reposets 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 C. Spencer Beggs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,132 @@
+# reposets
+
+[![npm version](https://img.shields.io/npm/v/reposets)](https://www.npmjs.com/package/reposets)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![TypeScript](https://img.shields.io/badge/TypeScript-6.0-blue.svg)](https://www.typescriptlang.org/)
+
+Declarative GitHub repository management. Define your repo settings, secrets, variables, rulesets, and deployment environments in a TOML config file, then apply them across all your repositories with a single command.
+
+## Why reposets
+
+Managing repository settings by hand doesn't scale. When you have dozens of repos that should share the same branch protection rules, CI secrets, and merge settings, clicking through the GitHub UI for each one is slow and error-prone. reposets lets you define that configuration once and sync it everywhere.
+
+## Features
+
+- **Git-committable config templates** — Your entire repo configuration lives in a TOML file that is safe to commit, review, and share. Sensitive values are never stored in the config itself.
+- **Resolvable values** — Secrets and integer fields reference named labels that resolve at sync time from 1Password, local files, or inline values in a separate credentials file. One config template works across environments.
+- **Multi-scope secret and variable management** — Assign the same secret group to Actions, Dependabot, Codespaces, and deployment environments with scoped targeting.
+- **Ruleset shorthand syntax** — Define branch and tag rulesets with compact inline syntax for pull request rules, status checks, and boolean flags instead of verbose API payloads.
+- **Deployment environment management** — Configure wait timers, reviewers, and branch policies for deployment environments alongside your other settings.
+- **Group-based targeting** — Organize repos into groups that share settings, secrets, variables, rulesets, and environments. Change the group config, sync once, and every repo updates.
+- **Cleanup policies** — Automatically remove undeclared resources per scope with optional preserve lists, so your repos converge to the declared state.
+- **Dry-run and validation** — Preview changes before applying, validate config locally without touching the GitHub API, and catch typos with built-in diagnostics.
+
+## Installation
+
+```sh
+npm install -g reposets
+```
+
+Alternative (no install):
+
+```sh
+npx reposets <command>
+```
+
+Requires Node.js >= 20.
+
+## Quick Start
+
+1. Run `reposets init` to scaffold config files.
+2. Add a credential profile:
+
+   ```sh
+   reposets credentials create --profile personal --github-token ghp_...
+   ```
+
+3. Edit `reposets.config.toml` with your repos and settings:
+
+   ```toml
+   owner = "your-username"
+
+   [settings.default]
+   has_wiki = false
+   delete_branch_on_merge = true
+
+   [groups.my-repos]
+   repos = ["repo-one", "repo-two"]
+   settings = ["default"]
+   ```
+
+4. Validate your config:
+
+   ```sh
+   reposets validate
+   ```
+
+5. Preview changes without applying them:
+
+   ```sh
+   reposets sync --dry-run
+   ```
+
+6. Apply the config:
+
+   ```sh
+   reposets sync
+   ```
+
+## Commands
+
+| Command | Description |
+| :--- | :--- |
+| `reposets sync` | Apply config to repos (supports --dry-run, --group, --repo, --no-cleanup) |
+| `reposets list` | Show config summary |
+| `reposets validate` | Validate config without API calls |
+| `reposets doctor` | Deep diagnostics with typo detection |
+| `reposets init` | Scaffold config files (--project for local) |
+| `reposets credentials` | Manage credential profiles (create, list, delete) |
+
+All commands accept `--log-level silent|info|verbose|debug`.
+
+## Configuration
+
+reposets uses two TOML files:
+
+- `reposets.config.toml` — defines settings, secrets, variables, rulesets, environments, and groups
+- `reposets.credentials.toml` — stores GitHub tokens and optional resolve sections for named values
+
+Config lookup order (first match wins):
+
+1. `--config` flag (explicit path or directory)
+2. Walk up from current directory looking for `reposets.config.toml`
+3. XDG fallback: `~/.config/reposets/reposets.config.toml`
+
+See the [docs/](https://github.com/spencerbeggs/reposets/tree/main/docs) folder for full reference on configuration, credentials, secrets, rulesets, environments, cleanup, and token setup.
+
+## Token Permissions
+
+reposets requires a fine-grained personal access token with:
+
+- Repository > Administration (Read and write)
+- Repository > Secrets (Read and write)
+- Repository > Variables (Read and write)
+- Repository > Environments (Read and write)
+- Account > GPG keys (Read and write)
+
+## Documentation
+
+Full reference guides are available in the [`docs/`](https://github.com/spencerbeggs/reposets/tree/main/docs) folder:
+
+- [Commands Reference](https://github.com/spencerbeggs/reposets/blob/main/docs/commands.md) - all commands, flags, and usage examples
+- [Configuration](https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md) - config file format, path resolution, and settings reference
+- [Credentials](https://github.com/spencerbeggs/reposets/blob/main/docs/credentials.md) - credential profiles, resolve sections, and 1Password integration
+- [Secrets and Variables](https://github.com/spencerbeggs/reposets/blob/main/docs/secrets-and-variables.md) - resource groups, three kinds (file/value/resolved), and scoping
+- [Rulesets](https://github.com/spencerbeggs/reposets/blob/main/docs/rulesets.md) - branch and tag ruleset configuration
+- [Environments](https://github.com/spencerbeggs/reposets/blob/main/docs/environments.md) - deployment environment setup
+- [Cleanup](https://github.com/spencerbeggs/reposets/blob/main/docs/cleanup.md) - automatic cleanup of undeclared resources
+- [Token Permissions](https://github.com/spencerbeggs/reposets/blob/main/docs/token-permissions.md) - GitHub PAT setup guide
+
+## License
+
+[MIT](./LICENSE)

package/bin/reposets.js

@@ -0,0 +1,500 @@
+#!/usr/bin/env node
+import { Command, Options } from "@effect/cli";
+import { NodeContext, NodeRuntime } from "@effect/platform-node";
+import { Console, Effect, Layer } from "effect";
+import { AppDirs } from "xdg-effect";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse } from "smol-toml";
+import { CredentialResolverLive, ReposetsCredentialsFile, SyncEngineLive, SyncLoggerLive, OnePasswordClientLive, GitHubClientLive, loadConfigWithDir, SyncEngine, ConfigFilesLive, ReposetsConfigFile } from "../500.js";
+const EMPTY_CREDENTIALS = {
+    profiles: {}
+};
+const profileOption = Options.text("profile").pipe(Options.withDescription("Credential profile name"));
+const githubTokenOption = Options.text("github-token").pipe(Options.withDescription("GitHub personal access token"), Options.optional);
+const opTokenOption = Options.text("op-token").pipe(Options.withDescription("1Password service account token"), Options.optional);
+function redactToken(token) {
+    if (token.length <= 8) return "****";
+    return `${token.slice(0, 4)}...${token.slice(-4)}`;
+}
+const createCommand = Command.make("create", {
+    profile: profileOption,
+    githubToken: githubTokenOption,
+    opToken: opTokenOption
+}, ({ profile, githubToken, opToken })=>Effect.gen(function*() {
+        const appDirs = yield* AppDirs;
+        yield* appDirs.ensureConfig;
+        const credentialsFile = yield* ReposetsCredentialsFile;
+        const creds = yield* credentialsFile.loadOrDefault(EMPTY_CREDENTIALS);
+        if (creds.profiles[profile]) return void (yield* Console.error(`Profile '${profile}' already exists. Delete it first.`));
+        const newProfile = {};
+        if ("Some" === githubToken._tag) newProfile.github_token = githubToken.value;
+        if ("Some" === opToken._tag) newProfile.op_service_account_token = opToken.value;
+        if (!newProfile.github_token && !newProfile.op_service_account_token) return void (yield* Console.error("Provide at least --github-token or --op-token."));
+        yield* credentialsFile.update((current)=>({
+                profiles: {
+                    ...current.profiles,
+                    [profile]: {
+                        github_token: newProfile.github_token ?? "",
+                        ...newProfile
+                    }
+                }
+            }), EMPTY_CREDENTIALS);
+        yield* Console.log(`Created profile '${profile}'.`);
+    })).pipe(Command.withDescription("Add a credential profile"));
+const listCredsCommand = Command.make("list", {}, ()=>Effect.gen(function*() {
+        const credentialsFile = yield* ReposetsCredentialsFile;
+        const creds = yield* credentialsFile.loadOrDefault(EMPTY_CREDENTIALS);
+        if (0 === Object.keys(creds.profiles).length) return void (yield* Console.log("No credential profiles configured."));
+        for (const [name, profile] of Object.entries(creds.profiles)){
+            yield* Console.log(`[${name}]`);
+            if (profile.github_token) yield* Console.log(`  github_token: ${redactToken(profile.github_token)}`);
+            if (profile.op_service_account_token) yield* Console.log(`  op_service_account_token: ${redactToken(profile.op_service_account_token)}`);
+            yield* Console.log("");
+        }
+    })).pipe(Command.withDescription("List profiles (tokens redacted)"));
+const deleteCommand = Command.make("delete", {
+    profile: profileOption
+}, ({ profile })=>Effect.gen(function*() {
+        const appDirs = yield* AppDirs;
+        yield* appDirs.ensureConfig;
+        const credentialsFile = yield* ReposetsCredentialsFile;
+        const creds = yield* credentialsFile.loadOrDefault(EMPTY_CREDENTIALS);
+        if (!creds.profiles[profile]) return void (yield* Console.error(`Profile '${profile}' not found.`));
+        const { [profile]: _, ...remainingProfiles } = creds.profiles;
+        yield* credentialsFile.save({
+            profiles: remainingProfiles
+        });
+        yield* Console.log(`Deleted profile '${profile}'.`);
+    })).pipe(Command.withDescription("Remove a profile"));
+const credentialsCommand = Command.make("credentials").pipe(Command.withDescription("Manage credential profiles"), Command.withSubcommands([
+    createCommand,
+    listCredsCommand,
+    deleteCommand
+]));
+const configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
+const KNOWN_CONFIG_KEYS = new Set([
+    "owner",
+    "log_level",
+    "settings",
+    "secrets",
+    "variables",
+    "rulesets",
+    "environments",
+    "groups"
+]);
+const KNOWN_GROUP_KEYS = new Set([
+    "owner",
+    "repos",
+    "credentials",
+    "settings",
+    "secrets",
+    "variables",
+    "rulesets",
+    "environments",
+    "cleanup"
+]);
+const KNOWN_CLEANUP_KEYS = new Set([
+    "secrets",
+    "variables",
+    "rulesets",
+    "environments"
+]);
+const KNOWN_CLEANUP_SECRETS_KEYS = new Set([
+    "actions",
+    "dependabot",
+    "codespaces",
+    "environments"
+]);
+const KNOWN_CLEANUP_VARIABLES_KEYS = new Set([
+    "actions",
+    "environments"
+]);
+function findClosestMatch(key, known) {
+    let best;
+    let bestDist = 1 / 0;
+    for (const candidate of known){
+        const dist = levenshtein(key, candidate);
+        if (dist < bestDist && dist <= 3) {
+            bestDist = dist;
+            best = candidate;
+        }
+    }
+    return best;
+}
+function levenshtein(a, b) {
+    const matrix = [];
+    for(let i = 0; i <= a.length; i++)matrix[i] = [
+        i
+    ];
+    for(let j = 0; j <= b.length; j++)matrix[0][j] = j;
+    for(let i = 1; i <= a.length; i++)for(let j = 1; j <= b.length; j++){
+        const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+        matrix[i][j] = Math.min(matrix[i - 1][j] + 1, matrix[i][j - 1] + 1, matrix[i - 1][j - 1] + cost);
+    }
+    return matrix[a.length][b.length];
+}
+const doctorCommand = Command.make("doctor", {
+    config: configOption
+}, ({ config })=>Effect.gen(function*() {
+        const configFile = yield* ReposetsConfigFile;
+        const discoverResult = yield* Effect.either(loadConfigWithDir(configFile, config));
+        if ("Left" === discoverResult._tag) return void (yield* Console.error("No config found. Run 'reposets init' to create one."));
+        const { configDir } = discoverResult.right;
+        const configPath = join(configDir, "reposets.config.toml");
+        let raw;
+        try {
+            const configToml = readFileSync(configPath, "utf-8");
+            raw = parse(configToml);
+        } catch (err) {
+            yield* Console.error(`TOML parse error: ${err instanceof Error ? err.message : String(err)}`);
+            return;
+        }
+        let warnings = 0;
+        for (const key of Object.keys(raw))if (!KNOWN_CONFIG_KEYS.has(key)) {
+            const suggestion = findClosestMatch(key, KNOWN_CONFIG_KEYS);
+            const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
+            yield* Console.log(`Warning: unknown top-level key '${key}'${hint}`);
+            warnings++;
+        }
+        const groups = raw.groups;
+        if (groups && "object" == typeof groups) {
+            for (const [groupName, group] of Object.entries(groups))if (group && "object" == typeof group) {
+                for (const key of Object.keys(group))if (!KNOWN_GROUP_KEYS.has(key)) {
+                    const suggestion = findClosestMatch(key, KNOWN_GROUP_KEYS);
+                    const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
+                    yield* Console.log(`Warning: unknown key '${key}' in groups.${groupName}${hint}`);
+                    warnings++;
+                }
+            }
+        }
+        if (groups && "object" == typeof groups) for (const [groupName, group] of Object.entries(groups)){
+            if (!group || "object" != typeof group) continue;
+            const cleanup = group.cleanup;
+            if (!cleanup || "object" != typeof cleanup) continue;
+            const cleanupObj = cleanup;
+            const prefix = `groups.${groupName}.cleanup`;
+            for (const key of Object.keys(cleanupObj))if (!KNOWN_CLEANUP_KEYS.has(key)) {
+                const suggestion = findClosestMatch(key, KNOWN_CLEANUP_KEYS);
+                const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
+                yield* Console.log(`Warning: unknown key '${key}' in ${prefix}${hint}`);
+                warnings++;
+            }
+            const secrets = cleanupObj.secrets;
+            if (secrets && "object" == typeof secrets) {
+                for (const key of Object.keys(secrets))if (!KNOWN_CLEANUP_SECRETS_KEYS.has(key)) {
+                    const suggestion = findClosestMatch(key, KNOWN_CLEANUP_SECRETS_KEYS);
+                    const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
+                    yield* Console.log(`Warning: unknown key '${key}' in ${prefix}.secrets${hint}`);
+                    warnings++;
+                }
+            }
+            const variables = cleanupObj.variables;
+            if (variables && "object" == typeof variables) {
+                for (const key of Object.keys(variables))if (!KNOWN_CLEANUP_VARIABLES_KEYS.has(key)) {
+                    const suggestion = findClosestMatch(key, KNOWN_CLEANUP_VARIABLES_KEYS);
+                    const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
+                    yield* Console.log(`Warning: unknown key '${key}' in ${prefix}.variables${hint}`);
+                    warnings++;
+                }
+            }
+        }
+        yield* Console.log("Schema validation: passed");
+        yield* Console.log("\nRequired fine-grained token permissions:");
+        yield* Console.log("  Repository permissions > Administration (Read and write) -- settings sync");
+        yield* Console.log("  Repository permissions > Secrets (Read and write) -- Actions secrets");
+        yield* Console.log("  Repository permissions > Variables (Read and write) -- Actions variables");
+        yield* Console.log("  Repository permissions > Environments (Read and write) -- environment sync");
+        yield* Console.log("  Account permissions > GPG keys (Read and write) -- secrets encryption key");
+        if (0 === warnings) yield* Console.log("\nNo unknown keys detected.");
+        else yield* Console.log(`\n${warnings} warning(s) found.`);
+    })).pipe(Command.withDescription("Deep config diagnostics with typo detection"));
+const projectOption = Options.boolean("project").pipe(Options.withDescription("Create config in current directory instead of XDG/home location"), Options.withDefault(false));
+const CONFIG_TEMPLATE = `# reposets configuration
+# See: https://github.com/spencerbeggs/reposets
+
+# Default owner for all groups (can be overridden per group)
+# owner = "your-github-username"
+
+# --- Settings groups ---
+# [settings.defaults]
+# has_wiki = false
+# has_issues = true
+# delete_branch_on_merge = true
+
+# --- Secret groups ---
+# Secrets can be file, value, or resolved kind:
+#
+# [secrets.from-files.file]
+# APP_KEY = "./private/app-key"
+#
+# [secrets.inline.value]
+# STATIC_SECRET = "my-secret"
+#
+# [secrets.from-creds.resolved]
+# NPM_TOKEN = "MY_NPM_TOKEN"
+
+# --- Variable groups ---
+# [variables.turbo.value]
+# DO_NOT_TRACK = "1"
+# TURBO_TELEMETRY_DISABLED = "1"
+#
+# [variables.bot.resolved]
+# APP_BOT_NAME = "MY_BOT_NAME"
+
+# --- Rulesets ---
+# [rulesets.default-branch]
+# name = "default-branch"
+# enforcement = "active"
+# target = "branch"
+#
+# [rulesets.default-branch.conditions.ref_name]
+# include = ["~DEFAULT_BRANCH"]
+# exclude = []
+#
+# [[rulesets.default-branch.rules]]
+# type = "deletion"
+
+# --- Cleanup defaults ---
+# [cleanup]
+# secrets = false
+# variables = false
+# rulesets = false
+
+# --- Groups ---
+# [groups.my-projects]
+# repos = ["repo-one", "repo-two"]
+# settings = ["defaults"]
+# secrets = { actions = ["from-files", "from-creds"] }
+# variables = { actions = ["turbo", "bot"] }
+# rulesets = ["default-branch"]
+`;
+const CREDENTIALS_TEMPLATE = `# reposets credentials (keep this file private)
+# See: https://github.com/spencerbeggs/reposets
+
+# [profiles.personal]
+# github_token = "ghp_your_token_here"
+# op_service_account_token = "ops_your_token_here"
+`;
+const CREDENTIALS_FILE = "reposets.credentials.toml";
+const CONFIG_FILE = "reposets.config.toml";
+const initCommand = Command.make("init", {
+    project: projectOption
+}, ({ project })=>Effect.gen(function*() {
+        const appDirs = yield* AppDirs;
+        const xdgConfigDir = yield* appDirs.config;
+        const targetDir = project ? process.cwd() : xdgConfigDir;
+        if (!existsSync(targetDir)) mkdirSync(targetDir, {
+            recursive: true
+        });
+        const configPath = join(targetDir, CONFIG_FILE);
+        const credsPath = join(targetDir, CREDENTIALS_FILE);
+        if (existsSync(configPath)) yield* Console.log(`Config already exists: ${configPath}`);
+        else {
+            writeFileSync(configPath, CONFIG_TEMPLATE);
+            yield* Console.log(`Created: ${configPath}`);
+        }
+        if (existsSync(credsPath)) yield* Console.log(`Credentials already exists: ${credsPath}`);
+        else {
+            writeFileSync(credsPath, CREDENTIALS_TEMPLATE);
+            yield* Console.log(`Created: ${credsPath}`);
+        }
+        if (project) {
+            const gitignorePath = join(targetDir, ".gitignore");
+            if (existsSync(gitignorePath)) {
+                const content = readFileSync(gitignorePath, "utf-8");
+                if (!content.includes(CREDENTIALS_FILE)) {
+                    appendFileSync(gitignorePath, `\n${CREDENTIALS_FILE}\n`);
+                    yield* Console.log(`Added ${CREDENTIALS_FILE} to .gitignore`);
+                }
+            } else {
+                writeFileSync(gitignorePath, `${CREDENTIALS_FILE}\n`);
+                yield* Console.log(`Created .gitignore with ${CREDENTIALS_FILE}`);
+            }
+        } else {
+            const gitignorePath = join(targetDir, ".gitignore");
+            if (!existsSync(gitignorePath)) {
+                writeFileSync(gitignorePath, `${CREDENTIALS_FILE}\n`);
+                yield* Console.log(`Created .gitignore in ${targetDir}`);
+            }
+        }
+        yield* Console.log("\nDone! Edit your config and credentials files to get started.");
+    })).pipe(Command.withDescription("Scaffold config files"));
+const list_configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
+const listCommand = Command.make("list", {
+    config: list_configOption
+}, ({ config })=>Effect.gen(function*() {
+        const configFile = yield* ReposetsConfigFile;
+        const { config: parsedConfig } = yield* loadConfigWithDir(configFile, config);
+        const defaultOwner = parsedConfig.owner ?? "(not set)";
+        yield* Console.log(`Default owner: ${defaultOwner}\n`);
+        for (const [groupName, group] of Object.entries(parsedConfig.groups)){
+            const owner = group.owner ?? parsedConfig.owner ?? "(not set)";
+            yield* Console.log(`[${groupName}] (owner: ${owner})`);
+            for (const repo of group.repos)yield* Console.log(`  - ${owner}/${repo}`);
+            if (group.settings?.length) yield* Console.log(`  settings: ${group.settings.join(", ")}`);
+            if (group.environments?.length) yield* Console.log(`  environments: ${group.environments.join(", ")}`);
+            if (group.secrets) {
+                const parts = [];
+                if (group.secrets.actions?.length) parts.push(`actions:[${group.secrets.actions.join(",")}]`);
+                if (group.secrets.dependabot?.length) parts.push(`dependabot:[${group.secrets.dependabot.join(",")}]`);
+                if (group.secrets.codespaces?.length) parts.push(`codespaces:[${group.secrets.codespaces.join(",")}]`);
+                if (group.secrets.environments) {
+                    for (const [envName, envGroups] of Object.entries(group.secrets.environments))if (envGroups.length) parts.push(`environments.${envName}:[${envGroups.join(",")}]`);
+                }
+                if (parts.length) yield* Console.log(`  secrets: ${parts.join(", ")}`);
+            }
+            if (group.variables) {
+                const parts = [];
+                if (group.variables.actions?.length) parts.push(`actions:[${group.variables.actions.join(",")}]`);
+                if (group.variables.environments) {
+                    for (const [envName, envGroups] of Object.entries(group.variables.environments))if (envGroups.length) parts.push(`environments.${envName}:[${envGroups.join(",")}]`);
+                }
+                if (parts.length) yield* Console.log(`  variables: ${parts.join(", ")}`);
+            }
+            if (group.rulesets?.length) yield* Console.log(`  rulesets: ${group.rulesets.join(", ")}`);
+            if (group.credentials) yield* Console.log(`  credentials: ${group.credentials}`);
+            yield* Console.log("");
+        }
+    })).pipe(Command.withDescription("Show config summary"));
+const sync_configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
+const groupOption = Options.text("group").pipe(Options.withDescription("Sync only a specific repo group"), Options.optional);
+const repoOption = Options.text("repo").pipe(Options.withDescription("Sync only a specific repo"), Options.optional);
+const dryRunOption = Options.boolean("dry-run").pipe(Options.withDescription("Preview changes without making them"), Options.withDefault(false));
+const noCleanupOption = Options.boolean("no-cleanup").pipe(Options.withDescription("Skip cleanup of undeclared resources"), Options.withDefault(false));
+const logLevelOption = Options.choice("log-level", [
+    "silent",
+    "info",
+    "verbose",
+    "debug"
+]).pipe(Options.withDescription("Set output verbosity (overrides log_level in config)"), Options.optional);
+const syncCommand = Command.make("sync", {
+    config: sync_configOption,
+    group: groupOption,
+    repo: repoOption,
+    dryRun: dryRunOption,
+    noCleanup: noCleanupOption,
+    logLevel: logLevelOption
+}, ({ config, group, repo, dryRun, noCleanup, logLevel: logLevelFlag })=>Effect.gen(function*() {
+        const configFile = yield* ReposetsConfigFile;
+        const { config: parsedConfig, configDir } = yield* loadConfigWithDir(configFile, config);
+        const credentialsFile = yield* ReposetsCredentialsFile;
+        const credentials = yield* credentialsFile.loadOrDefault({
+            profiles: {}
+        });
+        const profileNames = Object.keys(credentials.profiles);
+        const defaultProfile = 1 === profileNames.length ? profileNames[0] : void 0;
+        const token = defaultProfile ? credentials.profiles[defaultProfile]?.github_token : void 0;
+        if (!token) return void (yield* Console.error("No GitHub token found. Run 'reposets credentials create' first."));
+        const logLevel = "Some" === logLevelFlag._tag ? logLevelFlag.value : parsedConfig.log_level;
+        const githubLayer = GitHubClientLive(token);
+        const opLayer = OnePasswordClientLive;
+        const resolverLayer = Layer.provide(CredentialResolverLive, opLayer);
+        const loggerLayer = SyncLoggerLive({
+            dryRun,
+            logLevel
+        });
+        const engineLayer = Layer.provideMerge(SyncEngineLive, Layer.merge(Layer.merge(githubLayer, resolverLayer), loggerLayer));
+        const groupFilter = "Some" === group._tag ? group.value : void 0;
+        const repoFilter = "Some" === repo._tag ? repo.value : void 0;
+        if (dryRun && "silent" !== logLevel) yield* Console.log("DRY RUN \u2014 no changes will be made\n");
+        yield* Effect.provide(Effect.gen(function*() {
+            const engine = yield* SyncEngine;
+            yield* engine.syncAll(parsedConfig, credentials, {
+                dryRun,
+                noCleanup,
+                groupFilter,
+                repoFilter,
+                configDir
+            });
+        }), engineLayer);
+    })).pipe(Command.withDescription("Sync repos with GitHub"));
+const validate_configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
+const validateCommand = Command.make("validate", {
+    config: validate_configOption
+}, ({ config })=>Effect.gen(function*() {
+        const configFile = yield* ReposetsConfigFile;
+        let hasErrors = false;
+        const configResult = yield* Effect.either(loadConfigWithDir(configFile, config));
+        if ("Left" === configResult._tag) return void (yield* Console.error(`Config validation failed: ${configResult.left.message}`));
+        yield* Console.log("Config schema: valid");
+        const { config: parsedConfig, configDir } = configResult.right;
+        for (const [groupName, group] of Object.entries(parsedConfig.groups)){
+            for (const ref of group.settings ?? [])if (!parsedConfig.settings?.[ref]) {
+                yield* Console.error(`Group '${groupName}': references unknown settings group '${ref}'`);
+                hasErrors = true;
+            }
+            const allSecretRefs = [
+                ...group.secrets?.actions ?? [],
+                ...group.secrets?.dependabot ?? [],
+                ...group.secrets?.codespaces ?? []
+            ];
+            for (const ref of allSecretRefs)if (!parsedConfig.secrets?.[ref]) {
+                yield* Console.error(`Group '${groupName}': references unknown secrets group '${ref}'`);
+                hasErrors = true;
+            }
+            for (const ref of group.variables?.actions ?? [])if (!parsedConfig.variables?.[ref]) {
+                yield* Console.error(`Group '${groupName}': references unknown variables group '${ref}'`);
+                hasErrors = true;
+            }
+            for (const ref of group.rulesets ?? [])if (!parsedConfig.rulesets?.[ref]) {
+                yield* Console.error(`Group '${groupName}': references unknown ruleset '${ref}'`);
+                hasErrors = true;
+            }
+            for (const ref of group.environments ?? [])if (!parsedConfig.environments?.[ref]) {
+                yield* Console.error(`Group '${groupName}': references unknown environment '${ref}'`);
+                hasErrors = true;
+            }
+            if (group.secrets?.environments) {
+                for (const [envName, groupRefs] of Object.entries(group.secrets.environments))for (const ref of groupRefs)if (!parsedConfig.secrets?.[ref]) {
+                    yield* Console.error(`Group '${groupName}': secrets.environments.${envName} references unknown secrets group '${ref}'`);
+                    hasErrors = true;
+                }
+            }
+            if (group.variables?.environments) {
+                for (const [envName, groupRefs] of Object.entries(group.variables.environments))for (const ref of groupRefs)if (!parsedConfig.variables?.[ref]) {
+                    yield* Console.error(`Group '${groupName}': variables.environments.${envName} references unknown variables group '${ref}'`);
+                    hasErrors = true;
+                }
+            }
+        }
+        for (const [groupName, group] of Object.entries(parsedConfig.secrets))if ("file" in group) for (const [entryName, filePath] of Object.entries(group.file)){
+            const fullPath = join(configDir, filePath);
+            if (!existsSync(fullPath)) {
+                yield* Console.error(`secrets.${groupName}.file.${entryName}: file not found: ${fullPath}`);
+                hasErrors = true;
+            }
+        }
+        for (const [groupName, group] of Object.entries(parsedConfig.variables))if ("file" in group) for (const [entryName, filePath] of Object.entries(group.file)){
+            const fullPath = join(configDir, filePath);
+            if (!existsSync(fullPath)) {
+                yield* Console.error(`variables.${groupName}.file.${entryName}: file not found: ${fullPath}`);
+                hasErrors = true;
+            }
+        }
+        const credentialsFile = yield* ReposetsCredentialsFile;
+        const credsResult = yield* Effect.either(credentialsFile.load);
+        if ("Left" === credsResult._tag) yield* Console.log("Credentials file: not found (optional)");
+        else {
+            yield* Console.log("Credentials schema: valid");
+            for (const [groupName, group] of Object.entries(parsedConfig.groups))if (group.credentials && !credsResult.right.profiles[group.credentials]) {
+                yield* Console.error(`Group '${groupName}': references unknown credentials profile '${group.credentials}'`);
+                hasErrors = true;
+            }
+        }
+        if (!hasErrors) yield* Console.log("\nAll checks passed.");
+    })).pipe(Command.withDescription("Validate config without API calls"));
+const rootCommand = Command.make("reposets").pipe(Command.withSubcommands([
+    syncCommand,
+    listCommand,
+    validateCommand,
+    doctorCommand,
+    initCommand,
+    credentialsCommand
+]));
+const cli = Command.run(rootCommand, {
+    name: "reposets",
+    version: "0.0.0"
+});
+const program = Effect.suspend(()=>cli(process.argv)).pipe(Effect.provide(ConfigFilesLive), Effect.provide(NodeContext.layer));
+NodeRuntime.runMain(program);