reposets 0.2.0 → 0.3.0

package/500.js

@@ -1,9 +1,9 @@
 import { Context, Data, Effect, Layer, Option, Ref, Schema } from "effect";
 import { blake2b } from "blakejs";
 import tweetnacl from "tweetnacl";
-import { AppDirsConfig, ConfigError, ConfigFile, FirstMatch, Jsonifiable, TomlCodec, UpwardWalk, XdgConfig, XdgConfigLive, XdgSavePath, taplo, tombi } from "xdg-effect";
+import { AppDirsConfig, ConfigError, ConfigFile, ExplicitPath, FirstMatch, Jsonifiable, StaticDir, TomlCodec, UpwardWalk, XdgConfigLive, XdgConfigResolver, XdgSavePath, taplo, tombi } from "xdg-effect";
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { isAbsolute, resolve } from "node:path";
 import { Octokit } from "@octokit/rest";
 class ResolveError extends Data.TaggedError("ResolveError") {
 }
@@ -704,16 +704,11 @@ const RulesetSchema = Schema.Union(BranchRulesetSchema, TagRulesetSchema).annota
     identifier: "Ruleset",
     title: "Repository ruleset",
     description: "A set of rules to apply when specified conditions are met",
-    jsonSchema: {
-        ...tombi({
-            tableKeysOrder: "schema"
-        }),
-        ...taplo({
-            links: {
-                key: "https://github.com/spencerbeggs/reposets/blob/main/docs/rulesets.md"
-            }
-        })
-    }
+    jsonSchema: taplo({
+        links: {
+            key: "https://github.com/spencerbeggs/reposets/blob/main/docs/rulesets.md"
+        }
+    })
 });
 function buildRulesetPayload(ruleset) {
     const rules = [];
@@ -1372,64 +1367,101 @@ const CONFIG_FILENAME = "reposets.config.toml";
 const CREDENTIALS_FILENAME = "reposets.credentials.toml";
 const ReposetsConfigFile = ConfigFile.Tag("reposets/Config");
 const ReposetsCredentialsFile = ConfigFile.Tag("reposets/Credentials");
-const xdgLayer = XdgConfigLive({
-    app: new AppDirsConfig({
-        namespace: "reposets"
-    }),
-    config: {
-        tag: ReposetsConfigFile,
-        schema: ConfigSchema,
-        codec: TomlCodec,
-        strategy: FirstMatch,
-        resolvers: [
-            UpwardWalk({
-                filename: CONFIG_FILENAME
-            }),
-            XdgConfig({
-                filename: CONFIG_FILENAME
-            })
-        ]
+function validateConfigRefs(config) {
+    const errors = [];
+    const definedSettings = new Set(Object.keys(config.settings));
+    const definedSecrets = new Set(Object.keys(config.secrets));
+    const definedVariables = new Set(Object.keys(config.variables));
+    const definedRulesets = new Set(Object.keys(config.rulesets));
+    const definedEnvironments = new Set(Object.keys(config.environments));
+    for (const [groupName, group] of Object.entries(config.groups)){
+        if (group.settings) {
+            for (const ref of group.settings)if (!definedSettings.has(ref)) errors.push(`group '${groupName}': unknown settings group '${ref}'`);
+        }
+        if (group.rulesets) {
+            for (const ref of group.rulesets)if (!definedRulesets.has(ref)) errors.push(`group '${groupName}': unknown ruleset '${ref}'`);
+        }
+        if (group.environments) {
+            for (const ref of group.environments)if (!definedEnvironments.has(ref)) errors.push(`group '${groupName}': unknown environment '${ref}'`);
+        }
+        if (group.secrets) {
+            if (group.secrets.actions) {
+                for (const ref of group.secrets.actions)if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': unknown secrets group '${ref}'`);
+            }
+            if (group.secrets.dependabot) {
+                for (const ref of group.secrets.dependabot)if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': unknown secrets group '${ref}'`);
+            }
+            if (group.secrets.codespaces) {
+                for (const ref of group.secrets.codespaces)if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': unknown secrets group '${ref}'`);
+            }
+            if (group.secrets.environments) for (const [envName, secretGroups] of Object.entries(group.secrets.environments)){
+                if (!definedEnvironments.has(envName)) errors.push(`group '${groupName}': unknown environment '${envName}' in secrets.environments`);
+                for (const ref of secretGroups)if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': in secrets.environments.'${envName}': unknown secrets group '${ref}'`);
+            }
+        }
+        if (group.variables) {
+            if (group.variables.actions) {
+                for (const ref of group.variables.actions)if (!definedVariables.has(ref)) errors.push(`group '${groupName}': unknown variables group '${ref}'`);
+            }
+            if (group.variables.environments) for (const [envName, varGroups] of Object.entries(group.variables.environments)){
+                if (!definedEnvironments.has(envName)) errors.push(`group '${groupName}': unknown environment '${envName}' in variables.environments`);
+                for (const ref of varGroups)if (!definedVariables.has(ref)) errors.push(`group '${groupName}': in variables.environments.'${envName}': unknown variables group '${ref}'`);
+            }
+        }
     }
-});
-const credentialsLayer = ConfigFile.Live({
-    tag: ReposetsCredentialsFile,
-    schema: CredentialsSchema,
-    codec: TomlCodec,
-    strategy: FirstMatch,
-    resolvers: [
-        UpwardWalk({
-            filename: CREDENTIALS_FILENAME
-        }),
-        XdgConfig({
-            filename: CREDENTIALS_FILENAME
-        })
-    ],
-    defaultPath: XdgSavePath(CREDENTIALS_FILENAME)
-}).pipe(Layer.provide(xdgLayer));
-const ConfigFilesLive = Layer.mergeAll(xdgLayer, credentialsLayer);
-function resolveConfigFlag(configFlag) {
-    if (Option.isNone(configFlag)) return;
-    const flag = configFlag.value;
-    if (existsSync(flag) && statSync(flag).isDirectory()) return join(flag, CONFIG_FILENAME);
-    return flag;
+    if (errors.length > 0) return Effect.fail(new ConfigError({
+        operation: "validate",
+        reason: errors.join("\n")
+    }));
+    return Effect.succeed(config);
 }
-function loadConfigWithDir(configFile, configFlag) {
-    const resolved = resolveConfigFlag(configFlag);
-    if (resolved) return Effect.map(configFile.loadFrom(resolved), (config)=>({
-            config,
-            configDir: dirname(resolved)
-        }));
-    return Effect.flatMap(configFile.discover, (sources)=>{
-        if (0 === sources.length) return Effect.fail(new ConfigError({
-            operation: "discover",
-            reason: "No config file found"
+function makeConfigFilesLive(configFlag) {
+    const configResolvers = [];
+    if (Option.isSome(configFlag)) {
+        const flag = configFlag.value;
+        if (existsSync(flag) && statSync(flag).isDirectory()) configResolvers.push(StaticDir({
+            dir: flag,
+            filename: CONFIG_FILENAME
         }));
-        return Effect.succeed({
-            config: sources[0].value,
-            configDir: dirname(sources[0].path)
-        });
+        else configResolvers.push(ExplicitPath(flag));
+    }
+    configResolvers.push(UpwardWalk({
+        filename: CONFIG_FILENAME
+    }), XdgConfigResolver({
+        filename: CONFIG_FILENAME
+    }));
+    return XdgConfigLive.multi({
+        app: new AppDirsConfig({
+            namespace: "reposets"
+        }),
+        configs: [
+            {
+                tag: ReposetsConfigFile,
+                schema: ConfigSchema,
+                codec: TomlCodec,
+                strategy: FirstMatch,
+                resolvers: configResolvers,
+                validate: validateConfigRefs
+            },
+            {
+                tag: ReposetsCredentialsFile,
+                schema: CredentialsSchema,
+                codec: TomlCodec,
+                strategy: FirstMatch,
+                resolvers: [
+                    UpwardWalk({
+                        filename: CREDENTIALS_FILENAME
+                    }),
+                    XdgConfigResolver({
+                        filename: CREDENTIALS_FILENAME
+                    })
+                ],
+                defaultPath: XdgSavePath(CREDENTIALS_FILENAME)
+            }
+        ]
     });
 }
+const ConfigFilesLive = makeConfigFilesLive(Option.none());
 class OnePasswordClient extends Context.Tag("OnePasswordClient")() {
 }
 const OnePasswordClientLive = Layer.succeed(OnePasswordClient, {
@@ -2657,4 +2689,4 @@ const SyncEngineLive = Layer.effect(SyncEngine, Effect.gen(function*() {
         }
     };
 }));
-export { BypassActorSchema, CleanupSchema, CleanupScopeSchema, ConfigFilesLive, ConfigSchema, CredentialProfileSchema, CredentialResolver, CredentialResolverLive, CredentialsSchema, GitHubApiError, GitHubClient, GitHubClientLive, GitHubClientTest, GroupSchema, LogLevelSchema, OnePasswordClient, OnePasswordClientLive, OnePasswordClientTest, OnePasswordError, ReposetsConfigFile, ReposetsCredentialsFile, ResolveError, ResolveSectionSchema, ResolvedRefSchema, RulesetSchema, SecretGroupSchema, SyncEngine, SyncEngineLive, SyncError, SyncLogger, SyncLoggerLive, VariableGroupSchema, buildRulesetPayload, encryptSecret, loadConfigWithDir, resolveConfigFlag };
+export { BypassActorSchema, CONFIG_FILENAME, CREDENTIALS_FILENAME, CleanupSchema, CleanupScopeSchema, ConfigFilesLive, ConfigSchema, CredentialProfileSchema, CredentialResolver, CredentialResolverLive, CredentialsSchema, GitHubApiError, GitHubClient, GitHubClientLive, GitHubClientTest, GroupSchema, LogLevelSchema, OnePasswordClient, OnePasswordClientLive, OnePasswordClientTest, OnePasswordError, ReposetsConfigFile, ReposetsCredentialsFile, ResolveError, ResolveSectionSchema, ResolvedRefSchema, RulesetSchema, SecretGroupSchema, SyncEngine, SyncEngineLive, SyncError, SyncLogger, SyncLoggerLive, VariableGroupSchema, buildRulesetPayload, encryptSecret, makeConfigFilesLive, validateConfigRefs };

package/bin/reposets.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { Command, Options } from "@effect/cli";
 import { NodeContext, NodeRuntime } from "@effect/platform-node";
-import { Console, Effect, Layer } from "effect";
+import { Effect, Layer, LogLevel, Logger, Option } from "effect";
 import { AppDirs } from "xdg-effect";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
 import { parse } from "smol-toml";
-import { CredentialResolverLive, ReposetsCredentialsFile, SyncEngineLive, SyncLoggerLive, OnePasswordClientLive, GitHubClientLive, loadConfigWithDir, SyncEngine, ConfigFilesLive, ReposetsConfigFile } from "../500.js";
+import { dirname, join } from "node:path";
+import { CredentialResolverLive, SyncEngineLive, ReposetsCredentialsFile, SyncLoggerLive, OnePasswordClientLive, GitHubClientLive, SyncEngine, makeConfigFilesLive, ReposetsConfigFile } from "../500.js";
 const EMPTY_CREDENTIALS = {
     profiles: {}
 };
@@ -26,11 +26,11 @@ const createCommand = Command.make("create", {
         yield* appDirs.ensureConfig;
         const credentialsFile = yield* ReposetsCredentialsFile;
         const creds = yield* credentialsFile.loadOrDefault(EMPTY_CREDENTIALS);
-        if (creds.profiles[profile]) return void (yield* Console.error(`Profile '${profile}' already exists. Delete it first.`));
+        if (creds.profiles[profile]) return void (yield* Effect.logError(`Profile '${profile}' already exists. Delete it first.`));
         const newProfile = {};
         if ("Some" === githubToken._tag) newProfile.github_token = githubToken.value;
         if ("Some" === opToken._tag) newProfile.op_service_account_token = opToken.value;
-        if (!newProfile.github_token && !newProfile.op_service_account_token) return void (yield* Console.error("Provide at least --github-token or --op-token."));
+        if (!newProfile.github_token && !newProfile.op_service_account_token) return void (yield* Effect.logError("Provide at least --github-token or --op-token."));
         yield* credentialsFile.update((current)=>({
                 profiles: {
                     ...current.profiles,
@@ -40,19 +40,19 @@ const createCommand = Command.make("create", {
                     }
                 }
             }), EMPTY_CREDENTIALS);
-        yield* Console.log(`Created profile '${profile}'.`);
-    })).pipe(Command.withDescription("Add a credential profile"));
+        yield* Effect.log(`Created profile '${profile}'.`);
+    }).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("Add a credential profile"));
 const listCredsCommand = Command.make("list", {}, ()=>Effect.gen(function*() {
         const credentialsFile = yield* ReposetsCredentialsFile;
         const creds = yield* credentialsFile.loadOrDefault(EMPTY_CREDENTIALS);
-        if (0 === Object.keys(creds.profiles).length) return void (yield* Console.log("No credential profiles configured."));
+        if (0 === Object.keys(creds.profiles).length) return void (yield* Effect.log("No credential profiles configured."));
         for (const [name, profile] of Object.entries(creds.profiles)){
-            yield* Console.log(`[${name}]`);
-            if (profile.github_token) yield* Console.log(`  github_token: ${redactToken(profile.github_token)}`);
-            if (profile.op_service_account_token) yield* Console.log(`  op_service_account_token: ${redactToken(profile.op_service_account_token)}`);
-            yield* Console.log("");
+            yield* Effect.log(`[${name}]`);
+            if (profile.github_token) yield* Effect.log(`  github_token: ${redactToken(profile.github_token)}`);
+            if (profile.op_service_account_token) yield* Effect.log(`  op_service_account_token: ${redactToken(profile.op_service_account_token)}`);
+            yield* Effect.log("");
         }
-    })).pipe(Command.withDescription("List profiles (tokens redacted)"));
+    }).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("List profiles (tokens redacted)"));
 const deleteCommand = Command.make("delete", {
     profile: profileOption
 }, ({ profile })=>Effect.gen(function*() {
@@ -60,13 +60,13 @@ const deleteCommand = Command.make("delete", {
         yield* appDirs.ensureConfig;
         const credentialsFile = yield* ReposetsCredentialsFile;
         const creds = yield* credentialsFile.loadOrDefault(EMPTY_CREDENTIALS);
-        if (!creds.profiles[profile]) return void (yield* Console.error(`Profile '${profile}' not found.`));
+        if (!creds.profiles[profile]) return void (yield* Effect.logError(`Profile '${profile}' not found.`));
         const { [profile]: _, ...remainingProfiles } = creds.profiles;
         yield* credentialsFile.save({
             profiles: remainingProfiles
         });
-        yield* Console.log(`Deleted profile '${profile}'.`);
-    })).pipe(Command.withDescription("Remove a profile"));
+        yield* Effect.log(`Deleted profile '${profile}'.`);
+    }).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("Remove a profile"));
 const credentialsCommand = Command.make("credentials").pipe(Command.withDescription("Manage credential profiles"), Command.withSubcommands([
     createCommand,
     listCredsCommand,
@@ -138,23 +138,24 @@ const doctorCommand = Command.make("doctor", {
     config: configOption
 }, ({ config })=>Effect.gen(function*() {
         const configFile = yield* ReposetsConfigFile;
-        const discoverResult = yield* Effect.either(loadConfigWithDir(configFile, config));
-        if ("Left" === discoverResult._tag) return void (yield* Console.error("No config found. Run 'reposets init' to create one."));
-        const { configDir } = discoverResult.right;
-        const configPath = join(configDir, "reposets.config.toml");
+        const discoverResult = yield* Effect.either(configFile.discover);
+        if ("Left" === discoverResult._tag) return void (yield* Effect.logError("No config found. Run 'reposets init' to create one."));
+        const sources = discoverResult.right;
+        if (0 === sources.length) return void (yield* Effect.logError("No config found. Run 'reposets init' to create one."));
+        const configPath = sources[0].path;
         let raw;
         try {
             const configToml = readFileSync(configPath, "utf-8");
             raw = parse(configToml);
         } catch (err) {
-            yield* Console.error(`TOML parse error: ${err instanceof Error ? err.message : String(err)}`);
+            yield* Effect.logError(`TOML parse error: ${err instanceof Error ? err.message : String(err)}`);
             return;
         }
         let warnings = 0;
         for (const key of Object.keys(raw))if (!KNOWN_CONFIG_KEYS.has(key)) {
             const suggestion = findClosestMatch(key, KNOWN_CONFIG_KEYS);
             const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
-            yield* Console.log(`Warning: unknown top-level key '${key}'${hint}`);
+            yield* Effect.log(`Warning: unknown top-level key '${key}'${hint}`);
             warnings++;
         }
         const groups = raw.groups;
@@ -163,7 +164,7 @@ const doctorCommand = Command.make("doctor", {
                 for (const key of Object.keys(group))if (!KNOWN_GROUP_KEYS.has(key)) {
                     const suggestion = findClosestMatch(key, KNOWN_GROUP_KEYS);
                     const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
-                    yield* Console.log(`Warning: unknown key '${key}' in groups.${groupName}${hint}`);
+                    yield* Effect.log(`Warning: unknown key '${key}' in groups.${groupName}${hint}`);
                     warnings++;
                 }
             }
@@ -177,7 +178,7 @@ const doctorCommand = Command.make("doctor", {
             for (const key of Object.keys(cleanupObj))if (!KNOWN_CLEANUP_KEYS.has(key)) {
                 const suggestion = findClosestMatch(key, KNOWN_CLEANUP_KEYS);
                 const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
-                yield* Console.log(`Warning: unknown key '${key}' in ${prefix}${hint}`);
+                yield* Effect.log(`Warning: unknown key '${key}' in ${prefix}${hint}`);
                 warnings++;
             }
             const secrets = cleanupObj.secrets;
@@ -185,7 +186,7 @@ const doctorCommand = Command.make("doctor", {
                 for (const key of Object.keys(secrets))if (!KNOWN_CLEANUP_SECRETS_KEYS.has(key)) {
                     const suggestion = findClosestMatch(key, KNOWN_CLEANUP_SECRETS_KEYS);
                     const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
-                    yield* Console.log(`Warning: unknown key '${key}' in ${prefix}.secrets${hint}`);
+                    yield* Effect.log(`Warning: unknown key '${key}' in ${prefix}.secrets${hint}`);
                     warnings++;
                 }
             }
@@ -194,21 +195,21 @@ const doctorCommand = Command.make("doctor", {
                 for (const key of Object.keys(variables))if (!KNOWN_CLEANUP_VARIABLES_KEYS.has(key)) {
                     const suggestion = findClosestMatch(key, KNOWN_CLEANUP_VARIABLES_KEYS);
                     const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
-                    yield* Console.log(`Warning: unknown key '${key}' in ${prefix}.variables${hint}`);
+                    yield* Effect.log(`Warning: unknown key '${key}' in ${prefix}.variables${hint}`);
                     warnings++;
                 }
             }
         }
-        yield* Console.log("Schema validation: passed");
-        yield* Console.log("\nRequired fine-grained token permissions:");
-        yield* Console.log("  Repository permissions > Administration (Read and write) -- settings sync");
-        yield* Console.log("  Repository permissions > Secrets (Read and write) -- Actions secrets");
-        yield* Console.log("  Repository permissions > Variables (Read and write) -- Actions variables");
-        yield* Console.log("  Repository permissions > Environments (Read and write) -- environment sync");
-        yield* Console.log("  Account permissions > GPG keys (Read and write) -- secrets encryption key");
-        if (0 === warnings) yield* Console.log("\nNo unknown keys detected.");
-        else yield* Console.log(`\n${warnings} warning(s) found.`);
-    })).pipe(Command.withDescription("Deep config diagnostics with typo detection"));
+        yield* Effect.log("Schema validation: passed");
+        yield* Effect.log("\nRequired fine-grained token permissions:");
+        yield* Effect.log("  Repository permissions > Administration (Read and write) -- settings sync");
+        yield* Effect.log("  Repository permissions > Secrets (Read and write) -- Actions secrets");
+        yield* Effect.log("  Repository permissions > Variables (Read and write) -- Actions variables");
+        yield* Effect.log("  Repository permissions > Environments (Read and write) -- environment sync");
+        yield* Effect.log("  Account permissions > GPG keys (Read and write) -- secrets encryption key");
+        if (0 === warnings) yield* Effect.log("\nNo unknown keys detected.");
+        else yield* Effect.log(`\n${warnings} warning(s) found.`);
+    }).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Deep config diagnostics with typo detection"));
 const projectOption = Options.boolean("project").pipe(Options.withDescription("Create config in current directory instead of XDG/home location"), Options.withDefault(false));
 const CONFIG_TEMPLATE = `# reposets configuration
 # See: https://github.com/spencerbeggs/reposets
@@ -289,15 +290,15 @@ const initCommand = Command.make("init", {
         });
         const configPath = join(targetDir, CONFIG_FILE);
         const credsPath = join(targetDir, CREDENTIALS_FILE);
-        if (existsSync(configPath)) yield* Console.log(`Config already exists: ${configPath}`);
+        if (existsSync(configPath)) yield* Effect.log(`Config already exists: ${configPath}`);
         else {
             writeFileSync(configPath, CONFIG_TEMPLATE);
-            yield* Console.log(`Created: ${configPath}`);
+            yield* Effect.log(`Created: ${configPath}`);
         }
-        if (existsSync(credsPath)) yield* Console.log(`Credentials already exists: ${credsPath}`);
+        if (existsSync(credsPath)) yield* Effect.log(`Credentials already exists: ${credsPath}`);
         else {
             writeFileSync(credsPath, CREDENTIALS_TEMPLATE);
-            yield* Console.log(`Created: ${credsPath}`);
+            yield* Effect.log(`Created: ${credsPath}`);
         }
         if (project) {
             const gitignorePath = join(targetDir, ".gitignore");
@@ -305,35 +306,37 @@ const initCommand = Command.make("init", {
                 const content = readFileSync(gitignorePath, "utf-8");
                 if (!content.includes(CREDENTIALS_FILE)) {
                     appendFileSync(gitignorePath, `\n${CREDENTIALS_FILE}\n`);
-                    yield* Console.log(`Added ${CREDENTIALS_FILE} to .gitignore`);
+                    yield* Effect.log(`Added ${CREDENTIALS_FILE} to .gitignore`);
                 }
             } else {
                 writeFileSync(gitignorePath, `${CREDENTIALS_FILE}\n`);
-                yield* Console.log(`Created .gitignore with ${CREDENTIALS_FILE}`);
+                yield* Effect.log(`Created .gitignore with ${CREDENTIALS_FILE}`);
             }
         } else {
             const gitignorePath = join(targetDir, ".gitignore");
             if (!existsSync(gitignorePath)) {
                 writeFileSync(gitignorePath, `${CREDENTIALS_FILE}\n`);
-                yield* Console.log(`Created .gitignore in ${targetDir}`);
+                yield* Effect.log(`Created .gitignore in ${targetDir}`);
             }
         }
-        yield* Console.log("\nDone! Edit your config and credentials files to get started.");
-    })).pipe(Command.withDescription("Scaffold config files"));
+        yield* Effect.log("\nDone! Edit your config and credentials files to get started.");
+    }).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("Scaffold config files"));
 const list_configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
 const listCommand = Command.make("list", {
     config: list_configOption
 }, ({ config })=>Effect.gen(function*() {
         const configFile = yield* ReposetsConfigFile;
-        const { config: parsedConfig } = yield* loadConfigWithDir(configFile, config);
+        const sources = yield* configFile.discover;
+        if (0 === sources.length) return void (yield* Effect.logError("No config file found."));
+        const parsedConfig = sources[0].value;
         const defaultOwner = parsedConfig.owner ?? "(not set)";
-        yield* Console.log(`Default owner: ${defaultOwner}\n`);
+        yield* Effect.log(`Default owner: ${defaultOwner}\n`);
         for (const [groupName, group] of Object.entries(parsedConfig.groups)){
             const owner = group.owner ?? parsedConfig.owner ?? "(not set)";
-            yield* Console.log(`[${groupName}] (owner: ${owner})`);
-            for (const repo of group.repos)yield* Console.log(`  - ${owner}/${repo}`);
-            if (group.settings?.length) yield* Console.log(`  settings: ${group.settings.join(", ")}`);
-            if (group.environments?.length) yield* Console.log(`  environments: ${group.environments.join(", ")}`);
+            yield* Effect.log(`[${groupName}] (owner: ${owner})`);
+            for (const repo of group.repos)yield* Effect.log(`  - ${owner}/${repo}`);
+            if (group.settings?.length) yield* Effect.log(`  settings: ${group.settings.join(", ")}`);
+            if (group.environments?.length) yield* Effect.log(`  environments: ${group.environments.join(", ")}`);
             if (group.secrets) {
                 const parts = [];
                 if (group.secrets.actions?.length) parts.push(`actions:[${group.secrets.actions.join(",")}]`);
@@ -342,7 +345,7 @@ const listCommand = Command.make("list", {
                 if (group.secrets.environments) {
                     for (const [envName, envGroups] of Object.entries(group.secrets.environments))if (envGroups.length) parts.push(`environments.${envName}:[${envGroups.join(",")}]`);
                 }
-                if (parts.length) yield* Console.log(`  secrets: ${parts.join(", ")}`);
+                if (parts.length) yield* Effect.log(`  secrets: ${parts.join(", ")}`);
             }
             if (group.variables) {
                 const parts = [];
@@ -350,13 +353,13 @@ const listCommand = Command.make("list", {
                 if (group.variables.environments) {
                     for (const [envName, envGroups] of Object.entries(group.variables.environments))if (envGroups.length) parts.push(`environments.${envName}:[${envGroups.join(",")}]`);
                 }
-                if (parts.length) yield* Console.log(`  variables: ${parts.join(", ")}`);
+                if (parts.length) yield* Effect.log(`  variables: ${parts.join(", ")}`);
             }
-            if (group.rulesets?.length) yield* Console.log(`  rulesets: ${group.rulesets.join(", ")}`);
-            if (group.credentials) yield* Console.log(`  credentials: ${group.credentials}`);
-            yield* Console.log("");
+            if (group.rulesets?.length) yield* Effect.log(`  rulesets: ${group.rulesets.join(", ")}`);
+            if (group.credentials) yield* Effect.log(`  credentials: ${group.credentials}`);
+            yield* Effect.log("");
         }
-    })).pipe(Command.withDescription("Show config summary"));
+    }).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Show config summary"));
 const sync_configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
 const groupOption = Options.text("group").pipe(Options.withDescription("Sync only a specific repo group"), Options.optional);
 const repoOption = Options.text("repo").pipe(Options.withDescription("Sync only a specific repo"), Options.optional);
@@ -377,7 +380,10 @@ const syncCommand = Command.make("sync", {
     logLevel: logLevelOption
 }, ({ config, group, repo, dryRun, noCleanup, logLevel: logLevelFlag })=>Effect.gen(function*() {
         const configFile = yield* ReposetsConfigFile;
-        const { config: parsedConfig, configDir } = yield* loadConfigWithDir(configFile, config);
+        const sources = yield* configFile.discover;
+        if (0 === sources.length) return void (yield* Effect.logError("No config file found."));
+        const parsedConfig = sources[0].value;
+        const configDir = dirname(sources[0].path);
         const credentialsFile = yield* ReposetsCredentialsFile;
         const credentials = yield* credentialsFile.loadOrDefault({
             profiles: {}
@@ -385,7 +391,7 @@ const syncCommand = Command.make("sync", {
         const profileNames = Object.keys(credentials.profiles);
         const defaultProfile = 1 === profileNames.length ? profileNames[0] : void 0;
         const token = defaultProfile ? credentials.profiles[defaultProfile]?.github_token : void 0;
-        if (!token) return void (yield* Console.error("No GitHub token found. Run 'reposets credentials create' first."));
+        if (!token) return void (yield* Effect.logError("No GitHub token found. Run 'reposets credentials create' first."));
         const logLevel = "Some" === logLevelFlag._tag ? logLevelFlag.value : parsedConfig.log_level;
         const githubLayer = GitHubClientLive(token);
         const opLayer = OnePasswordClientLive;
@@ -397,7 +403,7 @@ const syncCommand = Command.make("sync", {
         const engineLayer = Layer.provideMerge(SyncEngineLive, Layer.merge(Layer.merge(githubLayer, resolverLayer), loggerLayer));
         const groupFilter = "Some" === group._tag ? group.value : void 0;
         const repoFilter = "Some" === repo._tag ? repo.value : void 0;
-        if (dryRun && "silent" !== logLevel) yield* Console.log("DRY RUN \u2014 no changes will be made\n");
+        if (dryRun && "silent" !== logLevel) yield* Effect.log("DRY RUN \u2014 no changes will be made\n");
         yield* Effect.provide(Effect.gen(function*() {
             const engine = yield* SyncEngine;
             yield* engine.syncAll(parsedConfig, credentials, {
@@ -408,82 +414,51 @@ const syncCommand = Command.make("sync", {
                 configDir
             });
         }), engineLayer);
-    })).pipe(Command.withDescription("Sync repos with GitHub"));
+    }).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Sync repos with GitHub"));
 const validate_configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
 const validateCommand = Command.make("validate", {
     config: validate_configOption
 }, ({ config })=>Effect.gen(function*() {
         const configFile = yield* ReposetsConfigFile;
         let hasErrors = false;
-        const configResult = yield* Effect.either(loadConfigWithDir(configFile, config));
-        if ("Left" === configResult._tag) return void (yield* Console.error(`Config validation failed: ${configResult.left.message}`));
-        yield* Console.log("Config schema: valid");
-        const { config: parsedConfig, configDir } = configResult.right;
-        for (const [groupName, group] of Object.entries(parsedConfig.groups)){
-            for (const ref of group.settings ?? [])if (!parsedConfig.settings?.[ref]) {
-                yield* Console.error(`Group '${groupName}': references unknown settings group '${ref}'`);
-                hasErrors = true;
-            }
-            const allSecretRefs = [
-                ...group.secrets?.actions ?? [],
-                ...group.secrets?.dependabot ?? [],
-                ...group.secrets?.codespaces ?? []
-            ];
-            for (const ref of allSecretRefs)if (!parsedConfig.secrets?.[ref]) {
-                yield* Console.error(`Group '${groupName}': references unknown secrets group '${ref}'`);
-                hasErrors = true;
-            }
-            for (const ref of group.variables?.actions ?? [])if (!parsedConfig.variables?.[ref]) {
-                yield* Console.error(`Group '${groupName}': references unknown variables group '${ref}'`);
-                hasErrors = true;
-            }
-            for (const ref of group.rulesets ?? [])if (!parsedConfig.rulesets?.[ref]) {
-                yield* Console.error(`Group '${groupName}': references unknown ruleset '${ref}'`);
-                hasErrors = true;
-            }
-            for (const ref of group.environments ?? [])if (!parsedConfig.environments?.[ref]) {
-                yield* Console.error(`Group '${groupName}': references unknown environment '${ref}'`);
-                hasErrors = true;
-            }
-            if (group.secrets?.environments) {
-                for (const [envName, groupRefs] of Object.entries(group.secrets.environments))for (const ref of groupRefs)if (!parsedConfig.secrets?.[ref]) {
-                    yield* Console.error(`Group '${groupName}': secrets.environments.${envName} references unknown secrets group '${ref}'`);
-                    hasErrors = true;
-                }
-            }
-            if (group.variables?.environments) {
-                for (const [envName, groupRefs] of Object.entries(group.variables.environments))for (const ref of groupRefs)if (!parsedConfig.variables?.[ref]) {
-                    yield* Console.error(`Group '${groupName}': variables.environments.${envName} references unknown variables group '${ref}'`);
-                    hasErrors = true;
-                }
-            }
-        }
+        const configResult = yield* Effect.either(configFile.discover);
+        if ("Left" === configResult._tag) return void (yield* Effect.logError(`Config validation failed: ${configResult.left.message}`));
+        const sources = configResult.right;
+        if (0 === sources.length) return void (yield* Effect.logError("No config file found."));
+        yield* Effect.log("Config schema: valid");
+        const parsedConfig = sources[0].value;
+        const configDir = dirname(sources[0].path);
         for (const [groupName, group] of Object.entries(parsedConfig.secrets))if ("file" in group) for (const [entryName, filePath] of Object.entries(group.file)){
             const fullPath = join(configDir, filePath);
             if (!existsSync(fullPath)) {
-                yield* Console.error(`secrets.${groupName}.file.${entryName}: file not found: ${fullPath}`);
+                yield* Effect.logError(`secrets.${groupName}.file.${entryName}: file not found: ${fullPath}`);
                 hasErrors = true;
             }
         }
         for (const [groupName, group] of Object.entries(parsedConfig.variables))if ("file" in group) for (const [entryName, filePath] of Object.entries(group.file)){
             const fullPath = join(configDir, filePath);
             if (!existsSync(fullPath)) {
-                yield* Console.error(`variables.${groupName}.file.${entryName}: file not found: ${fullPath}`);
+                yield* Effect.logError(`variables.${groupName}.file.${entryName}: file not found: ${fullPath}`);
                 hasErrors = true;
             }
         }
         const credentialsFile = yield* ReposetsCredentialsFile;
         const credsResult = yield* Effect.either(credentialsFile.load);
-        if ("Left" === credsResult._tag) yield* Console.log("Credentials file: not found (optional)");
+        if ("Left" === credsResult._tag) yield* Effect.log("Credentials file: not found (optional)");
         else {
-            yield* Console.log("Credentials schema: valid");
+            yield* Effect.log("Credentials schema: valid");
             for (const [groupName, group] of Object.entries(parsedConfig.groups))if (group.credentials && !credsResult.right.profiles[group.credentials]) {
-                yield* Console.error(`Group '${groupName}': references unknown credentials profile '${group.credentials}'`);
+                yield* Effect.logError(`Group '${groupName}': references unknown credentials profile '${group.credentials}'`);
                 hasErrors = true;
             }
         }
-        if (!hasErrors) yield* Console.log("\nAll checks passed.");
-    })).pipe(Command.withDescription("Validate config without API calls"));
+        if (!hasErrors) yield* Effect.log("\nAll checks passed.");
+    }).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Validate config without API calls"));
+const CliLogger = Logger.replace(Logger.defaultLogger, Logger.make(({ logLevel, message })=>{
+    const text = "string" == typeof message ? message : String(message);
+    if (LogLevel.greaterThanEqual(logLevel, LogLevel.Error)) globalThis.console.error(text);
+    else globalThis.console.log(text);
+}));
 const rootCommand = Command.make("reposets").pipe(Command.withSubcommands([
     syncCommand,
     listCommand,
@@ -496,5 +471,5 @@ const cli = Command.run(rootCommand, {
     name: "reposets",
     version: "0.0.0"
 });
-const program = Effect.suspend(()=>cli(process.argv)).pipe(Effect.provide(ConfigFilesLive), Effect.provide(NodeContext.layer));
+const program = Effect.suspend(()=>cli(process.argv)).pipe(Effect.provide(NodeContext.layer), Effect.provide(CliLogger));
 NodeRuntime.runMain(program);

package/index.d.ts

@@ -9,11 +9,12 @@
 
 import { AppDirs } from 'xdg-effect';
 import { ConfigFile } from 'xdg-effect';
-import type { ConfigFileService } from 'xdg-effect';
+import { ConfigFileService } from 'xdg-effect';
 import { Context } from 'effect';
 import { Effect } from 'effect';
 import { FileSystem } from '@effect/platform/FileSystem';
-import { Layer } from 'effect';
+import { Layer } from 'effect/Layer';
+import { Layer as Layer_2 } from 'effect';
 import { Option } from 'effect';
 import { Ref } from 'effect';
 import { Schema } from 'effect';
@@ -112,9 +113,15 @@ export declare const CleanupScopeSchema: Schema.Union<[typeof Schema.Boolean, Sc
 
 export declare type Config = typeof ConfigSchema.Type;
 
+export declare const CONFIG_FILENAME = "reposets.config.toml";
+
 export { ConfigFile }
 
-export declare const ConfigFilesLive: Layer.Layer<AppDirs | ConfigFileService<any> | XdgResolver, never, FileSystem>;
+/**
+ * Default ConfigFiles layer with no --config flag override.
+ * Used by CLI entrypoint when no flag is provided.
+ */
+export declare const ConfigFilesLive: Layer<AppDirs | ConfigFileService<any> | XdgResolver, never, FileSystem>;
 
 export declare const ConfigSchema: Schema.Struct<{
     owner: Schema.optional<Schema.SchemaClass<string, string, never>>;
@@ -478,7 +485,7 @@ export declare class CredentialResolver extends CredentialResolver_base {
 
 declare const CredentialResolver_base: Context.TagClass<CredentialResolver, "CredentialResolver", CredentialResolverService>;
 
-export declare const CredentialResolverLive: Layer.Layer<CredentialResolver, never, OnePasswordClient>;
+export declare const CredentialResolverLive: Layer_2.Layer<CredentialResolver, never, OnePasswordClient>;
 
 declare interface CredentialResolverService {
     readonly resolveAll: (profile: CredentialProfile, basePath: string) => Effect.Effect<Map<string, string>, ResolveError>;
@@ -486,6 +493,8 @@ declare interface CredentialResolverService {
 
 export declare type Credentials = typeof CredentialsSchema.Type;
 
+export declare const CREDENTIALS_FILENAME = "reposets.credentials.toml";
+
 export declare const CredentialsSchema: Schema.Struct<{
     profiles: Schema.optionalWith<Schema.Record$<typeof Schema.String, Schema.Struct<{
         github_token: Schema.SchemaClass<string, string, never>;
@@ -527,7 +536,7 @@ export declare class GitHubClient extends GitHubClient_base {
 
 declare const GitHubClient_base: Context.TagClass<GitHubClient, "GitHubClient", GitHubClientService>;
 
-export declare function GitHubClientLive(token: string): Layer.Layer<GitHubClient>;
+export declare function GitHubClientLive(token: string): Layer_2.Layer<GitHubClient>;
 
 declare interface GitHubClientService {
     readonly getOwnerType: (owner: string) => Effect.Effect<OwnerType, GitHubApiError>;
@@ -553,7 +562,7 @@ declare interface GitHubClientService {
 }
 
 export declare function GitHubClientTest(): {
-    layer: Layer.Layer<GitHubClient>;
+    layer: Layer_2.Layer<GitHubClient>;
     calls: () => RecordedCall[];
 };
 
@@ -636,35 +645,31 @@ export declare const GroupSchema: Schema.Struct<{
     }>>;
 }>;
 
-/**
- * Load config using the ConfigFileService. When a --config flag is provided,
- * uses loadFrom with the resolved path. Otherwise uses discover to get both
- * the config value and the file path (for configDir derivation).
- *
- * Returns config and configDir where configDir is the directory containing
- * the config file.
- */
-export declare function loadConfigWithDir(configFile: ConfigFileService<Config>, configFlag: Option.Option<string>): Effect.Effect<{
-    config: Config;
-    configDir: string;
-}, XdgConfigError>;
-
 export declare type LogLevel = typeof LogLevelSchema.Type;
 
 export declare const LogLevelSchema: Schema.Literal<["silent", "info", "verbose", "debug"]>;
 
+/**
+ * Creates a live Layer providing both config and credentials file services.
+ * When configFlag is Some and points to a directory, prepends StaticDir resolver.
+ * When configFlag is Some and points to a file, prepends ExplicitPath resolver.
+ * Always includes UpwardWalk + XdgConfigResolver as fallback resolvers.
+ * Passes validateConfigRefs as the validate callback on the config spec.
+ */
+export declare function makeConfigFilesLive(configFlag: Option.Option<string>): Layer<AppDirs | ConfigFileService<any> | XdgResolver, never, FileSystem>;
+
 export declare class OnePasswordClient extends OnePasswordClient_base {
 }
 
 declare const OnePasswordClient_base: Context.TagClass<OnePasswordClient, "OnePasswordClient", OnePasswordClientService>;
 
-export declare const OnePasswordClientLive: Layer.Layer<OnePasswordClient, never, never>;
+export declare const OnePasswordClientLive: Layer_2.Layer<OnePasswordClient, never, never>;
 
 declare interface OnePasswordClientService {
     readonly resolve: (reference: string, serviceAccountToken: string) => Effect.Effect<string, OnePasswordError>;
 }
 
-export declare function OnePasswordClientTest(stubs: Record<string, string>): Layer.Layer<OnePasswordClient>;
+export declare function OnePasswordClientTest(stubs: Record<string, string>): Layer_2.Layer<OnePasswordClient>;
 
 export declare class OnePasswordError extends OnePasswordError_base<{
     readonly message: string;
@@ -682,7 +687,7 @@ export declare interface RecordedCall {
     args: Record<string, unknown>;
 }
 
-export declare const ReposetsConfigFile: Tag<ConfigFileService<{
+export declare const ReposetsConfigFile: Tag<ConfigFileService<    {
 readonly owner?: string | undefined;
 readonly log_level: "debug" | "info" | "silent" | "verbose";
 readonly settings: {
@@ -991,7 +996,7 @@ readonly preserve: readonly string[];
 } | undefined;
 };
 };
-}>, ConfigFileService<{
+}>, ConfigFileService<    {
 readonly owner?: string | undefined;
 readonly log_level: "debug" | "info" | "silent" | "verbose";
 readonly settings: {
@@ -1302,7 +1307,7 @@ readonly preserve: readonly string[];
 };
 }>>;
 
-export declare const ReposetsCredentialsFile: Tag<ConfigFileService<{
+export declare const ReposetsCredentialsFile: Tag<ConfigFileService<    {
 readonly profiles: {
 readonly [x: string]: {
 readonly github_token: string;
@@ -1322,7 +1327,7 @@ readonly [x: string]: unknown;
 } | undefined;
 };
 };
-}>, ConfigFileService<{
+}>, ConfigFileService<    {
 readonly profiles: {
 readonly [x: string]: {
 readonly github_token: string;
@@ -1344,12 +1349,6 @@ readonly [x: string]: unknown;
 };
 }>>;
 
-/**
- * Resolves a --config flag to a file path. If the flag points to a directory,
- * appends the config filename. If omitted, returns undefined.
- */
-export declare function resolveConfigFlag(configFlag: Option.Option<string>): string | undefined;
-
 export declare type ResolvedRef = typeof ResolvedRefSchema.Type;
 
 export declare const ResolvedRefSchema: Schema.Struct<{
@@ -1613,7 +1612,7 @@ export declare class SyncEngine extends SyncEngine_base {
 
 declare const SyncEngine_base: Context.TagClass<SyncEngine, "SyncEngine", SyncEngineService>;
 
-export declare const SyncEngineLive: Layer.Layer<SyncEngine, never, CredentialResolver | GitHubClient | SyncLogger>;
+export declare const SyncEngineLive: Layer_2.Layer<SyncEngine, never, CredentialResolver | GitHubClient | SyncLogger>;
 
 declare interface SyncEngineService {
     readonly syncAll: (config: Config, credentials: Credentials, options: SyncOptions) => Effect.Effect<void, SyncError>;
@@ -1639,7 +1638,7 @@ export declare interface SyncLoggerConfig {
     readonly output?: Ref.Ref<string[]>;
 }
 
-export declare function SyncLoggerLive(config: SyncLoggerConfig): Layer.Layer<SyncLogger>;
+export declare function SyncLoggerLive(config: SyncLoggerConfig): Layer_2.Layer<SyncLogger>;
 
 declare interface SyncLoggerService {
     readonly groupStart: (name: string, repoCount: number) => Effect.Effect<void>;
@@ -1661,6 +1660,15 @@ declare interface SyncOptions {
     readonly configDir: string;
 }
 
+/**
+ * Validates all internal cross-references in a parsed config. Checks that
+ * every group's settings, secrets, variables, rulesets, and environments
+ * references point to defined top-level sections, and that environment-scoped
+ * secret/variable groups reference defined environments. Collects ALL errors
+ * into a single ConfigError.
+ */
+export declare function validateConfigRefs(config: Config): Effect.Effect<Config, XdgConfigError>;
+
 export declare type VariableGroup = typeof VariableGroupSchema.Type;
 
 export declare const VariableGroupSchema: Schema.Union<[Schema.Struct<{

package/index.js

@@ -1,2 +1,2 @@
-export { BypassActorSchema, CleanupSchema, CleanupScopeSchema, ConfigFilesLive, ConfigSchema, CredentialProfileSchema, CredentialResolver, CredentialResolverLive, CredentialsSchema, GitHubApiError, GitHubClient, GitHubClientLive, GitHubClientTest, GroupSchema, LogLevelSchema, OnePasswordClient, OnePasswordClientLive, OnePasswordClientTest, OnePasswordError, ReposetsConfigFile, ReposetsCredentialsFile, ResolveError, ResolveSectionSchema, ResolvedRefSchema, RulesetSchema, SecretGroupSchema, SyncEngine, SyncEngineLive, SyncError, SyncLogger, SyncLoggerLive, VariableGroupSchema, buildRulesetPayload, encryptSecret, loadConfigWithDir, resolveConfigFlag } from "./500.js";
+export { BypassActorSchema, CONFIG_FILENAME, CREDENTIALS_FILENAME, CleanupSchema, CleanupScopeSchema, ConfigFilesLive, ConfigSchema, CredentialProfileSchema, CredentialResolver, CredentialResolverLive, CredentialsSchema, GitHubApiError, GitHubClient, GitHubClientLive, GitHubClientTest, GroupSchema, LogLevelSchema, OnePasswordClient, OnePasswordClientLive, OnePasswordClientTest, OnePasswordError, ReposetsConfigFile, ReposetsCredentialsFile, ResolveError, ResolveSectionSchema, ResolvedRefSchema, RulesetSchema, SecretGroupSchema, SyncEngine, SyncEngineLive, SyncError, SyncLogger, SyncLoggerLive, VariableGroupSchema, buildRulesetPayload, encryptSecret, makeConfigFilesLive, validateConfigRefs } from "./500.js";
 export { AppDirs, ConfigError as XdgConfigError, ConfigFile } from "xdg-effect";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reposets",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "private": false,
   "description": "CLI tool to sync GitHub repo settings, secrets and rulesets across personal repositories",
   "keywords": [
@@ -54,7 +54,7 @@
     "effect": "^3.21.1",
     "smol-toml": ">=1.6.1",
     "tweetnacl": "^1.0.3",
-    "xdg-effect": "^0.3.1"
+    "xdg-effect": "^1.0.0"
   },
   "engines": {
     "node": ">=20.0.0"

package/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.58.5"
+      "packageVersion": "7.58.7"
     }
   ]
 }