reposets 0.4.0 → 0.4.2

package/schemas/ruleset.js

@@ -0,0 +1,545 @@
+import { taplo, tombi } from "xdg-effect";
+import { Schema } from "effect";
+
+//#region src/schemas/ruleset.ts
+const ResolvedRefSchema = Schema.Struct({ resolved: Schema.String.annotations({
+	title: "Credential label",
+	description: "Reference to a named value in the active credential profile's resolve section"
+}) }).annotations({
+	identifier: "ResolvedRef",
+	title: "Resolved reference",
+	description: "A reference to a credential-resolved value"
+});
+const ActorTypeSchema = Schema.Literal("Integration", "OrganizationAdmin", "RepositoryRole", "Team", "DeployKey").annotations({
+	title: "Actor type",
+	description: "The type of actor that can bypass a ruleset"
+});
+const BypassModeSchema = Schema.Literal("always", "pull_request", "exempt").annotations({
+	title: "Bypass mode",
+	description: "When the specified actor can bypass the ruleset"
+});
+const BypassActorSchema = Schema.Struct({
+	actor_id: Schema.optional(Schema.Union(Schema.Int, ResolvedRefSchema).annotations({
+		title: "Actor ID",
+		description: "The ID of the actor, or a { resolved } reference to a credential label."
+	})),
+	actor_type: ActorTypeSchema,
+	bypass_mode: Schema.optionalWith(BypassModeSchema, { default: () => "always" })
+}).annotations({
+	identifier: "BypassActor",
+	title: "Bypass actor",
+	description: "An actor that can bypass rules in a ruleset"
+});
+const RefNameConditionSchema = Schema.Struct({
+	include: Schema.optionalWith(Schema.Array(Schema.String).annotations({
+		title: "Include patterns",
+		description: "Ref name patterns to include. Accepts ~DEFAULT_BRANCH, ~ALL, or glob patterns.",
+		examples: [["~DEFAULT_BRANCH"]]
+	}), { default: () => [] }),
+	exclude: Schema.optionalWith(Schema.Array(Schema.String).annotations({
+		title: "Exclude patterns",
+		description: "Ref name patterns to exclude"
+	}), { default: () => [] })
+}).annotations({
+	identifier: "RefNameCondition",
+	title: "Ref name condition",
+	description: "Conditions for matching ref names (branches or tags)"
+});
+const RulesetConditionsSchema = Schema.Struct({ ref_name: Schema.optional(RefNameConditionSchema) }).annotations({
+	identifier: "RulesetConditions",
+	title: "Ruleset conditions",
+	description: "Conditions that determine when the ruleset applies"
+});
+const RequiredReviewerSchema = Schema.Struct({
+	file_patterns: Schema.Array(Schema.String).annotations({
+		title: "File patterns",
+		description: "File patterns this reviewer must approve (fnmatch syntax)"
+	}),
+	minimum_approvals: Schema.Int.annotations({
+		title: "Minimum approvals",
+		description: "Minimum approvals required from this team (0 = optional)"
+	}),
+	reviewer: Schema.Struct({
+		id: Schema.Int.annotations({
+			title: "Team ID",
+			description: "Team ID"
+		}),
+		type: Schema.Literal("Team")
+	}).annotations({ title: "Reviewer team" })
+});
+const StatusCheckSchema = Schema.Struct({
+	context: Schema.String.annotations({
+		title: "Context",
+		description: "The status check context name that must be present on the commit"
+	}),
+	integration_id: Schema.optional(Schema.Union(Schema.Int, ResolvedRefSchema).annotations({
+		title: "Integration ID",
+		description: "The integration ID, or a { resolved } reference to a credential label"
+	}))
+});
+const WorkflowFileSchema = Schema.Struct({
+	path: Schema.String.annotations({
+		title: "Workflow path",
+		description: "Path to the workflow file"
+	}),
+	ref: Schema.optional(Schema.String.annotations({
+		title: "Ref",
+		description: "Branch or tag of the workflow file"
+	})),
+	repository_id: Schema.Union(Schema.Int, ResolvedRefSchema).annotations({
+		title: "Repository ID",
+		description: "Repository ID, or a { resolved } reference to a credential label"
+	}),
+	sha: Schema.optional(Schema.String.annotations({
+		title: "SHA",
+		description: "Commit SHA of the workflow file"
+	}))
+});
+const TargetPatternSchema = Schema.Union(Schema.Struct({ include: Schema.String.annotations({
+	title: "Include pattern",
+	description: "Glob pattern to include"
+}) }), Schema.Struct({ exclude: Schema.String.annotations({
+	title: "Exclude pattern",
+	description: "Glob pattern to exclude"
+}) })).annotations({
+	identifier: "TargetPattern",
+	title: "Target pattern",
+	description: "An include or exclude pattern for ref matching"
+});
+const TargetsSchema = Schema.Union(Schema.Literal("default", "all").annotations({
+	title: "Target preset",
+	description: "'default' targets the default branch; 'all' targets all branches/tags"
+}), Schema.Array(TargetPatternSchema).annotations({
+	title: "Custom target patterns",
+	description: "Array of include/exclude patterns for fine-grained ref targeting"
+})).annotations({
+	identifier: "Targets",
+	title: "Targets shorthand",
+	description: "Shorthand for specifying ref_name conditions: 'default', 'all', or custom patterns"
+});
+const PullRequestsShorthandSchema = Schema.Struct({
+	approvals: Schema.optionalWith(Schema.Int.pipe(Schema.between(0, 10)).annotations({
+		title: "Required approvals",
+		description: "Number of approving reviews required (0-10)"
+	}), { default: () => 0 }),
+	dismiss_stale_reviews: Schema.optionalWith(Schema.Boolean.annotations({
+		title: "Dismiss stale reviews",
+		description: "Dismiss previous approvals when new commits are pushed"
+	}), { default: () => false }),
+	code_owner_review: Schema.optionalWith(Schema.Boolean.annotations({
+		title: "Code owner review",
+		description: "Require review from code owners for files they own"
+	}), { default: () => false }),
+	last_push_approval: Schema.optionalWith(Schema.Boolean.annotations({
+		title: "Last push approval",
+		description: "Most recent push must be approved by someone other than the pusher"
+	}), { default: () => false }),
+	resolve_threads: Schema.optionalWith(Schema.Boolean.annotations({
+		title: "Resolve threads",
+		description: "All review conversations must be resolved before merging"
+	}), { default: () => false }),
+	merge_methods: Schema.optional(Schema.Array(Schema.Literal("merge", "squash", "rebase")).annotations({
+		title: "Merge methods",
+		description: "Allowed merge methods. At least one must be enabled."
+	})),
+	reviewers: Schema.optional(Schema.Array(RequiredReviewerSchema).annotations({
+		title: "Required reviewers",
+		description: "Teams that must approve specific file patterns"
+	}))
+}).annotations({
+	identifier: "PullRequestsShorthand",
+	title: "Pull requests shorthand",
+	description: "Simplified pull request configuration (branch rulesets only)"
+});
+const StatusChecksShorthandSchema = Schema.Struct({
+	update_branch: Schema.optional(Schema.Boolean.annotations({
+		title: "Strict status checks",
+		description: "PRs must be tested with the latest code"
+	})),
+	on_creation: Schema.optional(Schema.Boolean.annotations({
+		title: "Enforce on create",
+		description: "When false, allows branch creation even if checks would prohibit it"
+	})),
+	default_integration_id: Schema.optional(Schema.Union(Schema.Int, ResolvedRefSchema).annotations({
+		title: "Default integration ID",
+		description: "Default integration ID applied to all checks that do not specify one"
+	})),
+	required: Schema.Array(StatusCheckSchema).annotations({
+		title: "Required checks",
+		description: "Status checks that must pass"
+	})
+}).annotations({
+	identifier: "StatusChecksShorthand",
+	title: "Status checks shorthand",
+	description: "Simplified status checks configuration"
+});
+const EnforcementSchema = Schema.Literal("disabled", "active", "evaluate").annotations({
+	title: "Enforcement level",
+	description: "disabled = off, active = enforced, evaluate = test mode (GitHub Enterprise only)"
+});
+const PatternEntrySchema = Schema.Struct({
+	operator: Schema.Literal("starts_with", "ends_with", "contains", "regex").annotations({
+		title: "Operator",
+		description: "The operator to use for matching"
+	}),
+	pattern: Schema.String.annotations({
+		title: "Pattern",
+		description: "The pattern to match"
+	}),
+	name: Schema.optional(Schema.String.annotations({
+		title: "Rule name",
+		description: "Display name for this pattern rule"
+	})),
+	negate: Schema.optional(Schema.Boolean.annotations({
+		title: "Negate",
+		description: "If true, the rule fails when the pattern matches"
+	}))
+}).annotations({
+	identifier: "PatternEntry",
+	title: "Pattern entry",
+	description: "A pattern matching rule with operator, pattern, and optional name/negate"
+});
+const MergeQueueShorthandSchema = Schema.Struct({
+	check_timeout: Schema.Int.pipe(Schema.between(1, 360)).annotations({
+		title: "Check timeout (minutes)",
+		description: "Max time for status checks to report"
+	}),
+	grouping: Schema.Literal("ALLGREEN", "HEADGREEN").annotations({
+		title: "Grouping strategy",
+		description: "Whether all commits or only the head commit must pass checks"
+	}),
+	max_build: Schema.Int.pipe(Schema.between(0, 100)).annotations({
+		title: "Max entries to build",
+		description: "Max queued PRs requesting checks simultaneously"
+	}),
+	max_merge: Schema.Int.pipe(Schema.between(0, 100)).annotations({
+		title: "Max entries to merge",
+		description: "Max PRs merged together in a group"
+	}),
+	merge_method: Schema.Literal("MERGE", "SQUASH", "REBASE").annotations({
+		title: "Merge method",
+		description: "Merge method for queued PRs"
+	}),
+	min_merge: Schema.Int.pipe(Schema.between(0, 100)).annotations({
+		title: "Min entries to merge",
+		description: "Min PRs merged together in a group"
+	}),
+	min_wait: Schema.Int.pipe(Schema.between(0, 360)).annotations({
+		title: "Min wait time (minutes)",
+		description: "Wait time for min group size after first PR is added"
+	})
+}).annotations({
+	identifier: "MergeQueueShorthand",
+	title: "Merge queue",
+	description: "Merge queue configuration"
+});
+const CopilotReviewShorthandSchema = Schema.Struct({
+	draft_prs: Schema.optional(Schema.Boolean.annotations({
+		title: "Review draft PRs",
+		description: "Review draft PRs before they are marked ready"
+	})),
+	on_push: Schema.optional(Schema.Boolean.annotations({
+		title: "Review on push",
+		description: "Review each new push to the PR"
+	}))
+}).annotations({
+	identifier: "CopilotReviewShorthand",
+	title: "Copilot review",
+	description: "Copilot code review configuration"
+});
+const CodeScanningEntrySchema = Schema.Struct({
+	tool: Schema.String.annotations({
+		title: "Tool name",
+		description: "Name of the code scanning tool"
+	}),
+	alerts: Schema.Literal("none", "errors", "errors_and_warnings", "all").annotations({
+		title: "Alerts threshold",
+		description: "Severity level at which alerts block updates"
+	}),
+	security_alerts: Schema.Literal("none", "critical", "high_or_higher", "medium_or_higher", "all").annotations({
+		title: "Security alerts threshold",
+		description: "Severity level at which security alerts block updates"
+	})
+}).annotations({
+	identifier: "CodeScanningEntry",
+	title: "Code scanning tool",
+	description: "A code scanning tool with alert thresholds"
+});
+const WorkflowsShorthandSchema = Schema.Struct({
+	on_creation: Schema.optional(Schema.Boolean.annotations({
+		title: "Enforce on creation",
+		description: "Enforce workflows when a branch is created (false = skip on creation)"
+	})),
+	required: Schema.Array(WorkflowFileSchema).annotations({
+		title: "Required workflows",
+		description: "Workflows that must pass for this rule"
+	})
+}).annotations({
+	identifier: "WorkflowsShorthand",
+	title: "Workflows",
+	description: "Required workflow configuration"
+});
+const sharedRulesetFields = {
+	name: Schema.String.annotations({
+		title: "Ruleset name",
+		description: "The name of the ruleset (used for matching when creating or updating)"
+	}),
+	enforcement: EnforcementSchema,
+	conditions: Schema.optional(RulesetConditionsSchema),
+	bypass_actors: Schema.optional(Schema.Array(BypassActorSchema)),
+	creation: Schema.optional(Schema.Boolean.annotations({
+		title: "Restrict creation",
+		description: "When true, adds a creation rule"
+	})),
+	update: Schema.optional(Schema.Boolean.annotations({
+		title: "Restrict updates",
+		description: "When true, adds an update rule with update_allows_fetch_and_merge: true"
+	})),
+	deletion: Schema.optional(Schema.Boolean.annotations({
+		title: "Restrict deletion",
+		description: "When true, adds a deletion rule"
+	})),
+	required_linear_history: Schema.optional(Schema.Boolean.annotations({
+		title: "Require linear history",
+		description: "When true, adds a required_linear_history rule"
+	})),
+	required_signatures: Schema.optional(Schema.Boolean.annotations({
+		title: "Require signatures",
+		description: "When true, adds a required_signatures rule"
+	})),
+	non_fast_forward: Schema.optional(Schema.Boolean.annotations({
+		title: "Prevent non-fast-forward",
+		description: "When true, adds a non_fast_forward rule"
+	})),
+	deployments: Schema.optional(Schema.Array(Schema.String).annotations({
+		title: "Required deployments",
+		description: "Deployment environments that must succeed; converts to required_deployments rule"
+	})),
+	targets: Schema.optional(TargetsSchema),
+	status_checks: Schema.optional(StatusChecksShorthandSchema),
+	commit_message: Schema.optional(Schema.Array(PatternEntrySchema).annotations({
+		title: "Commit message patterns",
+		description: "Commit message pattern rules"
+	})),
+	commit_author_email: Schema.optional(Schema.Array(PatternEntrySchema).annotations({
+		title: "Commit author email patterns",
+		description: "Commit author email pattern rules"
+	})),
+	committer_email: Schema.optional(Schema.Array(PatternEntrySchema).annotations({
+		title: "Committer email patterns",
+		description: "Committer email pattern rules"
+	}))
+};
+const BranchRulesetSchema = Schema.Struct({
+	...sharedRulesetFields,
+	type: Schema.Literal("branch").annotations({
+		title: "Ruleset type",
+		description: "This ruleset applies to branches"
+	}),
+	pull_requests: Schema.optional(PullRequestsShorthandSchema),
+	merge_queue: Schema.optional(MergeQueueShorthandSchema),
+	copilot_review: Schema.optional(CopilotReviewShorthandSchema),
+	code_scanning: Schema.optional(Schema.Array(CodeScanningEntrySchema).annotations({
+		title: "Code scanning tools",
+		description: "Code scanning tool requirements"
+	})),
+	workflows: Schema.optional(WorkflowsShorthandSchema),
+	branch_name: Schema.optional(Schema.Array(PatternEntrySchema).annotations({
+		title: "Branch name patterns",
+		description: "Branch name pattern rules"
+	}))
+}).annotations({
+	identifier: "BranchRuleset",
+	title: "Branch ruleset",
+	description: "A ruleset that applies to branches",
+	jsonSchema: {
+		...tombi({ tableKeysOrder: "schema" }),
+		...taplo({
+			initKeys: [
+				"name",
+				"type",
+				"enforcement",
+				"targets"
+			],
+			links: { key: "https://github.com/spencerbeggs/reposets/blob/main/docs/rulesets.md" }
+		})
+	}
+});
+const TagRulesetSchema = Schema.Struct({
+	...sharedRulesetFields,
+	type: Schema.Literal("tag").annotations({
+		title: "Ruleset type",
+		description: "This ruleset applies to tags"
+	}),
+	tag_name: Schema.optional(Schema.Array(PatternEntrySchema).annotations({
+		title: "Tag name patterns",
+		description: "Tag name pattern rules"
+	}))
+}).annotations({
+	identifier: "TagRuleset",
+	title: "Tag ruleset",
+	description: "A ruleset that applies to tags",
+	jsonSchema: {
+		...tombi({ tableKeysOrder: "schema" }),
+		...taplo({
+			initKeys: [
+				"name",
+				"type",
+				"enforcement",
+				"targets"
+			],
+			links: { key: "https://github.com/spencerbeggs/reposets/blob/main/docs/rulesets.md" }
+		})
+	}
+});
+const RulesetSchema = Schema.Union(BranchRulesetSchema, TagRulesetSchema).annotations({
+	identifier: "Ruleset",
+	title: "Repository ruleset",
+	description: "A set of rules to apply when specified conditions are met",
+	jsonSchema: taplo({ links: { key: "https://github.com/spencerbeggs/reposets/blob/main/docs/rulesets.md" } })
+});
+/**
+* Builds an API-compatible ruleset payload from the config-level Ruleset.
+* Converts all shorthand fields into the GitHub API rules array format.
+*/
+function buildRulesetPayload(ruleset) {
+	const rules = [];
+	if (ruleset.creation === true) rules.push({ type: "creation" });
+	if (ruleset.update === true) rules.push({
+		type: "update",
+		parameters: { update_allows_fetch_and_merge: true }
+	});
+	if (ruleset.deletion === true) rules.push({ type: "deletion" });
+	if (ruleset.required_linear_history === true) rules.push({ type: "required_linear_history" });
+	if (ruleset.required_signatures === true) rules.push({ type: "required_signatures" });
+	if (ruleset.non_fast_forward === true) rules.push({ type: "non_fast_forward" });
+	if (ruleset.deployments !== void 0 && ruleset.deployments.length > 0) rules.push({
+		type: "required_deployments",
+		parameters: { required_deployment_environments: ruleset.deployments }
+	});
+	if (ruleset.type === "branch" && ruleset.pull_requests !== void 0) {
+		const pr = ruleset.pull_requests;
+		rules.push({
+			type: "pull_request",
+			parameters: {
+				required_approving_review_count: pr.approvals,
+				dismiss_stale_reviews_on_push: pr.dismiss_stale_reviews,
+				require_code_owner_review: pr.code_owner_review,
+				require_last_push_approval: pr.last_push_approval,
+				required_review_thread_resolution: pr.resolve_threads,
+				...pr.merge_methods !== void 0 ? { allowed_merge_methods: pr.merge_methods } : {},
+				...pr.reviewers !== void 0 ? { required_reviewers: pr.reviewers } : {}
+			}
+		});
+	}
+	if (ruleset.status_checks !== void 0) {
+		const sc = ruleset.status_checks;
+		const checks = sc.required.map((check) => {
+			if (check.integration_id === void 0 && sc.default_integration_id !== void 0) return {
+				...check,
+				integration_id: sc.default_integration_id
+			};
+			return check;
+		});
+		rules.push({
+			type: "required_status_checks",
+			parameters: {
+				strict_required_status_checks_policy: sc.update_branch ?? true,
+				...sc.on_creation === false ? { do_not_enforce_on_create: true } : {},
+				required_status_checks: checks
+			}
+		});
+	}
+	if (ruleset.type === "branch" && ruleset.merge_queue !== void 0) {
+		const mq = ruleset.merge_queue;
+		rules.push({
+			type: "merge_queue",
+			parameters: {
+				check_response_timeout_minutes: mq.check_timeout,
+				grouping_strategy: mq.grouping,
+				max_entries_to_build: mq.max_build,
+				max_entries_to_merge: mq.max_merge,
+				merge_method: mq.merge_method,
+				min_entries_to_merge: mq.min_merge,
+				min_entries_to_merge_wait_minutes: mq.min_wait
+			}
+		});
+	}
+	if (ruleset.type === "branch" && ruleset.copilot_review !== void 0) {
+		const cr = ruleset.copilot_review;
+		rules.push({
+			type: "copilot_code_review",
+			parameters: {
+				...cr.draft_prs !== void 0 ? { review_draft_pull_requests: cr.draft_prs } : {},
+				...cr.on_push !== void 0 ? { review_on_push: cr.on_push } : {}
+			}
+		});
+	}
+	if (ruleset.type === "branch" && ruleset.code_scanning !== void 0) rules.push({
+		type: "code_scanning",
+		parameters: { code_scanning_tools: ruleset.code_scanning.map((entry) => ({
+			tool: entry.tool,
+			alerts_threshold: entry.alerts,
+			security_alerts_threshold: entry.security_alerts
+		})) }
+	});
+	if (ruleset.type === "branch" && ruleset.workflows !== void 0) {
+		const wf = ruleset.workflows;
+		rules.push({
+			type: "workflows",
+			parameters: {
+				...wf.on_creation === false ? { do_not_enforce_on_create: true } : {},
+				workflows: wf.required
+			}
+		});
+	}
+	for (const [field, ruleType] of [
+		["commit_message", "commit_message_pattern"],
+		["commit_author_email", "commit_author_email_pattern"],
+		["committer_email", "committer_email_pattern"]
+	]) {
+		const patterns = ruleset[field];
+		if (patterns !== void 0) for (const entry of patterns) rules.push({
+			type: ruleType,
+			parameters: entry
+		});
+	}
+	if (ruleset.type === "branch" && ruleset.branch_name !== void 0) for (const entry of ruleset.branch_name) rules.push({
+		type: "branch_name_pattern",
+		parameters: entry
+	});
+	if (ruleset.type === "tag" && ruleset.tag_name !== void 0) for (const entry of ruleset.tag_name) rules.push({
+		type: "tag_name_pattern",
+		parameters: entry
+	});
+	let conditions = ruleset.conditions;
+	if (ruleset.targets !== void 0) if (ruleset.targets === "default") conditions = { ref_name: {
+		include: ["~DEFAULT_BRANCH"],
+		exclude: []
+	} };
+	else if (ruleset.targets === "all") conditions = { ref_name: {
+		include: ["~ALL"],
+		exclude: []
+	} };
+	else {
+		const include = [];
+		const exclude = [];
+		for (const pattern of ruleset.targets) if ("include" in pattern) include.push(pattern.include);
+		else exclude.push(pattern.exclude);
+		conditions = { ref_name: {
+			include,
+			exclude
+		} };
+	}
+	return {
+		name: ruleset.name,
+		target: ruleset.type,
+		enforcement: ruleset.enforcement,
+		...conditions !== void 0 ? { conditions } : {},
+		...ruleset.bypass_actors !== void 0 ? { bypass_actors: ruleset.bypass_actors } : {},
+		...rules.length > 0 ? { rules } : {}
+	};
+}
+
+//#endregion
+export { BypassActorSchema, ResolvedRefSchema, RulesetSchema, buildRulesetPayload };

package/services/ConfigFiles.js

@@ -0,0 +1,119 @@
+import { ConfigSchema } from "../schemas/config.js";
+import { CredentialsSchema } from "../schemas/credentials.js";
+import { AppDirsConfig, ConfigError, ConfigFile, ExplicitPath, FirstMatch, StaticDir, TomlCodec, UpwardWalk, XdgConfigLive, XdgConfigResolver, XdgSavePath } from "xdg-effect";
+import { Effect, Option } from "effect";
+import { existsSync, statSync } from "node:fs";
+
+//#region src/services/ConfigFiles.ts
+const CONFIG_FILENAME = "reposets.config.toml";
+const CREDENTIALS_FILENAME = "reposets.credentials.toml";
+const ReposetsConfigFile = ConfigFile.Tag("reposets/Config");
+const ReposetsCredentialsFile = ConfigFile.Tag("reposets/Credentials");
+/**
+* Validates all internal cross-references in a parsed config. Checks that
+* every group's settings, secrets, variables, rulesets, and environments
+* references point to defined top-level sections, and that environment-scoped
+* secret/variable groups reference defined environments. Collects ALL errors
+* into a single ConfigError.
+*/
+function validateConfigRefs(config) {
+	const errors = [];
+	const definedSettings = new Set(Object.keys(config.settings));
+	const definedSecrets = new Set(Object.keys(config.secrets));
+	const definedVariables = new Set(Object.keys(config.variables));
+	const definedRulesets = new Set(Object.keys(config.rulesets));
+	const definedEnvironments = new Set(Object.keys(config.environments));
+	const definedSecurity = new Set(Object.keys(config.security));
+	const definedCodeScanning = new Set(Object.keys(config.code_scanning));
+	for (const [groupName, group] of Object.entries(config.groups)) {
+		if (group.settings) {
+			for (const ref of group.settings) if (!definedSettings.has(ref)) errors.push(`group '${groupName}': unknown settings group '${ref}'`);
+		}
+		if (group.rulesets) {
+			for (const ref of group.rulesets) if (!definedRulesets.has(ref)) errors.push(`group '${groupName}': unknown ruleset '${ref}'`);
+		}
+		if (group.environments) {
+			for (const ref of group.environments) if (!definedEnvironments.has(ref)) errors.push(`group '${groupName}': unknown environment '${ref}'`);
+		}
+		if (group.security) {
+			for (const ref of group.security) if (!definedSecurity.has(ref)) errors.push(`group '${groupName}': unknown security group '${ref}'`);
+		}
+		if (group.code_scanning) {
+			for (const ref of group.code_scanning) if (!definedCodeScanning.has(ref)) errors.push(`group '${groupName}': unknown code_scanning group '${ref}'`);
+		}
+		if (group.secrets) {
+			if (group.secrets.actions) {
+				for (const ref of group.secrets.actions) if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': unknown secrets group '${ref}'`);
+			}
+			if (group.secrets.dependabot) {
+				for (const ref of group.secrets.dependabot) if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': unknown secrets group '${ref}'`);
+			}
+			if (group.secrets.codespaces) {
+				for (const ref of group.secrets.codespaces) if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': unknown secrets group '${ref}'`);
+			}
+			if (group.secrets.environments) for (const [envName, secretGroups] of Object.entries(group.secrets.environments)) {
+				if (!definedEnvironments.has(envName)) errors.push(`group '${groupName}': unknown environment '${envName}' in secrets.environments`);
+				for (const ref of secretGroups) if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': in secrets.environments.'${envName}': unknown secrets group '${ref}'`);
+			}
+		}
+		if (group.variables) {
+			if (group.variables.actions) {
+				for (const ref of group.variables.actions) if (!definedVariables.has(ref)) errors.push(`group '${groupName}': unknown variables group '${ref}'`);
+			}
+			if (group.variables.environments) for (const [envName, varGroups] of Object.entries(group.variables.environments)) {
+				if (!definedEnvironments.has(envName)) errors.push(`group '${groupName}': unknown environment '${envName}' in variables.environments`);
+				for (const ref of varGroups) if (!definedVariables.has(ref)) errors.push(`group '${groupName}': in variables.environments.'${envName}': unknown variables group '${ref}'`);
+			}
+		}
+	}
+	if (errors.length > 0) return Effect.fail(new ConfigError({
+		operation: "validate",
+		reason: errors.join("\n")
+	}));
+	return Effect.succeed(config);
+}
+/**
+* Creates a live Layer providing both config and credentials file services.
+* When configFlag is Some and points to a directory, prepends StaticDir resolver.
+* When configFlag is Some and points to a file, prepends ExplicitPath resolver.
+* Always includes UpwardWalk + XdgConfigResolver as fallback resolvers.
+* Passes validateConfigRefs as the validate callback on the config spec.
+*/
+function makeConfigFilesLive(configFlag) {
+	const configResolvers = [];
+	if (Option.isSome(configFlag)) {
+		const flag = configFlag.value;
+		if (existsSync(flag) && statSync(flag).isDirectory()) configResolvers.push(StaticDir({
+			dir: flag,
+			filename: CONFIG_FILENAME
+		}));
+		else configResolvers.push(ExplicitPath(flag));
+	}
+	configResolvers.push(UpwardWalk({ filename: CONFIG_FILENAME }), XdgConfigResolver({ filename: CONFIG_FILENAME }));
+	return XdgConfigLive.multi({
+		app: new AppDirsConfig({ namespace: "reposets" }),
+		configs: [{
+			tag: ReposetsConfigFile,
+			schema: ConfigSchema,
+			codec: TomlCodec,
+			strategy: FirstMatch,
+			resolvers: configResolvers,
+			validate: validateConfigRefs
+		}, {
+			tag: ReposetsCredentialsFile,
+			schema: CredentialsSchema,
+			codec: TomlCodec,
+			strategy: FirstMatch,
+			resolvers: [UpwardWalk({ filename: CREDENTIALS_FILENAME }), XdgConfigResolver({ filename: CREDENTIALS_FILENAME })],
+			defaultPath: XdgSavePath(CREDENTIALS_FILENAME)
+		}]
+	});
+}
+/**
+* Default ConfigFiles layer with no --config flag override.
+* Used by CLI entrypoint when no flag is provided.
+*/
+const ConfigFilesLive = makeConfigFilesLive(Option.none());
+
+//#endregion
+export { CONFIG_FILENAME, CREDENTIALS_FILENAME, ConfigFilesLive, ReposetsConfigFile, ReposetsCredentialsFile, makeConfigFilesLive, validateConfigRefs };