reposets 0.4.1 → 0.4.2

package/README.md

@@ -1,8 +1,9 @@
 # reposets
 
-[![npm version](https://img.shields.io/npm/v/reposets)](https://www.npmjs.com/package/reposets)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![TypeScript](https://img.shields.io/badge/TypeScript-6.0-blue.svg)](https://www.typescriptlang.org/)
+[![npm](https://img.shields.io/npm/v/reposets?label=npm&color=cb3837)](https://www.npmjs.com/package/reposets)
+[![License: MIT](https://img.shields.io/badge/License-MIT-4caf50.svg)](https://opensource.org/licenses/MIT)
+[![Node.js %3E%3D24.11.0](https://img.shields.io/badge/Node.js-%3E%3D24.11.0-5fa04e.svg)](https://nodejs.org/)
+[![TypeScript 6.0](https://img.shields.io/badge/TypeScript-6.0-3178c6.svg)](https://www.typescriptlang.org/)
 
 Declarative GitHub repository management. Define your repo settings, secrets, variables, rulesets, deployment environments, advanced security toggles, and CodeQL default setup in a TOML config file, then apply them across all your repositories with a single command.
 
@@ -22,26 +23,26 @@ Managing repository settings by hand doesn't scale. When you have dozens of repo
 - **Cleanup policies** — Automatically remove undeclared resources per scope with optional preserve lists, so your repos converge to the declared state.
 - **Dry-run and validation** — Preview changes before applying, validate config locally without touching the GitHub API, and catch typos with built-in diagnostics.
 
-## Installation
+## Install
 
-```sh
+```bash
 npm install -g reposets
 ```
 
 Alternative (no install):
 
-```sh
+```bash
 npx reposets <command>
 ```
 
-Requires Node.js >= 20.
+Requires the Node.js version shown in the badge above.
 
-## Quick Start
+## Quick start
 
 1. Run `reposets init` to scaffold config files.
 2. Add a credential profile:
 
-   ```sh
+   ```bash
    reposets credentials create --profile personal --github-token ghp_...
    ```
 
@@ -61,19 +62,19 @@ Requires Node.js >= 20.
 
 4. Validate your config:
 
-   ```sh
+   ```bash
    reposets validate
    ```
 
 5. Preview changes without applying them:
 
-   ```sh
+   ```bash
    reposets sync --dry-run
    ```
 
 6. Apply the config:
 
-   ```sh
+   ```bash
    reposets sync
    ```
 
@@ -105,7 +106,7 @@ Config lookup order (first match wins):
 
 See the [docs/](https://github.com/spencerbeggs/reposets/tree/main/docs) folder for full reference on configuration, credentials, secrets, rulesets, environments, cleanup, and token setup.
 
-## Token Permissions
+## Token permissions
 
 reposets requires a fine-grained personal access token with:
 
@@ -137,4 +138,4 @@ Full reference guides are available in the [`docs/`](https://github.com/spencerb
 
 ## License
 
-[MIT](./LICENSE)
+[MIT](LICENSE)

package/bin/reposets.d.ts

@@ -0,0 +1 @@
+export { };

package/bin/reposets.js

@@ -1,516 +1,34 @@
 #!/usr/bin/env node
-import { Command, Options } from "@effect/cli";
+import { credentialsCommand } from "../cli/commands/credentials.js";
+import { doctorCommand } from "../cli/commands/doctor.js";
+import { initCommand } from "../cli/commands/init.js";
+import { listCommand } from "../cli/commands/list.js";
+import { syncCommand } from "../cli/commands/sync.js";
+import { validateCommand } from "../cli/commands/validate.js";
+import { Effect, LogLevel, Logger } from "effect";
+import { Command } from "@effect/cli";
 import { NodeContext, NodeRuntime } from "@effect/platform-node";
-import { Effect, Layer, LogLevel, Logger, Option } from "effect";
-import { AppDirs } from "xdg-effect";
-import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { parse } from "smol-toml";
-import { dirname, join } from "node:path";
-import { CredentialResolverLive, SyncEngineLive, ReposetsCredentialsFile, SyncLoggerLive, OnePasswordClientLive, GitHubClientLive, SyncEngine, makeConfigFilesLive, ReposetsConfigFile } from "../500.js";
-const EMPTY_CREDENTIALS = {
-    profiles: {}
-};
-const profileOption = Options.text("profile").pipe(Options.withDescription("Credential profile name"));
-const githubTokenOption = Options.text("github-token").pipe(Options.withDescription("GitHub personal access token"), Options.optional);
-const opTokenOption = Options.text("op-token").pipe(Options.withDescription("1Password service account token"), Options.optional);
-function redactToken(token) {
-    if (token.length <= 8) return "****";
-    return `${token.slice(0, 4)}...${token.slice(-4)}`;
-}
-const createCommand = Command.make("create", {
-    profile: profileOption,
-    githubToken: githubTokenOption,
-    opToken: opTokenOption
-}, ({ profile, githubToken, opToken })=>Effect.gen(function*() {
-        const appDirs = yield* AppDirs;
-        yield* appDirs.ensureConfig;
-        const credentialsFile = yield* ReposetsCredentialsFile;
-        const creds = yield* credentialsFile.loadOrDefault(EMPTY_CREDENTIALS);
-        if (creds.profiles[profile]) return void (yield* Effect.logError(`Profile '${profile}' already exists. Delete it first.`));
-        const newProfile = {};
-        if ("Some" === githubToken._tag) newProfile.github_token = githubToken.value;
-        if ("Some" === opToken._tag) newProfile.op_service_account_token = opToken.value;
-        if (!newProfile.github_token && !newProfile.op_service_account_token) return void (yield* Effect.logError("Provide at least --github-token or --op-token."));
-        yield* credentialsFile.update((current)=>({
-                profiles: {
-                    ...current.profiles,
-                    [profile]: {
-                        github_token: newProfile.github_token ?? "",
-                        ...newProfile
-                    }
-                }
-            }), EMPTY_CREDENTIALS);
-        yield* Effect.log(`Created profile '${profile}'.`);
-    }).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("Add a credential profile"));
-const listCredsCommand = Command.make("list", {}, ()=>Effect.gen(function*() {
-        const credentialsFile = yield* ReposetsCredentialsFile;
-        const creds = yield* credentialsFile.loadOrDefault(EMPTY_CREDENTIALS);
-        if (0 === Object.keys(creds.profiles).length) return void (yield* Effect.log("No credential profiles configured."));
-        for (const [name, profile] of Object.entries(creds.profiles)){
-            yield* Effect.log(`[${name}]`);
-            if (profile.github_token) yield* Effect.log(`  github_token: ${redactToken(profile.github_token)}`);
-            if (profile.op_service_account_token) yield* Effect.log(`  op_service_account_token: ${redactToken(profile.op_service_account_token)}`);
-            yield* Effect.log("");
-        }
-    }).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("List profiles (tokens redacted)"));
-const deleteCommand = Command.make("delete", {
-    profile: profileOption
-}, ({ profile })=>Effect.gen(function*() {
-        const appDirs = yield* AppDirs;
-        yield* appDirs.ensureConfig;
-        const credentialsFile = yield* ReposetsCredentialsFile;
-        const creds = yield* credentialsFile.loadOrDefault(EMPTY_CREDENTIALS);
-        if (!creds.profiles[profile]) return void (yield* Effect.logError(`Profile '${profile}' not found.`));
-        const { [profile]: _, ...remainingProfiles } = creds.profiles;
-        yield* credentialsFile.save({
-            profiles: remainingProfiles
-        });
-        yield* Effect.log(`Deleted profile '${profile}'.`);
-    }).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("Remove a profile"));
-const credentialsCommand = Command.make("credentials").pipe(Command.withDescription("Manage credential profiles"), Command.withSubcommands([
-    createCommand,
-    listCredsCommand,
-    deleteCommand
-]));
-const configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
-const KNOWN_CONFIG_KEYS = new Set([
-    "owner",
-    "log_level",
-    "settings",
-    "secrets",
-    "variables",
-    "rulesets",
-    "environments",
-    "security",
-    "code_scanning",
-    "groups"
-]);
-const KNOWN_GROUP_KEYS = new Set([
-    "owner",
-    "repos",
-    "credentials",
-    "settings",
-    "secrets",
-    "variables",
-    "rulesets",
-    "environments",
-    "security",
-    "code_scanning",
-    "cleanup"
-]);
-const KNOWN_CLEANUP_KEYS = new Set([
-    "secrets",
-    "variables",
-    "rulesets",
-    "environments"
-]);
-const KNOWN_CLEANUP_SECRETS_KEYS = new Set([
-    "actions",
-    "dependabot",
-    "codespaces",
-    "environments"
-]);
-const KNOWN_CLEANUP_VARIABLES_KEYS = new Set([
-    "actions",
-    "environments"
-]);
-function findClosestMatch(key, known) {
-    let best;
-    let bestDist = 1 / 0;
-    for (const candidate of known){
-        const dist = levenshtein(key, candidate);
-        if (dist < bestDist && dist <= 3) {
-            bestDist = dist;
-            best = candidate;
-        }
-    }
-    return best;
-}
-function levenshtein(a, b) {
-    const matrix = [];
-    for(let i = 0; i <= a.length; i++)matrix[i] = [
-        i
-    ];
-    for(let j = 0; j <= b.length; j++)matrix[0][j] = j;
-    for(let i = 1; i <= a.length; i++)for(let j = 1; j <= b.length; j++){
-        const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-        matrix[i][j] = Math.min(matrix[i - 1][j] + 1, matrix[i][j - 1] + 1, matrix[i - 1][j - 1] + cost);
-    }
-    return matrix[a.length][b.length];
-}
-const doctorCommand = Command.make("doctor", {
-    config: configOption
-}, ({ config })=>Effect.gen(function*() {
-        const configFile = yield* ReposetsConfigFile;
-        const discoverResult = yield* Effect.either(configFile.discover);
-        if ("Left" === discoverResult._tag) return void (yield* Effect.logError("No config found. Run 'reposets init' to create one."));
-        const sources = discoverResult.right;
-        if (0 === sources.length) return void (yield* Effect.logError("No config found. Run 'reposets init' to create one."));
-        const configPath = sources[0].path;
-        let raw;
-        try {
-            const configToml = readFileSync(configPath, "utf-8");
-            raw = parse(configToml);
-        } catch (err) {
-            yield* Effect.logError(`TOML parse error: ${err instanceof Error ? err.message : String(err)}`);
-            return;
-        }
-        let warnings = 0;
-        for (const key of Object.keys(raw))if (!KNOWN_CONFIG_KEYS.has(key)) {
-            const suggestion = findClosestMatch(key, KNOWN_CONFIG_KEYS);
-            const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
-            yield* Effect.log(`Warning: unknown top-level key '${key}'${hint}`);
-            warnings++;
-        }
-        const groups = raw.groups;
-        if (groups && "object" == typeof groups) {
-            for (const [groupName, group] of Object.entries(groups))if (group && "object" == typeof group) {
-                for (const key of Object.keys(group))if (!KNOWN_GROUP_KEYS.has(key)) {
-                    const suggestion = findClosestMatch(key, KNOWN_GROUP_KEYS);
-                    const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
-                    yield* Effect.log(`Warning: unknown key '${key}' in groups.${groupName}${hint}`);
-                    warnings++;
-                }
-            }
-        }
-        if (groups && "object" == typeof groups) for (const [groupName, group] of Object.entries(groups)){
-            if (!group || "object" != typeof group) continue;
-            const cleanup = group.cleanup;
-            if (!cleanup || "object" != typeof cleanup) continue;
-            const cleanupObj = cleanup;
-            const prefix = `groups.${groupName}.cleanup`;
-            for (const key of Object.keys(cleanupObj))if (!KNOWN_CLEANUP_KEYS.has(key)) {
-                const suggestion = findClosestMatch(key, KNOWN_CLEANUP_KEYS);
-                const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
-                yield* Effect.log(`Warning: unknown key '${key}' in ${prefix}${hint}`);
-                warnings++;
-            }
-            const secrets = cleanupObj.secrets;
-            if (secrets && "object" == typeof secrets) {
-                for (const key of Object.keys(secrets))if (!KNOWN_CLEANUP_SECRETS_KEYS.has(key)) {
-                    const suggestion = findClosestMatch(key, KNOWN_CLEANUP_SECRETS_KEYS);
-                    const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
-                    yield* Effect.log(`Warning: unknown key '${key}' in ${prefix}.secrets${hint}`);
-                    warnings++;
-                }
-            }
-            const variables = cleanupObj.variables;
-            if (variables && "object" == typeof variables) {
-                for (const key of Object.keys(variables))if (!KNOWN_CLEANUP_VARIABLES_KEYS.has(key)) {
-                    const suggestion = findClosestMatch(key, KNOWN_CLEANUP_VARIABLES_KEYS);
-                    const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
-                    yield* Effect.log(`Warning: unknown key '${key}' in ${prefix}.variables${hint}`);
-                    warnings++;
-                }
-            }
-        }
-        yield* Effect.log("Schema validation: passed");
-        yield* Effect.log("\nRequired fine-grained token permissions:");
-        yield* Effect.log("  Repository permissions > Administration (Read and write) -- settings sync");
-        yield* Effect.log("  Repository permissions > Secrets (Read and write) -- Actions secrets");
-        yield* Effect.log("  Repository permissions > Variables (Read and write) -- Actions variables");
-        yield* Effect.log("  Repository permissions > Environments (Read and write) -- environment sync");
-        yield* Effect.log("  Repository permissions > Code scanning alerts (Read and write) -- code_scanning sync");
-        yield* Effect.log("  Repository permissions > Dependabot alerts (Read and write) -- security feature sync");
-        yield* Effect.log("  Repository permissions > Secret scanning alerts (Read and write) -- secret scanning delegation");
-        yield* Effect.log("  Account permissions > GPG keys (Read and write) -- secrets encryption key");
-        yield* Effect.log("  Organization permissions > Members (Read) -- resolve team slugs (org-level only)");
-        if (0 === warnings) yield* Effect.log("\nNo unknown keys detected.");
-        else yield* Effect.log(`\n${warnings} warning(s) found.`);
-    }).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Deep config diagnostics with typo detection"));
-const projectOption = Options.boolean("project").pipe(Options.withDescription("Create config in current directory instead of XDG/home location"), Options.withDefault(false));
-const CONFIG_TEMPLATE = `# reposets configuration
-# See: https://github.com/spencerbeggs/reposets
-
-# Default owner for all groups (can be overridden per group)
-# owner = "your-github-username"
-
-# --- Settings groups ---
-# [settings.defaults]
-# has_wiki = false
-# has_issues = true
-# delete_branch_on_merge = true
-
-# --- Secret groups ---
-# Secrets can be file, value, or resolved kind:
-#
-# [secrets.from-files.file]
-# APP_KEY = "./private/app-key"
-#
-# [secrets.inline.value]
-# STATIC_SECRET = "my-secret"
-#
-# [secrets.from-creds.resolved]
-# NPM_TOKEN = "MY_NPM_TOKEN"
-
-# --- Variable groups ---
-# [variables.turbo.value]
-# DO_NOT_TRACK = "1"
-# TURBO_TELEMETRY_DISABLED = "1"
-#
-# [variables.bot.resolved]
-# APP_BOT_NAME = "MY_BOT_NAME"
-
-# --- Rulesets ---
-# [rulesets.default-branch]
-# name = "default-branch"
-# enforcement = "active"
-# target = "branch"
-#
-# [rulesets.default-branch.conditions.ref_name]
-# include = ["~DEFAULT_BRANCH"]
-# exclude = []
-#
-# [[rulesets.default-branch.rules]]
-# type = "deletion"
 
-# --- Advanced security ---
-# Nested inside a settings group (folded into the same PATCH /repos call).
-# Some fields are GHAS-licensed and only work on public repos or
-# private repos with a GHAS subscription. Org-only fields are silently
-# skipped on personal accounts.
-#
-# [settings.defaults.security_and_analysis]
-# secret_scanning = "enabled"
-# secret_scanning_push_protection = "enabled"
-# dependabot_security_updates = "enabled"
-
-# --- Security feature toggles ---
-# Dedicated PUT/DELETE endpoints; omit a key to leave it untouched.
-#
-# [security.oss-defaults]
-# vulnerability_alerts = true
-# automated_security_fixes = true
-# private_vulnerability_reporting = true
-
-# --- CodeQL default setup ---
-# Applies via PATCH /repos/{o}/{r}/code-scanning/default-setup.
-# Languages not detected in the repo are skipped with a warning.
-#
-# [code_scanning.oss-defaults]
-# state = "configured"
-# languages = ["javascript-typescript", "python"]
-# query_suite = "extended"
-# threat_model = "remote"
-
-# --- Cleanup defaults ---
-# [cleanup]
-# secrets = false
-# variables = false
-# rulesets = false
-
-# --- Groups ---
-# [groups.my-projects]
-# repos = ["repo-one", "repo-two"]
-# settings = ["defaults"]
-# secrets = { actions = ["from-files", "from-creds"] }
-# variables = { actions = ["turbo", "bot"] }
-# rulesets = ["default-branch"]
-# security = ["oss-defaults"]
-# code_scanning = ["oss-defaults"]
-`;
-const CREDENTIALS_TEMPLATE = `# reposets credentials (keep this file private)
-# See: https://github.com/spencerbeggs/reposets
-
-# [profiles.personal]
-# github_token = "ghp_your_token_here"
-# op_service_account_token = "ops_your_token_here"
-`;
-const CREDENTIALS_FILE = "reposets.credentials.toml";
-const CONFIG_FILE = "reposets.config.toml";
-const initCommand = Command.make("init", {
-    project: projectOption
-}, ({ project })=>Effect.gen(function*() {
-        const appDirs = yield* AppDirs;
-        const xdgConfigDir = yield* appDirs.config;
-        const targetDir = project ? process.cwd() : xdgConfigDir;
-        if (!existsSync(targetDir)) mkdirSync(targetDir, {
-            recursive: true
-        });
-        const configPath = join(targetDir, CONFIG_FILE);
-        const credsPath = join(targetDir, CREDENTIALS_FILE);
-        if (existsSync(configPath)) yield* Effect.log(`Config already exists: ${configPath}`);
-        else {
-            writeFileSync(configPath, CONFIG_TEMPLATE);
-            yield* Effect.log(`Created: ${configPath}`);
-        }
-        if (existsSync(credsPath)) yield* Effect.log(`Credentials already exists: ${credsPath}`);
-        else {
-            writeFileSync(credsPath, CREDENTIALS_TEMPLATE);
-            yield* Effect.log(`Created: ${credsPath}`);
-        }
-        if (project) {
-            const gitignorePath = join(targetDir, ".gitignore");
-            if (existsSync(gitignorePath)) {
-                const content = readFileSync(gitignorePath, "utf-8");
-                if (!content.includes(CREDENTIALS_FILE)) {
-                    appendFileSync(gitignorePath, `\n${CREDENTIALS_FILE}\n`);
-                    yield* Effect.log(`Added ${CREDENTIALS_FILE} to .gitignore`);
-                }
-            } else {
-                writeFileSync(gitignorePath, `${CREDENTIALS_FILE}\n`);
-                yield* Effect.log(`Created .gitignore with ${CREDENTIALS_FILE}`);
-            }
-        } else {
-            const gitignorePath = join(targetDir, ".gitignore");
-            if (!existsSync(gitignorePath)) {
-                writeFileSync(gitignorePath, `${CREDENTIALS_FILE}\n`);
-                yield* Effect.log(`Created .gitignore in ${targetDir}`);
-            }
-        }
-        yield* Effect.log("\nDone! Edit your config and credentials files to get started.");
-    }).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("Scaffold config files"));
-const list_configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
-const listCommand = Command.make("list", {
-    config: list_configOption
-}, ({ config })=>Effect.gen(function*() {
-        const configFile = yield* ReposetsConfigFile;
-        const sources = yield* configFile.discover;
-        if (0 === sources.length) return void (yield* Effect.logError("No config file found."));
-        const parsedConfig = sources[0].value;
-        const defaultOwner = parsedConfig.owner ?? "(not set)";
-        yield* Effect.log(`Default owner: ${defaultOwner}\n`);
-        for (const [groupName, group] of Object.entries(parsedConfig.groups)){
-            const owner = group.owner ?? parsedConfig.owner ?? "(not set)";
-            yield* Effect.log(`[${groupName}] (owner: ${owner})`);
-            for (const repo of group.repos)yield* Effect.log(`  - ${owner}/${repo}`);
-            if (group.settings?.length) yield* Effect.log(`  settings: ${group.settings.join(", ")}`);
-            if (group.environments?.length) yield* Effect.log(`  environments: ${group.environments.join(", ")}`);
-            if (group.secrets) {
-                const parts = [];
-                if (group.secrets.actions?.length) parts.push(`actions:[${group.secrets.actions.join(",")}]`);
-                if (group.secrets.dependabot?.length) parts.push(`dependabot:[${group.secrets.dependabot.join(",")}]`);
-                if (group.secrets.codespaces?.length) parts.push(`codespaces:[${group.secrets.codespaces.join(",")}]`);
-                if (group.secrets.environments) {
-                    for (const [envName, envGroups] of Object.entries(group.secrets.environments))if (envGroups.length) parts.push(`environments.${envName}:[${envGroups.join(",")}]`);
-                }
-                if (parts.length) yield* Effect.log(`  secrets: ${parts.join(", ")}`);
-            }
-            if (group.variables) {
-                const parts = [];
-                if (group.variables.actions?.length) parts.push(`actions:[${group.variables.actions.join(",")}]`);
-                if (group.variables.environments) {
-                    for (const [envName, envGroups] of Object.entries(group.variables.environments))if (envGroups.length) parts.push(`environments.${envName}:[${envGroups.join(",")}]`);
-                }
-                if (parts.length) yield* Effect.log(`  variables: ${parts.join(", ")}`);
-            }
-            if (group.rulesets?.length) yield* Effect.log(`  rulesets: ${group.rulesets.join(", ")}`);
-            if (group.security?.length) yield* Effect.log(`  security: ${group.security.join(", ")}`);
-            if (group.code_scanning?.length) yield* Effect.log(`  code_scanning: ${group.code_scanning.join(", ")}`);
-            if (group.credentials) yield* Effect.log(`  credentials: ${group.credentials}`);
-            yield* Effect.log("");
-        }
-    }).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Show config summary"));
-const sync_configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
-const groupOption = Options.text("group").pipe(Options.withDescription("Sync only a specific repo group"), Options.optional);
-const repoOption = Options.text("repo").pipe(Options.withDescription("Sync only a specific repo"), Options.optional);
-const dryRunOption = Options.boolean("dry-run").pipe(Options.withDescription("Preview changes without making them"), Options.withDefault(false));
-const noCleanupOption = Options.boolean("no-cleanup").pipe(Options.withDescription("Skip cleanup of undeclared resources"), Options.withDefault(false));
-const logLevelOption = Options.choice("log-level", [
-    "silent",
-    "info",
-    "verbose",
-    "debug"
-]).pipe(Options.withDescription("Set output verbosity (overrides log_level in config)"), Options.optional);
-const syncCommand = Command.make("sync", {
-    config: sync_configOption,
-    group: groupOption,
-    repo: repoOption,
-    dryRun: dryRunOption,
-    noCleanup: noCleanupOption,
-    logLevel: logLevelOption
-}, ({ config, group, repo, dryRun, noCleanup, logLevel: logLevelFlag })=>Effect.gen(function*() {
-        const configFile = yield* ReposetsConfigFile;
-        const sources = yield* configFile.discover;
-        if (0 === sources.length) return void (yield* Effect.logError("No config file found."));
-        const parsedConfig = sources[0].value;
-        const configDir = dirname(sources[0].path);
-        const credentialsFile = yield* ReposetsCredentialsFile;
-        const credentials = yield* credentialsFile.loadOrDefault({
-            profiles: {}
-        });
-        const profileNames = Object.keys(credentials.profiles);
-        const defaultProfile = 1 === profileNames.length ? profileNames[0] : void 0;
-        const token = defaultProfile ? credentials.profiles[defaultProfile]?.github_token : void 0;
-        if (!token) return void (yield* Effect.logError("No GitHub token found. Run 'reposets credentials create' first."));
-        const logLevel = "Some" === logLevelFlag._tag ? logLevelFlag.value : parsedConfig.log_level;
-        const githubLayer = GitHubClientLive(token);
-        const opLayer = OnePasswordClientLive;
-        const resolverLayer = Layer.provide(CredentialResolverLive, opLayer);
-        const loggerLayer = SyncLoggerLive({
-            dryRun,
-            logLevel
-        });
-        const engineLayer = Layer.provideMerge(SyncEngineLive, Layer.merge(Layer.merge(githubLayer, resolverLayer), loggerLayer));
-        const groupFilter = "Some" === group._tag ? group.value : void 0;
-        const repoFilter = "Some" === repo._tag ? repo.value : void 0;
-        if (dryRun && "silent" !== logLevel) yield* Effect.log("DRY RUN \u2014 no changes will be made\n");
-        yield* Effect.provide(Effect.gen(function*() {
-            const engine = yield* SyncEngine;
-            yield* engine.syncAll(parsedConfig, credentials, {
-                dryRun,
-                noCleanup,
-                groupFilter,
-                repoFilter,
-                configDir
-            });
-        }), engineLayer);
-    }).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Sync repos with GitHub"));
-const validate_configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
-const validateCommand = Command.make("validate", {
-    config: validate_configOption
-}, ({ config })=>Effect.gen(function*() {
-        const configFile = yield* ReposetsConfigFile;
-        let hasErrors = false;
-        const configResult = yield* Effect.either(configFile.discover);
-        if ("Left" === configResult._tag) return void (yield* Effect.logError(`Config validation failed: ${configResult.left.message}`));
-        const sources = configResult.right;
-        if (0 === sources.length) return void (yield* Effect.logError("No config file found."));
-        yield* Effect.log("Config schema: valid");
-        const parsedConfig = sources[0].value;
-        const configDir = dirname(sources[0].path);
-        for (const [groupName, group] of Object.entries(parsedConfig.secrets))if ("file" in group) for (const [entryName, filePath] of Object.entries(group.file)){
-            const fullPath = join(configDir, filePath);
-            if (!existsSync(fullPath)) {
-                yield* Effect.logError(`secrets.${groupName}.file.${entryName}: file not found: ${fullPath}`);
-                hasErrors = true;
-            }
-        }
-        for (const [groupName, group] of Object.entries(parsedConfig.variables))if ("file" in group) for (const [entryName, filePath] of Object.entries(group.file)){
-            const fullPath = join(configDir, filePath);
-            if (!existsSync(fullPath)) {
-                yield* Effect.logError(`variables.${groupName}.file.${entryName}: file not found: ${fullPath}`);
-                hasErrors = true;
-            }
-        }
-        const credentialsFile = yield* ReposetsCredentialsFile;
-        const credsResult = yield* Effect.either(credentialsFile.load);
-        if ("Left" === credsResult._tag) yield* Effect.log("Credentials file: not found (optional)");
-        else {
-            yield* Effect.log("Credentials schema: valid");
-            for (const [groupName, group] of Object.entries(parsedConfig.groups))if (group.credentials && !credsResult.right.profiles[group.credentials]) {
-                yield* Effect.logError(`Group '${groupName}': references unknown credentials profile '${group.credentials}'`);
-                hasErrors = true;
-            }
-        }
-        if (!hasErrors) yield* Effect.log("\nAll checks passed.");
-    }).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Validate config without API calls"));
-const CliLogger = Logger.replace(Logger.defaultLogger, Logger.make(({ logLevel, message })=>{
-    const text = "string" == typeof message ? message : String(message);
-    if (LogLevel.greaterThanEqual(logLevel, LogLevel.Error)) globalThis.console.error(text);
-    else globalThis.console.log(text);
+//#region src/cli/index.ts
+const CliLogger = Logger.replace(Logger.defaultLogger, Logger.make(({ logLevel, message }) => {
+	const text = typeof message === "string" ? message : String(message);
+	if (LogLevel.greaterThanEqual(logLevel, LogLevel.Error)) globalThis.console.error(text);
+	else globalThis.console.log(text);
 }));
 const rootCommand = Command.make("reposets").pipe(Command.withSubcommands([
-    syncCommand,
-    listCommand,
-    validateCommand,
-    doctorCommand,
-    initCommand,
-    credentialsCommand
+	syncCommand,
+	listCommand,
+	validateCommand,
+	doctorCommand,
+	initCommand,
+	credentialsCommand
 ]));
 const cli = Command.run(rootCommand, {
-    name: "reposets",
-    version: "0.0.0"
+	name: "reposets",
+	version: "0.0.0"
 });
-const program = Effect.suspend(()=>cli(process.argv)).pipe(Effect.provide(NodeContext.layer), Effect.provide(CliLogger));
+const program = Effect.suspend(() => cli(process.argv)).pipe(Effect.provide(NodeContext.layer), Effect.provide(CliLogger));
 NodeRuntime.runMain(program);
+
+//#endregion
+export {  };