reposets 0.4.1 → 0.4.2

package/500.js

@@ -1,3354 +0,0 @@
-import { Context, Data, Effect, Layer, Option, Ref, Schema } from "effect";
-import { blake2b } from "blakejs";
-import tweetnacl from "tweetnacl";
-import { AppDirsConfig, ConfigError, ConfigFile, ExplicitPath, FirstMatch, Jsonifiable, StaticDir, TomlCodec, UpwardWalk, XdgConfigLive, XdgConfigResolver, XdgSavePath, taplo, tombi } from "xdg-effect";
-import { existsSync, readFileSync, statSync } from "node:fs";
-import { isAbsolute, resolve } from "node:path";
-import { Octokit } from "@octokit/rest";
-class ResolveError extends Data.TaggedError("ResolveError") {
-}
-class OnePasswordError extends Data.TaggedError("OnePasswordError") {
-}
-class GitHubApiError extends Data.TaggedError("GitHubApiError") {
-}
-class SyncError extends Data.TaggedError("SyncError") {
-}
-function encryptSecret(publicKey, secretValue) {
-    const messageBytes = Buffer.from(secretValue);
-    const publicKeyBytes = Buffer.from(publicKey, "base64");
-    const ephemeralKeyPair = tweetnacl.box.keyPair();
-    const nonceInput = new Uint8Array(64);
-    nonceInput.set(ephemeralKeyPair.publicKey);
-    nonceInput.set(publicKeyBytes, 32);
-    const nonce = blake2b(nonceInput, void 0, 24);
-    const ciphertext = tweetnacl.box(messageBytes, nonce, publicKeyBytes, ephemeralKeyPair.secretKey);
-    const sealed = new Uint8Array(ephemeralKeyPair.publicKey.length + ciphertext.length);
-    sealed.set(ephemeralKeyPair.publicKey);
-    sealed.set(ciphertext, ephemeralKeyPair.publicKey.length);
-    return Buffer.from(sealed).toString("base64");
-}
-const ResourceFileKind = Schema.Struct({
-    file: Schema.Record({
-        key: Schema.String,
-        value: Schema.String
-    }).annotations({
-        title: "File entries",
-        description: "Named entries with file path values, resolved relative to config directory",
-        jsonSchema: tombi({
-            additionalKeyLabel: "name"
-        })
-    })
-});
-const ResourceValueKind = Schema.Struct({
-    value: Schema.Record({
-        key: Schema.String,
-        value: Schema.Union(Schema.String, Schema.Record({
-            key: Schema.String,
-            value: Jsonifiable
-        }))
-    }).annotations({
-        title: "Value entries",
-        description: "Named entries with inline values. Strings used as-is, objects JSON-stringified.",
-        jsonSchema: tombi({
-            additionalKeyLabel: "name"
-        })
-    })
-});
-const ResourceResolvedKind = Schema.Struct({
-    resolved: Schema.Record({
-        key: Schema.String,
-        value: Schema.String
-    }).annotations({
-        title: "Resolved entries",
-        description: "Named entries mapped to credential labels. Values come from the active credential profile.",
-        jsonSchema: tombi({
-            additionalKeyLabel: "name"
-        })
-    })
-});
-const SecretGroupSchema = Schema.Union(ResourceFileKind, ResourceValueKind, ResourceResolvedKind).annotations({
-    identifier: "SecretGroup",
-    title: "Secret group",
-    description: "A group of secrets. Must be exactly one kind: file, value, or resolved.",
-    jsonSchema: taplo({
-        links: {
-            key: "https://github.com/spencerbeggs/reposets/blob/main/docs/secrets-and-variables.md"
-        }
-    })
-});
-const VariableGroupSchema = Schema.Union(ResourceFileKind, ResourceValueKind, ResourceResolvedKind).annotations({
-    identifier: "VariableGroup",
-    title: "Variable group",
-    description: "A group of variables. Must be exactly one kind: file, value, or resolved.",
-    jsonSchema: taplo({
-        links: {
-            key: "https://github.com/spencerbeggs/reposets/blob/main/docs/secrets-and-variables.md"
-        }
-    })
-});
-const CleanupScopeSchema = Schema.Union(Schema.Boolean, Schema.Struct({
-    preserve: Schema.Array(Schema.String).annotations({
-        title: "Preserve list",
-        description: "Resource names that should never be deleted during cleanup",
-        examples: [
-            [
-                "LEGACY_TOKEN",
-                "DEPLOY_KEY"
-            ]
-        ]
-    })
-})).annotations({
-    identifier: "CleanupScope",
-    title: "Cleanup scope",
-    description: "Controls cleanup for a single resource scope. false disables cleanup, true enables full cleanup, or specify names to preserve."
-});
-const CleanupSecretsSchema = Schema.Struct({
-    actions: Schema.optionalWith(CleanupScopeSchema, {
-        default: ()=>false
-    }).annotations({
-        title: "Clean up Actions secrets",
-        description: "Delete Actions secrets not declared in any referenced secret group",
-        default: false
-    }),
-    dependabot: Schema.optionalWith(CleanupScopeSchema, {
-        default: ()=>false
-    }).annotations({
-        title: "Clean up Dependabot secrets",
-        description: "Delete Dependabot secrets not declared in any referenced secret group",
-        default: false
-    }),
-    codespaces: Schema.optionalWith(CleanupScopeSchema, {
-        default: ()=>false
-    }).annotations({
-        title: "Clean up Codespaces secrets",
-        description: "Delete Codespaces secrets not declared in any referenced secret group",
-        default: false
-    }),
-    environments: Schema.optionalWith(CleanupScopeSchema, {
-        default: ()=>false
-    }).annotations({
-        title: "Clean up environment secrets",
-        description: "Delete environment secrets not declared in any referenced secret group",
-        default: false
-    })
-}).annotations({
-    identifier: "CleanupSecrets",
-    title: "Secrets cleanup configuration",
-    description: "Controls deletion of secrets by scope (Actions, Dependabot, Codespaces, environments)."
-});
-const CleanupVariablesSchema = Schema.Struct({
-    actions: Schema.optionalWith(CleanupScopeSchema, {
-        default: ()=>false
-    }).annotations({
-        title: "Clean up Actions variables",
-        description: "Delete Actions variables not declared in any referenced variable group",
-        default: false
-    }),
-    environments: Schema.optionalWith(CleanupScopeSchema, {
-        default: ()=>false
-    }).annotations({
-        title: "Clean up environment variables",
-        description: "Delete environment variables not declared in any referenced variable group",
-        default: false
-    })
-}).annotations({
-    identifier: "CleanupVariables",
-    title: "Variables cleanup configuration",
-    description: "Controls deletion of variables by scope (Actions, environments)."
-});
-const CleanupSchema = Schema.Struct({
-    secrets: Schema.optionalWith(CleanupSecretsSchema, {
-        default: ()=>({
-                actions: false,
-                dependabot: false,
-                codespaces: false,
-                environments: false
-            })
-    }).annotations({
-        title: "Secrets cleanup",
-        description: "Controls cleanup of secrets by scope"
-    }),
-    variables: Schema.optionalWith(CleanupVariablesSchema, {
-        default: ()=>({
-                actions: false,
-                environments: false
-            })
-    }).annotations({
-        title: "Variables cleanup",
-        description: "Controls cleanup of variables by scope"
-    }),
-    rulesets: Schema.optionalWith(CleanupScopeSchema, {
-        default: ()=>false
-    }).annotations({
-        title: "Clean up rulesets",
-        description: "Delete repository rulesets not declared in any referenced ruleset group",
-        default: false
-    }),
-    environments: Schema.optionalWith(CleanupScopeSchema, {
-        default: ()=>false
-    }).annotations({
-        title: "Clean up environments",
-        description: "Delete repository environments not declared in config",
-        default: false
-    })
-}).annotations({
-    identifier: "Cleanup",
-    title: "Cleanup configuration",
-    description: "Controls deletion of resources not declared in config. All disabled by default.",
-    jsonSchema: taplo({
-        links: {
-            key: "https://github.com/spencerbeggs/reposets/blob/main/docs/cleanup.md"
-        }
-    })
-});
-const ReviewerTypeSchema = Schema.Literal("User", "Team").annotations({
-    title: "Reviewer type",
-    description: "Whether the reviewer is an individual user or a team"
-});
-const ReviewerSchema = Schema.Struct({
-    type: ReviewerTypeSchema,
-    id: Schema.Int.annotations({
-        title: "Reviewer ID",
-        description: "The numeric GitHub ID of the user or team"
-    })
-}).annotations({
-    identifier: "Reviewer",
-    title: "Reviewer",
-    description: "A user or team required to review deployments"
-});
-const DeploymentBranchPolicySchema = Schema.Struct({
-    name: Schema.String.annotations({
-        title: "Pattern",
-        description: "The name pattern (branch name, tag name, or glob) to allow deployments from"
-    }),
-    type: Schema.optionalWith(Schema.Literal("branch", "tag").annotations({
-        title: "Policy type",
-        description: 'Whether this policy matches branches or tags. Defaults to "branch".'
-    }), {
-        default: ()=>"branch"
-    })
-}).annotations({
-    identifier: "DeploymentBranchPolicy",
-    title: "Deployment branch policy",
-    description: "A custom branch or tag pattern that deployments are allowed from"
-});
-const DeploymentBranchesSchema = Schema.Union(Schema.Literal("all", "protected").annotations({
-    title: "Deployment branch preset",
-    description: '"all" allows any branch, "protected" allows only protected branches'
-}), Schema.Array(DeploymentBranchPolicySchema).annotations({
-    title: "Custom deployment policies",
-    description: "Array of branch or tag name patterns allowed to deploy to this environment"
-})).annotations({
-    identifier: "DeploymentBranches",
-    title: "Deployment branches",
-    description: 'Controls which branches can deploy. Use "all", "protected", or a list of custom policies.'
-});
-const EnvironmentSchema = Schema.Struct({
-    wait_timer: Schema.optional(Schema.Int.pipe(Schema.between(0, 43200)).annotations({
-        title: "Wait timer (minutes)",
-        description: "Number of minutes to wait before allowing deployments to proceed (0-43200)"
-    })),
-    prevent_self_review: Schema.optional(Schema.Boolean.annotations({
-        title: "Prevent self-review",
-        description: "Prevent the user who triggered the deployment from approving it"
-    })),
-    reviewers: Schema.optional(Schema.Array(ReviewerSchema).annotations({
-        title: "Required reviewers",
-        description: "Users or teams required to approve deployments to this environment"
-    })),
-    deployment_branches: Schema.optional(DeploymentBranchesSchema)
-}).annotations({
-    identifier: "Environment",
-    title: "Deployment environment",
-    description: "Configuration for a GitHub deployment environment",
-    jsonSchema: {
-        ...tombi({
-            tableKeysOrder: "schema"
-        }),
-        ...taplo({
-            links: {
-                key: "https://github.com/spencerbeggs/reposets/blob/main/docs/environments.md"
-            }
-        })
-    }
-});
-const ResolvedRefSchema = Schema.Struct({
-    resolved: Schema.String.annotations({
-        title: "Credential label",
-        description: "Reference to a named value in the active credential profile's resolve section"
-    })
-}).annotations({
-    identifier: "ResolvedRef",
-    title: "Resolved reference",
-    description: "A reference to a credential-resolved value"
-});
-const ActorTypeSchema = Schema.Literal("Integration", "OrganizationAdmin", "RepositoryRole", "Team", "DeployKey").annotations({
-    title: "Actor type",
-    description: "The type of actor that can bypass a ruleset"
-});
-const BypassModeSchema = Schema.Literal("always", "pull_request", "exempt").annotations({
-    title: "Bypass mode",
-    description: "When the specified actor can bypass the ruleset"
-});
-const BypassActorSchema = Schema.Struct({
-    actor_id: Schema.optional(Schema.Union(Schema.Int, ResolvedRefSchema).annotations({
-        title: "Actor ID",
-        description: "The ID of the actor, or a { resolved } reference to a credential label."
-    })),
-    actor_type: ActorTypeSchema,
-    bypass_mode: Schema.optionalWith(BypassModeSchema, {
-        default: ()=>"always"
-    })
-}).annotations({
-    identifier: "BypassActor",
-    title: "Bypass actor",
-    description: "An actor that can bypass rules in a ruleset"
-});
-const RefNameConditionSchema = Schema.Struct({
-    include: Schema.optionalWith(Schema.Array(Schema.String).annotations({
-        title: "Include patterns",
-        description: "Ref name patterns to include. Accepts ~DEFAULT_BRANCH, ~ALL, or glob patterns.",
-        examples: [
-            [
-                "~DEFAULT_BRANCH"
-            ]
-        ]
-    }), {
-        default: ()=>[]
-    }),
-    exclude: Schema.optionalWith(Schema.Array(Schema.String).annotations({
-        title: "Exclude patterns",
-        description: "Ref name patterns to exclude"
-    }), {
-        default: ()=>[]
-    })
-}).annotations({
-    identifier: "RefNameCondition",
-    title: "Ref name condition",
-    description: "Conditions for matching ref names (branches or tags)"
-});
-const RulesetConditionsSchema = Schema.Struct({
-    ref_name: Schema.optional(RefNameConditionSchema)
-}).annotations({
-    identifier: "RulesetConditions",
-    title: "Ruleset conditions",
-    description: "Conditions that determine when the ruleset applies"
-});
-const RequiredReviewerSchema = Schema.Struct({
-    file_patterns: Schema.Array(Schema.String).annotations({
-        title: "File patterns",
-        description: "File patterns this reviewer must approve (fnmatch syntax)"
-    }),
-    minimum_approvals: Schema.Int.annotations({
-        title: "Minimum approvals",
-        description: "Minimum approvals required from this team (0 = optional)"
-    }),
-    reviewer: Schema.Struct({
-        id: Schema.Int.annotations({
-            title: "Team ID",
-            description: "Team ID"
-        }),
-        type: Schema.Literal("Team")
-    }).annotations({
-        title: "Reviewer team"
-    })
-});
-const StatusCheckSchema = Schema.Struct({
-    context: Schema.String.annotations({
-        title: "Context",
-        description: "The status check context name that must be present on the commit"
-    }),
-    integration_id: Schema.optional(Schema.Union(Schema.Int, ResolvedRefSchema).annotations({
-        title: "Integration ID",
-        description: "The integration ID, or a { resolved } reference to a credential label"
-    }))
-});
-const WorkflowFileSchema = Schema.Struct({
-    path: Schema.String.annotations({
-        title: "Workflow path",
-        description: "Path to the workflow file"
-    }),
-    ref: Schema.optional(Schema.String.annotations({
-        title: "Ref",
-        description: "Branch or tag of the workflow file"
-    })),
-    repository_id: Schema.Union(Schema.Int, ResolvedRefSchema).annotations({
-        title: "Repository ID",
-        description: "Repository ID, or a { resolved } reference to a credential label"
-    }),
-    sha: Schema.optional(Schema.String.annotations({
-        title: "SHA",
-        description: "Commit SHA of the workflow file"
-    }))
-});
-const TargetPatternSchema = Schema.Union(Schema.Struct({
-    include: Schema.String.annotations({
-        title: "Include pattern",
-        description: "Glob pattern to include"
-    })
-}), Schema.Struct({
-    exclude: Schema.String.annotations({
-        title: "Exclude pattern",
-        description: "Glob pattern to exclude"
-    })
-})).annotations({
-    identifier: "TargetPattern",
-    title: "Target pattern",
-    description: "An include or exclude pattern for ref matching"
-});
-const TargetsSchema = Schema.Union(Schema.Literal("default", "all").annotations({
-    title: "Target preset",
-    description: "'default' targets the default branch; 'all' targets all branches/tags"
-}), Schema.Array(TargetPatternSchema).annotations({
-    title: "Custom target patterns",
-    description: "Array of include/exclude patterns for fine-grained ref targeting"
-})).annotations({
-    identifier: "Targets",
-    title: "Targets shorthand",
-    description: "Shorthand for specifying ref_name conditions: 'default', 'all', or custom patterns"
-});
-const PullRequestsShorthandSchema = Schema.Struct({
-    approvals: Schema.optionalWith(Schema.Int.pipe(Schema.between(0, 10)).annotations({
-        title: "Required approvals",
-        description: "Number of approving reviews required (0-10)"
-    }), {
-        default: ()=>0
-    }),
-    dismiss_stale_reviews: Schema.optionalWith(Schema.Boolean.annotations({
-        title: "Dismiss stale reviews",
-        description: "Dismiss previous approvals when new commits are pushed"
-    }), {
-        default: ()=>false
-    }),
-    code_owner_review: Schema.optionalWith(Schema.Boolean.annotations({
-        title: "Code owner review",
-        description: "Require review from code owners for files they own"
-    }), {
-        default: ()=>false
-    }),
-    last_push_approval: Schema.optionalWith(Schema.Boolean.annotations({
-        title: "Last push approval",
-        description: "Most recent push must be approved by someone other than the pusher"
-    }), {
-        default: ()=>false
-    }),
-    resolve_threads: Schema.optionalWith(Schema.Boolean.annotations({
-        title: "Resolve threads",
-        description: "All review conversations must be resolved before merging"
-    }), {
-        default: ()=>false
-    }),
-    merge_methods: Schema.optional(Schema.Array(Schema.Literal("merge", "squash", "rebase")).annotations({
-        title: "Merge methods",
-        description: "Allowed merge methods. At least one must be enabled."
-    })),
-    reviewers: Schema.optional(Schema.Array(RequiredReviewerSchema).annotations({
-        title: "Required reviewers",
-        description: "Teams that must approve specific file patterns"
-    }))
-}).annotations({
-    identifier: "PullRequestsShorthand",
-    title: "Pull requests shorthand",
-    description: "Simplified pull request configuration (branch rulesets only)"
-});
-const StatusChecksShorthandSchema = Schema.Struct({
-    update_branch: Schema.optional(Schema.Boolean.annotations({
-        title: "Strict status checks",
-        description: "PRs must be tested with the latest code"
-    })),
-    on_creation: Schema.optional(Schema.Boolean.annotations({
-        title: "Enforce on create",
-        description: "When false, allows branch creation even if checks would prohibit it"
-    })),
-    default_integration_id: Schema.optional(Schema.Union(Schema.Int, ResolvedRefSchema).annotations({
-        title: "Default integration ID",
-        description: "Default integration ID applied to all checks that do not specify one"
-    })),
-    required: Schema.Array(StatusCheckSchema).annotations({
-        title: "Required checks",
-        description: "Status checks that must pass"
-    })
-}).annotations({
-    identifier: "StatusChecksShorthand",
-    title: "Status checks shorthand",
-    description: "Simplified status checks configuration"
-});
-const EnforcementSchema = Schema.Literal("disabled", "active", "evaluate").annotations({
-    title: "Enforcement level",
-    description: "disabled = off, active = enforced, evaluate = test mode (GitHub Enterprise only)"
-});
-const PatternEntrySchema = Schema.Struct({
-    operator: Schema.Literal("starts_with", "ends_with", "contains", "regex").annotations({
-        title: "Operator",
-        description: "The operator to use for matching"
-    }),
-    pattern: Schema.String.annotations({
-        title: "Pattern",
-        description: "The pattern to match"
-    }),
-    name: Schema.optional(Schema.String.annotations({
-        title: "Rule name",
-        description: "Display name for this pattern rule"
-    })),
-    negate: Schema.optional(Schema.Boolean.annotations({
-        title: "Negate",
-        description: "If true, the rule fails when the pattern matches"
-    }))
-}).annotations({
-    identifier: "PatternEntry",
-    title: "Pattern entry",
-    description: "A pattern matching rule with operator, pattern, and optional name/negate"
-});
-const MergeQueueShorthandSchema = Schema.Struct({
-    check_timeout: Schema.Int.pipe(Schema.between(1, 360)).annotations({
-        title: "Check timeout (minutes)",
-        description: "Max time for status checks to report"
-    }),
-    grouping: Schema.Literal("ALLGREEN", "HEADGREEN").annotations({
-        title: "Grouping strategy",
-        description: "Whether all commits or only the head commit must pass checks"
-    }),
-    max_build: Schema.Int.pipe(Schema.between(0, 100)).annotations({
-        title: "Max entries to build",
-        description: "Max queued PRs requesting checks simultaneously"
-    }),
-    max_merge: Schema.Int.pipe(Schema.between(0, 100)).annotations({
-        title: "Max entries to merge",
-        description: "Max PRs merged together in a group"
-    }),
-    merge_method: Schema.Literal("MERGE", "SQUASH", "REBASE").annotations({
-        title: "Merge method",
-        description: "Merge method for queued PRs"
-    }),
-    min_merge: Schema.Int.pipe(Schema.between(0, 100)).annotations({
-        title: "Min entries to merge",
-        description: "Min PRs merged together in a group"
-    }),
-    min_wait: Schema.Int.pipe(Schema.between(0, 360)).annotations({
-        title: "Min wait time (minutes)",
-        description: "Wait time for min group size after first PR is added"
-    })
-}).annotations({
-    identifier: "MergeQueueShorthand",
-    title: "Merge queue",
-    description: "Merge queue configuration"
-});
-const CopilotReviewShorthandSchema = Schema.Struct({
-    draft_prs: Schema.optional(Schema.Boolean.annotations({
-        title: "Review draft PRs",
-        description: "Review draft PRs before they are marked ready"
-    })),
-    on_push: Schema.optional(Schema.Boolean.annotations({
-        title: "Review on push",
-        description: "Review each new push to the PR"
-    }))
-}).annotations({
-    identifier: "CopilotReviewShorthand",
-    title: "Copilot review",
-    description: "Copilot code review configuration"
-});
-const CodeScanningEntrySchema = Schema.Struct({
-    tool: Schema.String.annotations({
-        title: "Tool name",
-        description: "Name of the code scanning tool"
-    }),
-    alerts: Schema.Literal("none", "errors", "errors_and_warnings", "all").annotations({
-        title: "Alerts threshold",
-        description: "Severity level at which alerts block updates"
-    }),
-    security_alerts: Schema.Literal("none", "critical", "high_or_higher", "medium_or_higher", "all").annotations({
-        title: "Security alerts threshold",
-        description: "Severity level at which security alerts block updates"
-    })
-}).annotations({
-    identifier: "CodeScanningEntry",
-    title: "Code scanning tool",
-    description: "A code scanning tool with alert thresholds"
-});
-const WorkflowsShorthandSchema = Schema.Struct({
-    on_creation: Schema.optional(Schema.Boolean.annotations({
-        title: "Enforce on creation",
-        description: "Enforce workflows when a branch is created (false = skip on creation)"
-    })),
-    required: Schema.Array(WorkflowFileSchema).annotations({
-        title: "Required workflows",
-        description: "Workflows that must pass for this rule"
-    })
-}).annotations({
-    identifier: "WorkflowsShorthand",
-    title: "Workflows",
-    description: "Required workflow configuration"
-});
-const sharedRulesetFields = {
-    name: Schema.String.annotations({
-        title: "Ruleset name",
-        description: "The name of the ruleset (used for matching when creating or updating)"
-    }),
-    enforcement: EnforcementSchema,
-    conditions: Schema.optional(RulesetConditionsSchema),
-    bypass_actors: Schema.optional(Schema.Array(BypassActorSchema)),
-    creation: Schema.optional(Schema.Boolean.annotations({
-        title: "Restrict creation",
-        description: "When true, adds a creation rule"
-    })),
-    update: Schema.optional(Schema.Boolean.annotations({
-        title: "Restrict updates",
-        description: "When true, adds an update rule with update_allows_fetch_and_merge: true"
-    })),
-    deletion: Schema.optional(Schema.Boolean.annotations({
-        title: "Restrict deletion",
-        description: "When true, adds a deletion rule"
-    })),
-    required_linear_history: Schema.optional(Schema.Boolean.annotations({
-        title: "Require linear history",
-        description: "When true, adds a required_linear_history rule"
-    })),
-    required_signatures: Schema.optional(Schema.Boolean.annotations({
-        title: "Require signatures",
-        description: "When true, adds a required_signatures rule"
-    })),
-    non_fast_forward: Schema.optional(Schema.Boolean.annotations({
-        title: "Prevent non-fast-forward",
-        description: "When true, adds a non_fast_forward rule"
-    })),
-    deployments: Schema.optional(Schema.Array(Schema.String).annotations({
-        title: "Required deployments",
-        description: "Deployment environments that must succeed; converts to required_deployments rule"
-    })),
-    targets: Schema.optional(TargetsSchema),
-    status_checks: Schema.optional(StatusChecksShorthandSchema),
-    commit_message: Schema.optional(Schema.Array(PatternEntrySchema).annotations({
-        title: "Commit message patterns",
-        description: "Commit message pattern rules"
-    })),
-    commit_author_email: Schema.optional(Schema.Array(PatternEntrySchema).annotations({
-        title: "Commit author email patterns",
-        description: "Commit author email pattern rules"
-    })),
-    committer_email: Schema.optional(Schema.Array(PatternEntrySchema).annotations({
-        title: "Committer email patterns",
-        description: "Committer email pattern rules"
-    }))
-};
-const BranchRulesetSchema = Schema.Struct({
-    ...sharedRulesetFields,
-    type: Schema.Literal("branch").annotations({
-        title: "Ruleset type",
-        description: "This ruleset applies to branches"
-    }),
-    pull_requests: Schema.optional(PullRequestsShorthandSchema),
-    merge_queue: Schema.optional(MergeQueueShorthandSchema),
-    copilot_review: Schema.optional(CopilotReviewShorthandSchema),
-    code_scanning: Schema.optional(Schema.Array(CodeScanningEntrySchema).annotations({
-        title: "Code scanning tools",
-        description: "Code scanning tool requirements"
-    })),
-    workflows: Schema.optional(WorkflowsShorthandSchema),
-    branch_name: Schema.optional(Schema.Array(PatternEntrySchema).annotations({
-        title: "Branch name patterns",
-        description: "Branch name pattern rules"
-    }))
-}).annotations({
-    identifier: "BranchRuleset",
-    title: "Branch ruleset",
-    description: "A ruleset that applies to branches",
-    jsonSchema: {
-        ...tombi({
-            tableKeysOrder: "schema"
-        }),
-        ...taplo({
-            initKeys: [
-                "name",
-                "type",
-                "enforcement",
-                "targets"
-            ],
-            links: {
-                key: "https://github.com/spencerbeggs/reposets/blob/main/docs/rulesets.md"
-            }
-        })
-    }
-});
-const TagRulesetSchema = Schema.Struct({
-    ...sharedRulesetFields,
-    type: Schema.Literal("tag").annotations({
-        title: "Ruleset type",
-        description: "This ruleset applies to tags"
-    }),
-    tag_name: Schema.optional(Schema.Array(PatternEntrySchema).annotations({
-        title: "Tag name patterns",
-        description: "Tag name pattern rules"
-    }))
-}).annotations({
-    identifier: "TagRuleset",
-    title: "Tag ruleset",
-    description: "A ruleset that applies to tags",
-    jsonSchema: {
-        ...tombi({
-            tableKeysOrder: "schema"
-        }),
-        ...taplo({
-            initKeys: [
-                "name",
-                "type",
-                "enforcement",
-                "targets"
-            ],
-            links: {
-                key: "https://github.com/spencerbeggs/reposets/blob/main/docs/rulesets.md"
-            }
-        })
-    }
-});
-const RulesetSchema = Schema.Union(BranchRulesetSchema, TagRulesetSchema).annotations({
-    identifier: "Ruleset",
-    title: "Repository ruleset",
-    description: "A set of rules to apply when specified conditions are met",
-    jsonSchema: taplo({
-        links: {
-            key: "https://github.com/spencerbeggs/reposets/blob/main/docs/rulesets.md"
-        }
-    })
-});
-function buildRulesetPayload(ruleset) {
-    const rules = [];
-    if (true === ruleset.creation) rules.push({
-        type: "creation"
-    });
-    if (true === ruleset.update) rules.push({
-        type: "update",
-        parameters: {
-            update_allows_fetch_and_merge: true
-        }
-    });
-    if (true === ruleset.deletion) rules.push({
-        type: "deletion"
-    });
-    if (true === ruleset.required_linear_history) rules.push({
-        type: "required_linear_history"
-    });
-    if (true === ruleset.required_signatures) rules.push({
-        type: "required_signatures"
-    });
-    if (true === ruleset.non_fast_forward) rules.push({
-        type: "non_fast_forward"
-    });
-    if (void 0 !== ruleset.deployments && ruleset.deployments.length > 0) rules.push({
-        type: "required_deployments",
-        parameters: {
-            required_deployment_environments: ruleset.deployments
-        }
-    });
-    if ("branch" === ruleset.type && void 0 !== ruleset.pull_requests) {
-        const pr = ruleset.pull_requests;
-        rules.push({
-            type: "pull_request",
-            parameters: {
-                required_approving_review_count: pr.approvals,
-                dismiss_stale_reviews_on_push: pr.dismiss_stale_reviews,
-                require_code_owner_review: pr.code_owner_review,
-                require_last_push_approval: pr.last_push_approval,
-                required_review_thread_resolution: pr.resolve_threads,
-                ...void 0 !== pr.merge_methods ? {
-                    allowed_merge_methods: pr.merge_methods
-                } : {},
-                ...void 0 !== pr.reviewers ? {
-                    required_reviewers: pr.reviewers
-                } : {}
-            }
-        });
-    }
-    if (void 0 !== ruleset.status_checks) {
-        const sc = ruleset.status_checks;
-        const checks = sc.required.map((check)=>{
-            if (void 0 === check.integration_id && void 0 !== sc.default_integration_id) return {
-                ...check,
-                integration_id: sc.default_integration_id
-            };
-            return check;
-        });
-        rules.push({
-            type: "required_status_checks",
-            parameters: {
-                strict_required_status_checks_policy: sc.update_branch ?? true,
-                ...false === sc.on_creation ? {
-                    do_not_enforce_on_create: true
-                } : {},
-                required_status_checks: checks
-            }
-        });
-    }
-    if ("branch" === ruleset.type && void 0 !== ruleset.merge_queue) {
-        const mq = ruleset.merge_queue;
-        rules.push({
-            type: "merge_queue",
-            parameters: {
-                check_response_timeout_minutes: mq.check_timeout,
-                grouping_strategy: mq.grouping,
-                max_entries_to_build: mq.max_build,
-                max_entries_to_merge: mq.max_merge,
-                merge_method: mq.merge_method,
-                min_entries_to_merge: mq.min_merge,
-                min_entries_to_merge_wait_minutes: mq.min_wait
-            }
-        });
-    }
-    if ("branch" === ruleset.type && void 0 !== ruleset.copilot_review) {
-        const cr = ruleset.copilot_review;
-        rules.push({
-            type: "copilot_code_review",
-            parameters: {
-                ...void 0 !== cr.draft_prs ? {
-                    review_draft_pull_requests: cr.draft_prs
-                } : {},
-                ...void 0 !== cr.on_push ? {
-                    review_on_push: cr.on_push
-                } : {}
-            }
-        });
-    }
-    if ("branch" === ruleset.type && void 0 !== ruleset.code_scanning) rules.push({
-        type: "code_scanning",
-        parameters: {
-            code_scanning_tools: ruleset.code_scanning.map((entry)=>({
-                    tool: entry.tool,
-                    alerts_threshold: entry.alerts,
-                    security_alerts_threshold: entry.security_alerts
-                }))
-        }
-    });
-    if ("branch" === ruleset.type && void 0 !== ruleset.workflows) {
-        const wf = ruleset.workflows;
-        rules.push({
-            type: "workflows",
-            parameters: {
-                ...false === wf.on_creation ? {
-                    do_not_enforce_on_create: true
-                } : {},
-                workflows: wf.required
-            }
-        });
-    }
-    for (const [field, ruleType] of [
-        [
-            "commit_message",
-            "commit_message_pattern"
-        ],
-        [
-            "commit_author_email",
-            "commit_author_email_pattern"
-        ],
-        [
-            "committer_email",
-            "committer_email_pattern"
-        ]
-    ]){
-        const patterns = ruleset[field];
-        if (void 0 !== patterns) for (const entry of patterns)rules.push({
-            type: ruleType,
-            parameters: entry
-        });
-    }
-    if ("branch" === ruleset.type && void 0 !== ruleset.branch_name) for (const entry of ruleset.branch_name)rules.push({
-        type: "branch_name_pattern",
-        parameters: entry
-    });
-    if ("tag" === ruleset.type && void 0 !== ruleset.tag_name) for (const entry of ruleset.tag_name)rules.push({
-        type: "tag_name_pattern",
-        parameters: entry
-    });
-    let conditions = ruleset.conditions;
-    if (void 0 !== ruleset.targets) if ("default" === ruleset.targets) conditions = {
-        ref_name: {
-            include: [
-                "~DEFAULT_BRANCH"
-            ],
-            exclude: []
-        }
-    };
-    else if ("all" === ruleset.targets) conditions = {
-        ref_name: {
-            include: [
-                "~ALL"
-            ],
-            exclude: []
-        }
-    };
-    else {
-        const include = [];
-        const exclude = [];
-        for (const pattern of ruleset.targets)if ("include" in pattern) include.push(pattern.include);
-        else exclude.push(pattern.exclude);
-        conditions = {
-            ref_name: {
-                include,
-                exclude
-            }
-        };
-    }
-    return {
-        name: ruleset.name,
-        target: ruleset.type,
-        enforcement: ruleset.enforcement,
-        ...void 0 !== conditions ? {
-            conditions
-        } : {},
-        ...void 0 !== ruleset.bypass_actors ? {
-            bypass_actors: ruleset.bypass_actors
-        } : {},
-        ...rules.length > 0 ? {
-            rules
-        } : {}
-    };
-}
-const SecretScopesSchema = Schema.Struct({
-    actions: Schema.optional(Schema.Array(Schema.String).annotations({
-        title: "Action secret groups",
-        description: "Secret groups to sync as GitHub Actions repository secrets",
-        examples: [
-            [
-                "deploy",
-                "app"
-            ]
-        ]
-    })),
-    dependabot: Schema.optional(Schema.Array(Schema.String).annotations({
-        title: "Dependabot secret groups",
-        description: "Secret groups to sync as Dependabot secrets",
-        examples: [
-            [
-                "deploy"
-            ]
-        ]
-    })),
-    codespaces: Schema.optional(Schema.Array(Schema.String).annotations({
-        title: "Codespaces secret groups",
-        description: "Secret groups to sync as Codespaces secrets",
-        examples: [
-            [
-                "deploy"
-            ]
-        ]
-    })),
-    environments: Schema.optional(Schema.Record({
-        key: Schema.String,
-        value: Schema.Array(Schema.String).annotations({
-            title: "Environment secret groups",
-            description: "Secret groups to sync as environment secrets"
-        })
-    }).annotations({
-        title: "Environment secret scopes",
-        description: "Map of environment names to secret group references",
-        jsonSchema: tombi({
-            additionalKeyLabel: "environment_name"
-        })
-    }))
-}).annotations({
-    identifier: "SecretScopes",
-    title: "Secret scopes",
-    description: "Assign secret groups to GitHub secret scopes (actions, dependabot, codespaces, environments)"
-});
-const VariableScopesSchema = Schema.Struct({
-    actions: Schema.optional(Schema.Array(Schema.String).annotations({
-        title: "Action variable groups",
-        description: "Variable groups to sync as GitHub Actions repository variables",
-        examples: [
-            [
-                "common"
-            ]
-        ]
-    })),
-    environments: Schema.optional(Schema.Record({
-        key: Schema.String,
-        value: Schema.Array(Schema.String).annotations({
-            title: "Environment variable groups",
-            description: "Variable groups to sync as environment variables"
-        })
-    }).annotations({
-        title: "Environment variable scopes",
-        description: "Map of environment names to variable group references",
-        jsonSchema: tombi({
-            additionalKeyLabel: "environment_name"
-        })
-    }))
-}).annotations({
-    identifier: "VariableScopes",
-    title: "Variable scopes",
-    description: "Assign variable groups to GitHub variable scopes (actions, environments)"
-});
-const GroupSchema = Schema.Struct({
-    owner: Schema.optional(Schema.String.annotations({
-        title: "Owner override",
-        description: "GitHub user or organization that owns these repos. Overrides the top-level owner.",
-        examples: [
-            "savvy-web"
-        ]
-    })),
-    repos: Schema.Array(Schema.String).annotations({
-        title: "Repository names",
-        description: "List of repository names (without owner prefix) to sync in this group",
-        examples: [
-            [
-                "repo-one",
-                "repo-two",
-                "repo-three"
-            ]
-        ],
-        jsonSchema: tombi({
-            arrayValuesOrder: "ascending"
-        })
-    }),
-    credentials: Schema.optional(Schema.String.annotations({
-        title: "Credential profile",
-        description: "Name of the credential profile to use. If only one profile exists, it is used automatically.",
-        examples: [
-            "personal",
-            "work"
-        ]
-    })),
-    settings: Schema.optional(Schema.Array(Schema.String).annotations({
-        title: "Settings groups",
-        description: "Names of settings groups to apply to these repos",
-        examples: [
-            [
-                "oss-defaults"
-            ]
-        ]
-    })),
-    environments: Schema.optional(Schema.Array(Schema.String).annotations({
-        title: "Environments",
-        description: "Names of environment definitions to create/update for these repos",
-        examples: [
-            [
-                "staging",
-                "production"
-            ]
-        ]
-    })),
-    secrets: Schema.optional(SecretScopesSchema),
-    variables: Schema.optional(VariableScopesSchema),
-    rulesets: Schema.optional(Schema.Array(Schema.String).annotations({
-        title: "Rulesets",
-        description: "Names of rulesets to apply to these repos",
-        examples: [
-            [
-                "workflow",
-                "release"
-            ]
-        ]
-    })),
-    security: Schema.optional(Schema.Array(Schema.String).annotations({
-        title: "Security groups",
-        description: "Names of security groups (vulnerability alerts, automated security fixes, private vulnerability reporting) to apply to these repos",
-        examples: [
-            [
-                "oss-defaults"
-            ]
-        ]
-    })),
-    code_scanning: Schema.optional(Schema.Array(Schema.String).annotations({
-        title: "Code scanning groups",
-        description: "Names of code_scanning groups (CodeQL default setup) to apply to these repos",
-        examples: [
-            [
-                "oss-defaults"
-            ]
-        ]
-    })),
-    cleanup: Schema.optional(CleanupSchema)
-}).annotations({
-    identifier: "Group",
-    title: "Repository group",
-    description: "A named group of repositories with their resource assignments",
-    jsonSchema: {
-        ...tombi({
-            tableKeysOrder: "schema"
-        }),
-        ...taplo({
-            initKeys: [
-                "repos"
-            ],
-            links: {
-                key: "https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md"
-            }
-        })
-    }
-});
-const SquashMergeCommitTitleSchema = Schema.Literal("PR_TITLE", "COMMIT_OR_PR_TITLE").annotations({
-    title: "Squash merge commit title",
-    description: "Default title for squash merge commits: PR_TITLE uses the pull request title, COMMIT_OR_PR_TITLE uses the commit message if only one commit, otherwise the PR title"
-});
-const SquashMergeCommitMessageSchema = Schema.Literal("PR_BODY", "COMMIT_MESSAGES", "BLANK").annotations({
-    title: "Squash merge commit message",
-    description: "Default message body for squash merge commits: PR_BODY uses the pull request body, COMMIT_MESSAGES concatenates all commit messages, BLANK leaves it empty"
-});
-const MergeCommitTitleSchema = Schema.Literal("PR_TITLE", "MERGE_MESSAGE").annotations({
-    title: "Merge commit title",
-    description: "Default title for merge commits: PR_TITLE uses the pull request title, MERGE_MESSAGE uses the classic merge message"
-});
-const MergeCommitMessageSchema = Schema.Literal("PR_BODY", "PR_TITLE", "BLANK").annotations({
-    title: "Merge commit message",
-    description: "Default message body for merge commits: PR_BODY uses the pull request body, PR_TITLE uses the PR title, BLANK leaves it empty"
-});
-const SecurityAndAnalysisStatusSchema = Schema.Literal("enabled", "disabled").annotations({
-    identifier: "SecurityAndAnalysisStatus",
-    title: "Security feature status",
-    description: 'Whether the security feature is "enabled" or "disabled"'
-});
-const DelegatedBypassReviewerModeSchema = Schema.Literal("ALWAYS", "EXEMPT").annotations({
-    identifier: "DelegatedBypassReviewerMode",
-    title: "Delegated bypass reviewer mode",
-    description: "ALWAYS: reviewer is always required to approve bypass; EXEMPT: reviewer can bypass without review"
-});
-const DelegatedBypassReviewerSchema = Schema.Union(Schema.Struct({
-    team: Schema.String.annotations({
-        title: "Team slug",
-        description: 'GitHub team slug (e.g., "security-team"); resolved to numeric reviewer_id at sync time',
-        examples: [
-            "security-team"
-        ]
-    }),
-    mode: Schema.optional(DelegatedBypassReviewerModeSchema)
-}), Schema.Struct({
-    role: Schema.String.annotations({
-        title: "Organization role name",
-        description: 'Organization role name as defined in `GET /orgs/{org}/organization-roles` (e.g., "all_repo_admin", "security_manager"). Resolved to the numeric role ID at sync time.',
-        examples: [
-            "all_repo_admin",
-            "all_repo_maintain",
-            "security_manager"
-        ]
-    }),
-    mode: Schema.optional(DelegatedBypassReviewerModeSchema)
-})).annotations({
-    identifier: "DelegatedBypassReviewer",
-    title: "Delegated bypass reviewer",
-    description: "A reviewer who can approve secret-scanning push-protection bypass requests. Must specify exactly one of team or role."
-});
-const SecurityAndAnalysisSchema = Schema.Struct({
-    advanced_security: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
-        title: "GitHub Advanced Security",
-        description: "(GHAS-licensed) Master toggle for GitHub Advanced Security features. Free on public repos; requires a GHAS license on private repos."
-    })),
-    code_security: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
-        title: "GitHub Code Security",
-        description: "(GHAS-licensed) Toggle GitHub Code Security functionality."
-    })),
-    secret_scanning: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
-        title: "Secret scanning",
-        description: "Detect exposed credentials and sensitive data committed to the repository."
-    })),
-    secret_scanning_push_protection: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
-        title: "Secret scanning push protection",
-        description: "Block git pushes that contain detected secrets."
-    })),
-    secret_scanning_ai_detection: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
-        title: "Secret scanning AI detection",
-        description: "(GHAS-licensed) AI-powered detection of generic secrets beyond standard provider patterns."
-    })),
-    secret_scanning_non_provider_patterns: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
-        title: "Secret scanning non-provider patterns",
-        description: "(GHAS-licensed) Detect custom secret patterns beyond the standard provider list."
-    })),
-    secret_scanning_delegated_alert_dismissal: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
-        title: "Delegated alert dismissal",
-        description: "(org-only) Allow delegated dismissal of secret scanning alerts."
-    })),
-    secret_scanning_delegated_bypass: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
-        title: "Delegated push protection bypass",
-        description: "(org-only) Allow delegated approval of secret scanning push protection bypass requests."
-    })),
-    delegated_bypass_reviewers: Schema.optional(Schema.Array(DelegatedBypassReviewerSchema).annotations({
-        title: "Delegated bypass reviewers",
-        description: "(org-only) Reviewers authorized to approve push protection bypass requests. Each entry must specify a team slug or role name."
-    })),
-    dependabot_security_updates: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
-        title: "Dependabot security updates",
-        description: "Automatically open pull requests to patch known dependency vulnerabilities."
-    }))
-}).annotations({
-    identifier: "SecurityAndAnalysis",
-    title: "Security and analysis",
-    description: "GitHub repository security_and_analysis fields applied via the same PATCH /repos call as other settings. (GHAS-licensed) fields require a GHAS license on private repos; (org-only) fields are silently skipped on personal repos.",
-    jsonSchema: {
-        ...tombi({
-            tableKeysOrder: "schema"
-        }),
-        ...taplo({
-            links: {
-                key: "https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md"
-            }
-        })
-    }
-});
-const SettingsGroupSchema = Schema.Struct({
-    is_template: Schema.optional(Schema.Boolean.annotations({
-        title: "Template repository",
-        description: "Whether the repository is a template that can be used to generate new repositories"
-    })),
-    has_wiki: Schema.optional(Schema.Boolean.annotations({
-        title: "Wikis",
-        description: "Enable the wiki feature for the repository"
-    })),
-    has_issues: Schema.optional(Schema.Boolean.annotations({
-        title: "Issues",
-        description: "Enable the issues feature for the repository"
-    })),
-    has_projects: Schema.optional(Schema.Boolean.annotations({
-        title: "Projects",
-        description: "Enable the projects feature for the repository"
-    })),
-    has_discussions: Schema.optional(Schema.Boolean.annotations({
-        title: "Discussions",
-        description: "Enable the discussions feature for the repository"
-    })),
-    has_sponsorships: Schema.optional(Schema.Boolean.annotations({
-        title: "Sponsorships",
-        description: "Display a Sponsor button for the repository (synced via GraphQL)"
-    })),
-    has_pull_requests: Schema.optional(Schema.Boolean.annotations({
-        title: "Pull requests",
-        description: "Enable the pull requests feature for the repository (synced via GraphQL)"
-    })),
-    allow_forking: Schema.optional(Schema.Boolean.annotations({
-        title: "Allow forking",
-        description: "Allow forking of the repository"
-    })),
-    allow_merge_commit: Schema.optional(Schema.Boolean.annotations({
-        title: "Allow merge commits",
-        description: "Allow merge commits when merging pull requests"
-    })),
-    allow_squash_merge: Schema.optional(Schema.Boolean.annotations({
-        title: "Allow squash merging",
-        description: "Allow squash merging when merging pull requests"
-    })),
-    allow_rebase_merge: Schema.optional(Schema.Boolean.annotations({
-        title: "Allow rebase merging",
-        description: "Allow rebase merging when merging pull requests"
-    })),
-    allow_auto_merge: Schema.optional(Schema.Boolean.annotations({
-        title: "Allow auto-merge",
-        description: "Allow pull requests to be automatically merged once all requirements are met"
-    })),
-    allow_update_branch: Schema.optional(Schema.Boolean.annotations({
-        title: "Always suggest updating pull request branches",
-        description: "Show the update branch button on pull requests"
-    })),
-    squash_merge_commit_title: Schema.optional(SquashMergeCommitTitleSchema),
-    squash_merge_commit_message: Schema.optional(SquashMergeCommitMessageSchema),
-    merge_commit_title: Schema.optional(MergeCommitTitleSchema),
-    merge_commit_message: Schema.optional(MergeCommitMessageSchema),
-    delete_branch_on_merge: Schema.optional(Schema.Boolean.annotations({
-        title: "Automatically delete head branches",
-        description: "Automatically delete head branches after pull requests are merged"
-    })),
-    web_commit_signoff_required: Schema.optional(Schema.Boolean.annotations({
-        title: "Require commit signoff",
-        description: "Require contributors to sign off on web-based commits"
-    })),
-    security_and_analysis: Schema.optional(SecurityAndAnalysisSchema)
-}, {
-    key: Schema.String,
-    value: Jsonifiable
-}).annotations({
-    identifier: "SettingsGroup",
-    title: "Settings group",
-    description: "GitHub repository settings to apply. Known fields are typed; additional fields are passed through to the API.",
-    jsonSchema: {
-        ...tombi({
-            tableKeysOrder: "schema"
-        }),
-        ...taplo({
-            links: {
-                key: "https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md"
-            }
-        })
-    }
-});
-const SecurityGroupSchema = Schema.Struct({
-    vulnerability_alerts: Schema.optional(Schema.Boolean.annotations({
-        title: "Vulnerability alerts",
-        description: "Enable Dependabot vulnerability alerts (PUT/DELETE /repos/{o}/{r}/vulnerability-alerts)."
-    })),
-    automated_security_fixes: Schema.optional(Schema.Boolean.annotations({
-        title: "Automated security fixes",
-        description: "Enable Dependabot security pull requests (PUT/DELETE /repos/{o}/{r}/automated-security-fixes). Requires vulnerability_alerts to also be enabled."
-    })),
-    private_vulnerability_reporting: Schema.optional(Schema.Boolean.annotations({
-        title: "Private vulnerability reporting",
-        description: "Enable the private vulnerability reporting inbox (PUT/DELETE /repos/{o}/{r}/private-vulnerability-reporting)."
-    }))
-}).pipe(Schema.filter((group)=>!(true === group.automated_security_fixes && false === group.vulnerability_alerts), {
-    identifier: "SecurityGroup",
-    message: ()=>"automated_security_fixes = true requires vulnerability_alerts to be enabled (or omitted to leave the existing setting in place)"
-})).annotations({
-    identifier: "SecurityGroup",
-    title: "Security group",
-    description: "Toggles for repository-level security features that have dedicated PUT/DELETE endpoints (vulnerability alerts, automated security fixes, private vulnerability reporting). Omitted keys are left untouched.",
-    jsonSchema: {
-        ...tombi({
-            tableKeysOrder: "schema"
-        }),
-        ...taplo({
-            links: {
-                key: "https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md"
-            }
-        })
-    }
-});
-const CodeScanningLanguageSchema = Schema.Literal("actions", "c-cpp", "csharp", "go", "java-kotlin", "javascript-typescript", "python", "ruby", "swift").annotations({
-    identifier: "CodeScanningLanguage",
-    title: "CodeQL default-setup language",
-    description: "Languages supported by GitHub code scanning default setup. Note: this is narrower than the CodeQL analyzer (Rust is supported by CodeQL but not by default setup)."
-});
-const CodeScanningStateSchema = Schema.Literal("configured", "not-configured").annotations({
-    identifier: "CodeScanningState",
-    title: "Default setup state",
-    description: '"configured" enables CodeQL default setup; "not-configured" disables it.'
-});
-const CodeScanningQuerySuiteSchema = Schema.Literal("default", "extended").annotations({
-    identifier: "CodeScanningQuerySuite",
-    title: "Query suite",
-    description: '"default" runs the standard query set; "extended" includes additional security queries.'
-});
-const CodeScanningThreatModelSchema = Schema.Literal("remote", "remote_and_local").annotations({
-    identifier: "CodeScanningThreatModel",
-    title: "Threat model",
-    description: '"remote" analyzes network sources only; "remote_and_local" also includes filesystem and environment access.'
-});
-const CodeScanningRunnerTypeSchema = Schema.Literal("standard", "labeled").annotations({
-    identifier: "CodeScanningRunnerType",
-    title: "Runner type",
-    description: '"standard" uses GitHub-hosted runners; "labeled" uses runners matching runner_label.'
-});
-const CodeScanningGroupSchema = Schema.Struct({
-    state: Schema.optional(CodeScanningStateSchema),
-    languages: Schema.optional(Schema.Array(CodeScanningLanguageSchema).annotations({
-        title: "Languages",
-        description: "CodeQL languages to analyze. Languages not detected in the repository are skipped with a warning at sync time.",
-        examples: [
-            [
-                "javascript-typescript",
-                "python"
-            ]
-        ]
-    })),
-    query_suite: Schema.optional(CodeScanningQuerySuiteSchema),
-    threat_model: Schema.optional(CodeScanningThreatModelSchema),
-    runner_type: Schema.optional(CodeScanningRunnerTypeSchema),
-    runner_label: Schema.optional(Schema.String.annotations({
-        title: "Runner label",
-        description: 'Self-hosted runner label. Required when runner_type = "labeled".'
-    }))
-}).pipe(Schema.filter((group)=>"labeled" !== group.runner_type || void 0 !== group.runner_label, {
-    identifier: "CodeScanningGroup",
-    message: ()=>'runner_label is required when runner_type = "labeled"'
-})).annotations({
-    identifier: "CodeScanningGroup",
-    title: "Code scanning group",
-    description: "CodeQL default setup configuration applied via PATCH /repos/{o}/{r}/code-scanning/default-setup. The endpoint returns 202 Accepted and configures asynchronously; reposets sends the request and does not poll for completion.",
-    jsonSchema: {
-        ...tombi({
-            tableKeysOrder: "schema"
-        }),
-        ...taplo({
-            links: {
-                key: "https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md"
-            }
-        })
-    }
-});
-const LogLevelSchema = Schema.Literal("silent", "info", "verbose", "debug").annotations({
-    identifier: "LogLevel",
-    title: "Log level",
-    description: "Controls output verbosity: silent (none), info (summaries), verbose (per-operation), debug (with sources)"
-});
-const ConfigSchema = Schema.Struct({
-    owner: Schema.optional(Schema.String.annotations({
-        title: "Default owner",
-        description: "Default GitHub user or organization for all groups. Can be overridden per group.",
-        examples: [
-            "spencerbeggs",
-            "savvy-web"
-        ]
-    })),
-    log_level: Schema.optionalWith(LogLevelSchema, {
-        default: ()=>"info"
-    }).annotations({
-        title: "Log level",
-        description: "Default output verbosity. Can be overridden with --log-level CLI flag."
-    }),
-    settings: Schema.optionalWith(Schema.Record({
-        key: Schema.String,
-        value: SettingsGroupSchema
-    }).annotations({
-        title: "Settings groups",
-        description: "Named groups of GitHub repository settings to apply",
-        jsonSchema: tombi({
-            additionalKeyLabel: "setting_group"
-        })
-    }), {
-        default: ()=>({})
-    }),
-    secrets: Schema.optionalWith(Schema.Record({
-        key: Schema.String,
-        value: SecretGroupSchema
-    }).annotations({
-        title: "Secret groups",
-        description: "Named groups of secrets. Each group is one kind: file, value, or resolved.",
-        jsonSchema: tombi({
-            additionalKeyLabel: "secret_group"
-        })
-    }), {
-        default: ()=>({})
-    }),
-    variables: Schema.optionalWith(Schema.Record({
-        key: Schema.String,
-        value: VariableGroupSchema
-    }).annotations({
-        title: "Variable groups",
-        description: "Named groups of variables. Each group is one kind: file, value, or resolved.",
-        jsonSchema: tombi({
-            additionalKeyLabel: "variable_group"
-        })
-    }), {
-        default: ()=>({})
-    }),
-    rulesets: Schema.optionalWith(Schema.Record({
-        key: Schema.String,
-        value: RulesetSchema
-    }).annotations({
-        title: "Rulesets",
-        description: "Named rulesets defining branch and tag protection rules",
-        jsonSchema: tombi({
-            additionalKeyLabel: "ruleset_name"
-        })
-    }), {
-        default: ()=>({})
-    }),
-    environments: Schema.optionalWith(Schema.Record({
-        key: Schema.String,
-        value: EnvironmentSchema
-    }).annotations({
-        title: "Environments",
-        description: "Named deployment environment configurations",
-        jsonSchema: tombi({
-            additionalKeyLabel: "environment_name"
-        })
-    }), {
-        default: ()=>({})
-    }),
-    security: Schema.optionalWith(Schema.Record({
-        key: Schema.String,
-        value: SecurityGroupSchema
-    }).annotations({
-        title: "Security groups",
-        description: "Named security groups for vulnerability alerts, automated security fixes, and private vulnerability reporting",
-        jsonSchema: tombi({
-            additionalKeyLabel: "security_group"
-        })
-    }), {
-        default: ()=>({})
-    }),
-    code_scanning: Schema.optionalWith(Schema.Record({
-        key: Schema.String,
-        value: CodeScanningGroupSchema
-    }).annotations({
-        title: "Code scanning groups",
-        description: "Named code scanning groups for CodeQL default setup configuration",
-        jsonSchema: tombi({
-            additionalKeyLabel: "code_scanning_group"
-        })
-    }), {
-        default: ()=>({})
-    }),
-    groups: Schema.Record({
-        key: Schema.String,
-        value: GroupSchema
-    }).annotations({
-        title: "Groups",
-        description: "Named groups of repositories with their settings, secrets, variables, rulesets, environments, security, and code scanning assignments",
-        jsonSchema: tombi({
-            additionalKeyLabel: "group_name"
-        })
-    })
-}).annotations({
-    identifier: "Config",
-    title: "reposets Configuration",
-    description: "Configuration for syncing GitHub repository settings, secrets, variables, rulesets, deployment environments, advanced security toggles, and CodeQL default setup",
-    jsonSchema: {
-        ...tombi({
-            tableKeysOrder: "schema"
-        }),
-        ...taplo({
-            initKeys: [
-                "owner",
-                "groups"
-            ],
-            links: {
-                key: "https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md"
-            }
-        })
-    }
-});
-const ResolveSectionSchema = Schema.Struct({
-    op: Schema.optional(Schema.Record({
-        key: Schema.String,
-        value: Schema.String
-    }).annotations({
-        title: "1Password references",
-        description: "Named values resolved via 1Password SDK. Values are op:// reference strings.",
-        jsonSchema: tombi({
-            additionalKeyLabel: "label"
-        })
-    })),
-    file: Schema.optional(Schema.Record({
-        key: Schema.String,
-        value: Schema.String
-    }).annotations({
-        title: "File references",
-        description: "Named values read from files. Values are file paths relative to the credentials directory.",
-        jsonSchema: tombi({
-            additionalKeyLabel: "label"
-        })
-    })),
-    value: Schema.optional(Schema.Record({
-        key: Schema.String,
-        value: Schema.Union(Schema.String, Schema.Record({
-            key: Schema.String,
-            value: Jsonifiable
-        }))
-    }).annotations({
-        title: "Inline values",
-        description: "Named inline values. Strings are used as-is, objects are JSON-stringified.",
-        jsonSchema: tombi({
-            additionalKeyLabel: "label"
-        })
-    }))
-}).annotations({
-    identifier: "ResolveSection",
-    title: "Resolve section",
-    description: "Named values resolved from 1Password, files, or inline. Referenced by resolved entries in secret and variable groups.",
-    jsonSchema: taplo({
-        links: {
-            key: "https://github.com/spencerbeggs/reposets/blob/main/docs/credentials.md"
-        }
-    })
-});
-const CredentialProfileSchema = Schema.Struct({
-    github_token: Schema.String.annotations({
-        title: "GitHub token",
-        description: "A GitHub personal access token (fine-grained) with administration, secrets, variables, environments, and GPG keys permissions",
-        examples: [
-            "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
-        ]
-    }),
-    op_service_account_token: Schema.optional(Schema.String.annotations({
-        title: "1Password service account token",
-        description: "A 1Password service account token for resolving op:// secret references",
-        examples: [
-            "ops_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
-        ]
-    })),
-    resolve: Schema.optional(ResolveSectionSchema)
-}).annotations({
-    identifier: "CredentialProfile",
-    title: "Credential profile",
-    description: "Authentication credentials for a GitHub account with optional named values for secret and variable resolution",
-    jsonSchema: taplo({
-        initKeys: [
-            "github_token"
-        ],
-        links: {
-            key: "https://github.com/spencerbeggs/reposets/blob/main/docs/credentials.md"
-        }
-    })
-});
-const CredentialsSchema = Schema.Struct({
-    profiles: Schema.optionalWith(Schema.Record({
-        key: Schema.String,
-        value: CredentialProfileSchema
-    }).annotations({
-        title: "Credential profiles",
-        description: "Named credential profiles. If only one profile is defined, it is used automatically for all repo groups.",
-        jsonSchema: tombi({
-            additionalKeyLabel: "profile_name"
-        })
-    }), {
-        default: ()=>({})
-    })
-}).annotations({
-    identifier: "Credentials",
-    title: "reposets Credentials",
-    description: "Authentication profiles for reposets. This file should be gitignored.",
-    jsonSchema: taplo({
-        initKeys: [
-            "profiles"
-        ],
-        links: {
-            key: "https://github.com/spencerbeggs/reposets/blob/main/docs/credentials.md"
-        }
-    })
-});
-const CONFIG_FILENAME = "reposets.config.toml";
-const CREDENTIALS_FILENAME = "reposets.credentials.toml";
-const ReposetsConfigFile = ConfigFile.Tag("reposets/Config");
-const ReposetsCredentialsFile = ConfigFile.Tag("reposets/Credentials");
-function validateConfigRefs(config) {
-    const errors = [];
-    const definedSettings = new Set(Object.keys(config.settings));
-    const definedSecrets = new Set(Object.keys(config.secrets));
-    const definedVariables = new Set(Object.keys(config.variables));
-    const definedRulesets = new Set(Object.keys(config.rulesets));
-    const definedEnvironments = new Set(Object.keys(config.environments));
-    const definedSecurity = new Set(Object.keys(config.security));
-    const definedCodeScanning = new Set(Object.keys(config.code_scanning));
-    for (const [groupName, group] of Object.entries(config.groups)){
-        if (group.settings) {
-            for (const ref of group.settings)if (!definedSettings.has(ref)) errors.push(`group '${groupName}': unknown settings group '${ref}'`);
-        }
-        if (group.rulesets) {
-            for (const ref of group.rulesets)if (!definedRulesets.has(ref)) errors.push(`group '${groupName}': unknown ruleset '${ref}'`);
-        }
-        if (group.environments) {
-            for (const ref of group.environments)if (!definedEnvironments.has(ref)) errors.push(`group '${groupName}': unknown environment '${ref}'`);
-        }
-        if (group.security) {
-            for (const ref of group.security)if (!definedSecurity.has(ref)) errors.push(`group '${groupName}': unknown security group '${ref}'`);
-        }
-        if (group.code_scanning) {
-            for (const ref of group.code_scanning)if (!definedCodeScanning.has(ref)) errors.push(`group '${groupName}': unknown code_scanning group '${ref}'`);
-        }
-        if (group.secrets) {
-            if (group.secrets.actions) {
-                for (const ref of group.secrets.actions)if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': unknown secrets group '${ref}'`);
-            }
-            if (group.secrets.dependabot) {
-                for (const ref of group.secrets.dependabot)if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': unknown secrets group '${ref}'`);
-            }
-            if (group.secrets.codespaces) {
-                for (const ref of group.secrets.codespaces)if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': unknown secrets group '${ref}'`);
-            }
-            if (group.secrets.environments) for (const [envName, secretGroups] of Object.entries(group.secrets.environments)){
-                if (!definedEnvironments.has(envName)) errors.push(`group '${groupName}': unknown environment '${envName}' in secrets.environments`);
-                for (const ref of secretGroups)if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': in secrets.environments.'${envName}': unknown secrets group '${ref}'`);
-            }
-        }
-        if (group.variables) {
-            if (group.variables.actions) {
-                for (const ref of group.variables.actions)if (!definedVariables.has(ref)) errors.push(`group '${groupName}': unknown variables group '${ref}'`);
-            }
-            if (group.variables.environments) for (const [envName, varGroups] of Object.entries(group.variables.environments)){
-                if (!definedEnvironments.has(envName)) errors.push(`group '${groupName}': unknown environment '${envName}' in variables.environments`);
-                for (const ref of varGroups)if (!definedVariables.has(ref)) errors.push(`group '${groupName}': in variables.environments.'${envName}': unknown variables group '${ref}'`);
-            }
-        }
-    }
-    if (errors.length > 0) return Effect.fail(new ConfigError({
-        operation: "validate",
-        reason: errors.join("\n")
-    }));
-    return Effect.succeed(config);
-}
-function makeConfigFilesLive(configFlag) {
-    const configResolvers = [];
-    if (Option.isSome(configFlag)) {
-        const flag = configFlag.value;
-        if (existsSync(flag) && statSync(flag).isDirectory()) configResolvers.push(StaticDir({
-            dir: flag,
-            filename: CONFIG_FILENAME
-        }));
-        else configResolvers.push(ExplicitPath(flag));
-    }
-    configResolvers.push(UpwardWalk({
-        filename: CONFIG_FILENAME
-    }), XdgConfigResolver({
-        filename: CONFIG_FILENAME
-    }));
-    return XdgConfigLive.multi({
-        app: new AppDirsConfig({
-            namespace: "reposets"
-        }),
-        configs: [
-            {
-                tag: ReposetsConfigFile,
-                schema: ConfigSchema,
-                codec: TomlCodec,
-                strategy: FirstMatch,
-                resolvers: configResolvers,
-                validate: validateConfigRefs
-            },
-            {
-                tag: ReposetsCredentialsFile,
-                schema: CredentialsSchema,
-                codec: TomlCodec,
-                strategy: FirstMatch,
-                resolvers: [
-                    UpwardWalk({
-                        filename: CREDENTIALS_FILENAME
-                    }),
-                    XdgConfigResolver({
-                        filename: CREDENTIALS_FILENAME
-                    })
-                ],
-                defaultPath: XdgSavePath(CREDENTIALS_FILENAME)
-            }
-        ]
-    });
-}
-const ConfigFilesLive = makeConfigFilesLive(Option.none());
-class OnePasswordClient extends Context.Tag("OnePasswordClient")() {
-}
-const OnePasswordClientLive = Layer.succeed(OnePasswordClient, {
-    resolve (reference, serviceAccountToken) {
-        return Effect.tryPromise({
-            try: async ()=>{
-                const { createClient } = await import("@1password/sdk");
-                const client = await createClient({
-                    auth: serviceAccountToken,
-                    integrationName: "reposets",
-                    integrationVersion: "1.0.0"
-                });
-                return await client.secrets.resolve(reference);
-            },
-            catch: (error)=>new OnePasswordError({
-                    message: `Failed to resolve ${reference}: ${error instanceof Error ? error.message : String(error)}`
-                })
-        });
-    }
-});
-function OnePasswordClientTest(stubs) {
-    return Layer.succeed(OnePasswordClient, {
-        resolve (reference, _serviceAccountToken) {
-            const value = stubs[reference];
-            if (void 0 === value) return Effect.fail(new OnePasswordError({
-                message: `Test stub: unknown reference ${reference}`
-            }));
-            return Effect.succeed(value);
-        }
-    });
-}
-class CredentialResolver extends Context.Tag("CredentialResolver")() {
-}
-const CredentialResolverLive = Layer.effect(CredentialResolver, Effect.gen(function*() {
-    const opClient = yield* OnePasswordClient;
-    return {
-        resolveAll (profile, basePath) {
-            return Effect.gen(function*() {
-                const result = new Map();
-                const resolveSection = profile.resolve;
-                if (!resolveSection) return result;
-                if (resolveSection.value) for (const [label, val] of Object.entries(resolveSection.value))if ("string" == typeof val) result.set(label, val);
-                else result.set(label, JSON.stringify(val));
-                if (resolveSection.file) for (const [label, filePath] of Object.entries(resolveSection.file)){
-                    const fullPath = isAbsolute(filePath) ? filePath : resolve(basePath, filePath);
-                    const content = yield* Effect["try"]({
-                        try: ()=>readFileSync(fullPath, "utf-8").trim(),
-                        catch: (error)=>new ResolveError({
-                                message: `Failed to read file for label '${label}': ${error instanceof Error ? error.message : String(error)}`
-                            })
-                    });
-                    result.set(label, content);
-                }
-                if (resolveSection.op) {
-                    const opToken = profile.op_service_account_token;
-                    if (!opToken) return yield* Effect.fail(new ResolveError({
-                        message: "No 1Password service account token provided but resolve.op entries are defined"
-                    }));
-                    for (const [label, reference] of Object.entries(resolveSection.op)){
-                        const value = yield* opClient.resolve(reference, opToken).pipe(Effect.mapError((err)=>new ResolveError({
-                                message: `Failed to resolve label '${label}': ${err.message}`
-                            })));
-                        result.set(label, value);
-                    }
-                }
-                return result;
-            });
-        }
-    };
-}));
-class GitHubClient extends Context.Tag("GitHubClient")() {
-}
-const ORG_ONLY_SETTINGS = new Set([
-    "allow_forking"
-]);
-const SAA_STATUS_FIELDS = new Set([
-    "advanced_security",
-    "code_security",
-    "secret_scanning",
-    "secret_scanning_push_protection",
-    "secret_scanning_ai_detection",
-    "secret_scanning_non_provider_patterns",
-    "secret_scanning_delegated_alert_dismissal",
-    "secret_scanning_delegated_bypass",
-    "dependabot_security_updates"
-]);
-function transformSecurityAndAnalysis(value) {
-    if (null === value || "object" != typeof value) return;
-    const input = value;
-    const out = {};
-    for (const [key, raw] of Object.entries(input))if (void 0 !== raw) {
-        if (SAA_STATUS_FIELDS.has(key) && ("enabled" === raw || "disabled" === raw)) out[key] = {
-            status: raw
-        };
-        else if ("delegated_bypass_reviewers" === key && Array.isArray(raw) && raw.length > 0) out.secret_scanning_delegated_bypass_options = {
-            reviewers: raw
-        };
-    }
-    return Object.keys(out).length > 0 ? out : void 0;
-}
-const GRAPHQL_SETTINGS = {
-    has_sponsorships: "hasSponsorshipsEnabled",
-    has_pull_requests: "hasPullRequestsEnabled"
-};
-function GitHubClientLive(token) {
-    return Layer.succeed(GitHubClient, (()=>{
-        const octokit = new Octokit({
-            auth: token
-        });
-        function wrapError(error) {
-            if (error instanceof Error) {
-                const asAny = error;
-                const status = "number" == typeof asAny.status ? asAny.status : void 0;
-                if (void 0 !== status) return new GitHubApiError({
-                    message: error.message,
-                    status
-                });
-                return new GitHubApiError({
-                    message: error.message
-                });
-            }
-            return new GitHubApiError({
-                message: String(error)
-            });
-        }
-        const ownerTypeCache = new Map();
-        const teamIdCache = new Map();
-        const roleIdCache = new Map();
-        return {
-            getOwnerType (owner) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const cached = ownerTypeCache.get(owner);
-                        if (cached) return cached;
-                        const { data } = await octokit.users.getByUsername({
-                            username: owner
-                        });
-                        const ownerType = "Organization" === data.type ? "Organization" : "User";
-                        ownerTypeCache.set(owner, ownerType);
-                        return ownerType;
-                    },
-                    catch: wrapError
-                });
-            },
-            syncSecret (owner, repo, name, value, scope) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        if ("actions" === scope) {
-                            const { data: publicKey } = await octokit.actions.getRepoPublicKey({
-                                owner,
-                                repo
-                            });
-                            const encryptedValue = encryptSecret(publicKey.key, value);
-                            await octokit.actions.createOrUpdateRepoSecret({
-                                owner,
-                                repo,
-                                secret_name: name,
-                                encrypted_value: encryptedValue,
-                                key_id: publicKey.key_id
-                            });
-                        } else if ("dependabot" === scope) {
-                            const { data: publicKey } = await octokit.dependabot.getRepoPublicKey({
-                                owner,
-                                repo
-                            });
-                            const encryptedValue = encryptSecret(publicKey.key, value);
-                            await octokit.dependabot.createOrUpdateRepoSecret({
-                                owner,
-                                repo,
-                                secret_name: name,
-                                encrypted_value: encryptedValue,
-                                key_id: publicKey.key_id
-                            });
-                        } else {
-                            const { data: publicKey } = await octokit.codespaces.getRepoPublicKey({
-                                owner,
-                                repo
-                            });
-                            const encryptedValue = encryptSecret(publicKey.key, value);
-                            await octokit.codespaces.createOrUpdateRepoSecret({
-                                owner,
-                                repo,
-                                secret_name: name,
-                                encrypted_value: encryptedValue,
-                                key_id: publicKey.key_id
-                            });
-                        }
-                    },
-                    catch: wrapError
-                });
-            },
-            syncVariable (owner, repo, name, value) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const { data } = await octokit.actions.listRepoVariables({
-                            owner,
-                            repo
-                        });
-                        const exists = data.variables.some((v)=>v.name === name);
-                        if (exists) await octokit.actions.updateRepoVariable({
-                            owner,
-                            repo,
-                            name,
-                            value
-                        });
-                        else await octokit.actions.createRepoVariable({
-                            owner,
-                            repo,
-                            name,
-                            value
-                        });
-                    },
-                    catch: wrapError
-                });
-            },
-            syncSettings (owner, repo, settings) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const restSettings = {};
-                        const graphqlInput = {};
-                        for (const [key, value] of Object.entries(settings)){
-                            if ("security_and_analysis" === key) {
-                                const saa = transformSecurityAndAnalysis(value);
-                                if (void 0 !== saa) restSettings.security_and_analysis = saa;
-                                continue;
-                            }
-                            const graphqlField = GRAPHQL_SETTINGS[key];
-                            if (void 0 !== graphqlField) graphqlInput[graphqlField] = value;
-                            else restSettings[key] = value;
-                        }
-                        if (false === restSettings.allow_merge_commit) {
-                            delete restSettings.merge_commit_title;
-                            delete restSettings.merge_commit_message;
-                        }
-                        if (false === restSettings.allow_squash_merge) {
-                            delete restSettings.squash_merge_commit_title;
-                            delete restSettings.squash_merge_commit_message;
-                        }
-                        if (Object.keys(restSettings).length > 0) await octokit.repos.update({
-                            owner,
-                            repo,
-                            ...restSettings
-                        });
-                        if (Object.keys(graphqlInput).length > 0) {
-                            const { data: repoData } = await octokit.repos.get({
-                                owner,
-                                repo
-                            });
-                            await octokit.graphql(`mutation UpdateRepository($input: UpdateRepositoryInput!) {
-										updateRepository(input: $input) {
-											repository { id }
-										}
-									}`, {
-                                input: {
-                                    repositoryId: repoData.node_id,
-                                    ...graphqlInput
-                                }
-                            });
-                        }
-                    },
-                    catch: wrapError
-                });
-            },
-            syncRuleset (owner, repo, name, payload) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const { data: existing } = await octokit.repos.getRepoRulesets({
-                            owner,
-                            repo
-                        });
-                        const match = existing.find((r)=>r.name === name);
-                        const body = {
-                            name: payload.name,
-                            target: payload.target,
-                            enforcement: payload.enforcement,
-                            ...void 0 !== payload.conditions ? {
-                                conditions: payload.conditions
-                            } : {},
-                            ...void 0 !== payload.rules ? {
-                                rules: payload.rules
-                            } : {},
-                            ...void 0 !== payload.bypass_actors ? {
-                                bypass_actors: payload.bypass_actors
-                            } : {}
-                        };
-                        if (match) await octokit.repos.updateRepoRuleset({
-                            owner,
-                            repo,
-                            ruleset_id: match.id,
-                            ...body
-                        });
-                        else await octokit.repos.createRepoRuleset({
-                            owner,
-                            repo,
-                            ...body
-                        });
-                    },
-                    catch: wrapError
-                });
-            },
-            listSecrets (owner, repo, scope) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        if ("actions" === scope) {
-                            const { data } = await octokit.actions.listRepoSecrets({
-                                owner,
-                                repo
-                            });
-                            return data.secrets.map((s)=>({
-                                    name: s.name
-                                }));
-                        }
-                        if ("dependabot" === scope) {
-                            const { data } = await octokit.dependabot.listRepoSecrets({
-                                owner,
-                                repo
-                            });
-                            return data.secrets.map((s)=>({
-                                    name: s.name
-                                }));
-                        }
-                        {
-                            const { data } = await octokit.codespaces.listRepoSecrets({
-                                owner,
-                                repo
-                            });
-                            return data.secrets.map((s)=>({
-                                    name: s.name
-                                }));
-                        }
-                    },
-                    catch: wrapError
-                });
-            },
-            listVariables (owner, repo) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const { data } = await octokit.actions.listRepoVariables({
-                            owner,
-                            repo
-                        });
-                        return data.variables.map((v)=>({
-                                name: v.name
-                            }));
-                    },
-                    catch: wrapError
-                });
-            },
-            listRulesets (owner, repo) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const { data } = await octokit.repos.getRepoRulesets({
-                            owner,
-                            repo
-                        });
-                        return data.map((r)=>({
-                                name: r.name,
-                                id: r.id,
-                                source_type: r.source_type
-                            }));
-                    },
-                    catch: wrapError
-                });
-            },
-            deleteSecret (owner, repo, name, scope) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        if ("actions" === scope) await octokit.actions.deleteRepoSecret({
-                            owner,
-                            repo,
-                            secret_name: name
-                        });
-                        else if ("dependabot" === scope) await octokit.dependabot.deleteRepoSecret({
-                            owner,
-                            repo,
-                            secret_name: name
-                        });
-                        else await octokit.codespaces.deleteRepoSecret({
-                            owner,
-                            repo,
-                            secret_name: name
-                        });
-                    },
-                    catch: wrapError
-                });
-            },
-            deleteVariable (owner, repo, name) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        await octokit.actions.deleteRepoVariable({
-                            owner,
-                            repo,
-                            name
-                        });
-                    },
-                    catch: wrapError
-                });
-            },
-            deleteRuleset (owner, repo, rulesetId) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        await octokit.repos.deleteRepoRuleset({
-                            owner,
-                            repo,
-                            ruleset_id: rulesetId
-                        });
-                    },
-                    catch: wrapError
-                });
-            },
-            syncEnvironment (owner, repo, name, config) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        await octokit.repos.createOrUpdateEnvironment({
-                            owner,
-                            repo,
-                            environment_name: name,
-                            ...config
-                        });
-                    },
-                    catch: wrapError
-                });
-            },
-            syncEnvironmentSecret (owner, repo, envName, name, value) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const { data: publicKey } = await octokit.actions.getEnvironmentPublicKey({
-                            owner,
-                            repo,
-                            environment_name: envName
-                        });
-                        const encrypted_value = encryptSecret(publicKey.key, value);
-                        await octokit.actions.createOrUpdateEnvironmentSecret({
-                            owner,
-                            repo,
-                            environment_name: envName,
-                            secret_name: name,
-                            encrypted_value,
-                            key_id: publicKey.key_id
-                        });
-                    },
-                    catch: wrapError
-                });
-            },
-            syncEnvironmentVariable (owner, repo, envName, name, value) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const { data } = await octokit.actions.listEnvironmentVariables({
-                            owner,
-                            repo,
-                            environment_name: envName
-                        });
-                        const exists = data.variables.some((v)=>v.name === name);
-                        if (exists) await octokit.actions.updateEnvironmentVariable({
-                            owner,
-                            repo,
-                            environment_name: envName,
-                            name,
-                            value
-                        });
-                        else await octokit.actions.createEnvironmentVariable({
-                            owner,
-                            repo,
-                            environment_name: envName,
-                            name,
-                            value
-                        });
-                    },
-                    catch: wrapError
-                });
-            },
-            listEnvironments (owner, repo) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const { data } = await octokit.repos.getAllEnvironments({
-                            owner,
-                            repo
-                        });
-                        return (data.environments ?? []).map((e)=>({
-                                name: e.name
-                            }));
-                    },
-                    catch: wrapError
-                });
-            },
-            listEnvironmentSecrets (owner, repo, envName) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const { data } = await octokit.actions.listEnvironmentSecrets({
-                            owner,
-                            repo,
-                            environment_name: envName
-                        });
-                        return data.secrets.map((s)=>({
-                                name: s.name
-                            }));
-                    },
-                    catch: wrapError
-                });
-            },
-            listEnvironmentVariables (owner, repo, envName) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const { data } = await octokit.actions.listEnvironmentVariables({
-                            owner,
-                            repo,
-                            environment_name: envName
-                        });
-                        return data.variables.map((v)=>({
-                                name: v.name
-                            }));
-                    },
-                    catch: wrapError
-                });
-            },
-            deleteEnvironment (owner, repo, name) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        await octokit.repos.deleteAnEnvironment({
-                            owner,
-                            repo,
-                            environment_name: name
-                        });
-                    },
-                    catch: wrapError
-                });
-            },
-            deleteEnvironmentSecret (owner, repo, envName, name) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        await octokit.actions.deleteEnvironmentSecret({
-                            owner,
-                            repo,
-                            environment_name: envName,
-                            secret_name: name
-                        });
-                    },
-                    catch: wrapError
-                });
-            },
-            deleteEnvironmentVariable (owner, repo, envName, name) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        await octokit.actions.deleteEnvironmentVariable({
-                            owner,
-                            repo,
-                            environment_name: envName,
-                            name
-                        });
-                    },
-                    catch: wrapError
-                });
-            },
-            getVulnerabilityAlerts (owner, repo) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        try {
-                            await octokit.request("GET /repos/{owner}/{repo}/vulnerability-alerts", {
-                                owner,
-                                repo
-                            });
-                            return true;
-                        } catch (error) {
-                            const status = error.status;
-                            if (404 === status) return false;
-                            throw error;
-                        }
-                    },
-                    catch: wrapError
-                });
-            },
-            setVulnerabilityAlerts (owner, repo, enabled) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        if (enabled) await octokit.request("PUT /repos/{owner}/{repo}/vulnerability-alerts", {
-                            owner,
-                            repo
-                        });
-                        else await octokit.request("DELETE /repos/{owner}/{repo}/vulnerability-alerts", {
-                            owner,
-                            repo
-                        });
-                    },
-                    catch: wrapError
-                });
-            },
-            getAutomatedSecurityFixes (owner, repo) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const { data } = await octokit.request("GET /repos/{owner}/{repo}/automated-security-fixes", {
-                            owner,
-                            repo
-                        });
-                        return Boolean(data.enabled);
-                    },
-                    catch: wrapError
-                });
-            },
-            setAutomatedSecurityFixes (owner, repo, enabled) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        if (enabled) await octokit.request("PUT /repos/{owner}/{repo}/automated-security-fixes", {
-                            owner,
-                            repo
-                        });
-                        else await octokit.request("DELETE /repos/{owner}/{repo}/automated-security-fixes", {
-                            owner,
-                            repo
-                        });
-                    },
-                    catch: wrapError
-                });
-            },
-            getPrivateVulnerabilityReporting (owner, repo) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const { data } = await octokit.request("GET /repos/{owner}/{repo}/private-vulnerability-reporting", {
-                            owner,
-                            repo
-                        });
-                        return Boolean(data.enabled);
-                    },
-                    catch: wrapError
-                });
-            },
-            setPrivateVulnerabilityReporting (owner, repo, enabled) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        if (enabled) await octokit.request("PUT /repos/{owner}/{repo}/private-vulnerability-reporting", {
-                            owner,
-                            repo
-                        });
-                        else await octokit.request("DELETE /repos/{owner}/{repo}/private-vulnerability-reporting", {
-                            owner,
-                            repo
-                        });
-                    },
-                    catch: wrapError
-                });
-            },
-            updateCodeScanningDefaultSetup (owner, repo, config) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const body = {};
-                        if (void 0 !== config.state) body.state = config.state;
-                        if (void 0 !== config.languages) body.languages = [
-                            ...config.languages
-                        ];
-                        if (void 0 !== config.query_suite) body.query_suite = config.query_suite;
-                        if (void 0 !== config.threat_model) body.threat_model = config.threat_model;
-                        if (void 0 !== config.runner_type) body.runner_type = config.runner_type;
-                        if (void 0 !== config.runner_label) body.runner_label = config.runner_label;
-                        await octokit.request("PATCH /repos/{owner}/{repo}/code-scanning/default-setup", {
-                            owner,
-                            repo,
-                            ...body
-                        });
-                    },
-                    catch: wrapError
-                });
-            },
-            listRepoLanguages (owner, repo) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const { data } = await octokit.repos.listLanguages({
-                            owner,
-                            repo
-                        });
-                        return Object.keys(data);
-                    },
-                    catch: wrapError
-                });
-            },
-            resolveTeamId (org, slug) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const cacheKey = `${org}:${slug}`;
-                        const cached = teamIdCache.get(cacheKey);
-                        if (void 0 !== cached) return cached;
-                        const { data } = await octokit.teams.getByName({
-                            org,
-                            team_slug: slug
-                        });
-                        teamIdCache.set(cacheKey, data.id);
-                        return data.id;
-                    },
-                    catch: wrapError
-                });
-            },
-            resolveRoleId (org, name) {
-                return Effect.tryPromise({
-                    try: async ()=>{
-                        const cacheKey = `${org}:${name}`;
-                        const cached = roleIdCache.get(cacheKey);
-                        if (void 0 !== cached) return cached;
-                        const { data } = await octokit.request("GET /orgs/{org}/organization-roles", {
-                            org
-                        });
-                        const roles = data.roles ?? [];
-                        const role = roles.find((r)=>r.name === name);
-                        if (!role) throw new Error(`organization role '${name}' not found in '${org}' (available: ${roles.map((r)=>r.name).join(", ") || "none"})`);
-                        roleIdCache.set(cacheKey, role.id);
-                        return role.id;
-                    },
-                    catch: wrapError
-                });
-            }
-        };
-    })());
-}
-function GitHubClientTest() {
-    const recorded = [];
-    const layer = Layer.succeed(GitHubClient, {
-        getOwnerType (_owner) {
-            return Effect.succeed("User");
-        },
-        syncSecret (owner, repo, name, _value, scope) {
-            recorded.push({
-                method: "syncSecret",
-                args: {
-                    owner,
-                    repo,
-                    name,
-                    scope
-                }
-            });
-            return Effect["void"];
-        },
-        syncVariable (owner, repo, name, _value) {
-            recorded.push({
-                method: "syncVariable",
-                args: {
-                    owner,
-                    repo,
-                    name
-                }
-            });
-            return Effect["void"];
-        },
-        syncSettings (owner, repo, settings) {
-            recorded.push({
-                method: "syncSettings",
-                args: {
-                    owner,
-                    repo,
-                    settings
-                }
-            });
-            return Effect["void"];
-        },
-        syncRuleset (owner, repo, name, _payload) {
-            recorded.push({
-                method: "syncRuleset",
-                args: {
-                    owner,
-                    repo,
-                    name
-                }
-            });
-            return Effect["void"];
-        },
-        listSecrets (_owner, _repo, _scope) {
-            return Effect.succeed([]);
-        },
-        listVariables (_owner, _repo) {
-            return Effect.succeed([]);
-        },
-        listRulesets (_owner, _repo) {
-            return Effect.succeed([]);
-        },
-        deleteSecret (owner, repo, name, scope) {
-            recorded.push({
-                method: "deleteSecret",
-                args: {
-                    owner,
-                    repo,
-                    name,
-                    scope
-                }
-            });
-            return Effect["void"];
-        },
-        deleteVariable (owner, repo, name) {
-            recorded.push({
-                method: "deleteVariable",
-                args: {
-                    owner,
-                    repo,
-                    name
-                }
-            });
-            return Effect["void"];
-        },
-        deleteRuleset (owner, repo, rulesetId) {
-            recorded.push({
-                method: "deleteRuleset",
-                args: {
-                    owner,
-                    repo,
-                    rulesetId
-                }
-            });
-            return Effect["void"];
-        },
-        syncEnvironment (owner, repo, name, _config) {
-            recorded.push({
-                method: "syncEnvironment",
-                args: {
-                    owner,
-                    repo,
-                    name
-                }
-            });
-            return Effect["void"];
-        },
-        syncEnvironmentSecret (owner, repo, envName, name, _value) {
-            recorded.push({
-                method: "syncEnvironmentSecret",
-                args: {
-                    owner,
-                    repo,
-                    envName,
-                    name
-                }
-            });
-            return Effect["void"];
-        },
-        syncEnvironmentVariable (owner, repo, envName, name, _value) {
-            recorded.push({
-                method: "syncEnvironmentVariable",
-                args: {
-                    owner,
-                    repo,
-                    envName,
-                    name
-                }
-            });
-            return Effect["void"];
-        },
-        listEnvironments (_owner, _repo) {
-            return Effect.succeed([]);
-        },
-        listEnvironmentSecrets (_owner, _repo, _envName) {
-            return Effect.succeed([]);
-        },
-        listEnvironmentVariables (_owner, _repo, _envName) {
-            return Effect.succeed([]);
-        },
-        deleteEnvironment (owner, repo, name) {
-            recorded.push({
-                method: "deleteEnvironment",
-                args: {
-                    owner,
-                    repo,
-                    name
-                }
-            });
-            return Effect["void"];
-        },
-        deleteEnvironmentSecret (owner, repo, envName, name) {
-            recorded.push({
-                method: "deleteEnvironmentSecret",
-                args: {
-                    owner,
-                    repo,
-                    envName,
-                    name
-                }
-            });
-            return Effect["void"];
-        },
-        deleteEnvironmentVariable (owner, repo, envName, name) {
-            recorded.push({
-                method: "deleteEnvironmentVariable",
-                args: {
-                    owner,
-                    repo,
-                    envName,
-                    name
-                }
-            });
-            return Effect["void"];
-        },
-        getVulnerabilityAlerts (_owner, _repo) {
-            return Effect.succeed(false);
-        },
-        setVulnerabilityAlerts (owner, repo, enabled) {
-            recorded.push({
-                method: "setVulnerabilityAlerts",
-                args: {
-                    owner,
-                    repo,
-                    enabled
-                }
-            });
-            return Effect["void"];
-        },
-        getAutomatedSecurityFixes (_owner, _repo) {
-            return Effect.succeed(false);
-        },
-        setAutomatedSecurityFixes (owner, repo, enabled) {
-            recorded.push({
-                method: "setAutomatedSecurityFixes",
-                args: {
-                    owner,
-                    repo,
-                    enabled
-                }
-            });
-            return Effect["void"];
-        },
-        getPrivateVulnerabilityReporting (_owner, _repo) {
-            return Effect.succeed(false);
-        },
-        setPrivateVulnerabilityReporting (owner, repo, enabled) {
-            recorded.push({
-                method: "setPrivateVulnerabilityReporting",
-                args: {
-                    owner,
-                    repo,
-                    enabled
-                }
-            });
-            return Effect["void"];
-        },
-        updateCodeScanningDefaultSetup (owner, repo, config) {
-            recorded.push({
-                method: "updateCodeScanningDefaultSetup",
-                args: {
-                    owner,
-                    repo,
-                    config
-                }
-            });
-            return Effect["void"];
-        },
-        listRepoLanguages (_owner, _repo) {
-            return Effect.succeed([]);
-        },
-        resolveTeamId (org, slug) {
-            recorded.push({
-                method: "resolveTeamId",
-                args: {
-                    org,
-                    slug
-                }
-            });
-            return Effect.succeed(0);
-        },
-        resolveRoleId (org, name) {
-            recorded.push({
-                method: "resolveRoleId",
-                args: {
-                    org,
-                    name
-                }
-            });
-            return Effect.succeed(0);
-        }
-    });
-    return {
-        layer,
-        calls: ()=>[
-                ...recorded
-            ]
-    };
-}
-class SyncLogger extends Context.Tag("SyncLogger")() {
-}
-function pluralize(resource, count) {
-    if (1 === count) return resource;
-    if ("ruleset" === resource) return "rulesets";
-    if ("security feature" === resource) return "security features";
-    if ("code scanning" === resource) return "code scanning";
-    return `${resource}s`;
-}
-function SyncLoggerLive(config) {
-    const { dryRun, logLevel, output } = config;
-    return Layer.effect(SyncLogger, Effect.gen(function*() {
-        const errors = yield* Ref.make([]);
-        const currentRepo = yield* Ref.make("");
-        function emit(line) {
-            if (output) return Ref.update(output, (lines)=>[
-                    ...lines,
-                    line
-                ]);
-            return Effect.sync(()=>{
-                process.stdout.write(`${line}\n`);
-            });
-        }
-        function isVisible(tier) {
-            if ("silent" === logLevel) return false;
-            const levels = [
-                "info",
-                "verbose",
-                "debug"
-            ];
-            return levels.indexOf(logLevel) >= levels.indexOf(tier);
-        }
-        function formatVerb(pastTense, presentTense) {
-            if (dryRun) return `would ${presentTense}`.padEnd(14);
-            return pastTense.padEnd(8);
-        }
-        return {
-            groupStart (name, repoCount) {
-                if (!isVisible("info")) return Effect["void"];
-                return emit(`group: ${name} (${repoCount} ${1 === repoCount ? "repo" : "repos"})`);
-            },
-            repoStart (owner, repo) {
-                const repoSlug = `${owner}/${repo}`;
-                if (!isVisible("info")) return Ref.set(currentRepo, repoSlug);
-                return Effect.gen(function*() {
-                    yield* Ref.set(currentRepo, repoSlug);
-                    yield* emit(`  repo: ${repoSlug}`);
-                });
-            },
-            repoSkip (owner, repo, reason) {
-                if (!isVisible("info")) return Effect["void"];
-                return Effect.gen(function*() {
-                    yield* emit(`  repo: ${owner}/${repo}`);
-                    yield* emit(`    skip    ${reason}`);
-                });
-            },
-            syncSummary (resource, count, detail) {
-                if (!isVisible("info")) return Effect["void"];
-                const verb = formatVerb("synced", "sync");
-                const noun = pluralize(resource, count);
-                const suffix = detail ? ` (${detail})` : "";
-                return emit(`    ${verb}${count} ${noun}${suffix}`);
-            },
-            settingsApplied () {
-                if (!isVisible("info")) return Effect["void"];
-                const verb = formatVerb("applied", "apply");
-                return emit(`    ${verb}settings`);
-            },
-            cleanupSummary (resource, count, names) {
-                if (!isVisible("info")) return Effect["void"];
-                const verb = formatVerb("deleted", "delete");
-                const noun = pluralize(resource, count);
-                const suffix = names.length > 0 ? ` (${names.join(", ")})` : "";
-                return emit(`    ${verb}${count} ${noun}${suffix}`);
-            },
-            syncOperation (verb, resource, name, detail, source) {
-                if (!isVisible("verbose")) return Effect["void"];
-                const formattedVerb = formatVerb(verb, verb);
-                const nameStr = name ? ` ${name}` : "";
-                const suffix = detail ? ` ${detail}` : "";
-                const sourceSuffix = source && isVisible("debug") ? ` <- ${source}` : "";
-                return emit(`    ${formattedVerb}${resource}${nameStr}${suffix}${sourceSuffix}`);
-            },
-            syncError (context, message) {
-                if (!isVisible("info")) return Effect["void"];
-                return Effect.gen(function*() {
-                    const repo = yield* Ref.get(currentRepo);
-                    yield* Ref.update(errors, (errs)=>[
-                            ...errs,
-                            {
-                                repo,
-                                context,
-                                message
-                            }
-                        ]);
-                    yield* emit(`    error   ${context}: ${message}`);
-                });
-            },
-            finish () {
-                if (!isVisible("info")) return Effect["void"];
-                return Effect.gen(function*() {
-                    const errs = yield* Ref.get(errors);
-                    if (0 === errs.length) yield* emit("Sync complete!");
-                    else {
-                        const label = 1 === errs.length ? "error" : "errors";
-                        yield* emit(`Sync complete with ${errs.length} ${label}:`);
-                        for (const err of errs)yield* emit(`  ${err.repo}: ${err.context} \u2014 ${err.message}`);
-                    }
-                });
-            }
-        };
-    }));
-}
-const ORG_ONLY_SAA_FIELDS = new Set([
-    "secret_scanning_delegated_alert_dismissal",
-    "secret_scanning_delegated_bypass",
-    "delegated_bypass_reviewers"
-]);
-const REPO_LANG_TO_CODEQL = {
-    JavaScript: "javascript-typescript",
-    TypeScript: "javascript-typescript",
-    C: "c-cpp",
-    "C++": "c-cpp",
-    "C#": "csharp",
-    Go: "go",
-    Java: "java-kotlin",
-    Kotlin: "java-kotlin",
-    Python: "python",
-    Ruby: "ruby",
-    Swift: "swift"
-};
-class SyncEngine extends Context.Tag("SyncEngine")() {
-}
-function isCleanupActive(scope) {
-    return false !== scope;
-}
-function getPreserveList(scope) {
-    if ("object" == typeof scope && "preserve" in scope) return new Set(scope.preserve);
-    return new Set();
-}
-function resolveResourceGroup(group, credentialMap, basePath) {
-    return Effect.gen(function*() {
-        const result = new Map();
-        if ("file" in group) for (const [name, filePath] of Object.entries(group.file)){
-            const fullPath = isAbsolute(filePath) ? filePath : resolve(basePath, filePath);
-            const content = yield* Effect["try"]({
-                try: ()=>readFileSync(fullPath, "utf-8").trim(),
-                catch: (error)=>new ResolveError({
-                        message: `Failed to read file for '${name}': ${error instanceof Error ? error.message : String(error)}`
-                    })
-            });
-            result.set(name, content);
-        }
-        else if ("value" in group) for (const [name, val] of Object.entries(group.value))result.set(name, "string" == typeof val ? val : JSON.stringify(val));
-        else if ("resolved" in group) for (const [name, label] of Object.entries(group.resolved)){
-            const value = credentialMap.get(label);
-            if (void 0 === value) yield* Effect.fail(new ResolveError({
-                message: `Credential label '${label}' not found for '${name}'`
-            }));
-            else result.set(name, value);
-        }
-        return result;
-    });
-}
-function resolveRulesetRefs(ruleset, credentialMap) {
-    const json = JSON.parse(JSON.stringify(ruleset));
-    substituteResolved(json, credentialMap);
-    return json;
-}
-function substituteResolved(obj, credentialMap) {
-    for (const [key, value] of Object.entries(obj))if (value && "object" == typeof value && !Array.isArray(value)) {
-        const rec = value;
-        if ("resolved" in rec && "string" == typeof rec.resolved) {
-            const resolved = credentialMap.get(rec.resolved);
-            if (void 0 === resolved) throw new Error(`Credential label '${rec.resolved}' not found for ruleset field '${key}'`);
-            const num = Number(resolved);
-            obj[key] = Number.isNaN(num) ? resolved : num;
-        } else substituteResolved(rec, credentialMap);
-    } else if (Array.isArray(value)) {
-        for (const item of value)if (item && "object" == typeof item) substituteResolved(item, credentialMap);
-    }
-}
-function groupEntryNames(group) {
-    if ("file" in group) return Object.keys(group.file);
-    if ("value" in group) return Object.keys(group.value);
-    if ("resolved" in group) return Object.keys(group.resolved);
-    return [];
-}
-function mergeSecurityAndAnalysis(blocks) {
-    const merged = {};
-    let hasAny = false;
-    for (const block of blocks)if (block) {
-        hasAny = true;
-        for (const [key, value] of Object.entries(block))if (void 0 !== value) merged[key] = value;
-    }
-    return hasAny ? merged : void 0;
-}
-function mergeSecurityGroups(groups) {
-    const merged = {};
-    for (const group of groups)if (group) {
-        for (const [key, value] of Object.entries(group))if ("boolean" == typeof value) merged[key] = value;
-    }
-    return merged;
-}
-function mergeCodeScanningGroups(groups) {
-    const merged = {};
-    for (const group of groups)if (group) {
-        for (const [key, value] of Object.entries(group))if (void 0 !== value) merged[key] = value;
-    }
-    return merged;
-}
-const SyncEngineLive = Layer.effect(SyncEngine, Effect.gen(function*() {
-    const github = yield* GitHubClient;
-    const credResolver = yield* CredentialResolver;
-    const logger = yield* SyncLogger;
-    return {
-        syncAll (config, credentials, options) {
-            return Effect.gen(function*() {
-                const { dryRun, noCleanup, groupFilter, repoFilter } = options;
-                const profileEntries = Object.entries(credentials.profiles);
-                const defaultProfileName = 1 === profileEntries.length ? profileEntries[0]?.[0] ?? "default" : "default";
-                const defaultProfile = credentials.profiles[defaultProfileName];
-                const groups = Object.entries(config.groups);
-                for (const [groupName, group] of groups){
-                    if (groupFilter && groupName !== groupFilter) continue;
-                    const owner = group.owner ?? config.owner ?? "";
-                    const profileName = group.credentials ?? defaultProfileName;
-                    const profile = credentials.profiles[profileName] ?? defaultProfile;
-                    yield* logger.groupStart(groupName, group.repos.length);
-                    const credentialMap = profile ? yield* credResolver.resolveAll(profile, options.configDir) : new Map();
-                    const ownerType = yield* github.getOwnerType(owner).pipe(Effect.catchTag("GitHubApiError", ()=>Effect.succeed("User")));
-                    const secretScopes = [
-                        "actions",
-                        "dependabot",
-                        "codespaces"
-                    ];
-                    const resolvedSecrets = new Map();
-                    for (const scope of secretScopes){
-                        const groupRefs = group.secrets?.[scope] ?? [];
-                        for (const groupRef of groupRefs){
-                            const secretGroup = config.secrets[groupRef];
-                            if (!secretGroup) continue;
-                            const entries = yield* resolveResourceGroup(secretGroup, credentialMap, options.configDir);
-                            const scopeMap = resolvedSecrets.get(scope) ?? new Map();
-                            for (const [name, value] of entries)scopeMap.set(name, value);
-                            resolvedSecrets.set(scope, scopeMap);
-                        }
-                    }
-                    const resolvedVariables = new Map();
-                    const variableGroupRefs = group.variables?.actions ?? [];
-                    for (const groupRef of variableGroupRefs){
-                        const variableGroup = config.variables[groupRef];
-                        if (!variableGroup) continue;
-                        const entries = yield* resolveResourceGroup(variableGroup, credentialMap, options.configDir);
-                        for (const [name, value] of entries)resolvedVariables.set(name, value);
-                    }
-                    const groupRulesetRefs = group.rulesets ?? [];
-                    const rulesetMap = new Map();
-                    for (const ref of groupRulesetRefs){
-                        const ruleset = config.rulesets[ref];
-                        if (ruleset) {
-                            const resolved = resolveRulesetRefs(ruleset, credentialMap);
-                            const payload = buildRulesetPayload(resolved);
-                            rulesetMap.set(ref, payload);
-                        }
-                    }
-                    const envRefs = group.environments ?? [];
-                    const envSecretMapping = group.secrets?.environments ?? {};
-                    const envVariableMapping = group.variables?.environments ?? {};
-                    const resolvedEnvSecrets = new Map();
-                    for (const [envName, groupRefs] of Object.entries(envSecretMapping)){
-                        const envMap = new Map();
-                        for (const groupRef of groupRefs){
-                            const secretGroup = config.secrets[groupRef];
-                            if (!secretGroup) continue;
-                            const entries = yield* resolveResourceGroup(secretGroup, credentialMap, options.configDir);
-                            for (const [name, value] of entries)envMap.set(name, value);
-                        }
-                        resolvedEnvSecrets.set(envName, envMap);
-                    }
-                    const resolvedEnvVariables = new Map();
-                    for (const [envName, groupRefs] of Object.entries(envVariableMapping)){
-                        const envMap = new Map();
-                        for (const groupRef of groupRefs){
-                            const variableGroup = config.variables[groupRef];
-                            if (!variableGroup) continue;
-                            const entries = yield* resolveResourceGroup(variableGroup, credentialMap, options.configDir);
-                            for (const [name, value] of entries)envMap.set(name, value);
-                        }
-                        resolvedEnvVariables.set(envName, envMap);
-                    }
-                    const effectiveCleanup = group.cleanup ?? {
-                        secrets: {
-                            actions: false,
-                            dependabot: false,
-                            codespaces: false,
-                            environments: false
-                        },
-                        variables: {
-                            actions: false,
-                            environments: false
-                        },
-                        rulesets: false,
-                        environments: false
-                    };
-                    const configuredSecretNames = (scope)=>{
-                        const refs = group.secrets?.[scope] ?? [];
-                        const names = new Set();
-                        for (const ref of refs){
-                            const grp = config.secrets[ref];
-                            if (grp) for (const name of groupEntryNames(grp))names.add(name);
-                        }
-                        return names;
-                    };
-                    const configuredVariableNames = ()=>{
-                        const refs = group.variables?.actions ?? [];
-                        const names = new Set();
-                        for (const ref of refs){
-                            const grp = config.variables[ref];
-                            if (grp) for (const name of groupEntryNames(grp))names.add(name);
-                        }
-                        return names;
-                    };
-                    const configuredRulesetNames = ()=>{
-                        const refs = group.rulesets ?? [];
-                        const names = new Set();
-                        for (const ref of refs){
-                            const ruleset = config.rulesets[ref];
-                            if (ruleset) names.add(ruleset.name);
-                        }
-                        return names;
-                    };
-                    const settingGroupRefs = group.settings ?? [];
-                    const mergedSettings = {};
-                    const skippedSettings = [];
-                    const saaBlocks = [];
-                    for (const ref of settingGroupRefs){
-                        const settingGroup = config.settings[ref];
-                        if (settingGroup) {
-                            const { security_and_analysis, ...rest } = settingGroup;
-                            Object.assign(mergedSettings, rest);
-                            saaBlocks.push(security_and_analysis);
-                        }
-                    }
-                    if ("User" === ownerType) {
-                        for (const key of ORG_ONLY_SETTINGS)if (key in mergedSettings) {
-                            delete mergedSettings[key];
-                            skippedSettings.push(key);
-                        }
-                    }
-                    const mergedSAA = mergeSecurityAndAnalysis(saaBlocks);
-                    const skippedSAA = [];
-                    if (mergedSAA) {
-                        const saaOut = {
-                            ...mergedSAA
-                        };
-                        if ("User" === ownerType) {
-                            for (const key of ORG_ONLY_SAA_FIELDS)if (key in saaOut) {
-                                delete saaOut[key];
-                                skippedSAA.push(key);
-                            }
-                        } else {
-                            const reviewers = saaOut.delegated_bypass_reviewers;
-                            if (Array.isArray(reviewers)) {
-                                const resolved = [];
-                                for (const reviewer of reviewers)if ("string" == typeof reviewer.team) {
-                                    const teamId = yield* github.resolveTeamId(owner, reviewer.team).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
-                                            yield* logger.syncError(`resolve team '${reviewer.team}'`, err.message);
-                                        })));
-                                    if (void 0 !== teamId) {
-                                        const entry = {
-                                            reviewer_id: teamId,
-                                            reviewer_type: "TEAM"
-                                        };
-                                        if (void 0 !== reviewer.mode) entry.mode = reviewer.mode;
-                                        resolved.push(entry);
-                                    }
-                                } else if ("string" == typeof reviewer.role) {
-                                    const roleId = yield* github.resolveRoleId(owner, reviewer.role).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
-                                            yield* logger.syncError(`resolve role '${reviewer.role}'`, err.message);
-                                        })));
-                                    if (void 0 !== roleId) {
-                                        const entry = {
-                                            reviewer_id: roleId,
-                                            reviewer_type: "ROLE"
-                                        };
-                                        if (void 0 !== reviewer.mode) entry.mode = reviewer.mode;
-                                        resolved.push(entry);
-                                    }
-                                }
-                                saaOut.delegated_bypass_reviewers = resolved;
-                            }
-                        }
-                        if (Object.keys(saaOut).length > 0) mergedSettings.security_and_analysis = saaOut;
-                    }
-                    const securityGroupRefs = group.security ?? [];
-                    const mergedSecurity = mergeSecurityGroups(securityGroupRefs.map((ref)=>config.security[ref]));
-                    const codeScanningRefs = group.code_scanning ?? [];
-                    const mergedCodeScanning = mergeCodeScanningGroups(codeScanningRefs.map((ref)=>config.code_scanning[ref]));
-                    const hasSecurity = Object.keys(mergedSecurity).length > 0;
-                    const securityContradiction = true === mergedSecurity.automated_security_fixes && false === mergedSecurity.vulnerability_alerts;
-                    const hasCodeScanning = Object.keys(mergedCodeScanning).length > 0;
-                    const hasSecrets = secretScopes.some((s)=>(resolvedSecrets.get(s)?.size ?? 0) > 0);
-                    const hasVariables = resolvedVariables.size > 0;
-                    const hasRulesets = rulesetMap.size > 0;
-                    const hasSettings = Object.keys(mergedSettings).length > 0;
-                    const hasEnvironments = envRefs.length > 0;
-                    const hasEnvSecrets = resolvedEnvSecrets.size > 0;
-                    const hasEnvVariables = resolvedEnvVariables.size > 0;
-                    const hasCleanup = !noCleanup && (isCleanupActive(effectiveCleanup.secrets.actions) || isCleanupActive(effectiveCleanup.secrets.dependabot) || isCleanupActive(effectiveCleanup.secrets.codespaces) || isCleanupActive(effectiveCleanup.secrets.environments) || isCleanupActive(effectiveCleanup.variables.actions) || isCleanupActive(effectiveCleanup.variables.environments) || isCleanupActive(effectiveCleanup.rulesets) || isCleanupActive(effectiveCleanup.environments));
-                    for (const repoName of group.repos)if (!repoFilter || repoName === repoFilter) {
-                        if (!hasSecrets && !hasVariables && !hasRulesets && !hasSettings && !hasEnvironments && !hasEnvSecrets && !hasEnvVariables && !hasSecurity && !hasCodeScanning && !hasCleanup) {
-                            yield* logger.repoSkip(owner, repoName, "no changes configured");
-                            continue;
-                        }
-                        yield* logger.repoStart(owner, repoName);
-                        if (!dryRun) {
-                            if (hasSettings) {
-                                yield* logger.syncOperation("apply", "settings", "");
-                                yield* github.syncSettings(owner, repoName, mergedSettings).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError("settings", err.message)));
-                            }
-                            for (const key of skippedSettings)yield* logger.syncOperation("skip", "setting", key, "(org-only, owner is a personal account)");
-                            for (const key of skippedSAA)yield* logger.syncOperation("skip", "security_and_analysis", key, "(org-only, owner is a personal account)");
-                            if (hasSecurity && securityContradiction) yield* logger.syncError("security merge", "automated_security_fixes = true requires vulnerability_alerts to be enabled (or omitted); skipping security sync");
-                            else if (hasSecurity) {
-                                if (void 0 !== mergedSecurity.vulnerability_alerts) {
-                                    const desired = mergedSecurity.vulnerability_alerts;
-                                    const current = yield* github.getVulnerabilityAlerts(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
-                                            yield* logger.syncError("get vulnerability_alerts", err.message);
-                                            return desired;
-                                        })));
-                                    if (current !== desired) {
-                                        yield* logger.syncOperation("sync", "vulnerability_alerts", desired ? "enable" : "disable");
-                                        yield* github.setVulnerabilityAlerts(owner, repoName, desired).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError("vulnerability_alerts", err.message)));
-                                    }
-                                }
-                                if (void 0 !== mergedSecurity.automated_security_fixes) {
-                                    const desired = mergedSecurity.automated_security_fixes;
-                                    const current = yield* github.getAutomatedSecurityFixes(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
-                                            yield* logger.syncError("get automated_security_fixes", err.message);
-                                            return desired;
-                                        })));
-                                    if (current !== desired) {
-                                        yield* logger.syncOperation("sync", "automated_security_fixes", desired ? "enable" : "disable");
-                                        yield* github.setAutomatedSecurityFixes(owner, repoName, desired).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError("automated_security_fixes", err.message)));
-                                    }
-                                }
-                                if (void 0 !== mergedSecurity.private_vulnerability_reporting) {
-                                    const desired = mergedSecurity.private_vulnerability_reporting;
-                                    const current = yield* github.getPrivateVulnerabilityReporting(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
-                                            yield* logger.syncError("get private_vulnerability_reporting", err.message);
-                                            return desired;
-                                        })));
-                                    if (current !== desired) {
-                                        yield* logger.syncOperation("sync", "private_vulnerability_reporting", desired ? "enable" : "disable");
-                                        yield* github.setPrivateVulnerabilityReporting(owner, repoName, desired).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError("private_vulnerability_reporting", err.message)));
-                                    }
-                                }
-                            }
-                            if (hasCodeScanning) {
-                                let desiredConfig = mergedCodeScanning;
-                                if (void 0 !== mergedCodeScanning.languages) {
-                                    const detected = yield* github.listRepoLanguages(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
-                                            yield* logger.syncError("list repo languages", err.message);
-                                            return [];
-                                        })));
-                                    const detectedCodeQL = new Set();
-                                    for (const lang of detected){
-                                        const mapped = REPO_LANG_TO_CODEQL[lang];
-                                        if (mapped) detectedCodeQL.add(mapped);
-                                    }
-                                    const filtered = [];
-                                    for (const lang of mergedCodeScanning.languages)if ("actions" === lang || detectedCodeQL.has(lang)) filtered.push(lang);
-                                    else yield* logger.syncOperation("skip", "code_scanning language", lang, "(not detected in repository)");
-                                    desiredConfig = {
-                                        ...mergedCodeScanning,
-                                        languages: filtered
-                                    };
-                                }
-                                yield* logger.syncOperation("sync", "code_scanning", desiredConfig.state ?? "default-setup");
-                                yield* github.updateCodeScanningDefaultSetup(owner, repoName, desiredConfig).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError("code_scanning default setup", err.message)));
-                            }
-                            for (const envName of envRefs){
-                                const envConfig = config.environments[envName];
-                                if (envConfig) {
-                                    yield* logger.syncOperation("sync", "environment", envName);
-                                    yield* github.syncEnvironment(owner, repoName, envName, envConfig).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`environment ${envName}`, err.message)));
-                                }
-                            }
-                            for (const scope of secretScopes){
-                                const scopeMap = resolvedSecrets.get(scope);
-                                if (scopeMap) for (const [name, value] of scopeMap){
-                                    yield* logger.syncOperation("sync", "secret", name, `(${scope})`);
-                                    yield* github.syncSecret(owner, repoName, name, value, scope).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`secret ${name} (${scope})`, err.message)));
-                                }
-                            }
-                            for (const [envName, envMap] of resolvedEnvSecrets)for (const [name, value] of envMap){
-                                yield* logger.syncOperation("sync", "secret", name, `(env: ${envName})`);
-                                yield* github.syncEnvironmentSecret(owner, repoName, envName, name, value).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`secret ${name} (env: ${envName})`, err.message)));
-                            }
-                            for (const [name, value] of resolvedVariables){
-                                yield* logger.syncOperation("sync", "variable", name);
-                                yield* github.syncVariable(owner, repoName, name, value).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`variable ${name}`, err.message)));
-                            }
-                            for (const [envName, envMap] of resolvedEnvVariables)for (const [name, value] of envMap){
-                                yield* logger.syncOperation("sync", "variable", name, `(env: ${envName})`);
-                                yield* github.syncEnvironmentVariable(owner, repoName, envName, name, value).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`variable ${name} (env: ${envName})`, err.message)));
-                            }
-                            for (const [_key, ruleset] of rulesetMap){
-                                yield* logger.syncOperation("sync", "ruleset", ruleset.name);
-                                yield* github.syncRuleset(owner, repoName, ruleset.name, ruleset).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`ruleset ${ruleset.name}`, err.message)));
-                            }
-                        }
-                        if (hasSecurity) {
-                            const securityCount = Object.values(mergedSecurity).filter((v)=>void 0 !== v).length;
-                            yield* logger.syncSummary("security feature", securityCount, "");
-                        }
-                        if (hasCodeScanning) yield* logger.syncSummary("code scanning", 1, mergedCodeScanning.state ?? "applied");
-                        if (hasEnvironments) yield* logger.syncSummary("environment", envRefs.length, "");
-                        if (hasSecrets) {
-                            const scopeCounts = [];
-                            let totalSecrets = 0;
-                            for (const scope of secretScopes){
-                                const count = resolvedSecrets.get(scope)?.size ?? 0;
-                                if (count > 0) {
-                                    scopeCounts.push(`${scope}: ${count}`);
-                                    totalSecrets += count;
-                                }
-                            }
-                            yield* logger.syncSummary("secret", totalSecrets, scopeCounts.join(", "));
-                        }
-                        if (hasVariables) yield* logger.syncSummary("variable", resolvedVariables.size, "");
-                        if (hasSettings) yield* logger.settingsApplied();
-                        if (rulesetMap.size > 0) yield* logger.syncSummary("ruleset", rulesetMap.size, "");
-                        if (!noCleanup) {
-                            if (isCleanupActive(effectiveCleanup.secrets.actions)) {
-                                const configured = configuredSecretNames("actions");
-                                const preserved = getPreserveList(effectiveCleanup.secrets.actions);
-                                const existing = yield* github.listSecrets(owner, repoName, "actions").pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
-                                        yield* logger.syncError("list secrets (actions)", err.message);
-                                        return [];
-                                    })));
-                                const toDelete = [];
-                                for (const { name } of existing)if (!configured.has(name) && !preserved.has(name)) {
-                                    toDelete.push(name);
-                                    yield* logger.syncOperation("delete", "secret", name, "(actions)");
-                                    if (!dryRun) yield* github.deleteSecret(owner, repoName, name, "actions").pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`delete secret ${name} (actions)`, err.message)));
-                                }
-                                if (toDelete.length > 0) yield* logger.cleanupSummary("secret", toDelete.length, toDelete);
-                            }
-                            if (isCleanupActive(effectiveCleanup.secrets.dependabot)) {
-                                const configured = configuredSecretNames("dependabot");
-                                const preserved = getPreserveList(effectiveCleanup.secrets.dependabot);
-                                const existing = yield* github.listSecrets(owner, repoName, "dependabot").pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
-                                        yield* logger.syncError("list secrets (dependabot)", err.message);
-                                        return [];
-                                    })));
-                                const toDelete = [];
-                                for (const { name } of existing)if (!configured.has(name) && !preserved.has(name)) {
-                                    toDelete.push(name);
-                                    yield* logger.syncOperation("delete", "secret", name, "(dependabot)");
-                                    if (!dryRun) yield* github.deleteSecret(owner, repoName, name, "dependabot").pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`delete secret ${name} (dependabot)`, err.message)));
-                                }
-                                if (toDelete.length > 0) yield* logger.cleanupSummary("secret", toDelete.length, toDelete);
-                            }
-                            if (isCleanupActive(effectiveCleanup.secrets.codespaces)) {
-                                const configured = configuredSecretNames("codespaces");
-                                const preserved = getPreserveList(effectiveCleanup.secrets.codespaces);
-                                const existing = yield* github.listSecrets(owner, repoName, "codespaces").pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
-                                        yield* logger.syncError("list secrets (codespaces)", err.message);
-                                        return [];
-                                    })));
-                                const toDelete = [];
-                                for (const { name } of existing)if (!configured.has(name) && !preserved.has(name)) {
-                                    toDelete.push(name);
-                                    yield* logger.syncOperation("delete", "secret", name, "(codespaces)");
-                                    if (!dryRun) yield* github.deleteSecret(owner, repoName, name, "codespaces").pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`delete secret ${name} (codespaces)`, err.message)));
-                                }
-                                if (toDelete.length > 0) yield* logger.cleanupSummary("secret", toDelete.length, toDelete);
-                            }
-                            if (isCleanupActive(effectiveCleanup.secrets.environments)) {
-                                const preserved = getPreserveList(effectiveCleanup.secrets.environments);
-                                const allEnvNames = new Set([
-                                    ...envRefs,
-                                    ...Object.keys(envSecretMapping)
-                                ]);
-                                for (const envName of allEnvNames){
-                                    const configuredNames = new Set();
-                                    for (const ref of envSecretMapping[envName] ?? []){
-                                        const grp = config.secrets[ref];
-                                        if (grp) for (const name of groupEntryNames(grp))configuredNames.add(name);
-                                    }
-                                    const existing = yield* github.listEnvironmentSecrets(owner, repoName, envName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
-                                            yield* logger.syncError(`list secrets (env: ${envName})`, err.message);
-                                            return [];
-                                        })));
-                                    const toDelete = [];
-                                    for (const { name } of existing)if (!configuredNames.has(name) && !preserved.has(name)) {
-                                        toDelete.push(name);
-                                        yield* logger.syncOperation("delete", "secret", name, `(env: ${envName})`);
-                                        if (!dryRun) yield* github.deleteEnvironmentSecret(owner, repoName, envName, name).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`delete secret ${name} (env: ${envName})`, err.message)));
-                                    }
-                                    if (toDelete.length > 0) yield* logger.cleanupSummary("secret", toDelete.length, toDelete);
-                                }
-                            }
-                            if (isCleanupActive(effectiveCleanup.variables.actions)) {
-                                const configured = configuredVariableNames();
-                                const preserved = getPreserveList(effectiveCleanup.variables.actions);
-                                const existing = yield* github.listVariables(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
-                                        yield* logger.syncError("list variables", err.message);
-                                        return [];
-                                    })));
-                                const toDelete = [];
-                                for (const { name } of existing)if (!configured.has(name) && !preserved.has(name)) {
-                                    toDelete.push(name);
-                                    yield* logger.syncOperation("delete", "variable", name);
-                                    if (!dryRun) yield* github.deleteVariable(owner, repoName, name).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`delete variable ${name}`, err.message)));
-                                }
-                                if (toDelete.length > 0) yield* logger.cleanupSummary("variable", toDelete.length, toDelete);
-                            }
-                            if (isCleanupActive(effectiveCleanup.variables.environments)) {
-                                const preserved = getPreserveList(effectiveCleanup.variables.environments);
-                                const allEnvVarNames = new Set([
-                                    ...envRefs,
-                                    ...Object.keys(envVariableMapping)
-                                ]);
-                                for (const envName of allEnvVarNames){
-                                    const configuredNames = new Set();
-                                    for (const ref of envVariableMapping[envName] ?? []){
-                                        const grp = config.variables[ref];
-                                        if (grp) for (const name of groupEntryNames(grp))configuredNames.add(name);
-                                    }
-                                    const existing = yield* github.listEnvironmentVariables(owner, repoName, envName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
-                                            yield* logger.syncError(`list variables (env: ${envName})`, err.message);
-                                            return [];
-                                        })));
-                                    const toDelete = [];
-                                    for (const { name } of existing)if (!configuredNames.has(name) && !preserved.has(name)) {
-                                        toDelete.push(name);
-                                        yield* logger.syncOperation("delete", "variable", name, `(env: ${envName})`);
-                                        if (!dryRun) yield* github.deleteEnvironmentVariable(owner, repoName, envName, name).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`delete variable ${name} (env: ${envName})`, err.message)));
-                                    }
-                                    if (toDelete.length > 0) yield* logger.cleanupSummary("variable", toDelete.length, toDelete);
-                                }
-                            }
-                            if (isCleanupActive(effectiveCleanup.rulesets)) {
-                                const configured = configuredRulesetNames();
-                                const preserved = getPreserveList(effectiveCleanup.rulesets);
-                                const existing = yield* github.listRulesets(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
-                                        yield* logger.syncError("list rulesets", err.message);
-                                        return [];
-                                    })));
-                                const toDelete = [];
-                                for (const { name, id, source_type } of existing)if ("Repository" === source_type) {
-                                    if (!configured.has(name) && !preserved.has(name)) {
-                                        toDelete.push(name);
-                                        yield* logger.syncOperation("delete", "ruleset", name);
-                                        if (!dryRun) yield* github.deleteRuleset(owner, repoName, id).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`delete ruleset ${name}`, err.message)));
-                                    }
-                                }
-                                if (toDelete.length > 0) yield* logger.cleanupSummary("ruleset", toDelete.length, toDelete);
-                            }
-                            if (isCleanupActive(effectiveCleanup.environments)) {
-                                const configuredEnvNames = new Set(envRefs);
-                                const preserved = getPreserveList(effectiveCleanup.environments);
-                                const existing = yield* github.listEnvironments(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
-                                        yield* logger.syncError("list environments", err.message);
-                                        return [];
-                                    })));
-                                const toDelete = [];
-                                for (const { name } of existing)if (!configuredEnvNames.has(name) && !preserved.has(name)) {
-                                    toDelete.push(name);
-                                    yield* logger.syncOperation("delete", "environment", name);
-                                    if (!dryRun) yield* github.deleteEnvironment(owner, repoName, name).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`delete environment ${name}`, err.message)));
-                                }
-                                if (toDelete.length > 0) yield* logger.cleanupSummary("environment", toDelete.length, toDelete);
-                            }
-                        }
-                    }
-                }
-                yield* logger.finish();
-            }).pipe(Effect.catchAll((error)=>Effect.fail(error instanceof SyncError ? error : new SyncError({
-                    message: error instanceof Error ? error.message : String(error)
-                }))));
-        }
-    };
-}));
-export { BypassActorSchema, CONFIG_FILENAME, CREDENTIALS_FILENAME, CleanupSchema, CleanupScopeSchema, ConfigFilesLive, ConfigSchema, CredentialProfileSchema, CredentialResolver, CredentialResolverLive, CredentialsSchema, GitHubApiError, GitHubClient, GitHubClientLive, GitHubClientTest, GroupSchema, LogLevelSchema, OnePasswordClient, OnePasswordClientLive, OnePasswordClientTest, OnePasswordError, ReposetsConfigFile, ReposetsCredentialsFile, ResolveError, ResolveSectionSchema, ResolvedRefSchema, RulesetSchema, SecretGroupSchema, SyncEngine, SyncEngineLive, SyncError, SyncLogger, SyncLoggerLive, VariableGroupSchema, buildRulesetPayload, encryptSecret, makeConfigFilesLive, validateConfigRefs };