reposets 0.4.1 → 0.4.3

package/cli/commands/credentials.js

@@ -0,0 +1,74 @@
+import { ReposetsCredentialsFile, makeConfigFilesLive } from "../../services/ConfigFiles.js";
+import { AppDirs } from "xdg-effect";
+import { Effect, Option } from "effect";
+import { Command, Options } from "@effect/cli";
+
+//#region src/cli/commands/credentials.ts
+const EMPTY_CREDENTIALS = { profiles: {} };
+const profileOption = Options.text("profile").pipe(Options.withDescription("Credential profile name"));
+const githubTokenOption = Options.text("github-token").pipe(Options.withDescription("GitHub personal access token"), Options.optional);
+const opTokenOption = Options.text("op-token").pipe(Options.withDescription("1Password service account token"), Options.optional);
+function redactToken(token) {
+	if (token.length <= 8) return "****";
+	return `${token.slice(0, 4)}...${token.slice(-4)}`;
+}
+const createCommand = Command.make("create", {
+	profile: profileOption,
+	githubToken: githubTokenOption,
+	opToken: opTokenOption
+}, ({ profile, githubToken, opToken }) => Effect.gen(function* () {
+	yield* (yield* AppDirs).ensureConfig;
+	const credentialsFile = yield* ReposetsCredentialsFile;
+	if ((yield* credentialsFile.loadOrDefault(EMPTY_CREDENTIALS)).profiles[profile]) {
+		yield* Effect.logError(`Profile '${profile}' already exists. Delete it first.`);
+		return;
+	}
+	const newProfile = {};
+	if (githubToken._tag === "Some") newProfile.github_token = githubToken.value;
+	if (opToken._tag === "Some") newProfile.op_service_account_token = opToken.value;
+	if (!newProfile.github_token && !newProfile.op_service_account_token) {
+		yield* Effect.logError("Provide at least --github-token or --op-token.");
+		return;
+	}
+	yield* credentialsFile.update((current) => ({ profiles: {
+		...current.profiles,
+		[profile]: {
+			github_token: newProfile.github_token ?? "",
+			...newProfile
+		}
+	} }), EMPTY_CREDENTIALS);
+	yield* Effect.log(`Created profile '${profile}'.`);
+}).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("Add a credential profile"));
+const listCredsCommand = Command.make("list", {}, () => Effect.gen(function* () {
+	const creds = yield* (yield* ReposetsCredentialsFile).loadOrDefault(EMPTY_CREDENTIALS);
+	if (Object.keys(creds.profiles).length === 0) {
+		yield* Effect.log("No credential profiles configured.");
+		return;
+	}
+	for (const [name, profile] of Object.entries(creds.profiles)) {
+		yield* Effect.log(`[${name}]`);
+		if (profile.github_token) yield* Effect.log(`  github_token: ${redactToken(profile.github_token)}`);
+		if (profile.op_service_account_token) yield* Effect.log(`  op_service_account_token: ${redactToken(profile.op_service_account_token)}`);
+		yield* Effect.log("");
+	}
+}).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("List profiles (tokens redacted)"));
+const deleteCommand = Command.make("delete", { profile: profileOption }, ({ profile }) => Effect.gen(function* () {
+	yield* (yield* AppDirs).ensureConfig;
+	const credentialsFile = yield* ReposetsCredentialsFile;
+	const creds = yield* credentialsFile.loadOrDefault(EMPTY_CREDENTIALS);
+	if (!creds.profiles[profile]) {
+		yield* Effect.logError(`Profile '${profile}' not found.`);
+		return;
+	}
+	const { [profile]: _, ...remainingProfiles } = creds.profiles;
+	yield* credentialsFile.save({ profiles: remainingProfiles });
+	yield* Effect.log(`Deleted profile '${profile}'.`);
+}).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("Remove a profile"));
+const credentialsCommand = Command.make("credentials").pipe(Command.withDescription("Manage credential profiles"), Command.withSubcommands([
+	createCommand,
+	listCredsCommand,
+	deleteCommand
+]));
+
+//#endregion
+export { credentialsCommand };

package/cli/commands/doctor.js

@@ -0,0 +1,154 @@
+import { ReposetsConfigFile, makeConfigFilesLive } from "../../services/ConfigFiles.js";
+import { Effect } from "effect";
+import { readFileSync } from "node:fs";
+import { Command, Options } from "@effect/cli";
+import { parse } from "smol-toml";
+
+//#region src/cli/commands/doctor.ts
+const configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
+const KNOWN_CONFIG_KEYS = /* @__PURE__ */ new Set([
+	"owner",
+	"log_level",
+	"settings",
+	"secrets",
+	"variables",
+	"rulesets",
+	"environments",
+	"security",
+	"code_scanning",
+	"groups"
+]);
+const KNOWN_GROUP_KEYS = /* @__PURE__ */ new Set([
+	"owner",
+	"repos",
+	"credentials",
+	"settings",
+	"secrets",
+	"variables",
+	"rulesets",
+	"environments",
+	"security",
+	"code_scanning",
+	"cleanup"
+]);
+const KNOWN_CLEANUP_KEYS = /* @__PURE__ */ new Set([
+	"secrets",
+	"variables",
+	"rulesets",
+	"environments"
+]);
+const KNOWN_CLEANUP_SECRETS_KEYS = /* @__PURE__ */ new Set([
+	"actions",
+	"dependabot",
+	"codespaces",
+	"environments"
+]);
+const KNOWN_CLEANUP_VARIABLES_KEYS = /* @__PURE__ */ new Set(["actions", "environments"]);
+function findClosestMatch(key, known) {
+	let best;
+	let bestDist = Number.POSITIVE_INFINITY;
+	for (const candidate of known) {
+		const dist = levenshtein(key, candidate);
+		if (dist < bestDist && dist <= 3) {
+			bestDist = dist;
+			best = candidate;
+		}
+	}
+	return best;
+}
+function levenshtein(a, b) {
+	const matrix = [];
+	for (let i = 0; i <= a.length; i++) matrix[i] = [i];
+	for (let j = 0; j <= b.length; j++) matrix[0][j] = j;
+	for (let i = 1; i <= a.length; i++) for (let j = 1; j <= b.length; j++) {
+		const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+		matrix[i][j] = Math.min(matrix[i - 1][j] + 1, matrix[i][j - 1] + 1, matrix[i - 1][j - 1] + cost);
+	}
+	return matrix[a.length][b.length];
+}
+const doctorCommand = Command.make("doctor", { config: configOption }, ({ config }) => Effect.gen(function* () {
+	const configFile = yield* ReposetsConfigFile;
+	const discoverResult = yield* Effect.either(configFile.discover);
+	if (discoverResult._tag === "Left") {
+		yield* Effect.logError("No config found. Run 'reposets init' to create one.");
+		return;
+	}
+	const sources = discoverResult.right;
+	if (sources.length === 0) {
+		yield* Effect.logError("No config found. Run 'reposets init' to create one.");
+		return;
+	}
+	const configPath = sources[0].path;
+	let raw;
+	try {
+		raw = parse(readFileSync(configPath, "utf-8"));
+	} catch (err) {
+		yield* Effect.logError(`TOML parse error: ${err instanceof Error ? err.message : String(err)}`);
+		return;
+	}
+	let warnings = 0;
+	for (const key of Object.keys(raw)) if (!KNOWN_CONFIG_KEYS.has(key)) {
+		const suggestion = findClosestMatch(key, KNOWN_CONFIG_KEYS);
+		const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
+		yield* Effect.log(`Warning: unknown top-level key '${key}'${hint}`);
+		warnings++;
+	}
+	const groups = raw.groups;
+	if (groups && typeof groups === "object") {
+		for (const [groupName, group] of Object.entries(groups)) if (group && typeof group === "object") {
+			for (const key of Object.keys(group)) if (!KNOWN_GROUP_KEYS.has(key)) {
+				const suggestion = findClosestMatch(key, KNOWN_GROUP_KEYS);
+				const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
+				yield* Effect.log(`Warning: unknown key '${key}' in groups.${groupName}${hint}`);
+				warnings++;
+			}
+		}
+	}
+	if (groups && typeof groups === "object") for (const [groupName, group] of Object.entries(groups)) {
+		if (!group || typeof group !== "object") continue;
+		const cleanup = group.cleanup;
+		if (!cleanup || typeof cleanup !== "object") continue;
+		const cleanupObj = cleanup;
+		const prefix = `groups.${groupName}.cleanup`;
+		for (const key of Object.keys(cleanupObj)) if (!KNOWN_CLEANUP_KEYS.has(key)) {
+			const suggestion = findClosestMatch(key, KNOWN_CLEANUP_KEYS);
+			const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
+			yield* Effect.log(`Warning: unknown key '${key}' in ${prefix}${hint}`);
+			warnings++;
+		}
+		const secrets = cleanupObj.secrets;
+		if (secrets && typeof secrets === "object") {
+			for (const key of Object.keys(secrets)) if (!KNOWN_CLEANUP_SECRETS_KEYS.has(key)) {
+				const suggestion = findClosestMatch(key, KNOWN_CLEANUP_SECRETS_KEYS);
+				const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
+				yield* Effect.log(`Warning: unknown key '${key}' in ${prefix}.secrets${hint}`);
+				warnings++;
+			}
+		}
+		const variables = cleanupObj.variables;
+		if (variables && typeof variables === "object") {
+			for (const key of Object.keys(variables)) if (!KNOWN_CLEANUP_VARIABLES_KEYS.has(key)) {
+				const suggestion = findClosestMatch(key, KNOWN_CLEANUP_VARIABLES_KEYS);
+				const hint = suggestion ? ` -- did you mean '${suggestion}'?` : "";
+				yield* Effect.log(`Warning: unknown key '${key}' in ${prefix}.variables${hint}`);
+				warnings++;
+			}
+		}
+	}
+	yield* Effect.log("Schema validation: passed");
+	yield* Effect.log("\nRequired fine-grained token permissions:");
+	yield* Effect.log("  Repository permissions > Administration (Read and write) -- settings sync");
+	yield* Effect.log("  Repository permissions > Secrets (Read and write) -- Actions secrets");
+	yield* Effect.log("  Repository permissions > Variables (Read and write) -- Actions variables");
+	yield* Effect.log("  Repository permissions > Environments (Read and write) -- environment sync");
+	yield* Effect.log("  Repository permissions > Code scanning alerts (Read and write) -- code_scanning sync");
+	yield* Effect.log("  Repository permissions > Dependabot alerts (Read and write) -- security feature sync");
+	yield* Effect.log("  Repository permissions > Secret scanning alerts (Read and write) -- secret scanning delegation");
+	yield* Effect.log("  Account permissions > GPG keys (Read and write) -- secrets encryption key");
+	yield* Effect.log("  Organization permissions > Members (Read) -- resolve team slugs (org-level only)");
+	if (warnings === 0) yield* Effect.log("\nNo unknown keys detected.");
+	else yield* Effect.log(`\n${warnings} warning(s) found.`);
+}).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Deep config diagnostics with typo detection"));
+
+//#endregion
+export { doctorCommand };

package/cli/commands/init.js

@@ -0,0 +1,147 @@
+import { makeConfigFilesLive } from "../../services/ConfigFiles.js";
+import { AppDirs } from "xdg-effect";
+import { Effect, Option } from "effect";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { Command, Options } from "@effect/cli";
+
+//#region src/cli/commands/init.ts
+const projectOption = Options.boolean("project").pipe(Options.withDescription("Create config in current directory instead of XDG/home location"), Options.withDefault(false));
+const CONFIG_TEMPLATE = `# reposets configuration
+# See: https://github.com/spencerbeggs/reposets
+
+# Default owner for all groups (can be overridden per group)
+# owner = "your-github-username"
+
+# --- Settings groups ---
+# [settings.defaults]
+# has_wiki = false
+# has_issues = true
+# delete_branch_on_merge = true
+
+# --- Secret groups ---
+# Secrets can be file, value, or resolved kind:
+#
+# [secrets.from-files.file]
+# APP_KEY = "./private/app-key"
+#
+# [secrets.inline.value]
+# STATIC_SECRET = "my-secret"
+#
+# [secrets.from-creds.resolved]
+# NPM_TOKEN = "MY_NPM_TOKEN"
+
+# --- Variable groups ---
+# [variables.turbo.value]
+# DO_NOT_TRACK = "1"
+# TURBO_TELEMETRY_DISABLED = "1"
+#
+# [variables.bot.resolved]
+# APP_BOT_NAME = "MY_BOT_NAME"
+
+# --- Rulesets ---
+# [rulesets.default-branch]
+# name = "default-branch"
+# enforcement = "active"
+# target = "branch"
+#
+# [rulesets.default-branch.conditions.ref_name]
+# include = ["~DEFAULT_BRANCH"]
+# exclude = []
+#
+# [[rulesets.default-branch.rules]]
+# type = "deletion"
+
+# --- Advanced security ---
+# Nested inside a settings group (folded into the same PATCH /repos call).
+# Some fields are GHAS-licensed and only work on public repos or
+# private repos with a GHAS subscription. Org-only fields are silently
+# skipped on personal accounts.
+#
+# [settings.defaults.security_and_analysis]
+# secret_scanning = "enabled"
+# secret_scanning_push_protection = "enabled"
+# dependabot_security_updates = "enabled"
+
+# --- Security feature toggles ---
+# Dedicated PUT/DELETE endpoints; omit a key to leave it untouched.
+#
+# [security.oss-defaults]
+# vulnerability_alerts = true
+# automated_security_fixes = true
+# private_vulnerability_reporting = true
+
+# --- CodeQL default setup ---
+# Applies via PATCH /repos/{o}/{r}/code-scanning/default-setup.
+# Languages not detected in the repo are skipped with a warning.
+#
+# [code_scanning.oss-defaults]
+# state = "configured"
+# languages = ["javascript-typescript", "python"]
+# query_suite = "extended"
+# threat_model = "remote"
+
+# --- Cleanup defaults ---
+# [cleanup]
+# secrets = false
+# variables = false
+# rulesets = false
+
+# --- Groups ---
+# [groups.my-projects]
+# repos = ["repo-one", "repo-two"]
+# settings = ["defaults"]
+# secrets = { actions = ["from-files", "from-creds"] }
+# variables = { actions = ["turbo", "bot"] }
+# rulesets = ["default-branch"]
+# security = ["oss-defaults"]
+# code_scanning = ["oss-defaults"]
+`;
+const CREDENTIALS_TEMPLATE = `# reposets credentials (keep this file private)
+# See: https://github.com/spencerbeggs/reposets
+
+# [profiles.personal]
+# github_token = "ghp_your_token_here"
+# op_service_account_token = "ops_your_token_here"
+`;
+const CREDENTIALS_FILE = "reposets.credentials.toml";
+const CONFIG_FILE = "reposets.config.toml";
+const initCommand = Command.make("init", { project: projectOption }, ({ project }) => Effect.gen(function* () {
+	const xdgConfigDir = yield* (yield* AppDirs).config;
+	const targetDir = project ? process.cwd() : xdgConfigDir;
+	if (!existsSync(targetDir)) mkdirSync(targetDir, { recursive: true });
+	const configPath = join(targetDir, CONFIG_FILE);
+	const credsPath = join(targetDir, CREDENTIALS_FILE);
+	if (existsSync(configPath)) yield* Effect.log(`Config already exists: ${configPath}`);
+	else {
+		writeFileSync(configPath, CONFIG_TEMPLATE);
+		yield* Effect.log(`Created: ${configPath}`);
+	}
+	if (existsSync(credsPath)) yield* Effect.log(`Credentials already exists: ${credsPath}`);
+	else {
+		writeFileSync(credsPath, CREDENTIALS_TEMPLATE);
+		yield* Effect.log(`Created: ${credsPath}`);
+	}
+	if (project) {
+		const gitignorePath = join(targetDir, ".gitignore");
+		if (existsSync(gitignorePath)) {
+			if (!readFileSync(gitignorePath, "utf-8").includes(CREDENTIALS_FILE)) {
+				appendFileSync(gitignorePath, `\n${CREDENTIALS_FILE}\n`);
+				yield* Effect.log(`Added ${CREDENTIALS_FILE} to .gitignore`);
+			}
+		} else {
+			writeFileSync(gitignorePath, `${CREDENTIALS_FILE}\n`);
+			yield* Effect.log(`Created .gitignore with ${CREDENTIALS_FILE}`);
+		}
+	} else {
+		const gitignorePath = join(targetDir, ".gitignore");
+		if (!existsSync(gitignorePath)) {
+			writeFileSync(gitignorePath, `${CREDENTIALS_FILE}\n`);
+			yield* Effect.log(`Created .gitignore in ${targetDir}`);
+		}
+	}
+	yield* Effect.log("\nDone! Edit your config and credentials files to get started.");
+}).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("Scaffold config files"));
+
+//#endregion
+export { initCommand };

package/cli/commands/list.js

@@ -0,0 +1,49 @@
+import { ReposetsConfigFile, makeConfigFilesLive } from "../../services/ConfigFiles.js";
+import { Effect } from "effect";
+import { Command, Options } from "@effect/cli";
+
+//#region src/cli/commands/list.ts
+const configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
+const listCommand = Command.make("list", { config: configOption }, ({ config }) => Effect.gen(function* () {
+	const sources = yield* (yield* ReposetsConfigFile).discover;
+	if (sources.length === 0) {
+		yield* Effect.logError("No config file found.");
+		return;
+	}
+	const parsedConfig = sources[0].value;
+	const defaultOwner = parsedConfig.owner ?? "(not set)";
+	yield* Effect.log(`Default owner: ${defaultOwner}\n`);
+	for (const [groupName, group] of Object.entries(parsedConfig.groups)) {
+		const owner = group.owner ?? parsedConfig.owner ?? "(not set)";
+		yield* Effect.log(`[${groupName}] (owner: ${owner})`);
+		for (const repo of group.repos) yield* Effect.log(`  - ${owner}/${repo}`);
+		if (group.settings?.length) yield* Effect.log(`  settings: ${group.settings.join(", ")}`);
+		if (group.environments?.length) yield* Effect.log(`  environments: ${group.environments.join(", ")}`);
+		if (group.secrets) {
+			const parts = [];
+			if (group.secrets.actions?.length) parts.push(`actions:[${group.secrets.actions.join(",")}]`);
+			if (group.secrets.dependabot?.length) parts.push(`dependabot:[${group.secrets.dependabot.join(",")}]`);
+			if (group.secrets.codespaces?.length) parts.push(`codespaces:[${group.secrets.codespaces.join(",")}]`);
+			if (group.secrets.environments) {
+				for (const [envName, envGroups] of Object.entries(group.secrets.environments)) if (envGroups.length) parts.push(`environments.${envName}:[${envGroups.join(",")}]`);
+			}
+			if (parts.length) yield* Effect.log(`  secrets: ${parts.join(", ")}`);
+		}
+		if (group.variables) {
+			const parts = [];
+			if (group.variables.actions?.length) parts.push(`actions:[${group.variables.actions.join(",")}]`);
+			if (group.variables.environments) {
+				for (const [envName, envGroups] of Object.entries(group.variables.environments)) if (envGroups.length) parts.push(`environments.${envName}:[${envGroups.join(",")}]`);
+			}
+			if (parts.length) yield* Effect.log(`  variables: ${parts.join(", ")}`);
+		}
+		if (group.rulesets?.length) yield* Effect.log(`  rulesets: ${group.rulesets.join(", ")}`);
+		if (group.security?.length) yield* Effect.log(`  security: ${group.security.join(", ")}`);
+		if (group.code_scanning?.length) yield* Effect.log(`  code_scanning: ${group.code_scanning.join(", ")}`);
+		if (group.credentials) yield* Effect.log(`  credentials: ${group.credentials}`);
+		yield* Effect.log("");
+	}
+}).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Show config summary"));
+
+//#endregion
+export { listCommand };

package/cli/commands/sync.js

@@ -0,0 +1,70 @@
+import { ReposetsConfigFile, ReposetsCredentialsFile, makeConfigFilesLive } from "../../services/ConfigFiles.js";
+import { OnePasswordClientLive } from "../../services/OnePasswordClient.js";
+import { CredentialResolverLive } from "../../services/CredentialResolver.js";
+import { GitHubClientLive } from "../../services/GitHubClient.js";
+import { SyncLoggerLive } from "../../services/SyncLogger.js";
+import { SyncEngine, SyncEngineLive } from "../../services/SyncEngine.js";
+import { Effect, Layer } from "effect";
+import { dirname } from "node:path";
+import { Command, Options } from "@effect/cli";
+
+//#region src/cli/commands/sync.ts
+const configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
+const groupOption = Options.text("group").pipe(Options.withDescription("Sync only a specific repo group"), Options.optional);
+const repoOption = Options.text("repo").pipe(Options.withDescription("Sync only a specific repo"), Options.optional);
+const dryRunOption = Options.boolean("dry-run").pipe(Options.withDescription("Preview changes without making them"), Options.withDefault(false));
+const noCleanupOption = Options.boolean("no-cleanup").pipe(Options.withDescription("Skip cleanup of undeclared resources"), Options.withDefault(false));
+const logLevelOption = Options.choice("log-level", [
+	"silent",
+	"info",
+	"verbose",
+	"debug"
+]).pipe(Options.withDescription("Set output verbosity (overrides log_level in config)"), Options.optional);
+const syncCommand = Command.make("sync", {
+	config: configOption,
+	group: groupOption,
+	repo: repoOption,
+	dryRun: dryRunOption,
+	noCleanup: noCleanupOption,
+	logLevel: logLevelOption
+}, ({ config, group, repo, dryRun, noCleanup, logLevel: logLevelFlag }) => Effect.gen(function* () {
+	const sources = yield* (yield* ReposetsConfigFile).discover;
+	if (sources.length === 0) {
+		yield* Effect.logError("No config file found.");
+		return;
+	}
+	const parsedConfig = sources[0].value;
+	const configDir = dirname(sources[0].path);
+	const credentials = yield* (yield* ReposetsCredentialsFile).loadOrDefault({ profiles: {} });
+	const profileNames = Object.keys(credentials.profiles);
+	const defaultProfile = profileNames.length === 1 ? profileNames[0] : void 0;
+	const token = defaultProfile ? credentials.profiles[defaultProfile]?.github_token : void 0;
+	if (!token) {
+		yield* Effect.logError("No GitHub token found. Run 'reposets credentials create' first.");
+		return;
+	}
+	const logLevel = logLevelFlag._tag === "Some" ? logLevelFlag.value : parsedConfig.log_level;
+	const githubLayer = GitHubClientLive(token);
+	const opLayer = OnePasswordClientLive;
+	const resolverLayer = Layer.provide(CredentialResolverLive, opLayer);
+	const loggerLayer = SyncLoggerLive({
+		dryRun,
+		logLevel
+	});
+	const engineLayer = Layer.provideMerge(SyncEngineLive, Layer.merge(Layer.merge(githubLayer, resolverLayer), loggerLayer));
+	const groupFilter = group._tag === "Some" ? group.value : void 0;
+	const repoFilter = repo._tag === "Some" ? repo.value : void 0;
+	if (dryRun && logLevel !== "silent") yield* Effect.log("DRY RUN — no changes will be made\n");
+	yield* Effect.provide(Effect.gen(function* () {
+		yield* (yield* SyncEngine).syncAll(parsedConfig, credentials, {
+			dryRun,
+			noCleanup,
+			groupFilter,
+			repoFilter,
+			configDir
+		});
+	}), engineLayer);
+}).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Sync repos with GitHub"));
+
+//#endregion
+export { syncCommand };

package/cli/commands/validate.js

@@ -0,0 +1,53 @@
+import { ReposetsConfigFile, ReposetsCredentialsFile, makeConfigFilesLive } from "../../services/ConfigFiles.js";
+import { Effect } from "effect";
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { Command, Options } from "@effect/cli";
+
+//#region src/cli/commands/validate.ts
+const configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
+const validateCommand = Command.make("validate", { config: configOption }, ({ config }) => Effect.gen(function* () {
+	const configFile = yield* ReposetsConfigFile;
+	let hasErrors = false;
+	const configResult = yield* Effect.either(configFile.discover);
+	if (configResult._tag === "Left") {
+		yield* Effect.logError(`Config validation failed: ${configResult.left.message}`);
+		return;
+	}
+	const sources = configResult.right;
+	if (sources.length === 0) {
+		yield* Effect.logError("No config file found.");
+		return;
+	}
+	yield* Effect.log("Config schema: valid");
+	const parsedConfig = sources[0].value;
+	const configDir = dirname(sources[0].path);
+	for (const [groupName, group] of Object.entries(parsedConfig.secrets)) if ("file" in group) for (const [entryName, filePath] of Object.entries(group.file)) {
+		const fullPath = join(configDir, filePath);
+		if (!existsSync(fullPath)) {
+			yield* Effect.logError(`secrets.${groupName}.file.${entryName}: file not found: ${fullPath}`);
+			hasErrors = true;
+		}
+	}
+	for (const [groupName, group] of Object.entries(parsedConfig.variables)) if ("file" in group) for (const [entryName, filePath] of Object.entries(group.file)) {
+		const fullPath = join(configDir, filePath);
+		if (!existsSync(fullPath)) {
+			yield* Effect.logError(`variables.${groupName}.file.${entryName}: file not found: ${fullPath}`);
+			hasErrors = true;
+		}
+	}
+	const credentialsFile = yield* ReposetsCredentialsFile;
+	const credsResult = yield* Effect.either(credentialsFile.load);
+	if (credsResult._tag === "Left") yield* Effect.log("Credentials file: not found (optional)");
+	else {
+		yield* Effect.log("Credentials schema: valid");
+		for (const [groupName, group] of Object.entries(parsedConfig.groups)) if (group.credentials && !credsResult.right.profiles[group.credentials]) {
+			yield* Effect.logError(`Group '${groupName}': references unknown credentials profile '${group.credentials}'`);
+			hasErrors = true;
+		}
+	}
+	if (!hasErrors) yield* Effect.log("\nAll checks passed.");
+}).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Validate config without API calls"));
+
+//#endregion
+export { validateCommand };

package/errors.js

@@ -0,0 +1,12 @@
+import { Data } from "effect";
+
+//#region src/errors.ts
+/* v8 ignore start -- TaggedError class declarations, covered via errors.test.ts */
+var ResolveError = class extends Data.TaggedError("ResolveError") {};
+var OnePasswordError = class extends Data.TaggedError("OnePasswordError") {};
+var GitHubApiError = class extends Data.TaggedError("GitHubApiError") {};
+var SyncError = class extends Data.TaggedError("SyncError") {};
+/* v8 ignore stop */
+
+//#endregion
+export { GitHubApiError, OnePasswordError, ResolveError, SyncError };