reposets 0.4.2 → 1.0.0

package/services/SyncLogger.js

@@ -1,7 +1,7 @@
 import { Context, Effect, Layer, Ref } from "effect";
 
 //#region src/services/SyncLogger.ts
-var SyncLogger = class extends Context.Tag("SyncLogger")() {};
+/** Plural forms the naive `+ "s"` gets wrong. */
 function pluralize(resource, count) {
 	if (count === 1) return resource;
 	if (resource === "ruleset") return "rulesets";
@@ -9,95 +9,126 @@ function pluralize(resource, count) {
 	if (resource === "code scanning") return "code scanning";
 	return `${resource}s`;
 }
+/**
+* Dry-run-aware output for the sync pipeline.
+*
+* @remarks
+* Every line a run prints goes through here, so `SyncEngine` describes what
+* happened and this service decides how to say it.
+*
+* **There are no verbosity tiers.** There were four — `silent`, `info`,
+* `verbose`, `debug` — and enumerating what they actually gated is what
+* retired them: `verbose` guarded exactly one call site, the per-resource
+* operation line, which is the entire content of a sync. So the boundary did
+* not fall between summary and detail; it fell between *settings* and
+* everything else, and a dry run at the default tier reported a change count
+* with four fifths of the list suppressed.
+*
+* `silent` was worse: it suppressed errors too, so a failing run printed
+* nothing at all and the exit code was the only signal. Redirecting stdout does
+* that job better, because errors go to stderr and survive it.
+*
+* What remains is one output, plus `debug` for two diagnostic suffixes.
+*
+* **Drift outranks everything else a run reports.** `synced 3 secrets` says
+* reposets did its job; a drift line says *someone else* changed the repository
+* and reposets has just overwritten them. That is the one thing a human needs to
+* see without asking for it, so it is emitted at `info` alongside the summaries
+* rather than at `verbose` with the per-resource operations, and it is worded as
+* an observation about a person rather than as an action by the tool.
+*
+* Drift is reported even when nothing was written — the case where an
+* out-of-band edit happens to match the config. The tool has no work to do; the
+* human still changed something, and staying quiet would hide it.
+*
+* Lines are emitted with `Effect.log`, never `Console.log`: the CLI entrypoint
+* installs a logger that routes Effect's output, and a direct console write
+* would bypass both it and the filtering above.
+*
+* @public
+*/
+var SyncLogger = class extends Context.Service()("reposets/SyncLogger") {};
+/**
+* Build a live logger for one run.
+*
+* @remarks
+* A factory rather than a bare layer because both settings are per-invocation:
+* they come from the `--dry-run` and `--debug` flags, which are only known once
+* the command has parsed.
+*
+* @public
+*/
 function SyncLoggerLive(config) {
-	const { dryRun, logLevel, output } = config;
+	const { dryRun, debug } = config;
 	return Layer.effect(SyncLogger, Effect.gen(function* () {
 		const errors = yield* Ref.make([]);
 		const currentRepo = yield* Ref.make("");
-		function emit(line) {
-			if (output) return Ref.update(output, (lines) => [...lines, line]);
-			return Effect.sync(() => {
-				process.stdout.write(`${line}\n`);
-			});
-		}
-		function isVisible(tier) {
-			if (logLevel === "silent") return false;
-			const levels = [
-				"info",
-				"verbose",
-				"debug"
-			];
-			return levels.indexOf(logLevel) >= levels.indexOf(tier);
-		}
+		const emit = (line) => Effect.log(line);
 		/**
-		* Format a verb with padding. Normal verbs (past tense) are padded to 8 chars.
-		* Dry-run verbs ("would " + present tense) are padded to 14 chars.
-		* The padded string is concatenated directly with the rest of the line (no extra space).
+		* Failures, on the error channel.
+		*
+		* @remarks
+		* v3 put these on stdout with everything else. They move to stderr —
+		* where the CLI entrypoint routes `logError` — so that
+		* `reposets sync > log.txt` still shows failures on the terminal while
+		* the log captures progress. A deliberate change to piping behavior,
+		* permitted because CLI output compatibility is not a goal of the
+		* rebuild.
 		*/
-		function formatVerb(pastTense, presentTense) {
-			if (dryRun) return `would ${presentTense}`.padEnd(14);
-			return pastTense.padEnd(8);
-		}
+		const emitError = (line) => Effect.logError(line);
+		/**
+		* Pad a verb so the content after it lines up. Past-tense verbs pad to
+		* 8; the dry-run `would <present>` forms pad to 14. The result is
+		* concatenated directly, with no separating space.
+		*/
+		const formatVerb = (pastTense, presentTense) => dryRun ? `would ${presentTense}`.padEnd(14) : pastTense.padEnd(8);
 		return {
-			groupStart(name, repoCount) {
-				if (!isVisible("info")) return Effect.void;
-				return emit(`group: ${name} (${repoCount} ${repoCount === 1 ? "repo" : "repos"})`);
+			groupStart: (name, selected, declared) => {
+				const scope = selected === declared ? `${selected} ${selected === 1 ? "repo" : "repos"}` : `${selected} of ${declared} ${declared === 1 ? "repo" : "repos"}`;
+				return emit(`group: ${name} (${scope})`);
 			},
-			repoStart(owner, repo) {
+			repoStart: (owner, repo) => {
 				const repoSlug = `${owner}/${repo}`;
-				if (!isVisible("info")) return Ref.set(currentRepo, repoSlug);
-				return Effect.gen(function* () {
-					yield* Ref.set(currentRepo, repoSlug);
-					yield* emit(`  repo: ${repoSlug}`);
-				});
-			},
-			repoSkip(owner, repo, reason) {
-				if (!isVisible("info")) return Effect.void;
-				return Effect.gen(function* () {
-					yield* emit(`  repo: ${owner}/${repo}`);
-					yield* emit(`    skip    ${reason}`);
-				});
-			},
-			syncSummary(resource, count, detail) {
-				if (!isVisible("info")) return Effect.void;
-				return emit(`    ${formatVerb("synced", "sync")}${count} ${pluralize(resource, count)}${detail ? ` (${detail})` : ""}`);
+				return Ref.set(currentRepo, repoSlug).pipe(Effect.andThen(emit(`  repo: ${repoSlug}`)));
 			},
-			settingsApplied() {
-				if (!isVisible("info")) return Effect.void;
-				return emit(`    ${formatVerb("applied", "apply")}settings`);
+			settingsApplied: (fields) => {
+				const named = [...fields].sort();
+				const detail = named.length === 0 ? "" : named.length <= 6 ? ` (${named.join(", ")})` : ` (${named.length} fields: ${named.slice(0, 5).join(", ")}, …)`;
+				return emit(`    ${formatVerb("applied", "apply")}settings${detail}`);
 			},
-			cleanupSummary(resource, count, names) {
-				if (!isVisible("info")) return Effect.void;
-				return emit(`    ${formatVerb("deleted", "delete")}${count} ${pluralize(resource, count)}${names.length > 0 ? ` (${names.join(", ")})` : ""}`);
+			cleanupSummary: (resource, count, names) => {
+				const suffix = names.length > 0 ? ` (${names.join(", ")})` : "";
+				return emit(`    ${formatVerb("deleted", "delete")}${count} ${pluralize(resource, count)}${suffix}`);
 			},
-			syncOperation(verb, resource, name, detail, source) {
-				if (!isVisible("verbose")) return Effect.void;
-				return emit(`    ${formatVerb(verb, verb)}${resource}${name ? ` ${name}` : ""}${detail ? ` ${detail}` : ""}${source && isVisible("debug") ? ` <- ${source}` : ""}`);
+			syncOperation: (verb, resource, name, detail, source) => {
+				const nameStr = name ? ` ${name}` : "";
+				const suffix = detail ? ` ${detail}` : "";
+				const sourceSuffix = source && debug ? ` <- ${source}` : "";
+				return emit(`    ${formatVerb(verb, verb)}${resource}${nameStr}${suffix}${sourceSuffix}`);
 			},
-			syncError(context, message) {
-				if (!isVisible("info")) return Effect.void;
-				return Effect.gen(function* () {
-					const repo = yield* Ref.get(currentRepo);
-					yield* Ref.update(errors, (errs) => [...errs, {
-						repo,
-						context,
-						message
-					}]);
-					yield* emit(`    error   ${context}: ${message}`);
-				});
+			driftDetected: (resource, name, drift) => {
+				const consequence = !drift.needsApply ? "already matches config, nothing written" : dryRun ? "would overwrite" : "overwritten";
+				const fingerprints = debug ? ` <- applied ${drift.applied} live ${drift.live}` : "";
+				return emit(`    ${"drift".padEnd(8)}${resource} ${name} changed outside reposets — ${consequence}${fingerprints}`);
 			},
-			finish() {
-				if (!isVisible("info")) return Effect.void;
-				return Effect.gen(function* () {
-					const errs = yield* Ref.get(errors);
-					if (errs.length === 0) yield* emit("Sync complete!");
-					else {
-						const label = errs.length === 1 ? "error" : "errors";
-						yield* emit(`Sync complete with ${errs.length} ${label}:`);
-						for (const err of errs) yield* emit(`  ${err.repo}: ${err.context} \u2014 ${err.message}`);
-					}
-				});
-			}
+			syncError: (context, message) => Effect.gen(function* () {
+				const repo = yield* Ref.get(currentRepo);
+				yield* Ref.update(errors, (errs) => [...errs, {
+					repo,
+					context,
+					message
+				}]);
+				yield* emitError(`    error   ${context}: ${message}`);
+			}),
+			finish: () => Effect.gen(function* () {
+				const errs = yield* Ref.get(errors);
+				if (errs.length === 0) {
+					yield* emit("Sync complete!");
+					return;
+				}
+				yield* emitError(`Sync complete with ${errs.length} ${errs.length === 1 ? "error" : "errors"}:`);
+				for (const err of errs) yield* emitError(err.repo === "" ? `  ${err.context} — ${err.message}` : `  ${err.repo}: ${err.context} — ${err.message}`);
+			})
 		};
 	}));
 }

package/store/RepoCache.js

@@ -0,0 +1,86 @@
+import { Context, Duration, Effect, Layer, Schema } from "effect";
+import { Cache } from "@effected/store";
+
+//#region src/store/RepoCache.ts
+/**
+* Team ids effectively never change: a team keeps its id across renames, and a
+* deleted team's id is never reissued.
+*/
+const TEAM_TTL = Duration.days(30);
+/**
+* An account's type changes only when a user converts to an organization — a
+* one-way, deliberate, rare act.
+*/
+const OWNER_TTL = Duration.days(30);
+/**
+* Short by design. The language breakdown gates which CodeQL languages get
+* configured, so a stale list silently under-configures code scanning on a repo
+* that just gained a language. Ten minutes covers a multi-repo run without
+* outliving it.
+*/
+const LANGUAGES_TTL = Duration.minutes(10);
+const TeamId = Schema.fromJsonString(Schema.Int);
+const Owner = Schema.fromJsonString(Schema.Literals(["User", "Organization"]));
+const Languages = Schema.fromJsonString(Schema.Array(Schema.String));
+const Private = Schema.fromJsonString(Schema.Boolean);
+const Count = Schema.fromJsonString(Schema.Number);
+/**
+* The three GitHub lookups worth not repeating, held on disk between runs.
+*
+* @remarks
+* A sync run asks the same questions once per repo — what is this owner, what
+* is that team's id, what languages does this repo have — and the answers are
+* either immutable or slow-moving. Caching them on disk turns a group of twenty
+* repos from twenty round trips into one, and turns the second run of the day
+* into none.
+*
+* The read-through, the byte encoding and the decode-drift policy all live in
+* `@effected/store`'s `Cache.through` now. It takes a `Codec<A, string>` and
+* handles the last step to bytes itself, so nothing here touches a
+* `TextEncoder`. A stale entry that no longer decodes is treated as a miss and
+* overwritten — the package's documented contract, not a local choice.
+*
+* `CacheError` stays in the failure channel rather than being swallowed. A
+* cache whose database is unreadable is a real, reportable condition, and a
+* caller that would rather push through can say so with `Effect.catchTag`.
+*
+* TTLs are policy, not configuration: team ids and owner types are held for 30
+* days, repository languages for 10 minutes.
+*
+* @public
+*/
+var RepoCache = class extends Context.Service()("reposets/RepoCache", { make: Effect.gen(function* () {
+	const cache = yield* Cache;
+	const withCache = (effect) => Effect.provideService(effect, Cache, cache);
+	return {
+		teamId: (org, slug, onMiss) => withCache(Cache.through(`team:${org}/${slug}`, TeamId, {
+			ttl: TEAM_TTL,
+			tags: ["team"]
+		})(onMiss)),
+		ownerType: (owner, onMiss) => withCache(Cache.through(`owner:${owner}`, Owner, {
+			ttl: OWNER_TTL,
+			tags: ["owner"]
+		})(onMiss)),
+		repoLanguages: (owner, repo, onMiss) => withCache(Cache.through(`langs:${owner}/${repo}`, Languages, {
+			ttl: LANGUAGES_TTL,
+			tags: ["langs"]
+		})(onMiss)),
+		repoWorkflows: (owner, repo, onMiss) => withCache(Cache.through(`workflows:${owner}/${repo}`, Count, {
+			ttl: LANGUAGES_TTL,
+			tags: ["repo"]
+		})(onMiss)),
+		repoPrivate: (owner, repo, onMiss) => withCache(Cache.through(`private:${owner}/${repo}`, Private, {
+			ttl: LANGUAGES_TTL,
+			tags: ["repo"]
+		})(Effect.map(onMiss, (repository) => repository.private)))
+	};
+}) }) {};
+/**
+* Live cache, over the ambient {@link Cache}.
+*
+* @public
+*/
+const RepoCacheLive = Layer.effect(RepoCache, RepoCache.make);
+
+//#endregion
+export { RepoCache, RepoCacheLive };

package/store/SyncJournal.js

@@ -0,0 +1,92 @@
+import { Context, Crypto, DateTime, Effect, Layer } from "effect";
+import { Store } from "@effected/store";
+
+//#region src/store/SyncJournal.ts
+/**
+* Append-only record of what each sync run did.
+*
+* @remarks
+* The journal answers "what did that last sync actually do", after the fact and
+* after the process has exited. It is written on every run, including dry runs —
+* a dry run's record is the useful one when someone asks what *would* have
+* happened.
+*
+* @public
+*/
+var SyncJournal = class extends Context.Service()("reposets/SyncJournal", { make: Effect.gen(function* () {
+	const store = yield* Store;
+	const crypto = yield* Crypto.Crypto;
+	const sql = store.client;
+	return {
+		startRun: (options) => Effect.gen(function* () {
+			const id = yield* crypto.randomUUIDv7;
+			const startedAt = yield* DateTime.now;
+			yield* sql`
+						INSERT INTO sync_run (id, started_at, group_name, dry_run)
+						VALUES (${id}, ${DateTime.formatIso(startedAt)}, ${options.group ?? null}, ${options.dryRun ? 1 : 0})
+					`;
+			return id;
+		}),
+		recordChange: (runId, change) => sql`
+					INSERT INTO sync_change (run_id, repo, kind, name, action, detail)
+					VALUES (${runId}, ${change.repo}, ${change.kind}, ${change.name}, ${change.action}, ${change.detail ?? null})
+				`.pipe(Effect.asVoid),
+		finishRun: (runId, outcome, error) => Effect.gen(function* () {
+			const finishedAt = yield* DateTime.now;
+			yield* sql`
+						UPDATE sync_run
+						SET finished_at = ${DateTime.formatIso(finishedAt)}, outcome = ${outcome}, error = ${error ?? null}
+						WHERE id = ${runId}
+					`;
+		}).pipe(Effect.asVoid),
+		history: (options) => options.repo === void 0 ? sql`
+							SELECT r.id, r.started_at AS startedAt, r.finished_at AS finishedAt,
+							       r.group_name AS "group", r.dry_run AS dryRun, r.outcome, r.error,
+							       COUNT(c.run_id) AS changes
+							FROM sync_run r
+							LEFT JOIN sync_change c ON c.run_id = r.id
+							GROUP BY r.id
+							ORDER BY r.rowid DESC
+							LIMIT ${options.limit}
+						` : sql`
+							SELECT r.id, r.started_at AS startedAt, r.finished_at AS finishedAt,
+							       r.group_name AS "group", r.dry_run AS dryRun, r.outcome, r.error,
+							       COUNT(c.run_id) AS changes
+							FROM sync_run r
+							JOIN sync_change c ON c.run_id = r.id
+							WHERE c.repo = ${options.repo}
+							GROUP BY r.id
+							ORDER BY r.rowid DESC
+							LIMIT ${options.limit}
+						`,
+		changesFor: (runId) => sql`
+					SELECT repo, kind, name, action, detail
+					FROM sync_change
+					WHERE run_id = ${runId}
+					ORDER BY rowid
+				`,
+		prune: (keep) => Effect.gen(function* () {
+			const doomed = yield* sql`
+						SELECT id FROM sync_run
+						WHERE rowid NOT IN (SELECT rowid FROM sync_run ORDER BY rowid DESC LIMIT ${keep})
+					`;
+			if (doomed.length === 0) return 0;
+			yield* sql`DELETE FROM sync_run WHERE id IN ${sql.in(doomed.map((row) => row.id))}`;
+			return doomed.length;
+		}),
+		clear: () => Effect.gen(function* () {
+			const counted = yield* sql`SELECT COUNT(*) AS n FROM sync_run`;
+			yield* sql`DELETE FROM sync_run`;
+			return counted[0]?.n ?? 0;
+		})
+	};
+}) }) {};
+/**
+* Live journal, over the ambient {@link Store}.
+*
+* @public
+*/
+const SyncJournalLive = Layer.effect(SyncJournal, SyncJournal.make);
+
+//#endregion
+export { SyncJournal, SyncJournalLive };

package/store/migrations.js

@@ -0,0 +1,86 @@
+import { Effect } from "effect";
+
+//#region src/store/migrations.ts
+/**
+* The sync journal: one row per run, plus one row per resource the run changed.
+*
+* @remarks
+* Both tables are one migration because they are one unit — rolling back a
+* journal that kept its child table would leave `sync_change` orphaned with a
+* dangling foreign key.
+*
+* `group_name`, not `group` — `GROUP` is a SQL reserved word.
+*
+* `sync_run.id` is an application-generated identifier rather than an
+* autoincrementing integer, so a run's child rows can be written without a round
+* trip to read back the parent's rowid.
+*/
+const journal = {
+	id: 1,
+	name: "journal",
+	up: (sql) => Effect.gen(function* () {
+		yield* sql`
+				CREATE TABLE sync_run (
+					id           TEXT    PRIMARY KEY,
+					started_at   TEXT    NOT NULL,
+					finished_at  TEXT,
+					group_name   TEXT,
+					dry_run      INTEGER NOT NULL DEFAULT 0,
+					outcome      TEXT,
+					error        TEXT
+				)
+			`;
+		yield* sql`
+				CREATE TABLE sync_change (
+					run_id  TEXT NOT NULL REFERENCES sync_run(id) ON DELETE CASCADE,
+					repo    TEXT NOT NULL,
+					kind    TEXT NOT NULL,
+					name    TEXT NOT NULL,
+					action  TEXT NOT NULL,
+					detail  TEXT
+				)
+			`;
+		yield* sql`CREATE INDEX sync_change_run ON sync_change(run_id)`;
+	}),
+	down: (sql) => Effect.gen(function* () {
+		yield* sql`DROP TABLE sync_change`;
+		yield* sql`DROP TABLE sync_run`;
+	})
+};
+/**
+* Last-applied fingerprints, the basis of drift detection.
+*
+* @remarks
+* Keyed `(repo, kind, name)` so drift is tracked per resource per repo — two
+* repos in one group drift independently, which is the whole reason to record it.
+*/
+const drift = {
+	id: 2,
+	name: "drift",
+	up: (sql) => sql`
+		CREATE TABLE applied_state (
+			repo         TEXT NOT NULL,
+			kind         TEXT NOT NULL,
+			name         TEXT NOT NULL,
+			fingerprint  TEXT NOT NULL,
+			applied_at   TEXT NOT NULL,
+			run_id       TEXT NOT NULL,
+			PRIMARY KEY (repo, kind, name)
+		)
+	`,
+	down: (sql) => sql`DROP TABLE applied_state`
+};
+/**
+* Every migration reposets applies, in ascending `id` order.
+*
+* @remarks
+* **Every migration defines `down`.** `rollback` skips a migration that has none
+* while still removing its ledger row, which would leave the schema change in
+* place and let a later `migrate` re-run its `up` against an existing table.
+*
+* @public
+*/
+const migrations = [journal, drift];
+
+//#endregion
+export { migrations };

package/sync/SyncEngine.js

@@ -0,0 +1,156 @@
+import { profileOwner } from "../schemas/credentials.js";
+import { SyncJournal } from "../store/SyncJournal.js";
+import { CredentialResolver } from "../services/CredentialResolver.js";
+import { SyncLogger } from "../services/SyncLogger.js";
+import { RepoCache } from "../store/RepoCache.js";
+import { emptyResult, mergeResults, selectPhases } from "./phase.js";
+import { Context, Effect, Layer } from "effect";
+import { GitHubRepository, Repo, RepoRef } from "@effected/github";
+
+//#region src/sync/SyncEngine.ts
+/**
+* Runs the configured phases over every selected repository.
+*
+* @remarks
+* The engine owns sequencing and reporting; it knows nothing about what any
+* phase does. Phases are a list it walks — which is what lets `--only` and
+* `--skip` select a subset without the engine growing a branch per phase.
+*
+* It records changes into a run but does **not** open or close one: the run
+* boundary is the command's, since one `sync` may drive several engines when
+* its groups authenticate as different profiles.
+*
+* **A run never aborts on one repository's failure.** Phases return their errors
+* rather than raising them, so a rejected ruleset on the third repo does not
+* cost the remaining seventeen. Failures are logged inline, accumulated in the
+* journal, and summarised at the end.
+*
+* @public
+*/
+var SyncEngine = class extends Context.Service()("reposets/SyncEngine") {};
+/**
+* Build the engine from a phase list.
+*
+* @remarks
+* The phases are a parameter rather than an import so the engine can be tested
+* against fakes, and so a phase's dependencies stay in the phase rather than
+* accumulating in the engine's `R`.
+*
+* @public
+*/
+function SyncEngineLive(makePhases) {
+	return Layer.effect(SyncEngine, Effect.gen(function* () {
+		const phases = yield* makePhases;
+		const journal = yield* SyncJournal;
+		const logger = yield* SyncLogger;
+		const resolver = yield* CredentialResolver;
+		const cache = yield* RepoCache;
+		const repository = yield* GitHubRepository;
+		const syncAll = (config, credentials, options) => Effect.gen(function* () {
+			const runId = options.runId;
+			const selected = selectPhases(phases, {
+				...options.only === void 0 ? {} : { only: options.only },
+				...options.skip === void 0 ? {} : { skip: options.skip }
+			});
+			let repos = 0;
+			let drifted = 0;
+			const results = [];
+			for (const [groupName, group] of Object.entries(config.groups)) {
+				if (options.group !== void 0 && groupName !== options.group) continue;
+				const profile = credentials.profiles[group.credentials];
+				const declared = profile === void 0 ? void 0 : profileOwner(profile);
+				const owner = declared?.owner ?? "";
+				const declaredType = declared?.ownerType ?? "Organization";
+				const targeted = options.repo === void 0 ? group.repos : group.repos.filter((repo) => repo === options.repo);
+				yield* logger.groupStart(groupName, targeted.length, group.repos.length);
+				if (options.repo !== void 0 && targeted.length === 0) continue;
+				if (profile === void 0) {
+					const known = Object.keys(credentials.profiles);
+					const message = `group '${groupName}' names credential profile '${group.credentials}', which does not exist (has: ${known.length === 0 ? "none" : known.join(", ")})`;
+					results.push({
+						changes: [],
+						errors: [{
+							context: `group ${groupName}`,
+							message
+						}]
+					});
+					yield* logger.syncError(`group ${groupName}`, message);
+					continue;
+				}
+				const resolved = yield* resolver.resolveAll(profile, options.configDir).pipe(Effect.orElseSucceed(() => /* @__PURE__ */ new Map()));
+				for (const repo of group.repos) {
+					if (options.repo !== void 0 && repo !== options.repo) continue;
+					repos += 1;
+					yield* logger.repoStart(owner, repo);
+					const ref = RepoRef.make({
+						owner,
+						repo
+					});
+					const observed = yield* cache.ownerType(owner, repository.ownerType.pipe(Repo.provide(ref))).pipe(Effect.orElseSucceed(() => declaredType));
+					if (observed !== declaredType) {
+						const message = `profile '${group.credentials}' declares ${declaredType === "User" ? `username = "${owner}"` : `org = "${owner}"`}, but GitHub reports ${owner} is ${observed === "User" ? "a user" : "an organization"}`;
+						results.push({
+							changes: [],
+							errors: [{
+								context: `${owner}/${repo}`,
+								message
+							}]
+						});
+						yield* logger.syncError(`${owner}/${repo}`, message);
+						continue;
+					}
+					const ownerType = declaredType;
+					const ctx = {
+						owner,
+						repo,
+						slug: `${owner}/${repo}`,
+						group: groupName,
+						ownerType,
+						config,
+						credentials: resolved,
+						runId,
+						dryRun: options.dryRun,
+						noCleanup: options.noCleanup,
+						configDir: options.configDir
+					};
+					for (const phase of selected) {
+						if (!phase.appliesTo(ctx)) continue;
+						const result = yield* phase.run(ctx).pipe(Repo.provide(ref), Effect.orElseSucceed(() => emptyResult));
+						results.push(result);
+						for (const change of result.changes) {
+							if (change.action === "drift-overwritten") drifted += 1;
+							yield* journal.recordChange(runId, change).pipe(Effect.ignore);
+						}
+						for (const error of result.errors) yield* logger.syncError(error.context, error.message);
+					}
+				}
+			}
+			if (options.repo !== void 0 && repos === 0) {
+				const known = Object.entries(config.groups).filter(([name]) => options.group === void 0 || name === options.group).flatMap(([, group]) => group.repos);
+				const message = `no repository named '${options.repo}' in ${options.group === void 0 ? "any configured group" : `group '${options.group}'`} (has: ${known.join(", ") || "none"})`;
+				results.push({
+					changes: [],
+					errors: [{
+						context: `--repo ${options.repo}`,
+						message
+					}]
+				});
+				yield* logger.syncError(`--repo ${options.repo}`, message);
+			}
+			const merged = mergeResults(results);
+			const errorSummary = merged.errors.length === 0 ? void 0 : merged.errors.length === 1 ? `${merged.errors[0]?.context}: ${merged.errors[0]?.message}` : `${merged.errors.length} errors, first: ${merged.errors[0]?.context}: ${merged.errors[0]?.message}`;
+			return {
+				runId,
+				repos,
+				changes: merged.changes.length,
+				drifted,
+				errors: merged.errors.length,
+				errorSummary
+			};
+		});
+		return { syncAll };
+	}));
+}
+
+//#endregion
+export { SyncEngine, SyncEngineLive };