reposets 0.4.2 → 1.0.0

package/cli/commands/history.js

@@ -0,0 +1,203 @@
+import { SyncJournal } from "../../store/SyncJournal.js";
+import { Effect } from "effect";
+import { Command, Flag } from "effect/unstable/cli";
+
+//#region src/cli/commands/history.ts
+const limitFlag = Flag.integer("limit").pipe(Flag.withDescription("How many runs to show, newest first"), Flag.withDefault(20));
+const repoFlag = Flag.string("repo").pipe(Flag.withDescription("Only runs that touched this repository, as \"owner/name\""), Flag.optional);
+/**
+* `2026-08-12 22:14` — enough to tell two runs apart, short enough to align.
+*
+* @remarks
+* The journal stores ISO-8601 UTC. Seconds are dropped because the column
+* exists to answer "which run was this", not to time anything; the run id is
+* the exact handle.
+*/
+const formatWhen = (iso) => iso.replace("T", " ").slice(0, 16);
+/** How long a run took, when it finished. */
+const formatDuration = (summary) => {
+	if (summary.finishedAt === null) return "—";
+	const millis = Date.parse(summary.finishedAt) - Date.parse(summary.startedAt);
+	if (Number.isNaN(millis) || millis < 0) return "—";
+	if (millis < 1e3) return `${millis}ms`;
+	const seconds = millis / 1e3;
+	return seconds < 60 ? `${seconds.toFixed(1)}s` : `${Math.floor(seconds / 60)}m${String(Math.round(seconds % 60)).padStart(2, "0")}s`;
+};
+/**
+* What became of a run.
+*
+* @remarks
+* A run with no `outcome` never reached `finishRun` — the process died mid-run
+* — which is a different and more alarming thing than a recorded failure, so it
+* gets its own word rather than being folded into "failed" or shown as blank.
+*/
+const formatOutcome = (summary) => {
+	if (summary.outcome !== null) return summary.outcome;
+	return summary.finishedAt === null ? "interrupted" : "unknown";
+};
+/** Pad, but never truncate — a long group name is worth more than the alignment. */
+const pad = (value, width) => value.padEnd(width);
+/**
+* Render the table, sizing each column to its widest cell.
+*
+* @remarks
+* Computed rather than fixed because group names and repository names are
+* user-supplied and unbounded. The `CliLogger` emits each line verbatim, so
+* alignment computed here survives to the terminal.
+*/
+const renderRows = (summaries) => {
+	const all = [{
+		id: "RUN",
+		when: "WHEN (UTC)",
+		outcome: "OUTCOME",
+		mode: "MODE",
+		group: "GROUP",
+		changes: "CHANGES",
+		took: "TOOK"
+	}, ...summaries.map((summary) => ({
+		id: summary.id.slice(0, 8),
+		when: formatWhen(summary.startedAt),
+		outcome: formatOutcome(summary),
+		mode: summary.dryRun === 1 ? "dry-run" : "applied",
+		group: summary.group ?? "(all)",
+		changes: String(summary.changes),
+		took: formatDuration(summary)
+	}))];
+	const width = (key) => Math.max(...all.map((row) => row[key].length));
+	return all.map((row) => `${pad(row.id, width("id"))}  ${pad(row.when, width("when"))}  ${pad(row.outcome, width("outcome"))}  ${pad(row.mode, width("mode"))}  ${pad(row.group, width("group"))}  ${row.changes.padStart(width("changes"))}  ${row.took}`);
+};
+/**
+* `reposets history` — what previous runs did.
+*
+* @remarks
+* New with the journal; there is no v3 equivalent. Newest first, because the
+* question is almost always "what happened just now".
+*
+* `--repo` filters to runs that **touched** that repository, which is what the
+* journal's query does — it joins through the recorded changes rather than
+* asking which group the repository belonged to. A run that was configured for
+* a repository but changed nothing in it does not appear, and that is the
+* useful reading: this is a record of what happened, not of what was intended.
+*
+* @public
+*/
+const historyHandler = (input) => Effect.gen(function* () {
+	const summaries = yield* (yield* SyncJournal).history({
+		limit: input.limit,
+		...input.repo === void 0 ? {} : { repo: input.repo }
+	});
+	if (summaries.length === 0) {
+		yield* Effect.log(input.repo === void 0 ? "No runs recorded yet. The journal fills in as you sync." : `No recorded run has touched ${input.repo}.`);
+		return;
+	}
+	for (const line of renderRows(summaries)) yield* Effect.log(line);
+	if (summaries.length === input.limit) {
+		yield* Effect.log("");
+		yield* Effect.log(`Showing the most recent ${input.limit}. Pass --limit for more.`);
+	}
+});
+/**
+* The present-tense form of a stored action, for a dry run.
+*
+* @remarks
+* `unchanged` and `drift-overwritten` are **observations, not operations** — a
+* dry run observed them just as truly as a real one would, so neither takes a
+* `would `. Only the three verbs that describe a write are rewritten.
+*/
+const wouldForm = (action) => action === "created" ? "create" : action === "updated" ? "update" : action === "deleted" ? "delete" : action;
+/**
+* `reposets history show <run>` — every resource one run touched.
+*
+* @remarks
+* The journal has recorded these from the start and nothing surfaced them, so
+* `12 changes` was a number with no way to ask *which twelve*.
+*
+* The id may be given in full or as a unique prefix, because nobody is going to
+* retype a UUID from a table.
+*/
+const showHandler = (prefix) => Effect.gen(function* () {
+	const journal = yield* SyncJournal;
+	const matches = (yield* journal.history({ limit: 1e3 }).pipe(Effect.orElseSucceed(() => []))).filter((run) => run.id.startsWith(prefix));
+	if (matches.length === 0) {
+		yield* Effect.logError(`No run matches '${prefix}'.`);
+		yield* Effect.sync(() => {
+			process.exitCode = 1;
+		});
+		return;
+	}
+	if (matches.length > 1) {
+		yield* Effect.logError(`'${prefix}' matches ${matches.length} runs. Use more of the id:`);
+		for (const run of matches.slice(0, 5)) yield* Effect.logError(`  ${run.id}  ${formatWhen(run.startedAt)}`);
+		yield* Effect.sync(() => {
+			process.exitCode = 1;
+		});
+		return;
+	}
+	const run = matches[0];
+	const changes = yield* journal.changesFor(run.id).pipe(Effect.orElseSucceed(() => []));
+	yield* Effect.log(`run ${run.id}`);
+	yield* Effect.log(`  ${formatWhen(run.startedAt)} · ${run.dryRun === 1 ? "dry-run" : "applied"} · ${run.outcome ?? "unfinished"} · ${formatDuration(run)}`);
+	yield* Effect.log("");
+	if (run.error !== null && run.error !== "") {
+		yield* Effect.log(`  error: ${run.error}`);
+		yield* Effect.log("");
+	}
+	if (changes.length === 0) {
+		yield* Effect.log(run.error !== null && run.error !== "" ? "  No resources changed." : "  No resources changed (nothing to do).");
+		return;
+	}
+	const byRepo = /* @__PURE__ */ new Map();
+	for (const change of changes) {
+		const existing = byRepo.get(change.repo);
+		if (existing === void 0) byRepo.set(change.repo, [change]);
+		else existing.push(change);
+	}
+	for (const [repo, records] of byRepo) {
+		yield* Effect.log(`  ${repo}`);
+		for (const record of records) {
+			const detail = record.detail === void 0 || record.detail === null ? "" : ` — ${record.detail}`;
+			const what = record.kind === record.name ? record.kind : `${record.kind} ${record.name}`;
+			const action = run.dryRun === 1 ? `would ${wouldForm(record.action)}` : record.action;
+			yield* Effect.log(`    ${action.padEnd(18)} ${what}${detail}`);
+		}
+	}
+});
+/**
+* `reposets history prune|clear` — the journal, and only the journal.
+*
+* @remarks
+* **These do not touch applied state or the cache**, and that is the whole
+* design. The same database holds the fingerprints drift detection compares
+* against; deleting those does not tidy anything, it disarms the check, so the
+* next run reports a first sync where an out-of-band edit actually happened.
+* A command that quietly did both would be the most dangerous thing in this CLI.
+*/
+const pruneHandler = (keep) => Effect.gen(function* () {
+	const removed = yield* (yield* SyncJournal).prune(keep).pipe(Effect.orElseSucceed(() => 0));
+	yield* Effect.log(removed === 0 ? `Nothing to prune; ${keep} or fewer runs are recorded.` : `Pruned ${removed} run${removed === 1 ? "" : "s"}, keeping the newest ${keep}.`);
+	yield* Effect.log("Applied state and the cache are untouched — drift detection still works.");
+});
+const clearHandler = () => Effect.gen(function* () {
+	const removed = yield* (yield* SyncJournal).clear().pipe(Effect.orElseSucceed(() => 0));
+	yield* Effect.log(`Cleared ${removed} run${removed === 1 ? "" : "s"} from the journal.`);
+	yield* Effect.log("Applied state and the cache are untouched — drift detection still works.");
+});
+/**
+* `reposets history`.
+*
+* @public
+*/
+const historyCommand = Command.make("history", {
+	limit: limitFlag,
+	repo: repoFlag
+}, ({ limit, repo }) => historyHandler({
+	limit,
+	repo: repo._tag === "Some" ? repo.value : void 0
+})).pipe(Command.withDescription("Show what previous sync runs did, newest first"), Command.withSubcommands([
+	Command.make("show", { run: Flag.string("run").pipe(Flag.withDescription("A run id, or a unique prefix")) }, ({ run }) => showHandler(run)).pipe(Command.withDescription("Show every resource one run touched")),
+	Command.make("prune", { keep: Flag.integer("keep").pipe(Flag.withDescription("How many of the newest runs to keep"), Flag.withDefault(50)) }, ({ keep }) => pruneHandler(keep)).pipe(Command.withDescription("Delete all but the newest runs from the journal")),
+	Command.make("clear", {}, () => clearHandler()).pipe(Command.withDescription("Delete every run from the journal"))
+]));
+
+//#endregion
+export { clearHandler, historyCommand, historyHandler, pruneHandler, showHandler };

package/cli/commands/init.js

@@ -1,17 +1,17 @@
-import { makeConfigFilesLive } from "../../services/ConfigFiles.js";
-import { AppDirs } from "xdg-effect";
-import { Effect, Option } from "effect";
-import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { Command, Options } from "@effect/cli";
+import { CONFIG_FILENAME, CREDENTIALS_FILENAME } from "../../services/ConfigFiles.js";
+import { Effect, FileSystem, Path } from "effect";
+import { Command, Flag } from "effect/unstable/cli";
+import { AppDirs } from "@effected/xdg";
+import { cwd } from "node:process";
 
 //#region src/cli/commands/init.ts
-const projectOption = Options.boolean("project").pipe(Options.withDescription("Create config in current directory instead of XDG/home location"), Options.withDefault(false));
+const projectFlag = Flag.boolean("project").pipe(Flag.withDescription("Scaffold into the current directory instead of the XDG config directory"));
 const CONFIG_TEMPLATE = `# reposets configuration
 # See: https://github.com/spencerbeggs/reposets
 
-# Default owner for all groups (can be overridden per group)
-# owner = "your-github-username"
+# The owner is NOT set here. It belongs to the credential profile a group
+# names, because a token authenticates as an identity — see
+# reposets.credentials.toml.
 
 # --- Settings groups ---
 # [settings.defaults]
@@ -20,128 +20,134 @@ const CONFIG_TEMPLATE = `# reposets configuration
 # delete_branch_on_merge = true
 
 # --- Secret groups ---
-# Secrets can be file, value, or resolved kind:
+# A secret group is exactly one kind: file, value, or resolved.
 #
 # [secrets.from-files.file]
 # APP_KEY = "./private/app-key"
 #
 # [secrets.inline.value]
-# STATIC_SECRET = "my-secret"
+# NON_SECRET = "safe-to-commit"
 #
 # [secrets.from-creds.resolved]
-# NPM_TOKEN = "MY_NPM_TOKEN"
+# NPM_TOKEN = "MY_NPM_TOKEN"   # a label from the credentials file's [resolve]
 
 # --- Variable groups ---
 # [variables.turbo.value]
 # DO_NOT_TRACK = "1"
-# TURBO_TELEMETRY_DISABLED = "1"
-#
-# [variables.bot.resolved]
-# APP_BOT_NAME = "MY_BOT_NAME"
 
 # --- Rulesets ---
 # [rulesets.default-branch]
 # name = "default-branch"
+# type = "branch"
 # enforcement = "active"
-# target = "branch"
-#
-# [rulesets.default-branch.conditions.ref_name]
-# include = ["~DEFAULT_BRANCH"]
-# exclude = []
-#
-# [[rulesets.default-branch.rules]]
-# type = "deletion"
+# targets = "default"
+# deletion = true
+# required_signatures = true
 
-# --- Advanced security ---
-# Nested inside a settings group (folded into the same PATCH /repos call).
-# Some fields are GHAS-licensed and only work on public repos or
-# private repos with a GHAS subscription. Org-only fields are silently
-# skipped on personal accounts.
-#
-# [settings.defaults.security_and_analysis]
-# secret_scanning = "enabled"
-# secret_scanning_push_protection = "enabled"
-# dependabot_security_updates = "enabled"
-
-# --- Security feature toggles ---
-# Dedicated PUT/DELETE endpoints; omit a key to leave it untouched.
-#
-# [security.oss-defaults]
-# vulnerability_alerts = true
-# automated_security_fixes = true
-# private_vulnerability_reporting = true
-
-# --- CodeQL default setup ---
-# Applies via PATCH /repos/{o}/{r}/code-scanning/default-setup.
-# Languages not detected in the repo are skipped with a warning.
-#
-# [code_scanning.oss-defaults]
-# state = "configured"
-# languages = ["javascript-typescript", "python"]
-# query_suite = "extended"
-# threat_model = "remote"
-
-# --- Cleanup defaults ---
-# [cleanup]
-# secrets = false
-# variables = false
-# rulesets = false
+# --- Deployment environments ---
+# [environments.production]
+# wait_timer = 5
+# prevent_self_review = true
 
 # --- Groups ---
 # [groups.my-projects]
 # repos = ["repo-one", "repo-two"]
+# credentials = "personal"   # REQUIRED: the profile this group authenticates as
 # settings = ["defaults"]
-# secrets = { actions = ["from-files", "from-creds"] }
-# variables = { actions = ["turbo", "bot"] }
-# rulesets = ["default-branch"]
-# security = ["oss-defaults"]
-# code_scanning = ["oss-defaults"]
+# secrets = { actions = ["from-creds"] }
 `;
-const CREDENTIALS_TEMPLATE = `# reposets credentials (keep this file private)
-# See: https://github.com/spencerbeggs/reposets
+const CREDENTIALS_TEMPLATE = `# reposets credentials
+#
+# This file holds REFERENCES, never secret values. Each entry names where a
+# credential lives — a 1Password item or an environment variable — so the file
+# itself discloses nothing if it leaks.
+#
+# 1Password references are resolved with OP_SERVICE_ACCOUNT_TOKEN from the
+# environment. That token is deliberately not stored here: it unlocks
+# everything else, so it does not belong in the same file as the things it
+# unlocks.
+#
+# Every group in reposets.config.toml names one of these profiles in its
+# 'credentials' field — that is the identity the group is synced as, and the
+# owner its repositories belong to. One owner per profile: a token that reaches
+# both your account and an org is declared as two profiles sharing a reference.
 
+# Every profile declares who it acts as: exactly one of username or org.
+# That is not bookkeeping — it decides which settings are even valid, and it
+# lets 'reposets validate' reject an organization-only setting with no network.
+#
 # [profiles.personal]
-# github_token = "ghp_your_token_here"
-# op_service_account_token = "ops_your_token_here"
+# username = "your-github-username"
+# github_token = { op = "op://Private/github/token" }
+#
+# [profiles.work]
+# org = "your-org"
+# github_token = { op = "op://Private/github/work-token" }
+
+# For CI, where a platform secret store injects the value:
+# [profiles.ci]
+# org = "your-org"
+# github_token = { env = "REPOSETS_GITHUB_TOKEN" }
+
+# Named values for 'resolved' secret and variable groups:
+# [profiles.personal.resolve.op]
+# MY_NPM_TOKEN = "op://Private/npm/token"
+#
+# [profiles.personal.resolve.env]
+# MY_BOT_NAME = "BOT_NAME"
+#
+# [profiles.personal.resolve.file]
+# MY_CERT = "./certs/bot.pem"
 `;
-const CREDENTIALS_FILE = "reposets.credentials.toml";
-const CONFIG_FILE = "reposets.config.toml";
-const initCommand = Command.make("init", { project: projectOption }, ({ project }) => Effect.gen(function* () {
-	const xdgConfigDir = yield* (yield* AppDirs).config;
-	const targetDir = project ? process.cwd() : xdgConfigDir;
-	if (!existsSync(targetDir)) mkdirSync(targetDir, { recursive: true });
-	const configPath = join(targetDir, CONFIG_FILE);
-	const credsPath = join(targetDir, CREDENTIALS_FILE);
-	if (existsSync(configPath)) yield* Effect.log(`Config already exists: ${configPath}`);
-	else {
-		writeFileSync(configPath, CONFIG_TEMPLATE);
-		yield* Effect.log(`Created: ${configPath}`);
-	}
-	if (existsSync(credsPath)) yield* Effect.log(`Credentials already exists: ${credsPath}`);
-	else {
-		writeFileSync(credsPath, CREDENTIALS_TEMPLATE);
-		yield* Effect.log(`Created: ${credsPath}`);
-	}
-	if (project) {
-		const gitignorePath = join(targetDir, ".gitignore");
-		if (existsSync(gitignorePath)) {
-			if (!readFileSync(gitignorePath, "utf-8").includes(CREDENTIALS_FILE)) {
-				appendFileSync(gitignorePath, `\n${CREDENTIALS_FILE}\n`);
-				yield* Effect.log(`Added ${CREDENTIALS_FILE} to .gitignore`);
-			}
-		} else {
-			writeFileSync(gitignorePath, `${CREDENTIALS_FILE}\n`);
-			yield* Effect.log(`Created .gitignore with ${CREDENTIALS_FILE}`);
-		}
-	} else {
-		const gitignorePath = join(targetDir, ".gitignore");
-		if (!existsSync(gitignorePath)) {
-			writeFileSync(gitignorePath, `${CREDENTIALS_FILE}\n`);
-			yield* Effect.log(`Created .gitignore in ${targetDir}`);
+/**
+* `reposets init` — scaffold the config and credentials files.
+*
+* @remarks
+* Writes into the XDG config directory by default, or the current directory
+* with `--project`. Existing files are reported and never overwritten — this
+* command must be safe to re-run against a configured machine.
+*
+* The credentials file is added to `.gitignore` in both modes. It contains only
+* references and so is not catastrophic to commit, but it still names a
+* person's vault layout, and the habit is worth keeping.
+*
+* @public
+*/
+const initHandler = (project) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const appDirs = yield* AppDirs;
+	const targetDir = project ? cwd() : yield* appDirs.ensureConfig;
+	yield* fs.makeDirectory(targetDir, { recursive: true });
+	/** Write a file unless it is already there; report either way. */
+	const scaffold = (name, contents) => Effect.gen(function* () {
+		const target = path.join(targetDir, name);
+		if (yield* fs.exists(target).pipe(Effect.orElseSucceed(() => false))) {
+			yield* Effect.log(`Already exists: ${target}`);
+			return;
 		}
+		yield* (yield* fs.writeFileString(target, contents).pipe(Effect.option))._tag === "Some" ? Effect.log(`Created: ${target}`) : Effect.logError(`Could not write: ${target}`);
+	});
+	yield* scaffold(CONFIG_FILENAME, CONFIG_TEMPLATE);
+	yield* scaffold(CREDENTIALS_FILENAME, CREDENTIALS_TEMPLATE);
+	const gitignorePath = path.join(targetDir, ".gitignore");
+	const existing = yield* fs.readFileString(gitignorePath).pipe(Effect.orElseSucceed(() => void 0));
+	if (existing === void 0) {
+		if ((yield* fs.writeFileString(gitignorePath, `${"reposets.credentials.toml"}\n`).pipe(Effect.option))._tag === "Some") yield* Effect.log(`Created .gitignore with ${CREDENTIALS_FILENAME}`);
+	} else if (!existing.includes("reposets.credentials.toml")) {
+		const separator = existing.endsWith("\n") ? "" : "\n";
+		if ((yield* fs.writeFileString(gitignorePath, `${existing}${separator}${"reposets.credentials.toml"}\n`).pipe(Effect.option))._tag === "Some") yield* Effect.log(`Added ${CREDENTIALS_FILENAME} to .gitignore`);
 	}
-	yield* Effect.log("\nDone! Edit your config and credentials files to get started.");
-}).pipe(Effect.provide(makeConfigFilesLive(Option.none())))).pipe(Command.withDescription("Scaffold config files"));
+	yield* Effect.log("");
+	yield* Effect.log("Done. Edit the config, then add a credential reference with:");
+	yield* Effect.log("  reposets credentials create --profile personal --username YOU --op \"op://Vault/item/field\"");
+});
+/**
+* `reposets init`.
+*
+* @public
+*/
+const initCommand = Command.make("init", { project: projectFlag }, ({ project }) => initHandler(project)).pipe(Command.withDescription("Scaffold reposets.config.toml and reposets.credentials.toml"));
 
 //#endregion
-export { initCommand };
+export { initCommand, initHandler };

package/cli/commands/list.js

@@ -1,49 +1,70 @@
-import { ReposetsConfigFile, makeConfigFilesLive } from "../../services/ConfigFiles.js";
+import { profileOwner } from "../../schemas/credentials.js";
+import { ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
 import { Effect } from "effect";
-import { Command, Options } from "@effect/cli";
+import { Command } from "effect/unstable/cli";
 
 //#region src/cli/commands/list.ts
-const configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
-const listCommand = Command.make("list", { config: configOption }, ({ config }) => Effect.gen(function* () {
-	const sources = yield* (yield* ReposetsConfigFile).discover;
-	if (sources.length === 0) {
-		yield* Effect.logError("No config file found.");
+/** `secrets` and `variables` render the same way; only the scope names differ. */
+const scopeParts = (scopes) => {
+	if (scopes === void 0) return [];
+	const parts = [];
+	for (const scope of [
+		"actions",
+		"dependabot",
+		"codespaces"
+	]) {
+		const groups = scopes[scope];
+		if (groups !== void 0 && groups.length > 0) parts.push(`${scope}:[${groups.join(",")}]`);
+	}
+	for (const [envName, envGroups] of Object.entries(scopes.environments ?? {})) if (envGroups.length > 0) parts.push(`environments.${envName}:[${envGroups.join(",")}]`);
+	return parts;
+};
+/**
+* `reposets list` — what the config declares, per group.
+*
+* @remarks
+* A reading command: it decodes the config and prints its structure, touching
+* neither GitHub nor the store. Empty collections are omitted rather than
+* printed as `(none)` — a group that assigns nothing should read as a short
+* entry, not a wall of blanks.
+*
+* @public
+*/
+const listHandler = Effect.gen(function* () {
+	const configFile = yield* ReposetsConfigFile;
+	const credentialsFile = yield* ReposetsCredentialsFile;
+	if ((yield* configFile.discover).length === 0) {
+		yield* Effect.logError("No config file found. Run 'reposets init' to create one.");
 		return;
 	}
-	const parsedConfig = sources[0].value;
-	const defaultOwner = parsedConfig.owner ?? "(not set)";
-	yield* Effect.log(`Default owner: ${defaultOwner}\n`);
-	for (const [groupName, group] of Object.entries(parsedConfig.groups)) {
-		const owner = group.owner ?? parsedConfig.owner ?? "(not set)";
-		yield* Effect.log(`[${groupName}] (owner: ${owner})`);
+	const config = yield* configFile.load;
+	const credentials = yield* credentialsFile.loadOrDefault({ profiles: {} });
+	for (const [groupName, group] of Object.entries(config.groups)) {
+		const profile = credentials.profiles[group.credentials];
+		const acts = profile === void 0 ? `credentials: ${group.credentials} — NOT FOUND` : `owner: ${profileOwner(profile).owner}, credentials: ${group.credentials}`;
+		yield* Effect.log(`[${groupName}] (${acts})`);
+		const owner = profile === void 0 ? "(unknown)" : profileOwner(profile).owner;
 		for (const repo of group.repos) yield* Effect.log(`  - ${owner}/${repo}`);
-		if (group.settings?.length) yield* Effect.log(`  settings: ${group.settings.join(", ")}`);
-		if (group.environments?.length) yield* Effect.log(`  environments: ${group.environments.join(", ")}`);
-		if (group.secrets) {
-			const parts = [];
-			if (group.secrets.actions?.length) parts.push(`actions:[${group.secrets.actions.join(",")}]`);
-			if (group.secrets.dependabot?.length) parts.push(`dependabot:[${group.secrets.dependabot.join(",")}]`);
-			if (group.secrets.codespaces?.length) parts.push(`codespaces:[${group.secrets.codespaces.join(",")}]`);
-			if (group.secrets.environments) {
-				for (const [envName, envGroups] of Object.entries(group.secrets.environments)) if (envGroups.length) parts.push(`environments.${envName}:[${envGroups.join(",")}]`);
-			}
-			if (parts.length) yield* Effect.log(`  secrets: ${parts.join(", ")}`);
-		}
-		if (group.variables) {
-			const parts = [];
-			if (group.variables.actions?.length) parts.push(`actions:[${group.variables.actions.join(",")}]`);
-			if (group.variables.environments) {
-				for (const [envName, envGroups] of Object.entries(group.variables.environments)) if (envGroups.length) parts.push(`environments.${envName}:[${envGroups.join(",")}]`);
-			}
-			if (parts.length) yield* Effect.log(`  variables: ${parts.join(", ")}`);
-		}
-		if (group.rulesets?.length) yield* Effect.log(`  rulesets: ${group.rulesets.join(", ")}`);
-		if (group.security?.length) yield* Effect.log(`  security: ${group.security.join(", ")}`);
-		if (group.code_scanning?.length) yield* Effect.log(`  code_scanning: ${group.code_scanning.join(", ")}`);
-		if (group.credentials) yield* Effect.log(`  credentials: ${group.credentials}`);
+		for (const [label, names] of [
+			["settings", group.settings],
+			["environments", group.environments],
+			["rulesets", group.rulesets],
+			["security", group.security],
+			["code_scanning", group.code_scanning]
+		]) if (names !== void 0 && names.length > 0) yield* Effect.log(`  ${label}: ${names.join(", ")}`);
+		const secrets = scopeParts(group.secrets);
+		if (secrets.length > 0) yield* Effect.log(`  secrets: ${secrets.join(", ")}`);
+		const variables = scopeParts(group.variables);
+		if (variables.length > 0) yield* Effect.log(`  variables: ${variables.join(", ")}`);
 		yield* Effect.log("");
 	}
-}).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Show config summary"));
+});
+/**
+* `reposets list`.
+*
+* @public
+*/
+const listCommand = Command.make("list", {}, () => listHandler).pipe(Command.withDescription("Show a summary of the config: groups, repos and their assigned resources"));
 
 //#endregion
-export { listCommand };
+export { listCommand, listHandler };