reposets 0.4.3 → 1.0.0

package/cli/commands/nuke.js

@@ -0,0 +1,127 @@
+import { CONFIG_FILENAME, CREDENTIALS_FILENAME } from "../../services/ConfigFiles.js";
+import { Effect, FileSystem, Path } from "effect";
+import { Command, Flag, Prompt } from "effect/unstable/cli";
+import { AppDirs } from "@effected/xdg";
+
+//#region src/cli/commands/nuke.ts
+const forceFlag = Flag.boolean("force").pipe(Flag.withDescription("Delete without asking. Intended for scripts; there is no undo"));
+/**
+* Everything reposets has written to this machine.
+*
+* @remarks
+* Assembled by **looking**, not by assuming: only paths that exist are
+* returned, so the confirmation lists what will actually be deleted rather than
+* everything that might. A prompt that overstates is a prompt people learn to
+* skim.
+*
+* The upward walk mirrors the config resolver's own chain — a project-local
+* file anywhere between the working directory and the filesystem root — because
+* the file a user is thinking of is the one the CLI would load, and that is not
+* always the one in the current directory.
+*/
+const findTargets = (fs, path, appDirs, from) => Effect.gen(function* () {
+	const candidates = [];
+	let dir = from;
+	for (;;) {
+		candidates.push({
+			path: path.join(dir, CONFIG_FILENAME),
+			what: "project config",
+			cost: "your groups and settings"
+		}, {
+			path: path.join(dir, CREDENTIALS_FILENAME),
+			what: "project credentials",
+			cost: "token references, not tokens"
+		});
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	candidates.push({
+		path: path.join(appDirs.dirs.config, CONFIG_FILENAME),
+		what: "user config",
+		cost: "your groups and settings"
+	}, {
+		path: path.join(appDirs.dirs.config, CREDENTIALS_FILENAME),
+		what: "user credentials",
+		cost: "token references, not tokens"
+	}, {
+		path: path.join(appDirs.dirs.state, "store.db"),
+		what: "state database",
+		cost: "run history AND the drift baselines — drift detection restarts from nothing"
+	});
+	const present = [];
+	for (const candidate of candidates) {
+		const info = yield* fs.stat(candidate.path).pipe(Effect.option);
+		if (info._tag === "Some" && info.value.type === "File") present.push(candidate);
+	}
+	return present;
+});
+/**
+* `reposets nuke` — remove everything reposets has written locally.
+*
+* @remarks
+* **Nothing on GitHub is touched.** Every secret, variable, ruleset and setting
+* this tool has ever applied stays exactly where it is; this removes the local
+* files and the local database, which is what "leave no trace on this machine"
+* means.
+*
+* Without `--force` it lists what it found and asks. The prompt defaults to
+* **no**, and a non-interactive shell is refused rather than assumed: a
+* destructive command that proceeds because nobody was there to answer is the
+* one failure mode worth engineering against.
+*
+* @public
+*/
+const nukeHandler = (force) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const appDirs = yield* AppDirs;
+	const targets = yield* findTargets(fs, path, appDirs, process.cwd());
+	if (targets.length === 0) {
+		yield* Effect.log("Nothing to remove — no reposets files found on this machine.");
+		return;
+	}
+	yield* Effect.log("This will delete:");
+	for (const target of targets) {
+		yield* Effect.log(`  ${target.path}`);
+		yield* Effect.log(`    ${target.what} — loses ${target.cost}`);
+	}
+	yield* Effect.log("");
+	yield* Effect.log("Nothing on GitHub is touched. Everything reposets applied stays applied.");
+	if (!force) {
+		if (process.stdin.isTTY !== true) {
+			yield* Effect.logError("");
+			yield* Effect.logError("Refusing: not an interactive terminal, and --force was not given.");
+			yield* Effect.sync(() => {
+				process.exitCode = 1;
+			});
+			return;
+		}
+		yield* Effect.log("");
+		if (!(yield* Prompt.confirm({ message: `Delete ${targets.length} file${targets.length === 1 ? "" : "s"}?` }).pipe(Effect.orElseSucceed(() => false)))) {
+			yield* Effect.log("Nothing was deleted.");
+			return;
+		}
+	}
+	let removed = 0;
+	for (const target of targets) {
+		const outcome = yield* fs.remove(target.path).pipe(Effect.result);
+		if (outcome._tag === "Failure") {
+			yield* Effect.logError(`  could not remove ${target.path} — ${String(outcome.failure)}`);
+			continue;
+		}
+		removed += 1;
+		yield* Effect.log(`  removed ${target.path}`);
+	}
+	yield* Effect.log("");
+	yield* Effect.log(removed === targets.length ? `Done. ${removed} file${removed === 1 ? "" : "s"} removed.` : `Removed ${removed} of ${targets.length}; the rest are listed above.`);
+});
+/**
+* The `nuke` command.
+*
+* @public
+*/
+const nukeCommand = Command.make("nuke", { force: forceFlag }, ({ force }) => nukeHandler(force)).pipe(Command.withDescription("Delete every reposets file on this machine. Nothing on GitHub is touched"));
+
+//#endregion
+export { nukeCommand, nukeHandler };

package/cli/commands/sync.js

@@ -1,70 +1,230 @@
-import { ReposetsConfigFile, ReposetsCredentialsFile, makeConfigFilesLive } from "../../services/ConfigFiles.js";
+import { ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
+import { formatSchemaIssue } from "../../lib/schema-issues.js";
+import { SyncJournal, SyncJournalLive } from "../../store/SyncJournal.js";
 import { OnePasswordClientLive } from "../../services/OnePasswordClient.js";
-import { CredentialResolverLive } from "../../services/CredentialResolver.js";
-import { GitHubClientLive } from "../../services/GitHubClient.js";
-import { SyncLoggerLive } from "../../services/SyncLogger.js";
-import { SyncEngine, SyncEngineLive } from "../../services/SyncEngine.js";
-import { Effect, Layer } from "effect";
-import { dirname } from "node:path";
-import { Command, Options } from "@effect/cli";
+import { CredentialResolver, CredentialResolverLive } from "../../services/CredentialResolver.js";
+import { danglingReferences } from "../../lib/config-refs.js";
+import { SyncLogger, SyncLoggerLive } from "../../services/SyncLogger.js";
+import { AppliedStateLive } from "../../store/AppliedState.js";
+import { RepoCacheLive } from "../../store/RepoCache.js";
+import { PHASE_NAMES } from "../../sync/phase.js";
+import { allPhases } from "../../sync/phases/index.js";
+import { SyncEngine, SyncEngineLive } from "../../sync/SyncEngine.js";
+import { Effect, Layer, Option } from "effect";
+import { Command, Flag } from "effect/unstable/cli";
+import { CodeScanning, DeploymentEnvironment, GitHubClient, GitHubRepository, RepositorySecret, RepositorySecurity, RepositoryVariable, Ruleset, WorkflowDispatch } from "@effected/github";
 
 //#region src/cli/commands/sync.ts
-const configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
-const groupOption = Options.text("group").pipe(Options.withDescription("Sync only a specific repo group"), Options.optional);
-const repoOption = Options.text("repo").pipe(Options.withDescription("Sync only a specific repo"), Options.optional);
-const dryRunOption = Options.boolean("dry-run").pipe(Options.withDescription("Preview changes without making them"), Options.withDefault(false));
-const noCleanupOption = Options.boolean("no-cleanup").pipe(Options.withDescription("Skip cleanup of undeclared resources"), Options.withDefault(false));
-const logLevelOption = Options.choice("log-level", [
-	"silent",
-	"info",
-	"verbose",
-	"debug"
-]).pipe(Options.withDescription("Set output verbosity (overrides log_level in config)"), Options.optional);
-const syncCommand = Command.make("sync", {
-	config: configOption,
-	group: groupOption,
-	repo: repoOption,
-	dryRun: dryRunOption,
-	noCleanup: noCleanupOption,
-	logLevel: logLevelOption
-}, ({ config, group, repo, dryRun, noCleanup, logLevel: logLevelFlag }) => Effect.gen(function* () {
-	const sources = yield* (yield* ReposetsConfigFile).discover;
-	if (sources.length === 0) {
-		yield* Effect.logError("No config file found.");
+const isPhaseName = (value) => PHASE_NAMES.includes(value);
+const phaseSet = (values) => new Set(values.filter(isPhaseName));
+/**
+* Phase names the user typed that do not exist.
+*
+* @remarks
+* Unrecognised names used to be filtered out silently, and an empty `only` set
+* reads downstream as "no filter" — so `--only nonsense` ran **all eight
+* phases**. The flag reached for to limit the blast radius of a destructive
+* command did the opposite of what it says, and reported success.
+*
+* Any unknown name is refused, including alongside valid ones: a typo in
+* `--only settings,secrts` means the user asked for two phases and would
+* otherwise get one, silently. That is a narrower wrong answer, not a safer one.
+*/
+const unknownPhases = (values) => values.filter((v) => !isPhaseName(v));
+/**
+* Group names by the credential profile they authenticate as.
+*
+* @remarks
+* A token is fixed at `GitHubClient` construction and every resource service is
+* built from that client, so a second identity is a second service graph and
+* there is no swapping one mid-run. Partitioning makes that explicit: a sync
+* under two identities really is two runs' worth of authority.
+*
+* Insertion order is the config's own order of first appearance, so output
+* still tracks the file a user is reading — with one exception inherited from
+* JS rather than chosen here: `config.groups` is a plain object, so a group
+* whose name parses as an integer is enumerated first whatever the file says.
+*
+* @param only - a `--group` filter. A name matching nothing yields an empty
+* map, which the caller reports rather than treating as "nothing to do".
+*
+* @public
+*/
+const partitionByProfile = (groups, only) => {
+	const partitions = /* @__PURE__ */ new Map();
+	for (const [groupName, group] of Object.entries(groups)) {
+		if (only !== void 0 && groupName !== only) continue;
+		const existing = partitions.get(group.credentials);
+		if (existing === void 0) partitions.set(group.credentials, [groupName]);
+		else existing.push(groupName);
+	}
+	return partitions;
+};
+/**
+* `reposets sync` — apply the config to every selected repository.
+*
+* @remarks
+* The layer graph is built here rather than at the entrypoint because it
+* depends on values only known after the config and credentials have loaded:
+* the GitHub token, and the logger's tier and dry-run flag.
+*
+* @public
+*/
+const syncHandler = (input) => Effect.gen(function* () {
+	const configFile = yield* ReposetsConfigFile;
+	const credentialsFile = yield* ReposetsCredentialsFile;
+	const discovered = yield* configFile.discover.pipe(Effect.result);
+	if (discovered._tag === "Failure") {
+		yield* Effect.logError(String(discovered.failure));
+		const failure = discovered.failure;
+		for (const line of formatSchemaIssue(failure.issue)) yield* Effect.logError(`  ${line}`);
+		if (failure.cause !== void 0) yield* Effect.logError(`  ${String(failure.cause)}`);
+		yield* Effect.sync(() => {
+			process.exitCode = 1;
+		});
+		return;
+	}
+	const source = discovered.success[0];
+	if (source === void 0) {
+		yield* Effect.logError("No config found. Run 'reposets init' to create one.");
+		yield* Effect.sync(() => {
+			process.exitCode = 1;
+		});
+		return;
+	}
+	const config = source.value;
+	const configDir = source.path.slice(0, source.path.lastIndexOf("/"));
+	const credentials = yield* credentialsFile.loadOrDefault({ profiles: {} });
+	const badPhases = [...unknownPhases(input.only), ...unknownPhases(input.skip)];
+	if (badPhases.length > 0) {
+		yield* Effect.logError(`Unknown phase name(s): ${badPhases.join(", ")}. Valid phases: ${PHASE_NAMES.join(", ")}`);
+		yield* Effect.logError("Nothing was synced.");
+		yield* Effect.sync(() => {
+			process.exitCode = 1;
+		});
+		return;
+	}
+	const dangling = danglingReferences(config);
+	if (dangling.length > 0) {
+		yield* Effect.logError("Config references sections that do not exist:");
+		for (const ref of dangling) {
+			const defined = ref.defined.length === 0 ? "none defined" : `defined: ${ref.defined.join(", ")}`;
+			yield* Effect.logError(`  ${ref.where}: '${ref.name}' does not exist — ${defined}`);
+		}
+		yield* Effect.logError("");
+		yield* Effect.logError("Nothing was synced. Fix the references or run 'reposets validate' for the full list.");
+		yield* Effect.sync(() => {
+			process.exitCode = 1;
+		});
 		return;
 	}
-	const parsedConfig = sources[0].value;
-	const configDir = dirname(sources[0].path);
-	const credentials = yield* (yield* ReposetsCredentialsFile).loadOrDefault({ profiles: {} });
-	const profileNames = Object.keys(credentials.profiles);
-	const defaultProfile = profileNames.length === 1 ? profileNames[0] : void 0;
-	const token = defaultProfile ? credentials.profiles[defaultProfile]?.github_token : void 0;
-	if (!token) {
-		yield* Effect.logError("No GitHub token found. Run 'reposets credentials create' first.");
+	const partitions = partitionByProfile(config.groups, input.group);
+	if (partitions.size === 0) {
+		yield* Effect.logError(input.group === void 0 ? "No groups configured. Add a [groups.<name>] section to sync anything." : `No group named '${input.group}'. Configured: ${Object.keys(config.groups).join(", ") || "none"}`);
+		yield* Effect.sync(() => {
+			process.exitCode = 1;
+		});
 		return;
 	}
-	const logLevel = logLevelFlag._tag === "Some" ? logLevelFlag.value : parsedConfig.log_level;
-	const githubLayer = GitHubClientLive(token);
-	const opLayer = OnePasswordClientLive;
-	const resolverLayer = Layer.provide(CredentialResolverLive, opLayer);
+	const resolverLayer = Layer.provide(CredentialResolverLive, OnePasswordClientLive);
 	const loggerLayer = SyncLoggerLive({
-		dryRun,
-		logLevel
+		dryRun: input.dryRun,
+		debug: input.debug
 	});
-	const engineLayer = Layer.provideMerge(SyncEngineLive, Layer.merge(Layer.merge(githubLayer, resolverLayer), loggerLayer));
-	const groupFilter = group._tag === "Some" ? group.value : void 0;
-	const repoFilter = repo._tag === "Some" ? repo.value : void 0;
-	if (dryRun && logLevel !== "silent") yield* Effect.log("DRY RUN — no changes will be made\n");
-	yield* Effect.provide(Effect.gen(function* () {
-		yield* (yield* SyncEngine).syncAll(parsedConfig, credentials, {
-			dryRun,
-			noCleanup,
-			groupFilter,
-			repoFilter,
-			configDir
-		});
-	}), engineLayer);
-}).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Sync repos with GitHub"));
+	const sharedLayer = Layer.mergeAll(SyncJournalLive, AppliedStateLive, RepoCacheLive, resolverLayer, loggerLayer);
+	const report = yield* Effect.gen(function* () {
+		const journal = yield* SyncJournal;
+		const logger = yield* SyncLogger;
+		const resolver = yield* CredentialResolver;
+		const runId = yield* journal.startRun({
+			group: input.group,
+			dryRun: input.dryRun
+		}).pipe(Effect.orElseSucceed(() => "unrecorded"));
+		let repos = 0;
+		let changes = 0;
+		let drifted = 0;
+		let errors = 0;
+		let firstError;
+		for (const [profileName, groupNames] of partitions) {
+			const profile = credentials.profiles[profileName];
+			if (profile === void 0) {
+				const message = `credential profile '${profileName}' does not exist (has: ${Object.keys(credentials.profiles).join(", ") || "none — run 'reposets credentials create'"}); skipping ${groupNames.join(", ")}`;
+				yield* logger.syncError(`profile ${profileName}`, message);
+				errors += 1;
+				firstError ??= `profile ${profileName}: ${message}`;
+				continue;
+			}
+			const resolved = yield* resolver.resolveGitHubToken(profile).pipe(Effect.result);
+			if (resolved._tag === "Failure") {
+				const message = `could not resolve the GitHub token for profile '${profileName}' — ${resolved.failure.reason}`;
+				yield* logger.syncError(`profile ${profileName}`, message);
+				errors += 1;
+				firstError ??= `profile ${profileName}: ${message}`;
+				continue;
+			}
+			const token = resolved.success;
+			const services = Layer.mergeAll(GitHubRepository.layer, Ruleset.layer, RepositorySecurity.layer, CodeScanning.layer, DeploymentEnvironment.layer, RepositorySecret.layer, RepositoryVariable.layer, WorkflowDispatch.layer).pipe(Layer.provideMerge(GitHubClient.layerFromToken({ token })));
+			const engineLayer = SyncEngineLive(allPhases).pipe(Layer.provide(services));
+			const scoped = {
+				...config,
+				groups: Object.fromEntries(groupNames.map((name) => [name, config.groups[name]]))
+			};
+			const partial = yield* Effect.gen(function* () {
+				return yield* (yield* SyncEngine).syncAll(scoped, credentials, {
+					runId,
+					dryRun: input.dryRun,
+					noCleanup: input.noCleanup,
+					configDir,
+					group: input.group,
+					repo: input.repo,
+					only: phaseSet(input.only),
+					skip: phaseSet(input.skip)
+				});
+			}).pipe(Effect.provide(engineLayer));
+			repos += partial.repos;
+			changes += partial.changes;
+			drifted += partial.drifted;
+			errors += partial.errors;
+			if (partial.errorSummary !== void 0) firstError ??= partial.errorSummary;
+		}
+		yield* journal.finishRun(runId, errors === 0 ? "success" : "partial", firstError).pipe(Effect.ignore);
+		yield* logger.finish();
+		return {
+			repos,
+			changes,
+			drifted,
+			errors
+		};
+	}).pipe(Effect.provide(sharedLayer));
+	yield* Effect.log(`${report.repos} repo(s), ${report.changes} change(s), ${report.drifted} drifted, ${report.errors} error(s)`);
+	if (report.errors > 0 || input.failOnDrift && report.drifted > 0) yield* Effect.sync(() => {
+		process.exitCode = 1;
+	});
+});
+/**
+* The `sync` command.
+*
+* @public
+*/
+const syncCommand = Command.make("sync", {
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDescription("Report what would change without writing anything")),
+	noCleanup: Flag.boolean("no-cleanup").pipe(Flag.withDescription("Skip deletion of undeclared resources")),
+	failOnDrift: Flag.boolean("fail-on-drift").pipe(Flag.withDescription("Exit non-zero when a resource was changed outside reposets")),
+	group: Flag.string("group").pipe(Flag.withDescription("Sync only this group"), Flag.optional),
+	repo: Flag.string("repo").pipe(Flag.withDescription("Sync only this repository"), Flag.optional),
+	only: Flag.string("only").pipe(Flag.withDescription("Run only these phases"), (f) => Flag.atLeast(f, 0)),
+	skip: Flag.string("skip").pipe(Flag.withDescription("Skip these phases"), (f) => Flag.atLeast(f, 0)),
+	debug: Flag.boolean("debug").pipe(Flag.withDescription("Annotate output with value sources and the fingerprints behind a drift report"))
+}, (input) => syncHandler({
+	dryRun: input.dryRun,
+	noCleanup: input.noCleanup,
+	failOnDrift: input.failOnDrift,
+	group: Option.getOrUndefined(input.group),
+	repo: Option.getOrUndefined(input.repo),
+	only: input.only,
+	skip: input.skip,
+	debug: input.debug
+})).pipe(Command.withDescription("Apply the config to every repository in a group, or all groups"));
 
 //#endregion
-export { syncCommand };
+export { partitionByProfile, syncCommand, syncHandler };

package/cli/commands/validate.js

@@ -1,53 +1,69 @@
-import { ReposetsConfigFile, ReposetsCredentialsFile, makeConfigFilesLive } from "../../services/ConfigFiles.js";
+import { ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
+import { danglingReferences } from "../../lib/config-refs.js";
+import { undefinedCredentialLabels } from "../../lib/credential-labels.js";
+import { orgOnlyViolations } from "../../lib/org-only.js";
 import { Effect } from "effect";
-import { existsSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { Command, Options } from "@effect/cli";
+import { Command } from "effect/unstable/cli";
 
 //#region src/cli/commands/validate.ts
-const configOption = Options.file("config").pipe(Options.withDescription("Path to config directory or reposets.config.toml file"), Options.optional);
-const validateCommand = Command.make("validate", { config: configOption }, ({ config }) => Effect.gen(function* () {
+/**
+* `reposets validate` — discovers, decodes and reports the config file.
+*
+* @remarks
+* The walking skeleton's vertical slice. Running it exercises `App.layer` (for
+* `AppDirs`/`Xdg`), `AppConfig.layer` with a caller-supplied resolver chain,
+* `TomlCodec`, and Schema v4 decoding — so a green run proves the composition
+* the rebuild stands on.
+*
+* The handler simply *requires* `ReposetsConfigFile`; how it gets built from
+* `--config` is the root command's business, not this command's.
+*
+* @public
+*/
+const validateCommand = Command.make("validate", {}, () => Effect.gen(function* () {
 	const configFile = yield* ReposetsConfigFile;
-	let hasErrors = false;
-	const configResult = yield* Effect.either(configFile.discover);
-	if (configResult._tag === "Left") {
-		yield* Effect.logError(`Config validation failed: ${configResult.left.message}`);
+	const credentialsFile = yield* ReposetsCredentialsFile;
+	const sources = yield* configFile.discover;
+	const value = yield* configFile.load;
+	const credentials = yield* credentialsFile.loadOrDefault({ profiles: {} });
+	const dangling = danglingReferences(value);
+	if (dangling.length > 0) {
+		yield* Effect.logError(`Invalid: ${sources[0]?.path ?? "config"}`);
+		for (const ref of dangling) {
+			const defined = ref.defined.length === 0 ? "none defined" : `defined: ${ref.defined.join(", ")}`;
+			yield* Effect.logError(`  ${ref.where}: '${ref.name}' does not exist — ${defined}`);
+		}
+		yield* Effect.sync(() => {
+			process.exitCode = 1;
+		});
 		return;
 	}
-	const sources = configResult.right;
-	if (sources.length === 0) {
-		yield* Effect.logError("No config file found.");
+	const labels = undefinedCredentialLabels(value, credentials);
+	const violations = orgOnlyViolations(value, credentials);
+	if (labels.length > 0) {
+		yield* Effect.logError(`Invalid: ${sources[0]?.path ?? "config"}`);
+		for (const label of labels) yield* Effect.logError(`  [${label.group}] ${label.where}: credential label '${label.label}' is not declared in profile '${label.profile}'`);
+		yield* Effect.logError("");
+		yield* Effect.logError("Add it to that profile's [resolve] section in reposets.credentials.toml, or correct the name.");
+		yield* Effect.sync(() => {
+			process.exitCode = 1;
+		});
 		return;
 	}
-	yield* Effect.log("Config schema: valid");
-	const parsedConfig = sources[0].value;
-	const configDir = dirname(sources[0].path);
-	for (const [groupName, group] of Object.entries(parsedConfig.secrets)) if ("file" in group) for (const [entryName, filePath] of Object.entries(group.file)) {
-		const fullPath = join(configDir, filePath);
-		if (!existsSync(fullPath)) {
-			yield* Effect.logError(`secrets.${groupName}.file.${entryName}: file not found: ${fullPath}`);
-			hasErrors = true;
-		}
-	}
-	for (const [groupName, group] of Object.entries(parsedConfig.variables)) if ("file" in group) for (const [entryName, filePath] of Object.entries(group.file)) {
-		const fullPath = join(configDir, filePath);
-		if (!existsSync(fullPath)) {
-			yield* Effect.logError(`variables.${groupName}.file.${entryName}: file not found: ${fullPath}`);
-			hasErrors = true;
-		}
-	}
-	const credentialsFile = yield* ReposetsCredentialsFile;
-	const credsResult = yield* Effect.either(credentialsFile.load);
-	if (credsResult._tag === "Left") yield* Effect.log("Credentials file: not found (optional)");
-	else {
-		yield* Effect.log("Credentials schema: valid");
-		for (const [groupName, group] of Object.entries(parsedConfig.groups)) if (group.credentials && !credsResult.right.profiles[group.credentials]) {
-			yield* Effect.logError(`Group '${groupName}': references unknown credentials profile '${group.credentials}'`);
-			hasErrors = true;
-		}
+	if (violations.length > 0) {
+		yield* Effect.logError(`Invalid: ${sources[0]?.path ?? "config"}`);
+		for (const violation of violations) yield* Effect.logError(`  [${violation.group}] ${violation.where}: ${violation.detail}, but profile '${violation.profile}' is a personal account`);
+		yield* Effect.logError("");
+		yield* Effect.logError("Either move these repositories to a profile declaring `org`, or drop the settings.");
+		yield* Effect.sync(() => {
+			process.exitCode = 1;
+		});
+		return;
 	}
-	if (!hasErrors) yield* Effect.log("\nAll checks passed.");
-}).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Validate config without API calls"));
+	const groups = Object.keys(value.groups).length;
+	yield* Effect.log(`Valid: ${sources[0]?.path ?? "config"}`);
+	yield* Effect.log(`  groups: ${groups === 0 ? "none declared yet" : String(groups)}`);
+})).pipe(Command.withDescription("Validate reposets.config.toml against the schema"));
 
 //#endregion
 export { validateCommand };

package/cli/flags.js

@@ -0,0 +1,36 @@
+import { makeConfigFilesLive } from "../services/ConfigFiles.js";
+import { Effect, Layer, Option } from "effect";
+import { Flag, GlobalFlag } from "effect/unstable/cli";
+
+//#region src/cli/flags.ts
+/**
+* `--config`, as a global flag.
+*
+* @remarks
+* `GlobalFlag.setting` returns a `Context.Service` carrying the parsed value,
+* which is the bridge between parse time and layer-construction time: a layer
+* can require the flag in `R` instead of receiving it as a constructor argument.
+*
+* Global rather than a parent flag deliberately — a global flag is accepted on
+* either side of the subcommand name (`reposets --config x validate` and
+* `reposets validate --config x` both parse), where a plain parent flag rejects
+* the trailing form with `UnrecognizedOption`.
+*
+* @public
+*/
+const ConfigFlag = GlobalFlag.setting("config")({ flag: Flag.string("config").pipe(Flag.withDescription("Path to reposets.config.toml, or a directory containing it"), Flag.optional) });
+/**
+* The config-file layer, parameterized by `--config` read from the ambient flag
+* service.
+*
+* @remarks
+* Provided once at the root command. Subcommand requirements bubble into the
+* parent's `R` through `withSubcommands`, so one `Command.provide` covers every
+* subcommand rather than each repeating it.
+*
+* @public
+*/
+const ConfigLive = Layer.unwrap(Effect.map(ConfigFlag, (flag) => makeConfigFilesLive(Option.getOrUndefined(flag))));
+
+//#endregion
+export { ConfigFlag, ConfigLive };

package/cli/logger.js

@@ -0,0 +1,48 @@
+import { Console, LogLevel, Logger } from "effect";
+
+//#region src/cli/logger.ts
+/**
+* Renders one log record as a plain CLI line.
+*
+* @remarks
+* Effect's default logger emits `[23:04:05.891] INFO (#2): message`, which is
+* the right shape for a service and the wrong one for a command-line tool: the
+* timestamp, level and fiber id are noise in front of output a human is reading,
+* and they make a formatted block — `doctor`'s permission table, for instance —
+* unreadable.
+*
+* A message that is an array is joined with a space, matching how `Effect.log`
+* accepts variadic parts.
+*/
+const render = (message) => Array.isArray(message) ? message.map(String).join(" ") : String(message);
+/**
+* The CLI's output logger: plain lines, errors on stderr.
+*
+* @remarks
+* Routing by level is the contract `SyncLogger` is written against — it emits
+* failures with `Effect.logError` precisely so that `reposets sync > log.txt`
+* still shows them on the terminal while the log captures progress. Without a
+* logger that honors the distinction, that choice does nothing.
+*
+* `Logger.layer` replaces the default logger rather than merging with it, so
+* nothing is emitted twice.
+*
+* A `Logger`'s callback is **synchronous**, so it cannot yield an `Effect` and
+* therefore cannot reach `Stdio`'s sinks. The way out is not to write to
+* `process.stdout` — it is the one core's own loggers take: read the `Console`
+* off the fiber. `Console.Console` is a `Context.Reference`, so it carries a
+* default and never appears in `R`, and a test swaps the reference instead of
+* stubbing a global.
+*
+* `console.log`/`console.error` supply their own newline, which is why nothing
+* here appends one.
+*
+* @public
+*/
+const CliLoggerLive = Logger.layer([Logger.make(({ fiber, logLevel, message }) => {
+	const console = fiber.getRef(Console.Console);
+	(LogLevel.isGreaterThanOrEqualTo(logLevel, "Error") ? console.error : console.log)(render(message));
+})]);
+
+//#endregion
+export { CliLoggerLive };