reposets 0.4.3 → 1.0.0

package/index.d.ts

@@ -1,898 +1,341 @@
-import { AppDirs, ConfigError, ConfigError as XdgConfigError, ConfigFile } from "xdg-effect";
-import { Context, Effect, Layer, Option, Ref, Schema } from "effect";
-
-//#region src/errors.d.ts
-declare const ResolveError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "ResolveError";
-} & Readonly<A>;
-declare class ResolveError extends ResolveError_base<{
-  readonly message: string;
-}> {}
-declare const OnePasswordError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "OnePasswordError";
-} & Readonly<A>;
-declare class OnePasswordError extends OnePasswordError_base<{
-  readonly message: string;
-}> {}
-declare const GitHubApiError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "GitHubApiError";
-} & Readonly<A>;
-declare class GitHubApiError extends GitHubApiError_base<{
-  readonly message: string;
-  readonly status?: number;
-}> {}
-declare const SyncError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "SyncError";
-} & Readonly<A>;
-declare class SyncError extends SyncError_base<{
-  readonly message: string;
-}> {}
-//#endregion
-//#region src/lib/crypto.d.ts
+import { FileSystem, Layer, Path, Schema } from "effect";
+import { AppDirs, Xdg } from "@effected/xdg";
+//#region src/schemas/config.d.ts
 /**
- * Encrypt a secret using libsodium's sealed box algorithm.
- * Implementation based on tweetsodium using tweetnacl + blakejs.
+ * The whole `reposets.config.toml` document.
  *
- * The sealed box format is: ephemeral_public_key (32 bytes) || ciphertext
+ * @remarks
+ * `groups` is the only required key. Every resource map defaults to empty, so a
+ * config that declares repositories and nothing else is valid and does nothing —
+ * which is the right behaviour for a tool that mutates GitHub.
+ *
+ * @public
  */
-declare function encryptSecret(publicKey: string, secretValue: string): string;
-//#endregion
-//#region src/schemas/common.d.ts
-declare const SecretGroupSchema: Schema.Union<[Schema.Struct<{
-  file: Schema.Record$<typeof Schema.String, typeof Schema.String>;
-}>, Schema.Struct<{
-  value: Schema.Record$<typeof Schema.String, Schema.Union<[typeof Schema.String, Schema.Record$<typeof Schema.String, Schema.SchemaClass<unknown, unknown, never>>]>>;
-}>, Schema.Struct<{
-  resolved: Schema.Record$<typeof Schema.String, typeof Schema.String>;
-}>]>;
-type SecretGroup = typeof SecretGroupSchema.Type;
-declare const VariableGroupSchema: Schema.Union<[Schema.Struct<{
-  file: Schema.Record$<typeof Schema.String, typeof Schema.String>;
-}>, Schema.Struct<{
-  value: Schema.Record$<typeof Schema.String, Schema.Union<[typeof Schema.String, Schema.Record$<typeof Schema.String, Schema.SchemaClass<unknown, unknown, never>>]>>;
-}>, Schema.Struct<{
-  resolved: Schema.Record$<typeof Schema.String, typeof Schema.String>;
-}>]>;
-type VariableGroup = typeof VariableGroupSchema.Type;
-declare const CleanupScopeSchema: Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-  preserve: Schema.Array$<typeof Schema.String>;
-}>]>;
-type CleanupScope = typeof CleanupScopeSchema.Type;
-declare const CleanupSchema: Schema.Struct<{
-  secrets: Schema.optionalWith<Schema.Struct<{
-    actions: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-      preserve: Schema.Array$<typeof Schema.String>;
-    }>]>, {
-      default: () => CleanupScope;
-    }>;
-    dependabot: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-      preserve: Schema.Array$<typeof Schema.String>;
-    }>]>, {
-      default: () => CleanupScope;
-    }>;
-    codespaces: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-      preserve: Schema.Array$<typeof Schema.String>;
-    }>]>, {
-      default: () => CleanupScope;
-    }>;
-    environments: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-      preserve: Schema.Array$<typeof Schema.String>;
-    }>]>, {
-      default: () => CleanupScope;
-    }>;
-  }>, {
-    default: () => {
-      actions: CleanupScope;
-      dependabot: CleanupScope;
-      codespaces: CleanupScope;
-      environments: CleanupScope;
-    };
-  }>;
-  variables: Schema.optionalWith<Schema.Struct<{
-    actions: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-      preserve: Schema.Array$<typeof Schema.String>;
-    }>]>, {
-      default: () => CleanupScope;
-    }>;
-    environments: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-      preserve: Schema.Array$<typeof Schema.String>;
-    }>]>, {
-      default: () => CleanupScope;
-    }>;
-  }>, {
-    default: () => {
-      actions: CleanupScope;
-      environments: CleanupScope;
-    };
-  }>;
-  rulesets: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-    preserve: Schema.Array$<typeof Schema.String>;
-  }>]>, {
-    default: () => CleanupScope;
-  }>;
-  environments: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-    preserve: Schema.Array$<typeof Schema.String>;
-  }>]>, {
-    default: () => CleanupScope;
-  }>;
-}>;
-type Cleanup = typeof CleanupSchema.Type;
-//#endregion
-//#region src/schemas/config.d.ts
-declare const GroupSchema: Schema.Struct<{
-  owner: Schema.optional<Schema.SchemaClass<string, string, never>>;
-  repos: Schema.Array$<typeof Schema.String>;
-  credentials: Schema.optional<Schema.SchemaClass<string, string, never>>;
-  settings: Schema.optional<Schema.Array$<typeof Schema.String>>;
-  environments: Schema.optional<Schema.Array$<typeof Schema.String>>;
-  secrets: Schema.optional<Schema.Struct<{
-    actions: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    dependabot: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    codespaces: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    environments: Schema.optional<Schema.Record$<typeof Schema.String, Schema.Array$<typeof Schema.String>>>;
-  }>>;
-  variables: Schema.optional<Schema.Struct<{
-    actions: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    environments: Schema.optional<Schema.Record$<typeof Schema.String, Schema.Array$<typeof Schema.String>>>;
-  }>>;
-  rulesets: Schema.optional<Schema.Array$<typeof Schema.String>>;
-  security: Schema.optional<Schema.Array$<typeof Schema.String>>;
-  code_scanning: Schema.optional<Schema.Array$<typeof Schema.String>>;
-  cleanup: Schema.optional<Schema.Struct<{
-    secrets: Schema.optionalWith<Schema.Struct<{
-      actions: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-        preserve: Schema.Array$<typeof Schema.String>;
-      }>]>, {
-        default: () => CleanupScope;
-      }>;
-      dependabot: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-        preserve: Schema.Array$<typeof Schema.String>;
-      }>]>, {
-        default: () => CleanupScope;
-      }>;
-      codespaces: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-        preserve: Schema.Array$<typeof Schema.String>;
-      }>]>, {
-        default: () => CleanupScope;
-      }>;
-      environments: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-        preserve: Schema.Array$<typeof Schema.String>;
-      }>]>, {
-        default: () => CleanupScope;
-      }>;
-    }>, {
-      default: () => {
-        actions: CleanupScope;
-        dependabot: CleanupScope;
-        codespaces: CleanupScope;
-        environments: CleanupScope;
-      };
-    }>;
-    variables: Schema.optionalWith<Schema.Struct<{
-      actions: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-        preserve: Schema.Array$<typeof Schema.String>;
-      }>]>, {
-        default: () => CleanupScope;
-      }>;
-      environments: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-        preserve: Schema.Array$<typeof Schema.String>;
-      }>]>, {
-        default: () => CleanupScope;
-      }>;
-    }>, {
-      default: () => {
-        actions: CleanupScope;
-        environments: CleanupScope;
-      };
-    }>;
-    rulesets: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-      preserve: Schema.Array$<typeof Schema.String>;
-    }>]>, {
-      default: () => CleanupScope;
-    }>;
-    environments: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-      preserve: Schema.Array$<typeof Schema.String>;
-    }>]>, {
-      default: () => CleanupScope;
-    }>;
-  }>>;
-}>;
-type Group = typeof GroupSchema.Type;
-declare const CodeScanningGroupSchema: Schema.refine<{
-  readonly state?: "configured" | "not-configured" | undefined;
-  readonly languages?: readonly ("actions" | "c-cpp" | "csharp" | "go" | "java-kotlin" | "javascript-typescript" | "python" | "ruby" | "swift")[] | undefined;
-  readonly query_suite?: "default" | "extended" | undefined;
-  readonly threat_model?: "remote" | "remote_and_local" | undefined;
-  readonly runner_type?: "standard" | "labeled" | undefined;
-  readonly runner_label?: string | undefined;
-}, Schema.Struct<{
-  state: Schema.optional<Schema.Literal<["configured", "not-configured"]>>;
-  languages: Schema.optional<Schema.Array$<Schema.Literal<["actions", "c-cpp", "csharp", "go", "java-kotlin", "javascript-typescript", "python", "ruby", "swift"]>>>;
-  query_suite: Schema.optional<Schema.Literal<["default", "extended"]>>;
-  threat_model: Schema.optional<Schema.Literal<["remote", "remote_and_local"]>>;
-  runner_type: Schema.optional<Schema.Literal<["standard", "labeled"]>>;
-  runner_label: Schema.optional<Schema.SchemaClass<string, string, never>>;
-}>>;
-type CodeScanningGroup = typeof CodeScanningGroupSchema.Type;
-declare const LogLevelSchema: Schema.Literal<["silent", "info", "verbose", "debug"]>;
-type LogLevel = typeof LogLevelSchema.Type;
 declare const ConfigSchema: Schema.Struct<{
-  owner: Schema.optional<Schema.SchemaClass<string, string, never>>;
-  log_level: Schema.optionalWith<Schema.Literal<["silent", "info", "verbose", "debug"]>, {
-    default: () => "info";
-  }>;
-  settings: Schema.optionalWith<Schema.Record$<typeof Schema.String, Schema.TypeLiteral<{
-    is_template: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    has_wiki: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    has_issues: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    has_projects: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    has_discussions: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    has_sponsorships: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    has_pull_requests: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    allow_forking: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    allow_merge_commit: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    allow_squash_merge: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    allow_rebase_merge: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    allow_auto_merge: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    allow_update_branch: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    squash_merge_commit_title: Schema.optional<Schema.Literal<["PR_TITLE", "COMMIT_OR_PR_TITLE"]>>;
-    squash_merge_commit_message: Schema.optional<Schema.Literal<["PR_BODY", "COMMIT_MESSAGES", "BLANK"]>>;
-    merge_commit_title: Schema.optional<Schema.Literal<["PR_TITLE", "MERGE_MESSAGE"]>>;
-    merge_commit_message: Schema.optional<Schema.Literal<["PR_BODY", "PR_TITLE", "BLANK"]>>;
-    delete_branch_on_merge: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    web_commit_signoff_required: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    security_and_analysis: Schema.optional<Schema.Struct<{
-      advanced_security: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
-      code_security: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
-      secret_scanning: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
-      secret_scanning_push_protection: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
-      secret_scanning_ai_detection: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
-      secret_scanning_non_provider_patterns: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
-      secret_scanning_delegated_alert_dismissal: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
-      secret_scanning_delegated_bypass: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
-      delegated_bypass_reviewers: Schema.optional<Schema.Array$<Schema.Union<[Schema.Struct<{
-        team: Schema.SchemaClass<string, string, never>;
-        mode: Schema.optional<Schema.Literal<["ALWAYS", "EXEMPT"]>>;
+  readonly settings: Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.StructWithRest<Schema.Struct<{
+    readonly is_template: Schema.optional<Schema.Boolean>;
+    readonly has_wiki: Schema.optional<Schema.Boolean>;
+    readonly has_issues: Schema.optional<Schema.Boolean>;
+    readonly has_projects: Schema.optional<Schema.Boolean>;
+    readonly has_discussions: Schema.optional<Schema.Boolean>;
+    readonly has_sponsorships: Schema.optional<Schema.Boolean>;
+    readonly has_pull_requests: Schema.optional<Schema.Boolean>;
+    readonly allow_forking: Schema.optional<Schema.Boolean>;
+    readonly allow_merge_commit: Schema.optional<Schema.Boolean>;
+    readonly allow_squash_merge: Schema.optional<Schema.Boolean>;
+    readonly allow_rebase_merge: Schema.optional<Schema.Boolean>;
+    readonly allow_auto_merge: Schema.optional<Schema.Boolean>;
+    readonly allow_update_branch: Schema.optional<Schema.Boolean>;
+    readonly squash_merge_commit_title: Schema.optional<Schema.Literals<readonly ["PR_TITLE", "COMMIT_OR_PR_TITLE"]>>;
+    readonly squash_merge_commit_message: Schema.optional<Schema.Literals<readonly ["PR_BODY", "COMMIT_MESSAGES", "BLANK"]>>;
+    readonly merge_commit_title: Schema.optional<Schema.Literals<readonly ["PR_TITLE", "MERGE_MESSAGE"]>>;
+    readonly merge_commit_message: Schema.optional<Schema.Literals<readonly ["PR_BODY", "PR_TITLE", "BLANK"]>>;
+    readonly delete_branch_on_merge: Schema.optional<Schema.Boolean>;
+    readonly web_commit_signoff_required: Schema.optional<Schema.Boolean>;
+    readonly security_and_analysis: Schema.optional<Schema.Struct<{
+      readonly advanced_security: Schema.optional<Schema.Literals<readonly ["enabled", "disabled"]>>;
+      readonly code_security: Schema.optional<Schema.Literals<readonly ["enabled", "disabled"]>>;
+      readonly secret_scanning: Schema.optional<Schema.Literals<readonly ["enabled", "disabled"]>>;
+      readonly secret_scanning_push_protection: Schema.optional<Schema.Literals<readonly ["enabled", "disabled"]>>;
+      readonly secret_scanning_ai_detection: Schema.optional<Schema.Literals<readonly ["enabled", "disabled"]>>;
+      readonly secret_scanning_non_provider_patterns: Schema.optional<Schema.Literals<readonly ["enabled", "disabled"]>>;
+      readonly secret_scanning_delegated_alert_dismissal: Schema.optional<Schema.Literals<readonly ["enabled", "disabled"]>>;
+      readonly secret_scanning_delegated_bypass: Schema.optional<Schema.Literals<readonly ["enabled", "disabled"]>>;
+      readonly delegated_bypass_reviewers: Schema.optional<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+        readonly team: Schema.String;
+        readonly mode: Schema.optional<Schema.Literals<readonly ["ALWAYS", "EXEMPT"]>>;
       }>, Schema.Struct<{
-        role: Schema.SchemaClass<string, string, never>;
-        mode: Schema.optional<Schema.Literal<["ALWAYS", "EXEMPT"]>>;
+        readonly role: Schema.String;
+        readonly mode: Schema.optional<Schema.Literals<readonly ["ALWAYS", "EXEMPT"]>>;
       }>]>>>;
-      dependabot_security_updates: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
+      readonly dependabot_security_updates: Schema.optional<Schema.Literals<readonly ["enabled", "disabled"]>>;
     }>>;
-  }, readonly [{
-    readonly key: typeof Schema.String;
-    readonly value: Schema.SchemaClass<unknown, unknown, never>;
-  }]>>, {
-    default: () => {};
-  }>;
-  secrets: Schema.optionalWith<Schema.Record$<typeof Schema.String, Schema.Union<[Schema.Struct<{
-    file: Schema.Record$<typeof Schema.String, typeof Schema.String>;
+  }>, readonly [Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>]>>, never>;
+  readonly secrets: Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.Struct<{
+    readonly file: Schema.$Record<Schema.String, Schema.String>;
   }>, Schema.Struct<{
-    value: Schema.Record$<typeof Schema.String, Schema.Union<[typeof Schema.String, Schema.Record$<typeof Schema.String, Schema.SchemaClass<unknown, unknown, never>>]>>;
+    readonly value: Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>]>>;
   }>, Schema.Struct<{
-    resolved: Schema.Record$<typeof Schema.String, typeof Schema.String>;
-  }>]>>, {
-    default: () => {};
-  }>;
-  variables: Schema.optionalWith<Schema.Record$<typeof Schema.String, Schema.Union<[Schema.Struct<{
-    file: Schema.Record$<typeof Schema.String, typeof Schema.String>;
+    readonly resolved: Schema.$Record<Schema.String, Schema.String>;
+  }>]>>, never>;
+  readonly variables: Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.Struct<{
+    readonly file: Schema.$Record<Schema.String, Schema.String>;
   }>, Schema.Struct<{
-    value: Schema.Record$<typeof Schema.String, Schema.Union<[typeof Schema.String, Schema.Record$<typeof Schema.String, Schema.SchemaClass<unknown, unknown, never>>]>>;
+    readonly value: Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>]>>;
   }>, Schema.Struct<{
-    resolved: Schema.Record$<typeof Schema.String, typeof Schema.String>;
-  }>]>>, {
-    default: () => {};
-  }>;
-  rulesets: Schema.optionalWith<Schema.Record$<typeof Schema.String, Schema.Union<[Schema.Struct<{
-    type: Schema.Literal<["branch"]>;
-    pull_requests: Schema.optional<Schema.Struct<{
-      approvals: Schema.optionalWith<Schema.refine<number, typeof Schema.Int>, {
-        default: () => number;
-      }>;
-      dismiss_stale_reviews: Schema.optionalWith<Schema.SchemaClass<boolean, boolean, never>, {
-        default: () => boolean;
-      }>;
-      code_owner_review: Schema.optionalWith<Schema.SchemaClass<boolean, boolean, never>, {
-        default: () => boolean;
-      }>;
-      last_push_approval: Schema.optionalWith<Schema.SchemaClass<boolean, boolean, never>, {
-        default: () => boolean;
-      }>;
-      resolve_threads: Schema.optionalWith<Schema.SchemaClass<boolean, boolean, never>, {
-        default: () => boolean;
-      }>;
-      merge_methods: Schema.optional<Schema.Array$<Schema.Literal<["merge", "squash", "rebase"]>>>;
-      reviewers: Schema.optional<Schema.Array$<Schema.Struct<{
-        file_patterns: Schema.Array$<typeof Schema.String>;
-        minimum_approvals: Schema.refine<number, typeof Schema.Number>;
-        reviewer: Schema.Struct<{
-          id: Schema.refine<number, typeof Schema.Number>;
-          type: Schema.Literal<["Team"]>;
-        }>;
-      }>>>;
-    }>>;
-    merge_queue: Schema.optional<Schema.Struct<{
-      check_timeout: Schema.refine<number, typeof Schema.Int>;
-      grouping: Schema.Literal<["ALLGREEN", "HEADGREEN"]>;
-      max_build: Schema.refine<number, typeof Schema.Int>;
-      max_merge: Schema.refine<number, typeof Schema.Int>;
-      merge_method: Schema.Literal<["MERGE", "SQUASH", "REBASE"]>;
-      min_merge: Schema.refine<number, typeof Schema.Int>;
-      min_wait: Schema.refine<number, typeof Schema.Int>;
-    }>>;
-    copilot_review: Schema.optional<Schema.Struct<{
-      draft_prs: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-      on_push: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    }>>;
-    code_scanning: Schema.optional<Schema.Array$<Schema.Struct<{
-      tool: Schema.SchemaClass<string, string, never>;
-      alerts: Schema.Literal<["none", "errors", "errors_and_warnings", "all"]>;
-      security_alerts: Schema.Literal<["none", "critical", "high_or_higher", "medium_or_higher", "all"]>;
-    }>>>;
-    workflows: Schema.optional<Schema.Struct<{
-      on_creation: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-      required: Schema.Array$<Schema.Struct<{
-        path: Schema.SchemaClass<string, string, never>;
-        ref: Schema.optional<Schema.SchemaClass<string, string, never>>;
-        repository_id: Schema.Union<[typeof Schema.Int, Schema.Struct<{
-          resolved: Schema.SchemaClass<string, string, never>;
-        }>]>;
-        sha: Schema.optional<Schema.SchemaClass<string, string, never>>;
+    readonly resolved: Schema.$Record<Schema.String, Schema.String>;
+  }>]>>, never>;
+  readonly rulesets: Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.Struct<{
+    readonly name: Schema.String;
+    readonly enforcement: Schema.Literals<readonly ["disabled", "active", "evaluate"]>;
+    readonly conditions: Schema.optional<Schema.Struct<{
+      readonly ref_name: Schema.optional<Schema.Struct<{
+        readonly include: Schema.withDecodingDefaultKey<Schema.$Array<Schema.String>, never>;
+        readonly exclude: Schema.withDecodingDefaultKey<Schema.$Array<Schema.String>, never>;
       }>>;
     }>>;
-    branch_name: Schema.optional<Schema.Array$<Schema.Struct<{
-      operator: Schema.Literal<["starts_with", "ends_with", "contains", "regex"]>;
-      pattern: Schema.SchemaClass<string, string, never>;
-      name: Schema.optional<Schema.SchemaClass<string, string, never>>;
-      negate: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    }>>>;
-    name: Schema.SchemaClass<string, string, never>;
-    enforcement: Schema.Literal<["disabled", "active", "evaluate"]>;
-    conditions: Schema.optional<Schema.Struct<{
-      ref_name: Schema.optional<Schema.Struct<{
-        include: Schema.optionalWith<Schema.Array$<typeof Schema.String>, {
-          default: () => never[];
-        }>;
-        exclude: Schema.optionalWith<Schema.Array$<typeof Schema.String>, {
-          default: () => never[];
-        }>;
-      }>>;
-    }>>;
-    bypass_actors: Schema.optional<Schema.Array$<Schema.Struct<{
-      actor_id: Schema.optional<Schema.Union<[typeof Schema.Int, Schema.Struct<{
-        resolved: Schema.SchemaClass<string, string, never>;
+    readonly bypass_actors: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly actor_id: Schema.optional<Schema.Union<readonly [Schema.Int, Schema.Struct<{
+        readonly resolved: Schema.String;
       }>]>>;
-      actor_type: Schema.Literal<["Integration", "OrganizationAdmin", "RepositoryRole", "Team", "DeployKey"]>;
-      bypass_mode: Schema.optionalWith<Schema.Literal<["always", "pull_request", "exempt"]>, {
-        default: () => "always";
-      }>;
+      readonly actor_type: Schema.Literals<readonly ["Integration", "OrganizationAdmin", "RepositoryRole", "Team", "DeployKey"]>;
+      readonly bypass_mode: Schema.withDecodingDefaultKey<Schema.Literals<readonly ["always", "pull_request", "exempt"]>, never>;
     }>>>;
-    creation: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    update: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    deletion: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    required_linear_history: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    required_signatures: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    non_fast_forward: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    deployments: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    targets: Schema.optional<Schema.Union<[Schema.Literal<["default", "all"]>, Schema.Array$<Schema.Union<[Schema.Struct<{
-      include: Schema.SchemaClass<string, string, never>;
+    readonly creation: Schema.optional<Schema.Boolean>;
+    readonly update: Schema.optional<Schema.Boolean>;
+    readonly deletion: Schema.optional<Schema.Boolean>;
+    readonly required_linear_history: Schema.optional<Schema.Boolean>;
+    readonly required_signatures: Schema.optional<Schema.Boolean>;
+    readonly non_fast_forward: Schema.optional<Schema.Boolean>;
+    readonly deployments: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly targets: Schema.optional<Schema.Union<readonly [Schema.Literals<readonly ["default", "all"]>, Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+      readonly include: Schema.String;
     }>, Schema.Struct<{
-      exclude: Schema.SchemaClass<string, string, never>;
+      readonly exclude: Schema.String;
     }>]>>]>>;
-    status_checks: Schema.optional<Schema.Struct<{
-      update_branch: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-      on_creation: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-      default_integration_id: Schema.optional<Schema.Union<[typeof Schema.Int, Schema.Struct<{
-        resolved: Schema.SchemaClass<string, string, never>;
+    readonly status_checks: Schema.optional<Schema.Struct<{
+      readonly update_branch: Schema.optional<Schema.Boolean>;
+      readonly on_creation: Schema.optional<Schema.Boolean>;
+      readonly default_integration_id: Schema.optional<Schema.Union<readonly [Schema.Int, Schema.Struct<{
+        readonly resolved: Schema.String;
       }>]>>;
-      required: Schema.Array$<Schema.Struct<{
-        context: Schema.SchemaClass<string, string, never>;
-        integration_id: Schema.optional<Schema.Union<[typeof Schema.Int, Schema.Struct<{
-          resolved: Schema.SchemaClass<string, string, never>;
+      readonly required: Schema.$Array<Schema.Struct<{
+        readonly context: Schema.String;
+        readonly integration_id: Schema.optional<Schema.Union<readonly [Schema.Int, Schema.Struct<{
+          readonly resolved: Schema.String;
         }>]>>;
       }>>;
     }>>;
-    commit_message: Schema.optional<Schema.Array$<Schema.Struct<{
-      operator: Schema.Literal<["starts_with", "ends_with", "contains", "regex"]>;
-      pattern: Schema.SchemaClass<string, string, never>;
-      name: Schema.optional<Schema.SchemaClass<string, string, never>>;
-      negate: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    }>>>;
-    commit_author_email: Schema.optional<Schema.Array$<Schema.Struct<{
-      operator: Schema.Literal<["starts_with", "ends_with", "contains", "regex"]>;
-      pattern: Schema.SchemaClass<string, string, never>;
-      name: Schema.optional<Schema.SchemaClass<string, string, never>>;
-      negate: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
+    readonly commit_message: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly operator: Schema.Literals<readonly ["starts_with", "ends_with", "contains", "regex"]>;
+      readonly pattern: Schema.String;
+      readonly name: Schema.optional<Schema.String>;
+      readonly negate: Schema.optional<Schema.Boolean>;
     }>>>;
-    committer_email: Schema.optional<Schema.Array$<Schema.Struct<{
-      operator: Schema.Literal<["starts_with", "ends_with", "contains", "regex"]>;
-      pattern: Schema.SchemaClass<string, string, never>;
-      name: Schema.optional<Schema.SchemaClass<string, string, never>>;
-      negate: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
+    readonly commit_author_email: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly operator: Schema.Literals<readonly ["starts_with", "ends_with", "contains", "regex"]>;
+      readonly pattern: Schema.String;
+      readonly name: Schema.optional<Schema.String>;
+      readonly negate: Schema.optional<Schema.Boolean>;
     }>>>;
-  }>, Schema.Struct<{
-    type: Schema.Literal<["tag"]>;
-    tag_name: Schema.optional<Schema.Array$<Schema.Struct<{
-      operator: Schema.Literal<["starts_with", "ends_with", "contains", "regex"]>;
-      pattern: Schema.SchemaClass<string, string, never>;
-      name: Schema.optional<Schema.SchemaClass<string, string, never>>;
-      negate: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
+    readonly committer_email: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly operator: Schema.Literals<readonly ["starts_with", "ends_with", "contains", "regex"]>;
+      readonly pattern: Schema.String;
+      readonly name: Schema.optional<Schema.String>;
+      readonly negate: Schema.optional<Schema.Boolean>;
     }>>>;
-    name: Schema.SchemaClass<string, string, never>;
-    enforcement: Schema.Literal<["disabled", "active", "evaluate"]>;
-    conditions: Schema.optional<Schema.Struct<{
-      ref_name: Schema.optional<Schema.Struct<{
-        include: Schema.optionalWith<Schema.Array$<typeof Schema.String>, {
-          default: () => never[];
-        }>;
-        exclude: Schema.optionalWith<Schema.Array$<typeof Schema.String>, {
-          default: () => never[];
+    readonly type: Schema.Literal<"branch">;
+    readonly pull_requests: Schema.optional<Schema.Struct<{
+      readonly approvals: Schema.withDecodingDefaultKey<Schema.Int, never>;
+      readonly dismiss_stale_reviews: Schema.withDecodingDefaultKey<Schema.Boolean, never>;
+      readonly code_owner_review: Schema.withDecodingDefaultKey<Schema.Boolean, never>;
+      readonly last_push_approval: Schema.withDecodingDefaultKey<Schema.Boolean, never>;
+      readonly resolve_threads: Schema.withDecodingDefaultKey<Schema.Boolean, never>;
+      readonly merge_methods: Schema.optional<Schema.$Array<Schema.Literals<readonly ["merge", "squash", "rebase"]>>>;
+      readonly reviewers: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly file_patterns: Schema.$Array<Schema.String>;
+        readonly minimum_approvals: Schema.Int;
+        readonly reviewer: Schema.Struct<{
+          readonly id: Schema.Int;
+          readonly type: Schema.Literal<"Team">;
         }>;
+      }>>>;
+    }>>;
+    readonly merge_queue: Schema.optional<Schema.Struct<{
+      readonly check_timeout: Schema.Int;
+      readonly grouping: Schema.Literals<readonly ["ALLGREEN", "HEADGREEN"]>;
+      readonly max_build: Schema.Int;
+      readonly max_merge: Schema.Int;
+      readonly merge_method: Schema.Literals<readonly ["MERGE", "SQUASH", "REBASE"]>;
+      readonly min_merge: Schema.Int;
+      readonly min_wait: Schema.Int;
+    }>>;
+    readonly copilot_review: Schema.optional<Schema.Struct<{
+      readonly draft_prs: Schema.optional<Schema.Boolean>;
+      readonly on_push: Schema.optional<Schema.Boolean>;
+    }>>;
+    readonly code_scanning: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly tool: Schema.String;
+      readonly alerts: Schema.Literals<readonly ["none", "errors", "errors_and_warnings", "all"]>;
+      readonly security_alerts: Schema.Literals<readonly ["none", "critical", "high_or_higher", "medium_or_higher", "all"]>;
+    }>>>;
+    readonly workflows: Schema.optional<Schema.Struct<{
+      readonly on_creation: Schema.optional<Schema.Boolean>;
+      readonly required: Schema.$Array<Schema.Struct<{
+        readonly path: Schema.String;
+        readonly ref: Schema.optional<Schema.String>;
+        readonly repository_id: Schema.Union<readonly [Schema.Int, Schema.Struct<{
+          readonly resolved: Schema.String;
+        }>]>;
+        readonly sha: Schema.optional<Schema.String>;
       }>>;
     }>>;
-    bypass_actors: Schema.optional<Schema.Array$<Schema.Struct<{
-      actor_id: Schema.optional<Schema.Union<[typeof Schema.Int, Schema.Struct<{
-        resolved: Schema.SchemaClass<string, string, never>;
+    readonly branch_name: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly operator: Schema.Literals<readonly ["starts_with", "ends_with", "contains", "regex"]>;
+      readonly pattern: Schema.String;
+      readonly name: Schema.optional<Schema.String>;
+      readonly negate: Schema.optional<Schema.Boolean>;
+    }>>>;
+  }>, Schema.Struct<{
+    readonly name: Schema.String;
+    readonly enforcement: Schema.Literals<readonly ["disabled", "active", "evaluate"]>;
+    readonly conditions: Schema.optional<Schema.Struct<{
+      readonly ref_name: Schema.optional<Schema.Struct<{
+        readonly include: Schema.withDecodingDefaultKey<Schema.$Array<Schema.String>, never>;
+        readonly exclude: Schema.withDecodingDefaultKey<Schema.$Array<Schema.String>, never>;
+      }>>;
+    }>>;
+    readonly bypass_actors: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly actor_id: Schema.optional<Schema.Union<readonly [Schema.Int, Schema.Struct<{
+        readonly resolved: Schema.String;
       }>]>>;
-      actor_type: Schema.Literal<["Integration", "OrganizationAdmin", "RepositoryRole", "Team", "DeployKey"]>;
-      bypass_mode: Schema.optionalWith<Schema.Literal<["always", "pull_request", "exempt"]>, {
-        default: () => "always";
-      }>;
+      readonly actor_type: Schema.Literals<readonly ["Integration", "OrganizationAdmin", "RepositoryRole", "Team", "DeployKey"]>;
+      readonly bypass_mode: Schema.withDecodingDefaultKey<Schema.Literals<readonly ["always", "pull_request", "exempt"]>, never>;
     }>>>;
-    creation: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    update: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    deletion: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    required_linear_history: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    required_signatures: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    non_fast_forward: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    deployments: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    targets: Schema.optional<Schema.Union<[Schema.Literal<["default", "all"]>, Schema.Array$<Schema.Union<[Schema.Struct<{
-      include: Schema.SchemaClass<string, string, never>;
+    readonly creation: Schema.optional<Schema.Boolean>;
+    readonly update: Schema.optional<Schema.Boolean>;
+    readonly deletion: Schema.optional<Schema.Boolean>;
+    readonly required_linear_history: Schema.optional<Schema.Boolean>;
+    readonly required_signatures: Schema.optional<Schema.Boolean>;
+    readonly non_fast_forward: Schema.optional<Schema.Boolean>;
+    readonly deployments: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly targets: Schema.optional<Schema.Union<readonly [Schema.Literals<readonly ["default", "all"]>, Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+      readonly include: Schema.String;
     }>, Schema.Struct<{
-      exclude: Schema.SchemaClass<string, string, never>;
+      readonly exclude: Schema.String;
     }>]>>]>>;
-    status_checks: Schema.optional<Schema.Struct<{
-      update_branch: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-      on_creation: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-      default_integration_id: Schema.optional<Schema.Union<[typeof Schema.Int, Schema.Struct<{
-        resolved: Schema.SchemaClass<string, string, never>;
+    readonly status_checks: Schema.optional<Schema.Struct<{
+      readonly update_branch: Schema.optional<Schema.Boolean>;
+      readonly on_creation: Schema.optional<Schema.Boolean>;
+      readonly default_integration_id: Schema.optional<Schema.Union<readonly [Schema.Int, Schema.Struct<{
+        readonly resolved: Schema.String;
       }>]>>;
-      required: Schema.Array$<Schema.Struct<{
-        context: Schema.SchemaClass<string, string, never>;
-        integration_id: Schema.optional<Schema.Union<[typeof Schema.Int, Schema.Struct<{
-          resolved: Schema.SchemaClass<string, string, never>;
+      readonly required: Schema.$Array<Schema.Struct<{
+        readonly context: Schema.String;
+        readonly integration_id: Schema.optional<Schema.Union<readonly [Schema.Int, Schema.Struct<{
+          readonly resolved: Schema.String;
         }>]>>;
       }>>;
     }>>;
-    commit_message: Schema.optional<Schema.Array$<Schema.Struct<{
-      operator: Schema.Literal<["starts_with", "ends_with", "contains", "regex"]>;
-      pattern: Schema.SchemaClass<string, string, never>;
-      name: Schema.optional<Schema.SchemaClass<string, string, never>>;
-      negate: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
+    readonly commit_message: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly operator: Schema.Literals<readonly ["starts_with", "ends_with", "contains", "regex"]>;
+      readonly pattern: Schema.String;
+      readonly name: Schema.optional<Schema.String>;
+      readonly negate: Schema.optional<Schema.Boolean>;
+    }>>>;
+    readonly commit_author_email: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly operator: Schema.Literals<readonly ["starts_with", "ends_with", "contains", "regex"]>;
+      readonly pattern: Schema.String;
+      readonly name: Schema.optional<Schema.String>;
+      readonly negate: Schema.optional<Schema.Boolean>;
     }>>>;
-    commit_author_email: Schema.optional<Schema.Array$<Schema.Struct<{
-      operator: Schema.Literal<["starts_with", "ends_with", "contains", "regex"]>;
-      pattern: Schema.SchemaClass<string, string, never>;
-      name: Schema.optional<Schema.SchemaClass<string, string, never>>;
-      negate: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
+    readonly committer_email: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly operator: Schema.Literals<readonly ["starts_with", "ends_with", "contains", "regex"]>;
+      readonly pattern: Schema.String;
+      readonly name: Schema.optional<Schema.String>;
+      readonly negate: Schema.optional<Schema.Boolean>;
     }>>>;
-    committer_email: Schema.optional<Schema.Array$<Schema.Struct<{
-      operator: Schema.Literal<["starts_with", "ends_with", "contains", "regex"]>;
-      pattern: Schema.SchemaClass<string, string, never>;
-      name: Schema.optional<Schema.SchemaClass<string, string, never>>;
-      negate: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
+    readonly type: Schema.Literal<"tag">;
+    readonly tag_name: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly operator: Schema.Literals<readonly ["starts_with", "ends_with", "contains", "regex"]>;
+      readonly pattern: Schema.String;
+      readonly name: Schema.optional<Schema.String>;
+      readonly negate: Schema.optional<Schema.Boolean>;
     }>>>;
-  }>]>>, {
-    default: () => {};
-  }>;
-  environments: Schema.optionalWith<Schema.Record$<typeof Schema.String, Schema.Struct<{
-    wait_timer: Schema.optional<Schema.refine<number, typeof Schema.Int>>;
-    prevent_self_review: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    reviewers: Schema.optional<Schema.Array$<Schema.Struct<{
-      type: Schema.Literal<["User", "Team"]>;
-      id: Schema.refine<number, typeof Schema.Number>;
+  }>]>>, never>;
+  readonly environments: Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.Struct<{
+    readonly wait_timer: Schema.optional<Schema.Int>;
+    readonly prevent_self_review: Schema.optional<Schema.Boolean>;
+    readonly reviewers: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly type: Schema.Literals<readonly ["User", "Team"]>;
+      readonly id: Schema.Int;
     }>>>;
-    deployment_branches: Schema.optional<Schema.Union<[Schema.Literal<["all", "protected"]>, Schema.Array$<Schema.Struct<{
-      name: Schema.SchemaClass<string, string, never>;
-      type: Schema.optionalWith<Schema.Literal<["branch", "tag"]>, {
-        default: () => "branch";
-      }>;
+    readonly deployment_branches: Schema.optional<Schema.Union<readonly [Schema.Literals<readonly ["all", "protected"]>, Schema.$Array<Schema.Struct<{
+      readonly name: Schema.String;
+      readonly type: Schema.withDecodingDefaultKey<Schema.Literals<readonly ["branch", "tag"]>, never>;
     }>>]>>;
-  }>>, {
-    default: () => {};
-  }>;
-  security: Schema.optionalWith<Schema.Record$<typeof Schema.String, Schema.refine<{
-    readonly vulnerability_alerts?: boolean | undefined;
-    readonly automated_security_fixes?: boolean | undefined;
-    readonly private_vulnerability_reporting?: boolean | undefined;
-  }, Schema.Struct<{
-    vulnerability_alerts: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    automated_security_fixes: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    private_vulnerability_reporting: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  }>>>, {
-    default: () => {};
-  }>;
-  code_scanning: Schema.optionalWith<Schema.Record$<typeof Schema.String, Schema.refine<{
-    readonly state?: "configured" | "not-configured" | undefined;
-    readonly languages?: readonly ("actions" | "c-cpp" | "csharp" | "go" | "java-kotlin" | "javascript-typescript" | "python" | "ruby" | "swift")[] | undefined;
-    readonly query_suite?: "default" | "extended" | undefined;
-    readonly threat_model?: "remote" | "remote_and_local" | undefined;
-    readonly runner_type?: "standard" | "labeled" | undefined;
-    readonly runner_label?: string | undefined;
-  }, Schema.Struct<{
-    state: Schema.optional<Schema.Literal<["configured", "not-configured"]>>;
-    languages: Schema.optional<Schema.Array$<Schema.Literal<["actions", "c-cpp", "csharp", "go", "java-kotlin", "javascript-typescript", "python", "ruby", "swift"]>>>;
-    query_suite: Schema.optional<Schema.Literal<["default", "extended"]>>;
-    threat_model: Schema.optional<Schema.Literal<["remote", "remote_and_local"]>>;
-    runner_type: Schema.optional<Schema.Literal<["standard", "labeled"]>>;
-    runner_label: Schema.optional<Schema.SchemaClass<string, string, never>>;
-  }>>>, {
-    default: () => {};
-  }>;
-  groups: Schema.Record$<typeof Schema.String, Schema.Struct<{
-    owner: Schema.optional<Schema.SchemaClass<string, string, never>>;
-    repos: Schema.Array$<typeof Schema.String>;
-    credentials: Schema.optional<Schema.SchemaClass<string, string, never>>;
-    settings: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    environments: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    secrets: Schema.optional<Schema.Struct<{
-      actions: Schema.optional<Schema.Array$<typeof Schema.String>>;
-      dependabot: Schema.optional<Schema.Array$<typeof Schema.String>>;
-      codespaces: Schema.optional<Schema.Array$<typeof Schema.String>>;
-      environments: Schema.optional<Schema.Record$<typeof Schema.String, Schema.Array$<typeof Schema.String>>>;
+  }>>, never>;
+  readonly security: Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.Struct<{
+    readonly vulnerability_alerts: Schema.optional<Schema.Boolean>;
+    readonly automated_security_fixes: Schema.optional<Schema.Boolean>;
+    readonly private_vulnerability_reporting: Schema.optional<Schema.Boolean>;
+  }>>, never>;
+  readonly code_scanning: Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.Struct<{
+    readonly state: Schema.optional<Schema.Literals<readonly ["configured", "not-configured"]>>;
+    readonly languages: Schema.optional<Schema.$Array<Schema.Literals<readonly ["actions", "c-cpp", "csharp", "go", "java-kotlin", "javascript-typescript", "python", "ruby", "swift"]>>>;
+    readonly query_suite: Schema.optional<Schema.Literals<readonly ["default", "extended"]>>;
+    readonly threat_model: Schema.optional<Schema.Literals<readonly ["remote", "remote_and_local"]>>;
+    readonly runner_type: Schema.optional<Schema.Literals<readonly ["standard", "labeled"]>>;
+    readonly runner_label: Schema.optional<Schema.String>;
+  }>>, never>;
+  readonly groups: Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.Struct<{
+    readonly repos: Schema.$Array<Schema.String>;
+    readonly credentials: Schema.String;
+    readonly settings: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly environments: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly secrets: Schema.optional<Schema.Struct<{
+      readonly actions: Schema.optional<Schema.$Array<Schema.String>>;
+      readonly dependabot: Schema.optional<Schema.$Array<Schema.String>>;
+      readonly codespaces: Schema.optional<Schema.$Array<Schema.String>>;
+      readonly environments: Schema.optional<Schema.$Record<Schema.String, Schema.$Array<Schema.String>>>;
     }>>;
-    variables: Schema.optional<Schema.Struct<{
-      actions: Schema.optional<Schema.Array$<typeof Schema.String>>;
-      environments: Schema.optional<Schema.Record$<typeof Schema.String, Schema.Array$<typeof Schema.String>>>;
-    }>>;
-    rulesets: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    security: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    code_scanning: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    cleanup: Schema.optional<Schema.Struct<{
-      secrets: Schema.optionalWith<Schema.Struct<{
-        actions: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-          preserve: Schema.Array$<typeof Schema.String>;
-        }>]>, {
-          default: () => CleanupScope;
-        }>;
-        dependabot: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-          preserve: Schema.Array$<typeof Schema.String>;
-        }>]>, {
-          default: () => CleanupScope;
-        }>;
-        codespaces: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-          preserve: Schema.Array$<typeof Schema.String>;
-        }>]>, {
-          default: () => CleanupScope;
-        }>;
-        environments: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-          preserve: Schema.Array$<typeof Schema.String>;
-        }>]>, {
-          default: () => CleanupScope;
-        }>;
-      }>, {
-        default: () => {
-          actions: CleanupScope;
-          dependabot: CleanupScope;
-          codespaces: CleanupScope;
-          environments: CleanupScope;
-        };
-      }>;
-      variables: Schema.optionalWith<Schema.Struct<{
-        actions: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-          preserve: Schema.Array$<typeof Schema.String>;
-        }>]>, {
-          default: () => CleanupScope;
-        }>;
-        environments: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-          preserve: Schema.Array$<typeof Schema.String>;
-        }>]>, {
-          default: () => CleanupScope;
-        }>;
-      }>, {
-        default: () => {
-          actions: CleanupScope;
-          environments: CleanupScope;
-        };
-      }>;
-      rulesets: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-        preserve: Schema.Array$<typeof Schema.String>;
-      }>]>, {
-        default: () => CleanupScope;
-      }>;
-      environments: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
-        preserve: Schema.Array$<typeof Schema.String>;
-      }>]>, {
-        default: () => CleanupScope;
-      }>;
+    readonly variables: Schema.optional<Schema.Struct<{
+      readonly actions: Schema.optional<Schema.$Array<Schema.String>>;
+      readonly environments: Schema.optional<Schema.$Record<Schema.String, Schema.$Array<Schema.String>>>;
     }>>;
-  }>>;
-}>;
-type Config = typeof ConfigSchema.Type;
-//#endregion
-//#region src/schemas/credentials.d.ts
-declare const ResolveSectionSchema: Schema.Struct<{
-  op: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.String>>;
-  file: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.String>>;
-  value: Schema.optional<Schema.Record$<typeof Schema.String, Schema.Union<[typeof Schema.String, Schema.Record$<typeof Schema.String, Schema.SchemaClass<unknown, unknown, never>>]>>>;
-}>;
-type ResolveSection = typeof ResolveSectionSchema.Type;
-declare const CredentialProfileSchema: Schema.Struct<{
-  github_token: Schema.SchemaClass<string, string, never>;
-  op_service_account_token: Schema.optional<Schema.SchemaClass<string, string, never>>;
-  resolve: Schema.optional<Schema.Struct<{
-    op: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.String>>;
-    file: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.String>>;
-    value: Schema.optional<Schema.Record$<typeof Schema.String, Schema.Union<[typeof Schema.String, Schema.Record$<typeof Schema.String, Schema.SchemaClass<unknown, unknown, never>>]>>>;
-  }>>;
-}>;
-type CredentialProfile = typeof CredentialProfileSchema.Type;
-declare const CredentialsSchema: Schema.Struct<{
-  profiles: Schema.optionalWith<Schema.Record$<typeof Schema.String, Schema.Struct<{
-    github_token: Schema.SchemaClass<string, string, never>;
-    op_service_account_token: Schema.optional<Schema.SchemaClass<string, string, never>>;
-    resolve: Schema.optional<Schema.Struct<{
-      op: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.String>>;
-      file: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.String>>;
-      value: Schema.optional<Schema.Record$<typeof Schema.String, Schema.Union<[typeof Schema.String, Schema.Record$<typeof Schema.String, Schema.SchemaClass<unknown, unknown, never>>]>>>;
+    readonly rulesets: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly security: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly code_scanning: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly cleanup: Schema.optional<Schema.Struct<{
+      readonly secrets: Schema.withDecodingDefaultKey<Schema.Struct<{
+        readonly actions: Schema.withDecodingDefaultKey<Schema.Union<readonly [Schema.Boolean, Schema.Struct<{
+          readonly preserve: Schema.$Array<Schema.String>;
+        }>]>, never>;
+        readonly dependabot: Schema.withDecodingDefaultKey<Schema.Union<readonly [Schema.Boolean, Schema.Struct<{
+          readonly preserve: Schema.$Array<Schema.String>;
+        }>]>, never>;
+        readonly codespaces: Schema.withDecodingDefaultKey<Schema.Union<readonly [Schema.Boolean, Schema.Struct<{
+          readonly preserve: Schema.$Array<Schema.String>;
+        }>]>, never>;
+        readonly environments: Schema.withDecodingDefaultKey<Schema.Union<readonly [Schema.Boolean, Schema.Struct<{
+          readonly preserve: Schema.$Array<Schema.String>;
+        }>]>, never>;
+      }>, never>;
+      readonly variables: Schema.withDecodingDefaultKey<Schema.Struct<{
+        readonly actions: Schema.withDecodingDefaultKey<Schema.Union<readonly [Schema.Boolean, Schema.Struct<{
+          readonly preserve: Schema.$Array<Schema.String>;
+        }>]>, never>;
+        readonly environments: Schema.withDecodingDefaultKey<Schema.Union<readonly [Schema.Boolean, Schema.Struct<{
+          readonly preserve: Schema.$Array<Schema.String>;
+        }>]>, never>;
+      }>, never>;
+      readonly rulesets: Schema.withDecodingDefaultKey<Schema.Union<readonly [Schema.Boolean, Schema.Struct<{
+        readonly preserve: Schema.$Array<Schema.String>;
+      }>]>, never>;
+      readonly environments: Schema.withDecodingDefaultKey<Schema.Union<readonly [Schema.Boolean, Schema.Struct<{
+        readonly preserve: Schema.$Array<Schema.String>;
+      }>]>, never>;
     }>>;
-  }>>, {
-    default: () => {};
-  }>;
+  }>>, never>;
 }>;
-type Credentials = typeof CredentialsSchema.Type;
-//#endregion
-//#region src/schemas/ruleset.d.ts
-declare const ResolvedRefSchema: Schema.Struct<{
-  resolved: Schema.SchemaClass<string, string, never>;
-}>;
-type ResolvedRef = typeof ResolvedRefSchema.Type;
-declare const BypassActorSchema: Schema.Struct<{
-  actor_id: Schema.optional<Schema.Union<[typeof Schema.Int, Schema.Struct<{
-    resolved: Schema.SchemaClass<string, string, never>;
-  }>]>>;
-  actor_type: Schema.Literal<["Integration", "OrganizationAdmin", "RepositoryRole", "Team", "DeployKey"]>;
-  bypass_mode: Schema.optionalWith<Schema.Literal<["always", "pull_request", "exempt"]>, {
-    default: () => "always";
-  }>;
-}>;
-type BypassActor = typeof BypassActorSchema.Type;
-declare const RulesetSchema: Schema.Union<[Schema.Struct<{
-  type: Schema.Literal<["branch"]>;
-  pull_requests: Schema.optional<Schema.Struct<{
-    approvals: Schema.optionalWith<Schema.refine<number, typeof Schema.Int>, {
-      default: () => number;
-    }>;
-    dismiss_stale_reviews: Schema.optionalWith<Schema.SchemaClass<boolean, boolean, never>, {
-      default: () => boolean;
-    }>;
-    code_owner_review: Schema.optionalWith<Schema.SchemaClass<boolean, boolean, never>, {
-      default: () => boolean;
-    }>;
-    last_push_approval: Schema.optionalWith<Schema.SchemaClass<boolean, boolean, never>, {
-      default: () => boolean;
-    }>;
-    resolve_threads: Schema.optionalWith<Schema.SchemaClass<boolean, boolean, never>, {
-      default: () => boolean;
-    }>;
-    merge_methods: Schema.optional<Schema.Array$<Schema.Literal<["merge", "squash", "rebase"]>>>;
-    reviewers: Schema.optional<Schema.Array$<Schema.Struct<{
-      file_patterns: Schema.Array$<typeof Schema.String>;
-      minimum_approvals: Schema.refine<number, typeof Schema.Number>;
-      reviewer: Schema.Struct<{
-        id: Schema.refine<number, typeof Schema.Number>;
-        type: Schema.Literal<["Team"]>;
-      }>;
-    }>>>;
-  }>>;
-  merge_queue: Schema.optional<Schema.Struct<{
-    check_timeout: Schema.refine<number, typeof Schema.Int>;
-    grouping: Schema.Literal<["ALLGREEN", "HEADGREEN"]>;
-    max_build: Schema.refine<number, typeof Schema.Int>;
-    max_merge: Schema.refine<number, typeof Schema.Int>;
-    merge_method: Schema.Literal<["MERGE", "SQUASH", "REBASE"]>;
-    min_merge: Schema.refine<number, typeof Schema.Int>;
-    min_wait: Schema.refine<number, typeof Schema.Int>;
-  }>>;
-  copilot_review: Schema.optional<Schema.Struct<{
-    draft_prs: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    on_push: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  }>>;
-  code_scanning: Schema.optional<Schema.Array$<Schema.Struct<{
-    tool: Schema.SchemaClass<string, string, never>;
-    alerts: Schema.Literal<["none", "errors", "errors_and_warnings", "all"]>;
-    security_alerts: Schema.Literal<["none", "critical", "high_or_higher", "medium_or_higher", "all"]>;
-  }>>>;
-  workflows: Schema.optional<Schema.Struct<{
-    on_creation: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    required: Schema.Array$<Schema.Struct<{
-      path: Schema.SchemaClass<string, string, never>;
-      ref: Schema.optional<Schema.SchemaClass<string, string, never>>;
-      repository_id: Schema.Union<[typeof Schema.Int, Schema.Struct<{
-        resolved: Schema.SchemaClass<string, string, never>;
-      }>]>;
-      sha: Schema.optional<Schema.SchemaClass<string, string, never>>;
-    }>>;
-  }>>;
-  branch_name: Schema.optional<Schema.Array$<Schema.Struct<{
-    operator: Schema.Literal<["starts_with", "ends_with", "contains", "regex"]>;
-    pattern: Schema.SchemaClass<string, string, never>;
-    name: Schema.optional<Schema.SchemaClass<string, string, never>>;
-    negate: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  }>>>;
-  name: Schema.SchemaClass<string, string, never>;
-  enforcement: Schema.Literal<["disabled", "active", "evaluate"]>;
-  conditions: Schema.optional<Schema.Struct<{
-    ref_name: Schema.optional<Schema.Struct<{
-      include: Schema.optionalWith<Schema.Array$<typeof Schema.String>, {
-        default: () => never[];
-      }>;
-      exclude: Schema.optionalWith<Schema.Array$<typeof Schema.String>, {
-        default: () => never[];
-      }>;
-    }>>;
-  }>>;
-  bypass_actors: Schema.optional<Schema.Array$<Schema.Struct<{
-    actor_id: Schema.optional<Schema.Union<[typeof Schema.Int, Schema.Struct<{
-      resolved: Schema.SchemaClass<string, string, never>;
-    }>]>>;
-    actor_type: Schema.Literal<["Integration", "OrganizationAdmin", "RepositoryRole", "Team", "DeployKey"]>;
-    bypass_mode: Schema.optionalWith<Schema.Literal<["always", "pull_request", "exempt"]>, {
-      default: () => "always";
-    }>;
-  }>>>;
-  creation: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  update: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  deletion: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  required_linear_history: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  required_signatures: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  non_fast_forward: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  deployments: Schema.optional<Schema.Array$<typeof Schema.String>>;
-  targets: Schema.optional<Schema.Union<[Schema.Literal<["default", "all"]>, Schema.Array$<Schema.Union<[Schema.Struct<{
-    include: Schema.SchemaClass<string, string, never>;
-  }>, Schema.Struct<{
-    exclude: Schema.SchemaClass<string, string, never>;
-  }>]>>]>>;
-  status_checks: Schema.optional<Schema.Struct<{
-    update_branch: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    on_creation: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    default_integration_id: Schema.optional<Schema.Union<[typeof Schema.Int, Schema.Struct<{
-      resolved: Schema.SchemaClass<string, string, never>;
-    }>]>>;
-    required: Schema.Array$<Schema.Struct<{
-      context: Schema.SchemaClass<string, string, never>;
-      integration_id: Schema.optional<Schema.Union<[typeof Schema.Int, Schema.Struct<{
-        resolved: Schema.SchemaClass<string, string, never>;
-      }>]>>;
-    }>>;
-  }>>;
-  commit_message: Schema.optional<Schema.Array$<Schema.Struct<{
-    operator: Schema.Literal<["starts_with", "ends_with", "contains", "regex"]>;
-    pattern: Schema.SchemaClass<string, string, never>;
-    name: Schema.optional<Schema.SchemaClass<string, string, never>>;
-    negate: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  }>>>;
-  commit_author_email: Schema.optional<Schema.Array$<Schema.Struct<{
-    operator: Schema.Literal<["starts_with", "ends_with", "contains", "regex"]>;
-    pattern: Schema.SchemaClass<string, string, never>;
-    name: Schema.optional<Schema.SchemaClass<string, string, never>>;
-    negate: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  }>>>;
-  committer_email: Schema.optional<Schema.Array$<Schema.Struct<{
-    operator: Schema.Literal<["starts_with", "ends_with", "contains", "regex"]>;
-    pattern: Schema.SchemaClass<string, string, never>;
-    name: Schema.optional<Schema.SchemaClass<string, string, never>>;
-    negate: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  }>>>;
-}>, Schema.Struct<{
-  type: Schema.Literal<["tag"]>;
-  tag_name: Schema.optional<Schema.Array$<Schema.Struct<{
-    operator: Schema.Literal<["starts_with", "ends_with", "contains", "regex"]>;
-    pattern: Schema.SchemaClass<string, string, never>;
-    name: Schema.optional<Schema.SchemaClass<string, string, never>>;
-    negate: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  }>>>;
-  name: Schema.SchemaClass<string, string, never>;
-  enforcement: Schema.Literal<["disabled", "active", "evaluate"]>;
-  conditions: Schema.optional<Schema.Struct<{
-    ref_name: Schema.optional<Schema.Struct<{
-      include: Schema.optionalWith<Schema.Array$<typeof Schema.String>, {
-        default: () => never[];
-      }>;
-      exclude: Schema.optionalWith<Schema.Array$<typeof Schema.String>, {
-        default: () => never[];
-      }>;
-    }>>;
-  }>>;
-  bypass_actors: Schema.optional<Schema.Array$<Schema.Struct<{
-    actor_id: Schema.optional<Schema.Union<[typeof Schema.Int, Schema.Struct<{
-      resolved: Schema.SchemaClass<string, string, never>;
-    }>]>>;
-    actor_type: Schema.Literal<["Integration", "OrganizationAdmin", "RepositoryRole", "Team", "DeployKey"]>;
-    bypass_mode: Schema.optionalWith<Schema.Literal<["always", "pull_request", "exempt"]>, {
-      default: () => "always";
-    }>;
-  }>>>;
-  creation: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  update: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  deletion: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  required_linear_history: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  required_signatures: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  non_fast_forward: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  deployments: Schema.optional<Schema.Array$<typeof Schema.String>>;
-  targets: Schema.optional<Schema.Union<[Schema.Literal<["default", "all"]>, Schema.Array$<Schema.Union<[Schema.Struct<{
-    include: Schema.SchemaClass<string, string, never>;
-  }>, Schema.Struct<{
-    exclude: Schema.SchemaClass<string, string, never>;
-  }>]>>]>>;
-  status_checks: Schema.optional<Schema.Struct<{
-    update_branch: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    on_creation: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-    default_integration_id: Schema.optional<Schema.Union<[typeof Schema.Int, Schema.Struct<{
-      resolved: Schema.SchemaClass<string, string, never>;
-    }>]>>;
-    required: Schema.Array$<Schema.Struct<{
-      context: Schema.SchemaClass<string, string, never>;
-      integration_id: Schema.optional<Schema.Union<[typeof Schema.Int, Schema.Struct<{
-        resolved: Schema.SchemaClass<string, string, never>;
-      }>]>>;
-    }>>;
-  }>>;
-  commit_message: Schema.optional<Schema.Array$<Schema.Struct<{
-    operator: Schema.Literal<["starts_with", "ends_with", "contains", "regex"]>;
-    pattern: Schema.SchemaClass<string, string, never>;
-    name: Schema.optional<Schema.SchemaClass<string, string, never>>;
-    negate: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  }>>>;
-  commit_author_email: Schema.optional<Schema.Array$<Schema.Struct<{
-    operator: Schema.Literal<["starts_with", "ends_with", "contains", "regex"]>;
-    pattern: Schema.SchemaClass<string, string, never>;
-    name: Schema.optional<Schema.SchemaClass<string, string, never>>;
-    negate: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  }>>>;
-  committer_email: Schema.optional<Schema.Array$<Schema.Struct<{
-    operator: Schema.Literal<["starts_with", "ends_with", "contains", "regex"]>;
-    pattern: Schema.SchemaClass<string, string, never>;
-    name: Schema.optional<Schema.SchemaClass<string, string, never>>;
-    negate: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
-  }>>>;
-}>]>;
-type Ruleset = typeof RulesetSchema.Type;
-/** API-compatible payload for creating/updating a ruleset. */
-interface RulesetPayload {
-  name: string;
-  target: "branch" | "tag";
-  enforcement: "disabled" | "active" | "evaluate";
-  conditions?: Record<string, unknown>;
-  bypass_actors?: ReadonlyArray<Record<string, unknown>>;
-  rules?: ReadonlyArray<Record<string, unknown>>;
-}
 /**
- * Builds an API-compatible ruleset payload from the config-level Ruleset.
- * Converts all shorthand fields into the GitHub API rules array format.
+ * The decoded shape of {@link ConfigSchema}.
+ *
+ * @public
  */
-declare function buildRulesetPayload(ruleset: Ruleset): RulesetPayload;
+type Config = typeof ConfigSchema.Type;
 //#endregion
 //#region src/services/ConfigFiles.d.ts
+/**
+ * The config file's fixed name, in every tier of the resolver chain.
+ *
+ * @public
+ */
 declare const CONFIG_FILENAME = "reposets.config.toml";
-declare const CREDENTIALS_FILENAME = "reposets.credentials.toml";
-declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effect").ConfigFileService<{
-  readonly code_scanning: {
-    readonly [x: string]: {
-      readonly state?: "configured" | "not-configured" | undefined;
-      readonly languages?: readonly ("actions" | "c-cpp" | "csharp" | "go" | "java-kotlin" | "javascript-typescript" | "python" | "ruby" | "swift")[] | undefined;
-      readonly query_suite?: "default" | "extended" | undefined;
-      readonly threat_model?: "remote" | "remote_and_local" | undefined;
-      readonly runner_type?: "standard" | "labeled" | undefined;
-      readonly runner_label?: string | undefined;
-    };
-  };
-  readonly owner?: string | undefined;
-  readonly log_level: "silent" | "info" | "verbose" | "debug";
+declare const ReposetsConfigFile_base: import("effect/Context").ServiceClass<ReposetsConfigFile, "reposets/Config", import("@effected/config-file").ConfigFileShape<{
   readonly settings: {
     readonly [x: string]: {
-      readonly [x: string]: unknown;
-      readonly allow_forking?: boolean | undefined;
+      readonly [x: string]: import("effect/Schema").Json;
       readonly is_template?: boolean | undefined;
       readonly has_wiki?: boolean | undefined;
       readonly has_issues?: boolean | undefined;
@@ -900,15 +343,16 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
       readonly has_discussions?: boolean | undefined;
       readonly has_sponsorships?: boolean | undefined;
       readonly has_pull_requests?: boolean | undefined;
+      readonly allow_forking?: boolean | undefined;
       readonly allow_merge_commit?: boolean | undefined;
       readonly allow_squash_merge?: boolean | undefined;
       readonly allow_rebase_merge?: boolean | undefined;
       readonly allow_auto_merge?: boolean | undefined;
       readonly allow_update_branch?: boolean | undefined;
-      readonly squash_merge_commit_title?: "PR_TITLE" | "COMMIT_OR_PR_TITLE" | undefined;
-      readonly squash_merge_commit_message?: "PR_BODY" | "COMMIT_MESSAGES" | "BLANK" | undefined;
-      readonly merge_commit_title?: "PR_TITLE" | "MERGE_MESSAGE" | undefined;
-      readonly merge_commit_message?: "PR_TITLE" | "PR_BODY" | "BLANK" | undefined;
+      readonly squash_merge_commit_title?: "COMMIT_OR_PR_TITLE" | "PR_TITLE" | undefined;
+      readonly squash_merge_commit_message?: "BLANK" | "COMMIT_MESSAGES" | "PR_BODY" | undefined;
+      readonly merge_commit_title?: "MERGE_MESSAGE" | "PR_TITLE" | undefined;
+      readonly merge_commit_message?: "BLANK" | "PR_BODY" | "PR_TITLE" | undefined;
       readonly delete_branch_on_merge?: boolean | undefined;
       readonly web_commit_signoff_required?: boolean | undefined;
       readonly security_and_analysis?: {
@@ -924,8 +368,8 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
           readonly team: string;
           readonly mode?: "ALWAYS" | "EXEMPT" | undefined;
         } | {
-          readonly mode?: "ALWAYS" | "EXEMPT" | undefined;
           readonly role: string;
+          readonly mode?: "ALWAYS" | "EXEMPT" | undefined;
         })[] | undefined;
         readonly dependabot_security_updates?: "disabled" | "enabled" | undefined;
       } | undefined;
@@ -939,7 +383,7 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
     } | {
       readonly value: {
         readonly [x: string]: string | {
-          readonly [x: string]: unknown;
+          readonly [x: string]: import("effect/Schema").Json;
         };
       };
     } | {
@@ -956,7 +400,7 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
     } | {
       readonly value: {
         readonly [x: string]: string | {
-          readonly [x: string]: unknown;
+          readonly [x: string]: import("effect/Schema").Json;
         };
       };
     } | {
@@ -968,119 +412,7 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
   readonly rulesets: {
     readonly [x: string]: {
       readonly name: string;
-      readonly type: "branch";
-      readonly pull_requests?: {
-        readonly approvals: number;
-        readonly dismiss_stale_reviews: boolean;
-        readonly code_owner_review: boolean;
-        readonly last_push_approval: boolean;
-        readonly resolve_threads: boolean;
-        readonly merge_methods?: readonly ("merge" | "squash" | "rebase")[] | undefined;
-        readonly reviewers?: readonly {
-          readonly file_patterns: readonly string[];
-          readonly minimum_approvals: number;
-          readonly reviewer: {
-            readonly type: "Team";
-            readonly id: number;
-          };
-        }[] | undefined;
-      } | undefined;
-      readonly merge_queue?: {
-        readonly check_timeout: number;
-        readonly grouping: "ALLGREEN" | "HEADGREEN";
-        readonly max_build: number;
-        readonly max_merge: number;
-        readonly merge_method: "MERGE" | "SQUASH" | "REBASE";
-        readonly min_merge: number;
-        readonly min_wait: number;
-      } | undefined;
-      readonly copilot_review?: {
-        readonly draft_prs?: boolean | undefined;
-        readonly on_push?: boolean | undefined;
-      } | undefined;
-      readonly code_scanning?: readonly {
-        readonly tool: string;
-        readonly alerts: "all" | "none" | "errors" | "errors_and_warnings";
-        readonly security_alerts: "all" | "none" | "critical" | "high_or_higher" | "medium_or_higher";
-      }[] | undefined;
-      readonly workflows?: {
-        readonly on_creation?: boolean | undefined;
-        readonly required: readonly {
-          readonly path: string;
-          readonly ref?: string | undefined;
-          readonly repository_id: number | {
-            readonly resolved: string;
-          };
-          readonly sha?: string | undefined;
-        }[];
-      } | undefined;
-      readonly branch_name?: readonly {
-        readonly operator: "starts_with" | "ends_with" | "contains" | "regex";
-        readonly pattern: string;
-        readonly name?: string | undefined;
-        readonly negate?: boolean | undefined;
-      }[] | undefined;
-      readonly enforcement: "disabled" | "active" | "evaluate";
-      readonly conditions?: {
-        readonly ref_name?: {
-          readonly include: readonly string[];
-          readonly exclude: readonly string[];
-        } | undefined;
-      } | undefined;
-      readonly bypass_actors?: readonly {
-        readonly actor_id?: number | {
-          readonly resolved: string;
-        } | undefined;
-        readonly actor_type: "Integration" | "OrganizationAdmin" | "RepositoryRole" | "Team" | "DeployKey";
-        readonly bypass_mode: "always" | "pull_request" | "exempt";
-      }[] | undefined;
-      readonly creation?: boolean | undefined;
-      readonly update?: boolean | undefined;
-      readonly deletion?: boolean | undefined;
-      readonly required_linear_history?: boolean | undefined;
-      readonly required_signatures?: boolean | undefined;
-      readonly non_fast_forward?: boolean | undefined;
-      readonly deployments?: readonly string[] | undefined;
-      readonly targets?: "default" | "all" | readonly ({
-        readonly include: string;
-      } | {
-        readonly exclude: string;
-      })[] | undefined;
-      readonly status_checks?: {
-        readonly update_branch?: boolean | undefined;
-        readonly on_creation?: boolean | undefined;
-        readonly default_integration_id?: number | {
-          readonly resolved: string;
-        } | undefined;
-        readonly required: readonly {
-          readonly context: string;
-          readonly integration_id?: number | {
-            readonly resolved: string;
-          } | undefined;
-        }[];
-      } | undefined;
-      readonly commit_message?: readonly {
-        readonly operator: "starts_with" | "ends_with" | "contains" | "regex";
-        readonly pattern: string;
-        readonly name?: string | undefined;
-        readonly negate?: boolean | undefined;
-      }[] | undefined;
-      readonly commit_author_email?: readonly {
-        readonly operator: "starts_with" | "ends_with" | "contains" | "regex";
-        readonly pattern: string;
-        readonly name?: string | undefined;
-        readonly negate?: boolean | undefined;
-      }[] | undefined;
-      readonly committer_email?: readonly {
-        readonly operator: "starts_with" | "ends_with" | "contains" | "regex";
-        readonly pattern: string;
-        readonly name?: string | undefined;
-        readonly negate?: boolean | undefined;
-      }[] | undefined;
-    } | {
-      readonly name: string;
-      readonly type: "tag";
-      readonly enforcement: "disabled" | "active" | "evaluate";
+      readonly enforcement: "active" | "disabled" | "evaluate";
       readonly conditions?: {
         readonly ref_name?: {
           readonly include: readonly string[];
@@ -1091,8 +423,8 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
         readonly actor_id?: number | {
           readonly resolved: string;
         } | undefined;
-        readonly actor_type: "Integration" | "OrganizationAdmin" | "RepositoryRole" | "Team" | "DeployKey";
-        readonly bypass_mode: "always" | "pull_request" | "exempt";
+        readonly actor_type: "DeployKey" | "Integration" | "OrganizationAdmin" | "RepositoryRole" | "Team";
+        readonly bypass_mode: "always" | "exempt" | "pull_request";
       }[] | undefined;
       readonly creation?: boolean | undefined;
       readonly update?: boolean | undefined;
@@ -1101,7 +433,7 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
       readonly required_signatures?: boolean | undefined;
       readonly non_fast_forward?: boolean | undefined;
       readonly deployments?: readonly string[] | undefined;
-      readonly targets?: "default" | "all" | readonly ({
+      readonly targets?: "all" | "default" | readonly ({
         readonly include: string;
       } | {
         readonly exclude: string;
@@ -1120,200 +452,23 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
         }[];
       } | undefined;
       readonly commit_message?: readonly {
-        readonly operator: "starts_with" | "ends_with" | "contains" | "regex";
+        readonly operator: "contains" | "ends_with" | "regex" | "starts_with";
         readonly pattern: string;
         readonly name?: string | undefined;
         readonly negate?: boolean | undefined;
       }[] | undefined;
       readonly commit_author_email?: readonly {
-        readonly operator: "starts_with" | "ends_with" | "contains" | "regex";
+        readonly operator: "contains" | "ends_with" | "regex" | "starts_with";
         readonly pattern: string;
         readonly name?: string | undefined;
         readonly negate?: boolean | undefined;
       }[] | undefined;
       readonly committer_email?: readonly {
-        readonly operator: "starts_with" | "ends_with" | "contains" | "regex";
+        readonly operator: "contains" | "ends_with" | "regex" | "starts_with";
         readonly pattern: string;
         readonly name?: string | undefined;
         readonly negate?: boolean | undefined;
       }[] | undefined;
-      readonly tag_name?: readonly {
-        readonly operator: "starts_with" | "ends_with" | "contains" | "regex";
-        readonly pattern: string;
-        readonly name?: string | undefined;
-        readonly negate?: boolean | undefined;
-      }[] | undefined;
-    };
-  };
-  readonly environments: {
-    readonly [x: string]: {
-      readonly reviewers?: readonly {
-        readonly type: "Team" | "User";
-        readonly id: number;
-      }[] | undefined;
-      readonly wait_timer?: number | undefined;
-      readonly prevent_self_review?: boolean | undefined;
-      readonly deployment_branches?: "all" | "protected" | readonly {
-        readonly name: string;
-        readonly type: "branch" | "tag";
-      }[] | undefined;
-    };
-  };
-  readonly security: {
-    readonly [x: string]: {
-      readonly vulnerability_alerts?: boolean | undefined;
-      readonly automated_security_fixes?: boolean | undefined;
-      readonly private_vulnerability_reporting?: boolean | undefined;
-    };
-  };
-  readonly groups: {
-    readonly [x: string]: {
-      readonly code_scanning?: readonly string[] | undefined;
-      readonly owner?: string | undefined;
-      readonly settings?: readonly string[] | undefined;
-      readonly secrets?: {
-        readonly environments?: {
-          readonly [x: string]: readonly string[];
-        } | undefined;
-        readonly actions?: readonly string[] | undefined;
-        readonly dependabot?: readonly string[] | undefined;
-        readonly codespaces?: readonly string[] | undefined;
-      } | undefined;
-      readonly variables?: {
-        readonly environments?: {
-          readonly [x: string]: readonly string[];
-        } | undefined;
-        readonly actions?: readonly string[] | undefined;
-      } | undefined;
-      readonly rulesets?: readonly string[] | undefined;
-      readonly environments?: readonly string[] | undefined;
-      readonly security?: readonly string[] | undefined;
-      readonly repos: readonly string[];
-      readonly credentials?: string | undefined;
-      readonly cleanup?: {
-        readonly secrets: {
-          readonly environments: boolean | {
-            readonly preserve: readonly string[];
-          };
-          readonly actions: boolean | {
-            readonly preserve: readonly string[];
-          };
-          readonly dependabot: boolean | {
-            readonly preserve: readonly string[];
-          };
-          readonly codespaces: boolean | {
-            readonly preserve: readonly string[];
-          };
-        };
-        readonly variables: {
-          readonly environments: boolean | {
-            readonly preserve: readonly string[];
-          };
-          readonly actions: boolean | {
-            readonly preserve: readonly string[];
-          };
-        };
-        readonly rulesets: boolean | {
-          readonly preserve: readonly string[];
-        };
-        readonly environments: boolean | {
-          readonly preserve: readonly string[];
-        };
-      } | undefined;
-    };
-  };
-}>, import("xdg-effect").ConfigFileService<{
-  readonly code_scanning: {
-    readonly [x: string]: {
-      readonly state?: "configured" | "not-configured" | undefined;
-      readonly languages?: readonly ("actions" | "c-cpp" | "csharp" | "go" | "java-kotlin" | "javascript-typescript" | "python" | "ruby" | "swift")[] | undefined;
-      readonly query_suite?: "default" | "extended" | undefined;
-      readonly threat_model?: "remote" | "remote_and_local" | undefined;
-      readonly runner_type?: "standard" | "labeled" | undefined;
-      readonly runner_label?: string | undefined;
-    };
-  };
-  readonly owner?: string | undefined;
-  readonly log_level: "silent" | "info" | "verbose" | "debug";
-  readonly settings: {
-    readonly [x: string]: {
-      readonly [x: string]: unknown;
-      readonly allow_forking?: boolean | undefined;
-      readonly is_template?: boolean | undefined;
-      readonly has_wiki?: boolean | undefined;
-      readonly has_issues?: boolean | undefined;
-      readonly has_projects?: boolean | undefined;
-      readonly has_discussions?: boolean | undefined;
-      readonly has_sponsorships?: boolean | undefined;
-      readonly has_pull_requests?: boolean | undefined;
-      readonly allow_merge_commit?: boolean | undefined;
-      readonly allow_squash_merge?: boolean | undefined;
-      readonly allow_rebase_merge?: boolean | undefined;
-      readonly allow_auto_merge?: boolean | undefined;
-      readonly allow_update_branch?: boolean | undefined;
-      readonly squash_merge_commit_title?: "PR_TITLE" | "COMMIT_OR_PR_TITLE" | undefined;
-      readonly squash_merge_commit_message?: "PR_BODY" | "COMMIT_MESSAGES" | "BLANK" | undefined;
-      readonly merge_commit_title?: "PR_TITLE" | "MERGE_MESSAGE" | undefined;
-      readonly merge_commit_message?: "PR_TITLE" | "PR_BODY" | "BLANK" | undefined;
-      readonly delete_branch_on_merge?: boolean | undefined;
-      readonly web_commit_signoff_required?: boolean | undefined;
-      readonly security_and_analysis?: {
-        readonly advanced_security?: "disabled" | "enabled" | undefined;
-        readonly code_security?: "disabled" | "enabled" | undefined;
-        readonly secret_scanning?: "disabled" | "enabled" | undefined;
-        readonly secret_scanning_push_protection?: "disabled" | "enabled" | undefined;
-        readonly secret_scanning_ai_detection?: "disabled" | "enabled" | undefined;
-        readonly secret_scanning_non_provider_patterns?: "disabled" | "enabled" | undefined;
-        readonly secret_scanning_delegated_alert_dismissal?: "disabled" | "enabled" | undefined;
-        readonly secret_scanning_delegated_bypass?: "disabled" | "enabled" | undefined;
-        readonly delegated_bypass_reviewers?: readonly ({
-          readonly team: string;
-          readonly mode?: "ALWAYS" | "EXEMPT" | undefined;
-        } | {
-          readonly mode?: "ALWAYS" | "EXEMPT" | undefined;
-          readonly role: string;
-        })[] | undefined;
-        readonly dependabot_security_updates?: "disabled" | "enabled" | undefined;
-      } | undefined;
-    };
-  };
-  readonly secrets: {
-    readonly [x: string]: {
-      readonly file: {
-        readonly [x: string]: string;
-      };
-    } | {
-      readonly value: {
-        readonly [x: string]: string | {
-          readonly [x: string]: unknown;
-        };
-      };
-    } | {
-      readonly resolved: {
-        readonly [x: string]: string;
-      };
-    };
-  };
-  readonly variables: {
-    readonly [x: string]: {
-      readonly file: {
-        readonly [x: string]: string;
-      };
-    } | {
-      readonly value: {
-        readonly [x: string]: string | {
-          readonly [x: string]: unknown;
-        };
-      };
-    } | {
-      readonly resolved: {
-        readonly [x: string]: string;
-      };
-    };
-  };
-  readonly rulesets: {
-    readonly [x: string]: {
-      readonly name: string;
       readonly type: "branch";
       readonly pull_requests?: {
         readonly approvals: number;
@@ -1321,13 +476,13 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
         readonly code_owner_review: boolean;
         readonly last_push_approval: boolean;
         readonly resolve_threads: boolean;
-        readonly merge_methods?: readonly ("merge" | "squash" | "rebase")[] | undefined;
+        readonly merge_methods?: readonly ("merge" | "rebase" | "squash")[] | undefined;
         readonly reviewers?: readonly {
           readonly file_patterns: readonly string[];
           readonly minimum_approvals: number;
           readonly reviewer: {
-            readonly type: "Team";
             readonly id: number;
+            readonly type: "Team";
           };
         }[] | undefined;
       } | undefined;
@@ -1336,7 +491,7 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
         readonly grouping: "ALLGREEN" | "HEADGREEN";
         readonly max_build: number;
         readonly max_merge: number;
-        readonly merge_method: "MERGE" | "SQUASH" | "REBASE";
+        readonly merge_method: "MERGE" | "REBASE" | "SQUASH";
         readonly min_merge: number;
         readonly min_wait: number;
       } | undefined;
@@ -1346,8 +501,8 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
       } | undefined;
       readonly code_scanning?: readonly {
         readonly tool: string;
-        readonly alerts: "all" | "none" | "errors" | "errors_and_warnings";
-        readonly security_alerts: "all" | "none" | "critical" | "high_or_higher" | "medium_or_higher";
+        readonly alerts: "all" | "errors" | "errors_and_warnings" | "none";
+        readonly security_alerts: "all" | "critical" | "high_or_higher" | "medium_or_higher" | "none";
       }[] | undefined;
       readonly workflows?: {
         readonly on_creation?: boolean | undefined;
@@ -1361,72 +516,14 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
         }[];
       } | undefined;
       readonly branch_name?: readonly {
-        readonly operator: "starts_with" | "ends_with" | "contains" | "regex";
-        readonly pattern: string;
-        readonly name?: string | undefined;
-        readonly negate?: boolean | undefined;
-      }[] | undefined;
-      readonly enforcement: "disabled" | "active" | "evaluate";
-      readonly conditions?: {
-        readonly ref_name?: {
-          readonly include: readonly string[];
-          readonly exclude: readonly string[];
-        } | undefined;
-      } | undefined;
-      readonly bypass_actors?: readonly {
-        readonly actor_id?: number | {
-          readonly resolved: string;
-        } | undefined;
-        readonly actor_type: "Integration" | "OrganizationAdmin" | "RepositoryRole" | "Team" | "DeployKey";
-        readonly bypass_mode: "always" | "pull_request" | "exempt";
-      }[] | undefined;
-      readonly creation?: boolean | undefined;
-      readonly update?: boolean | undefined;
-      readonly deletion?: boolean | undefined;
-      readonly required_linear_history?: boolean | undefined;
-      readonly required_signatures?: boolean | undefined;
-      readonly non_fast_forward?: boolean | undefined;
-      readonly deployments?: readonly string[] | undefined;
-      readonly targets?: "default" | "all" | readonly ({
-        readonly include: string;
-      } | {
-        readonly exclude: string;
-      })[] | undefined;
-      readonly status_checks?: {
-        readonly update_branch?: boolean | undefined;
-        readonly on_creation?: boolean | undefined;
-        readonly default_integration_id?: number | {
-          readonly resolved: string;
-        } | undefined;
-        readonly required: readonly {
-          readonly context: string;
-          readonly integration_id?: number | {
-            readonly resolved: string;
-          } | undefined;
-        }[];
-      } | undefined;
-      readonly commit_message?: readonly {
-        readonly operator: "starts_with" | "ends_with" | "contains" | "regex";
-        readonly pattern: string;
-        readonly name?: string | undefined;
-        readonly negate?: boolean | undefined;
-      }[] | undefined;
-      readonly commit_author_email?: readonly {
-        readonly operator: "starts_with" | "ends_with" | "contains" | "regex";
-        readonly pattern: string;
-        readonly name?: string | undefined;
-        readonly negate?: boolean | undefined;
-      }[] | undefined;
-      readonly committer_email?: readonly {
-        readonly operator: "starts_with" | "ends_with" | "contains" | "regex";
+        readonly operator: "contains" | "ends_with" | "regex" | "starts_with";
         readonly pattern: string;
         readonly name?: string | undefined;
         readonly negate?: boolean | undefined;
       }[] | undefined;
     } | {
       readonly name: string;
-      readonly type: "tag";
-      readonly enforcement: "disabled" | "active" | "evaluate";
+      readonly enforcement: "active" | "disabled" | "evaluate";
       readonly conditions?: {
         readonly ref_name?: {
           readonly include: readonly string[];
@@ -1437,8 +534,8 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
         readonly actor_id?: number | {
           readonly resolved: string;
         } | undefined;
-        readonly actor_type: "Integration" | "OrganizationAdmin" | "RepositoryRole" | "Team" | "DeployKey";
-        readonly bypass_mode: "always" | "pull_request" | "exempt";
+        readonly actor_type: "DeployKey" | "Integration" | "OrganizationAdmin" | "RepositoryRole" | "Team";
+        readonly bypass_mode: "always" | "exempt" | "pull_request";
       }[] | undefined;
       readonly creation?: boolean | undefined;
       readonly update?: boolean | undefined;
@@ -1447,7 +544,7 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
       readonly required_signatures?: boolean | undefined;
       readonly non_fast_forward?: boolean | undefined;
       readonly deployments?: readonly string[] | undefined;
-      readonly targets?: "default" | "all" | readonly ({
+      readonly targets?: "all" | "default" | readonly ({
         readonly include: string;
       } | {
         readonly exclude: string;
@@ -1466,25 +563,26 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
         }[];
       } | undefined;
       readonly commit_message?: readonly {
-        readonly operator: "starts_with" | "ends_with" | "contains" | "regex";
+        readonly operator: "contains" | "ends_with" | "regex" | "starts_with";
         readonly pattern: string;
         readonly name?: string | undefined;
         readonly negate?: boolean | undefined;
       }[] | undefined;
       readonly commit_author_email?: readonly {
-        readonly operator: "starts_with" | "ends_with" | "contains" | "regex";
+        readonly operator: "contains" | "ends_with" | "regex" | "starts_with";
         readonly pattern: string;
         readonly name?: string | undefined;
         readonly negate?: boolean | undefined;
       }[] | undefined;
       readonly committer_email?: readonly {
-        readonly operator: "starts_with" | "ends_with" | "contains" | "regex";
+        readonly operator: "contains" | "ends_with" | "regex" | "starts_with";
         readonly pattern: string;
         readonly name?: string | undefined;
         readonly negate?: boolean | undefined;
       }[] | undefined;
+      readonly type: "tag";
       readonly tag_name?: readonly {
-        readonly operator: "starts_with" | "ends_with" | "contains" | "regex";
+        readonly operator: "contains" | "ends_with" | "regex" | "starts_with";
         readonly pattern: string;
         readonly name?: string | undefined;
         readonly negate?: boolean | undefined;
@@ -1493,12 +591,12 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
   };
   readonly environments: {
     readonly [x: string]: {
+      readonly wait_timer?: number | undefined;
+      readonly prevent_self_review?: boolean | undefined;
       readonly reviewers?: readonly {
         readonly type: "Team" | "User";
         readonly id: number;
       }[] | undefined;
-      readonly wait_timer?: number | undefined;
-      readonly prevent_self_review?: boolean | undefined;
       readonly deployment_branches?: "all" | "protected" | readonly {
         readonly name: string;
         readonly type: "branch" | "tag";
@@ -1512,35 +610,41 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
       readonly private_vulnerability_reporting?: boolean | undefined;
     };
   };
+  readonly code_scanning: {
+    readonly [x: string]: {
+      readonly state?: "configured" | "not-configured" | undefined;
+      readonly languages?: readonly ("actions" | "c-cpp" | "csharp" | "go" | "java-kotlin" | "javascript-typescript" | "python" | "ruby" | "swift")[] | undefined;
+      readonly query_suite?: "default" | "extended" | undefined;
+      readonly threat_model?: "remote" | "remote_and_local" | undefined;
+      readonly runner_type?: "labeled" | "standard" | undefined;
+      readonly runner_label?: string | undefined;
+    };
+  };
   readonly groups: {
     readonly [x: string]: {
-      readonly code_scanning?: readonly string[] | undefined;
-      readonly owner?: string | undefined;
+      readonly repos: readonly string[];
+      readonly credentials: string;
       readonly settings?: readonly string[] | undefined;
+      readonly environments?: readonly string[] | undefined;
       readonly secrets?: {
-        readonly environments?: {
-          readonly [x: string]: readonly string[];
-        } | undefined;
         readonly actions?: readonly string[] | undefined;
         readonly dependabot?: readonly string[] | undefined;
         readonly codespaces?: readonly string[] | undefined;
+        readonly environments?: {
+          readonly [x: string]: readonly string[];
+        } | undefined;
       } | undefined;
       readonly variables?: {
+        readonly actions?: readonly string[] | undefined;
         readonly environments?: {
           readonly [x: string]: readonly string[];
         } | undefined;
-        readonly actions?: readonly string[] | undefined;
       } | undefined;
       readonly rulesets?: readonly string[] | undefined;
-      readonly environments?: readonly string[] | undefined;
       readonly security?: readonly string[] | undefined;
-      readonly repos: readonly string[];
-      readonly credentials?: string | undefined;
+      readonly code_scanning?: readonly string[] | undefined;
       readonly cleanup?: {
         readonly secrets: {
-          readonly environments: boolean | {
-            readonly preserve: readonly string[];
-          };
           readonly actions: boolean | {
             readonly preserve: readonly string[];
           };
@@ -1550,14 +654,17 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
           readonly codespaces: boolean | {
             readonly preserve: readonly string[];
           };
-        };
-        readonly variables: {
           readonly environments: boolean | {
             readonly preserve: readonly string[];
           };
+        };
+        readonly variables: {
           readonly actions: boolean | {
             readonly preserve: readonly string[];
           };
+          readonly environments: boolean | {
+            readonly preserve: readonly string[];
+          };
         };
         readonly rulesets: boolean | {
           readonly preserve: readonly string[];
@@ -1569,182 +676,47 @@ declare const ReposetsConfigFile: import("effect/Context").Tag<import("xdg-effec
     };
   };
 }>>;
-declare const ReposetsCredentialsFile: import("effect/Context").Tag<import("xdg-effect").ConfigFileService<{
-  readonly profiles: {
-    readonly [x: string]: {
-      readonly github_token: string;
-      readonly op_service_account_token?: string | undefined;
-      readonly resolve?: {
-        readonly value?: {
-          readonly [x: string]: string | {
-            readonly [x: string]: unknown;
-          };
-        } | undefined;
-        readonly file?: {
-          readonly [x: string]: string;
-        } | undefined;
-        readonly op?: {
-          readonly [x: string]: string;
-        } | undefined;
-      } | undefined;
-    };
-  };
-}>, import("xdg-effect").ConfigFileService<{
-  readonly profiles: {
-    readonly [x: string]: {
-      readonly github_token: string;
-      readonly op_service_account_token?: string | undefined;
-      readonly resolve?: {
-        readonly value?: {
-          readonly [x: string]: string | {
-            readonly [x: string]: unknown;
-          };
-        } | undefined;
-        readonly file?: {
-          readonly [x: string]: string;
-        } | undefined;
-        readonly op?: {
-          readonly [x: string]: string;
-        } | undefined;
-      } | undefined;
-    };
-  };
-}>>;
 /**
- * Validates all internal cross-references in a parsed config. Checks that
- * every group's settings, secrets, variables, rulesets, and environments
- * references point to defined top-level sections, and that environment-scoped
- * secret/variable groups reference defined environments. Collects ALL errors
- * into a single ConfigError.
+ * Service identity for the parsed `reposets.config.toml`.
+ *
+ * @public
  */
-declare function validateConfigRefs(config: Config): Effect.Effect<Config, ConfigError>;
+declare class ReposetsConfigFile extends ReposetsConfigFile_base {}
+declare const ConfigFlagNotFound_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "ConfigFlagNotFound";
+} & Readonly<A>;
 /**
- * Creates a live Layer providing both config and credentials file services.
- * When configFlag is Some and points to a directory, prepends StaticDir resolver.
- * When configFlag is Some and points to a file, prepends ExplicitPath resolver.
- * Always includes UpwardWalk + XdgConfigResolver as fallback resolvers.
- * Passes validateConfigRefs as the validate callback on the config spec.
+ * Raised when `--config` names a path that does not exist.
+ *
+ * @remarks
+ * Config discovery is best-effort by contract — every `ConfigResolver` has
+ * `never` in its error channel — so a resolver that finds nothing falls through
+ * to the next tier. That is right for a probe and wrong for an explicit request:
+ * `--config /nope.toml` would otherwise load the XDG config instead. The
+ * distinction is enforced here rather than pushed into the resolver contract.
+ *
+ * @public
  */
-declare function makeConfigFilesLive(configFlag: Option.Option<string>): import("effect/Layer").Layer<import("xdg-effect").ConfigFileService<any> | import("xdg-effect").AppDirs | import("xdg-effect").XdgResolver, never, import("@effect/platform/FileSystem").FileSystem>;
+declare class ConfigFlagNotFound extends ConfigFlagNotFound_base<{
+  readonly path: string;
+}> {
+  /**
+   * @remarks
+   * Without this, the class renders as a bare `ConfigFlagNotFound:` and the
+   * `path` never reaches the log line. The kit does the same on its own errors.
+   */
+  get message(): string;
+}
 /**
- * Default ConfigFiles layer with no --config flag override.
- * Used by CLI entrypoint when no flag is provided.
+ * Builds the config-file layer for one invocation's `--config` flag.
+ *
+ * @remarks
+ * Mints a fresh layer per call, so bind the result once per run rather than
+ * inlining it at two provide sites.
+ *
+ * @public
  */
-declare const ConfigFilesLive: import("effect/Layer").Layer<import("xdg-effect").ConfigFileService<any> | import("xdg-effect").AppDirs | import("xdg-effect").XdgResolver, never, import("@effect/platform/FileSystem").FileSystem>;
-//#endregion
-//#region src/services/OnePasswordClient.d.ts
-interface OnePasswordClientService {
-  readonly resolve: (reference: string, serviceAccountToken: string) => Effect.Effect<string, OnePasswordError>;
-}
-declare const OnePasswordClient_base: Context.TagClass<OnePasswordClient, "OnePasswordClient", OnePasswordClientService>;
-declare class OnePasswordClient extends OnePasswordClient_base {}
-declare const OnePasswordClientLive: Layer.Layer<OnePasswordClient, never, never>;
-declare function OnePasswordClientTest(stubs: Record<string, string>): Layer.Layer<OnePasswordClient>;
-//#endregion
-//#region src/services/CredentialResolver.d.ts
-interface CredentialResolverService {
-  readonly resolveAll: (profile: CredentialProfile, basePath: string) => Effect.Effect<Map<string, string>, ResolveError>;
-}
-declare const CredentialResolver_base: Context.TagClass<CredentialResolver, "CredentialResolver", CredentialResolverService>;
-declare class CredentialResolver extends CredentialResolver_base {}
-declare const CredentialResolverLive: Layer.Layer<CredentialResolver, never, OnePasswordClient>;
-//#endregion
-//#region src/services/GitHubClient.d.ts
-type SecretScope = "actions" | "dependabot" | "codespaces";
-interface SecretInfo {
-  name: string;
-}
-interface VariableInfo {
-  name: string;
-}
-interface RulesetInfo {
-  name: string;
-  id: number;
-  source_type?: string | undefined;
-}
-interface EnvironmentInfo {
-  name: string;
-}
-type OwnerType = "User" | "Organization";
-interface GitHubClientService {
-  readonly getOwnerType: (owner: string) => Effect.Effect<OwnerType, GitHubApiError>;
-  readonly syncSecret: (owner: string, repo: string, name: string, value: string, scope: SecretScope) => Effect.Effect<void, GitHubApiError>;
-  readonly syncVariable: (owner: string, repo: string, name: string, value: string) => Effect.Effect<void, GitHubApiError>;
-  readonly syncSettings: (owner: string, repo: string, settings: Record<string, unknown>) => Effect.Effect<void, GitHubApiError>;
-  readonly syncRuleset: (owner: string, repo: string, name: string, payload: RulesetPayload) => Effect.Effect<void, GitHubApiError>;
-  readonly listSecrets: (owner: string, repo: string, scope: SecretScope) => Effect.Effect<SecretInfo[], GitHubApiError>;
-  readonly listVariables: (owner: string, repo: string) => Effect.Effect<VariableInfo[], GitHubApiError>;
-  readonly listRulesets: (owner: string, repo: string) => Effect.Effect<RulesetInfo[], GitHubApiError>;
-  readonly deleteSecret: (owner: string, repo: string, name: string, scope: SecretScope) => Effect.Effect<void, GitHubApiError>;
-  readonly deleteVariable: (owner: string, repo: string, name: string) => Effect.Effect<void, GitHubApiError>;
-  readonly deleteRuleset: (owner: string, repo: string, rulesetId: number) => Effect.Effect<void, GitHubApiError>;
-  readonly syncEnvironment: (owner: string, repo: string, name: string, config: Record<string, unknown>) => Effect.Effect<void, GitHubApiError>;
-  readonly syncEnvironmentSecret: (owner: string, repo: string, envName: string, name: string, value: string) => Effect.Effect<void, GitHubApiError>;
-  readonly syncEnvironmentVariable: (owner: string, repo: string, envName: string, name: string, value: string) => Effect.Effect<void, GitHubApiError>;
-  readonly listEnvironments: (owner: string, repo: string) => Effect.Effect<EnvironmentInfo[], GitHubApiError>;
-  readonly listEnvironmentSecrets: (owner: string, repo: string, envName: string) => Effect.Effect<SecretInfo[], GitHubApiError>;
-  readonly listEnvironmentVariables: (owner: string, repo: string, envName: string) => Effect.Effect<VariableInfo[], GitHubApiError>;
-  readonly deleteEnvironment: (owner: string, repo: string, name: string) => Effect.Effect<void, GitHubApiError>;
-  readonly deleteEnvironmentSecret: (owner: string, repo: string, envName: string, name: string) => Effect.Effect<void, GitHubApiError>;
-  readonly deleteEnvironmentVariable: (owner: string, repo: string, envName: string, name: string) => Effect.Effect<void, GitHubApiError>;
-  readonly getVulnerabilityAlerts: (owner: string, repo: string) => Effect.Effect<boolean, GitHubApiError>;
-  readonly setVulnerabilityAlerts: (owner: string, repo: string, enabled: boolean) => Effect.Effect<void, GitHubApiError>;
-  readonly getAutomatedSecurityFixes: (owner: string, repo: string) => Effect.Effect<boolean, GitHubApiError>;
-  readonly setAutomatedSecurityFixes: (owner: string, repo: string, enabled: boolean) => Effect.Effect<void, GitHubApiError>;
-  readonly getPrivateVulnerabilityReporting: (owner: string, repo: string) => Effect.Effect<boolean, GitHubApiError>;
-  readonly setPrivateVulnerabilityReporting: (owner: string, repo: string, enabled: boolean) => Effect.Effect<void, GitHubApiError>;
-  readonly updateCodeScanningDefaultSetup: (owner: string, repo: string, config: CodeScanningGroup) => Effect.Effect<void, GitHubApiError>;
-  readonly listRepoLanguages: (owner: string, repo: string) => Effect.Effect<ReadonlyArray<string>, GitHubApiError>;
-  readonly resolveTeamId: (org: string, slug: string) => Effect.Effect<number, GitHubApiError>;
-  readonly resolveRoleId: (org: string, name: string) => Effect.Effect<number, GitHubApiError>;
-}
-declare const GitHubClient_base: Context.TagClass<GitHubClient, "GitHubClient", GitHubClientService>;
-declare class GitHubClient extends GitHubClient_base {}
-declare function GitHubClientLive(token: string): Layer.Layer<GitHubClient>;
-interface RecordedCall {
-  method: string;
-  args: Record<string, unknown>;
-}
-declare function GitHubClientTest(): {
-  layer: Layer.Layer<GitHubClient>;
-  calls: () => RecordedCall[];
-};
-//#endregion
-//#region src/services/SyncLogger.d.ts
-interface SyncLoggerService {
-  readonly groupStart: (name: string, repoCount: number) => Effect.Effect<void>;
-  readonly repoStart: (owner: string, repo: string) => Effect.Effect<void>;
-  readonly repoSkip: (owner: string, repo: string, reason: string) => Effect.Effect<void>;
-  readonly syncSummary: (resource: "secret" | "variable" | "ruleset" | "environment" | "security feature" | "code scanning", count: number, detail: string) => Effect.Effect<void>;
-  readonly settingsApplied: () => Effect.Effect<void>;
-  readonly cleanupSummary: (resource: string, count: number, names: string[]) => Effect.Effect<void>;
-  readonly syncOperation: (verb: "sync" | "apply" | "delete" | "skip", resource: string, name: string, detail?: string, source?: string) => Effect.Effect<void>;
-  readonly syncError: (context: string, message: string) => Effect.Effect<void>;
-  readonly finish: () => Effect.Effect<void>;
-}
-declare const SyncLogger_base: Context.TagClass<SyncLogger, "SyncLogger", SyncLoggerService>;
-declare class SyncLogger extends SyncLogger_base {}
-interface SyncLoggerConfig {
-  readonly dryRun: boolean;
-  readonly logLevel: LogLevel;
-  readonly output?: Ref.Ref<string[]>;
-}
-declare function SyncLoggerLive(config: SyncLoggerConfig): Layer.Layer<SyncLogger>;
-//#endregion
-//#region src/services/SyncEngine.d.ts
-interface SyncOptions {
-  readonly dryRun: boolean;
-  readonly noCleanup: boolean;
-  readonly groupFilter?: string | undefined;
-  readonly repoFilter?: string | undefined;
-  readonly configDir: string;
-}
-interface SyncEngineService {
-  readonly syncAll: (config: Config, credentials: Credentials, options: SyncOptions) => Effect.Effect<void, SyncError>;
-}
-declare const SyncEngine_base: Context.TagClass<SyncEngine, "SyncEngine", SyncEngineService>;
-declare class SyncEngine extends SyncEngine_base {}
-declare const SyncEngineLive: Layer.Layer<SyncEngine, never, GitHubClient | SyncLogger | CredentialResolver>;
+declare const makeConfigFilesLive: (configFlag: string | undefined) => Layer.Layer<ReposetsConfigFile, ConfigFlagNotFound, FileSystem.FileSystem | Path.Path | AppDirs | Xdg>;
 //#endregion
-export { AppDirs, type BypassActor, BypassActorSchema, CONFIG_FILENAME, CREDENTIALS_FILENAME, type Cleanup, CleanupSchema, type CleanupScope, CleanupScopeSchema, type Config, ConfigFile, ConfigFilesLive, ConfigSchema, type CredentialProfile, CredentialProfileSchema, CredentialResolver, CredentialResolverLive, type Credentials, CredentialsSchema, GitHubApiError, GitHubClient, GitHubClientLive, GitHubClientTest, type Group, GroupSchema, type LogLevel, LogLevelSchema, OnePasswordClient, OnePasswordClientLive, OnePasswordClientTest, OnePasswordError, type RecordedCall, ReposetsConfigFile, ReposetsCredentialsFile, ResolveError, type ResolveSection, ResolveSectionSchema, type ResolvedRef, ResolvedRefSchema, type Ruleset, type RulesetPayload, RulesetSchema, type SecretGroup, SecretGroupSchema, SyncEngine, SyncEngineLive, SyncError, SyncLogger, type SyncLoggerConfig, SyncLoggerLive, type VariableGroup, VariableGroupSchema, XdgConfigError, buildRulesetPayload, encryptSecret, makeConfigFilesLive, validateConfigRefs };
+export { CONFIG_FILENAME, type Config, ConfigFlagNotFound, ConfigSchema, ReposetsConfigFile, makeConfigFilesLive };
 //# sourceMappingURL=index.d.ts.map