reposets 1.0.21 → 2.0.0

package/README.md

@@ -99,7 +99,7 @@ The owner is not in the config. It belongs to the credential profile, which decl
 | `reposets nuke` | Delete every local reposets file. Nothing on GitHub is touched |
 | `reposets credentials` | Manage credential profiles: `create`, `list`, `delete` |
 
-Every command accepts `--config` and the `--log-level` filter Effect core provides. `--log-level error` is quiet on success and loud on failure; `--log-level none` is the CI form.
+Every command accepts `--config`. Command output goes to stdout and diagnostics and errors to stderr, so `reposets sync > /dev/null` is quiet on success and loud on failure. Usage errors exit `64`; findings exit `1`.
 
 ## Configuration
 

package/bin/reposets.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { CredentialsFilesLive } from "../services/ConfigFiles.js";
-import { formatSchemaIssue } from "../lib/schema-issues.js";
+import { Invocation } from "../services/Invocation.js";
 import { migrations } from "../store/migrations.js";
 import { SyncJournalLive } from "../store/SyncJournal.js";
 import { credentialsCommand } from "../cli/commands/credentials.js";
@@ -13,14 +13,26 @@ import { initCommand } from "../cli/commands/init.js";
 import { listCommand } from "../cli/commands/list.js";
 import { nukeCommand } from "../cli/commands/nuke.js";
 import { validateCommand } from "../cli/commands/validate.js";
-import { CliLoggerLive } from "../cli/logger.js";
 import { Effect, Layer } from "effect";
 import { App } from "@effected/app";
 import { NodeRuntime, NodeServices } from "@effect/platform-node";
+import { CliColor, CliRuntime, ConfigIssueRenderer } from "@effected/cli";
 import { Command } from "effect/unstable/cli";
 
 //#region src/cli/index.ts
 /**
+* The build's version.
+*
+* @remarks
+* The bundler substitutes `process.env.__PACKAGE_VERSION__` with a literal at
+* build time, so this is not a runtime environment read. Only the exact
+* `process.env.__PACKAGE_VERSION__` spelling is substituted — a destructured
+* `env.__PACKAGE_VERSION__` is not, which is why `doctor` printed
+* `0.0.0 (dev build)` from every build until the version was threaded down
+* from here through {@link Invocation}.
+*/
+const VERSION = "2.0.0";
+/**
 * The application control plane.
 *
 * @remarks
@@ -35,6 +47,21 @@ const AppLive = App.layer({
 	store: { migrations }
 });
 /**
+* Everything this module reads from `process`, handed down as plain values.
+*
+* @remarks
+* This file is the only one under `src/` allowed to read `process`. Commands and
+* services require {@link Invocation} instead, so a test can hand them a
+* different working directory. Two things are deliberately not here: the
+* environment, which every reader takes through Effect's `Config` (the default
+* `ConfigProvider` reads the process environment, so nothing here has to), and
+* whether stdin is a terminal, which `nuke` asks core's `Stdio.stdinIsTerminal`.
+*/
+const InvocationLive = Invocation.layer({
+	cwd: process.cwd(),
+	version: VERSION
+});
+/**
 * The root command.
 *
 * @remarks
@@ -53,33 +80,55 @@ const cli = Command.make("reposets", {}, () => Effect.void).pipe(Command.withDes
 	historyCommand,
 	credentialsCommand
 ]), Command.provide(ConfigLive), Command.provide(CredentialsFilesLive), Command.provide(SyncJournalLive), Command.withGlobalFlags([ConfigFlag]));
-const MainLive = Layer.mergeAll(Layer.provideMerge(AppLive, NodeServices.layer), CliLoggerLive);
 /**
-* Report a failure through the CLI logger and exit non-zero.
+* The platform: Node's services, the application control plane over them, the
+* invocation facts, and one colour-aware help/error formatter.
 *
 * @remarks
-* `NodeRuntime.runMain` reports an unhandled failure with Effect's *default*
-* logger, which sits outside the layers the program was provided — so a failure
-* escaping to it prints `[23:05:56] ERROR (#2): …` **on stdout**, in the format
-* {@link CliLoggerLive} exists to replace, on the stream errors must not use.
+* `provideMerge` rather than `provide` at each step, because commands require
+* the platform services (`FileSystem`, `Path`, `Stdio`) directly as well as
+* through `App`. `CliColor.formatterLayer()` needs `Stdio` to decide whether
+* colour is on, so it sits above `NodeServices.layer` rather than beside it.
+*/
+const PlatformLive = Layer.mergeAll(AppLive, CliColor.formatterLayer(), InvocationLive).pipe(Layer.provideMerge(NodeServices.layer));
+/** Whether a failure is a tagged error of a given tag. */
+const isTagged = (error, tag) => typeof error === "object" && error !== null && "_tag" in error && error._tag === tag;
+/**
+* Render a failure that escaped a command, one line at a time, to stderr.
+*
+* @remarks
+* `CliRuntime.main` hands this every failure it does not already know how to
+* skip — a usage error `Command.runWith` printed itself never reaches it — and
+* logs each returned line through `CliLogger` before exiting `1`.
+*
+* A config that fails to decode arrives here as a `ConfigValidationError`,
+* whose message names the file and stops there. The structured cause is on its
+* `issue`, which `ConfigIssueRenderer` turns into `unknown key at …` lines, so
+* the failure describes itself rather than telling a CI log to go run another
+* command. The `doctor` pointer stays only when something was misspelled — a
+* missing key has no near-match to suggest, and pointing a confused user at a
+* command that cannot help them is worse than saying nothing.
 *
-* Catching here keeps the failure inside the logger's scope. The exit code is
-* then ours to set, since the effect now succeeds.
+* Any other failure that carries a `cause` gets it printed on a second line. A
+* TOML syntax error is a `ConfigCodecError` whose own message is the bare
+* "toml parse failed" — the line and column live on the cause, and printing it
+* is the difference between "your config is broken somewhere" and "1:9,
+* expected ] to close the table header".
 */
-const reportAndExit = (error) => Effect.gen(function* () {
-	yield* Effect.logError(String(error));
+const render = (error) => {
+	const lines = [String(error)];
 	if (isTagged(error, "ConfigValidationError")) {
-		const lines = formatSchemaIssue(error.issue);
-		for (const line of lines) yield* Effect.logError(`  ${line}`);
-		if (lines.some((line) => line.startsWith("unknown key"))) yield* Effect.logError("  Run 'reposets doctor' for suggested spellings.");
-	}
-	yield* Effect.sync(() => {
-		process.exitCode = 1;
-	});
-});
-/** Whether a caught value is a tagged error of a given tag. */
-const isTagged = (error, tag) => typeof error === "object" && error !== null && "_tag" in error && error._tag === tag;
-cli.pipe(Command.run({ version: "1.0.21" }), Effect.catch(reportAndExit), Effect.provide(MainLive), NodeRuntime.runMain);
+		const issues = ConfigIssueRenderer.render(error);
+		lines.push(...issues.map((line) => `  ${line}`));
+		if (issues.some((line) => line.startsWith("unknown key"))) lines.push("  Run 'reposets doctor' for suggested spellings.");
+	} else if (typeof error === "object" && error !== null && "cause" in error && error.cause !== void 0) lines.push(`  ${String(error.cause)}`);
+	return lines;
+};
+NodeRuntime.runMain(CliRuntime.main(Command.run(cli, { version: VERSION }), {
+	platform: PlatformLive,
+	render,
+	helpOnUsageError: "stderr"
+}));
 
 //#endregion
 export {  };

package/cli/commands/credentials.js

@@ -1,7 +1,7 @@
 import { profileOwner } from "../../schemas/credentials.js";
 import { ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
-import { Effect, Option } from "effect";
-import { Command, Flag } from "effect/unstable/cli";
+import { Console, Effect, Option } from "effect";
+import { CliError, Command, Flag } from "effect/unstable/cli";
 import { AppDirs } from "@effected/xdg";
 
 //#region src/cli/commands/credentials.ts
@@ -50,6 +50,16 @@ const saveWhereRead = (file, value) => Effect.gen(function* () {
 	yield* file.write(value, existing.path);
 	return existing.path;
 });
+/**
+* Refuse an invocation the user got wrong.
+*
+* @remarks
+* Every refusal in this module is a usage error — the flags asked for
+* something invalid — so it fails with `CliError.UserError` and exits 64.
+* `Command.runWith` prints the message once, on stderr. The messages never
+* echo a supplied value, for the reason given in {@link createHandler}.
+*/
+const refuse = (message) => Effect.fail(new CliError.UserError({ cause: message }));
 /** How a profile's `github_token` is sourced, for display. Never a value. */
 const describeSource = (source) => "op" in source ? `op ${source.op}` : `env ${source.env}`;
 /**
@@ -72,35 +82,14 @@ const createHandler = (input) => Effect.gen(function* () {
 	const { profile, op, env, username, org } = input;
 	yield* (yield* AppDirs).ensureConfig;
 	const credentialsFile = yield* ReposetsCredentialsFile;
-	if (op !== void 0 && env !== void 0) {
-		yield* Effect.logError("Provide exactly one of --op or --env, not both.");
-		return;
-	}
-	if (op === void 0 && env === void 0) {
-		yield* Effect.logError("Provide a reference: --op \"op://Vault/item/field\" or --env REPOSETS_GITHUB_TOKEN. A token value is never accepted.");
-		return;
-	}
-	if (op !== void 0 && !op.startsWith("op://")) {
-		yield* Effect.logError("--op must be a 1Password reference starting with \"op://\". Value not echoed.");
-		return;
-	}
-	if (looksLikeSecret(op ?? env ?? "")) {
-		yield* Effect.logError("That looks like a credential value, not a reference. This command stores references only — pass --op \"op://Vault/item/field\" or --env VAR_NAME. Value not echoed.");
-		return;
-	}
-	if (username !== void 0 && org !== void 0) {
-		yield* Effect.logError("Provide exactly one of --username or --org, not both.");
-		return;
-	}
-	if (username === void 0 && org === void 0) {
-		yield* Effect.logError("Provide --username <you> for a personal account or --org <name> for an organization. It is what the profile acts as, and it decides which settings are even valid.");
-		return;
-	}
+	if (op !== void 0 && env !== void 0) return yield* refuse("Provide exactly one of --op or --env, not both.");
+	if (op === void 0 && env === void 0) return yield* refuse("Provide a reference: --op \"op://Vault/item/field\" or --env REPOSETS_GITHUB_TOKEN. A token value is never accepted.");
+	if (op !== void 0 && !op.startsWith("op://")) return yield* refuse("--op must be a 1Password reference starting with \"op://\". Value not echoed.");
+	if (looksLikeSecret(op ?? env ?? "")) return yield* refuse("That looks like a credential value, not a reference. This command stores references only — pass --op \"op://Vault/item/field\" or --env VAR_NAME. Value not echoed.");
+	if (username !== void 0 && org !== void 0) return yield* refuse("Provide exactly one of --username or --org, not both.");
+	if (username === void 0 && org === void 0) return yield* refuse("Provide --username <you> for a personal account or --org <name> for an organization. It is what the profile acts as, and it decides which settings are even valid.");
 	const existing = yield* credentialsFile.loadOrDefault(EMPTY);
-	if (existing.profiles[profile] !== void 0) {
-		yield* Effect.logError(`Profile '${profile}' already exists. Delete it first.`);
-		return;
-	}
+	if (existing.profiles[profile] !== void 0) return yield* refuse(`Profile '${profile}' already exists. Delete it first.`);
 	const github_token = op !== void 0 ? { op } : { env };
 	const actsAs = username !== void 0 ? {
 		username,
@@ -113,7 +102,7 @@ const createHandler = (input) => Effect.gen(function* () {
 		...existing.profiles,
 		[profile]: actsAs
 	} });
-	yield* Effect.log(`Created profile '${profile}' (${username !== void 0 ? `username: ${username}` : `org: ${org}`}, github_token: ${describeSource(github_token)}) in ${path}.`);
+	yield* Console.log(`Created profile '${profile}' (${username !== void 0 ? `username: ${username}` : `org: ${org}`}, github_token: ${describeSource(github_token)}) in ${path}.`);
 });
 const createCommand = Command.make("create", {
 	profile: profileFlag,
@@ -141,14 +130,14 @@ const createCommand = Command.make("create", {
 const listHandler = Effect.gen(function* () {
 	const credentials = yield* (yield* ReposetsCredentialsFile).loadOrDefault(EMPTY);
 	if (Object.keys(credentials.profiles).length === 0) {
-		yield* Effect.log("No credential profiles configured.");
+		yield* Console.log("No credential profiles configured.");
 		return;
 	}
 	for (const [name, profile] of Object.entries(credentials.profiles)) {
 		const { owner, ownerType } = profileOwner(profile);
-		yield* Effect.log(`[${name}]`);
-		yield* Effect.log(`  acts as: ${owner} (${ownerType === "User" ? "user" : "organization"})`);
-		yield* Effect.log(`  github_token: ${describeSource(profile.github_token)}`);
+		yield* Console.log(`[${name}]`);
+		yield* Console.log(`  acts as: ${owner} (${ownerType === "User" ? "user" : "organization"})`);
+		yield* Console.log(`  github_token: ${describeSource(profile.github_token)}`);
 		for (const kind of [
 			"op",
 			"env",
@@ -156,9 +145,9 @@ const listHandler = Effect.gen(function* () {
 		]) {
 			const entries = profile.resolve?.[kind];
 			if (entries === void 0) continue;
-			for (const [label, reference] of Object.entries(entries)) yield* Effect.log(`  resolve.${kind}.${label}: ${reference}`);
+			for (const [label, reference] of Object.entries(entries)) yield* Console.log(`  resolve.${kind}.${label}: ${reference}`);
 		}
-		yield* Effect.log("");
+		yield* Console.log("");
 	}
 });
 const listCommand = Command.make("list", {}, () => listHandler).pipe(Command.withDescription("List credential profiles and the references they hold"));
@@ -171,13 +160,10 @@ const deleteHandler = (profile) => Effect.gen(function* () {
 	yield* (yield* AppDirs).ensureConfig;
 	const credentialsFile = yield* ReposetsCredentialsFile;
 	const credentials = yield* credentialsFile.loadOrDefault(EMPTY);
-	if (credentials.profiles[profile] === void 0) {
-		yield* Effect.logError(`Profile '${profile}' not found.`);
-		return;
-	}
+	if (credentials.profiles[profile] === void 0) return yield* refuse(`Profile '${profile}' not found.`);
 	const { [profile]: _removed, ...remaining } = credentials.profiles;
 	const path = yield* saveWhereRead(credentialsFile, { profiles: remaining });
-	yield* Effect.log(`Deleted profile '${profile}' from ${path}.`);
+	yield* Console.log(`Deleted profile '${profile}' from ${path}.`);
 });
 const deleteCommand = Command.make("delete", { profile: profileFlag }, ({ profile }) => deleteHandler(profile)).pipe(Command.withDescription("Remove a credential profile"));
 /**

package/cli/commands/doctor.js

@@ -1,14 +1,14 @@
 import { SettingsGroupSchema } from "../../schemas/config.js";
 import { profileOwner } from "../../schemas/credentials.js";
 import { CONFIG_FILENAME, CREDENTIALS_FILENAME, ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
-import { formatSchemaIssue } from "../../lib/schema-issues.js";
+import { Invocation } from "../../services/Invocation.js";
 import { OP_SERVICE_ACCOUNT_TOKEN, OnePasswordClientLive } from "../../services/OnePasswordClient.js";
 import { CredentialResolver, CredentialResolverLive } from "../../services/CredentialResolver.js";
 import { ConfigFlag } from "../flags.js";
-import { Effect, FileSystem, Layer, Option, Path, Result } from "effect";
+import { Config, Console, Effect, FileSystem, Layer, Option, Path, Result } from "effect";
+import { SchemaIssueRenderer } from "@effected/cli";
 import { Command } from "effect/unstable/cli";
 import { AppDirs } from "@effected/xdg";
-import { cwd, env } from "node:process";
 import { GitHubClient } from "@effected/github";
 import { Toml } from "@effected/toml";
 
@@ -51,7 +51,7 @@ const KNOWN_GROUP_KEYS = /* @__PURE__ */ new Set([
 const REMOVED_KEYS = {
 	owner: "removed in 1.0 — the owner now belongs to the credential profile, which declares `username` or `org`",
 	"owner (in groups)": "removed in 1.0 — a group's owner comes from the profile named by its `credentials`, so a group cannot override it",
-	log_level: "removed in 1.0 — output is one level; use --debug for diagnostics, or core's --log-level to filter by severity"
+	log_level: "removed in 1.0 — output is one level; use --debug for diagnostics, or redirect stdout to quieten a run"
 };
 /**
 * The settings fields the schema names, derived rather than listed.
@@ -202,10 +202,10 @@ const findClosestMatch = (key, known) => {
 * `appDirs.dirs.config` rather than `ensureConfig`: the latter *creates* the
 * directory, and a read-only diagnostic must not.
 */
-const locateConfig = (fs, path, appDirs, configFlag) => Effect.gen(function* () {
+const locateConfig = (fs, path, appDirs, configFlag, cwd) => Effect.gen(function* () {
 	const candidates = [];
 	if (configFlag !== void 0) candidates.push(configFlag, path.join(configFlag, CONFIG_FILENAME));
-	let dir = cwd();
+	let dir = cwd;
 	for (;;) {
 		candidates.push(path.join(dir, CONFIG_FILENAME));
 		const parent = path.dirname(dir);
@@ -233,6 +233,12 @@ const isRecord = (value) => typeof value === "object" && value !== null && !Arra
 * *names* — and whether the 1Password service account variable is present. It
 * never resolves a reference, so there is no value in scope to leak.
 *
+* The report — failing sections included — is the command's output and goes to
+* stdout in one piece, so `reposets doctor > report.txt` captures all of it.
+* Only the three early stops (no config, unreadable, unparseable) are
+* diagnostics on stderr. `doctor` always exits 0: it describes, it does not
+* gate — `validate` is the gate.
+*
 * @public
 */
 /**
@@ -280,16 +286,17 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const appDirs = yield* AppDirs;
+	const invocation = yield* Invocation;
 	const discovered = yield* configFile.discover.pipe(Effect.result);
 	const sources = discovered._tag === "Success" ? discovered.success : [];
 	const schemaValid = discovered._tag === "Success" && sources.length > 0;
 	const validationIssue = discovered._tag === "Failure" ? discovered.failure.issue : void 0;
-	const configPath = sources[0]?.path ?? (yield* locateConfig(fs, path, appDirs, configFlag));
+	const configPath = sources[0]?.path ?? (yield* locateConfig(fs, path, appDirs, configFlag, invocation.cwd));
 	if (configPath === void 0) {
 		yield* Effect.logError("No config found. Run 'reposets init' to create one.");
 		return;
 	}
-	yield* Effect.log(`Config: ${configPath}`);
+	yield* Console.log(`Config: ${configPath}`);
 	const text = yield* fs.readFileString(configPath).pipe(Effect.option);
 	if (text._tag === "None") {
 		yield* Effect.logError(`Could not read ${configPath}`);
@@ -308,13 +315,13 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 			if (known.has(key)) continue;
 			const removedFrom = REMOVED_KEYS[where === "" ? key : `${key} (in groups)`] ?? REMOVED_KEYS[key];
 			if (removedFrom !== void 0) {
-				yield* Effect.log(`Warning: '${key}'${where} ${removedFrom}`);
+				yield* Console.log(`Warning: '${key}'${where} ${removedFrom}`);
 				warnings += 1;
 				continue;
 			}
 			const suggestion = findClosestMatch(key, known);
 			const hint = suggestion === void 0 ? "" : ` — did you mean '${suggestion}'?`;
-			yield* Effect.log(`Warning: unknown key '${key}'${where}${hint}`);
+			yield* Console.log(`Warning: unknown key '${key}'${where}${hint}`);
 			warnings += 1;
 		}
 	});
@@ -326,7 +333,7 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 			if (KNOWN_SETTINGS_FIELDS.has(field)) continue;
 			const suggestion = findClosestMatch(field, KNOWN_SETTINGS_FIELDS);
 			const hint = suggestion === void 0 ? " — it will be sent to GitHub as-is, which ignores fields it does not recognise" : ` — did you mean '${suggestion}'?`;
-			yield* Effect.log(`Warning: unrecognised setting '${field}' in settings.${groupName}${hint}`);
+			yield* Console.log(`Warning: unrecognised setting '${field}' in settings.${groupName}${hint}`);
 			warnings += 1;
 		}
 	}
@@ -341,21 +348,21 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 		yield* checkKeys(cleanup.secrets, KNOWN_CLEANUP_SECRETS_KEYS, ` in ${prefix}.secrets`);
 		yield* checkKeys(cleanup.variables, KNOWN_CLEANUP_VARIABLES_KEYS, ` in ${prefix}.variables`);
 	}
-	if (schemaValid) yield* Effect.log("Schema validation: passed");
+	if (schemaValid) yield* Console.log("Schema validation: passed");
 	else {
-		yield* Effect.logError("Schema validation: FAILED — these values are rejected, not ignored");
-		for (const line of formatSchemaIssue(validationIssue)) yield* Effect.logError(`  ${line}`);
+		yield* Console.log("Schema validation: FAILED — these values are rejected, not ignored");
+		for (const line of SchemaIssueRenderer.render(validationIssue)) yield* Console.log(`  ${line}`);
 	}
-	yield* Effect.log("");
+	yield* Console.log("");
 	const loaded = yield* credentialsFile.loadOrDefault({ profiles: {} }).pipe(Effect.result);
 	const credentials = loaded._tag === "Success" ? loaded.success : { profiles: {} };
 	const profileNames = Object.keys(credentials.profiles);
 	if (loaded._tag === "Failure") {
-		yield* Effect.logError(`Credentials: FAILED to load — ${String(loaded.failure.message ?? loaded.failure)}`);
-		yield* Effect.logError("  Unknown keys are rejected. `op_service_account_token` was removed — that token now comes from OP_SERVICE_ACCOUNT_TOKEN in the environment.");
-	} else if (profileNames.length === 0) yield* Effect.log("Credentials: no profiles configured");
+		yield* Console.log(`Credentials: FAILED to load — ${String(loaded.failure.message ?? loaded.failure)}`);
+		yield* Console.log("  Unknown keys are rejected. `op_service_account_token` was removed — that token now comes from OP_SERVICE_ACCOUNT_TOKEN in the environment.");
+	} else if (profileNames.length === 0) yield* Console.log("Credentials: no profiles configured");
 	else {
-		yield* Effect.log(`Credentials: ${profileNames.length} profile(s)`);
+		yield* Console.log(`Credentials: ${profileNames.length} profile(s)`);
 		let usesOnePassword = false;
 		for (const [name, profile] of Object.entries(credentials.profiles)) {
 			const token = "op" in profile.github_token ? `op ${profile.github_token.op}` : `env ${profile.github_token.env}`;
@@ -373,45 +380,45 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 				}
 			}
 			const resolveSummary = sections.length === 0 ? "" : `, resolve ${sections.join(" ")}`;
-			yield* Effect.log(`  [${name}] github_token: ${token}${resolveSummary}`);
+			yield* Console.log(`  [${name}] github_token: ${token}${resolveSummary}`);
 		}
-		const hasServiceAccount = env["OP_SERVICE_ACCOUNT_TOKEN"] !== void 0 && env["OP_SERVICE_ACCOUNT_TOKEN"] !== "";
-		if (usesOnePassword) yield* Effect.log(hasServiceAccount ? `  ${OP_SERVICE_ACCOUNT_TOKEN}: set` : `  ${OP_SERVICE_ACCOUNT_TOKEN}: NOT SET — op:// references cannot be resolved`);
+		const hasServiceAccount = Option.isSome(yield* Config.option(Config.String(OP_SERVICE_ACCOUNT_TOKEN)).pipe(Effect.orElseSucceed(() => Option.none())));
+		if (usesOnePassword) yield* Console.log(hasServiceAccount ? `  ${OP_SERVICE_ACCOUNT_TOKEN}: set` : `  ${OP_SERVICE_ACCOUNT_TOKEN}: NOT SET — op:// references cannot be resolved`);
 	}
-	yield* Effect.log("");
-	yield* Effect.log(`Version: ${env.__PACKAGE_VERSION__ ?? "0.0.0 (dev build)"}`);
+	yield* Console.log("");
+	yield* Console.log(`Version: ${invocation.version}`);
 	const credentialDiscovery = yield* credentialsFile.discover.pipe(Effect.result);
 	const credentialSources = credentialDiscovery._tag === "Success" ? credentialDiscovery.success : [];
 	const credentialsLine = credentialDiscovery._tag === "Failure" ? "(failed to load — the error above names the file)" : credentialSources.length === 0 ? `${path.join(appDirs.dirs.config, CREDENTIALS_FILENAME)} (not created yet)` : credentialSources[0]?.path ?? "";
-	yield* Effect.log(`Credentials file: ${credentialsLine}`);
-	yield* Effect.log(`State database: ${path.join(appDirs.dirs.state, "store.db")}`);
-	yield* Effect.log("");
+	yield* Console.log(`Credentials file: ${credentialsLine}`);
+	yield* Console.log(`State database: ${path.join(appDirs.dirs.state, "store.db")}`);
+	yield* Console.log("");
 	for (const [name, profile] of Object.entries(credentials.profiles)) {
 		const resolverLayer = Layer.provide(CredentialResolverLive, OnePasswordClientLive);
 		const resolved = yield* Effect.gen(function* () {
 			return yield* (yield* CredentialResolver).resolveGitHubToken(profile);
 		}).pipe(Effect.provide(resolverLayer), Effect.result);
 		if (resolved._tag === "Failure") {
-			yield* Effect.logError(`Token [${name}]: could not resolve — ${String(resolved.failure)}`);
+			yield* Console.log(`Token [${name}]: could not resolve — ${String(resolved.failure)}`);
 			continue;
 		}
 		const identity = yield* Effect.gen(function* () {
 			return yield* (yield* GitHubClient).request("GET /user", {});
 		}).pipe(Effect.provide(GitHubClient.layerFromToken({ token: resolved.success })), Effect.result);
 		if (identity._tag !== "Success") {
-			yield* Effect.logError(`Token [${name}]: resolved but REJECTED by GitHub — ${String(identity.failure)}`);
+			yield* Console.log(`Token [${name}]: resolved but REJECTED by GitHub — ${String(identity.failure)}`);
 			continue;
 		}
 		const line = describeIdentity(name, profile, identity.success.login);
-		yield* line.ok ? Effect.log(line.text) : Effect.logError(line.text);
+		yield* Console.log(line.text);
 	}
-	yield* Effect.log("");
-	yield* Effect.log("Required fine-grained token permissions:");
-	for (const [scope, permission, why] of REQUIRED_PERMISSIONS) yield* Effect.log(`  ${scope} > ${permission} — ${why}`);
-	yield* Effect.log("  (Metadata: Read is mandatory and granted automatically)");
-	yield* Effect.log("  These are NOT verified — GitHub does not expose a fine-grained token's own scopes.");
-	yield* Effect.log("");
-	yield* Effect.log(warnings === 0 ? "No unknown keys detected." : `${warnings} warning(s) found.`);
+	yield* Console.log("");
+	yield* Console.log("Required fine-grained token permissions:");
+	for (const [scope, permission, why] of REQUIRED_PERMISSIONS) yield* Console.log(`  ${scope} > ${permission} — ${why}`);
+	yield* Console.log("  (Metadata: Read is mandatory and granted automatically)");
+	yield* Console.log("  These are NOT verified — GitHub does not expose a fine-grained token's own scopes.");
+	yield* Console.log("");
+	yield* Console.log(warnings === 0 ? "No unknown keys detected." : `${warnings} warning(s) found.`);
 });
 /**
 * `reposets doctor`.

package/cli/commands/history.js

@@ -1,6 +1,6 @@
 import { SyncJournal } from "../../store/SyncJournal.js";
-import { Effect } from "effect";
-import { Command, Flag } from "effect/unstable/cli";
+import { Console, Effect } from "effect";
+import { CliError, Command, Flag } from "effect/unstable/cli";
 
 //#region src/cli/commands/history.ts
 const limitFlag = Flag.Int("limit").pipe(Flag.withDefault(20), Flag.withDescription("How many runs to show, newest first"));
@@ -42,7 +42,7 @@ const pad = (value, width) => value.padEnd(width);
 *
 * @remarks
 * Computed rather than fixed because group names and repository names are
-* user-supplied and unbounded. The `CliLogger` emits each line verbatim, so
+* user-supplied and unbounded. Each line is written verbatim to stdout, so
 * alignment computed here survives to the terminal.
 */
 const renderRows = (summaries) => {
@@ -87,14 +87,11 @@ const historyHandler = (input) => Effect.gen(function* () {
 		...input.repo === void 0 ? {} : { repo: input.repo }
 	});
 	if (summaries.length === 0) {
-		yield* Effect.log(input.repo === void 0 ? "No runs recorded yet. The journal fills in as you sync." : `No recorded run has touched ${input.repo}.`);
+		yield* Console.log(input.repo === void 0 ? "No runs recorded yet. The journal fills in as you sync." : `No recorded run has touched ${input.repo}.`);
 		return;
 	}
-	for (const line of renderRows(summaries)) yield* Effect.log(line);
-	if (summaries.length === input.limit) {
-		yield* Effect.log("");
-		yield* Effect.log(`Showing the most recent ${input.limit}. Pass --limit for more.`);
-	}
+	for (const line of renderRows(summaries)) yield* Console.log(line);
+	if (summaries.length === input.limit) yield* Effect.log(`Showing the most recent ${input.limit}. Pass --limit for more.`);
 });
 /**
 * The present-tense form of a stored action, for a dry run.
@@ -118,32 +115,22 @@ const wouldForm = (action) => action === "created" ? "create" : action === "upda
 const showHandler = (prefix) => Effect.gen(function* () {
 	const journal = yield* SyncJournal;
 	const matches = (yield* journal.history({ limit: 1e3 }).pipe(Effect.orElseSucceed(() => []))).filter((run) => run.id.startsWith(prefix));
-	if (matches.length === 0) {
-		yield* Effect.logError(`No run matches '${prefix}'.`);
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
-	}
+	if (matches.length === 0) return yield* Effect.fail(new CliError.UserError({ cause: `No run matches '${prefix}'.` }));
 	if (matches.length > 1) {
-		yield* Effect.logError(`'${prefix}' matches ${matches.length} runs. Use more of the id:`);
-		for (const run of matches.slice(0, 5)) yield* Effect.logError(`  ${run.id}  ${formatWhen(run.startedAt)}`);
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
+		const candidates = matches.slice(0, 5).map((run) => `  ${run.id}  ${formatWhen(run.startedAt)}`);
+		return yield* Effect.fail(new CliError.UserError({ cause: [`'${prefix}' matches ${matches.length} runs. Use more of the id:`, ...candidates].join("\n") }));
 	}
 	const run = matches[0];
 	const changes = yield* journal.changesFor(run.id).pipe(Effect.orElseSucceed(() => []));
-	yield* Effect.log(`run ${run.id}`);
-	yield* Effect.log(`  ${formatWhen(run.startedAt)} · ${run.dryRun === 1 ? "dry-run" : "applied"} · ${run.outcome ?? "unfinished"} · ${formatDuration(run)}`);
-	yield* Effect.log("");
+	yield* Console.log(`run ${run.id}`);
+	yield* Console.log(`  ${formatWhen(run.startedAt)} · ${run.dryRun === 1 ? "dry-run" : "applied"} · ${run.outcome ?? "unfinished"} · ${formatDuration(run)}`);
+	yield* Console.log("");
 	if (run.error !== null && run.error !== "") {
-		yield* Effect.log(`  error: ${run.error}`);
-		yield* Effect.log("");
+		yield* Console.log(`  error: ${run.error}`);
+		yield* Console.log("");
 	}
 	if (changes.length === 0) {
-		yield* Effect.log(run.error !== null && run.error !== "" ? "  No resources changed." : "  No resources changed (nothing to do).");
+		yield* Console.log(run.error !== null && run.error !== "" ? "  No resources changed." : "  No resources changed (nothing to do).");
 		return;
 	}
 	const byRepo = /* @__PURE__ */ new Map();
@@ -153,12 +140,12 @@ const showHandler = (prefix) => Effect.gen(function* () {
 		else existing.push(change);
 	}
 	for (const [repo, records] of byRepo) {
-		yield* Effect.log(`  ${repo}`);
+		yield* Console.log(`  ${repo}`);
 		for (const record of records) {
 			const detail = record.detail === void 0 || record.detail === null ? "" : ` — ${record.detail}`;
 			const what = record.kind === record.name ? record.kind : `${record.kind} ${record.name}`;
 			const action = run.dryRun === 1 ? `would ${wouldForm(record.action)}` : record.action;
-			yield* Effect.log(`    ${action.padEnd(18)} ${what}${detail}`);
+			yield* Console.log(`    ${action.padEnd(18)} ${what}${detail}`);
 		}
 	}
 });
@@ -174,13 +161,13 @@ const showHandler = (prefix) => Effect.gen(function* () {
 */
 const pruneHandler = (keep) => Effect.gen(function* () {
 	const removed = yield* (yield* SyncJournal).prune(keep).pipe(Effect.orElseSucceed(() => 0));
-	yield* Effect.log(removed === 0 ? `Nothing to prune; ${keep} or fewer runs are recorded.` : `Pruned ${removed} run${removed === 1 ? "" : "s"}, keeping the newest ${keep}.`);
-	yield* Effect.log("Applied state and the cache are untouched — drift detection still works.");
+	yield* Console.log(removed === 0 ? `Nothing to prune; ${keep} or fewer runs are recorded.` : `Pruned ${removed} run${removed === 1 ? "" : "s"}, keeping the newest ${keep}.`);
+	yield* Console.log("Applied state and the cache are untouched — drift detection still works.");
 });
 const clearHandler = () => Effect.gen(function* () {
 	const removed = yield* (yield* SyncJournal).clear().pipe(Effect.orElseSucceed(() => 0));
-	yield* Effect.log(`Cleared ${removed} run${removed === 1 ? "" : "s"} from the journal.`);
-	yield* Effect.log("Applied state and the cache are untouched — drift detection still works.");
+	yield* Console.log(`Cleared ${removed} run${removed === 1 ? "" : "s"} from the journal.`);
+	yield* Console.log("Applied state and the cache are untouched — drift detection still works.");
 });
 /**
 * `reposets history`.

package/cli/commands/init.js

@@ -1,8 +1,9 @@
 import { CONFIG_FILENAME, CREDENTIALS_FILENAME } from "../../services/ConfigFiles.js";
-import { Effect, FileSystem, Path } from "effect";
+import { Invocation } from "../../services/Invocation.js";
+import { Console, Effect, FileSystem, Path } from "effect";
+import { CliExit } from "@effected/cli";
 import { Command, Flag } from "effect/unstable/cli";
 import { AppDirs } from "@effected/xdg";
-import { cwd } from "node:process";
 
 //#region src/cli/commands/init.ts
 const projectFlag = Flag.Boolean("project").pipe(Flag.withDefault(false), Flag.withDescription("Scaffold into the current directory instead of the XDG config directory"));
@@ -111,32 +112,41 @@ const CREDENTIALS_TEMPLATE = `# reposets credentials
 * references and so is not catastrophic to commit, but it still names a
 * person's vault layout, and the habit is worth keeping.
 *
+* What was created or found goes to stdout; the next-steps guidance to stderr.
+* A file that could not be written is reported on stderr and exits 1.
+*
 * @public
 */
 const initHandler = (project) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const appDirs = yield* AppDirs;
-	const targetDir = project ? cwd() : yield* appDirs.ensureConfig;
+	const targetDir = project ? (yield* Invocation).cwd : yield* appDirs.ensureConfig;
 	yield* fs.makeDirectory(targetDir, { recursive: true });
+	/**
+	* A write that fails is a real failure of this command — the user asked
+	* for a file and did not get one — so it is reported on stderr and the
+	* run exits 1 through `CliExit`. The remaining files are still attempted:
+	* one unwritable path should not hide what else did or did not happen.
+	*/
+	const failed = (target) => Effect.logError(`Could not write: ${target}`).pipe(Effect.andThen(CliExit.set(1)));
 	/** Write a file unless it is already there; report either way. */
 	const scaffold = (name, contents) => Effect.gen(function* () {
 		const target = path.join(targetDir, name);
 		if (yield* fs.exists(target).pipe(Effect.orElseSucceed(() => false))) {
-			yield* Effect.log(`Already exists: ${target}`);
+			yield* Console.log(`Already exists: ${target}`);
 			return;
 		}
-		yield* (yield* fs.writeFileString(target, contents).pipe(Effect.option))._tag === "Some" ? Effect.log(`Created: ${target}`) : Effect.logError(`Could not write: ${target}`);
+		yield* (yield* fs.writeFileString(target, contents).pipe(Effect.option))._tag === "Some" ? Console.log(`Created: ${target}`) : failed(target);
 	});
 	yield* scaffold(CONFIG_FILENAME, CONFIG_TEMPLATE);
 	yield* scaffold(CREDENTIALS_FILENAME, CREDENTIALS_TEMPLATE);
 	const gitignorePath = path.join(targetDir, ".gitignore");
 	const existing = yield* fs.readFileString(gitignorePath).pipe(Effect.orElseSucceed(() => void 0));
-	if (existing === void 0) {
-		if ((yield* fs.writeFileString(gitignorePath, `${"reposets.credentials.toml"}\n`).pipe(Effect.option))._tag === "Some") yield* Effect.log(`Created .gitignore with ${CREDENTIALS_FILENAME}`);
-	} else if (!existing.includes("reposets.credentials.toml")) {
+	if (existing === void 0) yield* (yield* fs.writeFileString(gitignorePath, `${"reposets.credentials.toml"}\n`).pipe(Effect.option))._tag === "Some" ? Console.log(`Created .gitignore with ${CREDENTIALS_FILENAME}`) : failed(gitignorePath);
+	else if (!existing.includes("reposets.credentials.toml")) {
 		const separator = existing.endsWith("\n") ? "" : "\n";
-		if ((yield* fs.writeFileString(gitignorePath, `${existing}${separator}${"reposets.credentials.toml"}\n`).pipe(Effect.option))._tag === "Some") yield* Effect.log(`Added ${CREDENTIALS_FILENAME} to .gitignore`);
+		yield* (yield* fs.writeFileString(gitignorePath, `${existing}${separator}${"reposets.credentials.toml"}\n`).pipe(Effect.option))._tag === "Some" ? Console.log(`Added ${CREDENTIALS_FILENAME} to .gitignore`) : failed(gitignorePath);
 	}
 	yield* Effect.log("");
 	yield* Effect.log("Done. Edit the config, then add a credential reference with:");

package/cli/commands/list.js

@@ -1,6 +1,7 @@
 import { profileOwner } from "../../schemas/credentials.js";
 import { ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
-import { Effect } from "effect";
+import { Console, Effect } from "effect";
+import { CliExit } from "@effected/cli";
 import { Command } from "effect/unstable/cli";
 
 //#region src/cli/commands/list.ts
@@ -26,7 +27,8 @@ const scopeParts = (scopes) => {
 * A reading command: it decodes the config and prints its structure, touching
 * neither GitHub nor the store. Empty collections are omitted rather than
 * printed as `(none)` — a group that assigns nothing should read as a short
-* entry, not a wall of blanks.
+* entry, not a wall of blanks. The summary is the command's output, so it is
+* written to stdout.
 *
 * @public
 */
@@ -35,28 +37,28 @@ const listHandler = Effect.gen(function* () {
 	const credentialsFile = yield* ReposetsCredentialsFile;
 	if ((yield* configFile.discover).length === 0) {
 		yield* Effect.logError("No config file found. Run 'reposets init' to create one.");
-		return;
+		return yield* CliExit.set(1);
 	}
 	const config = yield* configFile.load;
 	const credentials = yield* credentialsFile.loadOrDefault({ profiles: {} });
 	for (const [groupName, group] of Object.entries(config.groups)) {
 		const profile = credentials.profiles[group.credentials];
 		const acts = profile === void 0 ? `credentials: ${group.credentials} — NOT FOUND` : `owner: ${profileOwner(profile).owner}, credentials: ${group.credentials}`;
-		yield* Effect.log(`[${groupName}] (${acts})`);
+		yield* Console.log(`[${groupName}] (${acts})`);
 		const owner = profile === void 0 ? "(unknown)" : profileOwner(profile).owner;
-		for (const repo of group.repos) yield* Effect.log(`  - ${owner}/${repo}`);
+		for (const repo of group.repos) yield* Console.log(`  - ${owner}/${repo}`);
 		for (const [label, names] of [
 			["settings", group.settings],
 			["environments", group.environments],
 			["rulesets", group.rulesets],
 			["security", group.security],
 			["code_scanning", group.code_scanning]
-		]) if (names !== void 0 && names.length > 0) yield* Effect.log(`  ${label}: ${names.join(", ")}`);
+		]) if (names !== void 0 && names.length > 0) yield* Console.log(`  ${label}: ${names.join(", ")}`);
 		const secrets = scopeParts(group.secrets);
-		if (secrets.length > 0) yield* Effect.log(`  secrets: ${secrets.join(", ")}`);
+		if (secrets.length > 0) yield* Console.log(`  secrets: ${secrets.join(", ")}`);
 		const variables = scopeParts(group.variables);
-		if (variables.length > 0) yield* Effect.log(`  variables: ${variables.join(", ")}`);
-		yield* Effect.log("");
+		if (variables.length > 0) yield* Console.log(`  variables: ${variables.join(", ")}`);
+		yield* Console.log("");
 	}
 });
 /**

package/cli/commands/nuke.js

@@ -1,6 +1,8 @@
 import { CONFIG_FILENAME, CREDENTIALS_FILENAME } from "../../services/ConfigFiles.js";
-import { Effect, FileSystem, Path } from "effect";
-import { Command, Flag, Prompt } from "effect/unstable/cli";
+import { Invocation } from "../../services/Invocation.js";
+import { Console, Effect, FileSystem, Path, Stdio } from "effect";
+import { CliExit } from "@effected/cli";
+import { CliError, Command, Flag, Prompt } from "effect/unstable/cli";
 import { AppDirs } from "@effected/xdg";
 
 //#region src/cli/commands/nuke.ts
@@ -76,30 +78,24 @@ const nukeHandler = (force) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const appDirs = yield* AppDirs;
-	const targets = yield* findTargets(fs, path, appDirs, process.cwd());
+	const { cwd } = yield* Invocation;
+	const targets = yield* findTargets(fs, path, appDirs, cwd);
 	if (targets.length === 0) {
-		yield* Effect.log("Nothing to remove — no reposets files found on this machine.");
+		yield* Console.log("Nothing to remove — no reposets files found on this machine.");
 		return;
 	}
-	yield* Effect.log("This will delete:");
+	yield* Console.log("This will delete:");
 	for (const target of targets) {
-		yield* Effect.log(`  ${target.path}`);
-		yield* Effect.log(`    ${target.what} — loses ${target.cost}`);
+		yield* Console.log(`  ${target.path}`);
+		yield* Console.log(`    ${target.what} — loses ${target.cost}`);
 	}
-	yield* Effect.log("");
-	yield* Effect.log("Nothing on GitHub is touched. Everything reposets applied stays applied.");
+	yield* Console.log("");
+	yield* Console.log("Nothing on GitHub is touched. Everything reposets applied stays applied.");
 	if (!force) {
-		if (process.stdin.isTTY !== true) {
-			yield* Effect.logError("");
-			yield* Effect.logError("Refusing: not an interactive terminal, and --force was not given.");
-			yield* Effect.sync(() => {
-				process.exitCode = 1;
-			});
-			return;
-		}
-		yield* Effect.log("");
+		if (!(yield* (yield* Stdio.Stdio).stdinIsTerminal)) return yield* Effect.fail(new CliError.UserError({ cause: "Refusing: not an interactive terminal, and --force was not given." }));
+		yield* Console.log("");
 		if (!(yield* Prompt.Confirm({ message: `Delete ${targets.length} file${targets.length === 1 ? "" : "s"}?` }).pipe(Effect.orElseSucceed(() => false)))) {
-			yield* Effect.log("Nothing was deleted.");
+			yield* Console.log("Nothing was deleted.");
 			return;
 		}
 	}
@@ -111,10 +107,11 @@ const nukeHandler = (force) => Effect.gen(function* () {
 			continue;
 		}
 		removed += 1;
-		yield* Effect.log(`  removed ${target.path}`);
+		yield* Console.log(`  removed ${target.path}`);
 	}
-	yield* Effect.log("");
-	yield* Effect.log(removed === targets.length ? `Done. ${removed} file${removed === 1 ? "" : "s"} removed.` : `Removed ${removed} of ${targets.length}; the rest are listed above.`);
+	yield* Console.log("");
+	yield* Console.log(removed === targets.length ? `Done. ${removed} file${removed === 1 ? "" : "s"} removed.` : `Removed ${removed} of ${targets.length}; the rest are listed above.`);
+	if (removed < targets.length) yield* CliExit.set(1);
 });
 /**
 * The `nuke` command.

package/cli/commands/sync.js

@@ -1,5 +1,4 @@
 import { ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
-import { formatSchemaIssue } from "../../lib/schema-issues.js";
 import { SyncJournal, SyncJournalLive } from "../../store/SyncJournal.js";
 import { OnePasswordClientLive } from "../../services/OnePasswordClient.js";
 import { CredentialResolver, CredentialResolverLive } from "../../services/CredentialResolver.js";
@@ -10,8 +9,9 @@ import { RepoCacheLive } from "../../store/RepoCache.js";
 import { PHASE_NAMES } from "../../sync/phase.js";
 import { allPhases } from "../../sync/phases/index.js";
 import { SyncEngine, SyncEngineLive } from "../../sync/SyncEngine.js";
-import { Effect, Layer, Option } from "effect";
-import { Command, Flag } from "effect/unstable/cli";
+import { Console, Effect, Layer, Option } from "effect";
+import { CliExit } from "@effected/cli";
+import { CliError, Command, Flag } from "effect/unstable/cli";
 import { CodeScanning, DeploymentEnvironment, GitHubClient, GitHubRepository, RepositorySecret, RepositorySecurity, RepositoryVariable, Ruleset, WorkflowDispatch } from "@effected/github";
 
 //#region src/cli/commands/sync.ts
@@ -71,39 +71,18 @@ const partitionByProfile = (groups, only) => {
 * @public
 */
 const syncHandler = (input) => Effect.gen(function* () {
+	const badPhases = [...unknownPhases(input.only), ...unknownPhases(input.skip)];
+	if (badPhases.length > 0) return yield* Effect.fail(new CliError.UserError({ cause: `Unknown phase name(s): ${badPhases.join(", ")}. Valid phases: ${PHASE_NAMES.join(", ")}. Nothing was synced.` }));
 	const configFile = yield* ReposetsConfigFile;
 	const credentialsFile = yield* ReposetsCredentialsFile;
-	const discovered = yield* configFile.discover.pipe(Effect.result);
-	if (discovered._tag === "Failure") {
-		yield* Effect.logError(String(discovered.failure));
-		const failure = discovered.failure;
-		for (const line of formatSchemaIssue(failure.issue)) yield* Effect.logError(`  ${line}`);
-		if (failure.cause !== void 0) yield* Effect.logError(`  ${String(failure.cause)}`);
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
-	}
-	const source = discovered.success[0];
+	const source = (yield* configFile.discover)[0];
 	if (source === void 0) {
 		yield* Effect.logError("No config found. Run 'reposets init' to create one.");
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
+		return yield* CliExit.set(1);
 	}
 	const config = source.value;
 	const configDir = source.path.slice(0, source.path.lastIndexOf("/"));
 	const credentials = yield* credentialsFile.loadOrDefault({ profiles: {} });
-	const badPhases = [...unknownPhases(input.only), ...unknownPhases(input.skip)];
-	if (badPhases.length > 0) {
-		yield* Effect.logError(`Unknown phase name(s): ${badPhases.join(", ")}. Valid phases: ${PHASE_NAMES.join(", ")}`);
-		yield* Effect.logError("Nothing was synced.");
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
-	}
 	const dangling = danglingReferences(config);
 	if (dangling.length > 0) {
 		yield* Effect.logError("Config references sections that do not exist:");
@@ -113,18 +92,13 @@ const syncHandler = (input) => Effect.gen(function* () {
 		}
 		yield* Effect.logError("");
 		yield* Effect.logError("Nothing was synced. Fix the references or run 'reposets validate' for the full list.");
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
+		return yield* CliExit.set(1);
 	}
 	const partitions = partitionByProfile(config.groups, input.group);
 	if (partitions.size === 0) {
-		yield* Effect.logError(input.group === void 0 ? "No groups configured. Add a [groups.<name>] section to sync anything." : `No group named '${input.group}'. Configured: ${Object.keys(config.groups).join(", ") || "none"}`);
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
+		if (input.group !== void 0) return yield* Effect.fail(new CliError.UserError({ cause: `No group named '${input.group}'. Configured: ${Object.keys(config.groups).join(", ") || "none"}` }));
+		yield* Effect.logError("No groups configured. Add a [groups.<name>] section to sync anything.");
+		return yield* CliExit.set(1);
 	}
 	const resolverLayer = Layer.provide(CredentialResolverLive, OnePasswordClientLive);
 	const loggerLayer = SyncLoggerLive({
@@ -196,10 +170,8 @@ const syncHandler = (input) => Effect.gen(function* () {
 			errors
 		};
 	}).pipe(Effect.provide(sharedLayer));
-	yield* Effect.log(`${report.repos} repo(s), ${report.changes} change(s), ${report.drifted} drifted, ${report.errors} error(s)`);
-	if (report.errors > 0 || input.failOnDrift && report.drifted > 0) yield* Effect.sync(() => {
-		process.exitCode = 1;
-	});
+	yield* Console.log(`${report.repos} repo(s), ${report.changes} change(s), ${report.drifted} drifted, ${report.errors} error(s)`);
+	if (report.errors > 0 || input.failOnDrift && report.drifted > 0) yield* CliExit.set(1);
 });
 /**
 * The `sync` command.

package/cli/commands/validate.js

@@ -2,7 +2,8 @@ import { ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/Conf
 import { danglingReferences } from "../../lib/config-refs.js";
 import { undefinedCredentialLabels } from "../../lib/credential-labels.js";
 import { orgOnlyViolations } from "../../lib/org-only.js";
-import { Effect } from "effect";
+import { Console, Effect } from "effect";
+import { CliExit } from "@effected/cli";
 import { Command } from "effect/unstable/cli";
 
 //#region src/cli/commands/validate.ts
@@ -18,9 +19,14 @@ import { Command } from "effect/unstable/cli";
 * The handler simply *requires* `ReposetsConfigFile`; how it gets built from
 * `--config` is the root command's business, not this command's.
 *
+* The success result goes to stdout. A reference or credential problem is a
+* finding, not a failure: the details go to stderr and the command succeeds
+* with `CliExit.set(1)`. A file that does not decode fails `discover`, and the
+* entrypoint's renderer prints the issue lines and exits `1`.
+*
 * @public
 */
-const validateCommand = Command.make("validate", {}, () => Effect.gen(function* () {
+const validateHandler = Effect.gen(function* () {
 	const configFile = yield* ReposetsConfigFile;
 	const credentialsFile = yield* ReposetsCredentialsFile;
 	const sources = yield* configFile.discover;
@@ -33,10 +39,7 @@ const validateCommand = Command.make("validate", {}, () => Effect.gen(function*
 			const defined = ref.defined.length === 0 ? "none defined" : `defined: ${ref.defined.join(", ")}`;
 			yield* Effect.logError(`  ${ref.where}: '${ref.name}' does not exist — ${defined}`);
 		}
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
+		return yield* CliExit.set(1);
 	}
 	const labels = undefinedCredentialLabels(value, credentials);
 	const violations = orgOnlyViolations(value, credentials);
@@ -45,25 +48,25 @@ const validateCommand = Command.make("validate", {}, () => Effect.gen(function*
 		for (const label of labels) yield* Effect.logError(`  [${label.group}] ${label.where}: credential label '${label.label}' is not declared in profile '${label.profile}'`);
 		yield* Effect.logError("");
 		yield* Effect.logError("Add it to that profile's [resolve] section in reposets.credentials.toml, or correct the name.");
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
+		return yield* CliExit.set(1);
 	}
 	if (violations.length > 0) {
 		yield* Effect.logError(`Invalid: ${sources[0]?.path ?? "config"}`);
 		for (const violation of violations) yield* Effect.logError(`  [${violation.group}] ${violation.where}: ${violation.detail}, but profile '${violation.profile}' is a personal account`);
 		yield* Effect.logError("");
 		yield* Effect.logError("Either move these repositories to a profile declaring `org`, or drop the settings.");
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
+		return yield* CliExit.set(1);
 	}
 	const groups = Object.keys(value.groups).length;
-	yield* Effect.log(`Valid: ${sources[0]?.path ?? "config"}`);
-	yield* Effect.log(`  groups: ${groups === 0 ? "none declared yet" : String(groups)}`);
-})).pipe(Command.withDescription("Validate reposets.config.toml against the schema"));
+	yield* Console.log(`Valid: ${sources[0]?.path ?? "config"}`);
+	yield* Console.log(`  groups: ${groups === 0 ? "none declared yet" : String(groups)}`);
+});
+/**
+* The `validate` command.
+*
+* @public
+*/
+const validateCommand = Command.make("validate", {}, () => validateHandler).pipe(Command.withDescription("Validate reposets.config.toml against the schema"));
 
 //#endregion
-export { validateCommand };
+export { validateCommand, validateHandler };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "reposets",
-	"version": "1.0.21",
+	"version": "2.0.0",
 	"private": false,
 	"description": "CLI tool to sync GitHub repo settings, secrets and rulesets across personal repositories",
 	"keywords": [
@@ -50,6 +50,7 @@
 		"@1password/sdk": "^0.5.0",
 		"@effect/platform-node": "4.0.0-rc.117",
 		"@effected/app": "^0.18.0",
+		"@effected/cli": "^0.9.0",
 		"@effected/config-file": "^0.12.0",
 		"@effected/github": "^0.13.0",
 		"@effected/store": "^0.10.0",

package/services/CredentialResolver.js

@@ -1,6 +1,5 @@
 import { OnePasswordClient } from "./OnePasswordClient.js";
-import { Context, Data, Effect, Layer, Redacted } from "effect";
-import { env } from "node:process";
+import { Config, Context, Data, Effect, Layer, Option, Redacted } from "effect";
 import { readFileSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
 
@@ -23,15 +22,28 @@ var ResolveError = class extends Data.TaggedError("ResolveError") {
 		return `Failed to resolve '${this.label}' from ${this.source}: ${this.reason}`;
 	}
 };
-/** Read an environment variable, failing in terms of its name. */
-const fromEnv = (label, variable) => Effect.suspend(() => {
-	const value = env[variable];
-	return value === void 0 ? Effect.fail(new ResolveError({
+/**
+* Read an environment variable, failing in terms of its name.
+*
+* @remarks
+* Read through `Config`, so the value comes from the ambient `ConfigProvider` —
+* the process environment in the shipped bin, an explicit record in a test —
+* and never from `process` directly. The provider treats an empty variable as
+* absent, so `FOO=""` fails as "not set" rather than resolving to an empty
+* credential that would only fail later, against GitHub, with a worse message.
+*/
+const fromEnv = (label, variable) => Config.option(Config.String(variable)).pipe(Effect.mapError((error) => new ResolveError({
+	label,
+	source: "env",
+	reason: `could not read ${variable}: ${error.message}`
+})), Effect.flatMap(Option.match({
+	onNone: () => Effect.fail(new ResolveError({
 		label,
 		source: "env",
 		reason: `environment variable ${variable} is not set`
-	})) : Effect.succeed(Redacted.make(value, { label }));
-});
+	})),
+	onSome: (value) => Effect.succeed(Redacted.make(value, { label }))
+})));
 /** Read a file, failing in terms of its path. */
 const fromFile = (label, filePath, basePath) => Effect.try({
 	try: () => {

package/services/Invocation.js

@@ -0,0 +1,38 @@
+import { Context, Layer } from "effect";
+
+//#region src/services/Invocation.ts
+/**
+* The facts about this process a command needs, read once at the entrypoint.
+*
+* @remarks
+* Only the CLI entrypoint (`src/cli/index.ts`) reads `process`. Everything
+* below it receives the working directory and the build's version through this
+* service instead, so a handler can be driven by a test that hands it a
+* different directory without `process.chdir`.
+*
+* The environment is deliberately NOT here. Environment variables are read
+* through Effect's `Config`, which resolves them from the ambient
+* `ConfigProvider` — the process environment by default, an explicit record
+* under `ConfigProvider.layer` in a test. That is core's own seam for the
+* environment, and `@effected/xdg` already reads `HOME` and `XDG_*` through it;
+* a second, hand-rolled one here would let the two disagree.
+*
+* The whole shape is one immutable value with no behaviour, so `Layer.succeed`
+* is the complete double — there is nothing for a partial mock to stub. The
+* moment a method appears here it stops being a value and becomes a service.
+*
+* @public
+*/
+var Invocation = class extends Context.Service()("reposets/Invocation") {
+	/**
+	* A fixed invocation, for tests and for the entrypoint alike.
+	*
+	* @remarks
+	* Each call mints a fresh layer; bind the result to a `const` rather than
+	* calling this at more than one provide site.
+	*/
+	static layer = (value) => Layer.succeed(this, value);
+};
+
+//#endregion
+export { Invocation };

package/services/OnePasswordClient.js

@@ -1,5 +1,4 @@
-import { Context, Data, Effect, Layer, Redacted } from "effect";
-import { env } from "node:process";
+import { Config, Context, Data, Effect, Layer, Option, Redacted } from "effect";
 
 //#region src/services/OnePasswordClient.ts
 /**
@@ -23,14 +22,27 @@ var OnePasswordError = class extends Data.TaggedError("OnePasswordError") {
 		return `Failed to resolve ${this.reference}: ${this.reason}`;
 	}
 };
-/** Read the service account token, failing in terms of the reference that needed it. */
-const serviceAccountToken = (reference) => Effect.suspend(() => {
-	const token = env[OP_SERVICE_ACCOUNT_TOKEN];
-	return token === void 0 || token === "" ? Effect.fail(new OnePasswordError({
+/**
+* Read the service account token, failing in terms of the reference that needed it.
+*
+* @remarks
+* Read through `Config`, so it comes from the ambient `ConfigProvider` — the
+* process environment in the shipped bin, an explicit record in a test — and
+* never from `process` directly. The provider treats an empty variable as
+* absent, which is the answer wanted here too: an empty token authenticates
+* nothing. A provider that fails outright is reported the same way, naming the
+* variable, rather than escaping as a `ConfigError` this service never declared.
+*/
+const serviceAccountToken = (reference) => Config.option(Config.String(OP_SERVICE_ACCOUNT_TOKEN)).pipe(Effect.mapError((error) => new OnePasswordError({
+	reference,
+	reason: `could not read ${OP_SERVICE_ACCOUNT_TOKEN}: ${error.message}`
+})), Effect.flatMap(Option.match({
+	onNone: () => Effect.fail(new OnePasswordError({
 		reference,
 		reason: `${OP_SERVICE_ACCOUNT_TOKEN} is not set in the environment`
-	})) : Effect.succeed(token);
-});
+	})),
+	onSome: Effect.succeed
+})));
 /**
 * Resolves `op://` references through the 1Password SDK.
 *

package/services/SyncLogger.js

@@ -1,4 +1,4 @@
-import { Context, Effect, Layer, Ref } from "effect";
+import { Console, Context, Effect, Layer, Ref } from "effect";
 
 //#region src/services/SyncLogger.ts
 /** Plural forms the naive `+ "s"` gets wrong. */
@@ -41,9 +41,14 @@ function pluralize(resource, count) {
 * out-of-band edit happens to match the config. The tool has no work to do; the
 * human still changed something, and staying quiet would hide it.
 *
-* Lines are emitted with `Effect.log`, never `Console.log`: the CLI entrypoint
-* installs a logger that routes Effect's output, and a direct console write
-* would bypass both it and the filtering above.
+* **The report is the product; failures are diagnostics.** What a run did —
+* group and repository headers, every operation, every drift line, the closing
+* "Sync complete!" — is the output of `sync` and `drift`, so it is written with
+* `Console.log` to stdout, where `reposets drift > report.txt` captures it.
+* Failures are emitted with `Effect.logError`, which the CLI logger
+* (`CliLogger.layer()`) routes to stderr, so they stay on the terminal when
+* stdout is redirected. A consequence worth knowing: `--log-level` filters
+* diagnostics only — it no longer silences the report.
 *
 * @public
 */
@@ -63,7 +68,7 @@ function SyncLoggerLive(config) {
 	return Layer.effect(SyncLogger, Effect.gen(function* () {
 		const errors = yield* Ref.make([]);
 		const currentRepo = yield* Ref.make("");
-		const emit = (line) => Effect.log(line);
+		const emit = (line) => Console.log(line);
 		/**
 		* Failures, on the error channel.
 		*

package/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.59.2"
+      "packageVersion": "7.59.1"
     }
   ]
 }

package/cli/logger.js

@@ -1,48 +0,0 @@
-import { Console, LogLevel, Logger } from "effect";
-
-//#region src/cli/logger.ts
-/**
-* Renders one log record as a plain CLI line.
-*
-* @remarks
-* Effect's default logger emits `[23:04:05.891] INFO (#2): message`, which is
-* the right shape for a service and the wrong one for a command-line tool: the
-* timestamp, level and fiber id are noise in front of output a human is reading,
-* and they make a formatted block — `doctor`'s permission table, for instance —
-* unreadable.
-*
-* A message that is an array is joined with a space, matching how `Effect.log`
-* accepts variadic parts.
-*/
-const render = (message) => Array.isArray(message) ? message.map(String).join(" ") : String(message);
-/**
-* The CLI's output logger: plain lines, errors on stderr.
-*
-* @remarks
-* Routing by level is the contract `SyncLogger` is written against — it emits
-* failures with `Effect.logError` precisely so that `reposets sync > log.txt`
-* still shows them on the terminal while the log captures progress. Without a
-* logger that honors the distinction, that choice does nothing.
-*
-* `Logger.layer` replaces the default logger rather than merging with it, so
-* nothing is emitted twice.
-*
-* A `Logger`'s callback is **synchronous**, so it cannot yield an `Effect` and
-* therefore cannot reach `Stdio`'s sinks. The way out is not to write to
-* `process.stdout` — it is the one core's own loggers take: read the `Console`
-* off the fiber. `Console.Console` is a `Context.Reference`, so it carries a
-* default and never appears in `R`, and a test swaps the reference instead of
-* stubbing a global.
-*
-* `console.log`/`console.error` supply their own newline, which is why nothing
-* here appends one.
-*
-* @public
-*/
-const CliLoggerLive = Logger.layer([Logger.make(({ fiber, logLevel, message }) => {
-	const console = fiber.getRef(Console.Console);
-	(LogLevel.isGreaterThanOrEqualTo(logLevel, "Error") ? console.error : console.log)(render(message));
-})]);
-
-//#endregion
-export { CliLoggerLive };

package/lib/schema-issues.js

@@ -1,50 +0,0 @@
-import { SchemaIssue } from "effect";
-
-//#region src/lib/schema-issues.ts
-/**
-* Core's structured formatter: one entry per leaf, each with its property path.
-*
-* @remarks
-* Built once. It is a pure function of the issue tree, and `Formatter` carries
-* no state.
-*/
-const formatter = SchemaIssue.makeFormatterStandardSchemaV1({ leafHook: (issue) => issue._tag === "UnexpectedKey" ? "unknown key" : SchemaIssue.defaultLeafHook(issue) });
-/**
-* Render a `ConfigValidationError`'s `issue` as one line per rejected value.
-*
-* @remarks
-* **No walker of our own.** Core already ships one:
-* `SchemaIssue.makeFormatterStandardSchemaV1()` flattens the tree to
-* `{ message, path }` entries, which is exactly the shape this needs.
-* `defaultLeafHook` handles every leaf variant — `UnexpectedKey`,
-* `InvalidType`, `MissingKey`, `Forbidden`, `OneOf` — so a wrong *type* renders
-* as sensibly as an unknown key, and a variant added upstream is covered
-* without a change here. Hand-rolling this against the excess-property shape
-* alone would have got every other cause wrong.
-*
-* `issue` is declared `Schema.Defect`, so it arrives as `unknown`; the
-* `isIssue` guard is what makes reading it safe. Anything that is not an issue
-* tree yields no lines rather than a crash — a rendering helper on an error
-* path must never become the reason a command dies.
-*
-* Nodes are never stringified. Each carries the entire AST inline, annotations
-* included, so `String(node)` would dump the schema rather than describe the
-* failure. Only `message` and `path` are read.
-*
-* @param issue - the `issue` field of a `ConfigValidationError`, or any value
-* @returns one line per rejected value, deepest path last; empty if `issue` is
-* not an issue tree
-*
-* @public
-*/
-const formatSchemaIssue = (issue) => {
-	if (!SchemaIssue.isIssue(issue)) return [];
-	const lines = formatter(issue).issues.map((entry) => {
-		const path = (entry.path ?? []).map(String).join(".");
-		return path === "" ? entry.message : `${entry.message} at ${path}`;
-	});
-	return [...new Set(lines)];
-};
-
-//#endregion
-export { formatSchemaIssue };