reposets 1.0.21 → 2.0.1

package/README.md

@@ -99,7 +99,7 @@ The owner is not in the config. It belongs to the credential profile, which decl
 | `reposets nuke` | Delete every local reposets file. Nothing on GitHub is touched |
 | `reposets credentials` | Manage credential profiles: `create`, `list`, `delete` |
 
-Every command accepts `--config` and the `--log-level` filter Effect core provides. `--log-level error` is quiet on success and loud on failure; `--log-level none` is the CI form.
+Every command accepts `--config`. Command output goes to stdout and diagnostics and errors to stderr, so `reposets sync > /dev/null` is quiet on success and loud on failure. Usage errors exit `64`; findings exit `1`.
 
 ## Configuration
 

package/bin/reposets.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { CredentialsFilesLive } from "../services/ConfigFiles.js";
-import { formatSchemaIssue } from "../lib/schema-issues.js";
+import { Invocation } from "../services/Invocation.js";
 import { migrations } from "../store/migrations.js";
 import { SyncJournalLive } from "../store/SyncJournal.js";
 import { credentialsCommand } from "../cli/commands/credentials.js";
@@ -13,14 +13,26 @@ import { initCommand } from "../cli/commands/init.js";
 import { listCommand } from "../cli/commands/list.js";
 import { nukeCommand } from "../cli/commands/nuke.js";
 import { validateCommand } from "../cli/commands/validate.js";
-import { CliLoggerLive } from "../cli/logger.js";
 import { Effect, Layer } from "effect";
 import { App } from "@effected/app";
 import { NodeRuntime, NodeServices } from "@effect/platform-node";
-import { Command } from "effect/unstable/cli";
+import { CliColor, CliRuntime, ConfigIssueRenderer } from "@effected/cli";
+import { Command } from "effect/cli";
 
 //#region src/cli/index.ts
 /**
+* The build's version.
+*
+* @remarks
+* The bundler substitutes `process.env.__PACKAGE_VERSION__` with a literal at
+* build time, so this is not a runtime environment read. Only the exact
+* `process.env.__PACKAGE_VERSION__` spelling is substituted — a destructured
+* `env.__PACKAGE_VERSION__` is not, which is why `doctor` printed
+* `0.0.0 (dev build)` from every build until the version was threaded down
+* from here through {@link Invocation}.
+*/
+const VERSION = "2.0.1";
+/**
 * The application control plane.
 *
 * @remarks
@@ -35,6 +47,21 @@ const AppLive = App.layer({
 	store: { migrations }
 });
 /**
+* Everything this module reads from `process`, handed down as plain values.
+*
+* @remarks
+* This file is the only one under `src/` allowed to read `process`. Commands and
+* services require {@link Invocation} instead, so a test can hand them a
+* different working directory. Two things are deliberately not here: the
+* environment, which every reader takes through Effect's `Config` (the default
+* `ConfigProvider` reads the process environment, so nothing here has to), and
+* whether stdin is a terminal, which `nuke` asks core's `Stdio.stdinIsTerminal`.
+*/
+const InvocationLive = Invocation.layer({
+	cwd: process.cwd(),
+	version: VERSION
+});
+/**
 * The root command.
 *
 * @remarks
@@ -53,33 +80,55 @@ const cli = Command.make("reposets", {}, () => Effect.void).pipe(Command.withDes
 	historyCommand,
 	credentialsCommand
 ]), Command.provide(ConfigLive), Command.provide(CredentialsFilesLive), Command.provide(SyncJournalLive), Command.withGlobalFlags([ConfigFlag]));
-const MainLive = Layer.mergeAll(Layer.provideMerge(AppLive, NodeServices.layer), CliLoggerLive);
 /**
-* Report a failure through the CLI logger and exit non-zero.
+* The platform: Node's services, the application control plane over them, the
+* invocation facts, and one colour-aware help/error formatter.
 *
 * @remarks
-* `NodeRuntime.runMain` reports an unhandled failure with Effect's *default*
-* logger, which sits outside the layers the program was provided — so a failure
-* escaping to it prints `[23:05:56] ERROR (#2): …` **on stdout**, in the format
-* {@link CliLoggerLive} exists to replace, on the stream errors must not use.
+* `provideMerge` rather than `provide` at each step, because commands require
+* the platform services (`FileSystem`, `Path`, `Stdio`) directly as well as
+* through `App`. `CliColor.formatterLayer()` needs `Stdio` to decide whether
+* colour is on, so it sits above `NodeServices.layer` rather than beside it.
+*/
+const PlatformLive = Layer.mergeAll(AppLive, CliColor.formatterLayer(), InvocationLive).pipe(Layer.provideMerge(NodeServices.layer));
+/** Whether a failure is a tagged error of a given tag. */
+const isTagged = (error, tag) => typeof error === "object" && error !== null && "_tag" in error && error._tag === tag;
+/**
+* Render a failure that escaped a command, one line at a time, to stderr.
+*
+* @remarks
+* `CliRuntime.main` hands this every failure it does not already know how to
+* skip — a usage error `Command.runWith` printed itself never reaches it — and
+* logs each returned line through `CliLogger` before exiting `1`.
+*
+* A config that fails to decode arrives here as a `ConfigValidationError`,
+* whose message names the file and stops there. The structured cause is on its
+* `issue`, which `ConfigIssueRenderer` turns into `unknown key at …` lines, so
+* the failure describes itself rather than telling a CI log to go run another
+* command. The `doctor` pointer stays only when something was misspelled — a
+* missing key has no near-match to suggest, and pointing a confused user at a
+* command that cannot help them is worse than saying nothing.
 *
-* Catching here keeps the failure inside the logger's scope. The exit code is
-* then ours to set, since the effect now succeeds.
+* Any other failure that carries a `cause` gets it printed on a second line. A
+* TOML syntax error is a `ConfigCodecError` whose own message is the bare
+* "toml parse failed" — the line and column live on the cause, and printing it
+* is the difference between "your config is broken somewhere" and "1:9,
+* expected ] to close the table header".
 */
-const reportAndExit = (error) => Effect.gen(function* () {
-	yield* Effect.logError(String(error));
+const render = (error) => {
+	const lines = [String(error)];
 	if (isTagged(error, "ConfigValidationError")) {
-		const lines = formatSchemaIssue(error.issue);
-		for (const line of lines) yield* Effect.logError(`  ${line}`);
-		if (lines.some((line) => line.startsWith("unknown key"))) yield* Effect.logError("  Run 'reposets doctor' for suggested spellings.");
-	}
-	yield* Effect.sync(() => {
-		process.exitCode = 1;
-	});
-});
-/** Whether a caught value is a tagged error of a given tag. */
-const isTagged = (error, tag) => typeof error === "object" && error !== null && "_tag" in error && error._tag === tag;
-cli.pipe(Command.run({ version: "1.0.21" }), Effect.catch(reportAndExit), Effect.provide(MainLive), NodeRuntime.runMain);
+		const issues = ConfigIssueRenderer.render(error);
+		lines.push(...issues.map((line) => `  ${line}`));
+		if (issues.some((line) => line.startsWith("unknown key"))) lines.push("  Run 'reposets doctor' for suggested spellings.");
+	} else if (typeof error === "object" && error !== null && "cause" in error && error.cause !== void 0) lines.push(`  ${String(error.cause)}`);
+	return lines;
+};
+NodeRuntime.runMain(CliRuntime.main(Command.run(cli, { version: VERSION }), {
+	platform: PlatformLive,
+	render,
+	helpOnUsageError: "stderr"
+}));
 
 //#endregion
 export {  };

package/cli/commands/credentials.js

@@ -1,7 +1,7 @@
 import { profileOwner } from "../../schemas/credentials.js";
 import { ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
-import { Effect, Option } from "effect";
-import { Command, Flag } from "effect/unstable/cli";
+import { Console, Effect, Option } from "effect";
+import { CliError, Command, Flag } from "effect/cli";
 import { AppDirs } from "@effected/xdg";
 
 //#region src/cli/commands/credentials.ts
@@ -50,6 +50,16 @@ const saveWhereRead = (file, value) => Effect.gen(function* () {
 	yield* file.write(value, existing.path);
 	return existing.path;
 });
+/**
+* Refuse an invocation the user got wrong.
+*
+* @remarks
+* Every refusal in this module is a usage error — the flags asked for
+* something invalid — so it fails with `CliError.UserError` and exits 64.
+* `Command.runWith` prints the message once, on stderr. The messages never
+* echo a supplied value, for the reason given in {@link createHandler}.
+*/
+const refuse = (message) => Effect.fail(new CliError.UserError({ cause: message }));
 /** How a profile's `github_token` is sourced, for display. Never a value. */
 const describeSource = (source) => "op" in source ? `op ${source.op}` : `env ${source.env}`;
 /**
@@ -72,35 +82,14 @@ const createHandler = (input) => Effect.gen(function* () {
 	const { profile, op, env, username, org } = input;
 	yield* (yield* AppDirs).ensureConfig;
 	const credentialsFile = yield* ReposetsCredentialsFile;
-	if (op !== void 0 && env !== void 0) {
-		yield* Effect.logError("Provide exactly one of --op or --env, not both.");
-		return;
-	}
-	if (op === void 0 && env === void 0) {
-		yield* Effect.logError("Provide a reference: --op \"op://Vault/item/field\" or --env REPOSETS_GITHUB_TOKEN. A token value is never accepted.");
-		return;
-	}
-	if (op !== void 0 && !op.startsWith("op://")) {
-		yield* Effect.logError("--op must be a 1Password reference starting with \"op://\". Value not echoed.");
-		return;
-	}
-	if (looksLikeSecret(op ?? env ?? "")) {
-		yield* Effect.logError("That looks like a credential value, not a reference. This command stores references only — pass --op \"op://Vault/item/field\" or --env VAR_NAME. Value not echoed.");
-		return;
-	}
-	if (username !== void 0 && org !== void 0) {
-		yield* Effect.logError("Provide exactly one of --username or --org, not both.");
-		return;
-	}
-	if (username === void 0 && org === void 0) {
-		yield* Effect.logError("Provide --username <you> for a personal account or --org <name> for an organization. It is what the profile acts as, and it decides which settings are even valid.");
-		return;
-	}
+	if (op !== void 0 && env !== void 0) return yield* refuse("Provide exactly one of --op or --env, not both.");
+	if (op === void 0 && env === void 0) return yield* refuse("Provide a reference: --op \"op://Vault/item/field\" or --env REPOSETS_GITHUB_TOKEN. A token value is never accepted.");
+	if (op !== void 0 && !op.startsWith("op://")) return yield* refuse("--op must be a 1Password reference starting with \"op://\". Value not echoed.");
+	if (looksLikeSecret(op ?? env ?? "")) return yield* refuse("That looks like a credential value, not a reference. This command stores references only — pass --op \"op://Vault/item/field\" or --env VAR_NAME. Value not echoed.");
+	if (username !== void 0 && org !== void 0) return yield* refuse("Provide exactly one of --username or --org, not both.");
+	if (username === void 0 && org === void 0) return yield* refuse("Provide --username <you> for a personal account or --org <name> for an organization. It is what the profile acts as, and it decides which settings are even valid.");
 	const existing = yield* credentialsFile.loadOrDefault(EMPTY);
-	if (existing.profiles[profile] !== void 0) {
-		yield* Effect.logError(`Profile '${profile}' already exists. Delete it first.`);
-		return;
-	}
+	if (existing.profiles[profile] !== void 0) return yield* refuse(`Profile '${profile}' already exists. Delete it first.`);
 	const github_token = op !== void 0 ? { op } : { env };
 	const actsAs = username !== void 0 ? {
 		username,
@@ -113,7 +102,7 @@ const createHandler = (input) => Effect.gen(function* () {
 		...existing.profiles,
 		[profile]: actsAs
 	} });
-	yield* Effect.log(`Created profile '${profile}' (${username !== void 0 ? `username: ${username}` : `org: ${org}`}, github_token: ${describeSource(github_token)}) in ${path}.`);
+	yield* Console.log(`Created profile '${profile}' (${username !== void 0 ? `username: ${username}` : `org: ${org}`}, github_token: ${describeSource(github_token)}) in ${path}.`);
 });
 const createCommand = Command.make("create", {
 	profile: profileFlag,
@@ -141,14 +130,14 @@ const createCommand = Command.make("create", {
 const listHandler = Effect.gen(function* () {
 	const credentials = yield* (yield* ReposetsCredentialsFile).loadOrDefault(EMPTY);
 	if (Object.keys(credentials.profiles).length === 0) {
-		yield* Effect.log("No credential profiles configured.");
+		yield* Console.log("No credential profiles configured.");
 		return;
 	}
 	for (const [name, profile] of Object.entries(credentials.profiles)) {
 		const { owner, ownerType } = profileOwner(profile);
-		yield* Effect.log(`[${name}]`);
-		yield* Effect.log(`  acts as: ${owner} (${ownerType === "User" ? "user" : "organization"})`);
-		yield* Effect.log(`  github_token: ${describeSource(profile.github_token)}`);
+		yield* Console.log(`[${name}]`);
+		yield* Console.log(`  acts as: ${owner} (${ownerType === "User" ? "user" : "organization"})`);
+		yield* Console.log(`  github_token: ${describeSource(profile.github_token)}`);
 		for (const kind of [
 			"op",
 			"env",
@@ -156,9 +145,9 @@ const listHandler = Effect.gen(function* () {
 		]) {
 			const entries = profile.resolve?.[kind];
 			if (entries === void 0) continue;
-			for (const [label, reference] of Object.entries(entries)) yield* Effect.log(`  resolve.${kind}.${label}: ${reference}`);
+			for (const [label, reference] of Object.entries(entries)) yield* Console.log(`  resolve.${kind}.${label}: ${reference}`);
 		}
-		yield* Effect.log("");
+		yield* Console.log("");
 	}
 });
 const listCommand = Command.make("list", {}, () => listHandler).pipe(Command.withDescription("List credential profiles and the references they hold"));
@@ -171,13 +160,10 @@ const deleteHandler = (profile) => Effect.gen(function* () {
 	yield* (yield* AppDirs).ensureConfig;
 	const credentialsFile = yield* ReposetsCredentialsFile;
 	const credentials = yield* credentialsFile.loadOrDefault(EMPTY);
-	if (credentials.profiles[profile] === void 0) {
-		yield* Effect.logError(`Profile '${profile}' not found.`);
-		return;
-	}
+	if (credentials.profiles[profile] === void 0) return yield* refuse(`Profile '${profile}' not found.`);
 	const { [profile]: _removed, ...remaining } = credentials.profiles;
 	const path = yield* saveWhereRead(credentialsFile, { profiles: remaining });
-	yield* Effect.log(`Deleted profile '${profile}' from ${path}.`);
+	yield* Console.log(`Deleted profile '${profile}' from ${path}.`);
 });
 const deleteCommand = Command.make("delete", { profile: profileFlag }, ({ profile }) => deleteHandler(profile)).pipe(Command.withDescription("Remove a credential profile"));
 /**

package/cli/commands/doctor.js

@@ -1,14 +1,14 @@
 import { SettingsGroupSchema } from "../../schemas/config.js";
 import { profileOwner } from "../../schemas/credentials.js";
 import { CONFIG_FILENAME, CREDENTIALS_FILENAME, ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
-import { formatSchemaIssue } from "../../lib/schema-issues.js";
+import { Invocation } from "../../services/Invocation.js";
 import { OP_SERVICE_ACCOUNT_TOKEN, OnePasswordClientLive } from "../../services/OnePasswordClient.js";
 import { CredentialResolver, CredentialResolverLive } from "../../services/CredentialResolver.js";
 import { ConfigFlag } from "../flags.js";
-import { Effect, FileSystem, Layer, Option, Path, Result } from "effect";
-import { Command } from "effect/unstable/cli";
+import { Config, Console, Effect, FileSystem, Layer, Option, Path, Result } from "effect";
+import { SchemaIssueRenderer } from "@effected/cli";
+import { Command } from "effect/cli";
 import { AppDirs } from "@effected/xdg";
-import { cwd, env } from "node:process";
 import { GitHubClient } from "@effected/github";
 import { Toml } from "@effected/toml";
 
@@ -51,7 +51,7 @@ const KNOWN_GROUP_KEYS = /* @__PURE__ */ new Set([
 const REMOVED_KEYS = {
 	owner: "removed in 1.0 — the owner now belongs to the credential profile, which declares `username` or `org`",
 	"owner (in groups)": "removed in 1.0 — a group's owner comes from the profile named by its `credentials`, so a group cannot override it",
-	log_level: "removed in 1.0 — output is one level; use --debug for diagnostics, or core's --log-level to filter by severity"
+	log_level: "removed in 1.0 — output is one level; use --debug for diagnostics, or redirect stdout to quieten a run"
 };
 /**
 * The settings fields the schema names, derived rather than listed.
@@ -202,10 +202,10 @@ const findClosestMatch = (key, known) => {
 * `appDirs.dirs.config` rather than `ensureConfig`: the latter *creates* the
 * directory, and a read-only diagnostic must not.
 */
-const locateConfig = (fs, path, appDirs, configFlag) => Effect.gen(function* () {
+const locateConfig = (fs, path, appDirs, configFlag, cwd) => Effect.gen(function* () {
 	const candidates = [];
 	if (configFlag !== void 0) candidates.push(configFlag, path.join(configFlag, CONFIG_FILENAME));
-	let dir = cwd();
+	let dir = cwd;
 	for (;;) {
 		candidates.push(path.join(dir, CONFIG_FILENAME));
 		const parent = path.dirname(dir);
@@ -233,6 +233,12 @@ const isRecord = (value) => typeof value === "object" && value !== null && !Arra
 * *names* — and whether the 1Password service account variable is present. It
 * never resolves a reference, so there is no value in scope to leak.
 *
+* The report — failing sections included — is the command's output and goes to
+* stdout in one piece, so `reposets doctor > report.txt` captures all of it.
+* Only the three early stops (no config, unreadable, unparseable) are
+* diagnostics on stderr. `doctor` always exits 0: it describes, it does not
+* gate — `validate` is the gate.
+*
 * @public
 */
 /**
@@ -280,16 +286,17 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const appDirs = yield* AppDirs;
+	const invocation = yield* Invocation;
 	const discovered = yield* configFile.discover.pipe(Effect.result);
 	const sources = discovered._tag === "Success" ? discovered.success : [];
 	const schemaValid = discovered._tag === "Success" && sources.length > 0;
 	const validationIssue = discovered._tag === "Failure" ? discovered.failure.issue : void 0;
-	const configPath = sources[0]?.path ?? (yield* locateConfig(fs, path, appDirs, configFlag));
+	const configPath = sources[0]?.path ?? (yield* locateConfig(fs, path, appDirs, configFlag, invocation.cwd));
 	if (configPath === void 0) {
 		yield* Effect.logError("No config found. Run 'reposets init' to create one.");
 		return;
 	}
-	yield* Effect.log(`Config: ${configPath}`);
+	yield* Console.log(`Config: ${configPath}`);
 	const text = yield* fs.readFileString(configPath).pipe(Effect.option);
 	if (text._tag === "None") {
 		yield* Effect.logError(`Could not read ${configPath}`);
@@ -308,13 +315,13 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 			if (known.has(key)) continue;
 			const removedFrom = REMOVED_KEYS[where === "" ? key : `${key} (in groups)`] ?? REMOVED_KEYS[key];
 			if (removedFrom !== void 0) {
-				yield* Effect.log(`Warning: '${key}'${where} ${removedFrom}`);
+				yield* Console.log(`Warning: '${key}'${where} ${removedFrom}`);
 				warnings += 1;
 				continue;
 			}
 			const suggestion = findClosestMatch(key, known);
 			const hint = suggestion === void 0 ? "" : ` — did you mean '${suggestion}'?`;
-			yield* Effect.log(`Warning: unknown key '${key}'${where}${hint}`);
+			yield* Console.log(`Warning: unknown key '${key}'${where}${hint}`);
 			warnings += 1;
 		}
 	});
@@ -326,7 +333,7 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 			if (KNOWN_SETTINGS_FIELDS.has(field)) continue;
 			const suggestion = findClosestMatch(field, KNOWN_SETTINGS_FIELDS);
 			const hint = suggestion === void 0 ? " — it will be sent to GitHub as-is, which ignores fields it does not recognise" : ` — did you mean '${suggestion}'?`;
-			yield* Effect.log(`Warning: unrecognised setting '${field}' in settings.${groupName}${hint}`);
+			yield* Console.log(`Warning: unrecognised setting '${field}' in settings.${groupName}${hint}`);
 			warnings += 1;
 		}
 	}
@@ -341,21 +348,21 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 		yield* checkKeys(cleanup.secrets, KNOWN_CLEANUP_SECRETS_KEYS, ` in ${prefix}.secrets`);
 		yield* checkKeys(cleanup.variables, KNOWN_CLEANUP_VARIABLES_KEYS, ` in ${prefix}.variables`);
 	}
-	if (schemaValid) yield* Effect.log("Schema validation: passed");
+	if (schemaValid) yield* Console.log("Schema validation: passed");
 	else {
-		yield* Effect.logError("Schema validation: FAILED — these values are rejected, not ignored");
-		for (const line of formatSchemaIssue(validationIssue)) yield* Effect.logError(`  ${line}`);
+		yield* Console.log("Schema validation: FAILED — these values are rejected, not ignored");
+		for (const line of SchemaIssueRenderer.render(validationIssue)) yield* Console.log(`  ${line}`);
 	}
-	yield* Effect.log("");
+	yield* Console.log("");
 	const loaded = yield* credentialsFile.loadOrDefault({ profiles: {} }).pipe(Effect.result);
 	const credentials = loaded._tag === "Success" ? loaded.success : { profiles: {} };
 	const profileNames = Object.keys(credentials.profiles);
 	if (loaded._tag === "Failure") {
-		yield* Effect.logError(`Credentials: FAILED to load — ${String(loaded.failure.message ?? loaded.failure)}`);
-		yield* Effect.logError("  Unknown keys are rejected. `op_service_account_token` was removed — that token now comes from OP_SERVICE_ACCOUNT_TOKEN in the environment.");
-	} else if (profileNames.length === 0) yield* Effect.log("Credentials: no profiles configured");
+		yield* Console.log(`Credentials: FAILED to load — ${String(loaded.failure.message ?? loaded.failure)}`);
+		yield* Console.log("  Unknown keys are rejected. `op_service_account_token` was removed — that token now comes from OP_SERVICE_ACCOUNT_TOKEN in the environment.");
+	} else if (profileNames.length === 0) yield* Console.log("Credentials: no profiles configured");
 	else {
-		yield* Effect.log(`Credentials: ${profileNames.length} profile(s)`);
+		yield* Console.log(`Credentials: ${profileNames.length} profile(s)`);
 		let usesOnePassword = false;
 		for (const [name, profile] of Object.entries(credentials.profiles)) {
 			const token = "op" in profile.github_token ? `op ${profile.github_token.op}` : `env ${profile.github_token.env}`;
@@ -373,45 +380,45 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 				}
 			}
 			const resolveSummary = sections.length === 0 ? "" : `, resolve ${sections.join(" ")}`;
-			yield* Effect.log(`  [${name}] github_token: ${token}${resolveSummary}`);
+			yield* Console.log(`  [${name}] github_token: ${token}${resolveSummary}`);
 		}
-		const hasServiceAccount = env["OP_SERVICE_ACCOUNT_TOKEN"] !== void 0 && env["OP_SERVICE_ACCOUNT_TOKEN"] !== "";
-		if (usesOnePassword) yield* Effect.log(hasServiceAccount ? `  ${OP_SERVICE_ACCOUNT_TOKEN}: set` : `  ${OP_SERVICE_ACCOUNT_TOKEN}: NOT SET — op:// references cannot be resolved`);
+		const hasServiceAccount = Option.isSome(yield* Config.option(Config.String(OP_SERVICE_ACCOUNT_TOKEN)).pipe(Effect.orElseSucceed(() => Option.none())));
+		if (usesOnePassword) yield* Console.log(hasServiceAccount ? `  ${OP_SERVICE_ACCOUNT_TOKEN}: set` : `  ${OP_SERVICE_ACCOUNT_TOKEN}: NOT SET — op:// references cannot be resolved`);
 	}
-	yield* Effect.log("");
-	yield* Effect.log(`Version: ${env.__PACKAGE_VERSION__ ?? "0.0.0 (dev build)"}`);
+	yield* Console.log("");
+	yield* Console.log(`Version: ${invocation.version}`);
 	const credentialDiscovery = yield* credentialsFile.discover.pipe(Effect.result);
 	const credentialSources = credentialDiscovery._tag === "Success" ? credentialDiscovery.success : [];
 	const credentialsLine = credentialDiscovery._tag === "Failure" ? "(failed to load — the error above names the file)" : credentialSources.length === 0 ? `${path.join(appDirs.dirs.config, CREDENTIALS_FILENAME)} (not created yet)` : credentialSources[0]?.path ?? "";
-	yield* Effect.log(`Credentials file: ${credentialsLine}`);
-	yield* Effect.log(`State database: ${path.join(appDirs.dirs.state, "store.db")}`);
-	yield* Effect.log("");
+	yield* Console.log(`Credentials file: ${credentialsLine}`);
+	yield* Console.log(`State database: ${path.join(appDirs.dirs.state, "store.db")}`);
+	yield* Console.log("");
 	for (const [name, profile] of Object.entries(credentials.profiles)) {
 		const resolverLayer = Layer.provide(CredentialResolverLive, OnePasswordClientLive);
 		const resolved = yield* Effect.gen(function* () {
 			return yield* (yield* CredentialResolver).resolveGitHubToken(profile);
 		}).pipe(Effect.provide(resolverLayer), Effect.result);
 		if (resolved._tag === "Failure") {
-			yield* Effect.logError(`Token [${name}]: could not resolve — ${String(resolved.failure)}`);
+			yield* Console.log(`Token [${name}]: could not resolve — ${String(resolved.failure)}`);
 			continue;
 		}
 		const identity = yield* Effect.gen(function* () {
 			return yield* (yield* GitHubClient).request("GET /user", {});
 		}).pipe(Effect.provide(GitHubClient.layerFromToken({ token: resolved.success })), Effect.result);
 		if (identity._tag !== "Success") {
-			yield* Effect.logError(`Token [${name}]: resolved but REJECTED by GitHub — ${String(identity.failure)}`);
+			yield* Console.log(`Token [${name}]: resolved but REJECTED by GitHub — ${String(identity.failure)}`);
 			continue;
 		}
 		const line = describeIdentity(name, profile, identity.success.login);
-		yield* line.ok ? Effect.log(line.text) : Effect.logError(line.text);
+		yield* Console.log(line.text);
 	}
-	yield* Effect.log("");
-	yield* Effect.log("Required fine-grained token permissions:");
-	for (const [scope, permission, why] of REQUIRED_PERMISSIONS) yield* Effect.log(`  ${scope} > ${permission} — ${why}`);
-	yield* Effect.log("  (Metadata: Read is mandatory and granted automatically)");
-	yield* Effect.log("  These are NOT verified — GitHub does not expose a fine-grained token's own scopes.");
-	yield* Effect.log("");
-	yield* Effect.log(warnings === 0 ? "No unknown keys detected." : `${warnings} warning(s) found.`);
+	yield* Console.log("");
+	yield* Console.log("Required fine-grained token permissions:");
+	for (const [scope, permission, why] of REQUIRED_PERMISSIONS) yield* Console.log(`  ${scope} > ${permission} — ${why}`);
+	yield* Console.log("  (Metadata: Read is mandatory and granted automatically)");
+	yield* Console.log("  These are NOT verified — GitHub does not expose a fine-grained token's own scopes.");
+	yield* Console.log("");
+	yield* Console.log(warnings === 0 ? "No unknown keys detected." : `${warnings} warning(s) found.`);
 });
 /**
 * `reposets doctor`.

package/cli/commands/drift.js

@@ -1,6 +1,6 @@
 import { syncHandler } from "./sync.js";
 import { Option } from "effect";
-import { Command, Flag } from "effect/unstable/cli";
+import { Command, Flag } from "effect/cli";
 
 //#region src/cli/commands/drift.ts
 /**

package/cli/commands/history.js

@@ -1,6 +1,6 @@
 import { SyncJournal } from "../../store/SyncJournal.js";
-import { Effect } from "effect";
-import { Command, Flag } from "effect/unstable/cli";
+import { Console, Effect } from "effect";
+import { CliError, Command, Flag } from "effect/cli";
 
 //#region src/cli/commands/history.ts
 const limitFlag = Flag.Int("limit").pipe(Flag.withDefault(20), Flag.withDescription("How many runs to show, newest first"));
@@ -42,7 +42,7 @@ const pad = (value, width) => value.padEnd(width);
 *
 * @remarks
 * Computed rather than fixed because group names and repository names are
-* user-supplied and unbounded. The `CliLogger` emits each line verbatim, so
+* user-supplied and unbounded. Each line is written verbatim to stdout, so
 * alignment computed here survives to the terminal.
 */
 const renderRows = (summaries) => {
@@ -87,14 +87,11 @@ const historyHandler = (input) => Effect.gen(function* () {
 		...input.repo === void 0 ? {} : { repo: input.repo }
 	});
 	if (summaries.length === 0) {
-		yield* Effect.log(input.repo === void 0 ? "No runs recorded yet. The journal fills in as you sync." : `No recorded run has touched ${input.repo}.`);
+		yield* Console.log(input.repo === void 0 ? "No runs recorded yet. The journal fills in as you sync." : `No recorded run has touched ${input.repo}.`);
 		return;
 	}
-	for (const line of renderRows(summaries)) yield* Effect.log(line);
-	if (summaries.length === input.limit) {
-		yield* Effect.log("");
-		yield* Effect.log(`Showing the most recent ${input.limit}. Pass --limit for more.`);
-	}
+	for (const line of renderRows(summaries)) yield* Console.log(line);
+	if (summaries.length === input.limit) yield* Effect.log(`Showing the most recent ${input.limit}. Pass --limit for more.`);
 });
 /**
 * The present-tense form of a stored action, for a dry run.
@@ -118,32 +115,22 @@ const wouldForm = (action) => action === "created" ? "create" : action === "upda
 const showHandler = (prefix) => Effect.gen(function* () {
 	const journal = yield* SyncJournal;
 	const matches = (yield* journal.history({ limit: 1e3 }).pipe(Effect.orElseSucceed(() => []))).filter((run) => run.id.startsWith(prefix));
-	if (matches.length === 0) {
-		yield* Effect.logError(`No run matches '${prefix}'.`);
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
-	}
+	if (matches.length === 0) return yield* Effect.fail(new CliError.UserError({ cause: `No run matches '${prefix}'.` }));
 	if (matches.length > 1) {
-		yield* Effect.logError(`'${prefix}' matches ${matches.length} runs. Use more of the id:`);
-		for (const run of matches.slice(0, 5)) yield* Effect.logError(`  ${run.id}  ${formatWhen(run.startedAt)}`);
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
+		const candidates = matches.slice(0, 5).map((run) => `  ${run.id}  ${formatWhen(run.startedAt)}`);
+		return yield* Effect.fail(new CliError.UserError({ cause: [`'${prefix}' matches ${matches.length} runs. Use more of the id:`, ...candidates].join("\n") }));
 	}
 	const run = matches[0];
 	const changes = yield* journal.changesFor(run.id).pipe(Effect.orElseSucceed(() => []));
-	yield* Effect.log(`run ${run.id}`);
-	yield* Effect.log(`  ${formatWhen(run.startedAt)} · ${run.dryRun === 1 ? "dry-run" : "applied"} · ${run.outcome ?? "unfinished"} · ${formatDuration(run)}`);
-	yield* Effect.log("");
+	yield* Console.log(`run ${run.id}`);
+	yield* Console.log(`  ${formatWhen(run.startedAt)} · ${run.dryRun === 1 ? "dry-run" : "applied"} · ${run.outcome ?? "unfinished"} · ${formatDuration(run)}`);
+	yield* Console.log("");
 	if (run.error !== null && run.error !== "") {
-		yield* Effect.log(`  error: ${run.error}`);
-		yield* Effect.log("");
+		yield* Console.log(`  error: ${run.error}`);
+		yield* Console.log("");
 	}
 	if (changes.length === 0) {
-		yield* Effect.log(run.error !== null && run.error !== "" ? "  No resources changed." : "  No resources changed (nothing to do).");
+		yield* Console.log(run.error !== null && run.error !== "" ? "  No resources changed." : "  No resources changed (nothing to do).");
 		return;
 	}
 	const byRepo = /* @__PURE__ */ new Map();
@@ -153,12 +140,12 @@ const showHandler = (prefix) => Effect.gen(function* () {
 		else existing.push(change);
 	}
 	for (const [repo, records] of byRepo) {
-		yield* Effect.log(`  ${repo}`);
+		yield* Console.log(`  ${repo}`);
 		for (const record of records) {
 			const detail = record.detail === void 0 || record.detail === null ? "" : ` — ${record.detail}`;
 			const what = record.kind === record.name ? record.kind : `${record.kind} ${record.name}`;
 			const action = run.dryRun === 1 ? `would ${wouldForm(record.action)}` : record.action;
-			yield* Effect.log(`    ${action.padEnd(18)} ${what}${detail}`);
+			yield* Console.log(`    ${action.padEnd(18)} ${what}${detail}`);
 		}
 	}
 });
@@ -174,13 +161,13 @@ const showHandler = (prefix) => Effect.gen(function* () {
 */
 const pruneHandler = (keep) => Effect.gen(function* () {
 	const removed = yield* (yield* SyncJournal).prune(keep).pipe(Effect.orElseSucceed(() => 0));
-	yield* Effect.log(removed === 0 ? `Nothing to prune; ${keep} or fewer runs are recorded.` : `Pruned ${removed} run${removed === 1 ? "" : "s"}, keeping the newest ${keep}.`);
-	yield* Effect.log("Applied state and the cache are untouched — drift detection still works.");
+	yield* Console.log(removed === 0 ? `Nothing to prune; ${keep} or fewer runs are recorded.` : `Pruned ${removed} run${removed === 1 ? "" : "s"}, keeping the newest ${keep}.`);
+	yield* Console.log("Applied state and the cache are untouched — drift detection still works.");
 });
 const clearHandler = () => Effect.gen(function* () {
 	const removed = yield* (yield* SyncJournal).clear().pipe(Effect.orElseSucceed(() => 0));
-	yield* Effect.log(`Cleared ${removed} run${removed === 1 ? "" : "s"} from the journal.`);
-	yield* Effect.log("Applied state and the cache are untouched — drift detection still works.");
+	yield* Console.log(`Cleared ${removed} run${removed === 1 ? "" : "s"} from the journal.`);
+	yield* Console.log("Applied state and the cache are untouched — drift detection still works.");
 });
 /**
 * `reposets history`.