reposets 1.0.21 → 2.0.1

package/cli/commands/init.js

@@ -1,8 +1,9 @@
 import { CONFIG_FILENAME, CREDENTIALS_FILENAME } from "../../services/ConfigFiles.js";
-import { Effect, FileSystem, Path } from "effect";
-import { Command, Flag } from "effect/unstable/cli";
+import { Invocation } from "../../services/Invocation.js";
+import { Console, Effect, FileSystem, Path } from "effect";
+import { CliExit } from "@effected/cli";
+import { Command, Flag } from "effect/cli";
 import { AppDirs } from "@effected/xdg";
-import { cwd } from "node:process";
 
 //#region src/cli/commands/init.ts
 const projectFlag = Flag.Boolean("project").pipe(Flag.withDefault(false), Flag.withDescription("Scaffold into the current directory instead of the XDG config directory"));
@@ -111,32 +112,41 @@ const CREDENTIALS_TEMPLATE = `# reposets credentials
 * references and so is not catastrophic to commit, but it still names a
 * person's vault layout, and the habit is worth keeping.
 *
+* What was created or found goes to stdout; the next-steps guidance to stderr.
+* A file that could not be written is reported on stderr and exits 1.
+*
 * @public
 */
 const initHandler = (project) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const appDirs = yield* AppDirs;
-	const targetDir = project ? cwd() : yield* appDirs.ensureConfig;
+	const targetDir = project ? (yield* Invocation).cwd : yield* appDirs.ensureConfig;
 	yield* fs.makeDirectory(targetDir, { recursive: true });
+	/**
+	* A write that fails is a real failure of this command — the user asked
+	* for a file and did not get one — so it is reported on stderr and the
+	* run exits 1 through `CliExit`. The remaining files are still attempted:
+	* one unwritable path should not hide what else did or did not happen.
+	*/
+	const failed = (target) => Effect.logError(`Could not write: ${target}`).pipe(Effect.andThen(CliExit.set(1)));
 	/** Write a file unless it is already there; report either way. */
 	const scaffold = (name, contents) => Effect.gen(function* () {
 		const target = path.join(targetDir, name);
 		if (yield* fs.exists(target).pipe(Effect.orElseSucceed(() => false))) {
-			yield* Effect.log(`Already exists: ${target}`);
+			yield* Console.log(`Already exists: ${target}`);
 			return;
 		}
-		yield* (yield* fs.writeFileString(target, contents).pipe(Effect.option))._tag === "Some" ? Effect.log(`Created: ${target}`) : Effect.logError(`Could not write: ${target}`);
+		yield* (yield* fs.writeFileString(target, contents).pipe(Effect.option))._tag === "Some" ? Console.log(`Created: ${target}`) : failed(target);
 	});
 	yield* scaffold(CONFIG_FILENAME, CONFIG_TEMPLATE);
 	yield* scaffold(CREDENTIALS_FILENAME, CREDENTIALS_TEMPLATE);
 	const gitignorePath = path.join(targetDir, ".gitignore");
 	const existing = yield* fs.readFileString(gitignorePath).pipe(Effect.orElseSucceed(() => void 0));
-	if (existing === void 0) {
-		if ((yield* fs.writeFileString(gitignorePath, `${"reposets.credentials.toml"}\n`).pipe(Effect.option))._tag === "Some") yield* Effect.log(`Created .gitignore with ${CREDENTIALS_FILENAME}`);
-	} else if (!existing.includes("reposets.credentials.toml")) {
+	if (existing === void 0) yield* (yield* fs.writeFileString(gitignorePath, `${"reposets.credentials.toml"}\n`).pipe(Effect.option))._tag === "Some" ? Console.log(`Created .gitignore with ${CREDENTIALS_FILENAME}`) : failed(gitignorePath);
+	else if (!existing.includes("reposets.credentials.toml")) {
 		const separator = existing.endsWith("\n") ? "" : "\n";
-		if ((yield* fs.writeFileString(gitignorePath, `${existing}${separator}${"reposets.credentials.toml"}\n`).pipe(Effect.option))._tag === "Some") yield* Effect.log(`Added ${CREDENTIALS_FILENAME} to .gitignore`);
+		yield* (yield* fs.writeFileString(gitignorePath, `${existing}${separator}${"reposets.credentials.toml"}\n`).pipe(Effect.option))._tag === "Some" ? Console.log(`Added ${CREDENTIALS_FILENAME} to .gitignore`) : failed(gitignorePath);
 	}
 	yield* Effect.log("");
 	yield* Effect.log("Done. Edit the config, then add a credential reference with:");

package/cli/commands/list.js

@@ -1,7 +1,8 @@
 import { profileOwner } from "../../schemas/credentials.js";
 import { ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
-import { Effect } from "effect";
-import { Command } from "effect/unstable/cli";
+import { Console, Effect } from "effect";
+import { CliExit } from "@effected/cli";
+import { Command } from "effect/cli";
 
 //#region src/cli/commands/list.ts
 /** `secrets` and `variables` render the same way; only the scope names differ. */
@@ -26,7 +27,8 @@ const scopeParts = (scopes) => {
 * A reading command: it decodes the config and prints its structure, touching
 * neither GitHub nor the store. Empty collections are omitted rather than
 * printed as `(none)` — a group that assigns nothing should read as a short
-* entry, not a wall of blanks.
+* entry, not a wall of blanks. The summary is the command's output, so it is
+* written to stdout.
 *
 * @public
 */
@@ -35,28 +37,28 @@ const listHandler = Effect.gen(function* () {
 	const credentialsFile = yield* ReposetsCredentialsFile;
 	if ((yield* configFile.discover).length === 0) {
 		yield* Effect.logError("No config file found. Run 'reposets init' to create one.");
-		return;
+		return yield* CliExit.set(1);
 	}
 	const config = yield* configFile.load;
 	const credentials = yield* credentialsFile.loadOrDefault({ profiles: {} });
 	for (const [groupName, group] of Object.entries(config.groups)) {
 		const profile = credentials.profiles[group.credentials];
 		const acts = profile === void 0 ? `credentials: ${group.credentials} — NOT FOUND` : `owner: ${profileOwner(profile).owner}, credentials: ${group.credentials}`;
-		yield* Effect.log(`[${groupName}] (${acts})`);
+		yield* Console.log(`[${groupName}] (${acts})`);
 		const owner = profile === void 0 ? "(unknown)" : profileOwner(profile).owner;
-		for (const repo of group.repos) yield* Effect.log(`  - ${owner}/${repo}`);
+		for (const repo of group.repos) yield* Console.log(`  - ${owner}/${repo}`);
 		for (const [label, names] of [
 			["settings", group.settings],
 			["environments", group.environments],
 			["rulesets", group.rulesets],
 			["security", group.security],
 			["code_scanning", group.code_scanning]
-		]) if (names !== void 0 && names.length > 0) yield* Effect.log(`  ${label}: ${names.join(", ")}`);
+		]) if (names !== void 0 && names.length > 0) yield* Console.log(`  ${label}: ${names.join(", ")}`);
 		const secrets = scopeParts(group.secrets);
-		if (secrets.length > 0) yield* Effect.log(`  secrets: ${secrets.join(", ")}`);
+		if (secrets.length > 0) yield* Console.log(`  secrets: ${secrets.join(", ")}`);
 		const variables = scopeParts(group.variables);
-		if (variables.length > 0) yield* Effect.log(`  variables: ${variables.join(", ")}`);
-		yield* Effect.log("");
+		if (variables.length > 0) yield* Console.log(`  variables: ${variables.join(", ")}`);
+		yield* Console.log("");
 	}
 });
 /**

package/cli/commands/nuke.js

@@ -1,6 +1,8 @@
 import { CONFIG_FILENAME, CREDENTIALS_FILENAME } from "../../services/ConfigFiles.js";
-import { Effect, FileSystem, Path } from "effect";
-import { Command, Flag, Prompt } from "effect/unstable/cli";
+import { Invocation } from "../../services/Invocation.js";
+import { Console, Effect, FileSystem, Path, Stdio } from "effect";
+import { CliExit } from "@effected/cli";
+import { CliError, Command, Flag, Prompt } from "effect/cli";
 import { AppDirs } from "@effected/xdg";
 
 //#region src/cli/commands/nuke.ts
@@ -76,30 +78,24 @@ const nukeHandler = (force) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const appDirs = yield* AppDirs;
-	const targets = yield* findTargets(fs, path, appDirs, process.cwd());
+	const { cwd } = yield* Invocation;
+	const targets = yield* findTargets(fs, path, appDirs, cwd);
 	if (targets.length === 0) {
-		yield* Effect.log("Nothing to remove — no reposets files found on this machine.");
+		yield* Console.log("Nothing to remove — no reposets files found on this machine.");
 		return;
 	}
-	yield* Effect.log("This will delete:");
+	yield* Console.log("This will delete:");
 	for (const target of targets) {
-		yield* Effect.log(`  ${target.path}`);
-		yield* Effect.log(`    ${target.what} — loses ${target.cost}`);
+		yield* Console.log(`  ${target.path}`);
+		yield* Console.log(`    ${target.what} — loses ${target.cost}`);
 	}
-	yield* Effect.log("");
-	yield* Effect.log("Nothing on GitHub is touched. Everything reposets applied stays applied.");
+	yield* Console.log("");
+	yield* Console.log("Nothing on GitHub is touched. Everything reposets applied stays applied.");
 	if (!force) {
-		if (process.stdin.isTTY !== true) {
-			yield* Effect.logError("");
-			yield* Effect.logError("Refusing: not an interactive terminal, and --force was not given.");
-			yield* Effect.sync(() => {
-				process.exitCode = 1;
-			});
-			return;
-		}
-		yield* Effect.log("");
+		if (!(yield* (yield* Stdio.Stdio).stdinIsTerminal)) return yield* Effect.fail(new CliError.UserError({ cause: "Refusing: not an interactive terminal, and --force was not given." }));
+		yield* Console.log("");
 		if (!(yield* Prompt.Confirm({ message: `Delete ${targets.length} file${targets.length === 1 ? "" : "s"}?` }).pipe(Effect.orElseSucceed(() => false)))) {
-			yield* Effect.log("Nothing was deleted.");
+			yield* Console.log("Nothing was deleted.");
 			return;
 		}
 	}
@@ -111,10 +107,11 @@ const nukeHandler = (force) => Effect.gen(function* () {
 			continue;
 		}
 		removed += 1;
-		yield* Effect.log(`  removed ${target.path}`);
+		yield* Console.log(`  removed ${target.path}`);
 	}
-	yield* Effect.log("");
-	yield* Effect.log(removed === targets.length ? `Done. ${removed} file${removed === 1 ? "" : "s"} removed.` : `Removed ${removed} of ${targets.length}; the rest are listed above.`);
+	yield* Console.log("");
+	yield* Console.log(removed === targets.length ? `Done. ${removed} file${removed === 1 ? "" : "s"} removed.` : `Removed ${removed} of ${targets.length}; the rest are listed above.`);
+	if (removed < targets.length) yield* CliExit.set(1);
 });
 /**
 * The `nuke` command.

package/cli/commands/sync.js

@@ -1,5 +1,4 @@
 import { ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
-import { formatSchemaIssue } from "../../lib/schema-issues.js";
 import { SyncJournal, SyncJournalLive } from "../../store/SyncJournal.js";
 import { OnePasswordClientLive } from "../../services/OnePasswordClient.js";
 import { CredentialResolver, CredentialResolverLive } from "../../services/CredentialResolver.js";
@@ -10,8 +9,9 @@ import { RepoCacheLive } from "../../store/RepoCache.js";
 import { PHASE_NAMES } from "../../sync/phase.js";
 import { allPhases } from "../../sync/phases/index.js";
 import { SyncEngine, SyncEngineLive } from "../../sync/SyncEngine.js";
-import { Effect, Layer, Option } from "effect";
-import { Command, Flag } from "effect/unstable/cli";
+import { Console, Effect, Layer, Option } from "effect";
+import { CliExit } from "@effected/cli";
+import { CliError, Command, Flag } from "effect/cli";
 import { CodeScanning, DeploymentEnvironment, GitHubClient, GitHubRepository, RepositorySecret, RepositorySecurity, RepositoryVariable, Ruleset, WorkflowDispatch } from "@effected/github";
 
 //#region src/cli/commands/sync.ts
@@ -71,39 +71,18 @@ const partitionByProfile = (groups, only) => {
 * @public
 */
 const syncHandler = (input) => Effect.gen(function* () {
+	const badPhases = [...unknownPhases(input.only), ...unknownPhases(input.skip)];
+	if (badPhases.length > 0) return yield* Effect.fail(new CliError.UserError({ cause: `Unknown phase name(s): ${badPhases.join(", ")}. Valid phases: ${PHASE_NAMES.join(", ")}. Nothing was synced.` }));
 	const configFile = yield* ReposetsConfigFile;
 	const credentialsFile = yield* ReposetsCredentialsFile;
-	const discovered = yield* configFile.discover.pipe(Effect.result);
-	if (discovered._tag === "Failure") {
-		yield* Effect.logError(String(discovered.failure));
-		const failure = discovered.failure;
-		for (const line of formatSchemaIssue(failure.issue)) yield* Effect.logError(`  ${line}`);
-		if (failure.cause !== void 0) yield* Effect.logError(`  ${String(failure.cause)}`);
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
-	}
-	const source = discovered.success[0];
+	const source = (yield* configFile.discover)[0];
 	if (source === void 0) {
 		yield* Effect.logError("No config found. Run 'reposets init' to create one.");
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
+		return yield* CliExit.set(1);
 	}
 	const config = source.value;
 	const configDir = source.path.slice(0, source.path.lastIndexOf("/"));
 	const credentials = yield* credentialsFile.loadOrDefault({ profiles: {} });
-	const badPhases = [...unknownPhases(input.only), ...unknownPhases(input.skip)];
-	if (badPhases.length > 0) {
-		yield* Effect.logError(`Unknown phase name(s): ${badPhases.join(", ")}. Valid phases: ${PHASE_NAMES.join(", ")}`);
-		yield* Effect.logError("Nothing was synced.");
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
-	}
 	const dangling = danglingReferences(config);
 	if (dangling.length > 0) {
 		yield* Effect.logError("Config references sections that do not exist:");
@@ -113,18 +92,13 @@ const syncHandler = (input) => Effect.gen(function* () {
 		}
 		yield* Effect.logError("");
 		yield* Effect.logError("Nothing was synced. Fix the references or run 'reposets validate' for the full list.");
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
+		return yield* CliExit.set(1);
 	}
 	const partitions = partitionByProfile(config.groups, input.group);
 	if (partitions.size === 0) {
-		yield* Effect.logError(input.group === void 0 ? "No groups configured. Add a [groups.<name>] section to sync anything." : `No group named '${input.group}'. Configured: ${Object.keys(config.groups).join(", ") || "none"}`);
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
+		if (input.group !== void 0) return yield* Effect.fail(new CliError.UserError({ cause: `No group named '${input.group}'. Configured: ${Object.keys(config.groups).join(", ") || "none"}` }));
+		yield* Effect.logError("No groups configured. Add a [groups.<name>] section to sync anything.");
+		return yield* CliExit.set(1);
 	}
 	const resolverLayer = Layer.provide(CredentialResolverLive, OnePasswordClientLive);
 	const loggerLayer = SyncLoggerLive({
@@ -196,10 +170,8 @@ const syncHandler = (input) => Effect.gen(function* () {
 			errors
 		};
 	}).pipe(Effect.provide(sharedLayer));
-	yield* Effect.log(`${report.repos} repo(s), ${report.changes} change(s), ${report.drifted} drifted, ${report.errors} error(s)`);
-	if (report.errors > 0 || input.failOnDrift && report.drifted > 0) yield* Effect.sync(() => {
-		process.exitCode = 1;
-	});
+	yield* Console.log(`${report.repos} repo(s), ${report.changes} change(s), ${report.drifted} drifted, ${report.errors} error(s)`);
+	if (report.errors > 0 || input.failOnDrift && report.drifted > 0) yield* CliExit.set(1);
 });
 /**
 * The `sync` command.

package/cli/commands/validate.js

@@ -2,8 +2,9 @@ import { ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/Conf
 import { danglingReferences } from "../../lib/config-refs.js";
 import { undefinedCredentialLabels } from "../../lib/credential-labels.js";
 import { orgOnlyViolations } from "../../lib/org-only.js";
-import { Effect } from "effect";
-import { Command } from "effect/unstable/cli";
+import { Console, Effect } from "effect";
+import { CliExit } from "@effected/cli";
+import { Command } from "effect/cli";
 
 //#region src/cli/commands/validate.ts
 /**
@@ -18,9 +19,14 @@ import { Command } from "effect/unstable/cli";
 * The handler simply *requires* `ReposetsConfigFile`; how it gets built from
 * `--config` is the root command's business, not this command's.
 *
+* The success result goes to stdout. A reference or credential problem is a
+* finding, not a failure: the details go to stderr and the command succeeds
+* with `CliExit.set(1)`. A file that does not decode fails `discover`, and the
+* entrypoint's renderer prints the issue lines and exits `1`.
+*
 * @public
 */
-const validateCommand = Command.make("validate", {}, () => Effect.gen(function* () {
+const validateHandler = Effect.gen(function* () {
 	const configFile = yield* ReposetsConfigFile;
 	const credentialsFile = yield* ReposetsCredentialsFile;
 	const sources = yield* configFile.discover;
@@ -33,10 +39,7 @@ const validateCommand = Command.make("validate", {}, () => Effect.gen(function*
 			const defined = ref.defined.length === 0 ? "none defined" : `defined: ${ref.defined.join(", ")}`;
 			yield* Effect.logError(`  ${ref.where}: '${ref.name}' does not exist — ${defined}`);
 		}
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
+		return yield* CliExit.set(1);
 	}
 	const labels = undefinedCredentialLabels(value, credentials);
 	const violations = orgOnlyViolations(value, credentials);
@@ -45,25 +48,25 @@ const validateCommand = Command.make("validate", {}, () => Effect.gen(function*
 		for (const label of labels) yield* Effect.logError(`  [${label.group}] ${label.where}: credential label '${label.label}' is not declared in profile '${label.profile}'`);
 		yield* Effect.logError("");
 		yield* Effect.logError("Add it to that profile's [resolve] section in reposets.credentials.toml, or correct the name.");
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
+		return yield* CliExit.set(1);
 	}
 	if (violations.length > 0) {
 		yield* Effect.logError(`Invalid: ${sources[0]?.path ?? "config"}`);
 		for (const violation of violations) yield* Effect.logError(`  [${violation.group}] ${violation.where}: ${violation.detail}, but profile '${violation.profile}' is a personal account`);
 		yield* Effect.logError("");
 		yield* Effect.logError("Either move these repositories to a profile declaring `org`, or drop the settings.");
-		yield* Effect.sync(() => {
-			process.exitCode = 1;
-		});
-		return;
+		return yield* CliExit.set(1);
 	}
 	const groups = Object.keys(value.groups).length;
-	yield* Effect.log(`Valid: ${sources[0]?.path ?? "config"}`);
-	yield* Effect.log(`  groups: ${groups === 0 ? "none declared yet" : String(groups)}`);
-})).pipe(Command.withDescription("Validate reposets.config.toml against the schema"));
+	yield* Console.log(`Valid: ${sources[0]?.path ?? "config"}`);
+	yield* Console.log(`  groups: ${groups === 0 ? "none declared yet" : String(groups)}`);
+});
+/**
+* The `validate` command.
+*
+* @public
+*/
+const validateCommand = Command.make("validate", {}, () => validateHandler).pipe(Command.withDescription("Validate reposets.config.toml against the schema"));
 
 //#endregion
-export { validateCommand };
+export { validateCommand, validateHandler };

package/cli/flags.js

@@ -1,6 +1,6 @@
 import { makeConfigFilesLive } from "../services/ConfigFiles.js";
 import { Effect, Layer, Option } from "effect";
-import { Flag, GlobalFlag } from "effect/unstable/cli";
+import { Flag, GlobalFlag } from "effect/cli";
 
 //#region src/cli/flags.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "reposets",
-	"version": "1.0.21",
+	"version": "2.0.1",
 	"private": false,
 	"description": "CLI tool to sync GitHub repo settings, secrets and rulesets across personal repositories",
 	"keywords": [
@@ -48,15 +48,16 @@
 	},
 	"dependencies": {
 		"@1password/sdk": "^0.5.0",
-		"@effect/platform-node": "4.0.0-rc.117",
-		"@effected/app": "^0.18.0",
-		"@effected/config-file": "^0.12.0",
-		"@effected/github": "^0.13.0",
-		"@effected/store": "^0.10.0",
-		"@effected/toml": "^0.9.0",
-		"@effected/xdg": "^0.7.0",
+		"@effect/platform-node": "4.0.0-rc.118",
+		"@effected/app": "^0.19.0",
+		"@effected/cli": "^0.10.0",
+		"@effected/config-file": "^0.13.0",
+		"@effected/github": "^0.14.0",
+		"@effected/store": "^0.11.0",
+		"@effected/toml": "^0.10.0",
+		"@effected/xdg": "^0.8.0",
 		"blakejs": "^1.2.1",
-		"effect": "4.0.0-rc.117"
+		"effect": "4.0.0-rc.118"
 	},
 	"engines": {
 		"node": ">=24.11.0"

package/services/CredentialResolver.js

@@ -1,6 +1,5 @@
 import { OnePasswordClient } from "./OnePasswordClient.js";
-import { Context, Data, Effect, Layer, Redacted } from "effect";
-import { env } from "node:process";
+import { Config, Context, Data, Effect, Layer, Option, Redacted } from "effect";
 import { readFileSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
 
@@ -23,15 +22,28 @@ var ResolveError = class extends Data.TaggedError("ResolveError") {
 		return `Failed to resolve '${this.label}' from ${this.source}: ${this.reason}`;
 	}
 };
-/** Read an environment variable, failing in terms of its name. */
-const fromEnv = (label, variable) => Effect.suspend(() => {
-	const value = env[variable];
-	return value === void 0 ? Effect.fail(new ResolveError({
+/**
+* Read an environment variable, failing in terms of its name.
+*
+* @remarks
+* Read through `Config`, so the value comes from the ambient `ConfigProvider` —
+* the process environment in the shipped bin, an explicit record in a test —
+* and never from `process` directly. The provider treats an empty variable as
+* absent, so `FOO=""` fails as "not set" rather than resolving to an empty
+* credential that would only fail later, against GitHub, with a worse message.
+*/
+const fromEnv = (label, variable) => Config.option(Config.String(variable)).pipe(Effect.mapError((error) => new ResolveError({
+	label,
+	source: "env",
+	reason: `could not read ${variable}: ${error.message}`
+})), Effect.flatMap(Option.match({
+	onNone: () => Effect.fail(new ResolveError({
 		label,
 		source: "env",
 		reason: `environment variable ${variable} is not set`
-	})) : Effect.succeed(Redacted.make(value, { label }));
-});
+	})),
+	onSome: (value) => Effect.succeed(Redacted.make(value, { label }))
+})));
 /** Read a file, failing in terms of its path. */
 const fromFile = (label, filePath, basePath) => Effect.try({
 	try: () => {

package/services/Invocation.js

@@ -0,0 +1,38 @@
+import { Context, Layer } from "effect";
+
+//#region src/services/Invocation.ts
+/**
+* The facts about this process a command needs, read once at the entrypoint.
+*
+* @remarks
+* Only the CLI entrypoint (`src/cli/index.ts`) reads `process`. Everything
+* below it receives the working directory and the build's version through this
+* service instead, so a handler can be driven by a test that hands it a
+* different directory without `process.chdir`.
+*
+* The environment is deliberately NOT here. Environment variables are read
+* through Effect's `Config`, which resolves them from the ambient
+* `ConfigProvider` — the process environment by default, an explicit record
+* under `ConfigProvider.layer` in a test. That is core's own seam for the
+* environment, and `@effected/xdg` already reads `HOME` and `XDG_*` through it;
+* a second, hand-rolled one here would let the two disagree.
+*
+* The whole shape is one immutable value with no behaviour, so `Layer.succeed`
+* is the complete double — there is nothing for a partial mock to stub. The
+* moment a method appears here it stops being a value and becomes a service.
+*
+* @public
+*/
+var Invocation = class extends Context.Service()("reposets/Invocation") {
+	/**
+	* A fixed invocation, for tests and for the entrypoint alike.
+	*
+	* @remarks
+	* Each call mints a fresh layer; bind the result to a `const` rather than
+	* calling this at more than one provide site.
+	*/
+	static layer = (value) => Layer.succeed(this, value);
+};
+
+//#endregion
+export { Invocation };

package/services/OnePasswordClient.js

@@ -1,5 +1,4 @@
-import { Context, Data, Effect, Layer, Redacted } from "effect";
-import { env } from "node:process";
+import { Config, Context, Data, Effect, Layer, Option, Redacted } from "effect";
 
 //#region src/services/OnePasswordClient.ts
 /**
@@ -23,14 +22,27 @@ var OnePasswordError = class extends Data.TaggedError("OnePasswordError") {
 		return `Failed to resolve ${this.reference}: ${this.reason}`;
 	}
 };
-/** Read the service account token, failing in terms of the reference that needed it. */
-const serviceAccountToken = (reference) => Effect.suspend(() => {
-	const token = env[OP_SERVICE_ACCOUNT_TOKEN];
-	return token === void 0 || token === "" ? Effect.fail(new OnePasswordError({
+/**
+* Read the service account token, failing in terms of the reference that needed it.
+*
+* @remarks
+* Read through `Config`, so it comes from the ambient `ConfigProvider` — the
+* process environment in the shipped bin, an explicit record in a test — and
+* never from `process` directly. The provider treats an empty variable as
+* absent, which is the answer wanted here too: an empty token authenticates
+* nothing. A provider that fails outright is reported the same way, naming the
+* variable, rather than escaping as a `ConfigError` this service never declared.
+*/
+const serviceAccountToken = (reference) => Config.option(Config.String(OP_SERVICE_ACCOUNT_TOKEN)).pipe(Effect.mapError((error) => new OnePasswordError({
+	reference,
+	reason: `could not read ${OP_SERVICE_ACCOUNT_TOKEN}: ${error.message}`
+})), Effect.flatMap(Option.match({
+	onNone: () => Effect.fail(new OnePasswordError({
 		reference,
 		reason: `${OP_SERVICE_ACCOUNT_TOKEN} is not set in the environment`
-	})) : Effect.succeed(token);
-});
+	})),
+	onSome: Effect.succeed
+})));
 /**
 * Resolves `op://` references through the 1Password SDK.
 *

package/services/SyncLogger.js

@@ -1,4 +1,4 @@
-import { Context, Effect, Layer, Ref } from "effect";
+import { Console, Context, Effect, Layer, Ref } from "effect";
 
 //#region src/services/SyncLogger.ts
 /** Plural forms the naive `+ "s"` gets wrong. */
@@ -41,9 +41,14 @@ function pluralize(resource, count) {
 * out-of-band edit happens to match the config. The tool has no work to do; the
 * human still changed something, and staying quiet would hide it.
 *
-* Lines are emitted with `Effect.log`, never `Console.log`: the CLI entrypoint
-* installs a logger that routes Effect's output, and a direct console write
-* would bypass both it and the filtering above.
+* **The report is the product; failures are diagnostics.** What a run did —
+* group and repository headers, every operation, every drift line, the closing
+* "Sync complete!" — is the output of `sync` and `drift`, so it is written with
+* `Console.log` to stdout, where `reposets drift > report.txt` captures it.
+* Failures are emitted with `Effect.logError`, which the CLI logger
+* (`CliLogger.layer()`) routes to stderr, so they stay on the terminal when
+* stdout is redirected. A consequence worth knowing: `--log-level` filters
+* diagnostics only — it no longer silences the report.
 *
 * @public
 */
@@ -63,7 +68,7 @@ function SyncLoggerLive(config) {
 	return Layer.effect(SyncLogger, Effect.gen(function* () {
 		const errors = yield* Ref.make([]);
 		const currentRepo = yield* Ref.make("");
-		const emit = (line) => Effect.log(line);
+		const emit = (line) => Console.log(line);
 		/**
 		* Failures, on the error channel.
 		*

package/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.59.2"
+      "packageVersion": "7.59.1"
     }
   ]
 }

package/cli/logger.js

@@ -1,48 +0,0 @@
-import { Console, LogLevel, Logger } from "effect";
-
-//#region src/cli/logger.ts
-/**
-* Renders one log record as a plain CLI line.
-*
-* @remarks
-* Effect's default logger emits `[23:04:05.891] INFO (#2): message`, which is
-* the right shape for a service and the wrong one for a command-line tool: the
-* timestamp, level and fiber id are noise in front of output a human is reading,
-* and they make a formatted block — `doctor`'s permission table, for instance —
-* unreadable.
-*
-* A message that is an array is joined with a space, matching how `Effect.log`
-* accepts variadic parts.
-*/
-const render = (message) => Array.isArray(message) ? message.map(String).join(" ") : String(message);
-/**
-* The CLI's output logger: plain lines, errors on stderr.
-*
-* @remarks
-* Routing by level is the contract `SyncLogger` is written against — it emits
-* failures with `Effect.logError` precisely so that `reposets sync > log.txt`
-* still shows them on the terminal while the log captures progress. Without a
-* logger that honors the distinction, that choice does nothing.
-*
-* `Logger.layer` replaces the default logger rather than merging with it, so
-* nothing is emitted twice.
-*
-* A `Logger`'s callback is **synchronous**, so it cannot yield an `Effect` and
-* therefore cannot reach `Stdio`'s sinks. The way out is not to write to
-* `process.stdout` — it is the one core's own loggers take: read the `Console`
-* off the fiber. `Console.Console` is a `Context.Reference`, so it carries a
-* default and never appears in `R`, and a test swaps the reference instead of
-* stubbing a global.
-*
-* `console.log`/`console.error` supply their own newline, which is why nothing
-* here appends one.
-*
-* @public
-*/
-const CliLoggerLive = Logger.layer([Logger.make(({ fiber, logLevel, message }) => {
-	const console = fiber.getRef(Console.Console);
-	(LogLevel.isGreaterThanOrEqualTo(logLevel, "Error") ? console.error : console.log)(render(message));
-})]);
-
-//#endregion
-export { CliLoggerLive };