reposets 3.1.8 → 4.0.1

package/bin/reposets.js

@@ -1,11 +1,9 @@
 #!/usr/bin/env node
-import { CredentialsFilesLive } from "../services/ConfigFiles.js";
 import { Invocation } from "../services/Invocation.js";
-import { CACHE_DB_FILENAME, STATE_DB_FILENAME } from "../store/files.js";
-import { migrations } from "../store/migrations.js";
+import { CredentialsFilesLive } from "../services/ConfigFiles.js";
+import { CACHE_OPTIONS, STORE_OPTIONS } from "../store/files.js";
 import { SyncJournalLive } from "../store/SyncJournal.js";
 import { credentialsCommand } from "../cli/commands/credentials.js";
-import { ConfigFlag, ConfigLive } from "../cli/flags.js";
 import { doctorCommand } from "../cli/commands/doctor.js";
 import { syncCommand } from "../cli/commands/sync.js";
 import { driftCommand } from "../cli/commands/drift.js";
@@ -14,7 +12,8 @@ import { initCommand } from "../cli/commands/init.js";
 import { listCommand } from "../cli/commands/list.js";
 import { nukeCommand } from "../cli/commands/nuke.js";
 import { validateCommand } from "../cli/commands/validate.js";
-import { Effect, Layer } from "effect";
+import { ConfigFlag, ConfigLive } from "../cli/flags.js";
+import { Effect, Layer, Predicate } from "effect";
 import { App, AppCache, AppStore } from "@effected/app";
 import { NodeRuntime, NodeServices } from "@effect/platform-node";
 import { CliAudience, CliRuntime, ConfigIssueRenderer, Fmt } from "@effected/cli";
@@ -32,7 +31,7 @@ import { Command } from "effect/cli";
 * `0.0.0 (dev build)` from every build until the version was threaded down
 * from here through {@link Invocation}.
 */
-const VERSION = "3.1.8";
+const VERSION = "4.0.1";
 /**
 * The application's directories: XDG resolution and the `reposets` namespace
 * under it.
@@ -60,10 +59,7 @@ const DirsLive = App.layerDirs({ namespace: "reposets" });
 * Migrations still run during layer construction, so they now run on the first
 * command that uses the database rather than on the first command of any kind.
 */
-const StoreLive = AppStore.layer({
-	migrations,
-	filename: STATE_DB_FILENAME
-});
+const StoreLive = AppStore.layer(STORE_OPTIONS);
 /**
 * Both databases, for the commands that run the sync engine.
 *
@@ -72,7 +68,7 @@ const StoreLive = AppStore.layer({
 * in `cache.db`. The engine builds its own journal over `Store`, so nothing
 * else is needed here.
 */
-const DatabasesLive = Layer.mergeAll(StoreLive, AppCache.layer({ filename: CACHE_DB_FILENAME }));
+const DatabasesLive = Layer.mergeAll(StoreLive, AppCache.layer(CACHE_OPTIONS));
 /**
 * The run journal over the state database, for `history` and its subcommands.
 *
@@ -138,8 +134,6 @@ const cli = Command.make("reposets", {}, () => Effect.void).pipe(Command.withDes
 * would be shadowed.
 */
 const PlatformLive = Layer.mergeAll(DirsLive, InvocationLive).pipe(Layer.provideMerge(NodeServices.layer));
-/** Whether a failure is a tagged error of a given tag. */
-const isTagged = (error, tag) => typeof error === "object" && error !== null && "_tag" in error && error._tag === tag;
 /**
 * Render a failure that escaped a command, one line at a time, to stderr.
 *
@@ -161,19 +155,31 @@ const isTagged = (error, tag) => typeof error === "object" && error !== null &&
 * kit's own status line. A TOML syntax error is a `ConfigCodecError` whose own
 * message is the bare "toml parse failed" — the line and column live on the
 * cause, and printing it is the difference between "your config is broken
-* somewhere" and a position plus what the parser expected there. The cause
-* reports a 0-based `line:column`: an unclosed `[groups` header on the first
-* line reads "ExpectedTableHeaderClose at 0:7 expected ] to close the table
+* somewhere" and a position plus what the parser expected there. The cause is
+* read with `Fmt.causeMessage`, the whole `cause` chain's messages without
+* the `TomlParseError:` prefix `String` would add, and falls back to
+* `Fmt.describe` when nothing along the chain has a message. The parser
+* reports a 1-based `line:column`: an unclosed `[groups` header on the first
+* line reads "ExpectedTableHeaderClose at 1:8 expected ] to close the table
 * header".
 *
+* When the failure names a file — `ConfigCodecError.path`, which
+* `ConfigFile`'s read pipeline fills in and which its `message` deliberately
+* leaves out — the cause line is prefixed with it, so a syntax error says
+* which of the discovered files it is in.
+*
 * Everything else, defects included, is the kit's default report. Lines built
 * here from data are sanitised: the kit keeps a person's escapes, so it cannot
 * strip an injected one from a `render`'s output.
 */
 const render = (error, details) => {
 	if (details.isDefect) return details.defaultLines;
-	if (isTagged(error, "ConfigValidationError")) return ConfigIssueRenderer.render(error).some((line) => line.startsWith("unknown key")) ? [...details.defaultLines, "Run 'reposets doctor' for suggested spellings."] : details.defaultLines;
-	if (typeof error === "object" && error !== null && "cause" in error && error.cause !== void 0) return [...details.defaultLines, `  ${Fmt.sanitize(String(error.cause))}`];
+	if (Predicate.isTagged(error, "ConfigValidationError")) return ConfigIssueRenderer.render(error).some((line) => line.startsWith("unknown key")) ? [...details.defaultLines, "Run 'reposets doctor' for suggested spellings."] : details.defaultLines;
+	if (Predicate.hasProperty(error, "cause") && error.cause !== void 0) {
+		const cause = Fmt.causeMessage(error.cause) ?? Fmt.describe(error.cause);
+		const where = Predicate.hasProperty(error, "path") && Predicate.isString(error.path) ? `${error.path}: ` : "";
+		return [...details.defaultLines, `  ${Fmt.sanitize(`${where}${cause}`)}`];
+	}
 	return details.defaultLines;
 };
 NodeRuntime.runMain(CliRuntime.main(CliAudience.run(cli, { version: VERSION }), {
@@ -181,8 +187,7 @@ NodeRuntime.runMain(CliRuntime.main(CliAudience.run(cli, { version: VERSION }),
 	env: {
 		audienceEnvVar: "REPOSETS_AUDIENCE",
 		log: { envVar: "REPOSETS_LOG_LEVEL" },
-		spansEnvVar: "REPOSETS_SPANS",
-		stderrIsTerminal: Effect.sync(() => process.stderr.isTTY === true)
+		spansEnvVar: "REPOSETS_SPANS"
 	},
 	render,
 	helpOnUsageError: "stderr"

package/cli/commands/credentials.js

@@ -96,24 +96,6 @@ const SECRET_IN_NAME = "That looks like a token, not a name. It was not stored."
 /** What `--env` names, and what the prompt accepts for it: a shell variable identifier. */
 const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /**
-* Write credentials back to the file they were read from.
-*
-* @remarks
-* `ConfigFileShape.save` resolves its own default path — the XDG one — rather
-* than the path `discover` found. With a project-local
-* `reposets.credentials.toml` present, that splits reads from writes: `create`
-* lands in XDG while `list` keeps reading the local file, so a profile is
-* created that the user cannot see and that sync will not use. Writing back to
-* the discovered source keeps one file authoritative, and falls back to `save`
-* only when there is genuinely nothing to update.
-*/
-const saveWhereRead = (file, value) => Effect.gen(function* () {
-	const existing = (yield* file.discover.pipe(Effect.orElseSucceed(() => [])))[0];
-	if (existing === void 0) return yield* file.save(value);
-	yield* file.write(value, existing.path);
-	return existing.path;
-});
-/**
 * Refuse an invocation the user got wrong.
 *
 * @remarks
@@ -284,7 +266,7 @@ const createHandler = (input) => Effect.gen(function* () {
 		...actsAs,
 		github_token
 	};
-	const path = yield* saveWhereRead(credentialsFile, { profiles: {
+	const path = yield* credentialsFile.save({ profiles: {
 		...existing.profiles,
 		[profile]: record
 	} });
@@ -378,7 +360,7 @@ const deleteHandler = (profile) => Effect.gen(function* () {
 	}), "Provide --profile <name>: the profile to delete."));
 	if (credentials.profiles[name] === void 0) return yield* refuse(`Profile '${name}' not found.`);
 	const { [name]: _removed, ...remaining } = credentials.profiles;
-	const path = yield* saveWhereRead(credentialsFile, { profiles: remaining });
+	const path = yield* credentialsFile.save({ profiles: remaining });
 	yield* CliMessage.success(`Deleted profile '${name}' from ${path}.`);
 });
 const deleteCommand = Command.make("delete", { profile: profileFlag }, ({ profile }) => deleteHandler(Option.getOrUndefined(profile))).pipe(Command.withDescription("Remove a credential profile"));

package/cli/commands/doctor.js

@@ -1,13 +1,13 @@
 import { SettingsGroupSchema } from "../../schemas/config.js";
 import { profileOwner } from "../../schemas/credentials.js";
-import { CONFIG_FILENAME, CREDENTIALS_FILENAME, ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
 import { Invocation } from "../../services/Invocation.js";
-import { STATE_DB_FILENAME } from "../../store/files.js";
+import { CREDENTIALS_FILENAME, ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
+import { STORE_OPTIONS } from "../../store/files.js";
 import { OP_SERVICE_ACCOUNT_TOKEN, OnePasswordClientLive } from "../../services/OnePasswordClient.js";
 import { CredentialResolver, CredentialResolverLive } from "../../services/CredentialResolver.js";
-import { ConfigFlag } from "../flags.js";
-import { Config, Console, Effect, FileSystem, Layer, Option, Path, Result } from "effect";
-import { CliMessage, Doc, SchemaIssueRenderer, Status } from "@effected/cli";
+import { Config, Console, Effect, FileSystem, Layer, Option, Path, Predicate, Result } from "effect";
+import { AppStore } from "@effected/app";
+import { CliMessage, Doc, Fmt, SchemaIssueRenderer, Status } from "@effected/cli";
 import { Command } from "effect/cli";
 import { AppDirs } from "@effected/xdg";
 import { GitHubClient } from "@effected/github";
@@ -157,69 +157,37 @@ const REQUIRED_PERMISSIONS = [
 		"resolve team slugs (org-owned repos only)"
 	]
 ];
-const levenshtein = (a, b) => {
-	const matrix = [];
-	for (let i = 0; i <= a.length; i++) matrix[i] = [i];
-	for (let j = 0; j <= b.length; j++) matrix[0][j] = j;
-	for (let i = 1; i <= a.length; i++) for (let j = 1; j <= b.length; j++) {
-		const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-		const row = matrix[i];
-		const prev = matrix[i - 1];
-		row[j] = Math.min(prev[j] + 1, row[j - 1] + 1, prev[j - 1] + cost);
-	}
-	return matrix[a.length][b.length];
-};
-/** The nearest known key within edit distance 3, if any. */
-const findClosestMatch = (key, known) => {
-	let best;
-	let bestDist = Number.POSITIVE_INFINITY;
-	for (const candidate of known) {
-		const dist = levenshtein(key, candidate);
-		if (dist < bestDist && dist <= 3) {
-			bestDist = dist;
-			best = candidate;
-		}
-	}
-	return best;
-};
 /**
-* Find the config file without decoding it.
+* The nearest known key within edit distance 3, if any.
 *
 * @remarks
-* The same two tiers the loader uses — walk up from the working directory, then
-* the XDG config directory — but testing only for existence.
-*
-* This was written on the belief that `discover` skips a source that fails to
-* decode. **That was wrong** — it propagates, and a validation failure now
-* reports its own path and its structured issue. The duplication survives for a
-* different and narrower reason, measured rather than assumed:
-* `ConfigCodecError` carries `codec` and `operation` and **no path**, so a TOML
-* *syntax* error cannot name the file it failed to parse. That is the most
-* ordinary config mistake there is, and this command exists to say which file
-* is wrong — so it finds the file itself and parses it for the line and column.
+* Three edits, the threshold this check had before it moved onto the kit;
+* `Fmt.suggest` defaults to two, `effect/cli`'s threshold. Ties keep the
+* first known key, as before.
+*/
+const findClosestMatch = (key, known) => Fmt.suggest(key, known, { maxDistance: 3 })[0];
+/**
+* The credential resolver `doctor`'s live token check runs through.
 *
-* Delete this when the codec error carries a path.
+* @remarks
+* Bound once at module scope and provided once around the whole check, not
+* rebuilt per profile: a layer built inside the loop was a fresh reference on
+* every iteration, so it built the resolver and its 1Password client once per
+* profile.
+*/
+const ResolverLive = Layer.provide(CredentialResolverLive, OnePasswordClientLive);
+/**
+* The file a failed discovery was reading.
 *
-* `appDirs.dirs.config` rather than `ensureConfig`: the latter *creates* the
-* directory, and a read-only diagnostic must not.
+* @remarks
+* Every failure `discover` can raise names its file: `ConfigFileReadError`
+* and `ConfigCodecError` carry `path` (the codec's is filled in by
+* `ConfigFile`'s read pipeline), and `ConfigValidationError` an
+* `Option` of it. That is what lets a TOML *syntax* error — the most ordinary
+* config mistake there is — name the file it failed to parse, so this command
+* no longer re-walks the resolver chain to find the file itself.
 */
-const locateConfig = (fs, path, appDirs, configFlag, cwd) => Effect.gen(function* () {
-	const candidates = [];
-	if (configFlag !== void 0) candidates.push(configFlag, path.join(configFlag, CONFIG_FILENAME));
-	let dir = cwd;
-	for (;;) {
-		candidates.push(path.join(dir, CONFIG_FILENAME));
-		const parent = path.dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	candidates.push(path.join(appDirs.dirs.config, CONFIG_FILENAME));
-	for (const candidate of candidates) {
-		const info = yield* fs.stat(candidate).pipe(Effect.option);
-		if (info._tag === "Some" && info.value.type === "File") return candidate;
-	}
-});
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const failedPath = (failure) => failure._tag === "ConfigValidationError" ? Option.getOrUndefined(failure.path) : failure.path;
 /**
 * `reposets doctor` — config diagnostics, typo detection, credential posture.
 *
@@ -286,7 +254,7 @@ const describeIdentity = (name, profile, login) => {
 		text: `Token [${name}]: resolved, but authenticates as ${login} while the profile declares username = "${owner}"`
 	};
 };
-const doctorHandler = (configFlag) => Effect.gen(function* () {
+const doctorHandler = Effect.gen(function* () {
 	const configFile = yield* ReposetsConfigFile;
 	const credentialsFile = yield* ReposetsCredentialsFile;
 	const fs = yield* FileSystem.FileSystem;
@@ -297,7 +265,7 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 	const sources = discovered._tag === "Success" ? discovered.success : [];
 	const schemaValid = discovered._tag === "Success" && sources.length > 0;
 	const validationIssue = discovered._tag === "Failure" ? discovered.failure.issue : void 0;
-	const configPath = sources[0]?.path ?? (yield* locateConfig(fs, path, appDirs, configFlag, invocation.cwd));
+	const configPath = discovered._tag === "Success" ? sources[0]?.path : failedPath(discovered.failure);
 	if (configPath === void 0) {
 		yield* CliMessage.failure("No config found. Run 'reposets init' to create one.");
 		return;
@@ -309,7 +277,7 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 		["Version: ", invocation.version],
 		["Config: ", Doc.file(configPath)],
 		["Credentials file: ", ...Array.isArray(credentialsLine) ? credentialsLine : [credentialsLine]],
-		["State database: ", Doc.file(path.join(appDirs.dirs.state, STATE_DB_FILENAME))]
+		["State database: ", Doc.file(yield* AppStore.location(STORE_OPTIONS))]
 	])]);
 	const text = yield* fs.readFileString(configPath).pipe(Effect.option);
 	if (text._tag === "None") {
@@ -320,13 +288,13 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 	const parsed = Toml.parseResult(text.value);
 	if (Result.isFailure(parsed)) {
 		yield* Doc.print([files]);
-		yield* CliMessage.failure(`TOML parse error: ${String(parsed.failure)}`);
+		yield* CliMessage.failure(`TOML parse error: ${Fmt.sanitize(Fmt.describe(parsed.failure))}`);
 		return;
 	}
-	const raw = isRecord(parsed.success) ? parsed.success : {};
+	const raw = Predicate.isObject(parsed.success) ? parsed.success : {};
 	const warnings = [];
 	const checkKeys = (target, known, where) => {
-		if (!isRecord(target)) return;
+		if (!Predicate.isObject(target)) return;
 		for (const key of Object.keys(target)) {
 			if (known.has(key)) continue;
 			const removedFrom = REMOVED_KEYS[where === "" ? key : `${key} (in groups)`] ?? REMOVED_KEYS[key];
@@ -340,9 +308,9 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 		}
 	};
 	checkKeys(raw, KNOWN_CONFIG_KEYS, "");
-	const settingsSection = isRecord(raw.settings) ? raw.settings : {};
+	const settingsSection = Predicate.isObject(raw.settings) ? raw.settings : {};
 	for (const [groupName, body] of Object.entries(settingsSection)) {
-		if (!isRecord(body)) continue;
+		if (!Predicate.isObject(body)) continue;
 		for (const field of Object.keys(body)) {
 			if (KNOWN_SETTINGS_FIELDS.has(field)) continue;
 			const suggestion = findClosestMatch(field, KNOWN_SETTINGS_FIELDS);
@@ -351,11 +319,11 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 		}
 	}
 	const groups = raw.groups;
-	if (isRecord(groups)) for (const [groupName, group] of Object.entries(groups)) {
+	if (Predicate.isObject(groups)) for (const [groupName, group] of Object.entries(groups)) {
 		checkKeys(group, KNOWN_GROUP_KEYS, ` in groups.${groupName}`);
-		if (!isRecord(group)) continue;
+		if (!Predicate.isObject(group)) continue;
 		const cleanup = group.cleanup;
-		if (!isRecord(cleanup)) continue;
+		if (!Predicate.isObject(cleanup)) continue;
 		const prefix = `groups.${groupName}.cleanup`;
 		checkKeys(cleanup, KNOWN_CLEANUP_KEYS, ` in ${prefix}`);
 		checkKeys(cleanup.secrets, KNOWN_CLEANUP_SECRETS_KEYS, ` in ${prefix}.secrets`);
@@ -363,15 +331,15 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 	}
 	const issueLines = schemaValid ? [] : SchemaIssueRenderer.render(validationIssue);
 	const schema = Doc.section("Schema", [schemaValid ? Doc.paragraph(Doc.status(Status.core, "success"), " Schema validation: passed") : Doc.paragraph(Doc.status(Status.core, "failure"), " Schema validation: FAILED — these values are rejected, not ignored"), ...issueLines.length === 0 ? [] : [Doc.verbatim(issueLines.join("\n"), { indent: 2 })]]);
-	const keys = Doc.section("Config keys", [...warnings.length === 0 ? [] : [Doc.list(warnings.map((warning) => Doc.paragraph(Doc.status(Status.core, "warning"), " ", warning)), { compact: true })], warnings.length === 0 ? Doc.paragraph(Doc.status(Status.core, "success"), " No unknown keys detected.") : Doc.paragraph(`${warnings.length} warning(s) found.`)]);
+	const keys = Doc.section("Config keys", [...warnings.length === 0 ? [] : [Doc.list(warnings.map((warning) => Doc.paragraph(Doc.status(Status.core, "warning"), " ", warning)), { compact: true })], warnings.length === 0 ? Doc.paragraph(Doc.status(Status.core, "success"), " No unknown keys detected.") : Doc.paragraph(`${Fmt.plural(warnings.length, "warning")} found.`)]);
 	const loaded = yield* credentialsFile.loadOrDefault({ profiles: {} }).pipe(Effect.result);
 	const credentials = loaded._tag === "Success" ? loaded.success : { profiles: {} };
 	const profileNames = Object.keys(credentials.profiles);
 	const credentialBlocks = [];
-	if (loaded._tag === "Failure") credentialBlocks.push(Doc.paragraph(Doc.status(Status.core, "failure"), ` Credentials: FAILED to load — ${String(loaded.failure.message ?? loaded.failure)}`), Doc.paragraph("Unknown keys are rejected. `op_service_account_token` was removed — that token now comes from OP_SERVICE_ACCOUNT_TOKEN in the environment."));
+	if (loaded._tag === "Failure") credentialBlocks.push(Doc.paragraph(Doc.status(Status.core, "failure"), ` Credentials: FAILED to load — ${Fmt.sanitize(Fmt.describe(loaded.failure))}`), Doc.paragraph("Unknown keys are rejected. `op_service_account_token` was removed — that token now comes from OP_SERVICE_ACCOUNT_TOKEN in the environment."));
 	else if (profileNames.length === 0) credentialBlocks.push(Doc.paragraph("Credentials: no profiles configured"));
 	else {
-		credentialBlocks.push(Doc.paragraph(`Credentials: ${profileNames.length} profile(s)`));
+		credentialBlocks.push(Doc.paragraph(`Credentials: ${Fmt.plural(profileNames.length, "profile")}`));
 		let usesOnePassword = false;
 		const profileLines = [];
 		for (const [name, profile] of Object.entries(credentials.profiles)) {
@@ -402,26 +370,27 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 		keys,
 		Doc.section("Credentials", credentialBlocks)
 	])]);
-	const tokenLines = [];
-	for (const [name, profile] of Object.entries(credentials.profiles)) {
-		const resolverLayer = Layer.provide(CredentialResolverLive, OnePasswordClientLive);
-		const resolved = yield* Effect.gen(function* () {
-			return yield* (yield* CredentialResolver).resolveGitHubToken(profile);
-		}).pipe(Effect.provide(resolverLayer), Effect.result);
-		if (resolved._tag === "Failure") {
-			tokenLines.push(Doc.paragraph(Doc.status(Status.core, "failure"), ` Token [${name}]: could not resolve — ${String(resolved.failure)}`));
-			continue;
-		}
-		const identity = yield* Effect.gen(function* () {
-			return yield* (yield* GitHubClient).request("GET /user", {});
-		}).pipe(Effect.provide(GitHubClient.layerFromToken({ token: resolved.success })), Effect.result);
-		if (identity._tag !== "Success") {
-			tokenLines.push(Doc.paragraph(Doc.status(Status.core, "failure"), ` Token [${name}]: resolved but REJECTED by GitHub — ${String(identity.failure)}`));
-			continue;
+	const tokenLines = yield* Effect.gen(function* () {
+		const resolver = yield* CredentialResolver;
+		const lines = [];
+		for (const [name, profile] of Object.entries(credentials.profiles)) {
+			const resolved = yield* resolver.resolveGitHubToken(profile).pipe(Effect.result);
+			if (resolved._tag === "Failure") {
+				lines.push(Doc.paragraph(Doc.status(Status.core, "failure"), ` Token [${name}]: could not resolve — ${Fmt.sanitize(Fmt.describe(resolved.failure))}`));
+				continue;
+			}
+			const identity = yield* Effect.gen(function* () {
+				return yield* (yield* GitHubClient).request("GET /user", {});
+			}).pipe(Effect.provide(GitHubClient.layerFromToken({ token: resolved.success })), Effect.result);
+			if (identity._tag !== "Success") {
+				lines.push(Doc.paragraph(Doc.status(Status.core, "failure"), ` Token [${name}]: resolved but REJECTED by GitHub — ${Fmt.sanitize(Fmt.describe(identity.failure))}`));
+				continue;
+			}
+			const line = describeIdentity(name, profile, identity.success.login);
+			lines.push(Doc.paragraph(Doc.status(Status.core, line.ok ? "success" : "failure"), " ", line.text));
 		}
-		const line = describeIdentity(name, profile, identity.success.login);
-		tokenLines.push(Doc.paragraph(Doc.status(Status.core, line.ok ? "success" : "failure"), " ", line.text));
-	}
+		return lines;
+	}).pipe(Effect.provide(ResolverLive));
 	const permissions = Doc.section("Required fine-grained token permissions", [
 		Doc.list(REQUIRED_PERMISSIONS.map(([scope, permission, why]) => Doc.paragraph(`${scope} > ${permission} — ${why}`)), { compact: true }),
 		Doc.paragraph(Doc.text("(Metadata: Read is mandatory and granted automatically)", "muted")),
@@ -435,9 +404,6 @@ const doctorHandler = (configFlag) => Effect.gen(function* () {
 *
 * @public
 */
-const doctorCommand = Command.make("doctor", {}, () => Effect.gen(function* () {
-	const flag = yield* ConfigFlag;
-	yield* doctorHandler(Option.getOrUndefined(flag));
-})).pipe(Command.withDescription("Diagnose the config: unknown keys, credential posture, required token permissions"));
+const doctorCommand = Command.make("doctor", {}, () => doctorHandler).pipe(Command.withDescription("Diagnose the config: unknown keys, credential posture, required token permissions"));
 
 export { describeIdentity, doctorCommand, doctorHandler };

package/cli/commands/history.js

@@ -21,9 +21,7 @@ const formatDuration = (summary) => {
 	if (summary.finishedAt === null) return "—";
 	const millis = Date.parse(summary.finishedAt) - Date.parse(summary.startedAt);
 	if (Number.isNaN(millis) || millis < 0) return "—";
-	if (millis < 1e3) return `${millis}ms`;
-	const seconds = millis / 1e3;
-	return seconds < 60 ? `${seconds.toFixed(1)}s` : `${Math.floor(seconds / 60)}m${String(Math.round(seconds % 60)).padStart(2, "0")}s`;
+	return Fmt.duration(millis);
 };
 /**
 * What became of a run.
@@ -212,7 +210,7 @@ const pickRun = (runs, abbreviate) => Effect.gen(function* () {
 			const outcome = formatOutcome(run);
 			return {
 				label: `${abbreviate(run.id)} · ${formatWhen(run.startedAt)} · ${outcome} · ${Fmt.sanitize(run.group ?? "(all)")}`,
-				detail: `${formatMode(run)} · ${run.changes} change${run.changes === 1 ? "" : "s"} · ${formatDuration(run)}`,
+				detail: `${formatMode(run)} · ${Fmt.plural(run.changes, "change")} · ${formatDuration(run)}`,
 				value: run
 			};
 		})
@@ -286,7 +284,7 @@ const showHandler = (prefix) => Effect.gen(function* () {
 			const what = record.kind === record.name ? record.kind : `${record.kind} ${record.name}`;
 			const action = dryRun ? `would ${wouldForm(record.action)}` : record.action;
 			return [
-				Doc.text(action.padEnd(18), actionToken(record.action, dryRun)),
+				Doc.text(Fmt.pad(action, 18), actionToken(record.action, dryRun)),
 				" ",
 				what,
 				detail
@@ -312,7 +310,7 @@ const UNTOUCHED = "Applied state and the cache are untouched — drift detection
 */
 const pruneHandler = (keep) => Effect.gen(function* () {
 	const removed = yield* (yield* SyncJournal).prune(keep).pipe(Effect.orElseSucceed(() => 0));
-	yield* removed === 0 ? CliMessage.info(`Nothing to prune; ${keep} or fewer runs are recorded.`) : CliMessage.success(`Pruned ${removed} run${removed === 1 ? "" : "s"}, keeping the newest ${keep}.`);
+	yield* removed === 0 ? CliMessage.info(`Nothing to prune; ${keep} or fewer runs are recorded.`) : CliMessage.success(`Pruned ${Fmt.plural(removed, "run")}, keeping the newest ${keep}.`);
 	yield* CliMessage.info(UNTOUCHED);
 });
 /**
@@ -320,7 +318,7 @@ const pruneHandler = (keep) => Effect.gen(function* () {
 */
 const clearHandler = () => Effect.gen(function* () {
 	const removed = yield* (yield* SyncJournal).clear().pipe(Effect.orElseSucceed(() => 0));
-	yield* CliMessage.success(`Cleared ${removed} run${removed === 1 ? "" : "s"} from the journal.`);
+	yield* CliMessage.success(`Cleared ${Fmt.plural(removed, "run")} from the journal.`);
 	yield* CliMessage.info(UNTOUCHED);
 });
 /**

package/cli/commands/init.js

@@ -1,5 +1,5 @@
-import { CONFIG_FILENAME, CREDENTIALS_FILENAME } from "../../services/ConfigFiles.js";
 import { Invocation } from "../../services/Invocation.js";
+import { CONFIG_FILENAME, CREDENTIALS_FILENAME } from "../../services/ConfigFiles.js";
 import { configSchemaHost, credentialsSchemaHost, schemaDirective } from "../../schemas/hosted.js";
 import { Effect, FileSystem, Option, Path } from "effect";
 import { CliExit, CliMessage } from "@effected/cli";

package/cli/commands/nuke.js

@@ -1,11 +1,13 @@
-import { CONFIG_FILENAME, CREDENTIALS_FILENAME } from "../../services/ConfigFiles.js";
 import { Invocation } from "../../services/Invocation.js";
-import { CACHE_DB_FILENAME, STATE_DB_FILENAME } from "../../store/files.js";
+import { CONFIG_FILENAME, CREDENTIALS_FILENAME } from "../../services/ConfigFiles.js";
+import { CACHE_OPTIONS, STORE_OPTIONS } from "../../store/files.js";
 import { Effect, FileSystem, Path } from "effect";
-import { CliExit, CliInteractive, CliMessage, Doc } from "@effected/cli";
+import { AppCache, AppStore } from "@effected/app";
+import { CliExit, CliInteractive, CliMessage, Doc, Fmt } from "@effected/cli";
 import { CliError, Command, Flag } from "effect/cli";
 import { CliUi, Confirm, MultiSelect } from "@effected/cli/ui";
 import { AppDirs, Xdg } from "@effected/xdg";
+import { Walker } from "@effected/walker";
 
 // src/cli/commands/nuke.ts
 const forceFlag = Flag.Boolean("force").pipe(Flag.withDefault(false), Flag.withDescription("Delete without asking. Intended for scripts; there is no undo"));
@@ -81,23 +83,18 @@ const isInitGitignore = (contents) => {
 */
 const findTargets = (fs, path, appDirs, from) => Effect.gen(function* () {
 	const files = [];
-	let dir = from;
-	for (;;) {
-		files.push({
-			path: path.join(dir, CONFIG_FILENAME),
-			what: "project config",
-			cost: "loses your groups and settings",
-			location: "project"
-		}, {
-			path: path.join(dir, CREDENTIALS_FILENAME),
-			what: "project credentials",
-			cost: "loses token references, not tokens",
-			location: "project"
-		});
-		const parent = path.dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
+	const chain = yield* Walker.ascend(from);
+	for (const dir of chain) files.push({
+		path: path.join(dir, CONFIG_FILENAME),
+		what: "project config",
+		cost: "loses your groups and settings",
+		location: "project"
+	}, {
+		path: path.join(dir, CREDENTIALS_FILENAME),
+		what: "project credentials",
+		cost: "loses token references, not tokens",
+		location: "project"
+	});
 	files.push({
 		path: path.join(appDirs.dirs.config, CONFIG_FILENAME),
 		what: "user config",
@@ -124,12 +121,12 @@ const findTargets = (fs, path, appDirs, from) => Effect.gen(function* () {
 		location: "user"
 	});
 	const databases = [{
-		path: path.join(appDirs.dirs.state, STATE_DB_FILENAME),
+		path: yield* AppStore.location(STORE_OPTIONS),
 		what: "state database",
 		cost: "loses run history AND the drift baselines — drift detection restarts from nothing",
 		location: "state"
 	}, {
-		path: path.join(appDirs.dirs.cache, CACHE_DB_FILENAME),
+		path: yield* AppCache.location(CACHE_OPTIONS),
 		what: "cache database",
 		cost: "loses cached GitHub reads — rebuilt on the next sync",
 		location: "cache"
@@ -168,13 +165,12 @@ const removeEmptyDirs = (fs, appDirs) => Effect.gen(function* () {
 		if (entries._tag === "None" || entries.value.length > 0) continue;
 		const outcome = yield* fs.remove(dir, { recursive: true }).pipe(Effect.result);
 		if (outcome._tag === "Failure") {
-			yield* Effect.logWarning(`could not remove empty directory ${dir} — ${String(outcome.failure)}`);
+			yield* Effect.logWarning(`could not remove empty directory ${dir} — ${Fmt.describe(outcome.failure)}`);
 			continue;
 		}
 		yield* CliMessage.success(`removed empty directory ${dir}`);
 	}
 });
-const plural = (n) => `${n} file${n === 1 ? "" : "s"}`;
 /**
 * How many files a set of targets removes.
 *
@@ -269,7 +265,7 @@ const choose = (targets, short) => Effect.gen(function* () {
 		sections: pickerSections(targets, short)
 	}));
 	if (chosen.length === 0) return [];
-	const { confirmed } = yield* CliUi.run(Confirm.screen({ message: `Delete ${plural(fileCount(chosen))}?` }));
+	const { confirmed } = yield* CliUi.run(Confirm.screen({ message: `Delete ${Fmt.plural(fileCount(chosen), "file")}?` }));
 	return confirmed ? chosen : [];
 }).pipe(Effect.catchTag("NotInteractive", () => Effect.fail(refusal())));
 /**
@@ -336,16 +332,16 @@ const nukeHandler = (force) => Effect.gen(function* () {
 	for (const target of targets) for (const file of target.paths) {
 		const outcome = yield* fs.remove(file).pipe(Effect.result);
 		if (outcome._tag === "Failure") {
-			yield* Effect.logError(`could not remove ${file} — ${String(outcome.failure)}`);
+			yield* Effect.logError(`could not remove ${file} — ${Fmt.describe(outcome.failure)}`);
 			continue;
 		}
 		yield* CliMessage.success(`removed ${file}`);
 		removed += 1;
 	}
 	yield* removeEmptyDirs(fs, appDirs);
-	if (removed === total) yield* CliMessage.success(`Done. ${plural(removed)} removed.`);
+	if (removed === total) yield* CliMessage.success(`Done. ${Fmt.plural(removed, "file")} removed.`);
 	else {
-		yield* CliMessage.failure(`Removed ${removed} of ${plural(total)}; the failures are listed above.`);
+		yield* CliMessage.failure(`Removed ${removed} of ${Fmt.plural(total, "file")}; the failures are listed above.`);
 		yield* CliExit.set(1);
 	}
 });

package/cli/commands/sync.js

@@ -18,22 +18,6 @@ import { CliUi } from "@effected/cli/ui";
 import { CodeScanning, DeploymentEnvironment, GitHubClient, GitHubRepository, RepositorySecret, RepositorySecurity, RepositoryVariable, Ruleset, WorkflowDispatch } from "@effected/github";
 
 // src/cli/commands/sync.ts
-const isPhaseName = (value) => PHASE_NAMES.includes(value);
-const phaseSet = (values) => new Set(values.filter(isPhaseName));
-/**
-* Phase names the user typed that do not exist.
-*
-* @remarks
-* Unrecognised names used to be filtered out silently, and an empty `only` set
-* reads downstream as "no filter" — so `--only nonsense` ran **all eight
-* phases**. The flag reached for to limit the blast radius of a destructive
-* command did the opposite of what it says, and reported success.
-*
-* Any unknown name is refused, including alongside valid ones: a typo in
-* `--only settings,secrts` means the user asked for two phases and would
-* otherwise get one, silently. That is a narrower wrong answer, not a safer one.
-*/
-const unknownPhases = (values) => values.filter((v) => !isPhaseName(v));
 /**
 * Group names by the credential profile they authenticate as.
 *
@@ -148,8 +132,6 @@ const runUnderSyncView = (view, work) => Effect.scoped(Effect.gen(function* () {
 * @public
 */
 const syncHandler = (input) => Effect.gen(function* () {
-	const badPhases = [...unknownPhases(input.only), ...unknownPhases(input.skip)];
-	if (badPhases.length > 0) return yield* Effect.fail(new CliError.UserError({ cause: `Unknown phase name(s): ${badPhases.join(", ")}. Valid phases: ${PHASE_NAMES.join(", ")}. Nothing was synced.` }));
 	const configFile = yield* ReposetsConfigFile;
 	const credentialsFile = yield* ReposetsCredentialsFile;
 	const source = (yield* configFile.discover)[0];
@@ -237,8 +219,8 @@ const syncHandler = (input) => Effect.gen(function* () {
 						configDir,
 						group: input.group,
 						repo: input.repo,
-						only: phaseSet(input.only),
-						skip: phaseSet(input.skip)
+						only: new Set(input.only),
+						skip: new Set(input.skip)
 					});
 				}).pipe(Effect.provide(engineLayer));
 				repos += partial.repos;
@@ -278,8 +260,8 @@ const syncCommand = Command.make("sync", {
 	failOnDrift: Flag.Boolean("fail-on-drift").pipe(Flag.withDefault(false), Flag.withDescription("Exit non-zero when a resource was changed outside reposets")),
 	group: Flag.String("group").pipe(Flag.optional, Flag.withDescription("Sync only this group")),
 	repo: Flag.String("repo").pipe(Flag.optional, Flag.withDescription("Sync only this repository")),
-	only: Flag.String("only").pipe(Flag.atLeast(0), Flag.withDescription("Run only these phases")),
-	skip: Flag.String("skip").pipe(Flag.atLeast(0), Flag.withDescription("Skip these phases")),
+	only: Flag.Literals("only", PHASE_NAMES).pipe(Flag.atLeast(0), Flag.withDescription("Run only these phases")),
+	skip: Flag.Literals("skip", PHASE_NAMES).pipe(Flag.atLeast(0), Flag.withDescription("Skip these phases")),
 	debug: Flag.Boolean("debug").pipe(Flag.withDefault(false), Flag.withDescription("Annotate output with value sources and the fingerprints behind a drift report"))
 }, (input) => syncHandler({
 	dryRun: input.dryRun,

package/index.d.ts

@@ -1,4 +1,4 @@
-import { FileSystem, Layer, Path, Schema } from "effect";
+import { Context, FileSystem, Layer, Path, Schema } from "effect";
 import { AppDirs, Xdg } from "@effected/xdg";
 /**
  * The whole `reposets.config.toml` document.
@@ -323,6 +323,44 @@ export declare const ConfigSchema: Schema.Struct<{
  * @public
  */
 type Config = typeof ConfigSchema.Type;
+declare const Invocation_base: Context.ServiceClass<Invocation, "reposets/Invocation", {
+  /** The directory the command was run from. */
+  readonly cwd: string;
+  /** The build's version, substituted by the bundler at build time. */
+  readonly version: string;
+}>;
+/**
+ * The facts about this process a command needs, read once at the entrypoint.
+ *
+ * @remarks
+ * Only the CLI entrypoint (`src/cli/index.ts`) reads `process`. Everything
+ * below it receives the working directory and the build's version through this
+ * service instead, so a handler can be driven by a test that hands it a
+ * different directory without `process.chdir`.
+ *
+ * The environment is deliberately NOT here. Environment variables are read
+ * through Effect's `Config`, which resolves them from the ambient
+ * `ConfigProvider` — the process environment by default, an explicit record
+ * under `ConfigProvider.layer` in a test. That is core's own seam for the
+ * environment, and `@effected/xdg` already reads `HOME` and `XDG_*` through it;
+ * a second, hand-rolled one here would let the two disagree.
+ *
+ * The whole shape is one immutable value with no behaviour, so `Layer.succeed`
+ * is the complete double — there is nothing for a partial mock to stub. The
+ * moment a method appears here it stops being a value and becomes a service.
+ *
+ * @public
+ */
+export declare class Invocation extends Invocation_base {
+  /**
+   * A fixed invocation, for tests and for the entrypoint alike.
+   *
+   * @remarks
+   * Each call mints a fresh layer; bind the result to a `const` rather than
+   * calling this at more than one provide site.
+   */
+  static readonly layer: (value: Context.Service.Shape<typeof Invocation>) => Layer.Layer<Invocation>;
+}
 /**
  * The config file's fixed name, in every tier of the resolver chain.
  *
@@ -747,6 +785,6 @@ export declare class ConfigFlagMissingConfig extends ConfigFlagMissingConfig_bas
  *
  * @public
  */
-export declare const makeConfigFilesLive: (configFlag: string | undefined) => Layer.Layer<ReposetsConfigFile, ConfigFlagNotFound | ConfigFlagMissingConfig, FileSystem.FileSystem | Path.Path | AppDirs | Xdg>;
+export declare const makeConfigFilesLive: (configFlag: string | undefined) => Layer.Layer<ReposetsConfigFile, ConfigFlagNotFound | ConfigFlagMissingConfig, FileSystem.FileSystem | Path.Path | AppDirs | Xdg | Invocation>;
 export type { Config };
 //# sourceMappingURL=index.d.ts.map

package/index.js

@@ -1,4 +1,5 @@
 import { ConfigSchema } from "./schemas/config.js";
+import { Invocation } from "./services/Invocation.js";
 import { CONFIG_FILENAME, ConfigFlagMissingConfig, ConfigFlagNotFound, ReposetsConfigFile, makeConfigFilesLive } from "./services/ConfigFiles.js";
 
-export { CONFIG_FILENAME, ConfigFlagMissingConfig, ConfigFlagNotFound, ConfigSchema, ReposetsConfigFile, makeConfigFilesLive };
+export { CONFIG_FILENAME, ConfigFlagMissingConfig, ConfigFlagNotFound, ConfigSchema, Invocation, ReposetsConfigFile, makeConfigFilesLive };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "reposets",
-	"version": "3.1.8",
+	"version": "4.0.1",
 	"private": false,
 	"description": "CLI tool to sync GitHub repo settings, secrets and rulesets across personal repositories",
 	"keywords": [
@@ -48,20 +48,22 @@
 	},
 	"dependencies": {
 		"@1password/sdk": "^0.5.0",
-		"@effect/platform-node": "^4.0.6",
-		"@effected/app": "^0.27.1",
-		"@effected/cli": "^0.22.2",
-		"@effected/config-file": "^0.20.1",
-		"@effected/env": "^0.5.0",
-		"@effected/github": "^0.25.0",
-		"@effected/glob": "^0.14.0",
-		"@effected/schemastore": "^0.26.2",
-		"@effected/store": "^0.19.0",
-		"@effected/toml": "^0.16.0",
-		"@effected/walker": "^0.20.1",
-		"@effected/xdg": "^0.15.1",
+		"@effect/platform-node": "^4.0.7",
+		"@effected/app": "^0.29.0",
+		"@effected/cli": "^0.24.0",
+		"@effected/config-file": "^0.22.0",
+		"@effected/env": "^0.7.0",
+		"@effected/github": "^0.26.0",
+		"@effected/glob": "^0.16.0",
+		"@effected/jsonc": "^0.21.0",
+		"@effected/schemastore": "^0.27.0",
+		"@effected/store": "^0.21.0",
+		"@effected/toml": "^0.17.0",
+		"@effected/walker": "^0.22.0",
+		"@effected/xdg": "^0.17.0",
+		"@effected/yaml": "^0.26.0",
 		"blakejs": "^1.2.1",
-		"effect": "^4.0.6",
+		"effect": "^4.0.7",
 		"ink": "^8.0.0",
 		"react": "^19.3.1"
 	},

package/services/ConfigFiles.js

@@ -1,5 +1,6 @@
 import { ConfigSchema } from "../schemas/config.js";
 import { CredentialsSchema } from "../schemas/credentials.js";
+import { Invocation } from "./Invocation.js";
 import { Data, Effect, FileSystem, Layer, Path } from "effect";
 import { AppConfig } from "@effected/app";
 import { ConfigFile, ConfigResolver } from "@effected/config-file";
@@ -73,15 +74,30 @@ const STRICT_KEYS = {
 * `AppConfig.layer` appends its own XDG tier after the resolvers given here, so
 * the upward walk wins and the XDG fallback comes free.
 *
+* The walk starts at {@link Invocation}'s `cwd`, never the process's own:
+* `upwardWalk` defaults to `process.cwd()` when given no `cwd`, which made
+* config discovery the one reader of `process` below the entrypoint.
+*
+* **Writes go back to the file that was found.** `AppConfig` pins
+* `saveTarget: "default"`, the XDG path, which would split reads from writes
+* when a project-local `reposets.credentials.toml` exists: `credentials create`
+* would land in XDG while `list` and `sync` keep reading the local file.
+* `"source"` writes to the highest-priority file the chain found, and to XDG
+* only when there is none.
+*
 * @public
 */
-const CredentialsFilesLive = AppConfig.layer(ReposetsCredentialsFile, {
+const CredentialsFilesLive = Layer.unwrap(Effect.map(Invocation, ({ cwd }) => AppConfig.layer(ReposetsCredentialsFile, {
 	filename: CREDENTIALS_FILENAME,
 	schema: CredentialsSchema,
 	codec: TomlCodec,
-	resolvers: [ConfigResolver.upwardWalk({ filename: CREDENTIALS_FILENAME })],
-	parseOptions: STRICT_KEYS
-});
+	resolvers: [ConfigResolver.upwardWalk({
+		filename: CREDENTIALS_FILENAME,
+		cwd
+	})],
+	parseOptions: STRICT_KEYS,
+	saveTarget: "source"
+})));
 /**
 * Raised when `--config` names a path that does not exist.
 *
@@ -144,14 +160,23 @@ var ConfigFlagMissingConfig = class extends Data.TaggedError("ConfigFlagMissingC
 * A directory is checked for the config file by existence only, not decoded:
 * a file that is present but invalid must still resolve, so `doctor` can
 * diagnose it and a command can report its decode error against the right path.
+*
+* Everything relative is taken against {@link Invocation}'s `cwd`: the upward
+* walk starts there, and a relative `--config` is resolved there before it is
+* checked, so a test that hands a command another directory moves both.
 */
-const resolversFor = (configFlag) => Effect.gen(function* () {
-	if (configFlag === void 0) return [ConfigResolver.upwardWalk({ filename: CONFIG_FILENAME })];
+const resolversFor = (flag) => Effect.gen(function* () {
+	const { cwd } = yield* Invocation;
+	if (flag === void 0) return [ConfigResolver.upwardWalk({
+		filename: CONFIG_FILENAME,
+		cwd
+	})];
 	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const configFlag = path.resolve(cwd, flag);
 	const info = yield* fs.stat(configFlag).pipe(Effect.option);
 	if (info._tag === "None") return yield* new ConfigFlagNotFound({ path: configFlag });
 	if (info.value.type !== "Directory") return [ConfigResolver.explicitPath(configFlag)];
-	const path = yield* Path.Path;
 	if (!(yield* fs.exists(path.join(configFlag, "reposets.config.toml")).pipe(Effect.orElseSucceed(() => false)))) return yield* new ConfigFlagMissingConfig({
 		dir: configFlag,
 		filename: CONFIG_FILENAME

package/services/CredentialResolver.js

@@ -1,7 +1,5 @@
 import { OnePasswordClient } from "./OnePasswordClient.js";
-import { Config, Context, Data, Effect, Layer, Option, Redacted } from "effect";
-import { readFileSync } from "node:fs";
-import { isAbsolute, resolve } from "node:path";
+import { Config, Context, Data, Effect, FileSystem, Layer, Option, Path, Redacted } from "effect";
 
 // src/services/CredentialResolver.ts
 /**
@@ -44,18 +42,21 @@ const fromEnv = (label, variable) => Config.option(Config.String(variable)).pipe
 	})),
 	onSome: (value) => Effect.succeed(Redacted.make(value, { label }))
 })));
-/** Read a file, failing in terms of its path. */
-const fromFile = (label, filePath, basePath) => Effect.try({
-	try: () => {
-		const fullPath = isAbsolute(filePath) ? filePath : resolve(basePath, filePath);
-		return Redacted.make(readFileSync(fullPath, "utf-8").trim(), { label });
-	},
-	catch: (error) => new ResolveError({
-		label,
-		source: "file",
-		reason: error instanceof Error ? error.message : String(error)
-	})
-});
+/**
+* Read a file, failing in terms of its path.
+*
+* @remarks
+* Through core's `FileSystem`, so a test reads from a seeded in-memory volume
+* rather than the disk. A relative path resolves against `basePath`. The
+* failure reason is the `PlatformError` message — `NotFound:
+* FileSystem.readFile (/abs/path)` — which names the path and never the
+* contents.
+*/
+const fromFile = (fs, path, label, filePath, basePath) => fs.readFileString(path.isAbsolute(filePath) ? filePath : path.resolve(basePath, filePath)).pipe(Effect.map((text) => Redacted.make(text.trim(), { label })), Effect.mapError((error) => new ResolveError({
+	label,
+	source: "file",
+	reason: error.message
+})));
 /**
 * Turns the references in a credential profile into usable values.
 *
@@ -84,6 +85,8 @@ const fromFile = (label, filePath, basePath) => Effect.try({
 */
 var CredentialResolver = class extends Context.Service()("reposets/CredentialResolver", { make: Effect.gen(function* () {
 	const onePassword = yield* OnePasswordClient;
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
 	/** One `op://` reference, with 1Password's failure restated in this service's terms. */
 	const fromOnePassword = (label, reference) => onePassword.resolve(reference).pipe(Effect.mapError((error) => new ResolveError({
 		label,
@@ -99,14 +102,15 @@ var CredentialResolver = class extends Context.Service()("reposets/CredentialRes
 			if (section === void 0) return resolved;
 			for (const [label, reference] of Object.entries(section.op ?? {})) resolved.set(label, yield* fromOnePassword(label, reference));
 			for (const [label, variable] of Object.entries(section.env ?? {})) resolved.set(label, yield* fromEnv(label, variable));
-			for (const [label, filePath] of Object.entries(section.file ?? {})) resolved.set(label, yield* fromFile(label, filePath, basePath));
+			for (const [label, filePath] of Object.entries(section.file ?? {})) resolved.set(label, yield* fromFile(fs, path, label, filePath, basePath));
 			for (const [label, value] of Object.entries(section.value ?? {})) resolved.set(label, Redacted.make(typeof value === "string" ? value : JSON.stringify(value), { label }));
 			return resolved;
 		})
 	};
 }) }) {};
 /**
-* Live resolver, over the ambient {@link OnePasswordClient}.
+* Live resolver, over the ambient {@link OnePasswordClient} and the platform's
+* `FileSystem` and `Path`.
 *
 * @public
 */

package/services/OnePasswordClient.js

@@ -1,4 +1,5 @@
 import { Config, Context, Data, Effect, Layer, Option, Redacted } from "effect";
+import { Fmt } from "@effected/cli";
 
 // src/services/OnePasswordClient.ts
 /**
@@ -76,7 +77,7 @@ var OnePasswordClient = class OnePasswordClient extends Context.Service()("repos
 		},
 		catch: (error) => new OnePasswordError({
 			reference,
-			reason: error instanceof Error ? error.message : String(error)
+			reason: Fmt.describe(error)
 		})
 	});
 	return Redacted.make(value, { label: reference });

package/services/SyncLogger.js

@@ -129,7 +129,7 @@ function SyncLoggerLive(config) {
 		* 8; the dry-run `would <present>` forms pad to 14. The result is
 		* concatenated directly, with no separating space.
 		*/
-		const formatVerb = (pastTense, presentTense) => dryRun ? `would ${presentTense}`.padEnd(14) : pastTense.padEnd(8);
+		const formatVerb = (pastTense, presentTense) => dryRun ? Fmt.pad(`would ${presentTense}`, 14) : Fmt.pad(pastTense, 8);
 		/** A change made reads as done; the same change on a dry run, as information. */
 		const changeStatus = dryRun ? "info" : "success";
 		return {
@@ -139,7 +139,7 @@ function SyncLoggerLive(config) {
 				dryRun
 			}),
 			groupStart: (name, selected, declared) => {
-				const scope = selected === declared ? `${selected} ${selected === 1 ? "repo" : "repos"}` : `${selected} of ${declared} ${declared === 1 ? "repo" : "repos"}`;
+				const scope = selected === declared ? Fmt.plural(selected, "repo") : `${selected} of ${Fmt.plural(declared, "repo")}`;
 				return emit(`group: ${name} (${scope})`).pipe(Effect.andThen(publish({
 					_tag: "GroupStarted",
 					name,
@@ -187,7 +187,7 @@ function SyncLoggerLive(config) {
 			driftDetected: (resource, name, drift) => {
 				const consequence = !drift.needsApply ? "already matches config, nothing written" : dryRun ? "would overwrite" : "overwritten";
 				const fingerprints = debug ? ` <- applied ${drift.applied} live ${drift.live}` : "";
-				return action("warning", `${"drift".padEnd(8)}${resource} ${name} changed outside reposets — ${consequence}${fingerprints}`).pipe(Effect.andThen(publish({
+				return action("warning", `${Fmt.pad("drift", 8)}${resource} ${name} changed outside reposets — ${consequence}${fingerprints}`).pipe(Effect.andThen(publish({
 					_tag: "Drift",
 					resource,
 					name,
@@ -213,7 +213,7 @@ function SyncLoggerLive(config) {
 				const errs = yield* Ref.get(errors);
 				if (errs.length === 0) yield* Console.log(`${mark("success")} Sync complete!`);
 				else {
-					yield* emitFailure(`Sync complete with ${errs.length} ${errs.length === 1 ? "error" : "errors"}:`);
+					yield* emitFailure(`Sync complete with ${Fmt.plural(errs.length, "error")}:`);
 					for (const err of errs) yield* emitError(Fmt.sanitize(err.repo === "" ? `  ${err.context} — ${err.message}` : `  ${err.repo}: ${err.context} — ${err.message}`));
 				}
 				yield* publish({

package/store/files.js

@@ -1,3 +1,5 @@
+import { migrations } from "./migrations.js";
+
 // src/store/files.ts
 /**
 * The state database's file name, under the XDG state directory.
@@ -20,5 +22,29 @@ const STATE_DB_FILENAME = "store.db";
 * @public
 */
 const CACHE_DB_FILENAME = "cache.db";
+/**
+* The state database's options: what `AppStore.layer` opens and what
+* `AppStore.location` reports.
+*
+* @remarks
+* One value for both, so the path `doctor` prints and `nuke` deletes is
+* derived by the same code from the same options as the path the layer opens
+* — `AppStore.location` is that derivation, not a copy of it. The directory
+* is left to its default, `state`.
+*
+* @public
+*/
+const STORE_OPTIONS = {
+	migrations,
+	filename: STATE_DB_FILENAME
+};
+/**
+* The cache database's options, for `AppCache.layer` and `AppCache.location`,
+* for the same reason as {@link STORE_OPTIONS}. The directory is left to its
+* default, `cache`.
+*
+* @public
+*/
+const CACHE_OPTIONS = { filename: CACHE_DB_FILENAME };
 
-export { CACHE_DB_FILENAME, STATE_DB_FILENAME };
+export { CACHE_DB_FILENAME, CACHE_OPTIONS, STATE_DB_FILENAME, STORE_OPTIONS };

package/sync/phase.js

@@ -1,4 +1,5 @@
 import { Effect } from "effect";
+import { Fmt } from "@effected/cli";
 
 // src/sync/phase.ts
 /** A phase that touched nothing and failed at nothing. */

package/sync/phases/code-scanning.js

@@ -5,6 +5,7 @@ import { read } from "./resource.js";
 import { fingerprint } from "../../lib/fingerprint.js";
 import { decide, isDrift, needsApply } from "../decide.js";
 import { Effect, Option } from "effect";
+import { Fmt } from "@effected/cli";
 import { CodeScanning, WorkflowDispatch } from "@effected/github";
 
 // src/sync/phases/code-scanning.ts
@@ -151,7 +152,7 @@ const codeScanningPhase = Effect.gen(function* () {
 			errors
 		};
 		if (!ctx.dryRun) {
-			const failure = yield* codeScanning.configure(desired).pipe(Effect.as(Option.none()), Effect.catch((error) => Effect.succeed(Option.some(error.message ?? String(error)))));
+			const failure = yield* codeScanning.configure(desired).pipe(Effect.as(Option.none()), Effect.catch((error) => Effect.succeed(Option.some(Fmt.describe(error)))));
 			if (Option.isSome(failure)) return {
 				changes: [],
 				errors: [...errors, {

package/sync/phases/environments.js

@@ -3,6 +3,7 @@ import { AppliedState, lookup } from "../../store/AppliedState.js";
 import { fingerprint } from "../../lib/fingerprint.js";
 import { decide, isDrift, needsApply } from "../decide.js";
 import { Effect, Option } from "effect";
+import { Fmt } from "@effected/cli";
 import { DeploymentEnvironment } from "@effected/github";
 
 // src/sync/phases/environments.ts
@@ -68,7 +69,7 @@ const environmentsPhase = Effect.gen(function* () {
 			if (isDrift(decision)) yield* logger.driftDetected(KIND, name, decision);
 			if (!needsApply(decision)) continue;
 			if (!ctx.dryRun) {
-				const failure = yield* environments.upsert(name, desired).pipe(Effect.as(Option.none()), Effect.catch((error) => Effect.succeed(Option.some(error.message ?? String(error)))));
+				const failure = yield* environments.upsert(name, desired).pipe(Effect.as(Option.none()), Effect.catch((error) => Effect.succeed(Option.some(Fmt.describe(error)))));
 				if (Option.isSome(failure)) {
 					errors.push({
 						context: `environment ${name}`,

package/sync/phases/resource.js

@@ -1,6 +1,5 @@
 import { Effect, Redacted } from "effect";
-import { readFileSync } from "node:fs";
-import { isAbsolute, resolve } from "node:path";
+import { Fmt } from "@effected/cli";
 
 // src/sync/phases/resource.ts
 /**
@@ -25,7 +24,7 @@ import { isAbsolute, resolve } from "node:path";
 * this runs on the secret-loading path, and the error is the most likely thing
 * to reach a log.
 */
-const resolveOne = (group, label, ctx) => {
+const resolveOne = (io, group, label, ctx) => Effect.gen(function* () {
 	const entries = /* @__PURE__ */ new Map();
 	const errors = [];
 	if ("value" in group) {
@@ -53,21 +52,19 @@ const resolveOne = (group, label, ctx) => {
 		};
 	}
 	for (const [name, filePath] of Object.entries(group.file)) {
-		const fullPath = isAbsolute(filePath) ? filePath : resolve(ctx.configDir, filePath);
-		try {
-			entries.set(name, Redacted.make(readFileSync(fullPath, "utf-8").trim(), { label: name }));
-		} catch (error) {
-			errors.push({
-				context: `${label}.${name}`,
-				message: error instanceof Error ? error.message : String(error)
-			});
-		}
+		const fullPath = io.path.isAbsolute(filePath) ? filePath : io.path.resolve(ctx.configDir, filePath);
+		const text = yield* io.fs.readFileString(fullPath).pipe(Effect.result);
+		if (text._tag === "Success") entries.set(name, Redacted.make(text.success.trim(), { label: name }));
+		else errors.push({
+			context: `${label}.${name}`,
+			message: text.failure.message
+		});
 	}
 	return {
 		entries,
 		errors
 	};
-};
+});
 /**
 * Resolve every group a scope references, later groups winning.
 *
@@ -79,13 +76,13 @@ const resolveOne = (group, label, ctx) => {
 *
 * @public
 */
-const resolveGroups = (refs, definitions, ctx) => {
+const resolveGroups = (io, refs, definitions, ctx) => Effect.gen(function* () {
 	const entries = /* @__PURE__ */ new Map();
 	const errors = [];
 	for (const ref of refs) {
 		const group = definitions[ref];
 		if (group === void 0) continue;
-		const outcome = resolveOne(group, ref, ctx);
+		const outcome = yield* resolveOne(io, group, ref, ctx);
 		for (const [name, value] of outcome.entries) entries.set(name, value);
 		errors.push(...outcome.errors);
 	}
@@ -93,7 +90,7 @@ const resolveGroups = (refs, definitions, ctx) => {
 		entries,
 		errors
 	};
-};
+});
 /**
 * The names a set of groups declares, without resolving any value.
 *
@@ -133,7 +130,7 @@ const declaredNames = (refs, definitions) => {
 *
 * @public
 */
-const read = (effect) => effect.pipe(Effect.map((value) => ({ value })), Effect.catch((error) => Effect.succeed({ failed: error.message ?? String(error) })));
+const read = (effect) => effect.pipe(Effect.map((value) => ({ value })), Effect.catch((error) => Effect.succeed({ failed: Fmt.describe(error) })));
 /**
 * Wrap an operation so a failure becomes a reportable error rather than a
 * failed run.
@@ -142,7 +139,7 @@ const read = (effect) => effect.pipe(Effect.map((value) => ({ value })), Effect.
 */
 const capture = (context, effect) => effect.pipe(Effect.as(void 0), Effect.catch((error) => Effect.succeed({
 	context,
-	message: error.message ?? String(error)
+	message: Fmt.describe(error)
 })));
 
 export { capture, declaredNames, read, resolveGroups };

package/sync/phases/secrets.js

@@ -3,7 +3,7 @@ import { AppliedState, lookup } from "../../store/AppliedState.js";
 import { capture, resolveGroups } from "./resource.js";
 import { fingerprint } from "../../lib/fingerprint.js";
 import { decide, isDrift, needsApply } from "../decide.js";
-import { Effect, Option, Redacted } from "effect";
+import { Effect, FileSystem, Option, Path, Redacted } from "effect";
 import { RepositorySecret } from "@effected/github";
 
 // src/sync/phases/secrets.ts
@@ -53,6 +53,10 @@ const secretsPhase = Effect.gen(function* () {
 	const secrets = yield* RepositorySecret;
 	const applied = yield* AppliedState;
 	const logger = yield* SyncLogger;
+	const io = {
+		fs: yield* FileSystem.FileSystem,
+		path: yield* Path.Path
+	};
 	const run = (ctx) => Effect.gen(function* () {
 		const scopes = ctx.config.groups[ctx.group]?.secrets;
 		if (scopes === void 0) return {
@@ -109,12 +113,12 @@ const secretsPhase = Effect.gen(function* () {
 			}
 		});
 		for (const scope of SCOPES) {
-			const resolved = resolveGroups(scopes[scope] ?? [], ctx.config.secrets, ctx);
+			const resolved = yield* resolveGroups(io, scopes[scope] ?? [], ctx.config.secrets, ctx);
 			errors.push(...resolved.errors);
 			yield* syncStore(resolved.entries, scope, void 0);
 		}
 		for (const [environment, refs] of Object.entries(scopes.environments ?? {})) {
-			const resolved = resolveGroups(refs, ctx.config.secrets, ctx);
+			const resolved = yield* resolveGroups(io, refs, ctx.config.secrets, ctx);
 			errors.push(...resolved.errors);
 			yield* syncStore(resolved.entries, "actions", environment);
 		}

package/sync/phases/security.js

@@ -3,6 +3,7 @@ import { AppliedState, lookup } from "../../store/AppliedState.js";
 import { fingerprint } from "../../lib/fingerprint.js";
 import { decide, isDrift, needsApply } from "../decide.js";
 import { Effect, Option } from "effect";
+import { Fmt } from "@effected/cli";
 import { RepositorySecurity } from "@effected/github";
 
 // src/sync/phases/security.ts
@@ -62,7 +63,7 @@ const securityPhase = Effect.gen(function* () {
 		return (toggle === "vulnerability_alerts" ? security.vulnerabilityAlerts() : toggle === "automated_security_fixes" ? security.automatedSecurityFixes() : security.privateVulnerabilityReporting()).pipe(Effect.map(Option.some), Effect.orElseSucceed(() => Option.none()));
 	};
 	const write = (toggle, value) => {
-		return (toggle === "vulnerability_alerts" ? security.setVulnerabilityAlerts(value) : toggle === "automated_security_fixes" ? security.setAutomatedSecurityFixes(value) : security.setPrivateVulnerabilityReporting(value)).pipe(Effect.as(Option.none()), Effect.catch((error) => Effect.succeed(Option.some(error.message ?? String(error)))));
+		return (toggle === "vulnerability_alerts" ? security.setVulnerabilityAlerts(value) : toggle === "automated_security_fixes" ? security.setAutomatedSecurityFixes(value) : security.setPrivateVulnerabilityReporting(value)).pipe(Effect.as(Option.none()), Effect.catch((error) => Effect.succeed(Option.some(Fmt.describe(error)))));
 	};
 	const run = (ctx) => Effect.gen(function* () {
 		const merged = mergeSecurity(ctx);

package/sync/phases/settings.js

@@ -237,7 +237,7 @@ const settingsPhase = Effect.gen(function* () {
 		};
 		let sent;
 		if (!ctx.dryRun) {
-			const outcome = yield* settingsClient.applySettings(desired).pipe(Effect.map((applied) => ({ applied })), Effect.catch((error) => Effect.succeed({ failed: error.message ?? String(error) })));
+			const outcome = yield* read(settingsClient.applySettings(desired, { unknownKeys: "send" }));
 			if ("failed" in outcome) return {
 				changes: [],
 				errors: [...errors, {
@@ -245,7 +245,8 @@ const settingsPhase = Effect.gen(function* () {
 					message: outcome.failed
 				}]
 			};
-			sent = [...outcome.applied.rest, ...outcome.applied.graphql];
+			for (const key of outcome.value.unverified) yield* logger.syncOperation("apply", "setting", key, "(unconfirmed: GitHub does not describe this field)");
+			sent = [...outcome.value.rest, ...outcome.value.graphql];
 			yield* applied.record({
 				repo: ctx.slug,
 				kind: KIND,

package/sync/phases/variables.js

@@ -3,7 +3,7 @@ import { AppliedState, lookup } from "../../store/AppliedState.js";
 import { capture, resolveGroups } from "./resource.js";
 import { fingerprint } from "../../lib/fingerprint.js";
 import { decide, isDrift, needsApply } from "../decide.js";
-import { Effect, Option, Redacted } from "effect";
+import { Effect, FileSystem, Option, Path, Redacted } from "effect";
 import { RepositoryVariable } from "@effected/github";
 
 // src/sync/phases/variables.ts
@@ -46,6 +46,10 @@ const variablesPhase = Effect.gen(function* () {
 	const variables = yield* RepositoryVariable;
 	const applied = yield* AppliedState;
 	const logger = yield* SyncLogger;
+	const io = {
+		fs: yield* FileSystem.FileSystem,
+		path: yield* Path.Path
+	};
 	const run = (ctx) => Effect.gen(function* () {
 		const scopes = ctx.config.groups[ctx.group]?.variables;
 		if (scopes === void 0) return {
@@ -54,12 +58,12 @@ const variablesPhase = Effect.gen(function* () {
 		};
 		const changes = [];
 		const errors = [];
-		const actions = resolveGroups(scopes.actions ?? [], ctx.config.variables, ctx);
+		const actions = yield* resolveGroups(io, scopes.actions ?? [], ctx.config.variables, ctx);
 		errors.push(...actions.errors);
 		/** Every environment's resolved entries, by environment name. */
 		const byEnvironment = /* @__PURE__ */ new Map();
 		for (const [environment, refs] of Object.entries(scopes.environments ?? {})) {
-			const resolved = resolveGroups(refs, ctx.config.variables, ctx);
+			const resolved = yield* resolveGroups(io, refs, ctx.config.variables, ctx);
 			errors.push(...resolved.errors);
 			byEnvironment.set(environment, resolved.entries);
 		}

package/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.59.4"
+      "packageVersion": "7.60.0"
     }
   ]
 }