@akterjs/cli 0.0.0-stage → 0.1.1

package/dist/cloud-client.adapter-DOVMoYAj.mjs

@@ -0,0 +1,304 @@
+import { P as currentTimeMillis, S as prependUrl, f as bearerToken, r as fromWeb } from "./HttpClientResponse-D5ZKICVV.mjs";
+import { A as ensuring, At as provideContext, B as flatMap, Dt as orElseSucceed, L as filterOrElse, Lt as retry, M as fail, T as context, Tt as option, U as fn, Vn as effect, W as fnUntraced, Xt as succeed, _a as pick, aa as Service, cn as tryPromise, d as asVoid, dt as map, en as sync, et as gen, ft as mapBoth, ht as mapError, ia as Reference, in as timeout, jt as provideService, o as andThen, p as callback, rt as interrupt, ua as getOrUndefined, xt as onError } from "./Effect-CKFpqbmw.mjs";
+import { B as TaggedStruct, Qn as remove, Zn as merge, ir as toEpochMillis, mt as is, qn as fromInput, tt as decodeEffect, u as DateTimeUtcFromString } from "./Schema-MiKt5K1v.mjs";
+import { S as none, _ as isSome, b as map$1, r as exists, w as some, x as match } from "./Option-DkxSnBhp.mjs";
+import { i as value, n as make } from "./Redacted-RkJrG5Me.mjs";
+import { o as set, r as make$1, s as update, t as get } from "./Ref-BIPOxJNH.mjs";
+import { t as make$2 } from "./Semaphore-DOVJ4ZGS.mjs";
+import { $ as toReadableStreamEffect, C as interruptWhen, d as ensuring$1, j as mkArrayBuffer } from "./Stream-bK9QIETN.mjs";
+import { _ as mapRequestEffect, d as make$4, f as HttpClient, g as mapRequest, h as make$3, m as layerMergedContext, p as filterStatusOk, v as transformResponse } from "./cloud-client.adapter-Cy1BjDbG.mjs";
+import { c as TransportError, i as HttpClientError, r as EncodeError, s as StatusCodeError } from "./HttpClientError-BUeMWx70.mjs";
+import { DeployFailedError } from "./deploy/deploy-failed.errors.mjs";
+import { ApiAttempt } from "./deploy/auth/api-attempt.service.mjs";
+import { exchangeFailure, progressWait, retriedSignIn, signInRetries } from "./deploy/request-failure.pure.mjs";
+import { signInFailure } from "./registry/operation-output.pure.mjs";
+// ../../node_modules/.pnpm/effect@4.1.2_patch_hash=0e61176203bb1256381ce1c5b488d7951983ce38ff698647d3f4617383abbf07/node_modules/effect/dist/http/FetchHttpClient.js
+/**
+* Fetch-based implementation of the Effect HTTP client service.
+*
+* This module provides an `HttpClient` layer that executes requests through a
+* Web Fetch API implementation. It is the transport to use in browsers, edge
+* runtimes, and Node.js environments where `globalThis.fetch` is available, or
+* anywhere a compatible fetch function can be supplied.
+*
+* Requests with an `Upgrade` header fail with `TransportError` before anything
+* is sent because fetch cannot hand over the connection.
+*
+* @stability unstable
+* @since 4.0.0
+*/
+/**
+* Context reference for the `fetch` implementation used by the fetch-based HTTP client.
+*
+* **Details**
+*
+* Defaults to `globalThis.fetch`.
+*
+* @stability unstable
+* @category services
+* @since 4.0.0
+*/
+const Fetch = /*#__PURE__*/ Reference("effect/http/FetchHttpClient/Fetch", { defaultValue: () => globalThis.fetch });
+/**
+* Context reference controlling stream bodies when the runtime does not support streaming requests.
+*
+* **Details**
+*
+* Defaults to `"error"`, which fails with an `EncodeError` without sending the
+* request. Set to `"buffer"` to collect the entire stream in memory and send it
+* as a single body instead. Runtimes with streaming support always send the stream.
+*
+* **Gotchas**
+*
+* Buffering keeps the entire upload in memory and can exhaust memory for large
+* or unbounded uploads. Support is detected once, on the first stream body sent,
+* using the global `Request` implementation even when a custom `Fetch` is provided.
+*
+* @stability unstable
+* @category services
+* @since 4.0.0
+*/
+const StreamBodyFallback = /*#__PURE__*/ Reference("effect/http/FetchHttpClient/StreamBodyFallback", { defaultValue: () => "error" });
+/**
+* Service that contains default fetch options for the fetch-based HTTP client.
+*
+* **When to use**
+*
+* Use to provide default credentials, cache, redirect, integrity, or other
+* fetch options for outgoing HTTP requests.
+*
+* **Details**
+*
+* Request-specific method, headers, body, and abort signal are supplied by the client when a request is executed.
+*
+* @see {@link HttpClient.followRedirects} for following redirects in the client, which needs `{ redirect: "manual" }` here
+*
+* @stability unstable
+* @category services
+* @since 4.0.0
+*/
+var RequestInit = class extends (/*#__PURE__*/ Service()("effect/http/FetchHttpClient/RequestInit")) {};
+let supportsStreamBody;
+const detectStreamBodySupport = () => {
+	try {
+		let duplexAccessed = false;
+		const body = new ReadableStream();
+		const request = new Request("https://example.com", {
+			method: "POST",
+			body,
+			get duplex() {
+				duplexAccessed = true;
+				return "half";
+			}
+		});
+		return (duplexAccessed || request.body === body) && !request.headers.has("Content-Type");
+	} catch {
+		return false;
+	}
+};
+/**
+* Layer that provides an `HttpClient` implementation backed by the configured
+* `Fetch` function.
+*
+* **When to use**
+*
+* Use when an Effect program should execute `HttpClient` requests through the
+* platform `fetch` implementation, especially in browser, edge, or Node.js
+* runtimes with `globalThis.fetch`.
+*
+* **Details**
+*
+* The layer uses the current `Fetch` reference and optional `RequestInit`
+* service for each request. Request-specific method, headers, body, and abort
+* signal are supplied by the client and override matching `RequestInit` fields.
+*
+* **Gotchas**
+*
+* Fetch behavior comes from the runtime's implementation, so CORS, cookies,
+* redirects, abort handling, and streaming support can vary by platform.
+* `fetch` follows redirects itself by default, so `HttpClient.followRedirects`
+* has no effect unless `RequestInit` sets `redirect: "manual"`. Trace
+* propagation is on by default, and a browser preflight fails unless the
+* target allows `b3` and `traceparent`. Stream request bodies are sent as Web
+* streams with `duplex: "half"` when the runtime supports it; see
+* `StreamBodyFallback` for the unsupported case. Any `content-length` header is
+* removed before calling `fetch`. Chrome passes the support check but rejects
+* streaming uploads over HTTP/1.1, which surfaces as a `TransportError`, and
+* browsers only deliver the response after the entire request body has been sent.
+*
+* @see {@link Fetch} for supplying the fetch implementation used by this layer
+* @see {@link RequestInit} for default `RequestInit` options applied before request-specific fields
+* @see {@link StreamBodyFallback} for opting into buffering on unsupported runtimes
+* @see {@link HttpClient.TracerPropagationEnabled} for leaving `b3` and `traceparent` off a browser request
+*
+* @stability unstable
+* @category layers
+* @since 4.0.0
+*/
+const layer = /*#__PURE__*/ layerMergedContext(/*#__PURE__*/ succeed(/* @__PURE__ */ make$3((request, url, signal, fiber) => {
+	if (request.headers.upgrade !== void 0) return fail(new HttpClientError({ reason: new TransportError({
+		request,
+		description: "fetch cannot send an HTTP upgrade request"
+	}) }));
+	const fetch = fiber.getRef(Fetch);
+	const options = getOrUndefined(fiber.context, RequestInit) ?? {};
+	let headers = options.headers ? merge(fromInput(options.headers), request.headers) : request.headers;
+	if (headers["content-length"]) headers = remove(headers, "content-length");
+	let uploadController;
+	const stopUpload = sync(() => uploadController?.abort());
+	const send = (body) => map(tryPromise({
+		try: () => fetch(url, {
+			...options,
+			method: request.method,
+			headers,
+			body,
+			duplex: typeof ReadableStream !== "undefined" && body instanceof ReadableStream ? "half" : void 0,
+			signal: uploadController ? AbortSignal.any([signal, uploadController.signal]) : signal
+		}),
+		catch: (cause) => new HttpClientError({ reason: new TransportError({
+			request,
+			cause
+		}) })
+	}), (response) => {
+		const original = fromWeb(request, response);
+		if (!uploadController) return original;
+		if (response.body === null) uploadController.abort();
+		return Object.create(original, {
+			...Object.fromEntries([
+				"arrayBuffer",
+				"text",
+				"json",
+				"formData",
+				"urlParamsBody"
+			].map((key) => [key, { get: () => ensuring(original[key], stopUpload) }])),
+			stream: { get: () => ensuring$1(original.stream, stopUpload) }
+		});
+	}).pipe(onError(() => stopUpload));
+	switch (request.body._tag) {
+		case "Raw":
+		case "Uint8Array": return send(request.body.body);
+		case "FormData": return send(request.body.formData);
+		case "Stream":
+			supportsStreamBody ??= detectStreamBodySupport();
+			if (supportsStreamBody) {
+				uploadController = new AbortController();
+				const uploadSignal = AbortSignal.any([signal, uploadController.signal]);
+				const stopped = callback((resume) => {
+					const onAbort = () => resume(interrupt);
+					if (uploadSignal.aborted) {
+						onAbort();
+						return;
+					}
+					uploadSignal.addEventListener("abort", onAbort, { once: true });
+					return sync(() => uploadSignal.removeEventListener("abort", onAbort));
+				});
+				return flatMap(toReadableStreamEffect(interruptWhen(request.body.stream, stopped)), send);
+			}
+			if (fiber.getRef(StreamBodyFallback) === "error") return fail(new HttpClientError({ reason: new EncodeError({
+				request,
+				description: "Streaming request bodies are not supported in this runtime"
+			}) }));
+			return mkArrayBuffer(request.body.stream).pipe(mapError((cause) => new HttpClientError({ reason: new EncodeError({
+				request,
+				cause
+			}) })), flatMap(send));
+	}
+	return send(void 0);
+})));
+// src/deploy/cloud-client.adapter.ts
+const sessionOf = fnUntraced(function* sessionOf(issued) {
+	const now = yield* currentTimeMillis;
+	const current = yield* decodeEffect(DateTimeUtcFromString)(issued.expiresAt).pipe(mapBoth({
+		onFailure: () => DeployFailedError.make({ message: "The API returned an invalid token expiry." }),
+		onSuccess: (expires) => ({
+			expiresAt: toEpochMillis(expires),
+			token: make(issued.token)
+		})
+	}));
+	if (current.expiresAt <= now) return yield* DeployFailedError.make({ message: "The API returned an expired token." });
+	return current;
+});
+const refreshMarginMillis = 3e4;
+const oneExchange = 1;
+const unauthorizedStatus = 401;
+/** A refused token's expiry, so the next request exchanges the secret again, as a refresh. */
+const refusedAt = 0;
+const firstSuccess = 200;
+const firstRedirect = 300;
+const refusedStatus = (response) => response.text.pipe(orElseSucceed(() => ""), flatMap((description) => fail(new HttpClientError({ reason: new StatusCodeError({
+	description,
+	request: response.request,
+	response
+}) }))));
+const succeeded = (response) => response.status >= firstSuccess && response.status < firstRedirect;
+const statusFirst = (client) => transformResponse(client, (responded) => filterOrElse(responded, succeeded, refusedStatus));
+const transportOf = map(HttpClient, (http) => http.pipe(transformResponse(provideService(RequestInit, { redirect: "error" }))));
+const anonymousClient = fn("anonymousClient")(function* anonymousClient(url) {
+	const transport = yield* transportOf;
+	return make$4(mapRequest(transport, prependUrl(url.href)));
+});
+/** The API's refusal of the bearer itself, answered before any handler runs, so sending the request again is safe. */
+const isBearerRefusal = is(TaggedStruct("UnauthorizedError", {}));
+const resignedWith = ({ session, token, transport }) => (response) => gen(function* resigned() {
+	const body = yield* option(response.json);
+	if (response.status !== unauthorizedStatus || !exists(body, isBearerRefusal)) return response;
+	yield* update(session, map$1((held) => ({
+		expiresAt: refusedAt,
+		token: held.token
+	})));
+	const bearer = yield* token;
+	return yield* transport.execute(bearerToken(response.request, bearer));
+});
+/** The token exchange within its wait; a first sign-in (`retrying`) retries on `signInRetries` while the failure may pass. */
+const exchanged = (exchange, retrying) => exchange.pipe(timeout(progressWait), retry({
+	schedule: signInRetries,
+	while: (failure) => retrying && retriedSignIn(failure)
+}));
+const cloudClient = fn("cloudClient")(function* cloudClient({ apiKey, url }) {
+	const transport = yield* transportOf;
+	const base = mapRequest(transport, prependUrl(url.href));
+	const unsigned = make$4(filterStatusOk(base));
+	const session = yield* make$1(none());
+	const exchanging = yield* make$2(oneExchange);
+	const exchange = unsigned.tokensExchange({ payload: { secret: value(apiKey) } });
+	const token = gen(function* bearerToken() {
+		const now = yield* currentTimeMillis;
+		const cached = yield* get(session);
+		const refreshing = isSome(cached);
+		if (isSome(cached) && cached.value.expiresAt > now + refreshMarginMillis) return cached.value.token;
+		yield* match(cached, {
+			onNone: () => ApiAttempt.mark("initial"),
+			onSome: () => ApiAttempt.mark("refresh")
+		});
+		const issued = yield* mapError(exchanged(exchange, !refreshing), exchangeFailure(refreshing));
+		const current = yield* sessionOf(issued);
+		yield* set(session, some(current)).pipe(andThen(ApiAttempt.mark("request")));
+		return current.token;
+	}).pipe(exchanging.withPermits(oneExchange));
+	const signed = mapRequestEffect(base, (request) => map(token, (bearer) => bearerToken(request, bearer)));
+	const authenticated = transformResponse(signed, flatMap(resignedWith({
+		session,
+		token,
+		transport
+	})));
+	return {
+		anonymous: base,
+		bearer: token,
+		client: make$4(authenticated),
+		http: authenticated,
+		progress: make$4(authenticated.pipe(statusFirst)),
+		request: ApiAttempt.request,
+		signIn: asVoid(mapError(token, signInFailure)),
+		upload: filterStatusOk(transport)
+	};
+});
+var CloudClient = class extends Service()("@akterjs/cli/deploy/cloud-client.adapter/CloudClient", { make: gen(function* makeCloudClient() {
+	const context$1 = yield* context().pipe(map(pick(HttpClient)));
+	return {
+		anonymous: (url) => provideContext(anonymousClient(url), context$1),
+		connect: (options) => provideContext(cloudClient(options), context$1)
+	};
+}) }) {
+	static layer = effect(this, this.make);
+};
+export { Fetch as n, layer as r, CloudClient as t };

package/dist/command/akter-commands.config.mjs

@@ -0,0 +1,32 @@
+import { a as withSubcommands, i as withDescription, t as make } from "../Command-Dzq9KM-h.mjs";
+import { importApp } from "../archive/archive-cli.config.mjs";
+import { bench, deploy, exportApp } from "../app-cli.config.mjs";
+import { login, logout, signup } from "../credentials/login.config.mjs";
+import { t as docs } from "../docs.config-D3zzLzLR.mjs";
+import { localCommands } from "../local/environment-cli.config.mjs";
+import { logCommands } from "../logs/log-follow.config.mjs";
+import { actorCommands } from "../registry/actor-commands.config.mjs";
+import { cloudCommands } from "../registry/cloud-commands.config.mjs";
+// src/command/akter-commands.config.ts
+const akterCommand = (operations) => {
+	const joined = {
+		...actorCommands(operations),
+		...logCommands
+	};
+	return make("akter").pipe(withDescription("Run Akter apps locally and operate Akter Cloud"), withSubcommands([
+		bench,
+		...localCommands,
+		deploy,
+		exportApp,
+		importApp,
+		docs,
+		login,
+		logout,
+		signup,
+		...cloudCommands({
+			joined,
+			operations
+		})
+	]));
+};
+export { akterCommand };

package/dist/command/akter-program.config.mjs

@@ -0,0 +1 @@
+export { t as runAkter } from "../akter-program.config-D8yb9xQP.mjs";

package/dist/credentials/credentials.service.mjs

@@ -0,0 +1,226 @@
+import { t as match } from "../Boolean-kILIvmhE.mjs";
+import { a as option, i as String, r as Redacted } from "../Config-B6OND9WR.mjs";
+import { At as provideContext, B as flatMap, Dt as orElseSucceed, Et as orDie, Kn as provide, M as fail, Q as fromOption, T as context, Tt as option$1, Vn as effect, W as fnUntraced, Xt as succeed, _n as when, aa as Service, dt as map, et as gen, f as cached, gn as void_, ht as mapError, tt as ignore } from "../Effect-CKFpqbmw.mjs";
+import { t as FileSystem } from "../FileSystem-4pPcEb_i.mjs";
+import { C as orElse, S as none, _ as isSome, a as firstSomeOf, b as map$1, d as fromUndefinedOr, f as getOrElse, h as isNone, i as filter, o as flatMap$1, w as some, x as match$1 } from "../Option-DkxSnBhp.mjs";
+import { t as Path } from "../Path-Djdv_eF5.mjs";
+import { i as value, n as make$1 } from "../Redacted-RkJrG5Me.mjs";
+import { F as String$1, I as Struct, a as Boolean, an as optionalKey, pt as fromJsonString, st as encodeEffect, tt as decodeEffect, x as Literal } from "../Schema-MiKt5K1v.mjs";
+import { s as isNonEmpty } from "../String-q5dcsVe4.mjs";
+import { CliExitError } from "../terminal/cli-exit.errors.mjs";
+import { Keychain } from "./keychain.adapter.mjs";
+import { cloudUrl, defaultCloudUrl } from "../deploy/cloud-url.pure.mjs";
+// src/credentials/credentials.service.ts
+const LoginFile = Struct({
+	keychain: Boolean,
+	kind: Literal("apiKey"),
+	organization: optionalKey(String$1),
+	secret: optionalKey(String$1),
+	url: String$1
+});
+const LoginJson = fromJsonString(LoginFile);
+const ownerOnlyFile = 384;
+const ownerOnlyFolder = 448;
+const fileName = "login.json";
+const nonEmpty = (name) => option(String(name)).pipe(map(filter(isNonEmpty)), orElseSucceed(() => none()));
+const apiKeyFromEnvironment = option(Redacted("AKTER_API_KEY")).pipe(map(filter((key) => isNonEmpty(value(key)))), orElseSucceed(() => none()));
+const failure = (code, reason) => (message) => CliExitError.make({
+	code,
+	message,
+	reason
+});
+const signedOut = () => failure(CliExitError.codes.authentication, "NotSignedIn")("Not signed in. Set AKTER_API_KEY to an API key or agent key, or save one with: akter login --with-api-key < key.txt");
+const unreadable = (file) => () => failure(CliExitError.codes.authentication, "LoginUnreadable")(`The saved login in ${file} can't be read. Run akter logout, then sign in again.`);
+const originOf = (url) => cloudUrl(url).pipe(map((parsed) => some(parsed.origin)), orElseSucceed(() => none()));
+const loginFile = fnUntraced(function* loginFile() {
+	const path = yield* Path;
+	const xdg = yield* nonEmpty("XDG_CONFIG_HOME");
+	const home = yield* nonEmpty("HOME");
+	const folder = orElse(xdg, () => map$1(home, (homeFolder) => path.join(homeFolder, ".config")));
+	return yield* match$1(folder, {
+		onNone: () => fail(failure(CliExitError.codes.authentication, "NoConfigFolder")("Neither XDG_CONFIG_HOME nor HOME is set, so there is no folder to keep a login in.")),
+		onSome: (found) => succeed(path.join(found, "akter", fileName))
+	});
+});
+const readLogin = fnUntraced(function* readLogin() {
+	const fileSystem = yield* FileSystem;
+	const located = yield* option$1(loginFile());
+	if (!(yield* match$1(located, {
+		onNone: () => succeed(false),
+		onSome: (file) => fileSystem.exists(file).pipe(orElseSucceed(() => false))
+	})) || isNone(located)) return none();
+	const file = located.value;
+	const text = yield* fileSystem.readFileString(file).pipe(mapError(unreadable(file)));
+	const login = yield* decodeEffect(LoginJson)(text).pipe(mapError(unreadable(file)));
+	return some(login);
+});
+const savedSecret = fnUntraced(function* savedSecret(saved) {
+	const login = yield* saved;
+	if (isNone(login)) return none();
+	if (!login.value.keychain) {
+		const secret = fromUndefinedOr(login.value.secret);
+		return map$1(secret, (value) => ({
+			secret: make$1(value),
+			source: "file"
+		}));
+	}
+	const keychain = yield* Keychain;
+	const origin = yield* originOf(login.value.url);
+	const found = yield* match$1(origin, {
+		onNone: () => succeed(none()),
+		onSome: keychain.find
+	});
+	return map$1(found, (value) => ({
+		secret: make$1(value),
+		source: "keychain"
+	}));
+});
+const elsewhere = (savedOrigin, url) => failure(CliExitError.codes.authentication, "LoginForOtherUrl")(`The saved login is for ${savedOrigin}, not ${url.origin}, so akter won't send its key there. Sign in for that URL with akter login --url ${url.origin}, or set AKTER_API_KEY.`);
+/**
+* A saved login's secret goes only to the origin it was saved for, so a --url or AKTER_CLOUD_URL that names another
+* server, typed by mistake or planted in an agent's prompt, can't receive it.
+*/
+const boundTo = fnUntraced(function* boundTo(saved, url) {
+	const login = yield* saved;
+	const file = yield* fromOption(login).pipe(mapError(signedOut));
+	const savedOrigin = yield* originOf(file.url);
+	if (isSome(savedOrigin) && savedOrigin.value !== url.origin) return yield* elsewhere(savedOrigin.value, url);
+	return yield* void_;
+});
+const otherThanEnvironment = (environmentOrigin, url) => failure(CliExitError.codes.usage, "ApiKeyForOtherUrl")(`AKTER_API_KEY is for AKTER_CLOUD_URL, ${environmentOrigin}, not ${url.origin}, so akter won't send it there. Drop --url, or set AKTER_CLOUD_URL to ${url.origin}.`);
+/**
+* AKTER_API_KEY goes only to AKTER_CLOUD_URL's origin when that is set, so a --url planted in an agent's prompt can't
+* collect the key a script or agent runs with. With no AKTER_CLOUD_URL, the caller chose both the key and the URL.
+*/
+const environmentBound = fnUntraced(function* environmentBound(url) {
+	const configured = yield* nonEmpty("AKTER_CLOUD_URL");
+	const origin = yield* flatMap(fromOption(configured), originOf).pipe(orElseSucceed(() => none()));
+	if (isSome(origin) && origin.value !== url.origin) return yield* otherThanEnvironment(origin.value, url);
+	return yield* void_;
+});
+/** AKTER_API_KEY first, so a script or an agent key wins over a person's saved login, which is bound to its origin. */
+const credentialOf = fnUntraced(function* credentialOf(saved, url) {
+	const fromEnvironment = yield* apiKeyFromEnvironment;
+	if (isSome(fromEnvironment)) {
+		yield* environmentBound(url);
+		return {
+			secret: fromEnvironment.value,
+			source: "AKTER_API_KEY"
+		};
+	}
+	const stored = yield* savedSecret(saved);
+	const credential = yield* fromOption(stored).pipe(mapError(signedOut));
+	yield* boundTo(saved, url);
+	return credential;
+});
+const urlOf = fnUntraced(function* urlOf(saved, flag) {
+	const login = yield* saved;
+	const fromEnvironment = yield* nonEmpty("AKTER_CLOUD_URL");
+	const chosen = firstSomeOf([
+		flag,
+		fromEnvironment,
+		map$1(login, (file) => file.url)
+	]);
+	return yield* cloudUrl(getOrElse(chosen, () => defaultCloudUrl)).pipe(mapError((invalid) => failure(CliExitError.codes.usage, "InvalidUrl")(invalid.message)));
+});
+const organizationOf = fnUntraced(function* organizationOf(saved, flag) {
+	const login = yield* saved;
+	const fromEnvironment = yield* nonEmpty("AKTER_ORGANIZATION");
+	const fromLogin = flatMap$1(login, (file) => fromUndefinedOr(file.organization));
+	return firstSomeOf([
+		flag,
+		fromEnvironment,
+		fromLogin
+	]);
+});
+const targetOf = fnUntraced(function* targetOf(saved, flags) {
+	const url = yield* urlOf(saved, flags.url);
+	const organization = yield* organizationOf(saved, flags.organization);
+	const { secret } = yield* credentialOf(saved, url);
+	const missing = failure(CliExitError.codes.usage, "MissingOrganization")("Pass --organization or set AKTER_ORGANIZATION.");
+	return {
+		apiKey: secret,
+		organization: yield* fromOption(organization).pipe(mapError(() => missing)),
+		url: url.href
+	};
+});
+const recordOf = (login, inKeychain) => {
+	const record = {
+		keychain: inKeychain,
+		kind: "apiKey",
+		url: login.url.href
+	};
+	const named = match$1(login.organization, {
+		onNone: () => record,
+		onSome: (organization) => ({
+			...record,
+			organization
+		})
+	});
+	if (inKeychain) return named;
+	return {
+		...named,
+		secret: value(login.secret)
+	};
+};
+const writeOwnerOnly = fnUntraced(function* writeOwnerOnly(file, text) {
+	const fileSystem = yield* FileSystem;
+	const path = yield* Path;
+	const staged = `${file}.tmp`;
+	yield* fileSystem.makeDirectory(path.dirname(file), {
+		mode: ownerOnlyFolder,
+		recursive: true
+	});
+	yield* fileSystem.chmod(path.dirname(file), ownerOnlyFolder);
+	yield* fileSystem.writeFileString(staged, text, { mode: ownerOnlyFile });
+	yield* fileSystem.chmod(staged, ownerOnlyFile);
+	return yield* fileSystem.rename(staged, file);
+});
+const save = fnUntraced(function* save(login) {
+	const file = yield* loginFile();
+	const inKeychain = yield* (yield* Keychain).store(login.url.origin, value(login.secret));
+	const text = yield* encodeEffect(LoginJson)(recordOf(login, inKeychain)).pipe(orDie);
+	yield* writeOwnerOnly(file, `${text}\n`).pipe(mapError((cause) => failure(CliExitError.codes.failed, "LoginNotSaved")(`Could not save the login in ${file}: ${cause.message}`)));
+	return {
+		file,
+		store: match(inKeychain, {
+			onFalse: () => "file",
+			onTrue: () => "keychain"
+		})
+	};
+});
+const clear = fnUntraced(function* clear() {
+	const fileSystem = yield* FileSystem;
+	const keychain = yield* Keychain;
+	const login = yield* readLogin().pipe(orElseSucceed(() => none()));
+	const origin = yield* match$1(login, {
+		onNone: () => succeed(none()),
+		onSome: (record) => originOf(record.url)
+	});
+	const file = yield* loginFile();
+	const exists = yield* fileSystem.exists(file).pipe(orElseSucceed(() => false));
+	yield* match$1(origin, {
+		onNone: () => void_,
+		onSome: keychain.remove
+	});
+	yield* when(ignore(fileSystem.remove(file)), succeed(exists));
+	return exists;
+});
+const make = gen(function* makeCredentials() {
+	const context$1 = yield* context();
+	const provided = (effect) => provideContext(effect, context$1);
+	const saved = yield* readLogin().pipe(provided, cached);
+	return {
+		clear: provided(clear()),
+		/** The secret to sign in at `url` with; a saved login's secret only for the origin it was saved for. */
+		credentialFor: (url) => provided(credentialOf(saved, url)),
+		organization: (flag) => provided(organizationOf(saved, flag)),
+		save: (login) => provided(save(login)),
+		target: (flags) => provided(targetOf(saved, flags)),
+		url: (flag) => provided(urlOf(saved, flag))
+	};
+});
+var Credentials = class extends Service()("@akterjs/cli/credentials/credentials.service/Credentials", { make }) {
+	static layer = effect(this, this.make).pipe(provide(Keychain.layer));
+};
+export { Credentials };

package/dist/credentials/keychain.adapter.mjs

@@ -0,0 +1,92 @@
+import { j as map } from "../Array-B4kuTQeW.mjs";
+import { Dt as orElseSucceed, Gt as scoped, K as forEach, Pt as reduce, Vn as effect, W as fnUntraced, Xt as succeed, a as all, aa as Service, dt as map$1, et as gen, in as timeout, jt as provideService } from "../Effect-CKFpqbmw.mjs";
+import { S as none, _ as isSome, b as map$2, i as filter, w as some } from "../Option-DkxSnBhp.mjs";
+import { M as mkString, T as make, V as runDrain, i as decodeText } from "../Stream-bK9QIETN.mjs";
+import { f as replaceAll, s as isNonEmpty, y as trimEnd } from "../String-q5dcsVe4.mjs";
+import { a as ChildProcessSpawner, n as make$1 } from "../ChildProcess-BCIwxPGc.mjs";
+// src/credentials/keychain.adapter.ts
+const service = "akter-cli";
+const label = "Akter CLI";
+const succeeded = 0;
+const streams = 3;
+const escapeQuote = replaceAll("\"", String.raw`\"`);
+const escapeBackslash = replaceAll("\\", String.raw`\\`);
+const quoted = (value) => `"${escapeQuote(escapeBackslash(value))}"`;
+const encoder = new globalThis.TextEncoder();
+const withInput = (command, args, text) => make$1(command, args, { stdin: make(encoder.encode(text)) });
+const backends = [{
+	lookup: (account) => make$1("security", [
+		"find-generic-password",
+		"-s",
+		service,
+		"-a",
+		account,
+		"-w"
+	]),
+	remove: (account) => make$1("security", [
+		"delete-generic-password",
+		"-s",
+		service,
+		"-a",
+		account
+	]),
+	store: (account, secret) => withInput("security", ["-i"], `add-generic-password -U -s ${service} -a ${quoted(account)} -l ${quoted(label)} -w ${quoted(secret)}\n`)
+}, {
+	lookup: (account) => make$1("secret-tool", [
+		"lookup",
+		"service",
+		service,
+		"account",
+		account
+	]),
+	remove: (account) => make$1("secret-tool", [
+		"clear",
+		"service",
+		service,
+		"account",
+		account
+	]),
+	store: (account, secret) => withInput("secret-tool", [
+		"store",
+		"--label",
+		label,
+		"service",
+		service,
+		"account",
+		account
+	], secret)
+}];
+const run = fnUntraced(function* run(command) {
+	const handle = yield* (yield* ChildProcessSpawner).spawn(command);
+	const output = mkString(decodeText(handle.stdout));
+	const [text, code] = yield* all([
+		output,
+		handle.exitCode,
+		runDrain(handle.stderr)
+	], { concurrency: streams });
+	return filter(some(text), () => code === succeeded);
+}, scoped);
+const attempt = (command) => run(command).pipe(timeout("10 seconds"), orElseSucceed(() => none()));
+const firstFound = (account) => (found, backend) => {
+	if (isSome(found)) return succeed(found);
+	return map$1(attempt(backend.lookup(account)), (output) => filter(map$2(output, (text) => trimEnd(text)), (text) => isNonEmpty(text)));
+};
+const firstStored = (account, secret) => (stored, backend) => {
+	if (stored) return succeed(true);
+	return map$1(attempt(backend.store(account, secret)), isSome);
+};
+const find = (account) => reduce(backends, () => none(), firstFound(account));
+const store = (account, secret) => reduce(backends, () => false, firstStored(account, secret));
+const remove = (account) => forEach(map(backends, (backend) => backend.remove(account)), (command) => attempt(command), { discard: true });
+var Keychain = class extends Service()("@akterjs/cli/credentials/keychain.adapter/Keychain", { make: gen(function* makeKeychain() {
+	const spawner = yield* ChildProcessSpawner;
+	const provide = provideService(ChildProcessSpawner, spawner);
+	return {
+		find: (account) => provide(find(account)),
+		remove: (account) => provide(remove(account)),
+		store: (account, secret) => provide(store(account, secret))
+	};
+}) }) {
+	static layer = effect(this, this.make);
+};
+export { Keychain };