@alchemy.run/axiom 0.0.0 → 2.0.0-beta.85

package/lib/VirtualField.js

@@ -0,0 +1,97 @@
+import * as Axiom from "@distilled.cloud/axiom";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+/**
+ * An Axiom virtual field — a saved APL expression that appears as a derived
+ * column on a dataset at query time. Use these to standardise common
+ * computations (status classes, latency buckets, parsed JSON paths) so
+ * dashboards and monitors don't have to redefine them.
+ *
+ * Bound to a single `dataset`; changing the dataset triggers a replacement.
+ * @see https://axiom.co/docs/query-data/virtual-fields
+ *
+ * ### Creating a Virtual Field
+ * **Example:** HTTP status class (e.g. 200 → "2xx")
+ * ```typescript
+ * yield* Axiom.VirtualField("status-class", {
+ *   dataset: "my-app-traces",
+ *   name: "status_class",
+ *   description: "HTTP response class bucket",
+ *   expression: 'strcat(tostring(toint(status / 100)), "xx")',
+ *   type: "string",
+ * });
+ * ```
+ *
+ * **Example:** Latency bucket in seconds
+ * ```typescript
+ * yield* Axiom.VirtualField("latency-bucket", {
+ *   dataset: "my-app-traces",
+ *   name: "latency_bucket_s",
+ *   expression: "bin(duration_ms / 1000.0, 0.5)",
+ *   type: "number",
+ *   unit: "s",
+ * });
+ * ```
+ *
+ * @resource
+ * @product Dataset
+ */
+export const VirtualField = Resource("Axiom.VirtualField");
+export const VirtualFieldProvider = () => Provider.effect(VirtualField, Effect.gen(function* () {
+    const create = yield* Axiom.createVirtualField;
+    const update = yield* Axiom.updateVirtualField;
+    const get = yield* Axiom.getVirtualField;
+    const del = yield* Axiom.deleteVirtualField;
+    const listVirtualFields = yield* Axiom.getVirtualFields;
+    const listDatasets = yield* Axiom.getDatasets;
+    return {
+        stables: ["id"],
+        // Axiom only exposes a per-dataset virtual-field enumeration
+        // (`GET /v2/vfields?dataset=...`); there is no account-wide list. So
+        // enumerate every dataset (`GET /v2/datasets`), fan out the per-dataset
+        // vfields list with bounded concurrency, and flatten. Each row already
+        // matches the `read` Attributes shape (`CreateVirtualFieldOutput`), so
+        // it's directly usable by `delete` with no follow-up read.
+        list: () => Effect.gen(function* () {
+            const datasets = yield* listDatasets({});
+            const perDataset = yield* Effect.forEach(datasets, (ds) => listVirtualFields({ dataset: ds.name }), { concurrency: 10 });
+            return perDataset.flat().map((vf) => ({ ...vf }));
+        }),
+        diff: Effect.fn(function* ({ news, output }) {
+            if (!isResolved(news))
+                return undefined;
+            if (output && news.dataset !== output.dataset) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news, output }) {
+            // Observe — Axiom assigns the virtual-field id server-side, so
+            // the only handle to a previously-created field is the cached
+            // `output.id`. Probe for live state with that id; treat NotFound
+            // (deleted out-of-band) as "no observed state" so we converge by
+            // re-creating.
+            const observed = output?.id
+                ? yield* get({ id: output.id }).pipe(Effect.catchTag("NotFound", () => Effect.undefined))
+                : undefined;
+            // Ensure — POST mints a new virtual field with a fresh id.
+            if (observed === undefined) {
+                return yield* create(news);
+            }
+            // Sync — the field exists; PUT against its id with the desired
+            // props. `dataset` is replacement-only (handled in diff).
+            return yield* update({ ...news, id: observed.id });
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* del({ id: output.id }).pipe(Effect.catchTag("NotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ output }) {
+            if (!output?.id)
+                return undefined;
+            return yield* get({ id: output.id }).pipe(Effect.catchTag("NotFound", () => Effect.undefined));
+        }),
+    };
+}));
+//# sourceMappingURL=VirtualField.js.map

package/lib/VirtualField.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VirtualField.js","sourceRoot":"","sources":["../src/VirtualField.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAaxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAe,oBAAoB,CAAC,CAAC;AAEzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,EAAE,CACvC,QAAQ,CAAC,MAAM,CACb,YAAY,EACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACzC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC5C,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACxD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAE9C,OAAO;QACL,OAAO,EAAE,CAAC,IAAI,CAAC;QACf,6DAA6D;QAC7D,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,2DAA2D;QAC3D,IAAI,EAAE,GAAG,EAAE,CACT,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACzC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACtC,QAAQ,EACR,CAAC,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAC/C,EAAE,WAAW,EAAE,EAAE,EAAE,CACpB,CAAC;YACF,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC;QACJ,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IAAI,MAAM,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC9C,+DAA+D;YAC/D,8DAA8D;YAC9D,iEAAiE;YACjE,iEAAiE;YACjE,eAAe;YACf,MAAM,QAAQ,GAAG,MAAM,EAAE,EAAE;gBACzB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAChC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpD;gBACH,CAAC,CAAC,SAAS,CAAC;YAEd,2DAA2D;YAC3D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YAED,+DAA+D;YAC/D,0DAA0D;YAC1D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACnC,IAAI,CAAC,MAAM,EAAE,EAAE;gBAAE,OAAO,SAAS,CAAC;YAClC,OAAO,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CACvC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpD,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,14 @@
+export * from "./Annotation.ts";
+export * from "./ApiToken.ts";
+export * from "./AuthProvider.ts";
+export * from "./Chart.ts";
+export * from "./Credentials.ts";
+export * from "./Dashboard.ts";
+export * from "./Dataset.ts";
+export * from "./Monitor.ts";
+export * from "./Notifier.ts";
+export * from "./Telemetry.ts";
+export * from "./Providers.ts";
+export * from "./View.ts";
+export * from "./VirtualField.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC"}

package/lib/index.js

@@ -0,0 +1,14 @@
+export * from "./Annotation.js";
+export * from "./ApiToken.js";
+export * from "./AuthProvider.js";
+export * from "./Chart.js";
+export * from "./Credentials.js";
+export * from "./Dashboard.js";
+export * from "./Dataset.js";
+export * from "./Monitor.js";
+export * from "./Notifier.js";
+export * from "./Telemetry.js";
+export * from "./Providers.js";
+export * from "./View.js";
+export * from "./VirtualField.js";
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alchemy.run/axiom",
-  "version": "0.0.0",
+  "version": "2.0.0-beta.85",
   "description": "Axiom datasets, dashboards, monitors and telemetry export for Alchemy.",
   "keywords": [
     "alchemy",
@@ -10,12 +10,62 @@
     "observability",
     "opentelemetry"
   ],
+  "homepage": "https://alchemy.run",
+  "bugs": {
+    "url": "https://github.com/alchemy-run/alchemy/issues"
+  },
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",
-  "homepage": "https://alchemy.run",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/alchemy-run/alchemy.git",
     "directory": "packages/axiom"
+  },
+  "files": [
+    "lib",
+    "src"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "bun": "./src/index.ts",
+      "worker": "./src/index.ts",
+      "default": "./lib/index.js"
+    },
+    "./*": {
+      "types": "./lib/*.d.ts",
+      "bun": "./src/*.ts",
+      "worker": "./src/*.ts",
+      "default": "./lib/*.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@distilled.cloud/axiom": "1.0.0-rc.18",
+    "@distilled.cloud/core": "1.0.0-rc.18"
+  },
+  "devDependencies": {
+    "@types/bun": "1.4.3",
+    "alchemy": "2.0.0-beta.85",
+    "effect": "^4.1.0",
+    "typescript": "^7.0.2"
+  },
+  "peerDependencies": {
+    "alchemy": "2.0.0-beta.85",
+    "effect": "^4.1.0"
+  },
+  "alchemy": {
+    "contributes": [
+      "@alchemy.run/axiom/Contributions"
+    ]
+  },
+  "scripts": {
+    "build": "pnpm -r --filter \"{.}...\" run build:package",
+    "build:package": "node scripts/build.ts"
   }
-}
+}

package/src/Annotation.ts

@@ -0,0 +1,121 @@
+import * as Axiom from "@distilled.cloud/axiom";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import type { Providers } from "./Providers.ts";
+
+export type AnnotationProps = Axiom.CreateAnnotationRequest;
+
+export type Annotation = Resource<
+  "Axiom.Annotation",
+  AnnotationProps,
+  Axiom.Annotation,
+  never,
+  Providers
+>;
+
+/**
+ * An Axiom annotation — a vertical marker overlaid on charts to flag a
+ * deploy, incident, feature flag flip, or any other point/range event you
+ * want correlated with telemetry.
+ *
+ * Annotations are scoped to one or more `datasets`. Use a single `time` for
+ * a point marker or `time` + `endTime` for a range. The `type` (e.g.
+ * `"deploy"`, `"incident"`) groups markers visually in the UI.
+ *
+ * Although typically created at deploy/release time (out-of-band of
+ * regular IaC), modelling them as resources makes per-environment
+ * annotation history reproducible.
+ * @see https://axiom.co/docs/query-data/annotate-charts
+ *
+ * ### Creating an Annotation
+ * **Example:** Point-in-time deploy marker
+ * ```typescript
+ * yield* Axiom.Annotation("deploy-1.2.3", {
+ *   type: "deploy",
+ *   title: "Release 1.2.3",
+ *   description: "https://github.com/acme/app/releases/tag/v1.2.3",
+ *   datasets: ["my-app-traces", "my-app-logs"],
+ *   time: new Date().toISOString(),
+ *   url: "https://github.com/acme/app/releases/tag/v1.2.3",
+ * });
+ * ```
+ *
+ * **Example:** Incident time-range
+ * ```typescript
+ * yield* Axiom.Annotation("inc-2026-04-27", {
+ *   type: "incident",
+ *   title: "Database failover",
+ *   datasets: ["my-app-traces"],
+ *   time:    "2026-04-27T18:05:00Z",
+ *   endTime: "2026-04-27T18:32:00Z",
+ *   url: "https://incident.io/incidents/abc123",
+ * });
+ * ```
+ *
+ * @resource
+ * @product Dataset
+ */
+export const Annotation = Resource<Annotation>("Axiom.Annotation");
+
+export const AnnotationProvider = () =>
+  Provider.effect(
+    Annotation,
+    Effect.gen(function* () {
+      const create = yield* Axiom.createAnnotation;
+      const update = yield* Axiom.updateAnnotation;
+      const get = yield* Axiom.getAnnotation;
+      const del = yield* Axiom.deleteAnnotation;
+      const listAnnotations = yield* Axiom.getAnnotations;
+
+      return {
+        stables: ["id"],
+        // Axiom exposes a flat, account-wide `GET /v2/annotations` list that
+        // returns every annotation's full record in one (non-paginated)
+        // response — the exact same shape `get`/`read` produce. Hand each
+        // record back directly as the resource's Attributes.
+        list: () =>
+          listAnnotations({}).pipe(Effect.map((annotations) => annotations.map((a) => ({ ...a })))),
+        reconcile: Effect.fn(function* ({ news, output }) {
+          // Observe — Axiom assigns the annotation id server-side, so the
+          // only handle to a previously-created annotation is the cached
+          // `output.id`. Probe for live state with that id; treat NotFound
+          // (deleted out-of-band, or never created) as "no observed state".
+          const observed = output?.id
+            ? yield* get({ id: output.id }).pipe(
+                Effect.catchTag("NotFound", () => Effect.undefined),
+              )
+            : undefined;
+
+          // Ensure — when no observed annotation exists, POST creates one
+          // and Axiom assigns the id.
+          if (observed === undefined) {
+            return yield* create(news);
+          }
+
+          // Sync — the annotation exists; apply desired props with PUT and
+          // preserve the stable id and original time as fallbacks.
+          const result = yield* update({ ...news, id: observed.id! });
+          return {
+            ...result,
+            id: observed.id!,
+            time: result.time ?? output?.time ?? news.time,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* del({ id: output.id }).pipe(Effect.catchTag("NotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.id) return undefined;
+          return yield* get({ id: output.id }).pipe(
+            Effect.map((current) => ({
+              ...current,
+              id: current.id ?? output.id,
+              time: current.time ?? output.time,
+            })),
+            Effect.catchTag("NotFound", () => Effect.undefined),
+          );
+        }),
+      };
+    }),
+  );

package/src/ApiToken.ts

@@ -0,0 +1,158 @@
+import * as Axiom from "@distilled.cloud/axiom";
+import { deepEqual, isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import type { Providers } from "./Providers.ts";
+
+export type ApiTokenProps = Omit<Axiom.CreateAPITokenRequest, never>;
+
+export type ApiToken = Resource<
+  "Axiom.ApiToken",
+  ApiTokenProps,
+  Omit<Axiom.CreateAPITokenResponse, "token"> & {
+    /**
+     * The bearer token. Returned only by `create` (and `regenerate`); Axiom
+     * does not return it on subsequent reads. Persisted in resource state via
+     * `Redacted` — handle with care.
+     */
+    token: Redacted.Redacted<string>;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * An Axiom API token — a scoped bearer token used to authenticate API
+ * requests (ingest, query, admin). Capabilities are pinned at creation time;
+ * changing any field triggers a **replacement** because Axiom does not
+ * expose an update endpoint.
+ *
+ * The raw token value is returned only by `create`. After that, Axiom
+ * never echoes it back, so it is captured into `output.token` (as a
+ * {@link Redacted}) on initial create and persisted in resource state.
+ * Treat resource state as sensitive — anyone with read access can recover
+ * the token. Pair with a secret store for downstream consumption.
+ * @see https://axiom.co/docs/reference/tokens
+ *
+ * ### Creating an API Token
+ * **Example:** Ingest-only token scoped to one dataset
+ * ```typescript
+ * const ingest = yield* Axiom.ApiToken("ingest", {
+ *   name: "prod-ingest",
+ *   description: "OTEL collector ingest",
+ *   datasetCapabilities: {
+ *     "my-app-traces": { ingest: ["create"] },
+ *   },
+ * });
+ * ```
+ *
+ * **Example:** Read-only query token
+ * ```typescript
+ * yield* Axiom.ApiToken("query", {
+ *   name: "grafana-reader",
+ *   datasetCapabilities: {
+ *     "my-app-traces": { query: ["read"] },
+ *     "my-app-logs":   { query: ["read"] },
+ *   },
+ * });
+ * ```
+ *
+ * ### Consuming the Token
+ * **Example:** Forward the token via Cloudflare Secrets
+ * ```typescript
+ * const secret = yield* Cloudflare.SecretsStore.Secret("axiom-token", {
+ *   value: ingest.token,
+ * });
+ * ```
+ *
+ * @resource
+ * @product API Token
+ */
+export const ApiToken = Resource<ApiToken>("Axiom.ApiToken");
+
+/** Axiom created a token but returned no bearer value. */
+export class MissingApiTokenValue extends Data.TaggedError("MissingApiTokenValue")<{
+  readonly id: string;
+}> {
+  override get message() {
+    return `Axiom did not return a value for the new API token ${this.id}`;
+  }
+}
+
+export const ApiTokenProvider = () =>
+  Provider.effect(
+    ApiToken,
+    Effect.gen(function* () {
+      const create = yield* Axiom.createAPIToken;
+      const get = yield* Axiom.getAPIToken;
+      const del = yield* Axiom.deleteAPIToken;
+      const listTokens = yield* Axiom.getAPITokens;
+
+      return {
+        stables: ["id", "token"],
+        // Enumerate every API token in the org. Axiom exposes a single
+        // account-wide `GET /v2/tokens` collection op (no pagination), so we
+        // fetch it once and hydrate each row into the exact `read` Attributes
+        // shape. The bearer secret is returned by Axiom only at creation and is
+        // never echoed back on enumeration, so — matching `read`, which sources
+        // the secret from cached state — we surface an empty Redacted token
+        // here rather than the real value.
+        list: () =>
+          Effect.gen(function* () {
+            const tokens = yield* listTokens({});
+            return tokens.map((token) => ({
+              ...token,
+              token: Redacted.make(""),
+            }));
+          }),
+        diff: Effect.fn(function* ({ olds, news, output }) {
+          if (!isResolved(news)) return undefined;
+          // First create — let the engine create normally.
+          if (output == null) return undefined;
+          // Axiom has no update endpoint for tokens, so any actual change
+          // to the inputs forces a replacement (which mints a new bearer
+          // value). If nothing changed, fall through to `noop` so we don't
+          // needlessly rotate the token on every deploy.
+          if (deepEqual(olds, news)) return undefined;
+          return { action: "replace" } as const;
+        }),
+        reconcile: Effect.fn(function* ({ news, output }) {
+          // Observe — Axiom does not expose an update endpoint for tokens,
+          // so any actual change to the inputs is forced to a replacement
+          // by `diff` above. That means by the time `reconcile` runs we
+          // are either (a) creating fresh, or (b) re-reconciling identical
+          // inputs against an existing token.
+          if (output !== undefined) {
+            // Identical inputs — Axiom does not echo the bearer back, so
+            // the cached `output` (with the persisted Redacted token) is
+            // the authoritative current state.
+            return output;
+          }
+
+          // Ensure — mint a new token. Axiom returns the bearer exactly
+          // once; capture it into Redacted state for downstream consumers.
+          const result = yield* create(news);
+          if (!result.token) {
+            return yield* Effect.die(new MissingApiTokenValue({ id: result.id }));
+          }
+          return {
+            ...result,
+            token: Redacted.isRedacted(result.token) ? result.token : Redacted.make(result.token),
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* del({ id: output.id }).pipe(Effect.catchTag("NotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.id) return undefined;
+          return yield* get({ id: output.id }).pipe(
+            Effect.map((current) => ({ ...current, token: output.token })),
+            Effect.catchTag("NotFound", () => Effect.undefined),
+          );
+        }),
+      };
+    }),
+  );

package/src/AuthProvider.ts

@@ -0,0 +1,135 @@
+import { DEFAULT_API_BASE_URL } from "@distilled.cloud/axiom/Credentials";
+import { AuthError } from "alchemy/Auth/AuthProvider";
+import { getEnv, getEnvRedacted } from "alchemy/Auth/Env";
+import {
+  makeStoredAuthProvider,
+  storedSecret,
+  storedValueText,
+  type StoredAuthConfig,
+} from "alchemy/Auth/StoredAuthProvider";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+
+export const AXIOM_AUTH_PROVIDER_NAME = "Axiom";
+
+export type AxiomAuthConfig = StoredAuthConfig;
+
+/**
+ * Resolved Axiom credentials. The provider values are a flat record
+ * (token + optional orgId/apiBaseUrl); the `apiToken`/`pat` distinction is
+ * derived at resolution time from orgId presence — an org id means the token
+ * is treated as a personal access token, mirroring how the CI environment
+ * resolution has always classified `AXIOM_ORG_ID`.
+ */
+export type AxiomResolvedCredentials =
+  | {
+      type: "apiToken";
+      apiToken: Redacted.Redacted<string>;
+      apiBaseUrl: string;
+      orgId?: string;
+      source: { type: AxiomAuthConfig["method"] | "env"; details?: string };
+    }
+  | {
+      type: "pat";
+      apiToken: Redacted.Redacted<string>;
+      apiBaseUrl: string;
+      orgId: string;
+      source: { type: AxiomAuthConfig["method"] | "env"; details?: string };
+    };
+
+const readEnvironment = Effect.gen(function* () {
+  const apiToken =
+    (yield* getEnvRedacted("AXIOM_TOKEN")) ?? (yield* getEnvRedacted("AXIOM_API_KEY"));
+  if (!apiToken) {
+    return yield* AuthError.make({
+      message: "Axiom CI credentials not found. Set AXIOM_TOKEN or AXIOM_API_KEY.",
+    });
+  }
+  const apiBaseUrl = (yield* getEnv("AXIOM_URL")) ?? DEFAULT_API_BASE_URL;
+  const orgId = yield* getEnv("AXIOM_ORG_ID");
+  return orgId
+    ? {
+        type: "pat" as const,
+        apiToken,
+        apiBaseUrl,
+        orgId,
+        source: { type: "env" as const },
+      }
+    : {
+        type: "apiToken" as const,
+        apiToken,
+        apiBaseUrl,
+        source: { type: "env" as const },
+      };
+});
+
+const axiomAuth = makeStoredAuthProvider<AxiomResolvedCredentials>({
+  provider: AXIOM_AUTH_PROVIDER_NAME,
+  fields: [
+    {
+      name: "token",
+      label: "Axiom API Token or Personal Access Token",
+      secret: true,
+    },
+    {
+      name: "orgId",
+      label: "Axiom Org ID (required for personal access tokens)",
+      optional: true,
+    },
+    {
+      name: "apiBaseUrl",
+      label: "Axiom API Base URL",
+      optional: true,
+      placeholder: DEFAULT_API_BASE_URL,
+    },
+  ],
+  toResolved: (values, source) => {
+    const apiToken = storedSecret(values.token) ?? Redacted.make("");
+    const apiBaseUrl = storedValueText(values.apiBaseUrl) ?? DEFAULT_API_BASE_URL;
+    return values.orgId !== undefined
+      ? {
+          type: "pat",
+          apiToken,
+          apiBaseUrl,
+          orgId: storedValueText(values.orgId) ?? "",
+          source: { type: source },
+        }
+      : {
+          type: "apiToken",
+          apiToken,
+          apiBaseUrl,
+          source: { type: source },
+        };
+  },
+  readEnvironment,
+  environment: [
+    {
+      name: "AXIOM_TOKEN",
+      required: true,
+      secret: true,
+      alternatives: ["AXIOM_API_KEY"],
+      description: "Personal access token or API token.",
+    },
+    {
+      name: "AXIOM_URL",
+      required: false,
+      description: "API base URL for self-hosted or regional deployments.",
+    },
+    {
+      name: "AXIOM_ORG_ID",
+      required: false,
+      description: "Organization id; required when the token is a personal access token.",
+    },
+  ],
+});
+
+/**
+ * Layer that registers the Axiom {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the Axiom
+ * `providers()` layer so the alchemy CLI can discover it.
+ */
+export const AxiomAuth = axiomAuth.layer;
+
+/** Schema of Axiom's inline static-token values. */
+export const AxiomStoredCredentials = axiomAuth.storedSchema;
+export type AxiomStoredCredentials = typeof AxiomStoredCredentials.Type;