@alchemy.run/boat 0.0.0 → 2.0.0-beta.87

package/lib/CredentialProfile.d.ts

@@ -0,0 +1,157 @@
+import * as boat from "@distilled.cloud/boat-dev/boat";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Redacted from "effect/Redacted";
+import type { Providers } from "./Providers.ts";
+type Secret = string | Redacted.Redacted<string>;
+/** A secret for any HTTPS API, and the base URL it is sent to. */
+export interface CredentialProfileApi {
+    /** The secret. A sandbox gets it as the variable the API is named after. */
+    key: Secret;
+    /**
+     * The API's base URL: HTTPS on the default port, with a public DNS name.
+     * A sandbox gets it as `<NAME>_BASE_URL`, and code there must send its
+     * requests to that variable: with the AI credentials proxy on it holds
+     * the proxy's URL, and only the proxy can swap the placeholder for `key`.
+     */
+    baseUrl: string;
+}
+export interface CredentialProfileProps {
+    /**
+     * Profile name, unique among its owner's profiles. If omitted, a unique
+     * name is generated from the stack, stage and logical ID. Renamed in
+     * place.
+     */
+    name?: string;
+    /** Anthropic API key. Sandboxes get it as `ANTHROPIC_API_KEY`. */
+    anthropic?: Secret;
+    /** OpenAI API key. Sandboxes get it as `OPENAI_API_KEY`. */
+    openai?: Secret;
+    /** OpenRouter API key. */
+    openrouter?: Secret;
+    /** LLM Gateway API key. */
+    llmgateway?: Secret;
+    /** DeepSeek API key. */
+    deepseek?: Secret;
+    /** Moonshot API key. */
+    moonshot?: Secret;
+    /** Mistral API key. */
+    mistral?: Secret;
+    /** xAI API key. */
+    xai?: Secret;
+    /** OpenCode API key. */
+    opencode?: Secret;
+    /**
+     * Secrets for any other HTTPS API, keyed by the environment variable a
+     * sandbox gets the secret as: `A-Z`, `0-9` and `_`, up to 64 characters.
+     * Provider names (`ANTHROPIC_*`, `OPENAI_*`, `AWS_*`, …) and names ending
+     * in `_BASE_URL` are reserved.
+     */
+    apis?: Record<string, CredentialProfileApi>;
+}
+export interface CredentialProfileAttributes {
+    /** Boat's profile id. */
+    credentialProfileId: string;
+    name: string;
+    /**
+     * The organization that owns the profile, as the stack's `org` named it;
+     * `undefined` for a personal profile.
+     */
+    org: string | undefined;
+    /** Whether it is its owner's default: what a sandbox gets when its environment names no profile. */
+    isDefault: boolean;
+    /** The credentials it holds, by Boat's ids (`anthropic-api-key`, `claude-subscription`, …). */
+    connected: string[];
+    /** The names of its custom APIs. */
+    customApis: string[];
+}
+export interface CredentialProfile extends Resource<"Boat.CredentialProfile", CredentialProfileProps, CredentialProfileAttributes, never, Providers, {
+    name: string;
+}> {
+}
+/**
+ * A Boat credential profile: a named set of API keys that Boat stores
+ * encrypted and hands to the sandboxes of an environment that names it.
+ *
+ * A profile holds provider API keys (Anthropic, OpenAI, …) and custom APIs:
+ * a secret for any other HTTPS API, with the base URL it is sent to. Boat
+ * never returns a secret once it is stored.
+ *
+ * The API keys and custom APIs of a declared profile are exactly the ones
+ * its props list: a deploy removes any other. Sign-ins (a Claude or ChatGPT
+ * subscription) and Bedrock are connected on Boat's dashboard and left
+ * alone.
+ *
+ * A profile is personal, or owned by an organization. With an `org` on the
+ * stack (`Boat.providers({ org })`, or the profile's) the organization owns
+ * it: every member's sandboxes can use it, and only owners change it.
+ * Without one it is yours. Changing the stack's `org` replaces it.
+ *
+ * ### Creating a profile
+ * **Example:** Provider API keys
+ * ```typescript
+ * export const MyProfile = Boat.CredentialProfile("MyProfile", {
+ *   anthropic: Config.Redacted("ANTHROPIC_API_KEY"),
+ *   openai: Config.Redacted("OPENAI_API_KEY"),
+ * });
+ * ```
+ *
+ * **Example:** A secret for any other API
+ * ```typescript
+ * export const Payments = Boat.CredentialProfile("Payments", {
+ *   apis: {
+ *     STRIPE_KEY: {
+ *       key: Config.Redacted("STRIPE_KEY"),
+ *       baseUrl: "https://api.stripe.com/v1",
+ *     },
+ *   },
+ * });
+ * ```
+ *
+ * A sandbox gets `STRIPE_KEY` and `STRIPE_KEY_BASE_URL`. Send requests to
+ * `$STRIPE_KEY_BASE_URL`, not to the API's own address, so the same code
+ * works when the AI credentials proxy replaces both.
+ *
+ * ### Giving sandboxes a profile
+ * **Example:** Name it on an environment
+ * ```typescript
+ * export const MyProfile = Boat.CredentialProfile("MyProfile", {
+ *   anthropic: Config.Redacted("ANTHROPIC_API_KEY"),
+ * });
+ *
+ * export const MyEnv = Boat.Environment("MyEnv", { credentialProfile: MyProfile });
+ *
+ * export const Box = Boat.Sandbox("Box", { environment: MyEnv });
+ * ```
+ *
+ * **Example:** Placeholders instead of real keys
+ * ```typescript
+ * export const MyProfile = Boat.CredentialProfile("MyProfile", {
+ *   anthropic: Config.Redacted("ANTHROPIC_API_KEY"),
+ * });
+ *
+ * // Billed: $1 a day, plus $1 per 1,000 proxied requests.
+ * export const Proxy = Boat.AiProxy("Proxy", { enabled: true });
+ *
+ * export const Tenants = Boat.Environment("Tenants", {
+ *   safeForThirdParties: true,
+ *   credentialProfile: MyProfile,
+ *   proxyAiCredentials: Proxy,
+ * });
+ * ```
+ *
+ * ### Referencing a profile the stack doesn't manage
+ * **Example:** The default profile, with the sign-ins made on the dashboard
+ * ```typescript
+ * export const MyEnv = Boat.Environment("MyEnv", {
+ *   credentialProfile: Boat.CredentialProfile.lookup({ name: "default" }),
+ * });
+ * ```
+ *
+ * @resource
+ * @product Credential Profile
+ */
+export declare const CredentialProfile: import("alchemy/Resource").ResourceClass<CredentialProfile>;
+export declare const CredentialProfileProvider: () => import("effect/Layer").Layer<Provider.Provider<CredentialProfile>, never, import("alchemy/Stack").Stack | import("alchemy/Stage").Stage | boat.BoatOpContext>;
+export {};
+//# sourceMappingURL=CredentialProfile.d.ts.map

package/lib/CredentialProfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialProfile.d.ts","sources":["../src/CredentialProfile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,gCAAgC,CAAC;AAEvD,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAI5C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,KAAK,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAEjD,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mBAAmB;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,2BAA2B;IAC1C,yBAAyB;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,oGAAoG;IACpG,SAAS,EAAE,OAAO,CAAC;IACnB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,oCAAoC;IACpC,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,wBAAwB,EACxB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,SAAS,EACT;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CACjB;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AACH,eAAO,MAAM,iBAAiB,6DAAwD,CAAC;AAmDvF,eAAO,MAAM,yBAAyB,qKAkInC,CAAC"}

package/lib/CredentialProfile.js

@@ -0,0 +1,245 @@
+import * as boat from "@distilled.cloud/boat-dev/boat";
+import { Unowned } from "alchemy/AdoptPolicy";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { BoatUnexpectedResponse } from "./Errors.js";
+import { inOrg, isOrgAccount, sameOrg, stackOrg } from "./internal/Org.js";
+import { boatName, isGeneratedName } from "./internal/Ownership.js";
+/**
+ * A Boat credential profile: a named set of API keys that Boat stores
+ * encrypted and hands to the sandboxes of an environment that names it.
+ *
+ * A profile holds provider API keys (Anthropic, OpenAI, …) and custom APIs:
+ * a secret for any other HTTPS API, with the base URL it is sent to. Boat
+ * never returns a secret once it is stored.
+ *
+ * The API keys and custom APIs of a declared profile are exactly the ones
+ * its props list: a deploy removes any other. Sign-ins (a Claude or ChatGPT
+ * subscription) and Bedrock are connected on Boat's dashboard and left
+ * alone.
+ *
+ * A profile is personal, or owned by an organization. With an `org` on the
+ * stack (`Boat.providers({ org })`, or the profile's) the organization owns
+ * it: every member's sandboxes can use it, and only owners change it.
+ * Without one it is yours. Changing the stack's `org` replaces it.
+ *
+ * ### Creating a profile
+ * **Example:** Provider API keys
+ * ```typescript
+ * export const MyProfile = Boat.CredentialProfile("MyProfile", {
+ *   anthropic: Config.Redacted("ANTHROPIC_API_KEY"),
+ *   openai: Config.Redacted("OPENAI_API_KEY"),
+ * });
+ * ```
+ *
+ * **Example:** A secret for any other API
+ * ```typescript
+ * export const Payments = Boat.CredentialProfile("Payments", {
+ *   apis: {
+ *     STRIPE_KEY: {
+ *       key: Config.Redacted("STRIPE_KEY"),
+ *       baseUrl: "https://api.stripe.com/v1",
+ *     },
+ *   },
+ * });
+ * ```
+ *
+ * A sandbox gets `STRIPE_KEY` and `STRIPE_KEY_BASE_URL`. Send requests to
+ * `$STRIPE_KEY_BASE_URL`, not to the API's own address, so the same code
+ * works when the AI credentials proxy replaces both.
+ *
+ * ### Giving sandboxes a profile
+ * **Example:** Name it on an environment
+ * ```typescript
+ * export const MyProfile = Boat.CredentialProfile("MyProfile", {
+ *   anthropic: Config.Redacted("ANTHROPIC_API_KEY"),
+ * });
+ *
+ * export const MyEnv = Boat.Environment("MyEnv", { credentialProfile: MyProfile });
+ *
+ * export const Box = Boat.Sandbox("Box", { environment: MyEnv });
+ * ```
+ *
+ * **Example:** Placeholders instead of real keys
+ * ```typescript
+ * export const MyProfile = Boat.CredentialProfile("MyProfile", {
+ *   anthropic: Config.Redacted("ANTHROPIC_API_KEY"),
+ * });
+ *
+ * // Billed: $1 a day, plus $1 per 1,000 proxied requests.
+ * export const Proxy = Boat.AiProxy("Proxy", { enabled: true });
+ *
+ * export const Tenants = Boat.Environment("Tenants", {
+ *   safeForThirdParties: true,
+ *   credentialProfile: MyProfile,
+ *   proxyAiCredentials: Proxy,
+ * });
+ * ```
+ *
+ * ### Referencing a profile the stack doesn't manage
+ * **Example:** The default profile, with the sign-ins made on the dashboard
+ * ```typescript
+ * export const MyEnv = Boat.Environment("MyEnv", {
+ *   credentialProfile: Boat.CredentialProfile.lookup({ name: "default" }),
+ * });
+ * ```
+ *
+ * @resource
+ * @product Credential Profile
+ */
+export const CredentialProfile = Resource("Boat.CredentialProfile");
+/** Props that hold a provider API key, and the credential Boat stores each as. */
+const PROVIDER_KEYS = {
+    anthropic: "anthropic-api-key",
+    openai: "openai-api-key",
+    openrouter: "openrouter-api-key",
+    llmgateway: "llmgateway-api-key",
+    deepseek: "deepseek-api-key",
+    moonshot: "moonshot-api-key",
+    mistral: "mistral-api-key",
+    xai: "xai-api-key",
+    opencode: "opencode-api-key",
+};
+const providerKeys = Object.entries(PROVIDER_KEYS);
+const reveal = (value) => Redacted.isRedacted(value) ? Redacted.value(value) : value;
+/** The profiles of the stack's owner: the organization, or you. */
+const listProfiles = Effect.fn(function* (org) {
+    const { profiles } = yield* boat.listCredentialProfiles({});
+    return profiles.filter((profile) => isOrgAccount(profile.owner, org));
+});
+const findProfile = Effect.fn(function* (org, match) {
+    const profiles = yield* listProfiles(org);
+    return (profiles.find((profile) => profile.id === match.credentialProfileId) ??
+        profiles.find((profile) => profile.name === match.name));
+});
+const toAttributes = (profile, org) => ({
+    credentialProfileId: profile.id,
+    name: profile.name,
+    org,
+    isDefault: profile.isDefault,
+    connected: [...profile.connected],
+    customApis: [...profile.customApis],
+});
+export const CredentialProfileProvider = () => Provider.effect(CredentialProfile, Effect.gen(function* () {
+    return {
+        stables: ["credentialProfileId", "org"],
+        // A profile belongs to one organization (or to you) for life.
+        diff: Effect.fn(function* ({ output }) {
+            if (output !== undefined && !sameOrg(output.org, yield* stackOrg)) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            const name = output?.name ?? (yield* boatName(id, olds?.name, 64));
+            const org = output ? output.org : yield* stackOrg;
+            const profile = yield* findProfile(org, {
+                credentialProfileId: output?.credentialProfileId,
+                name,
+            });
+            if (profile === undefined)
+                return undefined;
+            const attrs = toAttributes(profile, org);
+            return output !== undefined || isGeneratedName(profile.name) ? attrs : Unowned(attrs);
+        }),
+        lookup: Effect.fn(function* ({ name }) {
+            const org = yield* stackOrg;
+            const profile = yield* findProfile(org, { name });
+            return profile === undefined ? undefined : toAttributes(profile, org);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, olds, output, session }) {
+            const name = yield* boatName(id, news.name ?? output?.name, 64);
+            // A different org replaces (see diff), so this is the org that owns it.
+            const org = yield* stackOrg;
+            // Observe — by id once we have one (it survives renames), else by name.
+            let profile = yield* findProfile(org, {
+                credentialProfileId: output?.credentialProfileId,
+                name,
+            });
+            // Ensure — a concurrent create of the same name is a race, not a failure.
+            if (profile === undefined) {
+                yield* session.note(`Creating credential profile ${name}...`);
+                const created = yield* boat
+                    // Without an `org`, the profile is yours.
+                    .createCredentialProfile({ name, ...inOrg(org) })
+                    .pipe(Effect.catchTag("Conflict", () => Effect.succeed(undefined)));
+                profile = created?.profile ?? (yield* findProfile(org, { name }));
+                if (profile === undefined) {
+                    return yield* new BoatUnexpectedResponse({
+                        message: `Boat credential profile ${name} vanished after create`,
+                    });
+                }
+            }
+            // Sync the name.
+            if (profile.name !== name) {
+                profile = (yield* boat.updateCredentialProfile({ profile: profile.id, name })).profile;
+            }
+            // Sync provider keys. Boat never returns a key, so what it holds is
+            // observed (`connected`) and the value is compared with the one last
+            // deployed. An adopted profile has none, so every key is written.
+            for (const [prop, credential] of providerKeys) {
+                const value = reveal(news[prop]);
+                if (value === undefined) {
+                    if (profile.connected.includes(credential)) {
+                        profile =
+                            (yield* boat
+                                .deleteCredentialProfileKey({ profile: profile.id, credential })
+                                .pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined))))?.profile ??
+                                profile;
+                    }
+                }
+                else if (olds === undefined ||
+                    !profile.connected.includes(credential) ||
+                    reveal(olds[prop]) !== value) {
+                    profile = (yield* boat.setCredentialProfileKey({
+                        profile: profile.id,
+                        credential,
+                        value,
+                    })).profile;
+                }
+            }
+            // Sync custom APIs, the same way.
+            const apis = news.apis ?? {};
+            for (const apiName of profile.customApis) {
+                if (apiName in apis)
+                    continue;
+                profile =
+                    (yield* boat
+                        .deleteCredentialProfileCustomApi({ profile: profile.id, name: apiName })
+                        .pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined))))?.profile ??
+                        profile;
+            }
+            for (const [apiName, api] of Object.entries(apis)) {
+                const old = olds?.apis?.[apiName];
+                if (old !== undefined &&
+                    profile.customApis.includes(apiName) &&
+                    reveal(old.key) === reveal(api.key) &&
+                    old.baseUrl === api.baseUrl) {
+                    continue;
+                }
+                profile = (yield* boat.setCredentialProfileCustomApi({
+                    profile: profile.id,
+                    name: apiName,
+                    value: reveal(api.key) ?? "",
+                    baseUrl: api.baseUrl,
+                })).profile;
+            }
+            return toAttributes(profile, org);
+        }),
+        // An environment that still names the profile fails the delete with
+        // Boat's own `in_use`; the engine deletes dependents first.
+        delete: Effect.fn(function* ({ output }) {
+            yield* boat
+                .deleteCredentialProfile({ profile: output.credentialProfileId })
+                .pipe(Effect.catchTag("NotFound", () => Effect.void));
+        }),
+        list: Effect.fn(function* () {
+            const org = yield* stackOrg;
+            return (yield* listProfiles(org))
+                .filter((profile) => isGeneratedName(profile.name))
+                .map((profile) => toAttributes(profile, org));
+        }),
+    };
+}));
+//# sourceMappingURL=CredentialProfile.js.map

package/lib/CredentialProfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialProfile.js","sources":["../src/CredentialProfile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,gCAAgC,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AA8EpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAoB,wBAAwB,CAAC,CAAC;AAEvF,kFAAkF;AAClF,MAAM,aAAa,GAAG;IACpB,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,gBAAgB;IACxB,UAAU,EAAE,oBAAoB;IAChC,UAAU,EAAE,oBAAoB;IAChC,QAAQ,EAAE,kBAAkB;IAC5B,QAAQ,EAAE,kBAAkB;IAC5B,OAAO,EAAE,iBAAiB;IAC1B,GAAG,EAAE,aAAa;IAClB,QAAQ,EAAE,kBAAkB;CACuD,CAAC;AAEtF,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAEhD,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,KAAyB,EAAE,EAAE,CAC3C,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAE7D,mEAAmE;AACnE,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAuB;IAC/D,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC5D,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACrC,GAAuB,EACvB,KAAqD;IAErD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,CACL,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,KAAK,CAAC,mBAAmB,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CACxD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CACnB,OAA+B,EAC/B,GAAuB,EACM,EAAE,CAAC,CAAC;IACjC,mBAAmB,EAAE,OAAO,CAAC,EAAE;IAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;IAClB,GAAG;IACH,SAAS,EAAE,OAAO,CAAC,SAAS;IAC5B,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IACjC,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,EAAE,CAC5C,QAAQ,CAAC,MAAM,CACb,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO;QACL,OAAO,EAAE,CAAC,qBAAqB,EAAE,KAAK,CAAC;QACvC,8DAA8D;QAC9D,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACnC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YACnE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;YAClD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;gBACtC,mBAAmB,EAAE,MAAM,EAAE,mBAAmB;gBAChD,IAAI;aACL,CAAC,CAAC;YACH,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC5C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACzC,OAAO,MAAM,KAAK,SAAS,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxF,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;YACnC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;YAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YACjE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAChE,wEAAwE;YACxE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;YAE5B,wEAAwE;YACxE,IAAI,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;gBACpC,mBAAmB,EAAE,MAAM,EAAE,mBAAmB;gBAChD,IAAI;aACL,CAAC,CAAC;YAEH,0EAA0E;YAC1E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,+BAA+B,IAAI,KAAK,CAAC,CAAC;gBAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI;oBACzB,0CAA0C;qBACzC,uBAAuB,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;qBAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACtE,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC1B,OAAO,KAAK,CAAC,CAAC,IAAI,sBAAsB,CAAC;wBACvC,OAAO,EAAE,2BAA2B,IAAI,wBAAwB;qBACjE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,iBAAiB;YACjB,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACzF,CAAC;YAED,oEAAoE;YACpE,qEAAqE;YACrE,kEAAkE;YAClE,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,YAAY,EAAE,CAAC;gBAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC3C,OAAO;4BACL,CAAC,KAAK,CAAC,CAAC,IAAI;iCACT,0BAA0B,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;iCAC/D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO;gCAC/E,OAAO,CAAC;oBACZ,CAAC;gBACH,CAAC;qBAAM,IACL,IAAI,KAAK,SAAS;oBAClB,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,EAC5B,CAAC;oBACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;wBAC7C,OAAO,EAAE,OAAO,CAAC,EAAE;wBACnB,UAAU;wBACV,KAAK;qBACN,CAAC,CAAC,CAAC,OAAO,CAAC;gBACd,CAAC;YACH,CAAC;YAED,kCAAkC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YAC7B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACzC,IAAI,OAAO,IAAI,IAAI;oBAAE,SAAS;gBAC9B,OAAO;oBACL,CAAC,KAAK,CAAC,CAAC,IAAI;yBACT,gCAAgC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;yBACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO;wBAC/E,OAAO,CAAC;YACZ,CAAC;YACD,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClD,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;gBAClC,IACE,GAAG,KAAK,SAAS;oBACjB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACpC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;oBACnC,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAC3B,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;oBACnD,OAAO,EAAE,OAAO,CAAC,EAAE;oBACnB,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;oBAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC,CAAC,CAAC,OAAO,CAAC;YACd,CAAC;YAED,OAAO,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC;QACF,oEAAoE;QACpE,4DAA4D;QAC5D,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,IAAI;iBACR,uBAAuB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC;iBAChE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;YACvB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;iBAC9B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;iBAClD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Credentials.d.ts

@@ -0,0 +1,15 @@
+import { Credentials } from "@distilled.cloud/boat-dev/Credentials";
+import * as Layer from "effect/Layer";
+export { Credentials, CredentialsFromEnv, DEFAULT_API_BASE_URL, fromApiKey, } from "@distilled.cloud/boat-dev/Credentials";
+/**
+ * Build Boat `Credentials` that resolve through the Alchemy AuthProvider:
+ * `BOAT_API_KEY` (+ `BOAT_ORG`) when set, otherwise the selected profile,
+ * whose `org` every call sends as `X-Boat-Org`; `options.org` overrides
+ * it. Resolution is
+ * deferred until the first API call, so building the provider layers never
+ * needs a profile.
+ */
+export declare const fromAuthProvider: (options?: {
+    readonly org?: string;
+}) => Layer.Layer<Credentials, never, import("alchemy/Auth/Registry").AuthProviders | import("alchemy/Auth/Profile").ProfileStore>;
+//# sourceMappingURL=Credentials.d.ts.map

package/lib/Credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Credentials.d.ts","sources":["../src/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AAGpE,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,GACX,MAAM,uCAAuC,CAAC;AAE/C;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,aAAc;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,iIAWjE,CAAC"}

package/lib/Credentials.js

@@ -0,0 +1,23 @@
+import { Credentials } from "@distilled.cloud/boat-dev/Credentials";
+import { ConfigError } from "@distilled.cloud/core/errors";
+import { lazyCredentials } from "alchemy/Auth/Resolve";
+import * as Layer from "effect/Layer";
+import { BOAT_AUTH_PROVIDER_NAME } from "./AuthProvider.js";
+export { Credentials, CredentialsFromEnv, DEFAULT_API_BASE_URL, fromApiKey, } from "@distilled.cloud/boat-dev/Credentials";
+/**
+ * Build Boat `Credentials` that resolve through the Alchemy AuthProvider:
+ * `BOAT_API_KEY` (+ `BOAT_ORG`) when set, otherwise the selected profile,
+ * whose `org` every call sends as `X-Boat-Org`; `options.org` overrides
+ * it. Resolution is
+ * deferred until the first API call, so building the provider layers never
+ * needs a profile.
+ */
+export const fromAuthProvider = (options) => Layer.effect(Credentials, lazyCredentials()(BOAT_AUTH_PROVIDER_NAME, (creds) => {
+    const org = options?.org ?? creds.org;
+    return {
+        apiKey: creds.apiKey,
+        apiBaseUrl: creds.apiBaseUrl,
+        ...(org ? { org } : {}),
+    };
+}));
+//# sourceMappingURL=Credentials.js.map

package/lib/Credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Credentials.js","sources":["../src/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAgC,MAAM,mBAAmB,CAAC;AAE1F,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,GACX,MAAM,uCAAuC,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAmC,EAAE,EAAE,CACtE,KAAK,CAAC,MAAM,CACV,WAAW,EACX,eAAe,EAAwC,CAAC,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE;IACzF,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC;IACtC,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxB,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}