@drkmttr/adhere 0.14.0 → 0.17.5

package/src/providers/providers.test.ts

@@ -0,0 +1,276 @@
+import type { Rule } from "#config.ts";
+import { cloudflare } from "#providers/cloudflare.ts";
+import { jev } from "#providers/jev.ts";
+import { openai } from "#providers/openai.ts";
+import { ContextOverflow, type Question, RequestFailed } from "#providers/provider.ts";
+import { questionsOf, requestOf } from "#providers/systemOne.ts";
+import { conflictBody, contradictBody, judgeBody, locateBody } from "#services/Jev.ts";
+import { describe, expect, it } from "vite-plus/test";
+
+const plain: Rule = {
+  description: "Ports must be named.",
+  must: "const port = PORT;",
+  never: "listen(3000)",
+  appliesTo: ["a server's entry point"],
+};
+const lines = ["const port = 3000;", "", "listen(port);"];
+const compared = [
+  { id: "a", rule: plain },
+  { id: "b", rule: { description: "Ports must be literals.", must: "listen(3000)" } },
+];
+
+/** A fetch that records each request's URL, headers, and body, and answers with `respond`. */
+const recording = (respond: (body: Record<string, unknown>, sent: number) => Response) => {
+  const sent: Array<{ url: string; authorization: string | null; body: Record<string, unknown> }> =
+    [];
+  const fetch = (async (url: unknown, init?: RequestInit) => {
+    const body = JSON.parse(String(init?.body)) as Record<string, unknown>;
+    sent.push({
+      url: String(url),
+      authorization: new Headers(init?.headers).get("authorization"),
+      body,
+    });
+    return respond(body, sent.length);
+  }) as typeof globalThis.fetch;
+  return { sent, fetch };
+};
+
+const noul = (id: string): Question => ({ id, type: "noul", question: `Is ${id} so?`, fields: {} });
+
+/** What adhere passes `ask` beside the key: a signal no test aborts. */
+const signal = new AbortController().signal;
+
+describe("System One", () => {
+  it("puts adhere's questions back as adhere built them, for Jev and Clef", () => {
+    const bodies = [
+      judgeBody("jev-latest", lines, { plain }, ["plain"]),
+      locateBody("jev-latest", lines, { plain }),
+      conflictBody("jev-latest", compared, [[1], [0]]),
+      contradictBody("jev-latest", compared, [0, 1]),
+    ];
+    for (const body of bodies) {
+      const rebuilt = requestOf(body.model, body.state, questionsOf(body.questions));
+      expect(JSON.stringify(rebuilt)).toBe(JSON.stringify(body));
+    }
+  });
+});
+
+describe("jev", () => {
+  it("sends adhere's request to TypeSafe with the key, and reads each answer as a value", async () => {
+    const body = judgeBody("jev-latest", lines, { plain });
+    const { sent, fetch } = recording(() =>
+      Response.json({
+        model: "jev-1.13.0",
+        answers: { plain: { noul: 0.91 }, "appliesTo:plain:0": { noul: 0.2 } },
+        usage: { input_tokens: 420 },
+      }),
+    );
+    const answered = await jev({ apiKey: "tsk_test", fetch }).ask(
+      body.state,
+      questionsOf(body.questions),
+      { signal },
+    );
+    expect(sent.map(({ url, authorization }) => [url, authorization])).toEqual([
+      ["https://api.typesafe.ai/v1/systemone", "Bearer tsk_test"],
+    ]);
+    expect(JSON.stringify(sent[0]?.body)).toBe(JSON.stringify(body));
+    expect(answered).toEqual({
+      answers: { plain: 0.91, "appliesTo:plain:0": 0.2 },
+      inputTokens: 420,
+      model: "jev-1.13.0",
+    });
+  });
+});
+
+describe("saved keys", () => {
+  it("are named by jev and openai built without a key, and asked with the key adhere passes", async () => {
+    const toJev = recording(() => Response.json({ answers: {} }));
+    const toOpenAI = recording(() => Response.json({ answers: [] }));
+    const jevProvider = jev({ fetch: toJev.fetch });
+    const openaiProvider = openai({ fetch: toOpenAI.fetch });
+    expect([jevProvider.savedKey, openaiProvider.savedKey]).toEqual(["typesafe", "openai"]);
+    expect(jev({ apiKey: "tsk_own" }).savedKey).toBeUndefined();
+    await jevProvider.ask({}, [noul("a")], { apiKey: "tsk_saved", signal });
+    await openaiProvider.ask({}, [noul("a")], { apiKey: "sk-saved", signal });
+    expect([...toJev.sent, ...toOpenAI.sent].map(({ authorization }) => authorization)).toEqual([
+      "Bearer tsk_saved",
+      "Bearer sk-saved",
+    ]);
+    await expect(jevProvider.ask({}, [noul("a")], { signal })).rejects.toThrow(
+      "No TypeSafe AI API key",
+    );
+  });
+});
+
+describe("cloudflare", () => {
+  it("asks 64 questions to a request under ids Clef takes, answers a choice of one option unasked, and puts each answer back under its key", async () => {
+    const questions: ReadonlyArray<Question> = [
+      ...Array.from({ length: 70 }, (_, index) => noul(`linter:rule/${index}`)),
+      { id: "start:rule:1", type: "choice", question: "Where?", fields: {}, options: { "3": "x" } },
+    ];
+    const { sent, fetch } = recording((body) =>
+      Response.json({
+        result: {
+          model: "clef",
+          answers: Object.fromEntries(
+            Object.keys(body.questions as object).map((id) => [id, { type: "noul", noul: 0.5 }]),
+          ),
+          usage: { input_tokens: 100 },
+        },
+      }),
+    );
+    const answered = await cloudflare({ accountId: "acct", apiToken: "cft", fetch }).ask(
+      { code: { "1": "x" } },
+      questions,
+      { signal },
+    );
+    expect(sent.map(({ url }) => url)).toEqual([
+      "https://api.cloudflare.com/client/v4/accounts/acct/ai/run/@cf/cloudflare/clef",
+      "https://api.cloudflare.com/client/v4/accounts/acct/ai/run/@cf/cloudflare/clef",
+    ]);
+    expect(sent.map(({ body }) => Object.keys(body.questions as object).length)).toEqual([64, 6]);
+    expect(Object.keys(sent[1]?.body.questions as object)).toEqual([
+      "q0",
+      "q1",
+      "q2",
+      "q3",
+      "q4",
+      "q5",
+    ]);
+    expect(answered.answers["linter:rule/69"]).toBe(0.5);
+    expect(answered.answers["start:rule:1"]).toBe("3");
+    expect(answered.inputTokens).toBe(200);
+  });
+
+  it("skips as over its context a request it read to its limit, or one Workers AI refused as too large", async () => {
+    const read = (tokens: number) =>
+      recording(() =>
+        Response.json({
+          result: { answers: { q0: { noul: 0.5 } }, usage: { input_tokens: tokens } },
+        }),
+      ).fetch;
+    const flash = (fetch: typeof globalThis.fetch) =>
+      cloudflare({ accountId: "acct", apiToken: "cft", model: "clef-flash", fetch }).ask(
+        {},
+        [noul("a")],
+        { signal },
+      );
+    expect((await flash(read(23_999))).answers).toEqual({ a: 0.5 });
+    await expect(flash(read(24_000))).rejects.toBeInstanceOf(ContextOverflow);
+    const tooLarge = recording(() => new Response("{}", { status: 413 })).fetch;
+    await expect(flash(tooLarge)).rejects.toBeInstanceOf(ContextOverflow);
+  });
+});
+
+describe("openai", () => {
+  it("asks each question as a decision question, its parts in JSON, and leaves a refusal unanswered", async () => {
+    const questions: ReadonlyArray<Question> = [
+      {
+        id: "plain",
+        type: "noul",
+        question: "Does `code` diverge from `must`?",
+        fields: { rule: "Ports must be named.", must: "const port = PORT;" },
+        yes: "it diverges",
+        no: "it follows",
+      },
+      {
+        id: "plain:section",
+        type: "choice",
+        question: "Which?",
+        fields: {},
+        options: { "1": null, "2": "the second" },
+      },
+      {
+        id: "start:plain:1",
+        type: "choice",
+        question: "Where?",
+        fields: {},
+        options: { "7": "x" },
+      },
+      noul("refused"),
+    ];
+    const { sent, fetch } = recording(() =>
+      Response.json({
+        model: "gpt-6-luna",
+        answers: [
+          { type: "predicate", name: "plain", probability: 0.9 },
+          {
+            type: "choice",
+            name: "plain:section",
+            choice: "2",
+            probabilities: [],
+            confidence: 0.8,
+          },
+          { type: "refusal", name: "refused" },
+        ],
+        usage: { input_tokens: 300 },
+      }),
+    );
+    const answered = await openai({ apiKey: "sk-test", fetch }).ask(
+      { code: { "1": "x" } },
+      questions,
+      { signal },
+    );
+    expect(sent[0]?.body).toEqual({
+      model: "gpt-6-luna",
+      input: JSON.stringify({ code: { "1": "x" } }),
+      questions: [
+        {
+          type: "predicate",
+          name: "plain",
+          instructions: JSON.stringify({
+            instructions: {
+              question: "Does `code` diverge from `must`?",
+              rule: "Ports must be named.",
+              must: "const port = PORT;",
+            },
+            criteria: { true: "it diverges", false: "it follows" },
+          }),
+        },
+        {
+          type: "choice",
+          name: "plain:section",
+          instructions: "Which?",
+          choices: [{ value: "1" }, { value: "2", description: "the second" }],
+        },
+        { type: "predicate", name: "refused", instructions: "Is refused so?" },
+      ],
+    });
+    expect(answered).toEqual({
+      answers: { "start:plain:1": "7", plain: 0.9, "plain:section": "2" },
+      inputTokens: 300,
+      model: "gpt-6-luna",
+    });
+  });
+});
+
+describe("a failed request", () => {
+  it("is thrown once, as a RequestFailed with its status and Ray ID, or status 0 when nothing answered", async () => {
+    const busy = recording(
+      () => new Response("busy\n", { status: 503, headers: { "cf-ray": "8c1f-LAX" } }),
+    );
+    const failed = await jev({ apiKey: "tsk_test", fetch: busy.fetch })
+      .ask({}, [noul("a")], { signal })
+      .catch((cause: unknown) => cause);
+    expect(failed).toBeInstanceOf(RequestFailed);
+    expect(failed).toMatchObject({
+      status: 503,
+      message: "Jev answered HTTP 503, Ray ID 8c1f-LAX: busy",
+    });
+    expect(busy.sent).toHaveLength(1);
+
+    const down = (async () => {
+      throw new TypeError("fetch failed");
+    }) as unknown as typeof globalThis.fetch;
+    await expect(
+      openai({ apiKey: "sk-test", fetch: down }).ask({}, [noul("a")], { signal }),
+    ).rejects.toMatchObject({ status: 0, message: "OpenAI did not answer: fetch failed" });
+  });
+
+  it("is an answer that does not decode, naming who sent it", async () => {
+    const { fetch } = recording(() => Response.json({ answers: "none" }));
+    await expect(
+      openai({ apiKey: "sk-test", fetch }).ask({}, [noul("a")], { signal }),
+    ).rejects.toThrow("OpenAI's answer did not decode");
+  });
+});

package/src/providers/systemOne.ts

@@ -0,0 +1,95 @@
+/**
+ * System One, the format Jev takes and Clef follows, and adhere's questions
+ * in it. adhere builds its questions this way, as its cache and Jev have
+ * always read them; a provider gets them split into their parts by
+ * `questionsOf`, and Jev's and Clef's put them back with `requestOf`.
+ */
+import type { Answered, Question, State } from "#providers/provider.ts";
+import { Schema } from "effect";
+
+/** A question's instructions: the question alone, or beside the fields it names. */
+type Instructions = string | (Readonly<Record<string, unknown>> & { readonly question: string });
+
+/** A question as System One takes it: a `noul` with what yes and no mean, or a `choice` among its criteria's keys. */
+export type SystemOneQuestion =
+  | {
+      readonly type: "noul";
+      readonly instructions: Instructions;
+      readonly criteria?: { readonly true: string; readonly false: string };
+    }
+  | {
+      readonly type: "choice";
+      readonly instructions: Instructions;
+      readonly criteria: Readonly<Record<string, string | null>>;
+    };
+
+/** A request as System One takes it: questions by id about `state`, its questions typed as `Q`. */
+export interface SystemOneRequest<Q = SystemOneQuestion> {
+  readonly model: string;
+  readonly state: State;
+  readonly questions: Readonly<Record<string, Q>>;
+}
+
+/**
+ * What System One answers: by id, a `noul`'s probability or a `choice`'s
+ * key, with the model that answered and the tokens it read.
+ */
+export const SystemOneAnswered = Schema.Struct({
+  answers: Schema.Record(
+    Schema.String,
+    Schema.Struct({
+      noul: Schema.optionalKey(Schema.Finite),
+      choice: Schema.optionalKey(Schema.String),
+    }),
+  ),
+  model: Schema.optionalKey(Schema.String),
+  usage: Schema.optionalKey(Schema.Struct({ input_tokens: Schema.Finite })),
+});
+
+/** Each question of a request split into what it asks, the fields it names, and what its answers mean. */
+export const questionsOf = (
+  questions: Readonly<Record<string, SystemOneQuestion>>,
+): ReadonlyArray<Question> =>
+  Object.entries(questions).map(([id, asked]) => {
+    const { question, ...fields } =
+      typeof asked.instructions === "string"
+        ? { question: asked.instructions }
+        : asked.instructions;
+    if (asked.type === "choice")
+      return { id, type: "choice", question, fields, options: asked.criteria };
+    return asked.criteria === undefined
+      ? { id, type: "noul", question, fields }
+      : { id, type: "noul", question, fields, yes: asked.criteria.true, no: asked.criteria.false };
+  });
+
+/** A question as System One asks it, as adhere built it: a question with no fields is its instructions alone. */
+export const systemOneQuestionOf = (asked: Question): SystemOneQuestion => {
+  const instructions =
+    Object.keys(asked.fields).length === 0
+      ? asked.question
+      : { question: asked.question, ...asked.fields };
+  if (asked.type === "choice") return { type: "choice", instructions, criteria: asked.options };
+  return asked.yes === undefined || asked.no === undefined
+    ? { type: "noul", instructions }
+    : { type: "noul", instructions, criteria: { true: asked.yes, false: asked.no } };
+};
+
+/** A request as System One takes it, each question by its id. */
+export const requestOf = (
+  model: string,
+  state: State,
+  questions: ReadonlyArray<Question>,
+): SystemOneRequest => ({
+  model,
+  state,
+  questions: Object.fromEntries(questions.map((asked) => [asked.id, systemOneQuestionOf(asked)])),
+});
+
+/** System One's answers as a provider gives them: each a probability or a key. One with neither is left out. */
+export const answersOf = (answers: typeof SystemOneAnswered.Type.answers): Answered["answers"] =>
+  Object.fromEntries(
+    Object.entries(answers).flatMap(
+      ([id, { noul, choice }]): ReadonlyArray<readonly [string, number | string]> =>
+        noul !== undefined ? [[id, noul]] : choice !== undefined ? [[id, choice]] : [],
+    ),
+  );

package/src/services/AdhereConfig.ts

@@ -131,10 +131,8 @@ export const AdhereConfigLive = (flags: Flags) =>
         }
       }
       const scopedRules = withOverrides(entries, overrides);
-      // The manifests are read on every run, so a changed workspace is seen, and only when a rule reads them.
-      const workspacePackages = scopedRules.some(
-        (entry) => entry.rule.reads?.includes("workspacePackages") === true,
-      )
+      // Read on every run so workspace edits are seen, but only when the config enables this context.
+      const workspacePackages = resolved.reads.includes("workspacePackages")
         ? yield* workspacePackagesOf(cwd)
         : undefined;
       return AdhereConfig.of({

package/src/services/Credentials.ts

@@ -1,3 +1,4 @@
+import type { SavedKey } from "#providers/provider.ts";
 import { Config, Context, Effect, FileSystem, Layer, Option, Path, Redacted, Schema } from "effect";
 
 /** No key to send, or the saved key cannot be read or written. */
@@ -6,37 +7,67 @@ export class CredentialsUnavailable extends Schema.TaggedError<CredentialsUnavai
   { message: Schema.String },
 ) {}
 
-/** A TypeSafe AI API key is one word: a space or a second line is a bad paste. */
+/** An API key is one word: a space or a second line is a bad paste. */
 const ApiKey = Schema.String.pipe(Schema.check(Schema.isPattern(/^\S+$/)));
 
-/** What `adhere login` saves. */
+/** What `adhere login` saves: TypeSafe AI's key, and with `--openai`, OpenAI's. */
 class SavedCredentials extends Schema.Class<SavedCredentials>("SavedCredentials")({
-  apiKey: Schema.RedactedFromValue(ApiKey),
+  apiKey: Schema.optionalKey(Schema.RedactedFromValue(ApiKey)),
+  openaiApiKey: Schema.optionalKey(Schema.RedactedFromValue(ApiKey)),
 }) {}
 
 const SavedCredentialsJson = Schema.fromJsonString(SavedCredentials);
 
-/** The TypeSafe AI API key: where a request gets it, and where `adhere login` keeps it. */
+/** The saved keys, by the name a provider asks for them by. */
+type Saved = Partial<Record<SavedKey, Redacted.Redacted<string>>>;
+
+/**
+ * Each key: the variable that wins over the saved one, how `adhere login`
+ * asks for it and names it, and what a run says when there is none, or when
+ * the file holds none.
+ */
+export const KEYS = {
+  typesafe: {
+    variable: "TYPESAFE_API_KEY",
+    label: "TypeSafe AI API key",
+    said: "API key",
+    missing: "No TypeSafe AI API key. Run `adhere login` to save one, or set TYPESAFE_API_KEY.",
+    absent: (file: string) => `${file} holds no API key. Run \`adhere login\` to save one again.`,
+  },
+  openai: {
+    variable: "OPENAI_API_KEY",
+    label: "OpenAI API key",
+    said: "OpenAI API key",
+    missing: "No OpenAI API key. Run `adhere login --openai` to save one, or set OPENAI_API_KEY.",
+    absent: (file: string) =>
+      `${file} holds no OpenAI API key. Run \`adhere login --openai\` to save one.`,
+  },
+} as const satisfies Record<SavedKey, unknown>;
+
+/** The API keys providers ask with: where a request gets one, and where `adhere login` keeps them. */
 export class Credentials extends Context.Service<
   Credentials,
   {
-    /** `TYPESAFE_API_KEY` when it is set, otherwise the key `adhere login` saved. */
-    readonly apiKey: Effect.Effect<Redacted.Redacted<string>, CredentialsUnavailable>;
-    /** Where the saved key lives, whether or not there is one. */
+    /** `name`'s key: its variable, such as `TYPESAFE_API_KEY`, when set, otherwise the one `adhere login` saved. */
+    readonly key: (
+      name: SavedKey,
+    ) => Effect.Effect<Redacted.Redacted<string>, CredentialsUnavailable>;
+    /** Where the saved keys live, whether or not there are any. */
     readonly file: Effect.Effect<string, CredentialsUnavailable>;
-    /** Saves a key for later runs, readable only by the user. */
+    /** Saves `name`'s key for later runs, beside the other, readable only by the user. */
     readonly save: (
+      name: SavedKey,
       apiKey: Redacted.Redacted<string>,
     ) => Effect.Effect<void, CredentialsUnavailable>;
-    /** Deletes the saved key. False when there was none. */
-    readonly remove: Effect.Effect<boolean, CredentialsUnavailable>;
+    /** Deletes `name`'s saved key, and the file with no key left in it. False when there was none. */
+    readonly remove: (name: SavedKey) => Effect.Effect<boolean, CredentialsUnavailable>;
   }
 >()("@drkmttr/adhere/services/Credentials") {}
 
 const refused = (message: string) => CredentialsUnavailable.make({ message });
 
 /**
- * The key lives in `$XDG_CONFIG_HOME/adhere/credentials.json`, or under
+ * The keys live in `$XDG_CONFIG_HOME/adhere/credentials.json`, or under
  * `~/.config` without it, on every platform. The file is written whole to a
  * temporary file created readable only by the user, then renamed over the
  * old one, so no reader sees half a key or a key with looser permissions.
@@ -59,65 +90,84 @@ export const CredentialsLive = Layer.effect(Credentials)(
       ),
     );
 
-    const exists = (target: string) =>
-      fs
-        .exists(target)
-        .pipe(Effect.mapError((problem) => refused(`Cannot read ${target}: ${problem.message}`)));
-
-    const readSaved = Effect.fn("Credentials.readSaved")(function* (target: string) {
-      const text = yield* fs
-        .readFileString(target)
-        .pipe(Effect.mapError((problem) => refused(`Cannot read ${target}: ${problem.message}`)));
-      const saved = yield* Schema.decodeUnknownEffect(SavedCredentialsJson)(text).pipe(
+    /**
+     * The keys the file holds, or nothing when there is no file. A file that
+     * does not read as keys refuses, so nothing writes over what it holds.
+     */
+    const savedIn = Effect.fn("Credentials.savedIn")(function* (target: string) {
+      const text = yield* Effect.gen(function* () {
+        return (yield* fs.exists(target)) ? yield* fs.readFileString(target) : undefined;
+      }).pipe(Effect.mapError((problem) => refused(`Cannot read ${target}: ${problem.message}`)));
+      if (text === undefined) return undefined;
+      const { apiKey, openaiApiKey } = yield* Schema.decodeUnknownEffect(SavedCredentialsJson)(
+        text,
+      ).pipe(
         Effect.mapError(() =>
-          refused(`${target} holds no API key. Run \`adhere login\` to save one again.`),
+          refused(
+            `${target} does not hold keys as \`adhere login\` saves them. Fix it, or delete it and run \`adhere login\` again.`,
+          ),
         ),
       );
-      return saved.apiKey;
+      return {
+        ...(apiKey === undefined ? {} : { typesafe: apiKey }),
+        ...(openaiApiKey === undefined ? {} : { openai: openaiApiKey }),
+      } satisfies Saved;
+    });
+
+    /** Writes the keys whole, as the layer's comment says; the file goes when none is left. */
+    const write = Effect.fn("Credentials.write")(function* (target: string, saved: Saved) {
+      const temporary = `${target}.tmp`;
+      const json = yield* Schema.encodeEffect(SavedCredentialsJson)(
+        new SavedCredentials({
+          ...(saved.typesafe === undefined ? {} : { apiKey: saved.typesafe }),
+          ...(saved.openai === undefined ? {} : { openaiApiKey: saved.openai }),
+        }),
+      ).pipe(Effect.orDie);
+      yield* Effect.gen(function* () {
+        if (saved.typesafe === undefined && saved.openai === undefined) {
+          return yield* fs.remove(target, { force: true });
+        }
+        yield* fs.makeDirectory(path.dirname(target), { recursive: true, mode: 0o700 });
+        // A mode applies only when a file is created: never reuse a leftover.
+        yield* fs.remove(temporary, { force: true });
+        yield* fs.writeFileString(temporary, `${json}\n`, { mode: 0o600 });
+        yield* fs.rename(temporary, target);
+      }).pipe(Effect.mapError((problem) => refused(`Cannot save ${target}: ${problem.message}`)));
     });
 
     // Read when a request needs the key, not before: a cached run needs none.
-    const apiKey = Effect.fn("Credentials.apiKey")(function* () {
-      const fromEnvironment = yield* Config.option(Config.Redacted("TYPESAFE_API_KEY")).pipe(
-        Effect.mapError((problem) => refused(`Cannot read TYPESAFE_API_KEY: ${problem.message}`)),
+    const key = Effect.fn("Credentials.key")(function* (name: SavedKey) {
+      const { variable, missing, absent } = KEYS[name];
+      const fromEnvironment = yield* Config.option(Config.Redacted(variable)).pipe(
+        Effect.mapError((problem) => refused(`Cannot read ${variable}: ${problem.message}`)),
       );
       if (Option.isSome(fromEnvironment)) return fromEnvironment.value;
       const target = yield* file;
-      if (!(yield* exists(target))) {
-        return yield* refused(
-          "No TypeSafe AI API key. Run `adhere login` to save one, or set TYPESAFE_API_KEY.",
-        );
-      }
-      return yield* readSaved(target);
+      const saved = yield* savedIn(target);
+      if (saved === undefined) return yield* refused(missing);
+      return saved[name] ?? (yield* refused(absent(target)));
     });
 
-    const save = Effect.fn("Credentials.save")(function* (key: Redacted.Redacted<string>) {
-      const saved = yield* Schema.decodeUnknownEffect(SavedCredentials)({
-        apiKey: Redacted.value(key),
-      }).pipe(
+    const save = Effect.fn("Credentials.save")(function* (
+      name: SavedKey,
+      apiKey: Redacted.Redacted<string>,
+    ) {
+      yield* Schema.decodeUnknownEffect(ApiKey)(Redacted.value(apiKey)).pipe(
         Effect.mapError(() => refused("An API key is one word, with no spaces or line breaks.")),
       );
-      const json = yield* Schema.encodeEffect(SavedCredentialsJson)(saved).pipe(Effect.orDie);
       const target = yield* file;
-      const temporary = `${target}.tmp`;
-      yield* Effect.gen(function* () {
-        yield* fs.makeDirectory(path.dirname(target), { recursive: true, mode: 0o700 });
-        // A mode applies only when a file is created: never reuse a leftover.
-        yield* fs.remove(temporary, { force: true });
-        yield* fs.writeFileString(temporary, `${json}\n`, { mode: 0o600 });
-        yield* fs.rename(temporary, target);
-      }).pipe(Effect.mapError((problem) => refused(`Cannot save ${target}: ${problem.message}`)));
+      yield* write(target, { ...(yield* savedIn(target)), [name]: apiKey });
     });
 
-    const remove = Effect.fn("Credentials.remove")(function* () {
+    const remove = Effect.fn("Credentials.remove")(function* (name: SavedKey) {
       const target = yield* file;
-      if (!(yield* exists(target))) return false;
-      yield* fs
-        .remove(target)
-        .pipe(Effect.mapError((problem) => refused(`Cannot delete ${target}: ${problem.message}`)));
+      const rest: Saved = { ...(yield* savedIn(target)) };
+      if (rest[name] === undefined) return false;
+      delete rest[name];
+      yield* write(target, rest);
       return true;
     });
 
-    return Credentials.of({ apiKey: apiKey(), file, save, remove: remove() });
+    return Credentials.of({ key, file, save, remove });
   }),
 );