@dxos/functions 0.8.4-main.ae835ea → 0.8.4-main.bc2380dfbc

package/src/protocol/protocol.ts

@@ -0,0 +1,452 @@
+//
+// Copyright 2025 DXOS.org
+//
+
+import * as AnthropicClient from '@effect/ai-anthropic/AnthropicClient';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as Option from 'effect/Option';
+import * as Schema from 'effect/Schema';
+import * as SchemaAST from 'effect/SchemaAST';
+
+import { AiModelResolver, AiService, OpaqueToolkit } from '@dxos/ai';
+import { AnthropicResolver } from '@dxos/ai/resolvers';
+import {
+  Blueprint,
+  FunctionError,
+  InvalidOperationInputError,
+  InvalidOperationOutputError,
+  Operation,
+  OperationRegistry,
+  Trace,
+} from '@dxos/compute';
+import { LifecycleState, Resource } from '@dxos/context';
+import { Database, Feed, JsonSchema, Ref, type Type } from '@dxos/echo';
+import { createFeedServiceLayer, EchoClient, type EchoDatabaseImpl, type QueueFactory } from '@dxos/echo-db';
+import { refFromEncodedReference } from '@dxos/echo/internal';
+import { runAndForwardErrors } from '@dxos/effect';
+import { assertState, failedInvariant, invariant } from '@dxos/invariant';
+import { PublicKey, type SpaceId } from '@dxos/keys';
+import { log } from '@dxos/log';
+import { EdgeFunctionEnv, ErrorCodec, type FunctionProtocol, type TraceProtocol } from '@dxos/protocols';
+
+import { type FunctionServices } from '../sdk';
+import {
+  configuredCredentialsLayer,
+  credentialsLayerFromDatabase,
+  FunctionInvocationService,
+  QueueService,
+} from '../services';
+import { FunctionsAiHttpClient } from './functions-ai-http-client';
+
+export interface FunctionWrappingOptions {
+  /**
+   * Additional types to register with the database.
+   */
+  types?: Type.AnyEntity[];
+
+  /**
+   * Toolkits to make available via the `OpaqueToolkitProvider`.
+   */
+  toolkits?: OpaqueToolkit.OpaqueToolkit[];
+
+  /**
+   * Blueprint registry to expose as `Blueprint.RegistryService` inside handler Effects.
+   * Required for operations that declare `Blueprint.RegistryService` in their `services` list.
+   */
+  blueprintRegistry?: Blueprint.Registry;
+}
+
+/**
+ * Wraps a function handler made with `defineFunction` to a protocol that the functions-runtime expects.
+ */
+export const wrapFunctionHandler = (
+  func: Operation.WithHandler<Operation.Definition.Any>,
+  opts: FunctionWrappingOptions = {},
+): FunctionProtocol.Func => {
+  if (!Operation.isOperationWithHandler(func)) {
+    throw new TypeError('Expected operation with handler');
+  }
+
+  const serviceTags = func.services.map((service) => service.key);
+
+  return {
+    meta: {
+      key: func.meta.key,
+      name: func.meta.name,
+      description: func.meta.description,
+      inputSchema: JsonSchema.toJsonSchema(func.input),
+      outputSchema: func.output === undefined ? undefined : JsonSchema.toJsonSchema(func.output),
+      services: func.services.map((service) => service.key),
+    },
+    handler: async ({ data, context }) => {
+      if (
+        (serviceTags.includes(Database.Service.key) ||
+          serviceTags.includes(QueueService.key) ||
+          serviceTags.includes(Feed.FeedService.key)) &&
+        (!context.services.dataService || !context.services.queryService)
+      ) {
+        throw new FunctionError({
+          message: 'Services not provided: dataService, queryService',
+        });
+      }
+
+      // eslint-disable-next-line no-useless-catch
+      try {
+        if (!SchemaAST.isAnyKeyword(func.input.ast)) {
+          try {
+            Schema.validateSync(func.input, { onExcessProperty: 'error' })(data);
+          } catch (error: any) {
+            throw new InvalidOperationInputError({
+              message: `Operation input did not match schema (${func.meta.key}): ${error.message}`,
+              cause: error,
+            });
+          }
+        }
+
+        await using funcContext = await new FunctionContext(context, opts).open();
+
+        const types = [...(opts.types ?? []), ...(func.types ?? [])];
+        if (types.length > 0) {
+          invariant(funcContext.db, 'Database is required for functions with types');
+          await funcContext.db.graph.schemaRegistry.register(types as Type.AnyEntity[]);
+        }
+
+        const dataWithDecodedRefs =
+          funcContext.db && !SchemaAST.isAnyKeyword(func.input.ast)
+            ? decodeRefsFromSchema(func.input.ast, data, funcContext.db)
+            : data;
+
+        let result: any = await func.handler(dataWithDecodedRefs);
+
+        if (Effect.isEffect(result)) {
+          result = await runAndForwardErrors(
+            (result as Effect.Effect<unknown, unknown, FunctionServices>).pipe(
+              Effect.orDie,
+              Effect.provide(funcContext.createLayer()),
+            ),
+          );
+        }
+
+        // Flush in-memory ECHO writes before the function scope closes.
+        // Writes performed by `db.add` / `db.remove` are buffered in the in-memory
+        // `EchoDatabaseImpl` and only pushed across the `DataService` binding when
+        // `db.flush({ disk })` is called. `FunctionContext._close` (invoked by the
+        // `await using` above) calls `db.close()` but does NOT flush, so mutations
+        // performed by handlers that declare `Database.Service` (e.g. `object-create`,
+        // `object-update`, `relation-create`) would be silently dropped before reaching
+        // the edge `AutomergeReplicator`. Flushing here closes that hole.
+        if (serviceTags.includes(Database.Service.key) && funcContext.db) {
+          await funcContext.db.flush({ disk: true, indexes: false });
+        }
+
+        if (func.output && !SchemaAST.isAnyKeyword(func.output.ast)) {
+          try {
+            Schema.validateSync(func.output, { onExcessProperty: 'error' })(result);
+          } catch (error: any) {
+            throw new InvalidOperationOutputError({
+              message: `Operation output did not match schema (${func.meta.key}): ${error.message}`,
+              cause: error,
+            });
+          }
+        }
+
+        return result;
+      } catch (error) {
+        // TODO(dmaretskyi): We might do error wrapping here and add extra context.
+        throw error;
+      }
+    },
+  };
+};
+
+/**
+ * Container for services and context for a function.
+ */
+class FunctionContext extends Resource {
+  readonly context: FunctionProtocol.Context;
+  readonly client: EchoClient | undefined;
+  db: EchoDatabaseImpl | undefined;
+  queues: QueueFactory | undefined;
+  readonly opts: FunctionWrappingOptions;
+
+  constructor(context: FunctionProtocol.Context, opts: FunctionWrappingOptions) {
+    super();
+    this.context = context;
+    this.opts = opts;
+    if (context.services.dataService && context.services.queryService) {
+      this.client = new EchoClient().connectToService({
+        dataService: context.services.dataService,
+        queryService: context.services.queryService,
+        queueService: context.services.queueService,
+      });
+    }
+  }
+
+  override async _open() {
+    await this.client?.open();
+    this.db =
+      this.client && this.context.spaceId
+        ? this.client.constructDatabase({
+            spaceId: this.context.spaceId ?? failedInvariant(),
+            spaceKey: PublicKey.fromHex(this.context.spaceKey ?? failedInvariant('spaceKey missing in context')),
+            reactiveSchemaQuery: false,
+            preloadSchemaOnOpen: false,
+          })
+        : undefined;
+
+    await this.db?.setSpaceRoot(this.context.spaceRootUrl ?? failedInvariant('spaceRootUrl missing in context'));
+    await this.db?.open();
+    this.queues =
+      this.client && this.context.spaceId ? this.client.constructQueueFactory(this.context.spaceId) : undefined;
+  }
+
+  override async _close() {
+    await this.db?.close();
+    await this.client?.close();
+  }
+
+  createLayer(): Layer.Layer<FunctionServices> {
+    assertState(this._lifecycleState === LifecycleState.OPEN, 'FunctionContext is not open');
+
+    const dbLayer = this.db ? Database.layer(this.db) : Database.notAvailable;
+    const queuesLayer = this.queues ? QueueService.layer(this.queues) : QueueService.notAvailable;
+    const feedLayer = this.queues ? createFeedServiceLayer(this.queues) : Feed.notAvailable;
+    const credentials = dbLayer
+      ? credentialsLayerFromDatabase({ caching: true }).pipe(Layer.provide(dbLayer))
+      : configuredCredentialsLayer([]);
+
+    const aiLayer = this.context.services.functionsAiService
+      ? InternalAiServiceLayer(this.context.services.functionsAiService)
+      : AiService.notAvailable;
+
+    const operationServiceLayer = this.context.services.functionsService
+      ? makeOperationServiceLayer(this.context.services.functionsService)
+      : unavailableOperationServiceLayer;
+
+    const operationRegistryLayer = this.context.services.functionsService
+      ? makeOperationRegistryLayer(this.context.services.functionsService, this.context.spaceId as SpaceId | undefined)
+      : emptyOperationRegistryLayer;
+
+    const traceWriterLayer = this.context.services.traceService
+      ? makeTraceWriterLayer(this.context.services.traceService)
+      : Trace.writerLayerNoop;
+
+    log('Creating function context layer', {
+      traceService: !!this.context.services.traceService,
+      functionsService: !!this.context.services.functionsService,
+      functionsAiService: !!this.context.services.functionsAiService,
+      spaceId: this.context.spaceId,
+      spaceRootUrl: this.context.spaceRootUrl,
+      toolkits: this.opts.toolkits?.length ?? 0,
+      types: this.opts.types?.length ?? 0,
+    });
+
+    const blueprintRegistryLayer = this.opts.blueprintRegistry
+      ? Layer.succeed(Blueprint.RegistryService, this.opts.blueprintRegistry)
+      : Blueprint.RegistryService.notAvailable;
+
+    return Layer.mergeAll(
+      dbLayer,
+      queuesLayer,
+      feedLayer,
+      credentials,
+      operationServiceLayer,
+      operationRegistryLayer,
+      aiLayer,
+      OpaqueToolkit.providerLayer(OpaqueToolkit.merge(...(this.opts.toolkits ?? []))),
+      traceWriterLayer,
+      blueprintRegistryLayer,
+
+      // `FunctionInvocationService` is deprecated; new code should yield `Operation.Service`.
+      // The cloudflare wrapper provides only the unavailable layer to satisfy the (still-present)
+      // type union — handlers that yield it will die at invocation time.
+      FunctionInvocationService.layerNotAvailable,
+    );
+  }
+}
+
+/**
+ * Backs `Trace.TraceService` with the EDGE-provided `TraceService` so that operation
+ * handlers can write trace events that are forwarded to the runtime's trace sink.
+ */
+const makeTraceWriterLayer = (traceService: TraceProtocol.TraceService): Layer.Layer<Trace.TraceService> =>
+  Layer.succeed(Trace.TraceService, {
+    write: (eventType, payload) => {
+      log('Writing trace event', {
+        eventType: eventType.key,
+      });
+      traceService.write([
+        {
+          key: eventType.key,
+          isEphemeral: eventType.isEphemeral,
+          data: payload,
+        },
+      ]);
+    },
+  });
+
+/**
+ * AI service layer that proxies HTTP requests through the EDGE-provided `FunctionsAiService`.
+ */
+const InternalAiServiceLayer = (functionsAiService: EdgeFunctionEnv.FunctionsAiService) =>
+  AiModelResolver.AiModelResolver.buildAiService.pipe(
+    Layer.provide(
+      AnthropicResolver.make().pipe(
+        Layer.provide(
+          AnthropicClient.layer({
+            // Note: It doesn't matter what is base url here, it will be proxied to ai gateway in edge.
+            apiUrl: 'http://internal/provider/anthropic',
+          }).pipe(Layer.provide(FunctionsAiHttpClient.layer(functionsAiService))),
+        ),
+      ),
+    ),
+  );
+
+/**
+ * Backs `Operation.Service` with the EDGE-provided `FunctionsService` so that operation
+ * handlers can invoke other deployed operations remotely. The `deployedId` on the operation
+ * definition is used as the routing key.
+ */
+const makeOperationServiceLayer = (
+  functionsService: EdgeFunctionEnv.FunctionsService,
+): Layer.Layer<Operation.Service> => {
+  const invokeRemote = async (
+    op: Operation.Definition.Any,
+    input: unknown,
+    options?: Operation.InvokeOptions,
+  ): Promise<{ data?: unknown; error?: Error }> => {
+    invariant(op.meta.deployedId, `Operation '${op.meta.key}' has no deployedId; cannot invoke remotely.`);
+    const result = await functionsService.invoke(op.meta.deployedId, input, {
+      spaceId: options?.spaceId,
+    });
+    if (result._kind === 'success') {
+      return { data: result.data };
+    }
+    return { error: ErrorCodec.decode(result.error) };
+  };
+
+  return Layer.succeed(Operation.Service, {
+    invoke: ((op: Operation.Definition.Any, input: unknown, options?: Operation.InvokeOptions) =>
+      Effect.tryPromise(() => invokeRemote(op, input, options)).pipe(
+        Effect.orDie,
+        Effect.flatMap((outcome) =>
+          outcome.error ? Effect.die(outcome.error) : Effect.succeed(outcome.data as never),
+        ),
+      )) as Operation.OperationService['invoke'],
+    schedule: ((op: Operation.Definition.Any, input: unknown) =>
+      Effect.sync(() => {
+        invariant(op.meta.deployedId, `Operation '${op.meta.key}' has no deployedId; cannot schedule remotely.`);
+        // Fire and forget — schedule is intentionally non-awaiting.
+        void functionsService.invoke(op.meta.deployedId, input).catch(() => {
+          // Swallow errors — schedule is observability-only.
+        });
+      })) as Operation.OperationService['schedule'],
+    invokePromise: ((op: Operation.Definition.Any, input: unknown, options?: Operation.InvokeOptions) =>
+      invokeRemote(op, input, options).catch((error: unknown) => ({
+        error: error instanceof Error ? error : new Error(String(error)),
+      }))) as Operation.OperationService['invokePromise'],
+  } satisfies Operation.OperationService);
+};
+
+const unavailableOperationServiceLayer = Layer.succeed(Operation.Service, {
+  invoke: () => Effect.die('Operation.Service is not available: missing functionsService in EDGE context.'),
+  schedule: () => Effect.die('Operation.Service is not available: missing functionsService in EDGE context.'),
+  invokePromise: async () => ({
+    error: new Error('Operation.Service is not available: missing functionsService in EDGE context.'),
+  }),
+} as Operation.OperationService);
+
+/**
+ * Backs `OperationRegistry.Service` with the EDGE-provided `FunctionsService.query`. Returns
+ * the first persistent operation matching the requested key, or `Option.none()` when not found.
+ */
+const makeOperationRegistryLayer = (
+  functionsService: EdgeFunctionEnv.FunctionsService,
+  spaceId: SpaceId | undefined,
+): Layer.Layer<OperationRegistry.Service> =>
+  Layer.succeed(OperationRegistry.Service, {
+    resolve: (key: string) =>
+      Effect.gen(function* () {
+        const records = yield* Effect.tryPromise(() => functionsService.query({ spaceId })).pipe(Effect.orDie);
+        const match = (records as Operation.PersistentOperation[]).find((record) => Operation.getKey(record) === key);
+        return match ? Option.some(Operation.deserialize(match)) : Option.none();
+      }),
+  });
+
+const emptyOperationRegistryLayer = Layer.succeed(OperationRegistry.Service, {
+  resolve: () => Effect.succeed(Option.none()),
+});
+
+const decodeRefsFromSchema = (ast: SchemaAST.AST, value: unknown, db: EchoDatabaseImpl): unknown => {
+  if (value == null) {
+    return value;
+  }
+
+  const encoded = SchemaAST.encodedBoundAST(ast);
+  if (Ref.isRefType(encoded)) {
+    if (Ref.isRef(value)) {
+      return value;
+    }
+
+    if (typeof value === 'object' && value !== null && typeof (value as any)['/'] === 'string') {
+      const resolver = db.graph.createRefResolver({ context: { space: db.spaceId } });
+      return refFromEncodedReference(value as any, resolver);
+    }
+
+    return value;
+  }
+
+  switch (encoded._tag) {
+    case 'TypeLiteral': {
+      if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return value;
+      }
+      const result: Record<string, unknown> = { ...(value as any) };
+      for (const prop of SchemaAST.getPropertySignatures(encoded)) {
+        const key = prop.name.toString();
+        if (key in result) {
+          result[key] = decodeRefsFromSchema(prop.type, (result as any)[key], db);
+        }
+      }
+      return result;
+    }
+
+    case 'TupleType': {
+      if (!Array.isArray(value)) {
+        return value;
+      }
+
+      // For arrays, effect uses TupleType with empty elements and a single rest element.
+      if (encoded.elements.length === 0 && encoded.rest.length === 1) {
+        const elementType = encoded.rest[0].type;
+        return (value as unknown[]).map((item) => decodeRefsFromSchema(elementType, item, db));
+      }
+
+      return value;
+    }
+
+    case 'Union': {
+      // Optional values are represented as union with undefined.
+      const nonUndefined = encoded.types.filter((t) => !SchemaAST.isUndefinedKeyword(t));
+      if (nonUndefined.length === 1) {
+        return decodeRefsFromSchema(nonUndefined[0], value, db);
+      }
+
+      // For other unions we can't safely pick a branch without validating.
+      return value;
+    }
+
+    case 'Suspend': {
+      return decodeRefsFromSchema(encoded.f(), value, db);
+    }
+
+    case 'Refinement': {
+      return decodeRefsFromSchema(encoded.from, value, db);
+    }
+
+    default: {
+      return value;
+    }
+  }
+};

package/src/sdk.ts

@@ -0,0 +1,31 @@
+//
+// Copyright 2023 DXOS.org
+//
+
+import { type AiService } from '@dxos/ai';
+import { type Credential, type Operation, type Trace } from '@dxos/compute';
+import { type Database, type Feed } from '@dxos/echo';
+
+import { type FunctionInvocationService, type QueueService } from './services';
+
+// TODO(burdon): Model after http request. Ref Lambda/OpenFaaS.
+// https://docs.aws.amazon.com/lambda/latest/dg/typescript-handler.html
+// https://www.serverless.com/framework/docs/providers/aws/guide/serverless.yml/#functions
+// https://www.npmjs.com/package/aws-lambda
+
+/**
+ * Services that are available to invoked functions.
+ * @deprecated
+ */
+export type FunctionServices =
+  | AiService.AiService
+  | Credential.CredentialsService
+  | Database.Service
+  // TODO(wittjosiah): Remove QueueService — use Feed.FeedService instead.
+  | QueueService
+  | Feed.FeedService
+  | Trace.TraceService
+  // TODO(dmaretskyi): `FunctionInvocationService` is being phased out in favour of `Operation.Service`;
+  // it's kept in the union until `functions-runtime/local-function-execution.ts` migrates.
+  | FunctionInvocationService
+  | Operation.Service;

package/src/services/credentials.ts

@@ -10,118 +10,23 @@ import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
 import * as Redacted from 'effect/Redacted';
 
-import { Query } from '@dxos/echo';
-import { DataType } from '@dxos/schema';
-
-import { DatabaseService } from './database';
-
-export type CredentialQuery = {
-  service?: string;
-};
-
-// TODO(dmaretskyi): Unify with other apis.
-// packages/sdk/schema/src/common/access-token.ts
-export type ServiceCredential = {
-  service: string;
-
-  // TODO(dmaretskyi): Build out.
-  apiKey?: string;
-};
-
-export class CredentialsService extends Context.Tag('@dxos/functions/CredentialsService')<
-  CredentialsService,
-  {
-    /**
-     * Query all.
-     */
-    queryCredentials: (query: CredentialQuery) => Promise<ServiceCredential[]>;
-
-    /**
-     * Get a single credential.
-     * @throws {Error} If no credential is found.
-     */
-    getCredential: (query: CredentialQuery) => Promise<ServiceCredential>;
-  }
->() {
-  static getCredential = (query: CredentialQuery): Effect.Effect<ServiceCredential, never, CredentialsService> =>
-    Effect.gen(function* () {
-      const credentials = yield* CredentialsService;
-      return yield* Effect.promise(() => credentials.getCredential(query));
-    });
-
-  static getApiKey = (query: CredentialQuery): Effect.Effect<Redacted.Redacted<string>, never, CredentialsService> =>
-    Effect.gen(function* () {
-      const credential = yield* CredentialsService.getCredential(query);
-      if (!credential.apiKey) {
-        throw new Error(`API key not found for service: ${query.service}`);
-      }
-      return Redacted.make(credential.apiKey);
-    });
-
-  static configuredLayer = (credentials: ServiceCredential[]) =>
-    Layer.succeed(CredentialsService, new ConfiguredCredentialsService(credentials));
-
-  static layerConfig = (credentials: { service: string; apiKey: Config.Config<Redacted.Redacted<string>> }[]) =>
-    Layer.effect(
-      CredentialsService,
-      Effect.gen(function* () {
-        const serviceCredentials = yield* Effect.forEach(credentials, ({ service, apiKey }) =>
-          Effect.gen(function* () {
-            return {
-              service,
-              apiKey: Redacted.value(yield* apiKey),
-            };
-          }),
-        );
-
-        return new ConfiguredCredentialsService(serviceCredentials);
-      }),
-    );
-
-  static layerFromDatabase = () =>
-    Layer.effect(
-      CredentialsService,
-      Effect.gen(function* () {
-        const dbService = yield* DatabaseService;
-        const queryCredentials = async (query: CredentialQuery): Promise<ServiceCredential[]> => {
-          const { objects: accessTokens } = await dbService.db.query(Query.type(DataType.AccessToken)).run();
-          return accessTokens
-            .filter((accessToken) => accessToken.source === query.service)
-            .map((accessToken) => ({
-              service: accessToken.source,
-              apiKey: accessToken.token,
-            }));
-        };
-        return {
-          getCredential: async (query) => {
-            const credentials = await queryCredentials(query);
-            if (credentials.length === 0) {
-              throw new Error(`Credential not found for service: ${query.service}`);
-            }
-
-            return credentials[0];
-          },
-          queryCredentials: async (query) => {
-            return queryCredentials(query);
-          },
-        };
-      }),
-    );
-}
+import { Credential } from '@dxos/compute';
+import { Database, Query } from '@dxos/echo';
+import { AccessToken } from '@dxos/types';
 
-export class ConfiguredCredentialsService implements Context.Tag.Service<CredentialsService> {
-  constructor(private readonly credentials: ServiceCredential[] = []) {}
+export class ConfiguredCredentialsService implements Context.Tag.Service<Credential.CredentialsService> {
+  constructor(private readonly credentials: Credential.ServiceCredential[] = []) {}
 
-  addCredentials(credentials: ServiceCredential[]): ConfiguredCredentialsService {
+  addCredentials(credentials: Credential.ServiceCredential[]): ConfiguredCredentialsService {
     this.credentials.push(...credentials);
     return this;
   }
 
-  async queryCredentials(query: CredentialQuery): Promise<ServiceCredential[]> {
+  async queryCredentials(query: Credential.CredentialQuery): Promise<Credential.ServiceCredential[]> {
     return this.credentials.filter((credential) => credential.service === query.service);
   }
 
-  async getCredential(query: CredentialQuery): Promise<ServiceCredential> {
+  async getCredential(query: Credential.CredentialQuery): Promise<Credential.ServiceCredential> {
     const credential = this.credentials.find((credential) => credential.service === query.service);
     if (!credential) {
       throw new Error(`Credential not found for service: ${query.service}`);
@@ -132,13 +37,79 @@ export class ConfiguredCredentialsService implements Context.Tag.Service<Credent
 }
 
 /**
- * Maps the request to include the API key from the credential.
+ * Maps the request to include the given token in the Authorization header.
  */
-export const withAuthorization = (query: CredentialQuery, kind?: 'Bearer' | 'Basic') =>
-  HttpClient.mapRequestEffect(
-    Effect.fnUntraced(function* (request) {
-      const key = yield* CredentialsService.getApiKey(query).pipe(Effect.map(Redacted.value));
-      const authorization = kind ? `${kind} ${key}` : key;
-      return HttpClientRequest.setHeader(request, 'Authorization', authorization);
+export const withAuthorization = (token: string, kind?: 'Bearer' | 'Basic') =>
+  HttpClient.mapRequest((request) => {
+    const authorization = kind ? `${kind} ${token}` : token;
+    return HttpClientRequest.setHeader(request, 'Authorization', authorization);
+  });
+
+export const configuredCredentialsLayer = (credentials: Credential.ServiceCredential[]) =>
+  Layer.succeed(Credential.CredentialsService, new ConfiguredCredentialsService(credentials));
+
+export const credentialsLayerConfig = (
+  credentials: {
+    service: string;
+    apiKey: Config.Config<Redacted.Redacted<string>>;
+  }[],
+) =>
+  Layer.effect(
+    Credential.CredentialsService,
+    Effect.gen(function* () {
+      const serviceCredentials = yield* Effect.forEach(credentials, ({ service, apiKey }) =>
+        Effect.gen(function* () {
+          return {
+            service,
+            apiKey: Redacted.value(yield* apiKey),
+          };
+        }),
+      );
+
+      return new ConfiguredCredentialsService(serviceCredentials);
+    }),
+  );
+
+export const credentialsLayerFromDatabase = ({ caching = false }: { caching?: boolean } = {}) =>
+  Layer.effect(
+    Credential.CredentialsService,
+    Effect.gen(function* () {
+      const dbService = yield* Database.Service;
+      const cache = new Map<string, Credential.ServiceCredential[]>();
+
+      const queryCredentials = async (query: Credential.CredentialQuery): Promise<Credential.ServiceCredential[]> => {
+        const cacheKey = JSON.stringify(query);
+        if (caching && cache.has(cacheKey)) {
+          return cache.get(cacheKey)!;
+        }
+
+        const accessTokens = await dbService.db.query(Query.type(AccessToken.AccessToken)).run();
+        const credentials = accessTokens
+          .filter((accessToken) => accessToken.source === query.service)
+          .map((accessToken) => ({
+            service: accessToken.source,
+            apiKey: accessToken.token,
+          }));
+
+        if (caching) {
+          cache.set(cacheKey, credentials);
+        }
+
+        return credentials;
+      };
+
+      return {
+        getCredential: async (query) => {
+          const credentials = await queryCredentials(query);
+          if (credentials.length === 0) {
+            throw new Error(`Credential not found for service: ${query.service}`);
+          }
+
+          return credentials[0];
+        },
+        queryCredentials: async (query) => {
+          return queryCredentials(query);
+        },
+      };
     }),
   );