alchemy 2.0.0-beta.33 → 2.0.0-beta.35

package/lib/Auth/Profile.d.ts

@@ -3,7 +3,9 @@ import * as ConfigProvider from "effect/ConfigProvider";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
-import type { AuthProvider, ConfigureContext } from "./AuthProvider.ts";
+import * as Layer from "effect/Layer";
+import type { PlatformError } from "effect/PlatformError";
+import type { AuthError, AuthProvider, ConfigureContext } from "./AuthProvider.ts";
 export declare const rootDir: string;
 export declare const configFilePath: string;
 /**
@@ -36,20 +38,36 @@ export interface AlchemyProfile {
         method: string;
     };
 }
-export declare const readConfig: Effect.Effect<{
-    version: typeof CONFIG_VERSION;
-    profiles: {
-        [profileName: string]: AlchemyProfile;
-    };
-}, never, FileSystem.FileSystem>;
-export declare const writeConfig: (config: AlchemyConfig["Service"]) => Effect.Effect<void, import("effect/PlatformError").PlatformError, FileSystem.FileSystem>;
-export declare const getProfile: (name: string) => Effect.Effect<AlchemyProfile, never, FileSystem.FileSystem>;
-export declare const setProfile: (name: string, profile: AlchemyProfile) => Effect.Effect<void, import("effect/PlatformError").PlatformError, FileSystem.FileSystem>;
 /**
- * Remove `name` and all its provider credentials from the on-disk config.
- * Returns `true` if the profile existed and was removed, `false` otherwise.
+ * Service exposing on-disk profile helpers. All methods have `R = never` —
+ * the {@link FileSystem.FileSystem} requirement is captured by
+ * {@link ProfileLive} when the layer is built, freeing call sites from
+ * having to thread `FileSystem` through their own Effects.
+ *
+ * Use {@link Profile} directly when you need profile helpers — yield it
+ * from your `Effect.gen` and call its methods (each has `R = never`).
+ */
+export interface ProfileService {
+    readonly readConfig: Effect.Effect<AlchemyConfig["Service"]>;
+    readonly writeConfig: (config: AlchemyConfig["Service"]) => Effect.Effect<void, PlatformError>;
+    readonly getProfile: (name: string) => Effect.Effect<AlchemyProfile | undefined>;
+    readonly setProfile: (name: string, profile: AlchemyProfile) => Effect.Effect<void, PlatformError>;
+    readonly deleteProfile: (name: string) => Effect.Effect<boolean, PlatformError>;
+    readonly loadOrConfigure: <Config extends {
+        method: string;
+    }>(auth: AuthProvider<Config>, profileName: string, ctx: ConfigureContext) => Effect.Effect<Config, AuthError | PlatformError>;
+}
+declare const Profile_base: Context.ServiceClass<Profile, "Alchemy::Profile", ProfileService>;
+export declare class Profile extends Profile_base {
+}
+/**
+ * Layer that builds the {@link Profile} service. Captures the
+ * {@link FileSystem.FileSystem} dependency at layer-build time, so any
+ * Effect that yields {@link Profile} ends up with `R = Profile` (no
+ * `FileSystem` leak). Provide this once at the top of your runtime
+ * (alongside `PlatformServices` / `NodeContext`).
  */
-export declare const deleteProfile: (name: string) => Effect.Effect<boolean, import("effect/PlatformError").PlatformError, FileSystem.FileSystem>;
+export declare const ProfileLive: Layer.Layer<Profile, never, FileSystem.FileSystem>;
 /**
  * Returns a `ConfigProvider` that overrides `ALCHEMY_PROFILE` with the
  * given `profile` (when explicitly passed via the CLI `--profile` flag),
@@ -59,26 +77,5 @@ export declare const deleteProfile: (name: string) => Effect.Effect<boolean, imp
  * without disturbing other config lookups.
  */
 export declare const withProfileOverride: (base: ConfigProvider.ConfigProvider, profile: string | undefined) => ConfigProvider.ConfigProvider;
-/**
- * Load the stored config for the given AuthProvider in `profileName`.
- * If absent, run the provider's `configure` step (passing through `ctx` so
- * providers can pick a CI-friendly default) and persist the resulting config
- * under the provider's name.
- */
-export declare const loadOrConfigure: <Config extends {
-    method: string;
-}>(auth: AuthProvider<Config>, profileName: string, ctx: ConfigureContext) => Effect.Effect<{
-    /**
-     * The method used to login to the provider. Different providers may use different methods, but common ones are:
-     * - oauth: OAuth authentication
-     * - api-key: API key authentication
-     * - username-password: Username and password authentication
-     * - token: Token authentication
-     * - certificate: Certificate authentication
-     * - ssh: SSH authentication
-     * - other: Other authentication methods
-     */
-    method: string;
-}, import("effect/PlatformError").PlatformError | import("./AuthProvider.ts").AuthError, FileSystem.FileSystem>;
 export {};
 //# sourceMappingURL=Profile.d.ts.map

package/lib/Auth/Profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Profile.d.ts","sourceRoot":"","sources":["../../src/Auth/Profile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,cAAc,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAGhD,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAExE,eAAO,MAAM,OAAO,QAAsC,CAAC;AAC3D,eAAO,MAAM,cAAc,QAAsC,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,eAAe,uBAE3B,CAAC;AAEF,eAAO,MAAM,cAAc,IAAI,CAAC;;aAKnB,OAAO,cAAc;cACpB;QACR,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAAC;KACvC;;AANL,qBAAa,aAAc,SAAQ,kBAQX;CAAG;AAE3B,MAAM,WAAW,cAAc;IAC7B,CAAC,YAAY,EAAE,MAAM,GAAG;QACtB;;;;;;;;;WASG;QACH,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAOD,eAAO,MAAM,UAAU;aA5BV,OAAO,cAAc;cACpB;QACR,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAAC;KACvC;gCAyCJ,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,QAAQ,aAAa,CAAC,SAAS,CAAC,6FAQzD,CAAC;AAEJ,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,gEACyB,CAAC;AAEjE,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,EAAE,SAAS,cAAc,6FAM7D,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,gGASvC,CAAC;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAC9B,MAAM,cAAc,CAAC,cAAc,EACnC,SAAS,MAAM,GAAG,SAAS,KAC1B,cAAc,CAAC,cAWjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,SAAS;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EAC/D,MAAM,YAAY,CAAC,MAAM,CAAC,EAC1B,aAAa,MAAM,EACnB,KAAK,gBAAgB;IA1GnB;;;;;;;;;OASG;YACK,MAAM;+GAwGf,CAAC"}
+{"version":3,"file":"Profile.d.ts","sourceRoot":"","sources":["../../src/Auth/Profile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,cAAc,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,KAAK,EACV,SAAS,EACT,YAAY,EACZ,gBAAgB,EACjB,MAAM,mBAAmB,CAAC;AAE3B,eAAO,MAAM,OAAO,QAAsC,CAAC;AAC3D,eAAO,MAAM,cAAc,QAAsC,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,eAAe,uBAE3B,CAAC;AAEF,eAAO,MAAM,cAAc,IAAI,CAAC;;aAKnB,OAAO,cAAc;cACpB;QACR,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAAC;KACvC;;AANL,qBAAa,aAAc,SAAQ,kBAQX;CAAG;AAE3B,MAAM,WAAW,cAAc;IAC7B,CAAC,YAAY,EAAE,MAAM,GAAG;QACtB;;;;;;;;;WASG;QACH,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAOD;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,WAAW,EAAE,CACpB,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,CACnB,IAAI,EAAE,MAAM,KACT,MAAM,CAAC,MAAM,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,CACnB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,cAAc,KACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,CACtB,IAAI,EAAE,MAAM,KACT,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3C,QAAQ,CAAC,eAAe,EAAE,CAAC,MAAM,SAAS;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,EAC1D,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,EAC1B,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,gBAAgB,KAClB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,aAAa,CAAC,CAAC;CACvD;;AAED,qBAAa,OAAQ,SAAQ,YAE5B;CAAG;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,oDA6EvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAC9B,MAAM,cAAc,CAAC,cAAc,EACnC,SAAS,MAAM,GAAG,SAAS,KAC1B,cAAc,CAAC,cAWjB,CAAC"}

package/lib/Auth/Profile.js

@@ -3,6 +3,7 @@ import * as ConfigProvider from "effect/ConfigProvider";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
 import os from "node:os";
 import path from "pathe";
 export const rootDir = path.join(os.homedir(), ".alchemy");
@@ -20,30 +21,53 @@ const emptyConfig = () => ({
     version: CONFIG_VERSION,
     profiles: {},
 });
-export const readConfig = FileSystem.FileSystem.asEffect().pipe(Effect.flatMap((fs) => fs.readFileString(configFilePath)), Effect.flatMap((data) => Effect.try({
-    try: () => {
-        const parsed = JSON.parse(data);
-        if (parsed?.version !== CONFIG_VERSION) {
-            // TODO(sam): this is destructive, should we maintain a chain of migrations from 0 to current?
-            return emptyConfig();
-        }
-        return parsed;
-    },
-    catch: emptyConfig,
-})), Effect.orElseSucceed(emptyConfig));
-export const writeConfig = (config) => FileSystem.FileSystem.asEffect().pipe(Effect.tap((fs) => fs.makeDirectory(path.dirname(configFilePath), { recursive: true })), Effect.flatMap((fs) => fs.writeFileString(configFilePath, JSON.stringify(config, null, 2))));
-export const getProfile = (name) => readConfig.pipe(Effect.map((config) => config.profiles[name]));
-export const setProfile = (name, profile) => readConfig.pipe(Effect.tap((config) => Effect.sync(() => (config.profiles[name] = profile))), Effect.flatMap(writeConfig));
+export class Profile extends Context.Service()("Alchemy::Profile") {
+}
 /**
- * Remove `name` and all its provider credentials from the on-disk config.
- * Returns `true` if the profile existed and was removed, `false` otherwise.
+ * Layer that builds the {@link Profile} service. Captures the
+ * {@link FileSystem.FileSystem} dependency at layer-build time, so any
+ * Effect that yields {@link Profile} ends up with `R = Profile` (no
+ * `FileSystem` leak). Provide this once at the top of your runtime
+ * (alongside `PlatformServices` / `NodeContext`).
  */
-export const deleteProfile = (name) => readConfig.pipe(Effect.flatMap((config) => {
-    if (!(name in config.profiles)) {
-        return Effect.succeed(false);
-    }
-    delete config.profiles[name];
-    return writeConfig(config).pipe(Effect.as(true));
+export const ProfileLive = Layer.effect(Profile, Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const readConfig = fs
+        .readFileString(configFilePath)
+        .pipe(Effect.flatMap((data) => Effect.try({
+        try: () => {
+            const parsed = JSON.parse(data);
+            if (parsed?.version !== CONFIG_VERSION) {
+                // TODO(sam): this is destructive, should we maintain a chain of migrations from 0 to current?
+                return emptyConfig();
+            }
+            return parsed;
+        },
+        catch: emptyConfig,
+    })), Effect.orElseSucceed(emptyConfig));
+    const writeConfig = (config) => fs
+        .makeDirectory(path.dirname(configFilePath), { recursive: true })
+        .pipe(Effect.flatMap(() => fs.writeFileString(configFilePath, JSON.stringify(config, null, 2))));
+    const getProfile = (name) => readConfig.pipe(Effect.map((config) => config.profiles[name]));
+    const setProfile = (name, profile) => readConfig.pipe(Effect.tap((config) => Effect.sync(() => (config.profiles[name] = profile))), Effect.flatMap(writeConfig));
+    const deleteProfile = (name) => readConfig.pipe(Effect.flatMap((config) => {
+        if (!(name in config.profiles)) {
+            return Effect.succeed(false);
+        }
+        delete config.profiles[name];
+        return writeConfig(config).pipe(Effect.as(true));
+    }));
+    const loadOrConfigure = (auth, profileName, ctx) => Effect.flatMap(getProfile(profileName), (existing) => existing?.[auth.name]
+        ? Effect.succeed(existing[auth.name])
+        : Effect.tap(auth.configure(profileName, ctx), (config) => setProfile(profileName, { ...existing, [auth.name]: config })));
+    return {
+        readConfig,
+        writeConfig,
+        getProfile,
+        setProfile,
+        deleteProfile,
+        loadOrConfigure,
+    };
 }));
 /**
  * Returns a `ConfigProvider` that overrides `ALCHEMY_PROFILE` with the
@@ -62,13 +86,4 @@ export const withProfileOverride = (base, profile) => {
         : undefined));
     return ConfigProvider.orElse(base)(overrideProvider);
 };
-/**
- * Load the stored config for the given AuthProvider in `profileName`.
- * If absent, run the provider's `configure` step (passing through `ctx` so
- * providers can pick a CI-friendly default) and persist the resulting config
- * under the provider's name.
- */
-export const loadOrConfigure = (auth, profileName, ctx) => Effect.flatMap(getProfile(profileName), (existing) => existing?.[auth.name]
-    ? Effect.succeed(existing?.[auth.name])
-    : Effect.tap(auth.configure(profileName, ctx), (config) => setProfile(profileName, { ...existing, [auth.name]: config })));
 //# sourceMappingURL=Profile.js.map

package/lib/Auth/Profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"Profile.js","sourceRoot":"","sources":["../../src/Auth/Profile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,cAAc,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,OAAO,CAAC;AAGzB,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAClE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAC9B,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAQ/C,CAAC,mBAAmB,CAAC;CAAG;AAkB3B,MAAM,WAAW,GAAG,GAA6B,EAAE,CAAC,CAAC;IACnD,OAAO,EAAE,cAAc;IACvB,QAAQ,EAAE,EAAE;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,IAAI,CAC7D,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,EACzD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAG,EAAE;QACR,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,MAAM,EAAE,OAAO,KAAK,cAAc,EAAE,CAAC;YACvC,8FAA8F;YAC9F,OAAO,WAAW,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,MAAkC,CAAC;IAC5C,CAAC;IACD,KAAK,EAAE,WAAW;CACnB,CAAC,CACH,EACD,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAClC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAgC,EAAE,EAAE,CAC9D,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,IAAI,CACnC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CACpE,EACD,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,EAAE,CAAC,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CACpE,CACF,CAAC;AAEJ,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CACzC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,OAAuB,EAAE,EAAE,CAClE,UAAU,CAAC,IAAI,CACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACpB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CACrD,EACD,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAC5B,CAAC;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CAC5C,UAAU,CAAC,IAAI,CACb,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;IACxB,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CACH,CAAC;AAEJ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,IAAmC,EACnC,OAA2B,EACI,EAAE;IACjC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,SAAS,GAA2B,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACvE,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACpD,MAAM,CAAC,OAAO,CACZ,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS;QACtE,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC;QAC/C,CAAC,CAAC,SAAS,CACd,CACF,CAAC;IACF,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAC;AACvD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,IAA0B,EAC1B,WAAmB,EACnB,GAAqB,EACrB,EAAE,CACF,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CACnD,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CACtD,UAAU,CAAC,WAAW,EAAE,EAAE,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAC9D,CACN,CAAC"}
+{"version":3,"file":"Profile.js","sourceRoot":"","sources":["../../src/Auth/Profile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,cAAc,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,OAAO,CAAC;AAOzB,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAClE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAC9B,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAQ/C,CAAC,mBAAmB,CAAC;CAAG;AAkB3B,MAAM,WAAW,GAAG,GAA6B,EAAE,CAAC,CAAC;IACnD,OAAO,EAAE,cAAc;IACvB,QAAQ,EAAE,EAAE;CACb,CAAC,CAAC;AAiCH,MAAM,OAAO,OAAQ,SAAQ,OAAO,CAAC,OAAO,EAA2B,CACrE,kBAAkB,CACnB;CAAG;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CACrC,OAAO,EACP,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAExC,MAAM,UAAU,GAA4C,EAAE;SAC3D,cAAc,CAAC,cAAc,CAAC;SAC9B,IAAI,CACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,MAAM,CAAC,GAAG,CAAC;QACT,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM,EAAE,OAAO,KAAK,cAAc,EAAE,CAAC;gBACvC,8FAA8F;gBAC9F,OAAO,WAAW,EAAE,CAAC;YACvB,CAAC;YACD,OAAO,MAAkC,CAAC;QAC5C,CAAC;QACD,KAAK,EAAE,WAAW;KACnB,CAAC,CACH,EACD,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAClC,CAAC;IAEJ,MAAM,WAAW,GAAG,CAAC,MAAgC,EAAE,EAAE,CACvD,EAAE;SACC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SAChE,IAAI,CACH,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAClB,EAAE,CAAC,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CACpE,CACF,CAAC;IAEN,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAClC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEjE,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,OAAuB,EAAE,EAAE,CAC3D,UAAU,CAAC,IAAI,CACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACpB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CACrD,EACD,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAC5B,CAAC;IAEJ,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CACrC,UAAU,CAAC,IAAI,CACb,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACxB,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CACH,CAAC;IAEJ,MAAM,eAAe,GAAG,CACtB,IAA0B,EAC1B,WAAmB,EACnB,GAAqB,EACrB,EAAE,CACF,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CACnD,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAW,CAAC;QAC/C,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CACtD,UAAU,CAAC,WAAW,EAAE,EAAE,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAC9D,CACN,CAAC;IAEJ,OAAO;QACL,UAAU;QACV,WAAW;QACX,UAAU;QACV,UAAU;QACV,aAAa;QACb,eAAe;KACS,CAAC;AAC7B,CAAC,CAAC,CACH,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,IAAmC,EACnC,OAA2B,EACI,EAAE;IACjC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,SAAS,GAA2B,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACvE,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACpD,MAAM,CAAC,OAAO,CACZ,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS;QACtE,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC;QAC/C,CAAC,CAAC,SAAS,CACd,CACF,CAAC;IACF,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAC;AACvD,CAAC,CAAC"}

package/lib/Axiom/AuthProvider.d.ts

@@ -1,4 +1,5 @@
 import * as Redacted from "effect/Redacted";
+import { CredentialsStore } from "../Auth/Credentials.ts";
 export type AxiomAuthConfig = {
     method: "env";
 } | {
@@ -44,5 +45,5 @@ export declare const AXIOM_AUTH_PROVIDER_NAME = "Axiom";
  * {@link AuthProviders} registry when built. Include this in the Axiom
  * `providers()` layer so `alchemy login` can discover it.
  */
-export declare const AxiomAuth: import("effect/Layer").Layer<never, never, import("../index.ts").AuthProviders>;
+export declare const AxiomAuth: import("effect/Layer").Layer<never, never, import("../index.ts").AuthProviders | CredentialsStore>;
 //# sourceMappingURL=AuthProvider.d.ts.map

package/lib/Axiom/AuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../src/Axiom/AuthProvider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAmC5C,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,KAAK,CAAA;CAAE,GACjB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,cAAc,EAAE,UAAU,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,cAAc,EAAE,KAAK,CAAA;CAAE,CAAC;AAEhD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E,MAAM,MAAM,wBAAwB,GAChC;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D,GACD;IACE,IAAI,EAAE,KAAK,CAAC;IACZ,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D,CAAC;AAEN,eAAO,MAAM,wBAAwB,UAAU,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,SAAS,iFASpB,CAAC"}
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../src/Axiom/AuthProvider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAM5C,OAAO,EAAE,gBAAgB,EAAmB,MAAM,wBAAwB,CAAC;AAuB3E,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,KAAK,CAAA;CAAE,GACjB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,cAAc,EAAE,UAAU,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,cAAc,EAAE,KAAK,CAAA;CAAE,CAAC;AAEhD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E,MAAM,MAAM,wBAAwB,GAChC;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D,GACD;IACE,IAAI,EAAE,KAAK,CAAC;IACZ,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D,CAAC;AAEN,eAAO,MAAM,wBAAwB,UAAU,CAAC;AAkBhD;;;;GAIG;AACH,eAAO,MAAM,SAAS,oGAsQrB,CAAC"}

package/lib/Axiom/AuthProvider.js

@@ -1,13 +1,12 @@
+import { DEFAULT_API_BASE_URL } from "@distilled.cloud/axiom/Credentials";
 import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
 import * as Match from "effect/Match";
 import * as Redacted from "effect/Redacted";
 import { AuthError, AuthProviderLayer, } from "../Auth/AuthProvider.js";
-import { deleteCredentials, displayRedacted, readCredentials, writeCredentials, } from "../Auth/Credentials.js";
+import { CredentialsStore, displayRedacted } from "../Auth/Credentials.js";
 import { getEnv, getEnvRedacted, retryOnce } from "../Auth/Env.js";
 import * as Clank from "../Util/Clank.js";
-import { DEFAULT_API_BASE_URL } from "@distilled.cloud/axiom/Credentials";
 const STORAGE_KEY = "axiom-stored";
 const options = [
     {
@@ -22,156 +21,163 @@ const options = [
     },
 ];
 export const AXIOM_AUTH_PROVIDER_NAME = "Axiom";
+const promptOrgId = (required) => getEnv("AXIOM_ORG_ID").pipe(Effect.flatMap((envOrgId) => Clank.text({
+    message: required
+        ? "Axiom Org ID (required for PAT)"
+        : "Axiom Org ID (Enter to skip)",
+    placeholder: envOrgId ?? "",
+    defaultValue: envOrgId ?? "",
+    validate: required
+        ? (v) => (v.length === 0 ? "Required" : undefined)
+        : undefined,
+}).pipe(retryOnce)));
 /**
  * Layer that registers the Axiom {@link AuthProvider} into the
  * {@link AuthProviders} registry when built. Include this in the Axiom
  * `providers()` layer so `alchemy login` can discover it.
  */
-export const AxiomAuth = AuthProviderLayer()(AXIOM_AUTH_PROVIDER_NAME, {
-    configure: (profileName, ctx) => configureCredentials(profileName, ctx),
-    logout: (profileName, config) => logout(profileName, config),
-    login: (profileName, config) => login(profileName, config),
-    prettyPrint: (profileName, config) => prettyPrint(profileName, config),
-    read: (profileName, config) => resolveCredentials(profileName, config),
-});
-const resolveCredentials = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, Effect.fnUntraced(function* () {
-    const apiToken = (yield* getEnvRedacted("AXIOM_TOKEN")) ??
-        (yield* getEnvRedacted("AXIOM_API_KEY"));
-    if (!apiToken) {
-        return yield* new AuthError({
-            message: "Axiom env credentials not found. Set AXIOM_TOKEN (or AXIOM_API_KEY).",
-        });
-    }
-    const apiBaseUrl = (yield* getEnv("AXIOM_URL")) ?? DEFAULT_API_BASE_URL;
-    const orgId = yield* getEnv("AXIOM_ORG_ID");
-    if (orgId) {
+export const AxiomAuth = AuthProviderLayer()(AXIOM_AUTH_PROVIDER_NAME, Effect.gen(function* () {
+    const store = yield* CredentialsStore;
+    const loginStored = Effect.fnUntraced(function* (profileName) {
+        const credentialType = yield* Clank.select({
+            message: "Axiom credential type",
+            options: [
+                {
+                    value: "apiToken",
+                    label: "API Token",
+                    hint: "recommended — scoped to specific datasets/actions",
+                },
+                {
+                    value: "pat",
+                    label: "Personal Access Token",
+                    hint: "full account control, requires Org ID",
+                },
+            ],
+        }).pipe(retryOnce);
+        const apiBaseUrlPrompt = yield* Clank.text({
+            message: "Axiom API Base URL (Enter for default)",
+            placeholder: DEFAULT_API_BASE_URL,
+            defaultValue: DEFAULT_API_BASE_URL,
+        }).pipe(retryOnce);
+        const apiBaseUrl = apiBaseUrlPrompt && apiBaseUrlPrompt.length > 0
+            ? apiBaseUrlPrompt
+            : undefined;
+        return yield* Match.value(credentialType).pipe(Match.when("apiToken", () => Effect.gen(function* () {
+            const apiToken = yield* Clank.password({
+                message: "Axiom API Token",
+                validate: (v) => (v.length === 0 ? "Required" : undefined),
+            }).pipe(retryOnce);
+            const orgId = yield* promptOrgId(false);
+            yield* store.write(profileName, STORAGE_KEY, {
+                type: "apiToken",
+                apiToken,
+                apiBaseUrl,
+                orgId: orgId && orgId.length > 0 ? orgId : undefined,
+            });
+            yield* Clank.success("Axiom: credentials saved.");
+            return {
+                method: "stored",
+                credentialType: "apiToken",
+            };
+        })), Match.when("pat", () => Effect.gen(function* () {
+            const apiToken = yield* Clank.password({
+                message: "Axiom Personal Access Token",
+                validate: (v) => (v.length === 0 ? "Required" : undefined),
+            }).pipe(retryOnce);
+            const orgId = yield* promptOrgId(true);
+            yield* store.write(profileName, STORAGE_KEY, { type: "pat", apiToken, apiBaseUrl, orgId });
+            yield* Clank.success("Axiom: credentials saved.");
+            return {
+                method: "stored",
+                credentialType: "pat",
+            };
+        })), Match.exhaustive);
+    });
+    const configureInteractive = (profileName) => Clank.select({
+        message: "Axiom authentication method",
+        options,
+    }).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
+    const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
+        if (ctx.ci) {
+            return { method: "env" };
+        }
+        return yield* configureInteractive(profileName);
+    }).pipe(Effect.mapError((e) => new AuthError({
+        message: "failed to configure credentials",
+        cause: e,
+    })));
+    const resolveCredentials = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, Effect.fnUntraced(function* () {
+        const apiToken = (yield* getEnvRedacted("AXIOM_TOKEN")) ??
+            (yield* getEnvRedacted("AXIOM_API_KEY"));
+        if (!apiToken) {
+            return yield* new AuthError({
+                message: "Axiom env credentials not found. Set AXIOM_TOKEN (or AXIOM_API_KEY).",
+            });
+        }
+        const apiBaseUrl = (yield* getEnv("AXIOM_URL")) ?? DEFAULT_API_BASE_URL;
+        const orgId = yield* getEnv("AXIOM_ORG_ID");
+        if (orgId) {
+            return {
+                type: "pat",
+                apiToken,
+                apiBaseUrl,
+                orgId,
+                source: { type: "env" },
+            };
+        }
         return {
-            type: "pat",
+            type: "apiToken",
             apiToken,
             apiBaseUrl,
-            orgId,
             source: { type: "env" },
         };
-    }
+    })), Match.when({ method: "stored" }, () => store.read(profileName, STORAGE_KEY).pipe(Effect.flatMap((creds) => creds == null
+        ? Effect.fail(new AuthError({
+            message: "Axiom stored credentials not found. Run: alchemy login --configure",
+        }))
+        : Effect.succeed(Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c) => ({
+            type: "apiToken",
+            apiToken: Redacted.make(c.apiToken),
+            apiBaseUrl: c.apiBaseUrl ?? DEFAULT_API_BASE_URL,
+            orgId: c.orgId,
+            source: { type: "stored" },
+        })), Match.when({ type: "pat" }, (c) => ({
+            type: "pat",
+            apiToken: Redacted.make(c.apiToken),
+            apiBaseUrl: c.apiBaseUrl ?? DEFAULT_API_BASE_URL,
+            orgId: c.orgId,
+            source: { type: "stored" },
+        })), Match.exhaustive))))), Match.exhaustive);
+    const logout = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store
+        .delete(profileName, STORAGE_KEY)
+        .pipe(Effect.andThen(Clank.success("Axiom: stored credentials removed")))), Match.exhaustive);
+    const login = (profileName, config) => Match.value(config)
+        .pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => store
+        .read(profileName, STORAGE_KEY)
+        .pipe(Effect.flatMap((creds) => creds == null ? loginStored(profileName) : Effect.void))), Match.exhaustive)
+        .pipe(Effect.mapError((e) => new AuthError({ message: "login failed", cause: e })));
+    const prettyPrint = (profileName, config) => resolveCredentials(profileName, config).pipe(Effect.tap((creds) => {
+        const sourceStr = creds.source.details
+            ? `${creds.source.type} - ${creds.source.details}`
+            : creds.source.type;
+        return Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c) => Effect.all([
+            Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
+            Console.log(`  apiBaseUrl: ${c.apiBaseUrl}`),
+            Console.log(`  orgId: ${c.orgId ?? "(none)"}`),
+            Console.log(`  source: ${sourceStr}`),
+        ])), Match.when({ type: "pat" }, (c) => Effect.all([
+            Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
+            Console.log(`  apiBaseUrl: ${c.apiBaseUrl}`),
+            Console.log(`  orgId: ${c.orgId}`),
+            Console.log(`  source: ${sourceStr}`),
+        ])), Match.exhaustive);
+    }), Effect.catch((e) => Console.error(`  Failed to retrieve credentials: ${e}`)));
     return {
-        type: "apiToken",
-        apiToken,
-        apiBaseUrl,
-        source: { type: "env" },
+        configure: configureCredentials,
+        logout,
+        login,
+        prettyPrint,
+        read: resolveCredentials,
     };
-})), Match.when({ method: "stored" }, () => readCredentials(profileName, STORAGE_KEY).pipe(Effect.flatMap((creds) => creds == null
-    ? Effect.fail(new AuthError({
-        message: "Axiom stored credentials not found. Run: alchemy login --configure",
-    }))
-    : Effect.succeed(Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c) => ({
-        type: "apiToken",
-        apiToken: Redacted.make(c.apiToken),
-        apiBaseUrl: c.apiBaseUrl ?? DEFAULT_API_BASE_URL,
-        orgId: c.orgId,
-        source: { type: "stored" },
-    })), Match.when({ type: "pat" }, (c) => ({
-        type: "pat",
-        apiToken: Redacted.make(c.apiToken),
-        apiBaseUrl: c.apiBaseUrl ?? DEFAULT_API_BASE_URL,
-        orgId: c.orgId,
-        source: { type: "stored" },
-    })), Match.exhaustive))))), Match.exhaustive);
-const logout = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => deleteCredentials(profileName, STORAGE_KEY).pipe(Effect.andThen(Clank.success("Axiom: stored credentials removed")))), Match.exhaustive);
-const login = (profileName, config) => Match.value(config)
-    .pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "stored" }, () => readCredentials(profileName, STORAGE_KEY).pipe(Effect.flatMap((creds) => creds == null ? loginStored(profileName) : Effect.void))), Match.exhaustive)
-    .pipe(Effect.mapError((e) => new AuthError({ message: "login failed", cause: e })));
-const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
-    if (ctx.ci) {
-        return { method: "env" };
-    }
-    return yield* configureInteractive(profileName);
-}).pipe(Effect.mapError((e) => new AuthError({
-    message: "failed to configure credentials",
-    cause: e,
-})));
-const configureInteractive = (profileName) => Clank.select({
-    message: "Axiom authentication method",
-    options,
-}).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
-const loginStored = Effect.fnUntraced(function* (profileName) {
-    const credentialType = yield* Clank.select({
-        message: "Axiom credential type",
-        options: [
-            {
-                value: "apiToken",
-                label: "API Token",
-                hint: "recommended — scoped to specific datasets/actions",
-            },
-            {
-                value: "pat",
-                label: "Personal Access Token",
-                hint: "full account control, requires Org ID",
-            },
-        ],
-    }).pipe(retryOnce);
-    const apiBaseUrlPrompt = yield* Clank.text({
-        message: "Axiom API Base URL (Enter for default)",
-        placeholder: DEFAULT_API_BASE_URL,
-        defaultValue: DEFAULT_API_BASE_URL,
-    }).pipe(retryOnce);
-    const apiBaseUrl = apiBaseUrlPrompt && apiBaseUrlPrompt.length > 0
-        ? apiBaseUrlPrompt
-        : undefined;
-    return yield* Match.value(credentialType).pipe(Match.when("apiToken", () => Effect.gen(function* () {
-        const apiToken = yield* Clank.password({
-            message: "Axiom API Token",
-            validate: (v) => (v.length === 0 ? "Required" : undefined),
-        }).pipe(retryOnce);
-        const orgId = yield* promptOrgId(false);
-        yield* writeCredentials(profileName, STORAGE_KEY, {
-            type: "apiToken",
-            apiToken,
-            apiBaseUrl,
-            orgId: orgId && orgId.length > 0 ? orgId : undefined,
-        });
-        yield* Clank.success("Axiom: credentials saved.");
-        return {
-            method: "stored",
-            credentialType: "apiToken",
-        };
-    })), Match.when("pat", () => Effect.gen(function* () {
-        const apiToken = yield* Clank.password({
-            message: "Axiom Personal Access Token",
-            validate: (v) => (v.length === 0 ? "Required" : undefined),
-        }).pipe(retryOnce);
-        const orgId = yield* promptOrgId(true);
-        yield* writeCredentials(profileName, STORAGE_KEY, { type: "pat", apiToken, apiBaseUrl, orgId });
-        yield* Clank.success("Axiom: credentials saved.");
-        return {
-            method: "stored",
-            credentialType: "pat",
-        };
-    })), Match.exhaustive);
-});
-const promptOrgId = (required) => getEnv("AXIOM_ORG_ID").pipe(Effect.flatMap((envOrgId) => Clank.text({
-    message: required
-        ? "Axiom Org ID (required for PAT)"
-        : "Axiom Org ID (Enter to skip)",
-    placeholder: envOrgId ?? "",
-    defaultValue: envOrgId ?? "",
-    validate: required
-        ? (v) => (v.length === 0 ? "Required" : undefined)
-        : undefined,
-}).pipe(retryOnce)));
-const prettyPrint = (profileName, config) => resolveCredentials(profileName, config).pipe(Effect.tap((creds) => {
-    const sourceStr = creds.source.details
-        ? `${creds.source.type} - ${creds.source.details}`
-        : creds.source.type;
-    return Match.value(creds).pipe(Match.when({ type: "apiToken" }, (c) => Effect.all([
-        Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
-        Console.log(`  apiBaseUrl: ${c.apiBaseUrl}`),
-        Console.log(`  orgId: ${c.orgId ?? "(none)"}`),
-        Console.log(`  source: ${sourceStr}`),
-    ])), Match.when({ type: "pat" }, (c) => Effect.all([
-        Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
-        Console.log(`  apiBaseUrl: ${c.apiBaseUrl}`),
-        Console.log(`  orgId: ${c.orgId}`),
-        Console.log(`  source: ${sourceStr}`),
-    ])), Match.exhaustive);
-}), Effect.catch((e) => Console.error(`  Failed to retrieve credentials: ${e}`)));
+}));
 //# sourceMappingURL=AuthProvider.js.map