alchemy 2.0.0-beta.34 → 2.0.0-beta.35

package/src/Axiom/AuthProvider.ts

@@ -1,6 +1,6 @@
+import { DEFAULT_API_BASE_URL } from "@distilled.cloud/axiom/Credentials";
 import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
 import * as Match from "effect/Match";
 import * as Redacted from "effect/Redacted";
 import {
@@ -8,15 +8,9 @@ import {
   AuthProviderLayer,
   type ConfigureContext,
 } from "../Auth/AuthProvider.ts";
-import {
-  deleteCredentials,
-  displayRedacted,
-  readCredentials,
-  writeCredentials,
-} from "../Auth/Credentials.ts";
+import { CredentialsStore, displayRedacted } from "../Auth/Credentials.ts";
 import { getEnv, getEnvRedacted, retryOnce } from "../Auth/Env.ts";
 import * as Clank from "../Util/Clank.ts";
-import { DEFAULT_API_BASE_URL } from "@distilled.cloud/axiom/Credentials";
 
 const STORAGE_KEY = "axiom-stored";
 
@@ -64,6 +58,22 @@ export type AxiomResolvedCredentials =
 
 export const AXIOM_AUTH_PROVIDER_NAME = "Axiom";
 
+const promptOrgId = (required: boolean) =>
+  getEnv("AXIOM_ORG_ID").pipe(
+    Effect.flatMap((envOrgId) =>
+      Clank.text({
+        message: required
+          ? "Axiom Org ID (required for PAT)"
+          : "Axiom Org ID (Enter to skip)",
+        placeholder: envOrgId ?? "",
+        defaultValue: envOrgId ?? "",
+        validate: required
+          ? (v) => (v.length === 0 ? "Required" : undefined)
+          : undefined,
+      }).pipe(retryOnce),
+    ),
+  );
+
 /**
  * Layer that registers the Axiom {@link AuthProvider} into the
  * {@link AuthProviders} registry when built. Include this in the Axiom
@@ -72,265 +82,263 @@ export const AXIOM_AUTH_PROVIDER_NAME = "Axiom";
 export const AxiomAuth = AuthProviderLayer<
   AxiomAuthConfig,
   AxiomResolvedCredentials
->()(AXIOM_AUTH_PROVIDER_NAME, {
-  configure: (profileName, ctx) => configureCredentials(profileName, ctx),
-  logout: (profileName, config) => logout(profileName, config),
-  login: (profileName, config) => login(profileName, config),
-  prettyPrint: (profileName, config) => prettyPrint(profileName, config),
-  read: (profileName, config) => resolveCredentials(profileName, config),
-});
+>()(
+  AXIOM_AUTH_PROVIDER_NAME,
+  Effect.gen(function* () {
+    const store = yield* CredentialsStore;
 
-const resolveCredentials = (
-  profileName: string,
-  config: AxiomAuthConfig,
-): Effect.Effect<AxiomResolvedCredentials, AuthError, FileSystem.FileSystem> =>
-  Match.value(config).pipe(
-    Match.when(
-      { method: "env" },
-      Effect.fnUntraced(function* () {
-        const apiToken =
-          (yield* getEnvRedacted("AXIOM_TOKEN")) ??
-          (yield* getEnvRedacted("AXIOM_API_KEY"));
-        if (!apiToken) {
-          return yield* new AuthError({
-            message:
-              "Axiom env credentials not found. Set AXIOM_TOKEN (or AXIOM_API_KEY).",
-          });
-        }
-        const apiBaseUrl = (yield* getEnv("AXIOM_URL")) ?? DEFAULT_API_BASE_URL;
-        const orgId = yield* getEnv("AXIOM_ORG_ID");
-        if (orgId) {
-          return {
-            type: "pat" as const,
-            apiToken,
-            apiBaseUrl,
-            orgId,
-            source: { type: "env" as const },
-          };
-        }
-        return {
-          type: "apiToken" as const,
-          apiToken,
-          apiBaseUrl,
-          source: { type: "env" as const },
-        };
-      }),
-    ),
-    Match.when({ method: "stored" }, () =>
-      readCredentials<AxiomStoredCredentials>(profileName, STORAGE_KEY).pipe(
-        Effect.flatMap((creds) =>
-          creds == null
-            ? Effect.fail(
-                new AuthError({
-                  message:
-                    "Axiom stored credentials not found. Run: alchemy login --configure",
-                }),
-              )
-            : Effect.succeed(
-                Match.value(creds).pipe(
-                  Match.when({ type: "apiToken" }, (c) => ({
-                    type: "apiToken" as const,
-                    apiToken: Redacted.make(c.apiToken),
-                    apiBaseUrl: c.apiBaseUrl ?? DEFAULT_API_BASE_URL,
-                    orgId: c.orgId,
-                    source: { type: "stored" as const },
-                  })),
-                  Match.when({ type: "pat" }, (c) => ({
-                    type: "pat" as const,
-                    apiToken: Redacted.make(c.apiToken),
-                    apiBaseUrl: c.apiBaseUrl ?? DEFAULT_API_BASE_URL,
-                    orgId: c.orgId,
-                    source: { type: "stored" as const },
-                  })),
-                  Match.exhaustive,
-                ),
-              ),
-        ),
-      ),
-    ),
-    Match.exhaustive,
-  );
+    const loginStored = Effect.fnUntraced(function* (profileName: string) {
+      const credentialType = yield* Clank.select({
+        message: "Axiom credential type",
+        options: [
+          {
+            value: "apiToken" as const,
+            label: "API Token",
+            hint: "recommended — scoped to specific datasets/actions",
+          },
+          {
+            value: "pat" as const,
+            label: "Personal Access Token",
+            hint: "full account control, requires Org ID",
+          },
+        ],
+      }).pipe(retryOnce);
 
-const logout = (profileName: string, config: AxiomAuthConfig) =>
-  Match.value(config).pipe(
-    Match.when({ method: "env" }, () => Effect.void),
-    Match.when({ method: "stored" }, () =>
-      deleteCredentials(profileName, STORAGE_KEY).pipe(
-        Effect.andThen(Clank.success("Axiom: stored credentials removed")),
-      ),
-    ),
-    Match.exhaustive,
-  );
+      const apiBaseUrlPrompt = yield* Clank.text({
+        message: "Axiom API Base URL (Enter for default)",
+        placeholder: DEFAULT_API_BASE_URL,
+        defaultValue: DEFAULT_API_BASE_URL,
+      }).pipe(retryOnce);
+      const apiBaseUrl =
+        apiBaseUrlPrompt && apiBaseUrlPrompt.length > 0
+          ? apiBaseUrlPrompt
+          : undefined;
 
-const login = (profileName: string, config: AxiomAuthConfig) =>
-  Match.value(config)
-    .pipe(
-      Match.when({ method: "env" }, () => Effect.void),
-      Match.when({ method: "stored" }, () =>
-        readCredentials<AxiomStoredCredentials>(profileName, STORAGE_KEY).pipe(
-          Effect.flatMap((creds) =>
-            creds == null ? loginStored(profileName) : Effect.void,
-          ),
-        ),
-      ),
-      Match.exhaustive,
-    )
-    .pipe(
-      Effect.mapError(
-        (e) => new AuthError({ message: "login failed", cause: e }),
-      ),
-    );
+      return yield* Match.value(credentialType).pipe(
+        Match.when("apiToken", () =>
+          Effect.gen(function* () {
+            const apiToken = yield* Clank.password({
+              message: "Axiom API Token",
+              validate: (v) => (v.length === 0 ? "Required" : undefined),
+            }).pipe(retryOnce);
+            const orgId = yield* promptOrgId(false);
 
-const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
-  Effect.gen(function* () {
-    if (ctx.ci) {
-      return { method: "env" as const };
-    }
-    return yield* configureInteractive(profileName);
-  }).pipe(
-    Effect.mapError(
-      (e) =>
-        new AuthError({
-          message: "failed to configure credentials",
-          cause: e,
-        }),
-    ),
-  );
+            yield* store.write<AxiomStoredCredentials>(
+              profileName,
+              STORAGE_KEY,
+              {
+                type: "apiToken",
+                apiToken,
+                apiBaseUrl,
+                orgId: orgId && orgId.length > 0 ? orgId : undefined,
+              },
+            );
+            yield* Clank.success("Axiom: credentials saved.");
+            return {
+              method: "stored" as const,
+              credentialType: "apiToken" as const,
+            };
+          }),
+        ),
+        Match.when("pat", () =>
+          Effect.gen(function* () {
+            const apiToken = yield* Clank.password({
+              message: "Axiom Personal Access Token",
+              validate: (v) => (v.length === 0 ? "Required" : undefined),
+            }).pipe(retryOnce);
+            const orgId = yield* promptOrgId(true);
 
-const configureInteractive = (profileName: string) =>
-  Clank.select({
-    message: "Axiom authentication method",
-    options,
-  }).pipe(
-    Effect.flatMap((method) =>
-      Match.value(method).pipe(
-        Match.when("env", () => Effect.succeed({ method: "env" as const })),
-        Match.when("stored", () => loginStored(profileName)),
+            yield* store.write<AxiomStoredCredentials>(
+              profileName,
+              STORAGE_KEY,
+              { type: "pat", apiToken, apiBaseUrl, orgId },
+            );
+            yield* Clank.success("Axiom: credentials saved.");
+            return {
+              method: "stored" as const,
+              credentialType: "pat" as const,
+            };
+          }),
+        ),
         Match.exhaustive,
-      ),
-    ),
-  );
-
-const loginStored = Effect.fnUntraced(function* (profileName: string) {
-  const credentialType = yield* Clank.select({
-    message: "Axiom credential type",
-    options: [
-      {
-        value: "apiToken" as const,
-        label: "API Token",
-        hint: "recommended — scoped to specific datasets/actions",
-      },
-      {
-        value: "pat" as const,
-        label: "Personal Access Token",
-        hint: "full account control, requires Org ID",
-      },
-    ],
-  }).pipe(retryOnce);
+      );
+    });
 
-  const apiBaseUrlPrompt = yield* Clank.text({
-    message: "Axiom API Base URL (Enter for default)",
-    placeholder: DEFAULT_API_BASE_URL,
-    defaultValue: DEFAULT_API_BASE_URL,
-  }).pipe(retryOnce);
-  const apiBaseUrl =
-    apiBaseUrlPrompt && apiBaseUrlPrompt.length > 0
-      ? apiBaseUrlPrompt
-      : undefined;
+    const configureInteractive = (profileName: string) =>
+      Clank.select({
+        message: "Axiom authentication method",
+        options,
+      }).pipe(
+        Effect.flatMap((method) =>
+          Match.value(method).pipe(
+            Match.when("env", () => Effect.succeed({ method: "env" as const })),
+            Match.when("stored", () => loginStored(profileName)),
+            Match.exhaustive,
+          ),
+        ),
+      );
 
-  return yield* Match.value(credentialType).pipe(
-    Match.when("apiToken", () =>
+    const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
       Effect.gen(function* () {
-        const apiToken = yield* Clank.password({
-          message: "Axiom API Token",
-          validate: (v) => (v.length === 0 ? "Required" : undefined),
-        }).pipe(retryOnce);
-        const orgId = yield* promptOrgId(false);
+        if (ctx.ci) {
+          return { method: "env" as const };
+        }
+        return yield* configureInteractive(profileName);
+      }).pipe(
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: "failed to configure credentials",
+              cause: e,
+            }),
+        ),
+      );
 
-        yield* writeCredentials<AxiomStoredCredentials>(
-          profileName,
-          STORAGE_KEY,
-          {
-            type: "apiToken",
-            apiToken,
-            apiBaseUrl,
-            orgId: orgId && orgId.length > 0 ? orgId : undefined,
-          },
-        );
-        yield* Clank.success("Axiom: credentials saved.");
-        return {
-          method: "stored" as const,
-          credentialType: "apiToken" as const,
-        };
-      }),
-    ),
-    Match.when("pat", () =>
-      Effect.gen(function* () {
-        const apiToken = yield* Clank.password({
-          message: "Axiom Personal Access Token",
-          validate: (v) => (v.length === 0 ? "Required" : undefined),
-        }).pipe(retryOnce);
-        const orgId = yield* promptOrgId(true);
+    const resolveCredentials = (
+      profileName: string,
+      config: AxiomAuthConfig,
+    ): Effect.Effect<AxiomResolvedCredentials, AuthError> =>
+      Match.value(config).pipe(
+        Match.when(
+          { method: "env" },
+          Effect.fnUntraced(function* () {
+            const apiToken =
+              (yield* getEnvRedacted("AXIOM_TOKEN")) ??
+              (yield* getEnvRedacted("AXIOM_API_KEY"));
+            if (!apiToken) {
+              return yield* new AuthError({
+                message:
+                  "Axiom env credentials not found. Set AXIOM_TOKEN (or AXIOM_API_KEY).",
+              });
+            }
+            const apiBaseUrl =
+              (yield* getEnv("AXIOM_URL")) ?? DEFAULT_API_BASE_URL;
+            const orgId = yield* getEnv("AXIOM_ORG_ID");
+            if (orgId) {
+              return {
+                type: "pat" as const,
+                apiToken,
+                apiBaseUrl,
+                orgId,
+                source: { type: "env" as const },
+              };
+            }
+            return {
+              type: "apiToken" as const,
+              apiToken,
+              apiBaseUrl,
+              source: { type: "env" as const },
+            };
+          }),
+        ),
+        Match.when({ method: "stored" }, () =>
+          store.read<AxiomStoredCredentials>(profileName, STORAGE_KEY).pipe(
+            Effect.flatMap((creds) =>
+              creds == null
+                ? Effect.fail(
+                    new AuthError({
+                      message:
+                        "Axiom stored credentials not found. Run: alchemy login --configure",
+                    }),
+                  )
+                : Effect.succeed(
+                    Match.value(creds).pipe(
+                      Match.when({ type: "apiToken" }, (c) => ({
+                        type: "apiToken" as const,
+                        apiToken: Redacted.make(c.apiToken),
+                        apiBaseUrl: c.apiBaseUrl ?? DEFAULT_API_BASE_URL,
+                        orgId: c.orgId,
+                        source: { type: "stored" as const },
+                      })),
+                      Match.when({ type: "pat" }, (c) => ({
+                        type: "pat" as const,
+                        apiToken: Redacted.make(c.apiToken),
+                        apiBaseUrl: c.apiBaseUrl ?? DEFAULT_API_BASE_URL,
+                        orgId: c.orgId,
+                        source: { type: "stored" as const },
+                      })),
+                      Match.exhaustive,
+                    ),
+                  ),
+            ),
+          ),
+        ),
+        Match.exhaustive,
+      );
 
-        yield* writeCredentials<AxiomStoredCredentials>(
-          profileName,
-          STORAGE_KEY,
-          { type: "pat", apiToken, apiBaseUrl, orgId },
-        );
-        yield* Clank.success("Axiom: credentials saved.");
-        return {
-          method: "stored" as const,
-          credentialType: "pat" as const,
-        };
-      }),
-    ),
-    Match.exhaustive,
-  );
-});
+    const logout = (profileName: string, config: AxiomAuthConfig) =>
+      Match.value(config).pipe(
+        Match.when({ method: "env" }, () => Effect.void),
+        Match.when({ method: "stored" }, () =>
+          store
+            .delete(profileName, STORAGE_KEY)
+            .pipe(
+              Effect.andThen(
+                Clank.success("Axiom: stored credentials removed"),
+              ),
+            ),
+        ),
+        Match.exhaustive,
+      );
 
-const promptOrgId = (required: boolean) =>
-  getEnv("AXIOM_ORG_ID").pipe(
-    Effect.flatMap((envOrgId) =>
-      Clank.text({
-        message: required
-          ? "Axiom Org ID (required for PAT)"
-          : "Axiom Org ID (Enter to skip)",
-        placeholder: envOrgId ?? "",
-        defaultValue: envOrgId ?? "",
-        validate: required
-          ? (v) => (v.length === 0 ? "Required" : undefined)
-          : undefined,
-      }).pipe(retryOnce),
-    ),
-  );
+    const login = (profileName: string, config: AxiomAuthConfig) =>
+      Match.value(config)
+        .pipe(
+          Match.when({ method: "env" }, () => Effect.void),
+          Match.when({ method: "stored" }, () =>
+            store
+              .read<AxiomStoredCredentials>(profileName, STORAGE_KEY)
+              .pipe(
+                Effect.flatMap((creds) =>
+                  creds == null ? loginStored(profileName) : Effect.void,
+                ),
+              ),
+          ),
+          Match.exhaustive,
+        )
+        .pipe(
+          Effect.mapError(
+            (e) => new AuthError({ message: "login failed", cause: e }),
+          ),
+        );
 
-const prettyPrint = (profileName: string, config: AxiomAuthConfig) =>
-  resolveCredentials(profileName, config).pipe(
-    Effect.tap((creds) => {
-      const sourceStr = creds.source.details
-        ? `${creds.source.type} - ${creds.source.details}`
-        : creds.source.type;
-      return Match.value(creds).pipe(
-        Match.when({ type: "apiToken" }, (c) =>
-          Effect.all([
-            Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
-            Console.log(`  apiBaseUrl: ${c.apiBaseUrl}`),
-            Console.log(`  orgId: ${c.orgId ?? "(none)"}`),
-            Console.log(`  source: ${sourceStr}`),
-          ]),
-        ),
-        Match.when({ type: "pat" }, (c) =>
-          Effect.all([
-            Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
-            Console.log(`  apiBaseUrl: ${c.apiBaseUrl}`),
-            Console.log(`  orgId: ${c.orgId}`),
-            Console.log(`  source: ${sourceStr}`),
-          ]),
+    const prettyPrint = (profileName: string, config: AxiomAuthConfig) =>
+      resolveCredentials(profileName, config).pipe(
+        Effect.tap((creds) => {
+          const sourceStr = creds.source.details
+            ? `${creds.source.type} - ${creds.source.details}`
+            : creds.source.type;
+          return Match.value(creds).pipe(
+            Match.when({ type: "apiToken" }, (c) =>
+              Effect.all([
+                Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
+                Console.log(`  apiBaseUrl: ${c.apiBaseUrl}`),
+                Console.log(`  orgId: ${c.orgId ?? "(none)"}`),
+                Console.log(`  source: ${sourceStr}`),
+              ]),
+            ),
+            Match.when({ type: "pat" }, (c) =>
+              Effect.all([
+                Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
+                Console.log(`  apiBaseUrl: ${c.apiBaseUrl}`),
+                Console.log(`  orgId: ${c.orgId}`),
+                Console.log(`  source: ${sourceStr}`),
+              ]),
+            ),
+            Match.exhaustive,
+          );
+        }),
+        Effect.catch((e) =>
+          Console.error(`  Failed to retrieve credentials: ${e}`),
         ),
-        Match.exhaustive,
       );
-    }),
-    Effect.catch((e) =>
-      Console.error(`  Failed to retrieve credentials: ${e}`),
-    ),
-  );
+
+    return {
+      configure: configureCredentials,
+      logout,
+      login,
+      prettyPrint,
+      read: resolveCredentials,
+    };
+  }),
+);

package/src/Axiom/Credentials.ts

@@ -5,7 +5,7 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Match from "effect/Match";
 import { getAuthProvider } from "../Auth/AuthProvider.ts";
-import { ALCHEMY_PROFILE, loadOrConfigure } from "../Auth/Profile.ts";
+import { ALCHEMY_PROFILE, Profile } from "../Auth/Profile.ts";
 import {
   AXIOM_AUTH_PROVIDER_NAME,
   type AxiomAuthConfig,
@@ -27,15 +27,15 @@ export const fromAuthProvider = () =>
   Layer.effect(
     Credentials,
     Effect.gen(function* () {
+      const profile = yield* Profile;
       const auth = yield* getAuthProvider<
         AxiomAuthConfig,
         AxiomResolvedCredentials
       >(AXIOM_AUTH_PROVIDER_NAME);
       const profileName = yield* ALCHEMY_PROFILE;
       const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
-      const ctx = yield* Effect.context<never>();
 
-      return yield* loadOrConfigure(auth, profileName, { ci }).pipe(
+      return yield* profile.loadOrConfigure(auth, profileName, { ci }).pipe(
         Effect.flatMap((config) =>
           auth.read(profileName, config as AxiomAuthConfig),
         ),
@@ -60,7 +60,6 @@ export const fromAuthProvider = () =>
               message: `Failed to resolve Axiom credentials for profile '${profileName}': ${(e as { message?: string }).message ?? String(e)}`,
             }),
         ),
-        Effect.provide(ctx),
       );
     }),
   );

package/src/Axiom/Providers.ts

@@ -1,5 +1,7 @@
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import * as Layer from "effect/Layer";
+import { CredentialsStoreLive } from "../Auth/Credentials.ts";
+import { ProfileLive } from "../Auth/Profile.ts";
 import * as Provider from "../Provider.ts";
 import { Annotation, AnnotationProvider } from "./Annotation.ts";
 import { ApiToken, ApiTokenProvider } from "./ApiToken.ts";
@@ -54,5 +56,7 @@ export const providers = () =>
     Layer.provideMerge(Credentials.fromAuthProvider()),
     Layer.provideMerge(FetchHttpClient.layer),
     Layer.provideMerge(AxiomAuth),
+    Layer.provideMerge(ProfileLive),
+    Layer.provideMerge(CredentialsStoreLive),
     Layer.orDie,
   );