alchemy 2.0.0-beta.34 → 2.0.0-beta.35

package/src/Cloudflare/Auth/AuthProvider.ts

@@ -3,7 +3,6 @@ import * as CfCredentialsModule from "@distilled.cloud/cloudflare/Credentials";
 import * as Console from "effect/Console";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Match from "effect/Match";
 import * as Redacted from "effect/Redacted";
@@ -14,12 +13,7 @@ import {
   AuthProviderLayer,
   type ConfigureContext,
 } from "../../Auth/AuthProvider.ts";
-import {
-  deleteCredentials,
-  displayRedacted,
-  readCredentials,
-  writeCredentials,
-} from "../../Auth/Credentials.ts";
+import { CredentialsStore, displayRedacted } from "../../Auth/Credentials.ts";
 import {
   getEnv,
   getEnvRedacted,
@@ -85,390 +79,6 @@ export type CloudflareResolvedCredentials =
 
 export const CLOUDFLARE_AUTH_PROVIDER_NAME = "Cloudflare";
 
-/**
- * Layer that registers the Cloudflare {@link AuthProvider} into the
- * {@link AuthProviders} registry when built. Include this in the Cloudflare
- * `providers()` layer so `alchemy login` can discover it.
- */
-export const CloudflareAuth = AuthProviderLayer<
-  CloudflareAuthConfig,
-  CloudflareResolvedCredentials
->()(CLOUDFLARE_AUTH_PROVIDER_NAME, {
-  configure: (profileName, ctx) => configureCredentials(profileName, ctx),
-  logout: (profileName, config) => logout(profileName, config),
-  login: (profileName, config) => login(profileName, config),
-  prettyPrint: (profileName, config) => prettyPrint(profileName, config),
-  read: (profileName, config) => resolveCredentials(profileName, config),
-});
-
-const resolveCredentials = (
-  profileName: string,
-  config: CloudflareAuthConfig,
-): Effect.Effect<
-  CloudflareResolvedCredentials,
-  AuthError,
-  FileSystem.FileSystem
-> =>
-  Match.value(config).pipe(
-    Match.when(
-      { method: "env" },
-      Effect.fnUntraced(function* () {
-        const accountId = yield* getEnvRequired("CLOUDFLARE_ACCOUNT_ID");
-        const apiToken = yield* getEnvRedacted("CLOUDFLARE_API_TOKEN");
-        if (apiToken) {
-          return {
-            type: "apiToken" as const,
-            apiToken,
-            accountId,
-            source: { type: "env" as const },
-          };
-        }
-        const apiKey = yield* getEnvRedacted("CLOUDFLARE_API_KEY");
-        const email = yield* getEnvRedacted("CLOUDFLARE_EMAIL");
-        if (apiKey && email) {
-          return {
-            type: "apiKey" as const,
-            apiKey,
-            email,
-            accountId,
-            source: { type: "env" as const },
-          };
-        }
-        return yield* new AuthError({
-          message:
-            "Cloudflare env credentials not found. Set CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL.",
-        });
-      }),
-    ),
-    Match.when({ method: "stored" }, () =>
-      readCredentials<CloudflareStoredCredentials>(
-        profileName,
-        "cf-stored",
-      ).pipe(
-        Effect.flatMap((creds) =>
-          creds == null
-            ? Effect.fail(
-                new AuthError({
-                  message:
-                    "Cloudflare stored credentials not found. Run: alchemy-effect login --configure",
-                }),
-              )
-            : Effect.succeed(
-                Match.value(creds).pipe(
-                  Match.when({ type: "apiToken" }, (c) => ({
-                    type: "apiToken" as const,
-                    apiToken: Redacted.make(c.apiToken),
-                    accountId: c.accountId,
-                    source: { type: "stored" as const },
-                  })),
-                  Match.when({ type: "apiKey" }, (c) => ({
-                    type: "apiKey" as const,
-                    apiKey: Redacted.make(c.apiKey),
-                    email: Redacted.make(c.email),
-                    accountId: c.accountId,
-                    source: { type: "stored" as const },
-                  })),
-                  Match.exhaustive,
-                ),
-              ),
-        ),
-      ),
-    ),
-    Match.when({ method: "oauth" }, (cfg) =>
-      Effect.gen(function* () {
-        const creds = yield* readCredentials<OAuthClient.OAuthCredentials>(
-          profileName,
-          "cf-oauth",
-        );
-        if (creds == null || creds.type !== "oauth") {
-          return yield* Effect.fail(
-            new AuthError({
-              message:
-                "Cloudflare OAuth credentials not found. Run: alchemy login",
-            }),
-          );
-        }
-        // Refresh proactively if the token has expired (or is within
-        // 10s of expiring). Persist the refreshed creds so subsequent
-        // resolves don't repeat the round-trip.
-        const fresh =
-          creds.expires > Date.now() + 10_000
-            ? creds
-            : yield* OAuthClient.refresh(creds).pipe(
-                Effect.tap((refreshed) =>
-                  writeCredentials(profileName, "cf-oauth", refreshed),
-                ),
-                Effect.mapError(
-                  (e) =>
-                    new AuthError({
-                      message:
-                        "Cloudflare OAuth refresh failed. Run: alchemy login",
-                      cause: e,
-                    }),
-                ),
-              );
-        return {
-          type: "oauth" as const,
-          accessToken: Redacted.make(fresh.access),
-          expires: fresh.expires,
-          accountId: cfg.accountId,
-          source: { type: "oauth" as const },
-        };
-      }),
-    ),
-    Match.exhaustive,
-  );
-
-const logout = (profileName: string, config: CloudflareAuthConfig) =>
-  Match.value(config).pipe(
-    Match.when({ method: "env" }, () => Effect.void),
-    Match.when({ method: "stored" }, () =>
-      deleteCredentials(profileName, "cf-stored").pipe(
-        Effect.andThen(Clank.success("Cloudflare: stored credentials removed")),
-      ),
-    ),
-    Match.when({ method: "oauth" }, () =>
-      readCredentials<OAuthClient.OAuthCredentials>(
-        profileName,
-        "cf-oauth",
-      ).pipe(
-        Effect.tap((creds) =>
-          creds?.type === "oauth"
-            ? OAuthClient.revoke(creds).pipe(
-                Effect.catchTag("OAuthError", (err) =>
-                  Clank.warn(
-                    `Cloudflare: could not revoke OAuth token: ${err.errorDescription}`,
-                  ),
-                ),
-              )
-            : Effect.void,
-        ),
-        Effect.andThen(deleteCredentials(profileName, "cf-oauth")),
-        Effect.andThen(Clank.success("Cloudflare: OAuth credentials removed.")),
-      ),
-    ),
-    Match.exhaustive,
-  );
-
-const login = (profileName: string, config: CloudflareAuthConfig) =>
-  Match.value(config)
-    .pipe(
-      Match.when({ method: "env" }, () => Effect.void),
-      Match.when({ method: "stored" }, () =>
-        readCredentials<CloudflareStoredCredentials>(
-          profileName,
-          "cf-stored",
-        ).pipe(
-          Effect.flatMap((creds) =>
-            creds == null ? loginStored(profileName) : Effect.void,
-          ),
-        ),
-      ),
-      Match.when({ method: "oauth" }, (c) =>
-        Effect.gen(function* () {
-          const creds = yield* readCredentials<OAuthClient.OAuthCredentials>(
-            profileName,
-            "cf-oauth",
-          );
-
-          if (creds?.type === "oauth") {
-            yield* Clank.info("Cloudflare: refreshing OAuth credentials...");
-            yield* OAuthClient.refresh(creds).pipe(
-              Effect.flatMap((refreshed) =>
-                writeCredentials(profileName, "cf-oauth", refreshed).pipe(
-                  Effect.andThen(
-                    Clank.success("Cloudflare: OAuth credentials refreshed."),
-                  ),
-                ),
-              ),
-              Effect.catchTag("OAuthError", () =>
-                oauthLogin(profileName, c.scopes).pipe(Effect.asVoid),
-              ),
-            );
-            return;
-          }
-
-          yield* oauthLogin(profileName, c.scopes);
-        }),
-      ),
-      Match.exhaustive,
-    )
-    .pipe(
-      Effect.mapError(
-        (e) => new AuthError({ message: "login failed", cause: e }),
-      ),
-    );
-
-const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
-  Effect.gen(function* () {
-    if (ctx.ci) {
-      return { method: "env" as const };
-    }
-    return yield* configureInteractive(profileName);
-  }).pipe(
-    Effect.mapError(
-      (e) =>
-        new AuthError({
-          message: "failed to configure credentials",
-          cause: e,
-        }),
-    ),
-  );
-
-const configureInteractive = (profileName: string) =>
-  Clank.select({
-    message: "Cloudflare authentication method",
-    options,
-  }).pipe(
-    Effect.flatMap((method) =>
-      Match.value(method).pipe(
-        Match.when("env", () => Effect.succeed({ method: "env" as const })),
-        Match.when("oauth", () => configureOAuth(profileName)),
-        Match.when("stored", () => loginStored(profileName)),
-        Match.exhaustive,
-      ),
-    ),
-  );
-
-const configureOAuth = Effect.fnUntraced(function* (profileName: string) {
-  const scopes = yield* promptOAuthScopes();
-
-  const oauthCreds = yield* oauthLogin(profileName, scopes);
-
-  const accountId = yield* selectAccount(oauthCreds.access).pipe(
-    Effect.mapError(
-      (e) =>
-        new AuthError({
-          message: "Cloudflare: could not list accounts",
-          cause: e,
-        }),
-    ),
-  );
-
-  return {
-    method: "oauth" as const,
-    scopes,
-    accountId,
-  };
-});
-
-const loginStored = Effect.fnUntraced(function* (profileName: string) {
-  const credentialType = yield* Clank.select({
-    message: "Cloudflare credential type",
-    options: [
-      { value: "apiToken" as const, label: "API Token", hint: "recommended" },
-      { value: "apiKey" as const, label: "API Key + Email" },
-    ],
-  }).pipe(retryOnce);
-
-  return yield* Match.value(credentialType).pipe(
-    Match.when("apiToken", () =>
-      Effect.gen(function* () {
-        const apiToken = yield* Clank.password({
-          message: "Cloudflare API Token",
-          validate: (v) => (v.length === 0 ? "Required" : undefined),
-        }).pipe(retryOnce);
-        const accountId = yield* promptAccountId();
-
-        yield* writeCredentials<CloudflareStoredCredentials>(
-          profileName,
-          "cf-stored",
-          { type: "apiToken", apiToken, accountId },
-        );
-        yield* Clank.success("Cloudflare: credentials saved.");
-        return {
-          method: "stored" as const,
-          credentialType: "apiToken" as const,
-        };
-      }),
-    ),
-    Match.when("apiKey", () =>
-      Effect.gen(function* () {
-        const apiKey = yield* Clank.text({
-          message: "Cloudflare API Key",
-          validate: (v) => (v.length === 0 ? "Required" : undefined),
-        }).pipe(retryOnce);
-
-        const email = yield* Clank.text({
-          message: "Cloudflare Email",
-          validate: (v) => (v.length === 0 ? "Required" : undefined),
-        }).pipe(retryOnce);
-        const accountId = yield* promptAccountId();
-
-        yield* writeCredentials<CloudflareStoredCredentials>(
-          profileName,
-          "cf-stored",
-          { type: "apiKey", apiKey, email, accountId },
-        );
-        yield* Clank.success("Cloudflare: credentials saved.");
-        return {
-          method: "stored" as const,
-          credentialType: "apiKey" as const,
-        };
-      }),
-    ),
-    Match.exhaustive,
-  );
-});
-
-const oauthLogin = (profileName: string, scopes: string[]) =>
-  Effect.gen(function* () {
-    const authorization = OAuthClient.authorize([...scopes, "offline_access"]);
-
-    yield* Clank.info("Cloudflare: opening browser for OAuth login...");
-    yield* Clank.info(authorization.url);
-    yield* Clank.openUrl(authorization.url).pipe(
-      Effect.catch(() =>
-        Clank.warn(
-          "Cloudflare: could not open browser automatically. Please open the URL above manually.",
-        ),
-      ),
-    );
-    yield* Clank.info(
-      "Cloudflare: waiting for authorization (up to 5 minutes)...",
-    );
-
-    const credentials = yield* OAuthClient.callback(authorization);
-    yield* writeCredentials(profileName, "cf-oauth", credentials);
-    yield* Clank.success("Cloudflare: OAuth credentials saved.");
-    return credentials;
-  });
-
-const promptAccountId = () =>
-  getEnv("CLOUDFLARE_ACCOUNT_ID").pipe(
-    Effect.flatMap((envAccountId) =>
-      Clank.text({
-        message: "Cloudflare Account ID (Enter to skip)",
-        placeholder: envAccountId ?? "",
-        defaultValue: envAccountId ?? "",
-      }).pipe(retryOnce),
-    ),
-  );
-
-const promptOAuthScopes = () =>
-  Clank.confirm({
-    message: "Customize OAuth scopes? (default covers typical use cases)",
-    initialValue: false,
-  }).pipe(
-    retryOnce,
-    Effect.flatMap((customize) => {
-      if (!customize) return Effect.succeed([...DEFAULT_SCOPES]);
-      return Clank.multiselect({
-        message: "Select OAuth scopes",
-        initialValues: DEFAULT_SCOPES as string[],
-        options: Object.entries(ALL_SCOPES).map(([value, hint]) => ({
-          value: value as string,
-          label: value,
-          hint,
-        })),
-        required: true,
-      }).pipe(
-        Effect.map((s) => s as string[]),
-        retryOnce,
-      );
-    }),
-  );
-
 const withOAuthCredentials = <A, E>(
   accessToken: string,
   effect: Effect.Effect<
@@ -516,49 +126,452 @@ const selectAccount = (accessToken: string) =>
     }).pipe(retryOnce);
   }).pipe((e) => withOAuthCredentials(accessToken, e));
 
-const prettyPrint = (profileName: string, config: CloudflareAuthConfig) =>
-  resolveCredentials(profileName, config).pipe(
-    Effect.tap((creds) => {
-      const sourceStr = creds.source.details
-        ? `${creds.source.type} - ${creds.source.details}`
-        : creds.source.type;
-      return Match.value(creds).pipe(
-        Match.when({ type: "apiToken" }, (c) =>
-          Effect.all([
-            Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
-            Console.log(`  accountId: ${c.accountId}`),
-            Console.log(`  source: ${sourceStr}`),
-          ]),
+const promptAccountId = () =>
+  getEnv("CLOUDFLARE_ACCOUNT_ID").pipe(
+    Effect.flatMap((envAccountId) =>
+      Clank.text({
+        message: "Cloudflare Account ID (Enter to skip)",
+        placeholder: envAccountId ?? "",
+        defaultValue: envAccountId ?? "",
+      }).pipe(retryOnce),
+    ),
+  );
+
+const promptOAuthScopes = () =>
+  Clank.confirm({
+    message: "Customize OAuth scopes? (default covers typical use cases)",
+    initialValue: false,
+  }).pipe(
+    retryOnce,
+    Effect.flatMap((customize) => {
+      if (!customize) return Effect.succeed([...DEFAULT_SCOPES]);
+      return Clank.multiselect({
+        message: "Select OAuth scopes",
+        initialValues: DEFAULT_SCOPES as string[],
+        options: Object.entries(ALL_SCOPES).map(([value, hint]) => ({
+          value: value as string,
+          label: value,
+          hint,
+        })),
+        required: true,
+      }).pipe(
+        Effect.map((s) => s as string[]),
+        retryOnce,
+      );
+    }),
+  );
+
+/**
+ * Layer that registers the Cloudflare {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the Cloudflare
+ * `providers()` layer so `alchemy login` can discover it.
+ */
+export const CloudflareAuth = AuthProviderLayer<
+  CloudflareAuthConfig,
+  CloudflareResolvedCredentials
+>()(
+  CLOUDFLARE_AUTH_PROVIDER_NAME,
+  Effect.gen(function* () {
+    const store = yield* CredentialsStore;
+
+    const oauthLogin = (profileName: string, scopes: string[]) =>
+      Effect.gen(function* () {
+        const authorization = OAuthClient.authorize([
+          ...scopes,
+          "offline_access",
+        ]);
+
+        yield* Clank.info("Cloudflare: opening browser for OAuth login...");
+        yield* Clank.info(authorization.url);
+        yield* Clank.openUrl(authorization.url).pipe(
+          Effect.catch(() =>
+            Clank.warn(
+              "Cloudflare: could not open browser automatically. Please open the URL above manually.",
+            ),
+          ),
+        );
+        yield* Clank.info(
+          "Cloudflare: waiting for authorization (up to 5 minutes)...",
+        );
+
+        const credentials = yield* OAuthClient.callback(authorization);
+        yield* store.write(profileName, "cf-oauth", credentials);
+        yield* Clank.success("Cloudflare: OAuth credentials saved.");
+        return credentials;
+      });
+
+    const loginStored = Effect.fnUntraced(function* (profileName: string) {
+      const credentialType = yield* Clank.select({
+        message: "Cloudflare credential type",
+        options: [
+          {
+            value: "apiToken" as const,
+            label: "API Token",
+            hint: "recommended",
+          },
+          { value: "apiKey" as const, label: "API Key + Email" },
+        ],
+      }).pipe(retryOnce);
+
+      return yield* Match.value(credentialType).pipe(
+        Match.when("apiToken", () =>
+          Effect.gen(function* () {
+            const apiToken = yield* Clank.password({
+              message: "Cloudflare API Token",
+              validate: (v) => (v.length === 0 ? "Required" : undefined),
+            }).pipe(retryOnce);
+            const accountId = yield* promptAccountId();
+
+            yield* store.write<CloudflareStoredCredentials>(
+              profileName,
+              "cf-stored",
+              { type: "apiToken", apiToken, accountId },
+            );
+            yield* Clank.success("Cloudflare: credentials saved.");
+            return {
+              method: "stored" as const,
+              credentialType: "apiToken" as const,
+            };
+          }),
         ),
-        Match.when({ type: "apiKey" }, (c) =>
-          Effect.all([
-            Console.log(`  apiKey: ${displayRedacted(c.apiKey)}`),
-            Console.log(`  email:  ${displayRedacted(c.email)}`),
-            Console.log(`  accountId: ${c.accountId}`),
-            Console.log(`  source: ${sourceStr}`),
-          ]),
+        Match.when("apiKey", () =>
+          Effect.gen(function* () {
+            const apiKey = yield* Clank.text({
+              message: "Cloudflare API Key",
+              validate: (v) => (v.length === 0 ? "Required" : undefined),
+            }).pipe(retryOnce);
+
+            const email = yield* Clank.text({
+              message: "Cloudflare Email",
+              validate: (v) => (v.length === 0 ? "Required" : undefined),
+            }).pipe(retryOnce);
+            const accountId = yield* promptAccountId();
+
+            yield* store.write<CloudflareStoredCredentials>(
+              profileName,
+              "cf-stored",
+              { type: "apiKey", apiKey, email, accountId },
+            );
+            yield* Clank.success("Cloudflare: credentials saved.");
+            return {
+              method: "stored" as const,
+              credentialType: "apiKey" as const,
+            };
+          }),
         ),
-        Match.when({ type: "oauth" }, (c) => {
-          const remainingMs = c.expires - Date.now();
-          const expiresAt = new Date(c.expires).toISOString();
-          const expiresStr =
-            remainingMs <= 0
-              ? `expired (${expiresAt})`
-              : `in ${Duration.format(Duration.millis(remainingMs))} (${expiresAt})`;
-          return Effect.all([
-            Console.log(`  accessToken: ${displayRedacted(c.accessToken)}`),
-            Console.log(`  expires: ${expiresStr}`),
-            Console.log(`  accountId: ${c.accountId}`),
-            Console.log(`  source: ${sourceStr}`),
-          ]);
-        }),
         Match.exhaustive,
       );
-    }),
-    Effect.catch((e) =>
-      Console.error(`  Failed to retrieve credentials: ${e}`),
-    ),
-  );
+    });
+
+    const configureOAuth = Effect.fnUntraced(function* (profileName: string) {
+      const scopes = yield* promptOAuthScopes();
+
+      const oauthCreds = yield* oauthLogin(profileName, scopes);
+
+      const accountId = yield* selectAccount(oauthCreds.access).pipe(
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: "Cloudflare: could not list accounts",
+              cause: e,
+            }),
+        ),
+      );
+
+      return {
+        method: "oauth" as const,
+        scopes,
+        accountId,
+      };
+    });
+
+    const configureInteractive = (profileName: string) =>
+      Clank.select({
+        message: "Cloudflare authentication method",
+        options,
+      }).pipe(
+        Effect.flatMap((method) =>
+          Match.value(method).pipe(
+            Match.when("env", () => Effect.succeed({ method: "env" as const })),
+            Match.when("oauth", () => configureOAuth(profileName)),
+            Match.when("stored", () => loginStored(profileName)),
+            Match.exhaustive,
+          ),
+        ),
+      );
+
+    const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
+      Effect.gen(function* () {
+        if (ctx.ci) {
+          return { method: "env" as const };
+        }
+        return yield* configureInteractive(profileName);
+      }).pipe(
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: "failed to configure credentials",
+              cause: e,
+            }),
+        ),
+      );
+
+    const resolveCredentials = (
+      profileName: string,
+      config: CloudflareAuthConfig,
+    ): Effect.Effect<CloudflareResolvedCredentials, AuthError> =>
+      Match.value(config).pipe(
+        Match.when(
+          { method: "env" },
+          Effect.fnUntraced(function* () {
+            const accountId = yield* getEnvRequired("CLOUDFLARE_ACCOUNT_ID");
+            const apiToken = yield* getEnvRedacted("CLOUDFLARE_API_TOKEN");
+            if (apiToken) {
+              return {
+                type: "apiToken" as const,
+                apiToken,
+                accountId,
+                source: { type: "env" as const },
+              };
+            }
+            const apiKey = yield* getEnvRedacted("CLOUDFLARE_API_KEY");
+            const email = yield* getEnvRedacted("CLOUDFLARE_EMAIL");
+            if (apiKey && email) {
+              return {
+                type: "apiKey" as const,
+                apiKey,
+                email,
+                accountId,
+                source: { type: "env" as const },
+              };
+            }
+            return yield* new AuthError({
+              message:
+                "Cloudflare env credentials not found. Set CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL.",
+            });
+          }),
+        ),
+        Match.when({ method: "stored" }, () =>
+          store
+            .read<CloudflareStoredCredentials>(profileName, "cf-stored")
+            .pipe(
+              Effect.flatMap((creds) =>
+                creds == null
+                  ? Effect.fail(
+                      new AuthError({
+                        message:
+                          "Cloudflare stored credentials not found. Run: alchemy-effect login --configure",
+                      }),
+                    )
+                  : Effect.succeed(
+                      Match.value(creds).pipe(
+                        Match.when({ type: "apiToken" }, (c) => ({
+                          type: "apiToken" as const,
+                          apiToken: Redacted.make(c.apiToken),
+                          accountId: c.accountId,
+                          source: { type: "stored" as const },
+                        })),
+                        Match.when({ type: "apiKey" }, (c) => ({
+                          type: "apiKey" as const,
+                          apiKey: Redacted.make(c.apiKey),
+                          email: Redacted.make(c.email),
+                          accountId: c.accountId,
+                          source: { type: "stored" as const },
+                        })),
+                        Match.exhaustive,
+                      ),
+                    ),
+              ),
+            ),
+        ),
+        Match.when({ method: "oauth" }, (cfg) =>
+          Effect.gen(function* () {
+            const creds = yield* store.read<OAuthClient.OAuthCredentials>(
+              profileName,
+              "cf-oauth",
+            );
+            if (creds == null || creds.type !== "oauth") {
+              return yield* Effect.fail(
+                new AuthError({
+                  message:
+                    "Cloudflare OAuth credentials not found. Run: alchemy login",
+                }),
+              );
+            }
+            // Refresh proactively if the token has expired (or is within
+            // 10s of expiring). Persist the refreshed creds so subsequent
+            // resolves don't repeat the round-trip.
+            const fresh =
+              creds.expires > Date.now() + 10_000
+                ? creds
+                : yield* OAuthClient.refresh(creds).pipe(
+                    Effect.tap((refreshed) =>
+                      store.write(profileName, "cf-oauth", refreshed),
+                    ),
+                    Effect.mapError(
+                      (e) =>
+                        new AuthError({
+                          message:
+                            "Cloudflare OAuth refresh failed. Run: alchemy login",
+                          cause: e,
+                        }),
+                    ),
+                  );
+            return {
+              type: "oauth" as const,
+              accessToken: Redacted.make(fresh.access),
+              expires: fresh.expires,
+              accountId: cfg.accountId,
+              source: { type: "oauth" as const },
+            };
+          }),
+        ),
+        Match.exhaustive,
+      );
+
+    const logout = (profileName: string, config: CloudflareAuthConfig) =>
+      Match.value(config).pipe(
+        Match.when({ method: "env" }, () => Effect.void),
+        Match.when({ method: "stored" }, () =>
+          store
+            .delete(profileName, "cf-stored")
+            .pipe(
+              Effect.andThen(
+                Clank.success("Cloudflare: stored credentials removed"),
+              ),
+            ),
+        ),
+        Match.when({ method: "oauth" }, () =>
+          store
+            .read<OAuthClient.OAuthCredentials>(profileName, "cf-oauth")
+            .pipe(
+              Effect.tap((creds) =>
+                creds?.type === "oauth"
+                  ? OAuthClient.revoke(creds).pipe(
+                      Effect.catchTag("OAuthError", (err) =>
+                        Clank.warn(
+                          `Cloudflare: could not revoke OAuth token: ${err.errorDescription}`,
+                        ),
+                      ),
+                    )
+                  : Effect.void,
+              ),
+              Effect.andThen(store.delete(profileName, "cf-oauth")),
+              Effect.andThen(
+                Clank.success("Cloudflare: OAuth credentials removed."),
+              ),
+            ),
+        ),
+        Match.exhaustive,
+      );
+
+    const login = (profileName: string, config: CloudflareAuthConfig) =>
+      Match.value(config)
+        .pipe(
+          Match.when({ method: "env" }, () => Effect.void),
+          Match.when({ method: "stored" }, () =>
+            store
+              .read<CloudflareStoredCredentials>(profileName, "cf-stored")
+              .pipe(
+                Effect.flatMap((creds) =>
+                  creds == null ? loginStored(profileName) : Effect.void,
+                ),
+              ),
+          ),
+          Match.when({ method: "oauth" }, (c) =>
+            Effect.gen(function* () {
+              const creds = yield* store.read<OAuthClient.OAuthCredentials>(
+                profileName,
+                "cf-oauth",
+              );
+
+              if (creds?.type === "oauth") {
+                yield* Clank.info(
+                  "Cloudflare: refreshing OAuth credentials...",
+                );
+                yield* OAuthClient.refresh(creds).pipe(
+                  Effect.flatMap((refreshed) =>
+                    store
+                      .write(profileName, "cf-oauth", refreshed)
+                      .pipe(
+                        Effect.andThen(
+                          Clank.success(
+                            "Cloudflare: OAuth credentials refreshed.",
+                          ),
+                        ),
+                      ),
+                  ),
+                  Effect.catchTag("OAuthError", () =>
+                    oauthLogin(profileName, c.scopes).pipe(Effect.asVoid),
+                  ),
+                );
+                return;
+              }
+
+              yield* oauthLogin(profileName, c.scopes);
+            }),
+          ),
+          Match.exhaustive,
+        )
+        .pipe(
+          Effect.mapError(
+            (e) => new AuthError({ message: "login failed", cause: e }),
+          ),
+        );
+
+    const prettyPrint = (profileName: string, config: CloudflareAuthConfig) =>
+      resolveCredentials(profileName, config).pipe(
+        Effect.tap((creds) => {
+          const sourceStr = creds.source.details
+            ? `${creds.source.type} - ${creds.source.details}`
+            : creds.source.type;
+          return Match.value(creds).pipe(
+            Match.when({ type: "apiToken" }, (c) =>
+              Effect.all([
+                Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
+                Console.log(`  accountId: ${c.accountId}`),
+                Console.log(`  source: ${sourceStr}`),
+              ]),
+            ),
+            Match.when({ type: "apiKey" }, (c) =>
+              Effect.all([
+                Console.log(`  apiKey: ${displayRedacted(c.apiKey)}`),
+                Console.log(`  email:  ${displayRedacted(c.email)}`),
+                Console.log(`  accountId: ${c.accountId}`),
+                Console.log(`  source: ${sourceStr}`),
+              ]),
+            ),
+            Match.when({ type: "oauth" }, (c) => {
+              const remainingMs = c.expires - Date.now();
+              const expiresAt = new Date(c.expires).toISOString();
+              const expiresStr =
+                remainingMs <= 0
+                  ? `expired (${expiresAt})`
+                  : `in ${Duration.format(Duration.millis(remainingMs))} (${expiresAt})`;
+              return Effect.all([
+                Console.log(`  accessToken: ${displayRedacted(c.accessToken)}`),
+                Console.log(`  expires: ${expiresStr}`),
+                Console.log(`  accountId: ${c.accountId}`),
+                Console.log(`  source: ${sourceStr}`),
+              ]);
+            }),
+            Match.exhaustive,
+          );
+        }),
+        Effect.catch((e) =>
+          Console.error(`  Failed to retrieve credentials: ${e}`),
+        ),
+      );
+
+    return {
+      configure: configureCredentials,
+      logout,
+      login,
+      prettyPrint,
+      read: resolveCredentials,
+    };
+  }),
+);
 
 export const ALL_SCOPES = {
   "access:read":
@@ -680,6 +693,8 @@ export const DEFAULT_SCOPES = [
   "user:read",
   "vectorize:write",
   "workers_kv:write",
+  "workers_observability:read",
+  "workers_observability_telemetry:write",
   "workers_routes:write",
   "workers_scripts:write",
   "workers_tail:read",