alchemy 2.0.0-beta.75 → 2.0.0-beta.77

package/src/Axiom/AuthProvider.ts

@@ -1,341 +1,139 @@
 import { DEFAULT_API_BASE_URL } from "@distilled.cloud/axiom/Credentials";
-import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
-import * as Match from "effect/Match";
 import * as Redacted from "effect/Redacted";
+import { AuthError } from "../Auth/AuthProvider.ts";
+import { getEnv, getEnvRedacted } from "../Auth/Env.ts";
 import {
-  AuthError,
-  AuthProviderLayer,
-  type ConfigureContext,
-} from "../Auth/AuthProvider.ts";
-import { CredentialsStore, displayRedacted } from "../Auth/Credentials.ts";
-import { getEnv, getEnvRedacted, retryOnce } from "../Auth/Env.ts";
-import * as Clank from "../Util/Clank.ts";
+  makeStoredAuthProvider,
+  storedSecret,
+  storedValueText,
+  type StoredAuthConfig,
+} from "../Auth/StoredAuthProvider.ts";
 
-const STORAGE_KEY = "axiom-stored";
-
-const options: Array<{
-  value: AxiomAuthConfig["method"];
-  label: string;
-  hint?: string;
-}> = [
-  {
-    value: "env",
-    label: "Environment Variables",
-    hint: "AXIOM_TOKEN (or AXIOM_API_KEY) + optional AXIOM_ORG_ID, AXIOM_URL",
-  },
-  {
-    value: "stored",
-    label: "API Token or Personal Access Token",
-    hint: "enter credentials interactively, stored in ~/.alchemy/credentials",
-  },
-];
-
-export type AxiomAuthConfig =
-  | { method: "env" }
-  | { method: "stored"; credentialType: "apiToken" }
-  | { method: "stored"; credentialType: "pat" };
+export const AXIOM_AUTH_PROVIDER_NAME = "Axiom";
 
-export type AxiomStoredCredentials =
-  | { type: "apiToken"; apiToken: string; apiBaseUrl?: string; orgId?: string }
-  | { type: "pat"; apiToken: string; apiBaseUrl?: string; orgId: string };
+export type AxiomAuthConfig = StoredAuthConfig;
 
+/**
+ * Resolved Axiom credentials. The provider values are a flat record
+ * (token + optional orgId/apiBaseUrl); the `apiToken`/`pat` distinction is
+ * derived at resolution time from orgId presence — an org id means the token
+ * is treated as a personal access token, mirroring how the CI environment
+ * resolution has always classified `AXIOM_ORG_ID`.
+ */
 export type AxiomResolvedCredentials =
   | {
       type: "apiToken";
       apiToken: Redacted.Redacted<string>;
       apiBaseUrl: string;
       orgId?: string;
-      source: { type: AxiomAuthConfig["method"]; details?: string };
+      source: { type: AxiomAuthConfig["method"] | "env"; details?: string };
     }
   | {
       type: "pat";
       apiToken: Redacted.Redacted<string>;
       apiBaseUrl: string;
       orgId: string;
-      source: { type: AxiomAuthConfig["method"]; details?: string };
+      source: { type: AxiomAuthConfig["method"] | "env"; details?: string };
     };
 
-export const AXIOM_AUTH_PROVIDER_NAME = "Axiom";
-
-const promptOrgId = (required: boolean) =>
-  getEnv("AXIOM_ORG_ID").pipe(
-    Effect.flatMap((envOrgId) =>
-      Clank.text({
-        message: required
-          ? "Axiom Org ID (required for PAT)"
-          : "Axiom Org ID (Enter to skip)",
-        placeholder: envOrgId ?? "",
-        defaultValue: envOrgId ?? "",
-        validate: required
-          ? (v) => (v.length === 0 ? "Required" : undefined)
-          : undefined,
-      }).pipe(retryOnce),
-    ),
-  );
+const readEnvironment = Effect.gen(function* () {
+  const apiToken =
+    (yield* getEnvRedacted("AXIOM_TOKEN")) ??
+    (yield* getEnvRedacted("AXIOM_API_KEY"));
+  if (!apiToken) {
+    return yield* new AuthError({
+      message:
+        "Axiom CI credentials not found. Set AXIOM_TOKEN or AXIOM_API_KEY.",
+    });
+  }
+  const apiBaseUrl = (yield* getEnv("AXIOM_URL")) ?? DEFAULT_API_BASE_URL;
+  const orgId = yield* getEnv("AXIOM_ORG_ID");
+  return orgId
+    ? {
+        type: "pat" as const,
+        apiToken,
+        apiBaseUrl,
+        orgId,
+        source: { type: "env" as const },
+      }
+    : {
+        type: "apiToken" as const,
+        apiToken,
+        apiBaseUrl,
+        source: { type: "env" as const },
+      };
+});
+
+const axiomAuth = makeStoredAuthProvider<AxiomResolvedCredentials>({
+  provider: AXIOM_AUTH_PROVIDER_NAME,
+  fields: [
+    {
+      name: "token",
+      label: "Axiom API Token or Personal Access Token",
+      secret: true,
+    },
+    {
+      name: "orgId",
+      label: "Axiom Org ID (required for personal access tokens)",
+      optional: true,
+    },
+    {
+      name: "apiBaseUrl",
+      label: "Axiom API Base URL",
+      optional: true,
+      placeholder: DEFAULT_API_BASE_URL,
+    },
+  ],
+  toResolved: (values, source) => {
+    const apiToken = storedSecret(values.token) ?? Redacted.make("");
+    const apiBaseUrl =
+      storedValueText(values.apiBaseUrl) ?? DEFAULT_API_BASE_URL;
+    return values.orgId !== undefined
+      ? {
+          type: "pat",
+          apiToken,
+          apiBaseUrl,
+          orgId: storedValueText(values.orgId) ?? "",
+          source: { type: source },
+        }
+      : {
+          type: "apiToken",
+          apiToken,
+          apiBaseUrl,
+          source: { type: source },
+        };
+  },
+  readEnvironment,
+  environment: [
+    {
+      name: "AXIOM_TOKEN",
+      required: true,
+      secret: true,
+      alternatives: ["AXIOM_API_KEY"],
+      description: "Personal access token or API token.",
+    },
+    {
+      name: "AXIOM_URL",
+      required: false,
+      description: "API base URL for self-hosted or regional deployments.",
+    },
+    {
+      name: "AXIOM_ORG_ID",
+      required: false,
+      description:
+        "Organization id; required when the token is a personal access token.",
+    },
+  ],
+});
 
 /**
  * Layer that registers the Axiom {@link AuthProvider} into the
  * {@link AuthProviders} registry when built. Include this in the Axiom
- * `providers()` layer so `alchemy login` can discover it.
+ * `providers()` layer so the alchemy CLI can discover it.
  */
-export const AxiomAuth = AuthProviderLayer<
-  AxiomAuthConfig,
-  AxiomResolvedCredentials
->()(
-  AXIOM_AUTH_PROVIDER_NAME,
-  Effect.gen(function* () {
-    const store = yield* CredentialsStore;
-
-    const loginStored = Effect.fn(function* (profileName: string) {
-      const credentialType = yield* Clank.select({
-        message: "Axiom credential type",
-        options: [
-          {
-            value: "apiToken" as const,
-            label: "API Token",
-            hint: "recommended — scoped to specific datasets/actions",
-          },
-          {
-            value: "pat" as const,
-            label: "Personal Access Token",
-            hint: "full account control, requires Org ID",
-          },
-        ],
-      }).pipe(retryOnce);
+export const AxiomAuth = axiomAuth.layer;
 
-      const apiBaseUrlPrompt = yield* Clank.text({
-        message: "Axiom API Base URL (Enter for default)",
-        placeholder: DEFAULT_API_BASE_URL,
-        defaultValue: DEFAULT_API_BASE_URL,
-      }).pipe(retryOnce);
-      const apiBaseUrl =
-        apiBaseUrlPrompt && apiBaseUrlPrompt.length > 0
-          ? apiBaseUrlPrompt
-          : undefined;
-
-      return yield* Match.value(credentialType).pipe(
-        Match.when("apiToken", () =>
-          Effect.gen(function* () {
-            const apiToken = yield* Clank.password({
-              message: "Axiom API Token",
-              validate: (v) => (v.length === 0 ? "Required" : undefined),
-            }).pipe(retryOnce);
-            const orgId = yield* promptOrgId(false);
-
-            yield* store.write<AxiomStoredCredentials>(
-              profileName,
-              STORAGE_KEY,
-              {
-                type: "apiToken",
-                apiToken,
-                apiBaseUrl,
-                orgId: orgId && orgId.length > 0 ? orgId : undefined,
-              },
-            );
-            yield* Clank.success("Axiom: credentials saved.");
-            return {
-              method: "stored" as const,
-              credentialType: "apiToken" as const,
-            };
-          }),
-        ),
-        Match.when("pat", () =>
-          Effect.gen(function* () {
-            const apiToken = yield* Clank.password({
-              message: "Axiom Personal Access Token",
-              validate: (v) => (v.length === 0 ? "Required" : undefined),
-            }).pipe(retryOnce);
-            const orgId = yield* promptOrgId(true);
-
-            yield* store.write<AxiomStoredCredentials>(
-              profileName,
-              STORAGE_KEY,
-              { type: "pat", apiToken, apiBaseUrl, orgId },
-            );
-            yield* Clank.success("Axiom: credentials saved.");
-            return {
-              method: "stored" as const,
-              credentialType: "pat" as const,
-            };
-          }),
-        ),
-        Match.exhaustive,
-      );
-    });
-
-    const configureInteractive = (profileName: string) =>
-      Clank.select({
-        message: "Axiom authentication method",
-        options,
-      }).pipe(
-        Effect.flatMap((method) =>
-          Match.value(method).pipe(
-            Match.when("env", () => Effect.succeed({ method: "env" as const })),
-            Match.when("stored", () => loginStored(profileName)),
-            Match.exhaustive,
-          ),
-        ),
-      );
-
-    const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
-      Effect.gen(function* () {
-        if (ctx.ci) {
-          return { method: "env" as const };
-        }
-        return yield* configureInteractive(profileName);
-      }).pipe(
-        Effect.mapError(
-          (e) =>
-            new AuthError({
-              message: "failed to configure credentials",
-              cause: e,
-            }),
-        ),
-      );
-
-    const resolveCredentials = (
-      profileName: string,
-      config: AxiomAuthConfig,
-    ): Effect.Effect<AxiomResolvedCredentials, AuthError> =>
-      Match.value(config).pipe(
-        Match.when(
-          { method: "env" },
-          Effect.fn(function* () {
-            const apiToken =
-              (yield* getEnvRedacted("AXIOM_TOKEN")) ??
-              (yield* getEnvRedacted("AXIOM_API_KEY"));
-            if (!apiToken) {
-              return yield* new AuthError({
-                message:
-                  "Axiom env credentials not found. Set AXIOM_TOKEN (or AXIOM_API_KEY).",
-              });
-            }
-            const apiBaseUrl =
-              (yield* getEnv("AXIOM_URL")) ?? DEFAULT_API_BASE_URL;
-            const orgId = yield* getEnv("AXIOM_ORG_ID");
-            if (orgId) {
-              return {
-                type: "pat" as const,
-                apiToken,
-                apiBaseUrl,
-                orgId,
-                source: { type: "env" as const },
-              };
-            }
-            return {
-              type: "apiToken" as const,
-              apiToken,
-              apiBaseUrl,
-              source: { type: "env" as const },
-            };
-          }),
-        ),
-        Match.when({ method: "stored" }, () =>
-          store.read<AxiomStoredCredentials>(profileName, STORAGE_KEY).pipe(
-            Effect.flatMap((creds) =>
-              creds == null
-                ? Effect.fail(
-                    new AuthError({
-                      message:
-                        "Axiom stored credentials not found. Run: alchemy login --configure",
-                    }),
-                  )
-                : Effect.succeed(
-                    Match.value(creds).pipe(
-                      Match.when({ type: "apiToken" }, (c) => ({
-                        type: "apiToken" as const,
-                        apiToken: Redacted.make(c.apiToken),
-                        apiBaseUrl: c.apiBaseUrl ?? DEFAULT_API_BASE_URL,
-                        orgId: c.orgId,
-                        source: { type: "stored" as const },
-                      })),
-                      Match.when({ type: "pat" }, (c) => ({
-                        type: "pat" as const,
-                        apiToken: Redacted.make(c.apiToken),
-                        apiBaseUrl: c.apiBaseUrl ?? DEFAULT_API_BASE_URL,
-                        orgId: c.orgId,
-                        source: { type: "stored" as const },
-                      })),
-                      Match.exhaustive,
-                    ),
-                  ),
-            ),
-          ),
-        ),
-        Match.exhaustive,
-      );
-
-    const logout = (profileName: string, config: AxiomAuthConfig) =>
-      Match.value(config).pipe(
-        Match.when({ method: "env" }, () => Effect.void),
-        Match.when({ method: "stored" }, () =>
-          store
-            .delete(profileName, STORAGE_KEY)
-            .pipe(
-              Effect.andThen(
-                Clank.success("Axiom: stored credentials removed"),
-              ),
-            ),
-        ),
-        Match.exhaustive,
-      );
-
-    const login = (profileName: string, config: AxiomAuthConfig) =>
-      Match.value(config)
-        .pipe(
-          Match.when({ method: "env" }, () => Effect.void),
-          Match.when({ method: "stored" }, () =>
-            store
-              .read<AxiomStoredCredentials>(profileName, STORAGE_KEY)
-              .pipe(
-                Effect.flatMap((creds) =>
-                  creds == null ? loginStored(profileName) : Effect.void,
-                ),
-              ),
-          ),
-          Match.exhaustive,
-        )
-        .pipe(
-          Effect.mapError(
-            (e) => new AuthError({ message: "login failed", cause: e }),
-          ),
-        );
-
-    const prettyPrint = (profileName: string, config: AxiomAuthConfig) =>
-      resolveCredentials(profileName, config).pipe(
-        Effect.tap((creds) => {
-          const sourceStr = creds.source.details
-            ? `${creds.source.type} - ${creds.source.details}`
-            : creds.source.type;
-          return Match.value(creds).pipe(
-            Match.when({ type: "apiToken" }, (c) =>
-              Effect.all([
-                Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
-                Console.log(`  apiBaseUrl: ${c.apiBaseUrl}`),
-                Console.log(`  orgId: ${c.orgId ?? "(none)"}`),
-                Console.log(`  source: ${sourceStr}`),
-              ]),
-            ),
-            Match.when({ type: "pat" }, (c) =>
-              Effect.all([
-                Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
-                Console.log(`  apiBaseUrl: ${c.apiBaseUrl}`),
-                Console.log(`  orgId: ${c.orgId}`),
-                Console.log(`  source: ${sourceStr}`),
-              ]),
-            ),
-            Match.exhaustive,
-          );
-        }),
-      );
-
-    return {
-      configure: configureCredentials,
-      logout,
-      login,
-      prettyPrint,
-      read: resolveCredentials,
-    };
-  }),
-);
+/** Schema of Axiom's inline static-token values. */
+export const AxiomStoredCredentials = axiomAuth.storedSchema;
+export type AxiomStoredCredentials = typeof AxiomStoredCredentials.Type;

package/src/Axiom/Credentials.ts

@@ -1,11 +1,9 @@
 import { Credentials } from "@distilled.cloud/axiom/Credentials";
 import { ConfigError } from "@distilled.cloud/core/errors";
-import * as Config from "effect/Config";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Match from "effect/Match";
-import { getAuthProvider } from "../Auth/AuthProvider.ts";
-import { ALCHEMY_PROFILE, AlchemyProfile } from "../Auth/Profile.ts";
+import { resolveProviderConfig } from "../Auth/Resolve.ts";
 import {
   AXIOM_AUTH_PROVIDER_NAME,
   type AxiomAuthConfig,
@@ -21,24 +19,18 @@ export {
 /**
  * Build a `Credentials` layer that resolves Axiom credentials via the Alchemy
  * AuthProvider using the configured profile (defaults to "default", overridable
- * with the `ALCHEMY_PROFILE` env/config value).
+ * with the current Alchemy profile).
  */
 export const fromAuthProvider = () =>
   Layer.effect(
     Credentials,
     Effect.gen(function* () {
-      const profile = yield* AlchemyProfile;
-      const auth = yield* getAuthProvider<
+      const { profileName, resolve } = yield* resolveProviderConfig<
         AxiomAuthConfig,
         AxiomResolvedCredentials
       >(AXIOM_AUTH_PROVIDER_NAME);
-      const profileName = yield* ALCHEMY_PROFILE;
-      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
 
-      return yield* profile.loadOrConfigure(auth, profileName, { ci }).pipe(
-        Effect.flatMap((config) =>
-          auth.read(profileName, config as AxiomAuthConfig),
-        ),
+      return yield* resolve.pipe(
         Effect.map((creds) =>
           Match.value(creds).pipe(
             Match.when({ type: "apiToken" }, (c) => ({
@@ -57,7 +49,7 @@ export const fromAuthProvider = () =>
         Effect.mapError(
           (e) =>
             new ConfigError({
-              message: `Failed to resolve Axiom credentials for profile '${profileName}': ${(e as { message?: string }).message ?? String(e)}`,
+              message: `Failed to resolve Axiom credentials from ${profileName === undefined ? "the CI environment" : `profile '${profileName}'`}: ${(e as { message?: string }).message ?? String(e)}`,
             }),
         ),
         Effect.orDie,

package/src/Axiom/Providers.ts

@@ -1,7 +1,7 @@
 import * as Layer from "effect/Layer";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import { CredentialsStoreLive } from "../Auth/Credentials.ts";
-import { ProfileLive } from "../Auth/Profile.ts";
+import { ProfileStoreLive } from "../Auth/Profile.ts";
 import * as Provider from "../Provider.ts";
 import { Annotation, AnnotationProvider } from "./Annotation.ts";
 import { ApiToken, ApiTokenProvider } from "./ApiToken.ts";
@@ -25,7 +25,7 @@ export type ProviderRequirements = Layer.Services<ReturnType<typeof providers>>;
 /**
  * Axiom providers and credentials. Wires up Dataset, ApiToken, Notifier,
  * Monitor, Dashboard, VirtualField, View and Annotation resources, and
- * registers the Axiom AuthProvider so `alchemy login` can configure it.
+ * registers the Axiom AuthProvider so `alchemy profile edit` can configure it.
  */
 export const providers = () =>
   Layer.effect(
@@ -56,7 +56,7 @@ export const providers = () =>
     Layer.provideMerge(Credentials.fromAuthProvider()),
     Layer.provideMerge(FetchHttpClient.layer),
     Layer.provideMerge(AxiomAuth),
-    Layer.provideMerge(ProfileLive),
+    Layer.provideMerge(ProfileStoreLive),
     Layer.provideMerge(CredentialsStoreLive),
     Layer.orDie,
   );

package/src/Bundle/Bundle.ts

@@ -86,11 +86,9 @@ export interface BundleExtraOptions {
  * rolldown input/output overrides plus the {@link BundleExtraOptions}
  * (pure-annotation packages via `pure`, bundle analyzer).
  *
- * Top-level calls in `effect`, `@effect/*`, `alchemy`, `@alchemy.run/*`,
- * and `@distilled.cloud/*` are annotated as pure by default so unused
- * code from those packages is tree-shaken out of the bundle; list
- * additional packages via `pure.packages`, or disable annotation with
- * `pure: false`.
+ * Unused code is tree-shaken. `effect`, alchemy, and `@distilled.cloud`
+ * are marked pure so unused parts prune more aggressively. List extra
+ * packages with `pure.packages`, or disable with `pure: false`.
  */
 export interface BundleConfig extends BundleExtraOptions {
   /**