alchemy 2.0.0-beta.76 → 2.0.0-beta.77

package/lib/Auth/AuthProvider.js

@@ -1,9 +1,16 @@
+import { cachedFunction } from "../Util/cached-function.js";
+import * as Config from "effect/Config";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Path from "effect/Path";
 import * as Schema from "effect/Schema";
 import * as Semaphore from "effect/Semaphore";
-import { withLock } from "./Lock.js";
+import { Interaction } from "../Interaction.js";
+import { UserFacingError } from "../UserFacingError.js";
+import { withProfileCredentialsLock } from "./Lock.js";
 /**
  * Canonical web host for OAuth provider-agnostic landing pages
  * (`/auth/success`, `/auth/error`). The CLI's loopback server 302s the
@@ -14,15 +21,6 @@ import { withLock } from "./Lock.js";
 export const AUTH_LANDING_HOST = "https://alchemy.run";
 export const AUTH_SUCCESS_URL = `${AUTH_LANDING_HOST}/auth/success`;
 export const AUTH_ERROR_URL = `${AUTH_LANDING_HOST}/auth/error`;
-/**
- * Methods on an {@link AuthProviderImpl} that mutate (or could trigger
- * mutation of) on-disk credentials. The factory wraps these in a
- * cross-process file lock keyed by `(profileName, providerName)` so that
- * concurrent processes never refresh / write credentials simultaneously.
- *
- * `prettyPrint` is intentionally excluded: it's read-only display.
- */
-const LOCKED_METHODS = new Set(["read", "login", "logout", "configure"]);
 /**
  * Methods that may drive an interactive flow (prompts, browser-based
  * OAuth, etc.). A process-wide mutex serializes these across providers
@@ -30,55 +28,194 @@ const LOCKED_METHODS = new Set(["read", "login", "logout", "configure"]);
  * before Planetscale's begins — even when the two auth provider Layers
  * are built in parallel as part of a single `providers()` Layer.
  *
- * The clack prompt wrapper in `Util/Clank.ts` enforces per-prompt
- * serialization; this mutex enforces per-flow serialization so the user
- * sees one provider's prompts grouped together rather than interleaved.
+ * The interactive renderer enforces per-prompt serialization; this mutex
+ * enforces per-flow serialization so the user sees one provider's prompts
+ * grouped together rather than interleaved.
  */
-const INTERACTIVE_METHODS = new Set(["login", "configure"]);
 const interactiveMutex = Semaphore.makeUnsafe(1);
 export class AuthError extends Schema.TaggedError()("AuthError", {
     message: Schema.String,
     cause: Schema.optional(Schema.Defect()),
 }) {
+    [UserFacingError] = true;
+}
+/**
+ * Stored credentials exist (or are expected) but cannot be used until the
+ * user re-authenticates: missing values, an expired/rotated
+ * token, or a session the provider can no longer refresh silently. The
+ * profile UI renders this as "needs re-login" instead of a generic error,
+ * and callers match it with `Effect.catchTag("NeedsReauth", ...)` — never
+ * by inspecting the message.
+ */
+export class NeedsReauth extends Schema.TaggedError()("NeedsReauth", {
+    provider: Schema.String,
+    profile: Schema.String,
+    message: Schema.String,
+    cause: Schema.optional(Schema.Defect()),
+}) {
+    [UserFacingError] = true;
 }
+/**
+ * Standard remediation hint appended to stored-credential errors
+ * ("credentials not found", "refresh failed", ...). Deliberately generic —
+ * the explicit command is correct from any surface, including inside the
+ * profile dashboard (where `r` is merely the shortcut for it). Centralized
+ * so the phrasing lives in one place; surface-aware wording can layer on
+ * top later without touching call sites.
+ */
+export const refreshHint = (provider, profileName) => `Run \`alchemy profile refresh --profile ${profileName} --provider ${provider}\`.`;
+/** {@link refreshHint}'s sibling for reconfiguration. */
+export const reconfigureHint = (provider, profileName) => `Run \`alchemy profile edit --profile ${profileName} --reconfigure ${provider}\` to reconfigure.`;
 export class AuthProviders extends Context.Service()("AuthProviders") {
 }
+/**
+ * Declares one environment variable a provider's {@link AuthProviderImpl.readEnvironment}
+ * consumes. Profiles are not available in CI — environment variables are the
+ * only CI credential source — so this metadata is the machine-readable
+ * contract for "what must CI set": rendered in docs, surfaced by the CLI,
+ * and available to tooling through the {@link AuthProviders} registry.
+ */
+export const EnvironmentVariable = Schema.Struct({
+    /** Environment variable name, e.g. `CLOUDFLARE_API_TOKEN`. */
+    name: Schema.String,
+    /** What the variable configures and when it applies. */
+    description: Schema.optional(Schema.String),
+    /**
+     * Whether credential resolution fails when neither this variable nor one
+     * of its {@link alternatives} is set. Use `description` to explain
+     * conditional requirements (e.g. "required unless X is set").
+     */
+    required: Schema.Boolean,
+    /** Holds a secret — display surfaces must redact its value. */
+    secret: Schema.optional(Schema.Boolean),
+    /**
+     * Alternative variable names that satisfy the same requirement, in
+     * precedence order after {@link name} (e.g. `AWS_DEFAULT_REGION` for
+     * `AWS_REGION`).
+     */
+    alternatives: Schema.optional(Schema.Array(Schema.String)),
+});
+const EnvironmentVariables = Schema.Array(EnvironmentVariable);
+/** Render a one-line summary of a provider's environment contract. */
+export const describeEnvironment = (environment) => environment
+    .map((v) => {
+    const names = [v.name, ...(v.alternatives ?? [])].join(" | ");
+    return v.required ? names : `[${names}]`;
+})
+    .join(", ");
+/**
+ * The variable names a provider's environment resolution would consume, or
+ * `undefined` when the declared contract is not fully satisfied (some
+ * required variable has no non-empty value). Reads through the ambient
+ * `ConfigProvider` — the process environment plus `.env` / `--env-file` —
+ * so it sees exactly what `readEnvironment` will. Environment credentials
+ * take precedence over any profile, CI or not; the returned names tell the
+ * user exactly which keys won.
+ */
+export const presentEnvironment = (environment) => Effect.gen(function* () {
+    const used = [];
+    for (const variable of environment) {
+        let found;
+        for (const name of [variable.name, ...(variable.alternatives ?? [])]) {
+            const value = yield* Config.option(Config.string(name));
+            if (Option.isSome(value) && value.value !== "") {
+                found = name;
+                break;
+            }
+        }
+        if (found !== undefined)
+            used.push(found);
+        else if (variable.required)
+            return undefined;
+    }
+    return used.length > 0 ? used : undefined;
+});
 export const AuthProvider = () => (name, impl) => Effect.gen(function* () {
-    const ctx = yield* Effect.context();
+    // FileSystem/Path back the cross-process credentials lock that wraps
+    // `logout`/`read` below, so capture them with the impl's own services.
+    //
+    // `Effect.context()` snapshots the ENTIRE fiber context (the type
+    // parameter only narrows the type), and `Effect.provideContext` makes
+    // the provided side win — so an Interaction that happens to be
+    // ambient at REGISTRATION would silently shadow whatever the caller
+    // provides at call time, making the interactive methods' declared
+    // `Interaction` requirement a dead letter. Omit it from the snapshot:
+    // interactive flows resolve Interaction from the caller, exactly as
+    // their signatures promise (a scripted test Interaction, a
+    // browser-driven Alchemist login).
+    // SAFETY: the assertion restores the pre-omit type — tsc cannot reduce
+    // `Exclude<R, … Exclude<R, Interaction>>` over the generic R. It only
+    // over-promises Interaction, which every registered method signature
+    // re-declares as a requirement anyway, so no call site can rely on the
+    // capture satisfying it.
+    const ctx = Context.omit(Interaction)(yield* Effect.context());
     const providers = yield* AuthProviders;
     const service = yield* Effect.isEffect(impl)
         ? impl
         : Effect.succeed(impl);
-    return yield* Effect.sync(() => (providers[name] = {
+    // Validate the declared environment contract at registration so a
+    // malformed declaration fails at layer build (programmer error), not
+    // when a CI run tries to render it.
+    const environment = service.environment === undefined
+        ? []
+        : Schema.decodeUnknownSync(EnvironmentVariables)(service.environment);
+    if (service.readEnvironment !== undefined && environment.length === 0) {
+        return yield* Effect.die(`AuthProvider '${name}' implements readEnvironment but does not ` +
+            "declare its `environment` variables. Declare every variable " +
+            "readEnvironment consumes so CI requirements are discoverable.");
+    }
+    if (service.configureWith !== undefined &&
+        (service.configureMethods === undefined ||
+            service.configureMethods.length === 0)) {
+        return yield* Effect.die(`AuthProvider '${name}' implements configureWith but does not ` +
+            "declare `configureMethods`. Declare each accepted --method and " +
+            "its --set fields so the CLI can validate and document them.");
+    }
+    const provider = {
+        logEnvironmentCredentials: yield* cachedFunction((used) => Effect.logInfo(`${name}: using environment variables (${used.join(", ")}) instead of the profile.`), { key: ([used]) => JSON.stringify(used.toSorted()) }),
         kind: "AuthProvider",
         name,
-        ...Object.fromEntries(Object.entries(service).map(([methodName, fn]) => [
-            methodName,
-            (...args) => {
-                let eff = fn(...args).pipe(Effect.provideContext(ctx));
-                if (LOCKED_METHODS.has(methodName)) {
-                    // First positional arg is always `profileName`.
-                    const profileName = args[0];
-                    eff = withLock(`${profileName}-${name}`, eff, {
-                        label: `${name}.${methodName} (profile '${profileName}')`,
-                        // `login`/`configure` legitimately block on the user
-                        // (browser OAuth, `aws sso login`), and a periodic
-                        // notice would trample the prompt they are answering.
-                        watchdog: !INTERACTIVE_METHODS.has(methodName),
-                    });
-                }
-                if (INTERACTIVE_METHODS.has(methodName)) {
-                    eff = Semaphore.withPermits(interactiveMutex, 1)(eff);
-                }
-                return eff;
-            },
-        ])),
-    }));
+        // configure/login can wait minutes on a browser grant, so they hold
+        // only the process-level interactive mutex — never the per-profile
+        // credentials lock, which would starve every concurrent `read` (its
+        // waiters time out at ~120s). Providers whose login path performs a
+        // rotate-on-use silent refresh wrap that read-refresh-persist
+        // section (and only it) in `withProfileCredentialsLock` themselves;
+        // a post-browser persist is a benign whole-file swap where the last
+        // grant wins.
+        configure: (profileName, currentConfig) => Semaphore.withPermits(interactiveMutex, 1)(service
+            .configure(profileName, currentConfig)
+            .pipe(Effect.provideContext(ctx))),
+        login: (profileName, config, updateConfig) => Semaphore.withPermits(interactiveMutex, 1)(service
+            .login(profileName, config, updateConfig)
+            .pipe(Effect.provideContext(ctx))),
+        logout: (profileName, config) => withProfileCredentialsLock(profileName, service.logout(profileName, config)).pipe(Effect.provideContext(ctx)),
+        details: (profileName, config, updateConfig) => withProfileCredentialsLock(profileName, service.details(profileName, config, updateConfig)).pipe(Effect.provideContext(ctx)),
+        ...(service.configureWith === undefined
+            ? {}
+            : {
+                configureWith: (profileName, input) => service.configureWith(profileName, input).pipe(Effect.provideContext(ctx)),
+                configureMethods: service.configureMethods,
+            }),
+        read: (profileName, config, updateConfig) => withProfileCredentialsLock(profileName, service.read(profileName, config, updateConfig)).pipe(Effect.provideContext(ctx)),
+        readEnvironment: service.readEnvironment?.pipe(Effect.provideContext(ctx)),
+        environment,
+        configSchema: service.configSchema,
+        decodeConfig: (profileName, config) => Effect.gen(function* () {
+            return yield* Schema.decodeUnknownEffect(service.configSchema)(config).pipe(Effect.mapError((cause) => new AuthError({
+                message: `Stored ${name} configuration in profile '${profileName}' is not valid ` +
+                    `for this version of alchemy. ` +
+                    `${reconfigureHint(name, profileName)}`,
+                cause,
+            })));
+        }),
+    };
+    providers[name] = provider;
 });
 /**
  * Build a Layer that registers an AuthProvider into the {@link AuthProviders}
  * registry when its parent layer is built. Use this from a provider's
- * top-level `providers()` Layer so that `alchemy login` can discover the
+ * top-level `providers()` Layer so that the alchemy CLI can discover the
  * provider via the registry without forcing credential resolution.
  */
 export const AuthProviderLayer = () => (name, impl) => Layer.effectDiscard(AuthProvider()(name, impl));
@@ -91,5 +228,8 @@ export const getAuthProvider = (name) => AuthProviders.use((registry) => registr
     ? Effect.fail(new AuthError({
         message: `AuthProvider '${name}' is not registered. Make sure its layer has been provided.`,
     }))
-    : Effect.succeed(registry[name]));
+    : Effect.succeed(
+    // SAFETY: registration erases provider-specific generic parameters;
+    // callers restore the contract associated with the requested name.
+    registry[name]));
 //# sourceMappingURL=AuthProvider.js.map

package/lib/Auth/AuthProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.js","sourceRoot":"","sources":["../../src/Auth/AuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,iBAAiB,eAAe,CAAC;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,iBAAiB,aAAa,CAAC;AAEhE;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAC5D,MAAM,gBAAgB,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAEjD,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,WAAW,EAAa,CAAC,WAAW,EAAE;IAC1E,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;CACxC,CAAC;CAAG;AAEL,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAK/C,CAAC,eAAe,CAAC;CAAG;AA2EvB,MAAM,CAAC,MAAM,YAAY,GACvB,GAAmD,EAAE,CACrD,CAQE,IAAY,EACZ,IAsBK,EACL,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,GAAG,EAAE,CACH,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;QACjB,IAAI,EAAE,cAAc;QACpB,IAAI;QACJ,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,UAAU;YACV,CAAC,GAAG,IAA2B,EAAE,EAAE;gBACjC,IAAI,GAAG,GAAI,EAAU,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CACjC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAC3B,CAAC;gBACF,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBACnC,gDAAgD;oBAChD,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;oBACtC,GAAG,GAAG,QAAQ,CAAC,GAAG,WAAW,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE;wBAC5C,KAAK,EAAE,GAAG,IAAI,IAAI,UAAU,cAAc,WAAW,IAAI;wBACzD,qDAAqD;wBACrD,mDAAmD;wBACnD,sDAAsD;wBACtD,QAAQ,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC;qBAC/C,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBACxC,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACxD,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;SACF,CAAC,CACH;KACmC,CAAC,CAC1C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEP;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,GAAmD,EAAE,CACrD,CAQE,IAAY,EACZ,IAsBK,EACL,EAAE,CACF,KAAK,CAAC,aAAa,CACjB,YAAY,EAAuB,CAOjC,IAAI,EAAE,IAAI,CAAC,CACd,CAAC;AAEN;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAI7B,IAAY,EACgE,EAAE,CAC9E,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC7B,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI;IACpB,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,SAAS,CAAC;QACZ,OAAO,EAAE,iBAAiB,IAAI,6DAA6D;KAC5F,CAAC,CACH;IACH,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsC,CAAC,CACxE,CAAC"}
+{"version":3,"file":"AuthProvider.js","sourceRoot":"","sources":["../../src/Auth/AuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,iBAAiB,eAAe,CAAC;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,iBAAiB,aAAa,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAEjD,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,WAAW,EAAa,CAAC,WAAW,EAAE;IAC1E,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;CACxC,CAAC;IACS,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,WAAW,EAAe,CAChE,aAAa,EACb;IACE,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;CACxC,CACF;IACU,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAE,WAAmB,EAAU,EAAE,CAC3E,2CAA2C,WAAW,eAAe,QAAQ,KAAK,CAAC;AAErF,yDAAyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAgB,EAChB,WAAmB,EACX,EAAE,CACV,wCAAwC,WAAW,kBAAkB,QAAQ,oBAAoB,CAAC;AAEpG,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAK/C,CAAC,eAAe,CAAC;CAAG;AAEvB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC,OAAO;IACxB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;IACvC;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;CAC3D,CAAC,CAAC;AAIH,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAE/D,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,WAA+C,EACvC,EAAE,CACV,WAAW;KACR,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;IACT,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;AAC3C,CAAC,CAAC;KACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAEhB;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,WAA+C,EAC/C,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,CAAC;QACnC,IAAI,KAAyB,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;gBAC/C,KAAK,GAAG,IAAI,CAAC;gBACb,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aACrC,IAAI,QAAQ,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC,CAAC,CAAC;AA+KL,MAAM,CAAC,MAAM,YAAY,GACvB,GAAmD,EAAE,CACrD,CACE,IAAY,EACZ,IAE2E,EAC3E,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,qEAAqE;IACrE,uEAAuE;IACvE,EAAE;IACF,kEAAkE;IAClE,sEAAsE;IACtE,+DAA+D;IAC/D,oEAAoE;IACpE,kEAAkE;IAClE,sEAAsE;IACtE,oEAAoE;IACpE,2DAA2D;IAC3D,mCAAmC;IACnC,uEAAuE;IACvE,sEAAsE;IACtE,qEAAqE;IACrE,uEAAuE;IACvE,yBAAyB;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CACnC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAElB,CACgE,CAAC;IACtE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,kEAAkE;IAClE,qEAAqE;IACrE,oCAAoC;IACpC,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,iBAAiB,IAAI,4CAA4C;YAC/D,8DAA8D;YAC9D,+DAA+D,CAClE,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,aAAa,KAAK,SAAS;QACnC,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;YACrC,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC,EACxC,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,iBAAiB,IAAI,0CAA0C;YAC7D,iEAAiE;YACjE,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAsC;QAClD,yBAAyB,EAAE,KAAK,CAAC,CAAC,cAAc,CAC9C,CAAC,IAA2B,EAAE,EAAE,CAC9B,MAAM,CAAC,OAAO,CACZ,GAAG,IAAI,kCAAkC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CACpF,EACH,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CACrD;QACD,IAAI,EAAE,cAAc;QACpB,IAAI;QACJ,oEAAoE;QACpE,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,8DAA8D;QAC9D,oEAAoE;QACpE,oEAAoE;QACpE,cAAc;QACd,SAAS,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,EAAE,CACxC,SAAS,CAAC,WAAW,CACnB,gBAAgB,EAChB,CAAC,CACF,CACC,OAAO;aACJ,SAAS,CAAC,WAAW,EAAE,aAAa,CAAC;aACrC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CACpC;QACH,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAC3C,SAAS,CAAC,WAAW,CACnB,gBAAgB,EAChB,CAAC,CACF,CACC,OAAO;aACJ,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC;aACxC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CACpC;QACH,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAC9B,0BAA0B,CACxB,WAAW,EACX,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CACpC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAC7C,0BAA0B,CACxB,WAAW,EACX,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,CACnD,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACpC,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,aAAa,EAAE,CACb,WAAmB,EACnB,KAGC,EACD,EAAE,CACF,OAAO,CAAC,aAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,CAC7C,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAC3B;gBACH,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;aAC3C,CAAC;QACN,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAC1C,0BAA0B,CACxB,WAAW,EACX,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,CAChD,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACpC,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,IAAI,CAC5C,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAC3B;QACD,WAAW;QACX,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CACpC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAC5D,MAAM,CACP,CAAC,IAAI,CACJ,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,SAAS,CAAC;gBACZ,OAAO,EACL,UAAU,IAAI,8BAA8B,WAAW,iBAAiB;oBACxE,+BAA+B;oBAC/B,GAAG,eAAe,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE;gBACzC,KAAK;aACN,CAAC,CACL,CACF,CAAC;QACJ,CAAC,CAAC;KACL,CAAC;IAEF,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;AAC7B,CAAC,CAAC,CAAC;AAEP;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,GAAmD,EAAE,CACrD,CACE,IAAY,EACZ,IAE2E,EAC3E,EAAE,CACF,KAAK,CAAC,aAAa,CACjB,YAAY,EAAuB,CAAa,IAAI,EAAE,IAAI,CAAC,CAC5D,CAAC;AAEN;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAI7B,IAAY,EACgE,EAAE,CAC9E,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC7B,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI;IACpB,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,SAAS,CAAC;QACZ,OAAO,EAAE,iBAAiB,IAAI,6DAA6D;KAC5F,CAAC,CACH;IACH,CAAC,CAAC,MAAM,CAAC,OAAO;IACZ,oEAAoE;IACpE,mEAAmE;IACnE,QAAQ,CAAC,IAAI,CAAsC,CACpD,CACN,CAAC"}

package/lib/Auth/BrowserOAuth.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Shared browser-OAuth ceremony for auth providers: open the authorization
+ * URL, then race the provider's local callback listener against the branded
+ * "waiting for browser" prompt (spinner + compact URL; Enter switches to
+ * manual code entry, `o` opens the browser again, and `c` copies the URL).
+ *
+ * Built-in providers (Cloudflare, Planetscale) and custom stack-provided
+ * auth providers should all route their browser flows through this so the
+ * login UX stays uniform.
+ */
+import * as Effect from "effect/Effect";
+import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import * as Interaction from "../Interaction.ts";
+export interface BrowserOAuthOptions<A, E1, R1, E2, R2> {
+    /** Display name, e.g. "Cloudflare" — used in the prompt title. */
+    provider: string;
+    /** The authorization URL the browser was pointed at. */
+    url: string;
+    /** Resolves when the local callback listener receives the redirect. */
+    callback: Effect.Effect<A, E1, R1>;
+    /** Exchanges a manually pasted code / callback URL for credentials. */
+    exchange: (input: string) => Effect.Effect<A, E2, R2>;
+    /** Spinner label. @default "waiting for browser authorization (up to 5 minutes)…" */
+    waitingLabel?: string;
+}
+export declare const browserOAuth: <A, E1, R1, E2, R2>(options: BrowserOAuthOptions<A, E1, R1, E2, R2>) => Effect.Effect<A, E1 | E2 | Interaction.InteractionError, R1 | R2 | ChildProcessSpawner | Interaction.Interaction>;
+//# sourceMappingURL=BrowserOAuth.d.ts.map

package/lib/Auth/BrowserOAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserOAuth.d.ts","sourceRoot":"","sources":["../../src/Auth/BrowserOAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AAGjD,MAAM,WAAW,mBAAmB,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;IACpD,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACnC,uEAAuE;IACvE,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACtD,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,YAAY,GAAwB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,uKAuChE,CAAC"}

package/lib/Auth/BrowserOAuth.js

@@ -0,0 +1,41 @@
+/**
+ * Shared browser-OAuth ceremony for auth providers: open the authorization
+ * URL, then race the provider's local callback listener against the branded
+ * "waiting for browser" prompt (spinner + compact URL; Enter switches to
+ * manual code entry, `o` opens the browser again, and `c` copies the URL).
+ *
+ * Built-in providers (Cloudflare, Planetscale) and custom stack-provided
+ * auth providers should all route their browser flows through this so the
+ * login UX stays uniform.
+ */
+import * as Effect from "effect/Effect";
+import * as Interaction from "../Interaction.js";
+import { CallbackServerStartError } from "./OAuthFlow.js";
+export const browserOAuth = Effect.fn(function* (options) {
+    const services = yield* Effect.context();
+    // This runner is invoked later by React's keyboard event boundary, not
+    // while the surrounding Effect is executing.
+    const openUrl = Effect.runPromiseWith(services);
+    const openFailed = yield* Interaction.openUrl(options.url).pipe(Effect.as(false), Effect.catch(() => Effect.succeed(true)));
+    return yield* Effect.raceFirst(
+    // A callback server that cannot start (e.g. the port is taken) must not
+    // fail the race — warn and hang so manual code entry stays available.
+    // Genuine OAuth failures delivered via the callback still fail fast.
+    options.callback.pipe(Effect.catch((e) => e instanceof CallbackServerStartError
+        ? Interaction.accessors.output
+            .warning(`${e.message} — paste the authorization code instead.`)
+            .pipe(Effect.andThen(Effect.never))
+        : Effect.fail(e))), (yield* Interaction.Interaction).prompt
+        .awaitExternal({
+        message: `${options.provider} authorization`,
+        waitingLabel: options.waitingLabel ??
+            "waiting for browser authorization (up to 5 minutes)…",
+        url: options.url,
+        openFailed,
+        onOpen: () => openUrl(Interaction.openUrl(options.url)),
+        inputLabel: "Paste the authorization code or callback URL",
+        validate: (value) => value.trim().length > 0 ? undefined : "Paste a code or URL",
+    })
+        .pipe(Effect.flatMap(options.exchange)));
+});
+//# sourceMappingURL=BrowserOAuth.js.map

package/lib/Auth/BrowserOAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserOAuth.js","sourceRoot":"","sources":["../../src/Auth/BrowserOAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAe1D,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAC7C,OAA+C;IAE/C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAuB,CAAC;IAC9D,uEAAuE;IACvE,6CAA6C;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAC7D,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAChB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACzC,CAAC;IACF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS;IAC5B,wEAAwE;IACxE,sEAAsE;IACtE,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,IAAI,CACnB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB,CAAC,YAAY,wBAAwB;QACnC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM;aACzB,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,0CAA0C,CAAC;aAC/D,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CACnB,CACF,EACD,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,MAAM;SACpC,aAAa,CAAC;QACb,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,gBAAgB;QAC5C,YAAY,EACV,OAAO,CAAC,YAAY;YACpB,sDAAsD;QACxD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU;QACV,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvD,UAAU,EAAE,8CAA8C;QAC1D,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB;KAC9D,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAC1C,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/lib/Auth/Credentials.d.ts

@@ -2,24 +2,29 @@ import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
-import type { PlatformError } from "effect/PlatformError";
 import * as Redacted from "effect/Redacted";
-export declare const profileCredentialsDirPath: (profile: string) => string;
+import * as Schema from "effect/Schema";
+import { AuthError } from "./AuthProvider.ts";
 export declare const credentialsFilePath: (profile: string, provider: string) => string;
 /**
  * Service exposing per-profile credential file helpers. All methods have
  * `R = never` — the {@link FileSystem.FileSystem} requirement is captured
  * by {@link CredentialsStoreLive} when the layer is built.
+ *
+ * Reads and writes go through the provider's declared credential schema, so
+ * a hand-edited or corrupted secrets file surfaces as a typed `AuthError`
+ * (with a reconfigure hint) instead of propagating malformed data into API
+ * calls.
  */
 export interface CredentialsStoreService {
-    readonly read: <T>(profile: string, provider: string) => Effect.Effect<T | undefined>;
-    readonly write: <T>(profile: string, provider: string, credentials: T) => Effect.Effect<void, PlatformError>;
-    readonly delete: (profile: string, provider: string) => Effect.Effect<void>;
+    readonly read: <A, E>(profile: string, provider: string, schema: Schema.Codec<A, E>) => Effect.Effect<A | undefined, AuthError>;
+    readonly write: <A, E>(profile: string, provider: string, schema: Schema.Codec<A, E>, credentials: A) => Effect.Effect<void, AuthError>;
+    readonly delete: (profile: string, provider: string) => Effect.Effect<void, AuthError>;
     /**
      * Recursively remove the `~/.alchemy/credentials/{profile}` directory
      * containing all per-provider secrets for `profile`. No-op if it doesn't exist.
      */
-    readonly deleteProfile: (profile: string) => Effect.Effect<void>;
+    readonly deleteProfile: (profile: string) => Effect.Effect<void, AuthError>;
 }
 declare const CredentialsStore_base: Context.ServiceClass<CredentialsStore, "Alchemy::CredentialsStore", CredentialsStoreService>;
 export declare class CredentialsStore extends CredentialsStore_base {

package/lib/Auth/Credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Credentials.d.ts","sourceRoot":"","sources":["../../src/Auth/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAM5C,eAAO,MAAM,yBAAyB,YAAa,MAAM,WACjB,CAAC;AAEzC,eAAO,MAAM,mBAAmB,YAAa,MAAM,YAAY,MAAM,WACF,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EACf,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,CAAC,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5E;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAClE;;AAED,qBAAa,gBAAiB,SAAQ,qBAGN;CAAG;AAEnC,eAAO,MAAM,oBAAoB,6DAsDhC,CAAC;AAEF,wBAAgB,eAAe,CAC7B,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC5B,YAAY,SAAI,GACf,MAAM,CAIR"}
+{"version":3,"file":"Credentials.d.ts","sourceRoot":"","sources":["../../src/Auth/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAI9C,eAAO,MAAM,mBAAmB,YAAa,MAAM,YAAY,MAAM,WACF,CAAC;AAEpE;;;;;;;;;GASG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAClB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KACvB,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EACnB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAC1B,WAAW,EAAE,CAAC,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,CACf,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;CAC7E;;AAED,qBAAa,gBAAiB,SAAQ,qBAGN;CAAG;AAEnC,eAAO,MAAM,oBAAoB,6DAyIhC,CAAC;AAmBF,wBAAgB,eAAe,CAC7B,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC5B,YAAY,SAAI,GACf,MAAM,CAIR"}

package/lib/Auth/Credentials.js

@@ -3,37 +3,66 @@ import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
 import path from "pathe";
-import { rootDir } from "./Profile.js";
-const credentialsDirPath = path.join(rootDir, "credentials");
-export const profileCredentialsDirPath = (profile) => path.join(credentialsDirPath, profile);
+import { writeFileAtomic } from "../Util/AtomicFile.js";
+import { profileCommandHint } from "../Util/interactive.js";
+import { AuthError } from "./AuthProvider.js";
+import { profileCredentialsDirPath } from "./Paths.js";
+import { validateProfileName } from "./Profile.js";
 export const credentialsFilePath = (profile, provider) => path.join(profileCredentialsDirPath(profile), `${provider}.json`);
 export class CredentialsStore extends Context.Service()("Alchemy::CredentialsStore") {
 }
 export const CredentialsStoreLive = Layer.effect(CredentialsStore, Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
-    const read = (profile, provider) => fs.readFileString(credentialsFilePath(profile, provider)).pipe(Effect.catch(() => Effect.succeed(undefined)), Effect.map((data) => {
+    const read = (profile, provider, schema) => Effect.gen(function* () {
+        const filePath = yield* validateCredentialPath(profile, provider);
+        const data = yield* fs.readFileString(filePath).pipe(Effect.catchReason("PlatformError", "NotFound", () => Effect.succeed(undefined)), Effect.mapError((cause) => new AuthError({
+            message: `Could not read credentials at '${filePath}'.`,
+            cause,
+        })));
         if (data === undefined)
             return undefined;
-        try {
-            return JSON.parse(data);
-        }
-        catch {
-            return undefined;
-        }
-    }));
-    const write = (profile, provider, credentials) => {
-        const filePath = credentialsFilePath(profile, provider);
-        return fs.makeDirectory(path.dirname(filePath), { recursive: true }).pipe(Effect.flatMap(() => {
-            return fs.writeFileString(filePath, JSON.stringify(credentials, null, 2));
-        }));
-    };
-    const remove_ = (profile, provider) => fs
-        .remove(credentialsFilePath(profile, provider))
-        .pipe(Effect.catch(() => Effect.void));
-    const deleteProfile = (profile) => fs
-        .remove(profileCredentialsDirPath(profile), { recursive: true })
-        .pipe(Effect.catch(() => Effect.void));
+        const json = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Unknown))(data).pipe(Effect.mapError((cause) => new AuthError({
+            message: `Stored credentials at '${filePath}' contain invalid JSON.`,
+            cause,
+        })));
+        const command = yield* profileCommandHint(`alchemy profile edit --profile ${profile} --reconfigure ${provider}`);
+        return yield* Schema.decodeUnknownEffect(schema)(json).pipe(Effect.mapError((cause) => new AuthError({
+            message: `Stored credentials at '${filePath}' do not match the expected shape. ` +
+                `Run \`${command}\` to replace them.`,
+            cause,
+        })));
+    });
+    const write = (profile, provider, schema, credentials) => Effect.gen(function* () {
+        const filePath = yield* validateCredentialPath(profile, provider);
+        const encoded = yield* Schema.encodeEffect(schema)(credentials).pipe(Effect.mapError((cause) => new AuthError({
+            message: `Credentials for '${provider}' do not match the declared schema.`,
+            cause,
+        })));
+        yield* Effect.gen(function* () {
+            const directory = path.dirname(filePath);
+            yield* fs.makeDirectory(directory, { recursive: true });
+            yield* fs.chmod(directory, 0o700);
+            yield* writeFileAtomic(fs, filePath, JSON.stringify(encoded, null, 2), 0o600);
+        }).pipe(Effect.mapError((cause) => new AuthError({
+            message: `Could not write credentials at '${filePath}'.`,
+            cause,
+        })));
+    });
+    const remove_ = (profile, provider) => validateCredentialPath(profile, provider).pipe(Effect.flatMap((filePath) => fs.remove(filePath).pipe(Effect.catchReason("PlatformError", "NotFound", () => Effect.void), Effect.mapError((cause) => new AuthError({
+        message: `Could not delete credentials at '${filePath}'.`,
+        cause,
+    })))));
+    const deleteProfile = (profile) => Effect.gen(function* () {
+        yield* validateProfileName(profile).pipe(Effect.mapError((cause) => new AuthError({ message: cause.message, cause })));
+        yield* fs
+            .remove(profileCredentialsDirPath(profile), { recursive: true })
+            .pipe(Effect.catchReason("PlatformError", "NotFound", () => Effect.void), Effect.mapError((cause) => new AuthError({
+            message: `Could not delete credentials for profile '${profile}'.`,
+            cause,
+        })));
+    });
     return {
         read,
         write,
@@ -41,6 +70,16 @@ export const CredentialsStoreLive = Layer.effect(CredentialsStore, Effect.gen(fu
         deleteProfile,
     };
 }));
+const CREDENTIAL_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const validateCredentialPath = (profile, provider) => Effect.gen(function* () {
+    yield* validateProfileName(profile).pipe(Effect.mapError((cause) => new AuthError({ message: cause.message, cause })));
+    if (!CREDENTIAL_KEY_PATTERN.test(provider)) {
+        return yield* new AuthError({
+            message: `Invalid credential key '${provider}'.`,
+        });
+    }
+    return credentialsFilePath(profile, provider);
+});
 export function displayRedacted(r, visibleChars = 4) {
     const raw = Redacted.value(r);
     if (raw.length <= visibleChars)

package/lib/Auth/Credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"Credentials.js","sourceRoot":"","sources":["../../src/Auth/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,IAAI,MAAM,OAAO,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,OAAe,EAAE,EAAE,CAC3D,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;AAEzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,EAAE,CACvE,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;AAyBpE,MAAM,OAAO,gBAAiB,SAAQ,OAAO,CAAC,OAAO,EAGlD,CAAC,2BAA2B,CAAC;CAAG;AAEnC,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,CAC9C,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAExC,MAAM,IAAI,GAAG,CACX,OAAe,EACf,QAAgB,EACc,EAAE,CAChC,EAAE,CAAC,cAAc,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAC5D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAA+B,CAAC,CAAC,EACnE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClB,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAA0B,CAAC;QAC1D,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAA0B,CAAC;QACpC,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEJ,MAAM,KAAK,GAAG,CACZ,OAAe,EACf,QAAgB,EAChB,WAAc,EACsB,EAAE;QACtC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxD,OAAO,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACvE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;YAClB,OAAO,EAAE,CAAC,eAAe,CACvB,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CACrC,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAuB,EAAE,CACzE,EAAE;SACC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;SAC9C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3C,MAAM,aAAa,GAAG,CAAC,OAAe,EAAuB,EAAE,CAC7D,EAAE;SACC,MAAM,CAAC,yBAAyB,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SAC/D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3C,OAAO;QACL,IAAI;QACJ,KAAK;QACL,MAAM,EAAE,OAAO;QACf,aAAa;KACoB,CAAC;AACtC,CAAC,CAAC,CACH,CAAC;AAEF,MAAM,UAAU,eAAe,CAC7B,CAA4B,EAC5B,YAAY,GAAG,CAAC;IAEhB,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,GAAG,CAAC,MAAM,IAAI,YAAY;QAAE,OAAO,MAAM,CAAC;IAC9C,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"Credentials.js","sourceRoot":"","sources":["../../src/Auth/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,IAAI,MAAM,OAAO,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,EAAE,CACvE,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;AAmCpE,MAAM,OAAO,gBAAiB,SAAQ,OAAO,CAAC,OAAO,EAGlD,CAAC,2BAA2B,CAAC;CAAG;AAEnC,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,CAC9C,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAExC,MAAM,IAAI,GAAG,CACX,OAAe,EACf,QAAgB,EAChB,MAA0B,EAC1B,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,IAAI,CAClD,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE,CACnD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,EACD,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,SAAS,CAAC;YACZ,OAAO,EAAE,kCAAkC,QAAQ,IAAI;YACvD,KAAK;SACN,CAAC,CACL,CACF,CAAC;QACF,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAC5C,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CACtC,CAAC,IAAI,CAAC,CAAC,IAAI,CACV,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,SAAS,CAAC;YACZ,OAAO,EAAE,0BAA0B,QAAQ,yBAAyB;YACpE,KAAK;SACN,CAAC,CACL,CACF,CAAC;QACF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,kBAAkB,CACvC,kCAAkC,OAAO,kBAAkB,QAAQ,EAAE,CACtE,CAAC;QACF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CACzD,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,SAAS,CAAC;YACZ,OAAO,EACL,0BAA0B,QAAQ,qCAAqC;gBACvE,SAAS,OAAO,qBAAqB;YACvC,KAAK;SACN,CAAC,CACL,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM,KAAK,GAAG,CACZ,OAAe,EACf,QAAgB,EAChB,MAA0B,EAC1B,WAAc,EACd,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAClE,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,SAAS,CAAC;YACZ,OAAO,EAAE,oBAAoB,QAAQ,qCAAqC;YAC1E,KAAK;SACN,CAAC,CACL,CACF,CAAC;QACF,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACzB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACzC,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAClC,KAAK,CAAC,CAAC,eAAe,CACpB,EAAE,EACF,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAChC,KAAK,CACN,CAAC;QACJ,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,SAAS,CAAC;YACZ,OAAO,EAAE,mCAAmC,QAAQ,IAAI;YACxD,KAAK;SACN,CAAC,CACL,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,GAAG,CACd,OAAe,EACf,QAAgB,EACgB,EAAE,CAClC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtB,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAClE,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,SAAS,CAAC;QACZ,OAAO,EAAE,oCAAoC,QAAQ,IAAI;QACzD,KAAK;KACN,CAAC,CACL,CACF,CACF,CACF,CAAC;IAEJ,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,KAAK,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,IAAI,CACtC,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAC5D,CACF,CAAC;QACF,KAAK,CAAC,CAAC,EAAE;aACN,MAAM,CAAC,yBAAyB,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;aAC/D,IAAI,CACH,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAClE,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,SAAS,CAAC;YACZ,OAAO,EAAE,6CAA6C,OAAO,IAAI;YACjE,KAAK;SACN,CAAC,CACL,CACF,CAAC;IACN,CAAC,CAAC,CAAC;IAEL,OAAO;QACL,IAAI;QACJ,KAAK;QACL,MAAM,EAAE,OAAO;QACf,aAAa;KACoB,CAAC;AACtC,CAAC,CAAC,CACH,CAAC;AAEF,MAAM,sBAAsB,GAAG,oCAAoC,CAAC;AAEpE,MAAM,sBAAsB,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,EAAE,CACnE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,IAAI,CACtC,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAC5D,CACF,CAAC;IACF,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;YAC1B,OAAO,EAAE,2BAA2B,QAAQ,IAAI;SACjD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEL,MAAM,UAAU,eAAe,CAC7B,CAA4B,EAC5B,YAAY,GAAG,CAAC;IAEhB,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,GAAG,CAAC,MAAM,IAAI,YAAY;QAAE,OAAO,MAAM,CAAC;IAC9C,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC;AAC7C,CAAC"}

package/lib/Auth/CredentialsCache.d.ts

@@ -0,0 +1,15 @@
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+/**
+ * Refresh expiring credentials this long before they actually expire so that
+ * in-flight requests never race the expiry deadline.
+ */
+export declare const CREDENTIAL_REFRESH_WINDOW: Duration.Duration;
+/** Compute how long credentials may remain cached. */
+export declare const credentialTimeToLive: (expiresAt: number | undefined, resolvedAt: number) => Duration.Duration;
+/**
+ * Build a single-entry Effect cache whose TTL is derived from each resolved
+ * credential's expiry. Concurrent cache misses share one resolution.
+ */
+export declare const cacheUntilExpiry: <A, E>(resolve: Effect.Effect<A, E>, expiresAt: (credentials: A) => number | undefined) => Effect.Effect<Effect.Effect<A, E, never>, never, never>;
+//# sourceMappingURL=CredentialsCache.d.ts.map

package/lib/Auth/CredentialsCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialsCache.d.ts","sourceRoot":"","sources":["../../src/Auth/CredentialsCache.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC;;;GAGG;AACH,eAAO,MAAM,yBAAyB,mBAAsB,CAAC;AAE7D,sDAAsD;AACtD,eAAO,MAAM,oBAAoB,cACpB,MAAM,GAAG,SAAS,cACjB,MAAM,KACjB,QAAQ,CAAC,QAQX,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,EAAE,CAAC,WAC1B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,aACjB,CAAC,WAAW,EAAE,CAAC,KAAK,MAAM,GAAG,SAAS,4DAwB/C,CAAC"}

package/lib/Auth/CredentialsCache.js

@@ -0,0 +1,34 @@
+import * as Cache from "effect/Cache";
+import * as Clock from "effect/Clock";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+/**
+ * Refresh expiring credentials this long before they actually expire so that
+ * in-flight requests never race the expiry deadline.
+ */
+export const CREDENTIAL_REFRESH_WINDOW = Duration.minutes(5);
+/** Compute how long credentials may remain cached. */
+export const credentialTimeToLive = (expiresAt, resolvedAt) => {
+    if (expiresAt === undefined)
+        return Duration.infinity;
+    return Duration.millis(Math.max(0, expiresAt - resolvedAt - Duration.toMillis(CREDENTIAL_REFRESH_WINDOW)));
+};
+/**
+ * Build a single-entry Effect cache whose TTL is derived from each resolved
+ * credential's expiry. Concurrent cache misses share one resolution.
+ */
+export const cacheUntilExpiry = (resolve, expiresAt) => Effect.gen(function* () {
+    const cache = yield* Cache.makeWith((_) => Effect.gen(function* () {
+        const resolvedAt = yield* Clock.currentTimeMillis;
+        const credentials = yield* resolve;
+        return { credentials, resolvedAt };
+    }), {
+        capacity: 1,
+        timeToLive: (exit) => Exit.isSuccess(exit)
+            ? credentialTimeToLive(expiresAt(exit.value.credentials), exit.value.resolvedAt)
+            : Duration.zero,
+    });
+    return Cache.get(cache, undefined).pipe(Effect.map(({ credentials }) => credentials));
+});
+//# sourceMappingURL=CredentialsCache.js.map

package/lib/Auth/CredentialsCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialsCache.js","sourceRoot":"","sources":["../../src/Auth/CredentialsCache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAE7D,sDAAsD;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,SAA6B,EAC7B,UAAkB,EACC,EAAE;IACrB,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC;IACtD,OAAO,QAAQ,CAAC,MAAM,CACpB,IAAI,CAAC,GAAG,CACN,CAAC,EACD,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CACtE,CACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,OAA4B,EAC5B,SAAiD,EACjD,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CACjC,CAAC,CAAO,EAAE,EAAE,CACV,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAClD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;QACnC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IACrC,CAAC,CAAC,EACJ;QACE,QAAQ,EAAE,CAAC;QACX,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CACnB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAClB,CAAC,CAAC,oBAAoB,CAClB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EACjC,IAAI,CAAC,KAAK,CAAC,UAAU,CACtB;YACH,CAAC,CAAC,QAAQ,CAAC,IAAI;KACpB,CACF,CAAC;IACF,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,CACrC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,CAC7C,CAAC;AACJ,CAAC,CAAC,CAAC"}