alchemy 2.0.0-beta.76 → 2.0.0-beta.77

package/lib/Auth/Resolve.d.ts

@@ -0,0 +1,42 @@
+import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { AuthError } from "./AuthProvider.ts";
+import { ProfileError, ProfileStore } from "./Profile.ts";
+/**
+ * Resolve the selected Alchemy profile after the command's dotenv provider is
+ * known. An omitted explicit override remains absent so it does not shadow
+ * `ALCHEMY_PROFILE` from `.env` / `--env-file`.
+ */
+export declare const resolveProfileSelection: (envFile: Option.Option<string>, override: string | undefined) => Effect.Effect<{
+    name: string;
+    source: "command-line" | "configuration" | "default";
+}, import("effect/PlatformError").PlatformError | ProfileError, import("effect/FileSystem").FileSystem | ProfileStore>;
+export declare const resolveProfileName: (envFile: Option.Option<string>, override: string | undefined) => Effect.Effect<string, import("effect/PlatformError").PlatformError | ProfileError, import("effect/FileSystem").FileSystem | ProfileStore>;
+/**
+ * The shared preamble of every per-cloud `fromAuthProvider` /
+ * `fromEnvironment` layer. Precedence: environment credentials (process
+ * environment plus `.env` / `--env-file`) whenever the provider's declared
+ * contract is fully present — CI or not, selected profile or not — then, in
+ * CI, the provider's environment resolution alone (profiles do not exist
+ * there), otherwise the selected profile.
+ */
+export declare const resolveProviderConfig: <C extends {
+    method: string;
+} = any, Credentials = any>(providerName: string) => Effect.Effect<{
+    auth: import("./AuthProvider.ts").AuthProvider<C, Credentials>;
+    profileName: undefined;
+    config: undefined;
+    resolve: Effect.Effect<Credentials, AuthError, never>;
+    source: "environment";
+} | {
+    auth: import("./AuthProvider.ts").AuthProvider<C, Credentials>;
+    profileName: string;
+    config: C;
+    resolve: Effect.Effect<Credentials, AuthError | import("./AuthProvider.ts").NeedsReauth, never>;
+    source: "profile";
+}, AuthError | Config.ConfigError | import("./Profile.ts").MissingProviderConfig | import("effect/PlatformError").PlatformError | ProfileError, import("./AuthProvider.ts").AuthProviders | ProfileStore>;
+/** Let an explicit profile override configured selection without disturbing other keys. */
+export declare const withProfileOverride: (base: ConfigProvider.ConfigProvider, profile: string | undefined) => ConfigProvider.ConfigProvider;
+//# sourceMappingURL=Resolve.d.ts.map

package/lib/Auth/Resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Resolve.d.ts","sourceRoot":"","sources":["../../src/Auth/Resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,cAAc,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,SAAS,EAGV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,YAAY,EACZ,YAAY,EAEb,MAAM,cAAc,CAAC;AAGtB;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;sHAiBlC,CAAC;AAEH,eAAO,MAAM,kBAAkB,6MAK7B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,GAChC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,GAAG,EAClC,WAAW,GAAG,GAAG,gBAEH,MAAM;;;;;YAeJ,aAAa;;;;;;YAwCjB,SAAS;yMAEnB,CAAC;AAEL,2FAA2F;AAC3F,eAAO,MAAM,mBAAmB,SACxB,cAAc,CAAC,cAAc,WAC1B,MAAM,GAAG,SAAS,KAC1B,cAAc,CAAC,cAWjB,CAAC"}

package/lib/Auth/Resolve.js

@@ -0,0 +1,90 @@
+import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { AuthError, getAuthProvider, presentEnvironment, } from "./AuthProvider.js";
+import { ALCHEMY_PROFILE, DEFAULT_PROFILE_NAME, ProfileError, ProfileStore, SuppressMissingProviderConfig, } from "./Profile.js";
+import { loadConfigProvider } from "../Util/ConfigProvider.js";
+/**
+ * Resolve the selected Alchemy profile after the command's dotenv provider is
+ * known. An omitted explicit override remains absent so it does not shadow
+ * `ALCHEMY_PROFILE` from `.env` / `--env-file`.
+ */
+export const resolveProfileSelection = Effect.fn(function* (envFile, override) {
+    const base = yield* loadConfigProvider(envFile);
+    const profiles = yield* ProfileStore;
+    const selected = yield* profiles.current.pipe(Effect.provideService(ConfigProvider.ConfigProvider, withProfileOverride(base, override)));
+    return {
+        ...selected,
+        source: override === undefined ? selected.source : "command-line",
+    };
+});
+export const resolveProfileName = Effect.fn(function* (envFile, override) {
+    return (yield* resolveProfileSelection(envFile, override)).name;
+});
+/**
+ * The shared preamble of every per-cloud `fromAuthProvider` /
+ * `fromEnvironment` layer. Precedence: environment credentials (process
+ * environment plus `.env` / `--env-file`) whenever the provider's declared
+ * contract is fully present — CI or not, selected profile or not — then, in
+ * CI, the provider's environment resolution alone (profiles do not exist
+ * there), otherwise the selected profile.
+ */
+export const resolveProviderConfig = (providerName) => Effect.gen(function* () {
+    const auth = yield* getAuthProvider(providerName);
+    if (auth.readEnvironment !== undefined) {
+        const used = yield* presentEnvironment(auth.environment);
+        if (used !== undefined) {
+            if (!(yield* SuppressMissingProviderConfig)) {
+                yield* auth.logEnvironmentCredentials(used);
+            }
+            return {
+                auth,
+                profileName: undefined,
+                config: undefined,
+                resolve: auth.readEnvironment,
+                source: "environment",
+            };
+        }
+    }
+    const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+    if (ci) {
+        if (auth.readEnvironment === undefined) {
+            return yield* Effect.fail(new AuthError({
+                message: `Auth provider '${providerName}' does not support environment credentials in CI.`,
+            }));
+        }
+        return {
+            auth,
+            profileName: undefined,
+            config: undefined,
+            resolve: auth.readEnvironment,
+            source: "environment",
+        };
+    }
+    const profile = yield* ProfileStore;
+    const selection = yield* profile.current;
+    const profileName = selection.name;
+    const config = yield* profile.loadProviderConfig(auth, profileName);
+    return {
+        auth,
+        profileName,
+        config,
+        resolve: auth.read(profileName, config, (updated) => profile.setProviderConfig(profileName, providerName, updated).pipe(Effect.mapError((cause) => new AuthError({
+            message: `${providerName}: could not persist refreshed credentials for profile '${profileName}'.`,
+            cause,
+        })))),
+        source: "profile",
+    };
+});
+/** Let an explicit profile override configured selection without disturbing other keys. */
+export const withProfileOverride = (base, profile) => {
+    if (profile === undefined)
+        return base;
+    const overrides = { ALCHEMY_PROFILE: profile };
+    const overrideProvider = ConfigProvider.make((path) => Effect.succeed(path.length === 1 && typeof path[0] === "string" && path[0] in overrides
+        ? ConfigProvider.makeValue(overrides[path[0]])
+        : undefined));
+    return ConfigProvider.orElse(base)(overrideProvider);
+};
+//# sourceMappingURL=Resolve.js.map

package/lib/Auth/Resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Resolve.js","sourceRoot":"","sources":["../../src/Auth/Resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,cAAc,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,SAAS,EACT,eAAe,EACf,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACxD,OAA8B,EAC9B,QAA4B;IAE5B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAC3C,MAAM,CAAC,cAAc,CACnB,cAAc,CAAC,cAAc,EAC7B,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CACpC,CACF,CAAC;IACF,OAAO;QACL,GAAG,QAAQ;QACX,MAAM,EACJ,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,cAAwB;KACvE,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACnD,OAA8B,EAC9B,QAA4B;IAE5B,OAAO,CAAC,KAAK,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAInC,YAAoB,EACpB,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAAiB,YAAY,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,6BAA6B,CAAC,EAAE,CAAC;gBAC5C,KAAK,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO;gBACL,IAAI;gBACJ,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,IAAI,CAAC,eAAe;gBAC7B,MAAM,EAAE,aAAsB;aAC/B,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,IAAI,EAAE,EAAE,CAAC;QACP,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CAAC;gBACZ,OAAO,EAAE,kBAAkB,YAAY,mDAAmD;aAC3F,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI;YACJ,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,IAAI,CAAC,eAAe;YAC7B,MAAM,EAAE,aAAsB;SAC/B,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;IACpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACzC,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpE,OAAO;QACL,IAAI;QACJ,WAAW;QACX,MAAM;QACN,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAClD,OAAO,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAChE,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,SAAS,CAAC;YACZ,OAAO,EAAE,GAAG,YAAY,0DAA0D,WAAW,IAAI;YACjG,KAAK;SACN,CAAC,CACL,CACF,CACF;QACD,MAAM,EAAE,SAAkB;KAC3B,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,2FAA2F;AAC3F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,IAAmC,EACnC,OAA2B,EACI,EAAE;IACjC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,SAAS,GAA2B,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACvE,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACpD,MAAM,CAAC,OAAO,CACZ,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS;QACtE,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC;QAC/C,CAAC,CAAC,SAAS,CACd,CACF,CAAC;IACF,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAC;AACvD,CAAC,CAAC"}

package/lib/Auth/StoredAuthProvider.d.ts

@@ -0,0 +1,84 @@
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+import * as Interaction from "../Interaction.ts";
+import { AuthError, type ConfigureField, type EnvironmentVariable } from "./AuthProvider.ts";
+/**
+ * Collected field values: one string per non-omitted field, keyed by
+ * {@link ConfigureField.name}.
+ */
+export type StoredValue = string | Redacted.Redacted<string>;
+export type StoredValues = Record<string, StoredValue | undefined>;
+/** Reveal a collected value only at a validation or I/O boundary. */
+export declare const storedValueText: (value: StoredValue | undefined) => string | undefined;
+/** Preserve or introduce redaction for a collected secret. */
+export declare const storedSecret: (value: StoredValue | undefined) => Redacted.Redacted<string> | undefined;
+/**
+ * Everything needed to generate a complete single-method ("stored")
+ * {@link AuthProviderImpl} for a provider whose credential is a token (or a
+ * small set of fields) the user pastes once: prompts, flag-driven
+ * configuration, schema-validated inline values, login/logout, and
+ * structured details.
+ *
+ * Providers with several auth methods (browser OAuth, SSO) don't fit this
+ * factory — they hand-roll the impl and may still reuse
+ * {@link collectFieldValues} for their token-shaped method.
+ */
+export interface StoredAuthProviderConfig<Resolved> {
+    /** Registry name, e.g. `"Neon"`. */
+    readonly provider: string;
+    /** The fields collected interactively or via `--set`. */
+    readonly fields: ReadonlyArray<ConfigureField>;
+    /**
+     * Derive additional stored values after input collection — e.g. resolve
+     * an account id with an API call using the entered token. Runs for both
+     * the interactive and flag-driven paths, before persistence.
+     */
+    readonly complete?: (values: StoredValues) => Effect.Effect<StoredValues, AuthError>;
+    /**
+     * Map validated stored values to the in-memory resolved credentials.
+     * `source` distinguishes profile-stored values from CI env resolution.
+     */
+    readonly toResolved: (values: StoredValues, source: "stored") => Resolved;
+    /** CI resolution from env vars; requires {@link environment}. */
+    readonly readEnvironment?: Effect.Effect<Resolved, AuthError>;
+    readonly environment?: ReadonlyArray<EnvironmentVariable>;
+}
+/** Inline-values type for factory-made static-token providers. */
+export type StoredAuthConfig = {
+    readonly method: "stored";
+    readonly [key: string]: StoredValue | undefined;
+};
+/**
+ * Validate flag-provided values against the field specs: unknown keys,
+ * missing required fields, and per-field validators all fail with an
+ * actionable {@link AuthError}.
+ */
+export declare const validateFieldValues: (provider: string, fields: ReadonlyArray<ConfigureField>, values: Record<string, string>) => Effect.Effect<StoredValues, AuthError>;
+/**
+ * Prompt for each field in order (secret fields masked, optional fields
+ * skippable with an empty answer). Shared by the factory's interactive
+ * `configure` and by hand-rolled multi-method providers that want the same
+ * behavior for their token method.
+ */
+export declare const collectFieldValues: (fields: ReadonlyArray<ConfigureField>) => Effect.Effect<StoredValues, AuthError, Interaction.Interaction>;
+/**
+ * Build a registration Layer (plus the derived inline-values schema)
+ * for a single-method stored-credential provider.
+ *
+ * ```ts
+ * export const { layer: NeonAuth, storedSchema: NeonStoredCredentials } =
+ *   makeStoredAuthProvider({
+ *     provider: "Neon",
+ *     fields: [{ name: "apiKey", label: "Neon API Key", secret: true }],
+ *     toResolved: (values, source) => ({ ... }),
+ *     readEnvironment: ...,
+ *     environment: [...],
+ *   });
+ * ```
+ */
+export declare const makeStoredAuthProvider: <Resolved>(config: StoredAuthProviderConfig<Resolved>) => {
+    layer: import("effect/Layer").Layer<never, never, import("./AuthProvider.ts").AuthProviders | import("effect/FileSystem").FileSystem | import("effect/Path").Path>;
+    storedSchema: Schema.Codec<StoredValues, StoredValues, never, never>;
+};
+//# sourceMappingURL=StoredAuthProvider.d.ts.map

package/lib/Auth/StoredAuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StoredAuthProvider.d.ts","sourceRoot":"","sources":["../../src/Auth/StoredAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,SAAS,EAET,KAAK,cAAc,EAEnB,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAC;AAI3B;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7D,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC,CAAC;AAEnE,qEAAqE;AACrE,eAAO,MAAM,eAAe,UAAW,WAAW,GAAG,SAAS,uBAKjD,CAAC;AAEd,8DAA8D;AAC9D,eAAO,MAAM,YAAY,UAAW,WAAW,GAAG,SAAS,0CAK/B,CAAC;AAE7B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,wBAAwB,CAAC,QAAQ;IAChD,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAClB,MAAM,EAAE,YAAY,KACjB,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;IAC1E,iEAAiE;IACjE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9D,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;CAC3D;AAED,kEAAkE;AAClE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;CACjD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,aACpB,MAAM,UACR,aAAa,CAAC,cAAc,CAAC,UAC7B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAoCpC,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WACrB,aAAa,CAAC,cAAc,CAAC,KACpC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,WAAW,CAAC,WAAW,CAkC7D,CAAC;AAEL;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAAI,QAAQ,UACrC,wBAAwB,CAAC,QAAQ,CAAC;;;CA0G3C,CAAC"}

package/lib/Auth/StoredAuthProvider.js

@@ -0,0 +1,179 @@
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+import * as Interaction from "../Interaction.js";
+import { AuthError, AuthProviderLayer, } from "./AuthProvider.js";
+import { displayRedacted } from "./Credentials.js";
+import { mapPromptCancellation } from "./Env.js";
+/** Reveal a collected value only at a validation or I/O boundary. */
+export const storedValueText = (value) => value === undefined
+    ? undefined
+    : Redacted.isRedacted(value)
+        ? Redacted.value(value)
+        : value;
+/** Preserve or introduce redaction for a collected secret. */
+export const storedSecret = (value) => value === undefined
+    ? undefined
+    : Redacted.isRedacted(value)
+        ? value
+        : Redacted.make(value);
+/**
+ * Validate flag-provided values against the field specs: unknown keys,
+ * missing required fields, and per-field validators all fail with an
+ * actionable {@link AuthError}.
+ */
+export const validateFieldValues = (provider, fields, values) => Effect.gen(function* () {
+    const known = new Set(fields.map((field) => field.name));
+    for (const key of Object.keys(values)) {
+        if (!known.has(key)) {
+            return yield* Effect.fail(new AuthError({
+                message: `${provider}: unknown field '${key}'. ` +
+                    `Valid fields: ${[...known].join(", ")}.`,
+            }));
+        }
+    }
+    const collected = {};
+    for (const field of fields) {
+        const raw = values[field.name] ?? field.defaultValue;
+        if (raw === undefined || raw.length === 0) {
+            if (field.optional)
+                continue;
+            return yield* Effect.fail(new AuthError({
+                message: `${provider}: missing required field '${field.name}' (${field.label}). Pass it with --set ${field.name}=<value>.`,
+            }));
+        }
+        const invalid = field.validate?.(raw);
+        if (invalid !== undefined) {
+            return yield* Effect.fail(new AuthError({
+                message: `${provider}: invalid '${field.name}': ${invalid}`,
+            }));
+        }
+        collected[field.name] = field.secret ? Redacted.make(raw) : raw;
+    }
+    return collected;
+});
+/**
+ * Prompt for each field in order (secret fields masked, optional fields
+ * skippable with an empty answer). Shared by the factory's interactive
+ * `configure` and by hand-rolled multi-method providers that want the same
+ * behavior for their token method.
+ */
+export const collectFieldValues = (fields) => Effect.gen(function* () {
+    const interaction = yield* Interaction.Interaction;
+    const values = {};
+    for (const field of fields) {
+        const description = [
+            field.description,
+            field.optional ? "Optional — press Enter to skip." : undefined,
+        ]
+            .filter((part) => part !== undefined)
+            .join(" ");
+        const validate = (value) => {
+            if (value.length === 0)
+                return field.optional ? undefined : "Required";
+            return field.validate?.(value);
+        };
+        const request = field.secret
+            ? interaction.prompt.password({
+                message: field.label,
+                description: description || undefined,
+                placeholder: field.placeholder,
+                validate,
+            })
+            : interaction.prompt.text({
+                message: field.label,
+                description: description || undefined,
+                placeholder: field.placeholder,
+                defaultValue: field.defaultValue,
+                validate,
+            });
+        const answer = yield* request.pipe(mapPromptCancellation);
+        if (answer.length === 0 && field.optional)
+            continue;
+        values[field.name] = field.secret ? Redacted.make(answer) : answer;
+    }
+    return values;
+});
+/**
+ * Build a registration Layer (plus the derived inline-values schema)
+ * for a single-method stored-credential provider.
+ *
+ * ```ts
+ * export const { layer: NeonAuth, storedSchema: NeonStoredCredentials } =
+ *   makeStoredAuthProvider({
+ *     provider: "Neon",
+ *     fields: [{ name: "apiKey", label: "Neon API Key", secret: true }],
+ *     toResolved: (values, source) => ({ ... }),
+ *     readEnvironment: ...,
+ *     environment: [...],
+ *   });
+ * ```
+ */
+export const makeStoredAuthProvider = (config) => {
+    const { provider, fields } = config;
+    const fieldSchemas = Object.fromEntries(fields.map((field) => [
+        field.name,
+        field.optional ? Schema.optional(Schema.String) : Schema.String,
+    ]));
+    const storedSchema = Schema.Struct(fieldSchemas);
+    const configSchema = Schema.Struct({
+        method: Schema.Literal("stored"),
+        ...fieldSchemas,
+    });
+    const layer = AuthProviderLayer()(provider, Effect.gen(function* () {
+        const interaction = Interaction.accessors;
+        const persist = (_profileName, values) => Effect.gen(function* () {
+            const complete = config.complete?.(values) ?? Effect.succeed(values);
+            const completed = yield* complete;
+            yield* interaction.output.success(`${provider}: credentials saved.`);
+            return {
+                method: "stored",
+                ...Object.fromEntries(Object.entries(completed).map(([key, value]) => [
+                    key,
+                    storedValueText(value),
+                ])),
+            };
+        });
+        const configure = (profileName) => collectFieldValues(fields).pipe(Effect.flatMap((values) => persist(profileName, values)));
+        const configureWith = (profileName, input) => input.method === "stored"
+            ? validateFieldValues(provider, fields, input.values).pipe(Effect.flatMap((values) => persist(profileName, values)))
+            : Effect.fail(new AuthError({
+                message: `${provider}: unknown method '${input.method}'. Valid methods: stored.`,
+            }));
+        const read = (_profileName, values) => Effect.succeed(config.toResolved(values, "stored"));
+        const login = (_profileName, values) => Effect.succeed(values);
+        const logout = (_profileName, _config) => Effect.void;
+        const details = (_profileName, values) => Effect.succeed({
+            lines: fields.flatMap((field) => {
+                const value = values[field.name];
+                if (value === undefined)
+                    return [];
+                return [
+                    {
+                        key: field.name,
+                        value: field.secret
+                            ? displayRedacted(storedSecret(value) ?? Redacted.make(""))
+                            : (storedValueText(value) ?? ""),
+                    },
+                ];
+            }),
+        });
+        const configureMethods = [
+            { method: "stored", fields },
+        ];
+        return {
+            configSchema,
+            configure,
+            configureWith,
+            configureMethods,
+            login,
+            logout,
+            details,
+            read,
+            readEnvironment: config.readEnvironment,
+            environment: config.environment,
+        };
+    }));
+    return { layer, storedSchema };
+};
+//# sourceMappingURL=StoredAuthProvider.js.map

package/lib/Auth/StoredAuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StoredAuthProvider.js","sourceRoot":"","sources":["../../src/Auth/StoredAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,SAAS,EACT,iBAAiB,GAIlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AASjD,qEAAqE;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAA8B,EAAE,EAAE,CAChE,KAAK,KAAK,SAAS;IACjB,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;QACvB,CAAC,CAAC,KAAK,CAAC;AAEd,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAA8B,EAAE,EAAE,CAC7D,KAAK,KAAK,SAAS;IACjB,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AA0C7B;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,QAAgB,EAChB,MAAqC,EACrC,MAA8B,EACU,EAAE,CAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CAAC;gBACZ,OAAO,EACL,GAAG,QAAQ,oBAAoB,GAAG,KAAK;oBACvC,iBAAiB,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC5C,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC;QACrD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,QAAQ;gBAAE,SAAS;YAC7B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CAAC;gBACZ,OAAO,EAAE,GAAG,QAAQ,6BAA6B,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,KAAK,yBAAyB,KAAK,CAAC,IAAI,WAAW;aAC3H,CAAC,CACH,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CAAC;gBACZ,OAAO,EAAE,GAAG,QAAQ,cAAc,KAAK,CAAC,IAAI,MAAM,OAAO,EAAE;aAC5D,CAAC,CACH,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAClE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,MAAqC,EAC4B,EAAE,CACnE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC;IACnD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG;YAClB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,SAAS;SAC/D;aACE,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;aACpD,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;YACvE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM;YAC1B,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC1B,OAAO,EAAE,KAAK,CAAC,KAAK;gBACpB,WAAW,EAAE,WAAW,IAAI,SAAS;gBACrC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ;aACT,CAAC;YACJ,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;gBACtB,OAAO,EAAE,KAAK,CAAC,KAAK;gBACpB,WAAW,EAAE,WAAW,IAAI,SAAS;gBACrC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,QAAQ;aACT,CAAC,CAAC;QACP,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ;YAAE,SAAS;QACpD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,MAA0C,EAC1C,EAAE;IACF,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAEpC,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CACrC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;KAChE,CAAC,CACH,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAChC,YAAY,CAGiB,CAAC;IAEhC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChC,GAAG,YAAY;KAChB,CAAmC,CAAC;IAErC,MAAM,KAAK,GAAG,iBAAiB,EAA8B,CAC3D,QAAQ,EACR,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC;QAC1C,MAAM,OAAO,GAAG,CAAC,YAAoB,EAAE,MAAoB,EAAE,EAAE,CAC7D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;YAClC,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,QAAQ,sBAAsB,CAAC,CAAC;YACrE,OAAO;gBACL,MAAM,EAAE,QAAiB;gBACzB,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;oBAC9C,GAAG;oBACH,eAAe,CAAC,KAAK,CAAC;iBACvB,CAAC,CACH;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,MAAM,SAAS,GAAG,CAAC,WAAmB,EAAE,EAAE,CACxC,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,CAC7B,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CACzD,CAAC;QAEJ,MAAM,aAAa,GAAG,CACpB,WAAmB,EACnB,KAAyD,EACzD,EAAE,CACF,KAAK,CAAC,MAAM,KAAK,QAAQ;YACvB,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CACtD,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CACzD;YACH,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,SAAS,CAAC;gBACZ,OAAO,EAAE,GAAG,QAAQ,qBAAqB,KAAK,CAAC,MAAM,2BAA2B;aACjF,CAAC,CACH,CAAC;QAER,MAAM,IAAI,GAAG,CAAC,YAAoB,EAAE,MAAwB,EAAE,EAAE,CAC9D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEtD,MAAM,KAAK,GAAG,CAAC,YAAoB,EAAE,MAAwB,EAAE,EAAE,CAC/D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEzB,MAAM,MAAM,GAAG,CAAC,YAAoB,EAAE,OAAyB,EAAE,EAAE,CACjE,MAAM,CAAC,IAAI,CAAC;QAEd,MAAM,OAAO,GAAG,CAAC,YAAoB,EAAE,MAAwB,EAAE,EAAE,CACjE,MAAM,CAAC,OAAO,CAAC;YACb,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjC,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,EAAE,CAAC;gBACnC,OAAO;oBACL;wBACE,GAAG,EAAE,KAAK,CAAC,IAAI;wBACf,KAAK,EAAE,KAAK,CAAC,MAAM;4BACjB,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;4BAC3D,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;qBACnC;iBACF,CAAC;YACJ,CAAC,CAAC;SACH,CAAC,CAAC;QAEL,MAAM,gBAAgB,GAAmC;YACvD,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;SAC7B,CAAC;QAEF,OAAO;YACL,YAAY;YACZ,SAAS;YACT,aAAa;YACb,gBAAgB;YAChB,KAAK;YACL,MAAM;YACN,OAAO;YACP,IAAI;YACJ,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AACjC,CAAC,CAAC"}

package/lib/Auth/index.d.ts

@@ -3,4 +3,5 @@ export * from "./Credentials.ts";
 export * from "./Demand.ts";
 export * from "./Env.ts";
 export * from "./Profile.ts";
+export * from "./Resolve.ts";
 //# sourceMappingURL=index.d.ts.map

package/lib/Auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC"}

package/lib/Auth/index.js

@@ -3,4 +3,5 @@ export * from "./Credentials.js";
 export * from "./Demand.js";
 export * from "./Env.js";
 export * from "./Profile.js";
+export * from "./Resolve.js";
 //# sourceMappingURL=index.js.map

package/lib/Auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC"}

package/lib/Axiom/AuthProvider.d.ts

@@ -1,32 +1,21 @@
 import * as Redacted from "effect/Redacted";
-import { CredentialsStore } from "../Auth/Credentials.ts";
-export type AxiomAuthConfig = {
-    method: "env";
-} | {
-    method: "stored";
-    credentialType: "apiToken";
-} | {
-    method: "stored";
-    credentialType: "pat";
-};
-export type AxiomStoredCredentials = {
-    type: "apiToken";
-    apiToken: string;
-    apiBaseUrl?: string;
-    orgId?: string;
-} | {
-    type: "pat";
-    apiToken: string;
-    apiBaseUrl?: string;
-    orgId: string;
-};
+import { type StoredAuthConfig } from "../Auth/StoredAuthProvider.ts";
+export declare const AXIOM_AUTH_PROVIDER_NAME = "Axiom";
+export type AxiomAuthConfig = StoredAuthConfig;
+/**
+ * Resolved Axiom credentials. The provider values are a flat record
+ * (token + optional orgId/apiBaseUrl); the `apiToken`/`pat` distinction is
+ * derived at resolution time from orgId presence — an org id means the token
+ * is treated as a personal access token, mirroring how the CI environment
+ * resolution has always classified `AXIOM_ORG_ID`.
+ */
 export type AxiomResolvedCredentials = {
     type: "apiToken";
     apiToken: Redacted.Redacted<string>;
     apiBaseUrl: string;
     orgId?: string;
     source: {
-        type: AxiomAuthConfig["method"];
+        type: AxiomAuthConfig["method"] | "env";
         details?: string;
     };
 } | {
@@ -35,15 +24,17 @@ export type AxiomResolvedCredentials = {
     apiBaseUrl: string;
     orgId: string;
     source: {
-        type: AxiomAuthConfig["method"];
+        type: AxiomAuthConfig["method"] | "env";
         details?: string;
     };
 };
-export declare const AXIOM_AUTH_PROVIDER_NAME = "Axiom";
 /**
  * Layer that registers the Axiom {@link AuthProvider} into the
  * {@link AuthProviders} registry when built. Include this in the Axiom
- * `providers()` layer so `alchemy login` can discover it.
+ * `providers()` layer so the alchemy CLI can discover it.
  */
-export declare const AxiomAuth: import("effect/Layer").Layer<never, never, import("../index.ts").AuthProviders | CredentialsStore>;
+export declare const AxiomAuth: import("effect/Layer").Layer<never, never, import("../index.ts").AuthProviders | import("effect/FileSystem").FileSystem | import("effect/Path").Path>;
+/** Schema of Axiom's inline static-token values. */
+export declare const AxiomStoredCredentials: import("effect/Schema").Codec<import("../Auth/StoredAuthProvider.ts").StoredValues, import("../Auth/StoredAuthProvider.ts").StoredValues, never, never>;
+export type AxiomStoredCredentials = typeof AxiomStoredCredentials.Type;
 //# sourceMappingURL=AuthProvider.d.ts.map

package/lib/Axiom/AuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../src/Axiom/AuthProvider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAM5C,OAAO,EAAE,gBAAgB,EAAmB,MAAM,wBAAwB,CAAC;AAuB3E,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,KAAK,CAAA;CAAE,GACjB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,cAAc,EAAE,UAAU,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,cAAc,EAAE,KAAK,CAAA;CAAE,CAAC;AAEhD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E,MAAM,MAAM,wBAAwB,GAChC;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D,GACD;IACE,IAAI,EAAE,KAAK,CAAC;IACZ,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D,CAAC;AAEN,eAAO,MAAM,wBAAwB,UAAU,CAAC;AAkBhD;;;;GAIG;AACH,eAAO,MAAM,SAAS,oGAmQrB,CAAC"}
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../src/Axiom/AuthProvider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,+BAA+B,CAAC;AAEvC,eAAO,MAAM,wBAAwB,UAAU,CAAC;AAEhD,MAAM,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAChC;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE,GACD;IACE,IAAI,EAAE,KAAK,CAAC;IACZ,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE,CAAC;AA4FN;;;;GAIG;AACH,eAAO,MAAM,SAAS,uJAAkB,CAAC;AAEzC,oDAAoD;AACpD,eAAO,MAAM,sBAAsB,yJAAyB,CAAC;AAC7D,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,IAAI,CAAC"}