alchemy 2.0.0-beta.76 → 2.0.0-beta.78

package/src/Local/RpcSpawner.ts

@@ -4,10 +4,14 @@ import * as Config from "effect/Config";
 import * as Console from "effect/Console";
 import * as Context from "effect/Context";
 import * as Deferred from "effect/Deferred";
+import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
 import type { PlatformError } from "effect/PlatformError";
 import * as Queue from "effect/Queue";
+import * as Schedule from "effect/Schedule";
+import * as Schema from "effect/Schema";
 import * as Scope from "effect/Scope";
 import * as Stream from "effect/Stream";
 import * as HttpClient from "effect/unstable/http/HttpClient";
@@ -17,7 +21,8 @@ import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
 import * as ChildProcess from "effect/unstable/process/ChildProcess";
 import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
 import { fileURLToPath } from "node:url";
-import { transformTypesFlags } from "../Util/Node.ts";
+import { pipedColorEnv } from "../Util/Terminal.ts";
+import { nodeLoaderArgs } from "../Util/Node.ts";
 import { httpServer } from "../Util/PlatformServices.ts";
 import { SPAWNER_URL_ENV_KEY } from "./RpcProviderProxy.ts";
 import {
@@ -38,9 +43,8 @@ export class RpcSpawner extends Context.Service<
  * it travels per RPC session (see `SESSION_ENV_PARAM`), so many stacks
  * (e.g. every test file in a run) share a single sidecar process.
  */
-export interface RpcSpawnPayload {
-  serverEntryUrl: string;
-}
+export const RpcSpawnPayload = Schema.Struct({ serverEntryUrl: Schema.String });
+export type RpcSpawnPayload = typeof RpcSpawnPayload.Type;
 
 /**
  * One line of sidecar child output, tagged with the channel it arrived on.
@@ -51,6 +55,16 @@ export interface SidecarLogLine {
   readonly line: string;
 }
 
+export const HeartbeatFrame = Schema.Struct({
+  channel: Schema.Literal("heartbeat"),
+});
+export type HeartbeatFrame = typeof HeartbeatFrame.Type;
+
+const SidecarLogLineSchema = Schema.Struct({
+  channel: Schema.Literals(["stdout", "stderr"]),
+  line: Schema.String,
+});
+
 /**
  * Path on the spawner's HTTP server that streams sidecar output as NDJSON
  * ({@link SidecarLogLine} per line). Consumed by {@link forwardSidecarLogs}
@@ -72,13 +86,13 @@ export const make = Effect.fn(function* ({
 
   // Sidecar output hub. During `alchemy dev` this process (the outer dev
   // command) shares the tty with the exec child, and the exec child owns the
-  // repainting progress renderer (Ink patches its `console`). Printing
-  // sidecar lines RAW from here interleaves with the renderer's repaints and
-  // corrupts the region (stacked/duplicated frames). So: when an exec child
-  // is subscribed via the /logs endpoint, hand lines to it and let it print
-  // through its (patched) console; only print from this process as a
-  // fallback when no subscriber is connected (e.g. during a --watch restart
-  // gap, when no renderer is alive either).
+  // repainting progress renderer. Printing sidecar lines RAW from here
+  // interleaves with the renderer's repaints and corrupts the region
+  // (stacked/duplicated frames). So: when an exec child is subscribed via
+  // the /logs endpoint, hand lines to it and let its logger route them into
+  // the renderer; only log from this process as a fallback when no
+  // subscriber is connected (e.g. during a --watch restart gap, when no
+  // renderer is alive either).
   const subscribers = new Set<(line: SidecarLogLine) => void>();
   const publish = (line: SidecarLogLine): Effect.Effect<void> =>
     Effect.suspend(() => {
@@ -86,8 +100,9 @@ export const make = Effect.fn(function* ({
         for (const notify of subscribers) notify(line);
         return Effect.void;
       }
-      // Through the Console SERVICE so runners that override it (e.g.
-      // alchemy-test's per-test buffer) capture the sidecar's output.
+      // Fallback path (no exec child subscribed): sidecar lines already carry
+      // the sidecar's logger prefix, so print verbatim rather than stamping
+      // this process's logger prefix on top.
       return line.channel === "stderr"
         ? Console.error(line.line)
         : Console.log(line.line);
@@ -96,22 +111,32 @@ export const make = Effect.fn(function* ({
   const spawn = Effect.fn(function* (serverEntryUrl: string) {
     const bin = typeof globalThis.Bun !== "undefined" ? "bun" : "node";
     const main = fileURLToPath(serverEntryUrl);
+    // The sidecar runs on THIS process's runtime binary, not whatever PATH
+    // resolves: a `.ts` entry (checkout) needs the dev-mode loader hooks,
+    // which are gated on this node's version, and a published `.js` entry
+    // must not silently switch Node versions between supervisor and sidecar.
+    const program = bin === "bun" ? "bun" : process.execPath;
     // Stack-specific context is deliberately absent: sessions carry their
     // own SessionEnvironment, so one child serves every stack.
     const environment: RpcServerEnvironment = {
       profile,
       envFile,
     };
+    // Sidecar stdio is piped, so toolchains down the chain (vite, workerd,
+    // pretty loggers) detect a non-TTY and drop ANSI colors — but their
+    // output ultimately renders on THIS process's terminal. Force color
+    // through the pipe when that terminal supports it, unless the user
+    // already decided (NO_COLOR / FORCE_COLOR). `extendEnv` propagates it
+    // from the sidecar to its own children (dev servers, workerd).
     const command = ChildProcess.make(
-      bin,
+      program,
       {
         bun: ["run", main],
-        // Under Node, transparently strip TypeScript types so that `.ts`
-        // entry points work the same way they do under Bun. Mirrors what
-        // `dev.ts` already does for the outer process, so the dev experience
-        // is symmetric on both runtimes whether the entry came from `src/`
-        // (dev/tests) or `lib/` (published packages).
-        node: main.endsWith(".ts") ? [...transformTypesFlags(), main] : [main],
+        // Under Node the sidecar starts with alchemy's Oxc loader hooks, the
+        // same way `dev.ts` starts the exec child: a `.ts` entry (src/ in a
+        // checkout) also gets src-condition resolution, a `.js` entry (lib/
+        // in a published install) gets the loader alone.
+        node: [...nodeLoaderArgs(main), main],
       }[bin],
       {
         stdout: "pipe",
@@ -120,9 +145,17 @@ export const make = Effect.fn(function* ({
         // test runner's reporter/TUI. The drain below is mandatory — an
         // unread pipe eventually fills and blocks the child.
         stderr: "pipe",
-        detached: false,
+        // `detached` deliberately unset: the spawner defaults to a new process
+        // group on POSIX (and none on Windows, where a detached console child
+        // has its own quirks). A terminal Ctrl+C must NOT reach the sidecar
+        // directly — its lifecycle belongs to this process's finalizer (the
+        // bounded kill below), and a sidecar tearing itself down concurrently
+        // yanks local providers out from under the exec child mid-shutdown.
+        // As a group leader the kill also reaps the sidecar's own children
+        // (workerd, emulators) instead of orphaning them.
         env: {
           [RPC_SERVER_ENVIRONMENT_KEY]: JSON.stringify(environment),
+          ...pipedColorEnv(),
         },
         extendEnv: true,
       },
@@ -186,30 +219,68 @@ export const make = Effect.fn(function* ({
   const server = yield* HttpServer.HttpServer;
 
   const encoder = new TextEncoder();
+  // The first heartbeat flushes the response headers immediately; the
+  // periodic ones defeat idle timeouts (Bun kills sockets that stay silent
+  // for ~10s). Entries without a `line` are skipped by the client.
+  const heartbeat: HeartbeatFrame = { channel: "heartbeat" };
+  const HEARTBEAT = encoder.encode(`${JSON.stringify(heartbeat)}\n`);
+  const heartbeats = Stream.make(HEARTBEAT).pipe(
+    Stream.concat(
+      Stream.fromSchedule(Schedule.spaced(Duration.seconds(5))).pipe(
+        Stream.map(() => HEARTBEAT),
+      ),
+    ),
+  );
 
   yield* server.serve(
     Effect.gen(function* () {
       const request = yield* HttpServerRequest;
-      if (request.url.startsWith(LOGS_PATH)) {
+      // `request.url` is relative under Node and absolute under Bun —
+      // normalize to the pathname before matching.
+      const pathname = new URL(request.url, "http://localhost").pathname;
+      if (pathname === LOGS_PATH) {
         // Long-lived NDJSON stream of sidecar output. The subscriber (exec
-        // child) prints these lines through its own console, which the Ink
-        // renderer patches — inserting them above the progress region
-        // instead of tearing it. Client disconnect interrupts the stream
-        // and unregisters the subscriber.
+        // child) routes these lines through its logger, which the renderer
+        // inserts above the progress region instead of tearing it. Client
+        // disconnect interrupts the stream and unregisters the subscriber.
         const queue = yield* Queue.make<Uint8Array, Cause.Done>();
         const notify = (line: SidecarLogLine) => {
           Queue.offerUnsafe(queue, encoder.encode(`${JSON.stringify(line)}\n`));
         };
         subscribers.add(notify);
         return HttpServerResponse.stream(
-          Stream.fromQueue(queue).pipe(
-            Stream.ensuring(Effect.sync(() => subscribers.delete(notify))),
+          Stream.merge(
+            Stream.fromQueue(queue).pipe(
+              Stream.ensuring(Effect.sync(() => subscribers.delete(notify))),
+            ),
+            heartbeats,
           ),
           { contentType: "application/x-ndjson" },
         );
       }
-      const payload = (yield* request.json) as unknown as RpcSpawnPayload;
-      const url = yield* register(payload.serverEntryUrl);
+      const decoded = yield* Effect.result(
+        request.json.pipe(
+          Effect.flatMap(Schema.decodeUnknownEffect(RpcSpawnPayload)),
+        ),
+      );
+      if (decoded._tag === "Failure") {
+        return HttpServerResponse.text("Invalid RPC spawn payload.", {
+          status: 400,
+        });
+      }
+      const entry = yield* Effect.result(
+        Effect.try({
+          try: () => new URL(decoded.success.serverEntryUrl),
+          catch: (cause) => cause,
+        }),
+      );
+      if (entry._tag === "Failure" || entry.success.protocol !== "file:") {
+        return HttpServerResponse.text(
+          "serverEntryUrl must be a valid file URL.",
+          { status: 400 },
+        );
+      }
+      const url = yield* register(entry.success.href);
       return HttpServerResponse.text(url);
     }),
   );
@@ -222,7 +293,14 @@ export const make = Effect.fn(function* ({
 export const layerServer = (
   environment: Pick<RpcServerEnvironment, "profile" | "envFile">,
 ) =>
-  Layer.effect(RpcSpawner, make(environment)).pipe(Layer.provide(httpServer()));
+  Layer.effect(RpcSpawner, make(environment)).pipe(
+    // `/logs` is deliberately long-lived. On shutdown the exec child still
+    // owns that response while this scope owns the exec child, so waiting for
+    // Node's default 20-second graceful HTTP drain creates a finalizer cycle.
+    // Stop accepting/serving immediately so the watcher finalizer can close
+    // the child; all actual sidecars still use their own bounded finalizers.
+    Layer.provide(httpServer(0, "127.0.0.1", { gracefulShutdownTimeout: 0 })),
+  );
 
 const RPC_ADDRESS_REGEX =
   /(<ALCHEMY_RPC_ADDRESS>)(.+)(<\/ALCHEMY_RPC_ADDRESS>)/;
@@ -233,30 +311,31 @@ const getRpcAddress = (
 ) =>
   Effect.gen(function* () {
     const address = yield* Deferred.make<string>();
-    let done = false;
+    // Set once the address line is seen; lines before it are handshake noise.
+    let addressSeen = false;
     yield* stdout.pipe(
       Stream.decodeText,
       Stream.splitLines,
       Stream.runForEach((line) => {
-        if (done) {
-          return publish(line);
-        }
         const match = line.match(RPC_ADDRESS_REGEX);
         if (match) {
-          done = true;
+          addressSeen = true;
           return Deferred.succeed(address, match[2]);
         }
-        return Effect.void;
+        return addressSeen ? publish(line) : Effect.void;
       }),
       Effect.forkScoped,
     );
     return yield* Deferred.await(address);
   });
 
-const parseSidecarLogLine = (raw: string): SidecarLogLine | undefined => {
+export const parseSidecarLogLine = (
+  raw: string,
+): SidecarLogLine | undefined => {
   try {
-    const parsed = JSON.parse(raw) as SidecarLogLine;
-    return typeof parsed?.line === "string" ? parsed : undefined;
+    return Schema.decodeUnknownOption(SidecarLogLineSchema)(
+      JSON.parse(raw),
+    ).pipe(Option.getOrUndefined);
   } catch {
     return undefined;
   }
@@ -265,48 +344,52 @@ const parseSidecarLogLine = (raw: string): SidecarLogLine | undefined => {
 /**
  * Pull sidecar output from the spawner (the outer `alchemy dev` process)
  * into THIS process's Console. The exec child owns the terminal renderer —
- * Ink patches its `console`, so lines printed here are inserted cleanly
+ * Sigil patches its `console`, so lines printed here are inserted cleanly
  * above the repainting progress region instead of racing it on the shared
  * tty. Forks in the ambient scope and never fails: when no spawner is
  * configured (`ALCHEMY_RPC_SPAWNER_URL` absent — plain deploy/destroy) it is
  * a no-op, and if the connection drops the spawner's own fallback printing
  * takes over.
  */
-export const forwardSidecarLogs: Effect.Effect<
-  void,
-  never,
-  HttpClient.HttpClient | Scope.Scope
-> = Config.string(SPAWNER_URL_ENV_KEY).pipe(
-  Effect.flatMap((spawnerUrl) => {
-    const streamOnce = Effect.gen(function* () {
-      const client = yield* HttpClient.HttpClient;
-      const response = yield* client.get(
-        new URL(LOGS_PATH, spawnerUrl).toString(),
-      );
-      yield* response.stream.pipe(
-        Stream.decodeText,
-        Stream.splitLines,
-        Stream.runForEach((raw) =>
-          Effect.suspend(() => {
-            const parsed = parseSidecarLogLine(raw);
-            if (parsed === undefined) return Effect.void;
-            return parsed.channel === "stderr"
-              ? Console.error(parsed.line)
-              : Console.log(parsed.line);
-          }),
-        ),
+export const forwardSidecarLogs = (
+  /** Mirrors every forwarded line (e.g. into a dev log file). */
+  tee?: (line: SidecarLogLine) => void,
+): Effect.Effect<void, never, HttpClient.HttpClient | Scope.Scope> =>
+  Config.String(SPAWNER_URL_ENV_KEY).pipe(
+    Effect.flatMap((spawnerUrl) => {
+      const streamOnce = Effect.gen(function* () {
+        const client = yield* HttpClient.HttpClient;
+        const response = yield* client.get(
+          new URL(LOGS_PATH, spawnerUrl).toString(),
+        );
+        yield* response.stream.pipe(
+          Stream.decodeText,
+          Stream.splitLines,
+          Stream.runForEach((raw) =>
+            Effect.suspend(() => {
+              const parsed = parseSidecarLogLine(raw);
+              if (parsed === undefined) return Effect.void;
+              tee?.(parsed);
+              // Sidecar lines already carry the sidecar's own logger prefix
+              // (timestamp/level/fiber) — print them verbatim; routing through
+              // this process's logger would stamp a second prefix on top.
+              return parsed.channel === "stderr"
+                ? Console.error(parsed.line)
+                : Console.log(parsed.line);
+            }),
+          ),
+        );
+      });
+      // Keep the subscription alive for the whole dev session: reconnect
+      // (paced) if the stream ends or errors. While disconnected the spawner's
+      // fallback printing covers the gap; the loop dies with the ambient scope.
+      return streamOnce.pipe(
+        Effect.ignore,
+        Effect.andThen(Effect.sleep("1 second")),
+        Effect.forever,
       );
-    });
-    // Keep the subscription alive for the whole dev session: reconnect
-    // (paced) if the stream ends or errors. While disconnected the spawner's
-    // fallback printing covers the gap; the loop dies with the ambient scope.
-    return streamOnce.pipe(
-      Effect.ignore,
-      Effect.andThen(Effect.sleep("1 second")),
-      Effect.forever,
-    );
-  }),
-  Effect.ignore,
-  Effect.forkScoped,
-  Effect.asVoid,
-);
+    }),
+    Effect.ignore,
+    Effect.forkScoped,
+    Effect.asVoid,
+  );

package/src/Local/Sidecar.ts

@@ -0,0 +1,32 @@
+/**
+ * The dev sidecar entry: ONE process hosting every RPC-backed local
+ * provider — Cloudflare's workerd-backed providers, the floci-backed AWS
+ * providers, `Command.Dev` processes, framework dev servers — so their
+ * long-lived state survives exec-child hot reloads during `alchemy dev`.
+ *
+ * Providers arrive in groups: each `RpcProvider.effect` names the URL of a
+ * module whose default export is its group's provider layer (see
+ * `Cloudflare/Local.ts`, `AWS/Local/Local.ts`, `Command/Local.ts`,
+ * `Website/ServerLocal.ts`). A group is imported and built the first time
+ * a session asks for one of its types, so a Cloudflare-only stack never
+ * loads the AWS providers or starts the emulator they need. The spawner
+ * (`RpcSpawner`) forks this entry once per run; `RpcProviderProxy` points
+ * every provider at it.
+ */
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as RpcServer from "./RpcServer.ts";
+
+RpcServer.launch((group) =>
+  Effect.promise(() => import(group)).pipe(
+    Effect.flatMap((module: { default?: unknown }) =>
+      Layer.isLayer(module.default)
+        ? Effect.succeed(module.default as RpcServer.ProviderLayer)
+        : Effect.fail(
+            new Error(
+              `Provider group module ${group} must default-export its provider Layer`,
+            ),
+          ),
+    ),
+  ),
+);

package/src/Neon/AuthProvider.ts

@@ -1,220 +1,48 @@
-import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
-import * as Match from "effect/Match";
 import * as Redacted from "effect/Redacted";
+import { getEnvRedactedRequired } from "../Auth/Env.ts";
 import {
-  AuthError,
-  AuthProviderLayer,
-  type ConfigureContext,
-} from "../Auth/AuthProvider.ts";
-import { CredentialsStore, displayRedacted } from "../Auth/Credentials.ts";
-import { getEnvRedacted, retryOnce } from "../Auth/Env.ts";
-import { AlchemyProfile } from "../Auth/Profile.ts";
-import * as Clank from "../Util/Clank.ts";
+  makeStoredAuthProvider,
+  storedSecret,
+  type StoredAuthConfig,
+} from "../Auth/StoredAuthProvider.ts";
 
 export const NEON_AUTH_PROVIDER_NAME = "Neon";
 
-export type NeonAuthConfig = { method: "env" } | { method: "stored" };
-
-export type NeonStoredCredentials = {
-  type: "apiKey";
-  apiKey: string;
-};
+export type NeonAuthConfig = StoredAuthConfig;
 
 export type NeonResolvedCredentials = {
   type: "apiKey";
   apiKey: Redacted.Redacted<string>;
-  source: { type: NeonAuthConfig["method"]; details?: string };
+  source: { type: NeonAuthConfig["method"] | "env"; details?: string };
 };
 
-const options: Array<{
-  value: NeonAuthConfig["method"];
-  label: string;
-  hint?: string;
-}> = [
-  {
-    value: "env",
-    label: "Environment Variable",
-    hint: "NEON_API_KEY",
-  },
-  {
-    value: "stored",
-    label: "API Key",
-    hint: "enter interactively, stored in ~/.alchemy/credentials",
-  },
-];
+const neonAuth = makeStoredAuthProvider<NeonResolvedCredentials>({
+  provider: NEON_AUTH_PROVIDER_NAME,
+  fields: [{ name: "apiKey", label: "Neon API Key", secret: true }],
+  toResolved: (values) => ({
+    type: "apiKey",
+    apiKey: storedSecret(values.apiKey) ?? Redacted.make(""),
+    source: { type: "stored" },
+  }),
+  readEnvironment: getEnvRedactedRequired("NEON_API_KEY").pipe(
+    Effect.map((apiKey) => ({
+      type: "apiKey" as const,
+      apiKey,
+      source: { type: "env" as const },
+    })),
+  ),
+  environment: [
+    {
+      name: "NEON_API_KEY",
+      required: true,
+      secret: true,
+    },
+  ],
+});
 
 /**
  * Layer that registers the Neon {@link AuthProvider} into the
  * {@link AuthProviders} registry.
  */
-export const NeonAuth = AuthProviderLayer<
-  NeonAuthConfig,
-  NeonResolvedCredentials
->()(
-  NEON_AUTH_PROVIDER_NAME,
-  Effect.gen(function* () {
-    const profiles = yield* AlchemyProfile;
-    const store = yield* CredentialsStore;
-
-    const loginStored = Effect.fn(function* (profileName: string) {
-      const apiKey = yield* Clank.password({
-        message: "Neon API Key",
-        validate: (v) => (v.length === 0 ? "Required" : undefined),
-      }).pipe(retryOnce);
-
-      yield* store.write<NeonStoredCredentials>(profileName, "neon-stored", {
-        type: "apiKey",
-        apiKey,
-      });
-      yield* Clank.success("Neon: credentials saved.");
-      return { method: "stored" as const };
-    });
-
-    const configureInteractive = (profileName: string) =>
-      Clank.select({
-        message: "Neon authentication method",
-        options,
-      }).pipe(
-        Effect.flatMap((method) =>
-          Match.value(method).pipe(
-            Match.when("env", () => Effect.succeed({ method: "env" as const })),
-            Match.when("stored", () => loginStored(profileName)),
-            Match.exhaustive,
-          ),
-        ),
-      );
-
-    const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
-      Effect.gen(function* () {
-        if (ctx.ci) {
-          return { method: "env" as const };
-        }
-        return yield* configureInteractive(profileName);
-      }).pipe(
-        Effect.mapError(
-          (e) =>
-            new AuthError({
-              message: "failed to configure credentials",
-              cause: e,
-            }),
-        ),
-      );
-
-    const resolveCredentials = (
-      profileName: string,
-      config: NeonAuthConfig,
-    ): Effect.Effect<NeonResolvedCredentials, AuthError> =>
-      Match.value(config).pipe(
-        Match.when(
-          { method: "env" },
-          Effect.fn(function* () {
-            const apiKey = yield* getEnvRedacted("NEON_API_KEY");
-            if (!apiKey) {
-              return yield* new AuthError({
-                message: "Neon env credentials not found. Set NEON_API_KEY.",
-              });
-            }
-            return {
-              type: "apiKey" as const,
-              apiKey,
-              source: { type: "env" as const },
-            };
-          }),
-        ),
-        Match.when({ method: "stored" }, () =>
-          store.read<NeonStoredCredentials>(profileName, "neon-stored").pipe(
-            Effect.flatMap((creds) =>
-              creds == null
-                ? Effect.fail(
-                    new AuthError({
-                      message:
-                        "Neon stored credentials not found. Run: alchemy login --configure",
-                    }),
-                  )
-                : Effect.succeed({
-                    type: "apiKey" as const,
-                    apiKey: Redacted.make(creds.apiKey),
-                    source: { type: "stored" as const },
-                  }),
-            ),
-          ),
-        ),
-        Match.exhaustive,
-      );
-
-    const logout = (profileName: string, config: NeonAuthConfig) =>
-      Match.value(config).pipe(
-        Match.when({ method: "env" }, () => Effect.void),
-        Match.when({ method: "stored" }, () =>
-          store
-            .delete(profileName, "neon-stored")
-            .pipe(
-              Effect.andThen(Clank.success("Neon: stored credentials removed")),
-            ),
-        ),
-        Match.exhaustive,
-      );
-
-    const login = (profileName: string, config: NeonAuthConfig) =>
-      Match.value(config)
-        .pipe(
-          Match.when({ method: "env" }, () =>
-            // If NEON_API_KEY isn't set, fall through to the interactive picker
-            // so the user can switch to `stored` (or be told to set the env var)
-            // instead of silently failing later in `read`. The new selection is
-            // persisted to the profile so subsequent logins don't re-prompt.
-            getEnvRedacted("NEON_API_KEY").pipe(
-              Effect.flatMap((apiKey) =>
-                apiKey
-                  ? Effect.void
-                  : Effect.gen(function* () {
-                      const next = yield* configureInteractive(profileName);
-                      const existing = yield* profiles.getProfile(profileName);
-                      yield* profiles.setProfile(profileName, {
-                        ...existing,
-                        [NEON_AUTH_PROVIDER_NAME]: next,
-                      });
-                    }),
-              ),
-            ),
-          ),
-          Match.when({ method: "stored" }, () =>
-            store
-              .read<NeonStoredCredentials>(profileName, "neon-stored")
-              .pipe(
-                Effect.flatMap((creds) =>
-                  creds == null ? loginStored(profileName) : Effect.void,
-                ),
-              ),
-          ),
-          Match.exhaustive,
-        )
-        .pipe(
-          Effect.mapError(
-            (e) => new AuthError({ message: "login failed", cause: e }),
-          ),
-        );
-
-    const prettyPrint = (profileName: string, config: NeonAuthConfig) =>
-      resolveCredentials(profileName, config).pipe(
-        Effect.tap((creds) => {
-          const sourceStr = creds.source.details
-            ? `${creds.source.type} - ${creds.source.details}`
-            : creds.source.type;
-          return Effect.all([
-            Console.log(`  apiKey: ${displayRedacted(creds.apiKey, 9)}`),
-            Console.log(`  source: ${sourceStr}`),
-          ]);
-        }),
-      );
-
-    return {
-      configure: configureCredentials,
-      logout,
-      login,
-      prettyPrint,
-      read: resolveCredentials,
-    };
-  }),
-);
+export const NeonAuth = neonAuth.layer;