alchemy 2.0.0-beta.84 → 2.0.0-beta.85

package/src/Auth/AuthProvider.ts

@@ -1,4 +1,5 @@
 import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
@@ -10,7 +11,9 @@ import * as Semaphore from "effect/Semaphore";
 import { Interaction } from "../Interaction.ts";
 import { UserFacingError } from "../UserFacingError.ts";
 import { cachedFunction } from "../Util/cached-function.ts";
+import { globalLogs } from "../Util/LogRecord.ts";
 import { withProfileCredentialsLock } from "./Lock.ts";
+import { AuthProviders } from "./Registry.ts";
 
 /**
  * Canonical web host for OAuth provider-agnostic landing pages
@@ -75,12 +78,7 @@ export const refreshHint = (provider: string, profileName: string): string =>
 export const reconfigureHint = (provider: string, profileName: string): string =>
   `Run \`alchemy profile edit --profile ${profileName} --reconfigure ${provider}\` to reconfigure.`;
 
-export class AuthProviders extends Context.Service<
-  AuthProviders,
-  {
-    [providerName: string]: AuthProvider;
-  }
->()("AuthProviders") {}
+export { AuthProviders, AuthProvidersLive } from "./Registry.ts";
 
 /**
  * Declares one environment variable a provider's {@link AuthProviderImpl.readEnvironment}
@@ -246,10 +244,19 @@ export interface AuthProviderImpl<
    */
   readonly configureMethods?: ReadonlyArray<ConfigureMethod>;
 
+  /**
+   * Re-authenticate, silently refreshing when the stored credentials allow.
+   * Returns the new config for the caller to save, or nothing when the
+   * provider already saved it through `updateConfig` (a silent refresh saves
+   * under the credentials lock, so the caller must not write it again).
+   * `reload` reads the stored config; run it under the lock before
+   * refreshing, since refresh tokens can be single-use.
+   */
   login(
     profileName: string,
     config: Config,
     updateConfig?: (config: Config) => Effect.Effect<void, AuthError>,
+    reload?: Effect.Effect<Config, AuthError>,
   ): Effect.Effect<Config | void, AuthError, R | Interaction>;
 
   logout(profileName: string, config: Config): Effect.Effect<void, AuthError, R | Interaction>;
@@ -297,9 +304,29 @@ export interface AuthProviderImpl<
 export interface AuthProvider<
   Config extends { method: string } = { method: string },
   Credentials = unknown,
-> extends AuthProviderImpl<Config, Credentials> {
+> extends Omit<AuthProviderImpl<Config, Credentials>, "read" | "details"> {
   readonly kind: "AuthProvider";
   readonly name: string;
+  /**
+   * {@link AuthProviderImpl.read} under the profile's credentials lock, with
+   * `loadConfig` run inside the lock. A silent refresh spends a single-use
+   * refresh token, so config loaded before the lock can hold a token that
+   * another process, or an earlier resolve in this one, already rotated.
+   */
+  read<E>(
+    profileName: string,
+    loadConfig: Effect.Effect<Config, E>,
+    updateConfig?: (config: Config) => Effect.Effect<void, AuthError>,
+  ): Effect.Effect<Credentials, E | AuthError | NeedsReauth>;
+  /**
+   * {@link AuthProviderImpl.details} under the profile's credentials lock,
+   * with `loadConfig` run inside the lock, since details may refresh.
+   */
+  details<E>(
+    profileName: string,
+    loadConfig: Effect.Effect<Config, E>,
+    updateConfig?: (config: Config) => Effect.Effect<void, AuthError>,
+  ): Effect.Effect<ProviderDetails, E | AuthError | NeedsReauth, Interaction>;
   /** Log each environment contract once per built provider layer. */
   readonly logEnvironmentCredentials: (used: ReadonlyArray<string>) => Effect.Effect<void>;
   /**
@@ -325,7 +352,7 @@ export const AuthProvider =
   ) =>
     Effect.gen(function* () {
       // FileSystem/Path back the cross-process credentials lock that wraps
-      // `logout`/`read` below, so capture them with the impl's own services.
+      // `logout`/`read`/`details` below, so capture them with the impl's own services.
       //
       // `Effect.context()` snapshots the ENTIRE fiber context (the type
       // parameter only narrows the type), and `Effect.provideContext` makes
@@ -344,6 +371,14 @@ export const AuthProvider =
       const ctx = Context.omit(Interaction)(
         yield* Effect.context<FileSystem.FileSystem | Path.Path | R | ImplReq>(),
       ) as Context.Context<FileSystem.FileSystem | Path.Path | R | ImplReq>;
+      // `read` and `readEnvironment` resolve credentials for a caller that
+      // has already chosen its ConfigProvider (`resolveProviderConfig`
+      // checks `presentEnvironment` under it), so they read through that
+      // one, not the one ambient at REGISTRATION. The profile-command
+      // methods keep the snapshot: they run under the process environment,
+      // and `--env-file` reaches them only through it.
+      // SAFETY: as above, the assertion only restores the pre-omit type.
+      const resolveCtx = Context.omit(ConfigProvider.ConfigProvider)(ctx) as typeof ctx;
       const providers = yield* AuthProviders;
       const service = yield* Effect.isEffect(impl) ? impl : Effect.succeed(impl);
       // Validate the declared environment contract at registration so a
@@ -352,7 +387,7 @@ export const AuthProvider =
       const environment =
         service.environment === undefined
           ? []
-          : yield* Schema.decodeUnknownEffect(EnvironmentVariables)(service.environment).pipe(
+          : yield* Schema.decodeEffect(EnvironmentVariables)(service.environment).pipe(
               Effect.orDie,
             );
       if (service.readEnvironment !== undefined && environment.length === 0) {
@@ -373,12 +408,12 @@ export const AuthProvider =
         );
       }
 
+      // Auth and credentials are account-level: every method's logs go to
+      // the global run log, not the project's.
       const provider: AuthProvider<Config, Credentials> = {
         logEnvironmentCredentials: yield* cachedFunction(
           (used: ReadonlyArray<string>) =>
-            Effect.logInfo(
-              `${name}: using environment variables (${used.join(", ")}) instead of the profile.`,
-            ),
+            Effect.logInfo(`${name}: using environment variables (${used.join(", ")}).`),
           { key: ([used]) => JSON.stringify(used.toSorted()) },
         ),
         kind: "AuthProvider",
@@ -395,21 +430,32 @@ export const AuthProvider =
           Semaphore.withPermits(
             interactiveMutex,
             1,
-          )(service.configure(profileName, currentConfig).pipe(Effect.provideContext(ctx))),
-        login: (profileName, config, updateConfig) =>
+          )(
+            service
+              .configure(profileName, currentConfig)
+              .pipe(Effect.provideContext(ctx), globalLogs),
+          ),
+        login: (profileName, config, updateConfig, reload) =>
           Semaphore.withPermits(
             interactiveMutex,
             1,
-          )(service.login(profileName, config, updateConfig).pipe(Effect.provideContext(ctx))),
+          )(
+            service
+              .login(profileName, config, updateConfig, reload)
+              .pipe(Effect.provideContext(ctx), globalLogs),
+          ),
         logout: (profileName, config) =>
           withProfileCredentialsLock(profileName, service.logout(profileName, config)).pipe(
             Effect.provideContext(ctx),
+            globalLogs,
           ),
-        details: (profileName, config, updateConfig) =>
+        details: (profileName, loadConfig, updateConfig) =>
           withProfileCredentialsLock(
             profileName,
-            service.details(profileName, config, updateConfig),
-          ).pipe(Effect.provideContext(ctx)),
+            Effect.flatMap(loadConfig, (config) =>
+              service.details(profileName, config, updateConfig),
+            ),
+          ).pipe(Effect.provideContext(ctx), globalLogs),
         ...(service.configureWith === undefined
           ? {}
           : {
@@ -419,15 +465,22 @@ export const AuthProvider =
                   readonly method: string;
                   readonly values: Record<string, string>;
                 },
-              ) => service.configureWith!(profileName, input).pipe(Effect.provideContext(ctx)),
+              ) =>
+                service.configureWith!(profileName, input).pipe(
+                  Effect.provideContext(ctx),
+                  globalLogs,
+                ),
               configureMethods: service.configureMethods,
             }),
-        read: (profileName, config, updateConfig) =>
+        read: (profileName, loadConfig, updateConfig) =>
           withProfileCredentialsLock(
             profileName,
-            service.read(profileName, config, updateConfig),
-          ).pipe(Effect.provideContext(ctx)),
-        readEnvironment: service.readEnvironment?.pipe(Effect.provideContext(ctx)),
+            Effect.flatMap(loadConfig, (config) => service.read(profileName, config, updateConfig)),
+          ).pipe(Effect.provideContext(resolveCtx), globalLogs),
+        readEnvironment: service.readEnvironment?.pipe(
+          Effect.provideContext(resolveCtx),
+          globalLogs,
+        ),
         environment,
         configSchema: service.configSchema,
         decodeConfig: (profileName, config) =>

package/src/Auth/BrowserOAuth.ts

@@ -1,8 +1,7 @@
 /**
- * Shared browser-OAuth ceremony for auth providers: open the authorization
- * URL, then race the provider's local callback listener against the branded
- * "waiting for browser" prompt (spinner + URL; Enter switches to
- * manual code entry, `o` opens the browser again, and `c` copies the URL).
+ * Shared browser-OAuth ceremony for auth providers: an
+ * {@link Interaction.browserLogin} that waits for the provider's local
+ * callback listener, with manual code entry as the fallback.
  *
  * {@link deviceOAuth} is the device-code (RFC 8628) counterpart.
  *
@@ -11,7 +10,6 @@
  * login UX stays uniform.
  */
 import * as Effect from "effect/Effect";
-import type { ChildProcessSpawner } from "effect/process/ChildProcessSpawner";
 import * as Interaction from "../Interaction.ts";
 import { CallbackServerStartError, type DeviceAuthorization } from "./OAuthFlow.ts";
 
@@ -31,40 +29,33 @@ export interface BrowserOAuthOptions<A, E1, R1, E2, R2> {
 export const browserOAuth = Effect.fn(function* <A, E1, R1, E2, R2>(
   options: BrowserOAuthOptions<A, E1, R1, E2, R2>,
 ) {
-  const services = yield* Effect.context<ChildProcessSpawner>();
-  // This runner is invoked later by React's keyboard event boundary, not
-  // while the surrounding Effect is executing.
-  const runPromise = Effect.runPromiseWith(services);
-  const openFailed = yield* Interaction.openUrl(options.url).pipe(
-    Effect.as(false),
-    Effect.orElseSucceed(() => true),
-  );
-  return yield* Effect.raceFirst(
-    // A callback server that cannot start (e.g. the port is taken) must not
-    // fail the race — warn and hang so manual code entry stays available.
-    // Genuine OAuth failures delivered via the callback still fail fast.
-    options.callback.pipe(
-      Effect.catchIf(
-        (e): e is E1 & CallbackServerStartError => e instanceof CallbackServerStartError,
-        (e) =>
-          Interaction.accessors.output
-            .warning(`${e.message} — paste the authorization code instead.`)
-            .pipe(Effect.andThen(Effect.never)),
-      ),
-    ),
-    (yield* Interaction.Interaction).prompt
-      .awaitExternal({
-        message: `${options.provider} authorization`,
-        waitingLabel:
-          options.waitingLabel ?? "waiting for browser authorization (up to 5 minutes)…",
-        url: options.url,
-        openFailed,
-        onOpen: () => runPromise(Interaction.openUrl(options.url)),
-        inputLabel: "Paste the authorization code or callback URL",
-        validate: (value) => (value.trim().length > 0 ? undefined : "Paste a code or URL"),
-      })
-      .pipe(Effect.flatMap(options.exchange)),
-  );
+  // A callback server that cannot start (e.g. the port is taken) must not
+  // fail the race when the user can paste the code instead — warn and hang
+  // so manual entry stays available. Without terminal input there is no
+  // manual entry, so the startup error fails the login. Genuine OAuth
+  // failures delivered via the callback always fail fast.
+  const { input } = (yield* Interaction.Interaction).terminal;
+  return yield* Interaction.browserLogin({
+    provider: options.provider,
+    url: options.url,
+    waitingLabel: options.waitingLabel,
+    waitFor: input
+      ? options.callback.pipe(
+          Effect.catchIf(
+            (e): e is E1 & CallbackServerStartError => e instanceof CallbackServerStartError,
+            (e) =>
+              Interaction.warning(`${e.message} — paste the authorization code instead.`).pipe(
+                Effect.andThen(Effect.never),
+              ),
+          ),
+        )
+      : options.callback,
+    manualCode: {
+      label: "Paste the authorization code or callback URL",
+      validate: (value) => (value.trim().length > 0 ? undefined : "Paste a code or URL"),
+      exchange: options.exchange,
+    },
+  });
 });
 
 export interface DeviceOAuthOptions<A, E, R> {
@@ -81,24 +72,10 @@ export interface DeviceOAuthOptions<A, E, R> {
  * URL, show the user code, and wait for the token poll. The prompt only
  * renders the URL/code and re-opens the browser; the poll always wins.
  */
-export const deviceOAuth = Effect.fn(function* <A, E, R>(options: DeviceOAuthOptions<A, E, R>) {
-  const services = yield* Effect.context<ChildProcessSpawner>();
-  const url = options.authorization.verificationUriComplete;
-  // Invoked later by React's keyboard event boundary.
-  const runPromise = Effect.runPromiseWith(services);
-  const openFailed = yield* Effect.isFailure(Interaction.openUrl(url));
-  return yield* Effect.raceFirst(
-    options.token,
-    Interaction.accessors.prompt
-      .awaitExternal({
-        message: `${options.provider} authorization`,
-        waitingLabel: "waiting for browser authorization (up to 5 minutes)…",
-        url,
-        code: options.authorization.userCode,
-        openFailed,
-        onOpen: () => runPromise(Interaction.openUrl(url)),
-        allowManualInput: false,
-      })
-      .pipe(Effect.andThen(Effect.never)),
-  );
-});
+export const deviceOAuth = <A, E, R>(options: DeviceOAuthOptions<A, E, R>) =>
+  Interaction.browserLogin({
+    provider: options.provider,
+    url: options.authorization.verificationUriComplete,
+    code: options.authorization.userCode,
+    waitFor: options.token,
+  });

package/src/Auth/Credentials.ts

@@ -66,7 +66,7 @@ export const CredentialsStoreLive = Layer.effect(
         Effect.gen(function* () {
           const filePath = yield* validateCredentialPath(profile, provider);
           const data = yield* fs.readFileString(filePath).pipe(
-            Effect.catchReason("PlatformError", "NotFound", () => Effect.succeed(undefined)),
+            Effect.catchReason("PlatformError", "NotFound", () => Effect.undefined),
             Effect.mapError((cause) =>
               AuthError.make({
                 message: `Could not read credentials at '${filePath}'.`,
@@ -75,9 +75,7 @@ export const CredentialsStoreLive = Layer.effect(
             ),
           );
           if (data === undefined) return undefined;
-          const json = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Unknown))(
-            data,
-          ).pipe(
+          const json = yield* Schema.decodeEffect(Schema.fromJsonString(Schema.Unknown))(data).pipe(
             Effect.mapError((cause) =>
               AuthError.make({
                 message: `Stored credentials at '${filePath}' contain invalid JSON.`,

package/src/Auth/Demand.ts

@@ -96,27 +96,36 @@ export class CredentialsRequired extends Data.TaggedError("CredentialsRequired")
 }
 
 /**
- * Live providers resolve credentials lazily, on their first cloud call, and
- * a failed resolution leaves the credential service as a
- * {@link CredentialsUnavailable} defect. Applied around every provider
+ * Live providers resolve credentials lazily, on their first cloud call. A
+ * failed resolution fails (or, for alchemy services typed as never failing,
+ * dies) with {@link CredentialsUnavailable}. Applied around every provider
  * lifecycle call, this fails the operation with {@link CredentialsRequired}
- * naming the resource instead of treating it as a provider crash.
+ * naming the resource instead.
  */
-export const failCredentialsRequired =
-  (fqn: string) =>
-  <A, E, R>(self: Effect.Effect<A, E, R>) =>
-    Effect.catchDefect(self, (defect) =>
-      Schema.is(CredentialsUnavailable)(defect)
-        ? Effect.fail(
-            new CredentialsRequired({
-              provider: defect.provider,
-              resources: [fqn],
-              reason: "runs against the real cloud",
-              message: defect.message,
-            }),
-          )
-        : Effect.die(defect),
+export const failCredentialsRequired = (fqn: string) =>
+  Effect.fn(function* <A, E, R>(self: Effect.Effect<A, E, R>) {
+    const isUnavailable = Schema.is(CredentialsUnavailable);
+    // Annotated: the catch handler returns this or a re-fail of E, and a
+    // union of Effects does not unify on its own.
+    const required = (
+      unavailable: CredentialsUnavailable,
+    ): Effect.Effect<never, E | CredentialsRequired> =>
+      Effect.fail(
+        new CredentialsRequired({
+          provider: unavailable.provider,
+          resources: [fqn],
+          reason: "runs against the real cloud",
+          message: unavailable.message,
+        }),
+      );
+    return yield* self.pipe(
+      // oxlint-disable-next-line effecttsgo/catch-conditional-refail-to-catch-if -- catchIf cannot narrow a generic E
+      Effect.catch((error) => (isUnavailable(error) ? required(error) : Effect.fail(error))),
+      Effect.catchDefect((defect) =>
+        isUnavailable(defect) ? required(defect) : Effect.die(defect),
+      ),
     );
+  });
 
 const describeReason = (reason: CredentialDemandReason): string => {
   switch (reason) {

package/src/Auth/Env.ts

@@ -36,14 +36,19 @@ export const getEnvRedactedRequired = (key: string) =>
     Effect.mapError((cause) => AuthError.make({ message: `Missing required env: ${key}`, cause })),
   );
 
-export const mapPromptCancellation = <A, R>(
-  self: Effect.Effect<A, Interaction.InteractionError, R>,
-) =>
+/** Turn a cancelled or unavailable prompt into an `AuthError`; other errors pass through. */
+export const mapPromptCancellation = <A, E, R>(self: Effect.Effect<A, E, R>) =>
   self.pipe(
-    Effect.mapError((cause) =>
-      AuthError.make({
-        message: cause._tag === "TerminalCancelled" ? "User cancelled prompt" : cause.message,
-        cause,
-      }),
+    Effect.catchIf(
+      (cause): cause is Extract<E, Interaction.InteractionError> =>
+        cause instanceof Interaction.TerminalCancelled ||
+        cause instanceof Interaction.NonInteractiveTerminal,
+      (cause) =>
+        Effect.fail(
+          AuthError.make({
+            message: cause._tag === "TerminalCancelled" ? "User cancelled prompt" : cause.message,
+            cause,
+          }),
+        ),
     ),
   );

package/src/Auth/Inspect.ts

@@ -7,7 +7,7 @@ import {
   type AuthProviders,
   type ProviderDetailLine,
 } from "./AuthProvider.ts";
-import type { ProviderConfig } from "./Profile.ts";
+import { ProfileStore, reloadProviderConfig, type ProviderConfig } from "./Profile.ts";
 
 /**
  * What a connected provider looks like right now. Establishing this means
@@ -93,7 +93,10 @@ export const inspectProvider = Effect.fn("inspectProvider")(function* (
     return broken(name, method, "error", "provider.invalid-config", decoded.failure.message);
   }
 
-  const details = yield* Effect.result(provider.details(profile, decoded.success, updateConfig));
+  const store = yield* ProfileStore;
+  const details = yield* Effect.result(
+    provider.details(profile, reloadProviderConfig(store, provider, profile), updateConfig),
+  );
   if (Result.isSuccess(details)) {
     return {
       name,

package/src/Auth/Lock.ts

@@ -1,5 +1,4 @@
 import * as Clock from "effect/Clock";
-import * as Console from "effect/Console";
 import * as Data from "effect/Data";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
@@ -133,12 +132,9 @@ type Phase = { current: "waiting" | "held" };
 /**
  * Periodic "I am not dead, I am stuck here" notice, forked for the lifetime
  * of a {@link withLock} call.
- *
- * Deliberately `Console.error` rather than `Effect.logWarning`: the CLI's
- * telemetry layer replaces the console logger with the OTLP one (see
- * `Telemetry/Layer.ts`), so log records reach `.alchemy/log/out` but never
- * the terminal. The whole point of this notice is to reach the user who is
- * watching a frozen terminal, so it must not go through the logger.
+ * Logged as a warning: the console logger shows it above the noise floor
+ * (telemetry merges with it rather than replacing it), and JSON output and
+ * the run log carry it too.
  */
 const stallNotice = (lockPath: string, label: string, phase: Phase, interval: Duration.Input) =>
   Effect.gen(function* () {
@@ -148,7 +144,7 @@ const stallNotice = (lockPath: string, label: string, phase: Phase, interval: Du
       // notice cadence and the reported wait must not drift apart.
       const now = yield* Clock.currentTimeMillis;
       const seconds = Math.round((now - start) / 1000);
-      yield* Console.error(
+      yield* Effect.logWarning(
         phase.current === "waiting"
           ? `alchemy: ${seconds}s waiting for the auth lock '${lockPath}' (${label}). ` +
               `Another alchemy process holds it; if none is running, delete that directory.`

package/src/Auth/OAuthFlow.ts

@@ -1,6 +1,7 @@
 import http from "node:http";
 import * as Clock from "effect/Clock";
-import * as Crypto from "effect/Crypto";
+import * as Digest from "effect/crypto/Digest";
+import * as SecureRandom from "effect/crypto/SecureRandom";
 import * as Data from "effect/Data";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
@@ -36,7 +37,7 @@ export class OAuthNetworkError extends Data.TaggedError("OAuthNetworkError")<{
   cause: unknown;
 }> {
   override get message(): string {
-    return `Request to ${this.endpoint} failed: ${this.cause}`;
+    return `Request to ${this.endpoint} failed: ${this.cause instanceof Error ? this.cause.message : String(this.cause)}`;
   }
 }
 
@@ -71,16 +72,6 @@ export type OAuthRequestError =
   | OAuthServerUnavailable
   | OAuthInvalidResponse;
 
-/** Secure random generation or hashing for state/PKCE failed. */
-export class OAuthCryptoError extends Data.TaggedError("OAuthCryptoError")<{
-  operation: string;
-  cause: unknown;
-}> {
-  override get message(): string {
-    return `${this.operation} failed: ${this.cause}`;
-  }
-}
-
 /** The client spec lacks the endpoints/URIs a flow needs. */
 export class UnsupportedOAuthFlowError extends Data.TaggedError("UnsupportedOAuthFlowError")<{
   flow: "browser" | "device";
@@ -245,7 +236,11 @@ export interface OAuthClient {
    */
   readonly authorize: (
     scopes?: ReadonlyArray<string>,
-  ) => Effect.Effect<Authorization, OAuthCryptoError | UnsupportedOAuthFlowError, Crypto.Crypto>;
+  ) => Effect.Effect<
+    Authorization,
+    UnsupportedOAuthFlowError,
+    SecureRandom.SecureRandom | Digest.Digest
+  >;
   /**
    * Exchange an authorization code directly. `authorization` supplies the
    * PKCE verifier; omit for non-PKCE clients (tests, relay-less flows).
@@ -312,23 +307,14 @@ export interface OAuthClient {
 }
 
 const randomText = Effect.fn(function* (length: number) {
-  const crypto = yield* Crypto.Crypto;
-  const bytes = yield* crypto
-    .randomBytes(length)
-    .pipe(
-      Effect.mapError(
-        (cause) => new OAuthCryptoError({ operation: "Secure random generation", cause }),
-      ),
-    );
-  return Base64Url.encode(bytes);
+  const random = yield* SecureRandom.SecureRandom;
+  return Base64Url.encode(yield* random.randomBytes(length));
 });
 
 const generatePKCE = Effect.fn(function* (length = 96) {
-  const crypto = yield* Crypto.Crypto;
+  const digest = yield* Digest.Digest;
   const verifier = yield* randomText(length);
-  const challenge = yield* crypto
-    .digest("SHA-256", new TextEncoder().encode(verifier))
-    .pipe(Effect.mapError((cause) => new OAuthCryptoError({ operation: "PKCE digest", cause })));
+  const challenge = yield* digest.digest(Digest.sha256, new TextEncoder().encode(verifier));
   return { verifier, challenge: Base64Url.encode(challenge) };
 });
 

package/src/Auth/Paths.ts

@@ -6,9 +6,10 @@ import path from "pathe";
  * `ALCHEMY_HOME`, which relocates profiles, credential files,
  * and cross-process locks together — used by tests to isolate a temp home
  * and available to users who keep dotfiles elsewhere. Resolved lazily so an
- * override set after module load (e.g. in a test) still takes effect.
+ * override set after module load (e.g. in a test) still takes effect. An
+ * empty `ALCHEMY_HOME` counts as unset, never as the current directory.
  */
-export const rootDir = () => process.env.ALCHEMY_HOME ?? path.join(os.homedir(), ".alchemy");
+export const rootDir = () => process.env.ALCHEMY_HOME || path.join(os.homedir(), ".alchemy");
 
 export const configFilePath = () => path.join(rootDir(), "profiles.json");
 

package/src/Auth/Profile.ts

@@ -321,8 +321,7 @@ export const ProfileStoreLive = Layer.effect(
         return V0.mergeSidecar(provider, values, decoded.success);
       });
 
-    /** Expand the released v0 store and preserve every original file. */
-    const migrateCentralManifest = provideLockServices(
+    const migrateCentralManifestLocked = provideLockServices(
       withLock(
         "profiles-migrate",
         Effect.gen(function* () {
@@ -418,6 +417,12 @@ export const ProfileStoreLive = Layer.effect(
       ),
     );
 
+    /**
+     * Expand the released v0 store and preserve every original file. Checked
+     * once per process, on the first profile read, rather than on every read.
+     */
+    const migrateCentralManifest = yield* Effect.cached(migrateCentralManifestLocked);
+
     const readProviderFile = (profile: string, file: string) =>
       Effect.gen(function* () {
         const fullPath = pathService.join(profileDirPath(profile), file);
@@ -667,6 +672,29 @@ export const ProfileStoreLive = Layer.effect(
   }),
 );
 
+/**
+ * Re-read a provider's stored configuration, failing only with
+ * {@link AuthError}. Silent refreshes rotate single-use refresh tokens, so
+ * {@link AuthProvider.read}/{@link AuthProvider.details} take this effect and
+ * run it under the profile's credentials lock instead of a config read before
+ * it.
+ */
+export const reloadProviderConfig = <Config extends { method: string }>(
+  store: ProfileStoreService,
+  auth: AuthProvider<Config>,
+  profileName: string,
+): Effect.Effect<Config, AuthError> =>
+  store.loadProviderConfig(auth, profileName).pipe(
+    Effect.mapError((cause) =>
+      cause._tag === "AuthError"
+        ? cause
+        : AuthError.make({
+            message: `Could not reload ${auth.name} configuration for profile '${profileName}'.`,
+            cause,
+          }),
+    ),
+  );
+
 /** The name of the currently selected profile. */
 export const currentProfileName: Effect.Effect<string, ProfileError | PlatformError, ProfileStore> =
   ProfileStore.use((store) => store.current).pipe(Effect.map((selection) => selection.name));

package/src/Auth/Registry.ts

@@ -0,0 +1,27 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import type { AuthProvider } from "./AuthProvider.ts";
+
+// Kept apart from `AuthProvider.ts` because `Stack.ts`, which every runtime
+// imports, provides the registry: this module pulls in nothing but Effect.
+
+/** Every registered {@link AuthProvider}, by provider name. */
+export class AuthProviders extends Context.Service<
+  AuthProviders,
+  {
+    [providerName: string]: AuthProvider;
+  }
+>()("AuthProviders") {}
+
+/**
+ * The registry a provider layer registers into: the ambient one when the
+ * caller supplies it (to read the registrations back, as `alchemy profile`
+ * does), otherwise a fresh one for this build. `Stack.build` provides it,
+ * so callers never supply an empty registry.
+ */
+export const AuthProvidersLive = Layer.effect(
+  AuthProviders,
+  Effect.serviceOption(AuthProviders).pipe(Effect.map(Option.getOrElse(() => ({})))),
+);