@alchemy.run/turso 2.0.0-beta.84 → 2.0.0-beta.86

package/src/Credentials.ts

@@ -1,25 +1,13 @@
 import { ConfigError } from "@distilled.cloud/core/errors";
-import {
-  Credentials,
-  DEFAULT_API_BASE_URL,
-  type Config as TursoClientConfig,
-} from "@distilled.cloud/turso/Credentials";
+import { Credentials, DEFAULT_API_BASE_URL } from "@distilled.cloud/turso/Credentials";
 import * as turso from "@distilled.cloud/turso/turso";
-import {
-  deferUntilFirstUse,
-  orDieCredentialsUnavailable,
-  resolveProviderConfig,
-} from "alchemy/Auth/Resolve";
+import { lazyCredentials, orDieCredentialsUnavailable } from "alchemy/Auth/Resolve";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as HttpClient from "effect/http/HttpClient";
 import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
-import {
-  TURSO_AUTH_PROVIDER_NAME,
-  type TursoAuthConfig,
-  type TursoResolvedCredentials,
-} from "./AuthProvider.ts";
+import { TURSO_AUTH_PROVIDER_NAME, type TursoResolvedCredentials } from "./AuthProvider.ts";
 
 export {
   Credentials,
@@ -61,17 +49,19 @@ const discoverOrganization = Effect.gen(function* () {
 });
 
 const make = (
-  resolve: Effect.Effect<TursoResolvedCredentials>,
+  resolve: Effect.Effect<TursoResolvedCredentials, ConfigError>,
 ): Effect.Effect<Context.Context<Credentials | Organization>, never, HttpClient.HttpClient> =>
   Effect.gen(function* () {
     const http = yield* HttpClient.HttpClient;
-    const cached = yield* Effect.cached(resolve);
-    const credentials: Effect.Effect<TursoClientConfig> = Effect.map(cached, (creds) => ({
+    const credentials = Effect.map(resolve, (creds) => ({
       apiKey: creds.apiToken,
       apiBaseUrl: creds.apiBaseUrl,
     }));
-    const organization = yield* Effect.cached(
-      Effect.flatMap(cached, (creds) =>
+    // `Organization` is typed as never failing, so a credentials failure dies
+    // here; the engine still reports it as `CredentialsRequired`.
+    const organization = yield* resolve.pipe(
+      Effect.orDie,
+      Effect.flatMap((creds) =>
         creds.organization !== undefined && creds.organization.length > 0
           ? Effect.succeed(creds.organization)
           : discoverOrganization.pipe(
@@ -80,6 +70,7 @@ const make = (
               orDieCredentialsUnavailable(TURSO_AUTH_PROVIDER_NAME),
             ),
       ),
+      Effect.cached,
     );
     return Context.make(Credentials, credentials).pipe(Context.add(Organization, organization));
   });
@@ -98,18 +89,13 @@ export const fromToken = (input: {
   organization?: string;
   apiBaseUrl?: string;
 }) =>
-  Layer.effectContext(
-    make(
-      Effect.succeed({
-        type: "apiToken",
-        apiToken:
-          typeof input.apiToken === "string" ? Redacted.make(input.apiToken) : input.apiToken,
-        apiBaseUrl: input.apiBaseUrl ?? DEFAULT_API_BASE_URL,
-        organization: input.organization,
-        source: { type: "stored" },
-      }),
-    ),
-  );
+  Effect.succeed<TursoResolvedCredentials>({
+    type: "apiToken",
+    apiToken: typeof input.apiToken === "string" ? Redacted.make(input.apiToken) : input.apiToken,
+    apiBaseUrl: input.apiBaseUrl ?? DEFAULT_API_BASE_URL,
+    organization: input.organization,
+    source: { type: "stored" },
+  }).pipe(make, Layer.effectContext);
 
 /**
  * Build Turso `Credentials` + `Organization` that resolve through the
@@ -119,21 +105,8 @@ export const fromToken = (input: {
  */
 export const fromAuthProvider = () =>
   Layer.effectContext(
-    Effect.gen(function* () {
-      const resolve = yield* resolveProviderConfig<TursoAuthConfig, TursoResolvedCredentials>(
-        TURSO_AUTH_PROVIDER_NAME,
-      ).pipe(
-        Effect.flatMap(({ profileName, resolve }) =>
-          Effect.mapError(
-            resolve,
-            (e) =>
-              new ConfigError({
-                message: `Failed to resolve Turso credentials from ${profileName === undefined ? "the environment" : `profile '${profileName}'`}: ${e.message}`,
-              }),
-          ),
-        ),
-        deferUntilFirstUse,
-      );
-      return yield* make(resolve.pipe(orDieCredentialsUnavailable(TURSO_AUTH_PROVIDER_NAME)));
-    }),
+    lazyCredentials<TursoResolvedCredentials, ConfigError>()(
+      TURSO_AUTH_PROVIDER_NAME,
+      (creds) => creds,
+    ).pipe(Effect.flatMap(make)),
   );

package/src/Database.ts

@@ -6,13 +6,14 @@ import {
   stampedOf,
   type MigrationsInput,
 } from "@alchemy.run/sql/Migrations";
-import { hashImports, readSqlFile, splitSqlStatements } from "@alchemy.run/sql/SqlFile";
+import { applySqlImports, hashImports, splitSqlStatements } from "@alchemy.run/sql/SqlFile";
 import * as turso from "@distilled.cloud/turso/turso";
 import { Unowned } from "alchemy/AdoptPolicy";
 import { deepEqual, isResolved } from "alchemy/Diff";
 import { createPhysicalName } from "alchemy/PhysicalName";
 import * as Provider from "alchemy/Provider";
 import { Resource } from "alchemy/Resource";
+import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as HttpClient from "effect/http/HttpClient";
 import * as Redacted from "effect/Redacted";
@@ -20,6 +21,11 @@ import { organization } from "./Credentials.ts";
 import * as Hrana from "./Hrana.ts";
 import type { Providers } from "./Providers.ts";
 
+export class DatabaseUnexpectedResponse extends Data.TaggedError("DatabaseUnexpectedResponse")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
 export interface DatabaseSeed {
   /**
    * `"database"` copies an existing database (optionally at a point in
@@ -128,6 +134,13 @@ export interface DatabaseProps {
    * Bookkeeping lives in Alchemy's `__alchemy_migrations` table. A database
    * previously migrated by drizzle-kit is adopted by a one-way conversion on
    * first deploy.
+   *
+   * History is forward-only and linear. A new file must sort after every
+   * applied one, or the deploy fails with `NonLinearMigrationHistoryError`;
+   * an edited or deleted applied file fails with
+   * `RewrittenMigrationHistoryError`. Renaming an applied file without
+   * changing its contents keeps it applied. See
+   * [Migrations](https://alchemy.run/sql/effect-sql/migrations#change-migration-history-safely).
    */
   migrations?: MigrationsInput;
   /**
@@ -185,9 +198,19 @@ export type Database = Resource<
   DatabaseProps,
   DatabaseAttributes,
   never,
-  Providers
+  Providers,
+  DatabaseLookup
 >;
 
+/**
+ * Props for {@link Database.lookup}: find a database this stack
+ * doesn't manage by its name, in the credentialed organization.
+ */
+export interface DatabaseLookup {
+  /** Database name. */
+  name: string;
+}
+
 /**
  * A Turso database: a SQLite database that lives in a {@link Group}.
  * Connect to it from a Worker or Lambda with {@link Connect}, or create a
@@ -246,6 +269,17 @@ export type Database = Resource<
  * const db = yield* Drizzle.LibSQL(conn);
  * ```
  *
+ * ### Looking up an existing database
+ * `Database.lookup` references a database Alchemy doesn't manage (created with
+ * the Turso CLI or by another stack). It is read during plan/deploy, never
+ * created, updated or deleted.
+ *
+ * **Example:** Mint a token for an existing database
+ * ```typescript
+ * const db = Turso.Database.lookup({ name: "app" });
+ * const token = yield* Turso.DatabaseToken("AppToken", { database: db.name });
+ * ```
+ *
  * @resource
  * @product Database
  */
@@ -276,7 +310,9 @@ const withConnection = <A, E, R>(
       authorization: "full-access",
     });
     if (!jwt) {
-      return yield* Effect.fail(new Error(`Turso returned no token for ${database.name}`));
+      return yield* new DatabaseUnexpectedResponse({
+        message: `Turso returned no token for ${database.name}`,
+      });
     }
     return yield* use({ url: `https://${database.hostname}`, authToken: jwt }, client);
   });
@@ -288,7 +324,7 @@ export const DatabaseProvider = () =>
       const observe = (org: string, name: string) =>
         turso.getDatabase({ organizationSlug: org, databaseName: name }).pipe(
           Effect.map((res) => res.database),
-          Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          Effect.catchTag("NotFound", () => Effect.undefined),
         );
 
       const toAttrs = (
@@ -351,7 +387,19 @@ export const DatabaseProvider = () =>
             }
           }
         }),
-        read: Effect.fn(function* ({ id, olds, output }) {
+        lookup: Effect.fn(function* ({ name }) {
+          const org = yield* organization;
+          const db = yield* observe(org, name);
+          if (!db) return undefined;
+          return toAttrs(org, db, yield* getConfig(org, name), {
+            migrationsDir: undefined,
+            migrationsTable: undefined,
+            migrationsHashes: {},
+            importHashes: {},
+          });
+        }),
+
+        read: Effect.fn(function* ({ id, olds, output, previous }) {
           const org = output?.organization ?? (yield* organization);
           const name = output?.name ?? (yield* databaseName(id, olds?.name));
           const db = yield* observe(org, name);
@@ -363,8 +411,13 @@ export const DatabaseProvider = () =>
             importHashes: output?.importHashes ?? {},
           });
           // Turso has no tags: a database found under an explicit,
-          // user-chosen name without prior state may belong to someone else.
-          return output === undefined && olds?.name !== undefined ? Unowned(attrs) : attrs;
+          // user-chosen name without prior state may belong to someone else — unless it
+          // is the generation a delete-first replacement is about to free.
+          const ours =
+            output !== undefined ||
+            olds?.name === undefined ||
+            (previous?.organization === org && previous.name === name);
+          return ours ? attrs : Unowned(attrs);
         }),
         reconcile: Effect.fn(function* ({ id, news, output, session }) {
           const org = output?.organization ?? (yield* organization);
@@ -393,7 +446,9 @@ export const DatabaseProvider = () =>
               .pipe(Effect.catchTag("Conflict", () => Effect.void));
             db = yield* observe(org, name);
             if (!db) {
-              return yield* Effect.fail(new Error(`Turso database ${name} vanished after create`));
+              return yield* new DatabaseUnexpectedResponse({
+                message: `Turso database ${name} vanished after create`,
+              });
             }
           }
 
@@ -447,23 +502,23 @@ export const DatabaseProvider = () =>
               })
             : undefined;
 
-          const previousImports = output?.importHashes ?? {};
-          const importHashes: Record<string, string> = {};
-          if (news.importFiles?.length) {
-            const root = yield* rootDir;
-            for (const filePath of news.importFiles) {
-              const file = yield* readSqlFile(root, filePath);
-              if (previousImports[filePath] !== file.hash) {
-                yield* session.note(`Importing ${filePath}...`);
-                yield* withConnection(org, target, (connection, client) =>
-                  Hrana.transaction(connection, splitSqlStatements(file.sql)).pipe(
-                    Effect.provideService(HttpClient.HttpClient, client),
+          const importHashes = yield* applySqlImports({
+            importFiles: news.importFiles,
+            rootDir: yield* rootDir,
+            previous: output?.importHashes,
+            apply: (file) =>
+              session
+                .note(`Importing ${file.id}...`)
+                .pipe(
+                  Effect.andThen(
+                    withConnection(org, target, (connection, client) =>
+                      Hrana.transaction(connection, splitSqlStatements(file.sql)).pipe(
+                        Effect.provideService(HttpClient.HttpClient, client),
+                      ),
+                    ),
                   ),
-                );
-              }
-              importHashes[filePath] = file.hash;
-            }
-          }
+                ),
+          });
 
           return toAttrs(org, db, config, {
             ...migrationsAttrs({ input: migrationsInput, run: migrations, output }),

package/src/DatabaseToken.ts

@@ -3,11 +3,19 @@ import { deepEqual } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
 import { Resource } from "alchemy/Resource";
 import * as Clock from "effect/Clock";
+import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
 import { organization } from "./Credentials.ts";
 import type { Providers } from "./Providers.ts";
 
+export class DatabaseTokenUnexpectedResponse extends Data.TaggedError(
+  "DatabaseTokenUnexpectedResponse",
+)<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
 /** Access level of a Turso SQL auth token. */
 export type TokenAuthorization = "full-access" | "read-only";
 
@@ -185,7 +193,9 @@ export const DatabaseTokenProvider = () =>
               : undefined,
           });
           if (!jwt) {
-            return yield* Effect.fail(new Error(`Turso returned no token for ${news.database}`));
+            return yield* new DatabaseTokenUnexpectedResponse({
+              message: `Turso returned no token for ${news.database}`,
+            });
           }
           return {
             token: jwt,

package/src/Group.ts

@@ -4,10 +4,16 @@ import { deepEqual, isResolved } from "alchemy/Diff";
 import { createPhysicalName } from "alchemy/PhysicalName";
 import * as Provider from "alchemy/Provider";
 import { Resource } from "alchemy/Resource";
+import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import { organization } from "./Credentials.ts";
 import type { Providers } from "./Providers.ts";
 
+export class GroupUnexpectedResponse extends Data.TaggedError("GroupUnexpectedResponse")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
 /**
  * A Turso location code, e.g. `"aws-us-east-1"`. List the locations
  * available to your organization with `turso db locations`.
@@ -75,7 +81,23 @@ export interface GroupAttributes {
   deleteProtection: boolean;
 }
 
-export type Group = Resource<"Turso.Group", GroupProps, GroupAttributes, never, Providers>;
+export type Group = Resource<
+  "Turso.Group",
+  GroupProps,
+  GroupAttributes,
+  never,
+  Providers,
+  GroupLookup
+>;
+
+/**
+ * Props for {@link Group.lookup}: find a group this stack
+ * doesn't manage by its name, in the credentialed organization.
+ */
+export interface GroupLookup {
+  /** Group name. */
+  name: string;
+}
 
 /**
  * A Turso group. Every Turso database belongs to one group, and the group
@@ -106,6 +128,17 @@ export type Group = Resource<"Turso.Group", GroupProps, GroupAttributes, never,
  * const db = yield* Turso.Database("Db", { group: group.name });
  * ```
  *
+ * ### Looking up an existing group
+ * `Group.lookup` references a group Alchemy doesn't manage (created with
+ * the Turso CLI or by another stack). It is read during plan/deploy, never
+ * created, updated or deleted.
+ *
+ * **Example:** Create a database in an existing group
+ * ```typescript
+ * const group = Turso.Group.lookup({ name: "default" });
+ * const db = yield* Turso.Database("App", { group: group.name });
+ * ```
+ *
  * @resource
  * @product Group
  */
@@ -125,7 +158,7 @@ export const GroupProvider = () =>
       const observe = (org: string, name: string) =>
         turso.getGroup({ organizationSlug: org, groupName: name }).pipe(
           Effect.map((res) => res.group),
-          Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          Effect.catchTag("NotFound", () => Effect.undefined),
         );
 
       const toAttrs = (
@@ -157,15 +190,26 @@ export const GroupProvider = () =>
             return { action: "replace", deleteFirst: news.name !== undefined } as const;
           }
         }),
-        read: Effect.fn(function* ({ id, olds, output }) {
+        lookup: Effect.fn(function* ({ name }) {
+          const org = yield* organization;
+          const group = yield* observe(org, name);
+          return group ? toAttrs(org, group, group.delete_protection ?? false) : undefined;
+        }),
+
+        read: Effect.fn(function* ({ id, olds, output, previous }) {
           const org = output?.organization ?? (yield* organization);
           const name = output?.name ?? (yield* groupName(id, olds?.name));
           const group = yield* observe(org, name);
           if (!group) return undefined;
           const attrs = toAttrs(org, group, group.delete_protection ?? false);
           // Turso has no tags: a group found under an explicit, user-chosen
-          // name without prior state may belong to someone else.
-          return output === undefined && olds?.name !== undefined ? Unowned(attrs) : attrs;
+          // name without prior state may belong to someone else — unless it
+          // is the generation a delete-first replacement is about to free.
+          const ours =
+            output !== undefined ||
+            olds?.name === undefined ||
+            (previous?.organization === org && previous.name === name);
+          return ours ? attrs : Unowned(attrs);
         }),
         reconcile: Effect.fn(function* ({ id, news, output, session }) {
           const org = output?.organization ?? (yield* organization);
@@ -190,7 +234,9 @@ export const GroupProvider = () =>
                 Effect.catchTag("Conflict", () => observe(org, name)),
               );
             if (!group) {
-              return yield* Effect.fail(new Error(`Turso group ${name} vanished after create`));
+              return yield* new GroupUnexpectedResponse({
+                message: `Turso group ${name} vanished after create`,
+              });
             }
           }
 

package/src/GroupToken.ts

@@ -1,6 +1,7 @@
 import * as turso from "@distilled.cloud/turso/turso";
 import * as Provider from "alchemy/Provider";
 import { Resource } from "alchemy/Resource";
+import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import { organization } from "./Credentials.ts";
 import {
@@ -12,6 +13,11 @@ import {
 } from "./DatabaseToken.ts";
 import type { Providers } from "./Providers.ts";
 
+export class GroupTokenUnexpectedResponse extends Data.TaggedError("GroupTokenUnexpectedResponse")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
 export interface GroupTokenProps extends SqlTokenProps {
   /** Name of the group whose databases the token grants access to. */
   group: string;
@@ -101,7 +107,9 @@ export const GroupTokenProvider = () =>
               : undefined,
           });
           if (!jwt) {
-            return yield* Effect.fail(new Error(`Turso returned no token for group ${news.group}`));
+            return yield* new GroupTokenUnexpectedResponse({
+              message: `Turso returned no token for group ${news.group}`,
+            });
           }
           return {
             token: jwt,

package/src/Hrana.ts

@@ -61,7 +61,9 @@ const toHranaValue = (value: unknown): HranaValue => {
   if (value instanceof Uint8Array) {
     return { type: "blob", base64: Buffer.from(value).toString("base64") };
   }
-  return { type: "text", value: String(value) };
+  if (typeof value === "string") return { type: "text", value };
+  if (value instanceof Date) return { type: "text", value: value.toISOString() };
+  return { type: "text", value: JSON.stringify(value) };
 };
 
 const fromHranaValue = (value: HranaValue): unknown => {

package/src/ManageDatabases.ts

@@ -159,7 +159,7 @@ export const ManageDatabasesHttp = Layer.effect(
               return database && database.group === (yield* groupName)
                 ? toManaged(database)
                 : undefined;
-            }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined))),
+            }).pipe(Effect.catchTag("NotFound", () => Effect.undefined)),
           ),
         list: () =>
           authorize(

package/src/OrganizationMember.ts

@@ -64,7 +64,7 @@ export const OrganizationMemberProvider = () =>
       const observe = (org: string, username: string) =>
         turso.getOrganizationMember({ organizationSlug: org, username }).pipe(
           Effect.map(({ member }) => member),
-          Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          Effect.catchTag("NotFound", () => Effect.undefined),
         );
 
       return {