@craft-ts/deploy-alchemy 0.7.0-beta.15

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Romain Geffrault
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,38 @@
+# @craft-ts/deploy-alchemy
+
+Optional Alchemy provider for CraftTS deployments.
+
+> **Experimental — never run against a live account.** The presets, the plan,
+> the credential checks and the refusal paths are covered by tests through a
+> runtime port. The adapter that calls Alchemy itself has never run against a
+> real Cloudflare or AWS account from the CraftTS repository: treat your first
+> deployment as its validation, and run `deploy preview` first.
+
+It consumes the manifest produced by `@craft-ts/deploy` and turns it into
+Cloudflare or AWS resources. It never rebuilds routes, contracts or layers, and
+it is never a dependency of a CraftTS application bundle.
+
+```bash
+npm install --save-dev @craft-ts/deploy-alchemy alchemy
+npx craft-ts deploy preview --provider alchemy --stage staging
+npx craft-ts deploy --provider alchemy --stage staging --yes
+```
+
+`preview` opens Alchemy in its read phase: it lists what would be created,
+updated or deleted and provably mutates nothing. `deploy` runs the same checks
+and the same preview, then refuses to apply until `--yes` approves the plan.
+
+| Manifest                 | Resources                                          |
+| ------------------------ | -------------------------------------------------- |
+| `static` on `cloudflare` | `StaticSite`                                       |
+| `worker` on `cloudflare` | the bound `KVNamespace`/`R2Bucket`/… then `Worker` |
+| `static` on `aws`        | `Bucket` behind a `CloudFrontDistribution`         |
+| `lambda` on `aws`        | `Function` plus its `FunctionUrl`                  |
+| `node` on `aws`          | Fargate `Cluster` and `Service`                    |
+
+Credentials are read from the environment and never written anywhere:
+`CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ACCOUNT_ID`, or `AWS_ACCESS_KEY_ID` and
+`AWS_REGION`, plus `ALCHEMY_PASSWORD` for the state.
+
+See the [Alchemy provider guide](../../apps/docs/guide/deployment/alchemy.md)
+for the state, the stages, the outputs and the rollback procedure.

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@craft-ts/deploy-alchemy",
+  "version": "0.7.0-beta.15",
+  "description": "Optional Alchemy provider for CraftTS deployments: Cloudflare and AWS presets driven by the deployment manifest",
+  "author": "Romain Geffrault",
+  "license": "MIT",
+  "homepage": "https://craft-ts.github.io/craft/",
+  "bugs": {
+    "url": "https://github.com/craft-ts/craft-ts/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/craft-ts/craft-ts.git"
+  },
+  "keywords": [
+    "craft-ts",
+    "deployment",
+    "alchemy",
+    "cloudflare",
+    "aws",
+    "infrastructure",
+    "typescript"
+  ],
+  "engines": {
+    "node": ">=20.19.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "sideEffects": false,
+  "type": "module",
+  "main": "./src/index.js",
+  "types": "./src/index.d.ts",
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "types": "./src/index.d.ts",
+      "default": "./src/index.js"
+    }
+  },
+  "dependencies": {
+    "@craft-ts/deploy": "^0.7.0-beta.0"
+  },
+  "peerDependencies": {
+    "alchemy": ">=0.70.0"
+  },
+  "peerDependenciesMeta": {
+    "alchemy": {
+      "optional": true
+    }
+  },
+  "module": "./src/index.js"
+}

package/src/index.d.ts

@@ -0,0 +1,20 @@
+import type { CraftDeploymentProvider } from '@craft-ts/deploy';
+export { createAlchemyDeploymentProvider } from './lib/provider.js';
+export type { AlchemyProviderOptions } from './lib/provider.js';
+/**
+ * The factory the CraftTS CLI looks for when it resolves
+ * `@craft-ts/deploy-alchemy`. Keeping the name generic is what lets the CLI
+ * load any provider package without knowing it exists.
+ */
+export declare function createCraftDeploymentProvider(options?: Readonly<Record<string, unknown>>): CraftDeploymentProvider;
+export { alchemyCredentialNames, checkAlchemyCredentials, } from './lib/credentials.js';
+export type { AlchemyEnvironment } from './lib/credentials.js';
+export { ALCHEMY_PRESETS, planAlchemyDeployment } from './lib/plan.js';
+export type { AlchemyPlanInput, AlchemyPlanResult } from './lib/plan.js';
+export { awsPreset } from './lib/presets/aws.js';
+export { cloudflarePreset } from './lib/presets/cloudflare.js';
+export type { AlchemyPreset, AlchemyPresetResult, } from './lib/presets/preset.js';
+export { alchemyResourceName } from './lib/naming.js';
+export { ALCHEMY_RESOURCE_EXPORTS, loadAlchemyRuntime, } from './lib/alchemy-runtime.js';
+export type { AlchemyOpenOptions, AlchemyPhase, AlchemyResourceRequest, AlchemyResourceState, AlchemyRuntime, AlchemyRuntimeLoader, AlchemyScope, } from './lib/runtime.js';
+//# sourceMappingURL=index.d.ts.map

package/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../libs/deploy-alchemy/src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAMhE,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,YAAY,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM,GAC9C,uBAAuB,CAEzB;AAED,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEzE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,YAAY,EACV,aAAa,EACb,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,YAAY,GACb,MAAM,kBAAkB,CAAC"}

package/src/index.js

@@ -0,0 +1,17 @@
+import { createAlchemyDeploymentProvider, } from './lib/provider.js';
+export { createAlchemyDeploymentProvider } from './lib/provider.js';
+/**
+ * The factory the CraftTS CLI looks for when it resolves
+ * `@craft-ts/deploy-alchemy`. Keeping the name generic is what lets the CLI
+ * load any provider package without knowing it exists.
+ */
+export function createCraftDeploymentProvider(options = {}) {
+    return createAlchemyDeploymentProvider(options);
+}
+export { alchemyCredentialNames, checkAlchemyCredentials, } from './lib/credentials.js';
+export { ALCHEMY_PRESETS, planAlchemyDeployment } from './lib/plan.js';
+export { awsPreset } from './lib/presets/aws.js';
+export { cloudflarePreset } from './lib/presets/cloudflare.js';
+export { alchemyResourceName } from './lib/naming.js';
+export { ALCHEMY_RESOURCE_EXPORTS, loadAlchemyRuntime, } from './lib/alchemy-runtime.js';
+//# sourceMappingURL=index.js.map

package/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../libs/deploy-alchemy/src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,+BAA+B,GAEhC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAGpE;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,UAA6C,EAAE;IAE/C,OAAO,+BAA+B,CAAC,OAAiC,CAAC,CAAC;AAC5E,CAAC;AAED,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAGvE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAM/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC","sourcesContent":["import type { CraftDeploymentProvider } from '@craft-ts/deploy';\nimport {\n  createAlchemyDeploymentProvider,\n  type AlchemyProviderOptions,\n} from './lib/provider.js';\n\nexport { createAlchemyDeploymentProvider } from './lib/provider.js';\nexport type { AlchemyProviderOptions } from './lib/provider.js';\n\n/**\n * The factory the CraftTS CLI looks for when it resolves\n * `@craft-ts/deploy-alchemy`. Keeping the name generic is what lets the CLI\n * load any provider package without knowing it exists.\n */\nexport function createCraftDeploymentProvider(\n  options: Readonly<Record<string, unknown>> = {},\n): CraftDeploymentProvider {\n  return createAlchemyDeploymentProvider(options as AlchemyProviderOptions);\n}\n\nexport {\n  alchemyCredentialNames,\n  checkAlchemyCredentials,\n} from './lib/credentials.js';\nexport type { AlchemyEnvironment } from './lib/credentials.js';\n\nexport { ALCHEMY_PRESETS, planAlchemyDeployment } from './lib/plan.js';\nexport type { AlchemyPlanInput, AlchemyPlanResult } from './lib/plan.js';\n\nexport { awsPreset } from './lib/presets/aws.js';\nexport { cloudflarePreset } from './lib/presets/cloudflare.js';\nexport type {\n  AlchemyPreset,\n  AlchemyPresetResult,\n} from './lib/presets/preset.js';\n\nexport { alchemyResourceName } from './lib/naming.js';\n\nexport {\n  ALCHEMY_RESOURCE_EXPORTS,\n  loadAlchemyRuntime,\n} from './lib/alchemy-runtime.js';\n\nexport type {\n  AlchemyOpenOptions,\n  AlchemyPhase,\n  AlchemyResourceRequest,\n  AlchemyResourceState,\n  AlchemyRuntime,\n  AlchemyRuntimeLoader,\n  AlchemyScope,\n} from './lib/runtime.js';\n"]}

package/src/lib/alchemy-runtime.d.ts

@@ -0,0 +1,22 @@
+import type { AlchemyRuntime } from './runtime.js';
+/**
+ * Adapter over the real Alchemy package.
+ *
+ * Alchemy is an optional peer dependency, so it is imported lazily and only
+ * when a preview or a deployment actually runs. Everything version-specific is
+ * concentrated here: the presets and the planner never see an Alchemy type.
+ */
+/**
+ * Where each planned resource type comes from.
+ *
+ * Alchemy exports its resources per platform module, so a plan type maps to a
+ * module plus an export. This table is the single place to adjust when Alchemy
+ * renames or moves a resource.
+ */
+export declare const ALCHEMY_RESOURCE_EXPORTS: Readonly<Record<string, Readonly<{
+    module: string;
+    export: string;
+}>>>;
+/** Imports the optional peer dependency, or explains why it cannot. */
+export declare function loadAlchemyRuntime(): Promise<AlchemyRuntime>;
+//# sourceMappingURL=alchemy-runtime.d.ts.map

package/src/lib/alchemy-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alchemy-runtime.d.ts","sourceRoot":"","sources":["../../../../../libs/deploy-alchemy/src/lib/alchemy-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAIV,cAAc,EAEf,MAAM,cAAc,CAAC;AAEtB;;;;;;GAMG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAC7C,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA8B5D,CAAC;AAeH,uEAAuE;AACvE,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,cAAc,CAAC,CAQlE"}

package/src/lib/alchemy-runtime.js

@@ -0,0 +1,150 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+/**
+ * Adapter over the real Alchemy package.
+ *
+ * Alchemy is an optional peer dependency, so it is imported lazily and only
+ * when a preview or a deployment actually runs. Everything version-specific is
+ * concentrated here: the presets and the planner never see an Alchemy type.
+ */
+/**
+ * Where each planned resource type comes from.
+ *
+ * Alchemy exports its resources per platform module, so a plan type maps to a
+ * module plus an export. This table is the single place to adjust when Alchemy
+ * renames or moves a resource.
+ */
+export const ALCHEMY_RESOURCE_EXPORTS = Object.freeze({
+    'cloudflare:StaticSite': {
+        module: 'alchemy/cloudflare',
+        export: 'StaticSite',
+    },
+    'cloudflare:Worker': { module: 'alchemy/cloudflare', export: 'Worker' },
+    'cloudflare:KVNamespace': {
+        module: 'alchemy/cloudflare',
+        export: 'KVNamespace',
+    },
+    'cloudflare:R2Bucket': { module: 'alchemy/cloudflare', export: 'R2Bucket' },
+    'cloudflare:D1Database': {
+        module: 'alchemy/cloudflare',
+        export: 'D1Database',
+    },
+    'cloudflare:Queue': { module: 'alchemy/cloudflare', export: 'Queue' },
+    'cloudflare:DurableObjectNamespace': {
+        module: 'alchemy/cloudflare',
+        export: 'DurableObjectNamespace',
+    },
+    'aws:LambdaFunction': { module: 'alchemy/aws', export: 'Function' },
+    'aws:LambdaFunctionUrl': { module: 'alchemy/aws', export: 'FunctionUrl' },
+    'aws:Bucket': { module: 'alchemy/aws', export: 'Bucket' },
+    'aws:CloudFrontDistribution': {
+        module: 'alchemy/aws',
+        export: 'Distribution',
+    },
+    'aws:EcsCluster': { module: 'alchemy/aws', export: 'Cluster' },
+    'aws:EcsService': { module: 'alchemy/aws', export: 'Service' },
+});
+/** Imports the optional peer dependency, or explains why it cannot. */
+export async function loadAlchemyRuntime() {
+    const alchemy = await importAlchemy();
+    const version = await readAlchemyVersion();
+    return {
+        version,
+        open: async (options) => await openScope(alchemy, options),
+    };
+}
+/**
+ * Imports a module whose specifier is only known at run time.
+ *
+ * The indirection is deliberate: `alchemy` is an optional peer dependency, so
+ * a literal `import('alchemy')` would fail to type-check in every project that
+ * has not installed it, and an ambient declaration would shadow the real types
+ * in the projects that have.
+ */
+async function importOptional(specifier) {
+    return await import(__rewriteRelativeImportExtension(specifier));
+}
+async function importAlchemy() {
+    try {
+        return (await importOptional('alchemy'));
+    }
+    catch (error) {
+        throw new Error(`\`alchemy\` is not installed in this project (${error instanceof Error ? error.message : String(error)}). Run \`npm install --save-dev alchemy\`.`);
+    }
+}
+async function readAlchemyVersion() {
+    try {
+        const manifest = (await importOptional('alchemy/package.json'));
+        return manifest.default?.version ?? manifest.version ?? 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+async function openScope(alchemy, options) {
+    const scope = await alchemy.default(options.app, {
+        stage: options.stage,
+        // Alchemy's read phase resolves the recorded state without creating or
+        // updating anything, which is exactly what a preview may do.
+        phase: options.phase,
+    });
+    return {
+        read: async () => readRecordedState(scope),
+        apply: async (resource) => await applyResource(resource),
+        finalize: async () => {
+            await scope.finalize();
+        },
+        dispose: async () => {
+            // A read scope has nothing to commit; disposing it must not delete the
+            // resources it just listed, so `destroy` is deliberately not called.
+        },
+    };
+}
+function readRecordedState(scope) {
+    const state = scope['state'];
+    if (!Array.isArray(state))
+        return [];
+    return state
+        .filter((entry) => typeof entry === 'object' && entry !== null)
+        .map((entry) => ({
+        type: String(entry['type'] ?? ''),
+        name: String(entry['id'] ?? entry['name'] ?? ''),
+        outputs: stringRecord(entry['output'] ?? entry['outputs']),
+    }));
+}
+async function applyResource(resource) {
+    const target = ALCHEMY_RESOURCE_EXPORTS[resource.type];
+    if (!target) {
+        throw new Error(`No Alchemy resource is mapped to \`${resource.type}\`. Add it to ALCHEMY_RESOURCE_EXPORTS.`);
+    }
+    const module = (await importOptional(target.module));
+    const factory = module[target.export];
+    if (typeof factory !== 'function') {
+        throw new Error(`\`${target.module}\` exports no \`${target.export}\`; the installed Alchemy does not match ALCHEMY_RESOURCE_EXPORTS.`);
+    }
+    const created = (await factory(resource.name, { ...resource.properties }));
+    return {
+        type: resource.type,
+        name: resource.name,
+        outputs: stringRecord(created),
+        properties: resource.properties,
+    };
+}
+function stringRecord(value) {
+    if (typeof value !== 'object' || value === null)
+        return {};
+    const record = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if (typeof entry === 'string' || typeof entry === 'number') {
+            record[key] = String(entry);
+        }
+    }
+    return record;
+}
+//# sourceMappingURL=alchemy-runtime.js.map

package/src/lib/alchemy-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alchemy-runtime.js","sourceRoot":"","sources":["../../../../../libs/deploy-alchemy/src/lib/alchemy-runtime.ts"],"names":[],"mappings":";;;;;;;;AAQA;;;;;;GAMG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAEjC,MAAM,CAAC,MAAM,CAAC;IAChB,uBAAuB,EAAE;QACvB,MAAM,EAAE,oBAAoB;QAC5B,MAAM,EAAE,YAAY;KACrB;IACD,mBAAmB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,QAAQ,EAAE;IACvE,wBAAwB,EAAE;QACxB,MAAM,EAAE,oBAAoB;QAC5B,MAAM,EAAE,aAAa;KACtB;IACD,qBAAqB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,UAAU,EAAE;IAC3E,uBAAuB,EAAE;QACvB,MAAM,EAAE,oBAAoB;QAC5B,MAAM,EAAE,YAAY;KACrB;IACD,kBAAkB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,OAAO,EAAE;IACrE,mCAAmC,EAAE;QACnC,MAAM,EAAE,oBAAoB;QAC5B,MAAM,EAAE,wBAAwB;KACjC;IACD,oBAAoB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE;IACnE,uBAAuB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE;IACzE,YAAY,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;IACzD,4BAA4B,EAAE;QAC5B,MAAM,EAAE,aAAa;QACrB,MAAM,EAAE,cAAc;KACvB;IACD,gBAAgB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE;IAC9D,gBAAgB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE;CAC/D,CAAC,CAAC;AAeH,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAE3C,OAAO;QACL,OAAO;QACP,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,SAAiB;IAC7C,OAAO,MAAM,MAAM,kCAAC,SAAS,EAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,CAAkB,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,iDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,4CAA4C,CAC7C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,MAAM,cAAc,CAAC,sBAAsB,CAAC,CAG7D,CAAC;QACF,OAAO,QAAQ,CAAC,OAAO,EAAE,OAAO,IAAI,QAAQ,CAAC,OAAO,IAAI,SAAS,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,OAAsB,EACtB,OAA2B;IAE3B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;QAC/C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,uEAAuE;QACvE,6DAA6D;QAC7D,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAC1C,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,aAAa,CAAC,QAAQ,CAAC;QACxD,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,uEAAuE;YACvE,qEAAqE;QACvE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAyB;IAEzB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK;SACT,MAAM,CACL,CAAC,KAAK,EAAoC,EAAE,CAC1C,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAC9C;SACA,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACf,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChD,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;KAC3D,CAAC,CAAC,CAAC;AACR,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAgC;IAEhC,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,CAAC,IAAI,yCAAyC,CAC7F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAGlD,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,KAAK,MAAM,CAAC,MAAM,mBAAmB,MAAM,CAAC,MAAM,oEAAoE,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MACf,OAID,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC,CAA4B,CAAC;IAEzE,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;QAC9B,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type {\n  AlchemyOpenOptions,\n  AlchemyResourceRequest,\n  AlchemyResourceState,\n  AlchemyRuntime,\n  AlchemyScope,\n} from './runtime.js';\n\n/**\n * Adapter over the real Alchemy package.\n *\n * Alchemy is an optional peer dependency, so it is imported lazily and only\n * when a preview or a deployment actually runs. Everything version-specific is\n * concentrated here: the presets and the planner never see an Alchemy type.\n */\n\n/**\n * Where each planned resource type comes from.\n *\n * Alchemy exports its resources per platform module, so a plan type maps to a\n * module plus an export. This table is the single place to adjust when Alchemy\n * renames or moves a resource.\n */\nexport const ALCHEMY_RESOURCE_EXPORTS: Readonly<\n  Record<string, Readonly<{ module: string; export: string }>>\n> = Object.freeze({\n  'cloudflare:StaticSite': {\n    module: 'alchemy/cloudflare',\n    export: 'StaticSite',\n  },\n  'cloudflare:Worker': { module: 'alchemy/cloudflare', export: 'Worker' },\n  'cloudflare:KVNamespace': {\n    module: 'alchemy/cloudflare',\n    export: 'KVNamespace',\n  },\n  'cloudflare:R2Bucket': { module: 'alchemy/cloudflare', export: 'R2Bucket' },\n  'cloudflare:D1Database': {\n    module: 'alchemy/cloudflare',\n    export: 'D1Database',\n  },\n  'cloudflare:Queue': { module: 'alchemy/cloudflare', export: 'Queue' },\n  'cloudflare:DurableObjectNamespace': {\n    module: 'alchemy/cloudflare',\n    export: 'DurableObjectNamespace',\n  },\n  'aws:LambdaFunction': { module: 'alchemy/aws', export: 'Function' },\n  'aws:LambdaFunctionUrl': { module: 'alchemy/aws', export: 'FunctionUrl' },\n  'aws:Bucket': { module: 'alchemy/aws', export: 'Bucket' },\n  'aws:CloudFrontDistribution': {\n    module: 'alchemy/aws',\n    export: 'Distribution',\n  },\n  'aws:EcsCluster': { module: 'alchemy/aws', export: 'Cluster' },\n  'aws:EcsService': { module: 'alchemy/aws', export: 'Service' },\n});\n\ntype AlchemyScopeHandle = {\n  finalize(): Promise<void>;\n  destroy?(): Promise<void>;\n  [key: string]: unknown;\n};\n\ntype AlchemyModule = {\n  default: (\n    application: string,\n    options: Record<string, unknown>,\n  ) => Promise<AlchemyScopeHandle>;\n};\n\n/** Imports the optional peer dependency, or explains why it cannot. */\nexport async function loadAlchemyRuntime(): Promise<AlchemyRuntime> {\n  const alchemy = await importAlchemy();\n  const version = await readAlchemyVersion();\n\n  return {\n    version,\n    open: async (options) => await openScope(alchemy, options),\n  };\n}\n\n/**\n * Imports a module whose specifier is only known at run time.\n *\n * The indirection is deliberate: `alchemy` is an optional peer dependency, so\n * a literal `import('alchemy')` would fail to type-check in every project that\n * has not installed it, and an ambient declaration would shadow the real types\n * in the projects that have.\n */\nasync function importOptional(specifier: string): Promise<unknown> {\n  return await import(specifier);\n}\n\nasync function importAlchemy(): Promise<AlchemyModule> {\n  try {\n    return (await importOptional('alchemy')) as AlchemyModule;\n  } catch (error) {\n    throw new Error(\n      `\\`alchemy\\` is not installed in this project (${\n        error instanceof Error ? error.message : String(error)\n      }). Run \\`npm install --save-dev alchemy\\`.`,\n    );\n  }\n}\n\nasync function readAlchemyVersion(): Promise<string> {\n  try {\n    const manifest = (await importOptional('alchemy/package.json')) as {\n      default?: { version?: string };\n      version?: string;\n    };\n    return manifest.default?.version ?? manifest.version ?? 'unknown';\n  } catch {\n    return 'unknown';\n  }\n}\n\nasync function openScope(\n  alchemy: AlchemyModule,\n  options: AlchemyOpenOptions,\n): Promise<AlchemyScope> {\n  const scope = await alchemy.default(options.app, {\n    stage: options.stage,\n    // Alchemy's read phase resolves the recorded state without creating or\n    // updating anything, which is exactly what a preview may do.\n    phase: options.phase,\n  });\n\n  return {\n    read: async () => readRecordedState(scope),\n    apply: async (resource) => await applyResource(resource),\n    finalize: async () => {\n      await scope.finalize();\n    },\n    dispose: async () => {\n      // A read scope has nothing to commit; disposing it must not delete the\n      // resources it just listed, so `destroy` is deliberately not called.\n    },\n  };\n}\n\nfunction readRecordedState(\n  scope: AlchemyScopeHandle,\n): readonly AlchemyResourceState[] {\n  const state = scope['state'];\n  if (!Array.isArray(state)) return [];\n  return state\n    .filter(\n      (entry): entry is Record<string, unknown> =>\n        typeof entry === 'object' && entry !== null,\n    )\n    .map((entry) => ({\n      type: String(entry['type'] ?? ''),\n      name: String(entry['id'] ?? entry['name'] ?? ''),\n      outputs: stringRecord(entry['output'] ?? entry['outputs']),\n    }));\n}\n\nasync function applyResource(\n  resource: AlchemyResourceRequest,\n): Promise<AlchemyResourceState> {\n  const target = ALCHEMY_RESOURCE_EXPORTS[resource.type];\n  if (!target) {\n    throw new Error(\n      `No Alchemy resource is mapped to \\`${resource.type}\\`. Add it to ALCHEMY_RESOURCE_EXPORTS.`,\n    );\n  }\n\n  const module = (await importOptional(target.module)) as Record<\n    string,\n    unknown\n  >;\n  const factory = module[target.export];\n  if (typeof factory !== 'function') {\n    throw new Error(\n      `\\`${target.module}\\` exports no \\`${target.export}\\`; the installed Alchemy does not match ALCHEMY_RESOURCE_EXPORTS.`,\n    );\n  }\n\n  const created = (await (\n    factory as (\n      name: string,\n      properties: Record<string, unknown>,\n    ) => Promise<unknown>\n  )(resource.name, { ...resource.properties })) as Record<string, unknown>;\n\n  return {\n    type: resource.type,\n    name: resource.name,\n    outputs: stringRecord(created),\n    properties: resource.properties,\n  };\n}\n\nfunction stringRecord(value: unknown): Readonly<Record<string, string>> {\n  if (typeof value !== 'object' || value === null) return {};\n  const record: Record<string, string> = {};\n  for (const [key, entry] of Object.entries(value)) {\n    if (typeof entry === 'string' || typeof entry === 'number') {\n      record[key] = String(entry);\n    }\n  }\n  return record;\n}\n"]}

package/src/lib/credentials.d.ts

@@ -0,0 +1,6 @@
+import type { CraftDeploymentDiagnostic, CraftDeploymentPlatform } from '@craft-ts/deploy';
+export type AlchemyEnvironment = Readonly<Record<string, string | undefined>>;
+export declare function checkAlchemyCredentials(platform: CraftDeploymentPlatform, environment: AlchemyEnvironment): readonly CraftDeploymentDiagnostic[];
+/** Credential names a platform reads, for documentation and error messages. */
+export declare function alchemyCredentialNames(platform: CraftDeploymentPlatform): readonly string[];
+//# sourceMappingURL=credentials.d.ts.map

package/src/lib/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../../libs/deploy-alchemy/src/lib/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AA2C9E,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,uBAAuB,EACjC,WAAW,EAAE,kBAAkB,GAC9B,SAAS,yBAAyB,EAAE,CA2CtC;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,uBAAuB,GAChC,SAAS,MAAM,EAAE,CAInB"}

package/src/lib/credentials.js

@@ -0,0 +1,78 @@
+/**
+ * Credentials each platform needs. The tooling never reads a value beyond
+ * checking that it is set, and never writes one anywhere.
+ */
+const RULES = {
+    cloudflare: [
+        {
+            anyOf: ['CLOUDFLARE_API_TOKEN', 'CLOUDFLARE_API_KEY'],
+            purpose: 'authenticate against the Cloudflare API',
+        },
+        {
+            anyOf: ['CLOUDFLARE_ACCOUNT_ID'],
+            purpose: 'select the Cloudflare account the resources belong to',
+        },
+    ],
+    aws: [
+        {
+            anyOf: ['AWS_ACCESS_KEY_ID', 'AWS_PROFILE', 'AWS_ROLE_ARN'],
+            purpose: 'authenticate against the AWS API',
+        },
+        {
+            anyOf: ['AWS_REGION', 'AWS_DEFAULT_REGION'],
+            purpose: 'select the AWS region the resources belong to',
+        },
+    ],
+};
+/**
+ * Alchemy encrypts the secrets it records in its state with this passphrase.
+ * Deploying without it would write a state nobody can read back.
+ */
+const STATE_SECRET = 'ALCHEMY_PASSWORD';
+export function checkAlchemyCredentials(platform, environment) {
+    const diagnostics = [];
+    const isSet = (name) => (environment[name] ?? '').trim().length > 0;
+    for (const rule of RULES[platform] ?? []) {
+        if (rule.anyOf.some(isSet))
+            continue;
+        diagnostics.push({
+            code: 'CRAFT_DEPLOY_PROVIDER_CREDENTIALS_MISSING',
+            severity: 'error',
+            provider: 'alchemy',
+            platform,
+            message: `None of ${rule.anyOf.join(', ')} is set, and Alchemy needs one to ${rule.purpose}.`,
+            fix: `Export ${rule.anyOf[0]} in the shell or the CI secret store; never write it in the manifest.`,
+        });
+    }
+    if ((RULES[platform] ?? []).length > 0 &&
+        !isSet(STATE_SECRET) &&
+        !isSet('ALCHEMY_STATE_TOKEN')) {
+        diagnostics.push({
+            code: 'CRAFT_DEPLOY_PROVIDER_STATE_UNAVAILABLE',
+            severity: 'error',
+            provider: 'alchemy',
+            platform,
+            message: `${STATE_SECRET} is not set, so Alchemy cannot encrypt or read back the secrets it records in its state.`,
+            fix: `Export ${STATE_SECRET} for the stage you deploy, and keep the same value across deployments of that stage.`,
+        });
+    }
+    if (RULES[platform] === undefined || (RULES[platform] ?? []).length === 0) {
+        diagnostics.push({
+            code: 'CRAFT_DEPLOY_PROVIDER_PLATFORM_UNSUPPORTED',
+            severity: 'error',
+            provider: 'alchemy',
+            platform,
+            message: `Alchemy has no credential profile for \`${platform}\`.`,
+            fix: 'Deploy to `cloudflare` or `aws`, or use another provider.',
+        });
+    }
+    return diagnostics;
+}
+/** Credential names a platform reads, for documentation and error messages. */
+export function alchemyCredentialNames(platform) {
+    const rules = RULES[platform] ?? [];
+    if (rules.length === 0)
+        return [];
+    return [...rules.flatMap((rule) => rule.anyOf), STATE_SECRET];
+}
+//# sourceMappingURL=credentials.js.map

package/src/lib/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../../../libs/deploy-alchemy/src/lib/credentials.ts"],"names":[],"mappings":"AAaA;;;GAGG;AACH,MAAM,KAAK,GAEP;IACF,UAAU,EAAE;QACV;YACE,KAAK,EAAE,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;YACrD,OAAO,EAAE,yCAAyC;SACnD;QACD;YACE,KAAK,EAAE,CAAC,uBAAuB,CAAC;YAChC,OAAO,EAAE,uDAAuD;SACjE;KACF;IACD,GAAG,EAAE;QACH;YACE,KAAK,EAAE,CAAC,mBAAmB,EAAE,aAAa,EAAE,cAAc,CAAC;YAC3D,OAAO,EAAE,kCAAkC;SAC5C;QACD;YACE,KAAK,EAAE,CAAC,YAAY,EAAE,oBAAoB,CAAC;YAC3C,OAAO,EAAE,+CAA+C;SACzD;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAExC,MAAM,UAAU,uBAAuB,CACrC,QAAiC,EACjC,WAA+B;IAE/B,MAAM,WAAW,GAAgC,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAE5E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACrC,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,2CAA2C;YACjD,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,SAAS;YACnB,QAAQ;YACR,OAAO,EAAE,WAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC,IAAI,CAAC,OAAO,GAAG;YAC7F,GAAG,EAAE,UAAU,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,uEAAuE;SACpG,CAAC,CAAC;IACL,CAAC;IAED,IACE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;QAClC,CAAC,KAAK,CAAC,YAAY,CAAC;QACpB,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAC7B,CAAC;QACD,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,yCAAyC;YAC/C,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,SAAS;YACnB,QAAQ;YACR,OAAO,EAAE,GAAG,YAAY,0FAA0F;YAClH,GAAG,EAAE,UAAU,YAAY,sFAAsF;SAClH,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,4CAA4C;YAClD,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,SAAS;YACnB,QAAQ;YACR,OAAO,EAAE,2CAA2C,QAAQ,KAAK;YACjE,GAAG,EAAE,2DAA2D;SACjE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CACpC,QAAiC;IAEjC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import type {\n  CraftDeploymentDiagnostic,\n  CraftDeploymentPlatform,\n} from '@craft-ts/deploy';\n\nexport type AlchemyEnvironment = Readonly<Record<string, string | undefined>>;\n\ntype CredentialRule = Readonly<{\n  /** Any one of these names satisfies the rule. */\n  anyOf: readonly string[];\n  purpose: string;\n}>;\n\n/**\n * Credentials each platform needs. The tooling never reads a value beyond\n * checking that it is set, and never writes one anywhere.\n */\nconst RULES: Partial<\n  Record<CraftDeploymentPlatform, readonly CredentialRule[]>\n> = {\n  cloudflare: [\n    {\n      anyOf: ['CLOUDFLARE_API_TOKEN', 'CLOUDFLARE_API_KEY'],\n      purpose: 'authenticate against the Cloudflare API',\n    },\n    {\n      anyOf: ['CLOUDFLARE_ACCOUNT_ID'],\n      purpose: 'select the Cloudflare account the resources belong to',\n    },\n  ],\n  aws: [\n    {\n      anyOf: ['AWS_ACCESS_KEY_ID', 'AWS_PROFILE', 'AWS_ROLE_ARN'],\n      purpose: 'authenticate against the AWS API',\n    },\n    {\n      anyOf: ['AWS_REGION', 'AWS_DEFAULT_REGION'],\n      purpose: 'select the AWS region the resources belong to',\n    },\n  ],\n};\n\n/**\n * Alchemy encrypts the secrets it records in its state with this passphrase.\n * Deploying without it would write a state nobody can read back.\n */\nconst STATE_SECRET = 'ALCHEMY_PASSWORD';\n\nexport function checkAlchemyCredentials(\n  platform: CraftDeploymentPlatform,\n  environment: AlchemyEnvironment,\n): readonly CraftDeploymentDiagnostic[] {\n  const diagnostics: CraftDeploymentDiagnostic[] = [];\n  const isSet = (name: string) => (environment[name] ?? '').trim().length > 0;\n\n  for (const rule of RULES[platform] ?? []) {\n    if (rule.anyOf.some(isSet)) continue;\n    diagnostics.push({\n      code: 'CRAFT_DEPLOY_PROVIDER_CREDENTIALS_MISSING',\n      severity: 'error',\n      provider: 'alchemy',\n      platform,\n      message: `None of ${rule.anyOf.join(', ')} is set, and Alchemy needs one to ${rule.purpose}.`,\n      fix: `Export ${rule.anyOf[0]} in the shell or the CI secret store; never write it in the manifest.`,\n    });\n  }\n\n  if (\n    (RULES[platform] ?? []).length > 0 &&\n    !isSet(STATE_SECRET) &&\n    !isSet('ALCHEMY_STATE_TOKEN')\n  ) {\n    diagnostics.push({\n      code: 'CRAFT_DEPLOY_PROVIDER_STATE_UNAVAILABLE',\n      severity: 'error',\n      provider: 'alchemy',\n      platform,\n      message: `${STATE_SECRET} is not set, so Alchemy cannot encrypt or read back the secrets it records in its state.`,\n      fix: `Export ${STATE_SECRET} for the stage you deploy, and keep the same value across deployments of that stage.`,\n    });\n  }\n\n  if (RULES[platform] === undefined || (RULES[platform] ?? []).length === 0) {\n    diagnostics.push({\n      code: 'CRAFT_DEPLOY_PROVIDER_PLATFORM_UNSUPPORTED',\n      severity: 'error',\n      provider: 'alchemy',\n      platform,\n      message: `Alchemy has no credential profile for \\`${platform}\\`.`,\n      fix: 'Deploy to `cloudflare` or `aws`, or use another provider.',\n    });\n  }\n\n  return diagnostics;\n}\n\n/** Credential names a platform reads, for documentation and error messages. */\nexport function alchemyCredentialNames(\n  platform: CraftDeploymentPlatform,\n): readonly string[] {\n  const rules = RULES[platform] ?? [];\n  if (rules.length === 0) return [];\n  return [...rules.flatMap((rule) => rule.anyOf), STATE_SECRET];\n}\n"]}

package/src/lib/naming.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Resource names carry the application and the stage.
+ *
+ * Two stages of the same application share one Alchemy account, so a name that
+ * omits the stage makes a preview deployment overwrite production.
+ */
+export declare function alchemyResourceName(application: string, stage: string, suffix: string): string;
+//# sourceMappingURL=naming.d.ts.map

package/src/lib/naming.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"naming.d.ts","sourceRoot":"","sources":["../../../../../libs/deploy-alchemy/src/lib/naming.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,MAAM,CAUR"}

package/src/lib/naming.js

@@ -0,0 +1,16 @@
+/**
+ * Resource names carry the application and the stage.
+ *
+ * Two stages of the same application share one Alchemy account, so a name that
+ * omits the stage makes a preview deployment overwrite production.
+ */
+export function alchemyResourceName(application, stage, suffix) {
+    return [application, stage, suffix]
+        .map((part) => part
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/^-+|-+$/g, ''))
+        .filter((part) => part.length > 0)
+        .join('-');
+}
+//# sourceMappingURL=naming.js.map

package/src/lib/naming.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"naming.js","sourceRoot":"","sources":["../../../../../libs/deploy-alchemy/src/lib/naming.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAmB,EACnB,KAAa,EACb,MAAc;IAEd,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC;SAChC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,IAAI;SACD,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAC3B;SACA,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC","sourcesContent":["/**\n * Resource names carry the application and the stage.\n *\n * Two stages of the same application share one Alchemy account, so a name that\n * omits the stage makes a preview deployment overwrite production.\n */\nexport function alchemyResourceName(\n  application: string,\n  stage: string,\n  suffix: string,\n): string {\n  return [application, stage, suffix]\n    .map((part) =>\n      part\n        .toLowerCase()\n        .replace(/[^a-z0-9-]+/g, '-')\n        .replace(/^-+|-+$/g, ''),\n    )\n    .filter((part) => part.length > 0)\n    .join('-');\n}\n"]}

package/src/lib/plan.d.ts

@@ -0,0 +1,24 @@
+import type { CraftDeploymentDiagnostic, CraftDeploymentPlan, CraftDeploymentRequest } from '@craft-ts/deploy';
+import type { AlchemyPreset } from './presets/preset.js';
+import type { AlchemyResourceRequest, AlchemyResourceState } from './runtime.js';
+export declare const ALCHEMY_PRESETS: Readonly<Record<string, AlchemyPreset>>;
+export type AlchemyPlanInput = Readonly<{
+    request: CraftDeploymentRequest;
+    /** What Alchemy already records for this application and stage. */
+    existing: readonly AlchemyResourceState[];
+}>;
+export type AlchemyPlanResult = Readonly<{
+    plan: CraftDeploymentPlan;
+    /** Resources to apply, in declaration order, when the plan is approved. */
+    resources: readonly AlchemyResourceRequest[];
+    diagnostics: readonly CraftDeploymentDiagnostic[];
+}>;
+/**
+ * Turns a manifest and the recorded state into the list of actions a
+ * deployment would take.
+ *
+ * The function is pure: it reads no environment, opens no connection and
+ * touches no infrastructure, which is what makes a preview trustworthy.
+ */
+export declare function planAlchemyDeployment(input: AlchemyPlanInput): AlchemyPlanResult;
+//# sourceMappingURL=plan.d.ts.map

package/src/lib/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../../../../libs/deploy-alchemy/src/lib/plan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,mBAAmB,EAEnB,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EACV,sBAAsB,EACtB,oBAAoB,EACrB,MAAM,cAAc,CAAC;AAEtB,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAIhE,CAAC;AAEL,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,OAAO,EAAE,sBAAsB,CAAC;IAChC,mEAAmE;IACnE,QAAQ,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,2EAA2E;IAC3E,SAAS,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC7C,WAAW,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACnD,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,gBAAgB,GACtB,iBAAiB,CA2DnB"}