@homeflare/alchemy 0.37.3 → 0.37.5

package/src/litellm/operations.ts

@@ -34,6 +34,7 @@ import type { LitellmOpContext } from '@distilled.cloud/litellm/Protocol';
 import type { ConfigError } from '@distilled.cloud/litellm/Errors';
 import * as Effect from 'effect/Effect';
 import * as Semaphore from 'effect/Semaphore';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
 
 export type { LitellmOpContext } from '@distilled.cloud/litellm/Protocol';
 export type LitellmRequirements = LitellmOpContext;
@@ -67,6 +68,18 @@ const semaphoreFor = (baseUrl: string): Effect.Effect<Semaphore.Semaphore> =>
  *   `Credentials`'s own type — so `E` (the wrapped operation's error) already contains it, and
  *   this widening is a genuine no-op for callers, not dead type-state left over from the revert.
  */
+/**
+ * ⛔ THE STACK'S AMBIENT `HttpClient` MAY BE CADDY'S. `caddyProviders()` provideMerges a client
+ *   that dials the admin listener and ignores the request host (`caddy-http-client.ts`). Measured
+ *   2026-09-25: that client answers `GET /config/pass_through_endpoint` with HTTP 200 `null`
+ *   (Caddy's empty-config body). The decoded value then has no `endpoints`, and `locate` throws
+ *   `rows.find` of undefined. FetchHttpClient uses the URL the LiteLLM protocol built. An outer
+ *   `Fetch` service still wins inside that client, which is how the fake proxy stays the test
+ *   transport.
+ */
+const throughFetch = <A, E, R>(io: Effect.Effect<A, E, R>) =>
+  io.pipe(Effect.provide(FetchHttpClient.layer));
+
 const mutate = <A, E>(
   io: Effect.Effect<A, E, LitellmOpContext>,
 ): Effect.Effect<A, E | ConfigError, LitellmOpContext> =>
@@ -74,18 +87,32 @@ const mutate = <A, E>(
     const resolve = yield* Credentials;
     const creds = yield* resolve;
     const semaphore = yield* semaphoreFor(creds.apiBaseUrl);
-    return yield* semaphore.withPermits(1)(io);
+    return yield* semaphore.withPermits(1)(throughFetch(io));
   });
 
+const endpointsOf = (
+  response: misc.PassThroughEndpointResponse,
+): Effect.Effect<readonly misc.PassThroughGenericEndpoint[]> => {
+  const rows = response.endpoints;
+  if (!Array.isArray(rows)) {
+    return Effect.die(
+      new Error(
+        'GET /config/pass_through_endpoint decoded no endpoints array. The call reached something other than the LiteLLM proxy.',
+      ),
+    );
+  }
+  return Effect.succeed(rows);
+};
+
 /** GET /config/pass_through_endpoint — every row, config-file and DB alike. Not under the semaphore: reads don't race the field. */
 export const listPassThroughEndpoints = (): Effect.Effect<
   readonly misc.PassThroughGenericEndpoint[],
   misc.GetPassThroughEndpointsConfigPassThroughEndpointGetError,
   LitellmOpContext
 > =>
-  misc
-    .getPassThroughEndpointsConfigPassThroughEndpointGet({})
-    .pipe(Effect.map((response) => response.endpoints));
+  throughFetch(misc.getPassThroughEndpointsConfigPassThroughEndpointGet({})).pipe(
+    Effect.flatMap(endpointsOf),
+  );
 
 /** POST /config/pass_through_endpoint. `body` carries `id` — see pass-through-form.ts. */
 export const createPassThroughEndpoint = (

package/src/litellm/pass-through-endpoint.ts

@@ -20,6 +20,10 @@
  * ⛔ NO CREDENTIAL IS A PROP (S25). `LITELLM_PROXY_URL`/`LITELLM_PROXY_API_KEY` are read at call
  *   time by `@distilled.cloud/litellm`'s own `CredentialsFromEnv` (providers.ts) — the same two
  *   variable names the retired hand-rolled `credentials.ts` read.
+ * ⛔ CREDENTIALS ARE NOT A RESOURCE REQUIREMENT. `LitellmOpContext` (`Credentials | HttpClient`)
+ *   belongs to the handlers at Apply, on `litellmProviders`'s layer. The 5th `Resource` parameter
+ *   used to be `LitellmRequirements | Stack | Stage`, so a stack body required `Credentials`, and
+ *   `Alchemy.Stack` rejects that (`"LitellmCredentials"` is not `"Stack"`). Measured 2026-09-24.
  */
 import { Resource } from 'alchemy';
 import { Unowned } from 'alchemy/AdoptPolicy';
@@ -27,13 +31,10 @@ import { isResolved } from 'alchemy/Diff';
 import type { Input } from 'alchemy/Input';
 import { createPhysicalName } from 'alchemy/PhysicalName';
 import * as Provider from 'alchemy/Provider';
-import type { Stack } from 'alchemy/Stack';
-import type { Stage } from 'alchemy/Stage';
 import type * as misc from '@distilled.cloud/litellm/misc';
 import * as Effect from 'effect/Effect';
 import * as Predicate from 'effect/Predicate';
 import {
-  type LitellmRequirements,
   createPassThroughEndpoint,
   deletePassThroughEndpoint,
   listPassThroughEndpoints,
@@ -65,9 +66,7 @@ export {
 export interface LiteLLMPassThroughEndpoint extends Resource<
   'LiteLLM.PassThroughEndpoint',
   PassThroughEndpointProps,
-  PassThroughEndpointAttributes,
-  never,
-  LitellmRequirements | Stack | Stage
+  PassThroughEndpointAttributes
 > {}
 
 export const LiteLLMPassThroughEndpoint = Resource<LiteLLMPassThroughEndpoint>(

package/src/litellm/pass-through-fetch-client.test.ts

@@ -0,0 +1,40 @@
+/**
+ * A stack that also provides Caddy's admin `HttpClient` must not send LiteLLM's list there.
+ *
+ * ⛔ MEASURED 2026-09-25. `caddyProviders()` provideMerges a client that dials `127.0.0.1:2019`
+ *   and ignores the request host. `GET /config/pass_through_endpoint` on that listener is HTTP
+ *   200 `null`. `listPassThroughEndpoints` then has no `endpoints` array and `locate` throws.
+ *   The call provides `FetchHttpClient`, which still reads an outer `Fetch` — this fake.
+ */
+import { describe, expect, test } from 'bun:test';
+import { credentials } from '@distilled.cloud/litellm/Credentials';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as HttpClient from 'effect/unstable/http/HttpClient';
+import { FAKE_BASE, startFakeLitellm } from './fake-litellm.ts';
+import { listPassThroughEndpoints } from './operations.ts';
+
+const MASTER_KEY = 'sk-test-master';
+
+describe('the proxy list', () => {
+  test('uses Fetch, not an ambient client that answers null', async () => {
+    const fake = startFakeLitellm({
+      masterKey: MASTER_KEY,
+      seed: [{ auth: true, id: 'live-1', path: '/bria', target: 'https://api.bria.ai' }],
+    });
+    const ambient = HttpClient.make(() => Effect.die(new Error('ambient client')));
+    const rows = await Effect.runPromise(
+      listPassThroughEndpoints().pipe(
+        Effect.provideService(HttpClient.HttpClient, ambient),
+        Effect.provide(Layer.succeed(FetchHttpClient.Fetch, fake.fetch)),
+        Effect.provide(credentials({ apiKey: MASTER_KEY, baseUrl: FAKE_BASE })),
+        Effect.provide(FetchHttpClient.layer),
+      ) as Effect.Effect<readonly { id?: string | null }[], unknown, never>,
+    );
+    expect(rows.map((row) => row.id)).toEqual(['live-1']);
+    expect(fake.requests().map((request) => request.path)).toEqual([
+      '/config/pass_through_endpoint',
+    ]);
+  });
+});

package/src/litellm/pass-through-stack.test.ts

@@ -0,0 +1,54 @@
+/**
+ * A real `Alchemy.Stack` whose body `yield*`s `LiteLLM.PassThroughEndpoint`, with
+ * `litellmProviders` as the providers layer.
+ *
+ * ⛔ THE TYPE IS THE BUG. The resource used to put `LitellmRequirements`
+ *   (`Credentials | HttpClient`) on its 5th type parameter, so this construction failed
+ *   TS2345: `Credentials` is not `ProviderServices | StackServices`
+ *   (`"LitellmCredentials"` is not `"Stack"`). No cast. `tsc` fails again if that leak
+ *   returns. The stack value is not run — `Alchemy.Stack` returns a lazy effect
+ *   (github/repo-policy-stack.test.ts measured the same).
+ *
+ * ★ THE DEPLOY IS THE OTHER HALF. `fakeStack` runs Alchemy's own Plan and Apply over the
+ *   fake proxy, and its providers layer is `litellmProviders` (`fake-stack.ts`). A sealed
+ *   `Layer.provide` builds the provider and then hides `Credentials`, so `reconcile` dies
+ *   with Service not found before any request. A live row means the handler ran with the
+ *   key present.
+ */
+import { expect, test } from 'bun:test';
+import { credentials } from '@distilled.cloud/litellm/Credentials';
+import * as Alchemy from 'alchemy';
+import * as Effect from 'effect/Effect';
+import { FAKE_BASE, startFakeLitellm } from './fake-litellm.ts';
+import { fakeStack } from './fake-stack.ts';
+import { LiteLLMPassThroughEndpoint } from './pass-through-endpoint.ts';
+import { litellmProviders } from './providers.ts';
+
+const MASTER_KEY = 'sk-test-master';
+const props = { path: '/bria', target: 'https://api.bria.ai' };
+
+test('an Alchemy.Stack body can yield LiteLLMPassThroughEndpoint, and apply reaches the proxy', async () => {
+  const stack = Alchemy.Stack(
+    'litellm-passthrough',
+    {
+      providers: litellmProviders(credentials({ apiKey: MASTER_KEY, baseUrl: FAKE_BASE })),
+      state: Alchemy.inMemoryState(),
+    },
+    Effect.gen(function* () {
+      return yield* LiteLLMPassThroughEndpoint('Endpoint', props);
+    }),
+  );
+  // Not run — see the file header. `tsc` is the assertion on this value.
+  expect(stack).toBeDefined();
+
+  const fake = startFakeLitellm({ masterKey: MASTER_KEY });
+  const planned = await fakeStack({ apiKey: MASTER_KEY, baseUrl: FAKE_BASE }, fake.fetch).deploy(
+    Effect.gen(function* () {
+      yield* LiteLLMPassThroughEndpoint('Endpoint', props);
+    }),
+  );
+
+  expect(planned).toEqual({ Endpoint: 'create' });
+  expect(fake.rows().some((row) => row.path === '/bria')).toBe(true);
+  expect(fake.requests().some((call) => call.method === 'POST')).toBe(true);
+});

package/src/litellm/providers.ts

@@ -10,11 +10,17 @@
  *   source them another way.
  * ⚠️ `HttpClient` is NOT provided here. It is ambient in every Alchemy runtime the same way it is
  *   for `netboxProviders`-style families in this kit; a stack that already deploys anything over
- *   HTTP already has one.
+ *   HTTP already has one. Do not add a second client to this layer.
+ * ⚠️ `Layer.provideMerge`, NEVER PLAIN `Layer.provide`, for the credentials layer. The handlers
+ *   still need `Credentials` when the engine calls `read`/`diff`/`reconcile`. `Provider.effect`
+ *   puts that need on the layer. Plain `provide` satisfies it only while the `Provider` value is
+ *   built, then hides `Credentials` from those later calls. Measured on Caddy, 2026-09-23:
+ *   `caddy/providers.ts`. `provideMerge` feeds credentials in and keeps them in the layer the
+ *   engine runs the handlers with.
  */
 import { type Credentials, CredentialsFromEnv } from '@distilled.cloud/litellm/Credentials';
 import * as Layer from 'effect/Layer';
 import { LiteLLMPassThroughEndpointProvider } from './pass-through-endpoint.ts';
 
 export const litellmProviders = (creds: Layer.Layer<Credentials> = CredentialsFromEnv) =>
-  LiteLLMPassThroughEndpointProvider().pipe(Layer.provide(creds));
+  LiteLLMPassThroughEndpointProvider().pipe(Layer.provideMerge(creds));

package/src/release/archive.ts

@@ -40,7 +40,11 @@ export const extractMembers = async (
   //   a peak RSS of 1116 MB for vmalert alone under bun 1.4.0. `pull` hands over the next slice only
   //   when the stream asks, so backpressure bounds what is inflated ahead of the tar reader.
   let offset = 0;
-  const source = new ReadableStream<Uint8Array>({
+  // ★ The writable side of DecompressionStream accepts BufferSource (ArrayBuffer or a
+  //   view). pipeThrough is invariant there, so a Uint8Array source is rejected even
+  //   though every slice enqueued is one. Measured as TS2345 under TypeScript 7. No
+  //   zlib package: Bun and Node both ship this stream.
+  const source = new ReadableStream<ArrayBufferView | ArrayBuffer>({
     pull(controller) {
       if (offset >= gzipped.length) {
         controller.close();