@knpkv/alchemy-console 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 knpkv
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,119 @@
-# Temporary Holding Version
+# @knpkv/alchemy-console
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Read-only data layer for a local Alchemy stack console. The package adds
+project discovery, lockfile version lookup, local state metadata, and SSO/S3
+readers. There is no executable or HTTP listener yet. Authenticated API and
+design-backed Rly screens follow in separate PRs.
+
+`discoverProjects(directory)` scans an explicit root for `alchemy.run.ts` without
+importing or executing it. It skips `.git`, `node_modules`, `.alchemy`, `.direnv`,
+`.cache`, and `dist`, deduplicates directory aliases, and rejects symlinks outside
+the root. Directory errors fail the scan rather than hiding inaccessible projects.
+
+`readAlchemyVersion(projectDirectory, searchRoot)` reads the nearest pnpm or Bun
+text lockfile within the root. pnpm resolves the project's exact workspace
+importer; Bun reads the resolved `alchemy` package tuple. Missing lockfiles or an
+unresolved Alchemy version return `null`. Invalid lockfiles fail explicitly.
+
+`readLocalState(directory, alchemyVersion)` reads
+`.alchemy/state/<app>/<stage>/<encoded-fqn>.json` for beta.74 and beta.77. Other
+versions, including unknown versions, fail with `unsupported-version`. Resource
+metadata includes FQN, logical ID, type, status, and namespace parent. Action rows
+are validated and excluded. Stack output and temporary files are ignored. Missing
+state returns `available: false`; an existing empty stage returns an empty resource
+list with `available: true`. JSON names must match the stored FQN encoding.
+
+## SSO and S3
+
+`discoverSsoProfiles(configFile)` reads the explicitly supplied AWS config file.
+It resolves modern `sso_session` references and legacy inline SSO settings,
+including the default profile. Static keys, credential processes, assumed-role
+chains, and service sections are excluded. Missing config returns an empty list;
+incomplete or conflicting SSO configuration fails with a safe tagged reason.
+The executable will supply the local config path; this layer does not choose an
+ambient profile or execute login commands.
+
+`s3ReaderLayer(profile)` uses `ssoCredentialsLayer()` and an Effect `HttpClient`.
+Credentials come exclusively from the selected SSO identity and cached local
+session. There is no environment, static-key, instance-metadata, or process
+credential fallback. The SDK may refresh an existing SSO session in its local
+token cache. Credentials remain redacted in server memory and are used only for
+request signing. The profile supplies the SSO portal region; listed bucket regions
+route S3 requests. Object requests include the selected account as
+`ExpectedBucketOwner`. S3 transport tracing is disabled so private request URLs
+and signing headers cannot enter telemetry.
+
+`discoverS3Buckets()` paginates the selected account's owned buckets and selects
+names containing `alchemy-state`. A caller may supply another naming predicate
+or explicit server-private bucket locators. Listing owned buckets cannot discover
+every cross-account bucket that a role might be allowed to read. Denied access or
+expired sessions fail explicitly; they do not produce an empty account catalog.
+An API can report these failures per profile while continuing other profiles.
+
+`discoverS3Stacks(bucket)` recognizes `<optional-prefix><app>/<stage>/<encoded-fqn>.json`
+keys. `listS3Versions(bucket, prefix)` returns persisted object version coordinates
+and deletion markers. Both S3 continuation markers are retained; repeated markers
+fail. `readS3State(stack, alchemyVersion?)` reads each latest non-deleted resource
+using its listed version ID. Stack outputs and temporary files are excluded.
+`readS3Resource(stack, key, versionId)` reads one historical version after checking
+that the key belongs to that stack. JSON names must match the resource FQN.
+Latest deletion markers never resurrect an older resource. Null versions from
+unversioned or suspended buckets are supported. Multiple resource reads are not
+an atomic snapshot of a deployment.
+
+Remote state alone does not prove the installed Alchemy version or last successful
+deploy. Both remain `null` unless a matching lockfile supplies the version.
+Known beta.74/beta.77 resource shapes are validated even when remote version is
+unknown; an explicitly supplied unsupported version fails. The adapter imports
+only `ListBuckets`, `ListObjectVersions`, and `GetObject`. It never builds Alchemy's
+state-store layer, which can create or reconfigure buckets.
+
+Read-only IAM access needs `s3:ListAllMyBuckets`, `s3:ListBucketVersions`, and
+`s3:GetObjectVersion` for version-pinned reads. No write policy is required. See the AWS
+[version listing](https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectVersions.html)
+and [object reading](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html)
+references. No live AWS or Alchemy stack is used by the tests.
+
+The flat resource list retains namespace parents, including parents without their
+own resource row. A consumer can group these into a tree. Provider IDs, account,
+region, console links, and last deploy are currently `null`. Local file timestamps
+do not prove a successful deployment. Readers do not invent missing metadata.
+
+## Private data and redaction
+
+Discovered directories and entrypoints are server-private filesystem locators.
+Keep them in server memory; do not persist them to browser storage or emit them
+through HTTP, logs, telemetry, or public error messages. The normalized stack and
+resource summaries may cross an authenticated owner API boundary. They must never
+appear on unauthenticated routes or public telemetry.
+
+Persisted Alchemy state can contain plaintext secret payloads inside
+`__redacted__` marker objects. This package never invokes Alchemy's reviver or
+decrypts anything. It discards props, attrs, old state, action inputs, and outputs.
+Marker objects in metadata become `<redacted>`, including sibling fields. Parsing
+errors include only a tagged reason, never raw contents or parser diagnostics.
+Reads are capped at 8 MiB per file and directory listings at 50,000 entries.
+
+SSO profiles retain server-private names, config paths, account/role selectors,
+session names, start URLs, and routing regions. S3 bucket names, state prefixes,
+object keys, version IDs, and pagination markers are also server-private. Their
+persisted representation is AWS config or S3 object coordinates; console code
+holds them in server memory only. They must not cross HTTP, browser storage,
+logs, telemetry, or public errors. Only normalized `StackState` and
+`ResourceSummary` fields may cross the authenticated owner API. Credential-bearing
+`SsoCredentials` results remain solely inside the signing boundary. S3 reads have
+the same 8 MiB payload cap and a 50,000-entry / 100-page listing cap.
+
+Cloudflare profiles will also remain server-side. The UI will never apply or
+destroy. Plan diffs remain on demand, with no scheduled execution.
+
+## Format references
+
+Synthetic test states follow the pinned upstream
+[resource format](https://github.com/alchemy-run/alchemy/blob/v2.0.0-beta.77/packages/alchemy/src/State/ResourceState.ts),
+[local layout](https://github.com/alchemy-run/alchemy/blob/v2.0.0-beta.77/packages/alchemy/src/State/LocalState.ts),
+and [state encoding](https://github.com/alchemy-run/alchemy/blob/v2.0.0-beta.77/packages/alchemy/src/State/StateEncoding.ts).
+No real stack, account, bucket, credential, or project path is included in fixtures.
+
+Run `pnpm --filter @knpkv/alchemy-console test` for the focused fixture tests.
+Build workspace dependencies before the package's `check` script.

package/dist/discovery.d.ts

@@ -0,0 +1,12 @@
+import { Effect, FileSystem, Path, Schema } from "effect";
+import { StateReadError } from "./schema.js";
+/** Server-private paths. Retain only in memory; never emit to HTTP, browser storage, logs, or telemetry. */
+export declare const Project: Schema.Struct<{
+    readonly directory: Schema.String;
+    readonly entrypoint: Schema.String;
+}>;
+export interface Project extends Schema.Schema.Type<typeof Project> {
+}
+/** Read directory metadata only. No stack imports, evaluation, subprocesses, or credential reads. */
+export declare const discoverProjects: (directory: string) => Effect.Effect<Project[], StateReadError, FileSystem.FileSystem | Path.Path>;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C,4GAA4G;AAC5G,eAAO,MAAM,OAAO;;;EAAyE,CAAA;AAC7F,MAAM,WAAW,OAAQ,SAAQ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC;CAAG;AAItE,qGAAqG;AACrG,eAAO,MAAM,gBAAgB,oGAyB3B,CAAA"}

package/dist/discovery.js

@@ -0,0 +1,39 @@
+import { Effect, FileSystem, Path, Schema } from "effect";
+import { entries, stat, withinRoot } from "./internal/files.js";
+import { StateReadError } from "./schema.js";
+/** Server-private paths. Retain only in memory; never emit to HTTP, browser storage, logs, or telemetry. */
+export const Project = Schema.Struct({ directory: Schema.String, entrypoint: Schema.String });
+const excluded = new Set([".git", "node_modules", ".alchemy", ".direnv", ".cache", "dist"]);
+/** Read directory metadata only. No stack imports, evaluation, subprocesses, or credential reads. */
+export const discoverProjects = Effect.fn("AlchemyConsole.discoverProjects")(function* (directory) {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const root = yield* fs.realPath(directory).pipe(Effect.mapError(() => new StateReadError({ reason: "io" })));
+    const pending = [root];
+    const visited = new Set();
+    const projects = [];
+    while (pending.length > 0) {
+        const candidate = pending.pop();
+        if (candidate === undefined)
+            break;
+        const current = yield* withinRoot(root, candidate);
+        if (visited.has(current))
+            continue;
+        visited.add(current);
+        if (visited.size > 50_000)
+            return yield* new StateReadError({ reason: "limit" });
+        for (const name of yield* entries(current)) {
+            if (excluded.has(name))
+                continue;
+            const file = yield* withinRoot(root, path.join(current, name));
+            const info = yield* stat(file);
+            if (info.type === "Directory")
+                pending.push(file);
+            else if (name === "alchemy.run.ts" && info.type === "File") {
+                projects.push(Project.make({ directory: current, entrypoint: file }));
+            }
+        }
+    }
+    return projects.sort((a, b) => a.directory.localeCompare(b.directory));
+});
+//# sourceMappingURL=discovery.js.map

package/dist/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C,4GAA4G;AAC5G,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;AAG7F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAA;AAE3F,qGAAqG;AACrG,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC,EAAC,SAAiB;IACtG,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC5G,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,CAAA;IACtB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,MAAM,QAAQ,GAAmB,EAAE,CAAA;IACnC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;QAC/B,IAAI,SAAS,KAAK,SAAS;YAAE,MAAK;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAClD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAQ;QAClC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpB,IAAI,OAAO,CAAC,IAAI,GAAG,MAAM;YAAE,OAAO,KAAK,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;QAChF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;YAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;iBAC5C,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC3D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;AACxE,CAAC,CAAC,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+export { discoverProjects, Project } from "./discovery.js";
+export { readLocalState } from "./local-state.js";
+export { discoverSsoProfiles, SsoProfile, SsoProfileError } from "./profiles.js";
+export { s3ReaderLayer } from "./s3-live.js";
+export { S3Reader, S3ReadError } from "./s3-reader.js";
+export type { S3Bucket, S3BucketPage, S3Version, S3VersionPage, VersionCursor } from "./s3-reader.js";
+export { discoverS3Buckets, discoverS3Stacks, listS3Versions, readS3Resource, readS3State } from "./s3-state.js";
+export type { S3StackLocator } from "./s3-state.js";
+export { ResourceSummary, StackState, StateReadError } from "./schema.js";
+export { SsoCredentials, ssoCredentialsLayer } from "./sso-credentials.js";
+export type { SsoCredentialProviderFactory } from "./sso-credentials.js";
+export { decodeResource } from "./state.js";
+export { readAlchemyVersion } from "./version.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACtD,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AACrG,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAChH,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC1E,YAAY,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA"}

package/dist/index.js

@@ -0,0 +1,11 @@
+export { discoverProjects, Project } from "./discovery.js";
+export { readLocalState } from "./local-state.js";
+export { discoverSsoProfiles, SsoProfile, SsoProfileError } from "./profiles.js";
+export { s3ReaderLayer } from "./s3-live.js";
+export { S3Reader, S3ReadError } from "./s3-reader.js";
+export { discoverS3Buckets, discoverS3Stacks, listS3Versions, readS3Resource, readS3State } from "./s3-state.js";
+export { ResourceSummary, StackState, StateReadError } from "./schema.js";
+export { SsoCredentials, ssoCredentialsLayer } from "./sso-credentials.js";
+export { decodeResource } from "./state.js";
+export { readAlchemyVersion } from "./version.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAEtD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAEhH,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA"}

package/dist/internal/files.d.ts

@@ -0,0 +1,9 @@
+import { Effect, FileSystem, Path } from "effect";
+import { StateReadError } from "../schema.js";
+export declare const readText: (file: string) => Effect.Effect<string, StateReadError, FileSystem.FileSystem>;
+export declare const entries: (directory: string) => Effect.Effect<string[], StateReadError, FileSystem.FileSystem>;
+/** Resolve before inspecting a candidate; symlinks may not escape the caller's explicit root. */
+export declare const withinRoot: (root: string, candidate: string) => Effect.Effect<string, StateReadError, FileSystem.FileSystem | Path.Path>;
+export declare const exists: (file: string) => Effect.Effect<boolean, StateReadError, FileSystem.FileSystem>;
+export declare const stat: (file: string) => Effect.Effect<FileSystem.File.Info, StateReadError, FileSystem.FileSystem>;
+//# sourceMappingURL=files.d.ts.map

package/dist/internal/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/internal/files.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,eAAO,MAAM,QAAQ,gFAKnB,CAAA;AAEF,eAAO,MAAM,OAAO,uFAOlB,CAAA;AAEF,iGAAiG;AACjG,eAAO,MAAM,UAAU,+GASrB,CAAA;AAEF,eAAO,MAAM,MAAM,iFAGjB,CAAA;AAEF,eAAO,MAAM,IAAI,8FAGf,CAAA"}

package/dist/internal/files.js

@@ -0,0 +1,34 @@
+import { collectBoundedText } from "@knpkv/bounded-io";
+import { Effect, FileSystem, Path } from "effect";
+import { StateReadError } from "../schema.js";
+export const readText = Effect.fn("AlchemyConsole.readText")(function* (file) {
+    const fs = yield* FileSystem.FileSystem;
+    return yield* collectBoundedText(fs.stream(file), 8 * 1024 * 1024).pipe(Effect.mapError((error) => new StateReadError({ reason: error._tag === "ByteLimitExceeded" ? "limit" : "io" })));
+});
+export const entries = Effect.fn("AlchemyConsole.entries")(function* (directory) {
+    const fs = yield* FileSystem.FileSystem;
+    const names = yield* fs.readDirectory(directory).pipe(Effect.mapError(() => new StateReadError({ reason: "io" })));
+    if (names.length > 50_000)
+        return yield* new StateReadError({ reason: "limit" });
+    return names.sort();
+});
+/** Resolve before inspecting a candidate; symlinks may not escape the caller's explicit root. */
+export const withinRoot = Effect.fn("AlchemyConsole.withinRoot")(function* (root, candidate) {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const real = yield* fs.realPath(candidate).pipe(Effect.mapError(() => new StateReadError({ reason: "io" })));
+    const relative = path.relative(root, real);
+    if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        return yield* new StateReadError({ reason: "outside-root" });
+    }
+    return real;
+});
+export const exists = Effect.fn("AlchemyConsole.exists")(function* (file) {
+    const fs = yield* FileSystem.FileSystem;
+    return yield* fs.exists(file).pipe(Effect.mapError(() => new StateReadError({ reason: "io" })));
+});
+export const stat = Effect.fn("AlchemyConsole.stat")(function* (file) {
+    const fs = yield* FileSystem.FileSystem;
+    return yield* fs.stat(file).pipe(Effect.mapError(() => new StateReadError({ reason: "io" })));
+});
+//# sourceMappingURL=files.js.map

package/dist/internal/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/internal/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,QAAQ,CAAC,EAAC,IAAY;IACjF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IACvC,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,IAAI,CACrE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAChH,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,EAAC,SAAiB;IACpF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAC5D,CAAA;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;QAAE,OAAO,KAAK,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAChF,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;AACrB,CAAC,CAAC,CAAA;AAEF,iGAAiG;AACjG,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,EAAC,IAAY,EAAE,SAAiB;IACxG,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC5G,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC1C,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3F,OAAO,KAAK,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EAAC,IAAY;IAC7E,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IACvC,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;AACjG,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,EAAC,IAAY;IACzE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IACvC,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/F,CAAC,CAAC,CAAA"}

package/dist/local-state.d.ts

@@ -0,0 +1,8 @@
+import { Effect, FileSystem, Path } from "effect";
+import { type StackState, StateReadError } from "./schema.js";
+/** Reads .alchemy/state/<app>/<stage>/<encoded-fqn>.json. Missing state is distinct from an empty stage. */
+export declare const readLocalState: (directory: string, alchemyVersion: string | null) => Effect.Effect<{
+    available: boolean;
+    stacks: StackState[];
+}, StateReadError, FileSystem.FileSystem | Path.Path>;
+//# sourceMappingURL=local-state.d.ts.map

package/dist/local-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-state.d.ts","sourceRoot":"","sources":["../src/local-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAA;AAEjD,OAAO,EAAE,KAAK,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAG7D,4GAA4G;AAC5G,eAAO,MAAM,cAAc;;;qDA2CzB,CAAA"}

package/dist/local-state.js

@@ -0,0 +1,53 @@
+import { Effect, FileSystem, Path } from "effect";
+import { entries, exists, readText, stat, withinRoot } from "./internal/files.js";
+import { StateReadError } from "./schema.js";
+import { decodeResource } from "./state.js";
+/** Reads .alchemy/state/<app>/<stage>/<encoded-fqn>.json. Missing state is distinct from an empty stage. */
+export const readLocalState = Effect.fn("AlchemyConsole.readLocalState")(function* (directory, alchemyVersion) {
+    if (alchemyVersion !== "2.0.0-beta.74" && alchemyVersion !== "2.0.0-beta.77") {
+        return yield* new StateReadError({ reason: "unsupported-version" });
+    }
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const root = yield* fs.realPath(directory).pipe(Effect.mapError(() => new StateReadError({ reason: "io" })));
+    const candidate = path.join(root, ".alchemy", "state");
+    if (!(yield* exists(candidate)))
+        return { available: false, stacks: [] };
+    const stateRoot = yield* withinRoot(root, candidate);
+    const stacks = [];
+    for (const app of yield* entries(stateRoot)) {
+        const appDir = yield* withinRoot(stateRoot, path.join(stateRoot, app));
+        if ((yield* stat(appDir)).type !== "Directory")
+            continue;
+        for (const stage of yield* entries(appDir)) {
+            const stageDir = yield* withinRoot(appDir, path.join(appDir, stage));
+            if ((yield* stat(stageDir)).type !== "Directory")
+                continue;
+            const resources = [];
+            for (const name of yield* entries(stageDir)) {
+                if (!name.endsWith(".json") || name === "__stack_output__.json")
+                    continue;
+                const file = yield* withinRoot(stageDir, path.join(stageDir, name));
+                if ((yield* stat(file)).type !== "File")
+                    return yield* new StateReadError({ reason: "invalid-state" });
+                const resource = yield* decodeResource(yield* readText(file));
+                if (resource === null)
+                    continue;
+                if (name !== `${resource.fqn.replaceAll("/", "__")}.json`) {
+                    return yield* new StateReadError({ reason: "invalid-state" });
+                }
+                resources.push(resource);
+            }
+            stacks.push({
+                app,
+                stage,
+                backend: "local",
+                alchemyVersion,
+                lastDeploy: null,
+                resources: resources.sort((a, b) => a.fqn.localeCompare(b.fqn))
+            });
+        }
+    }
+    return { available: true, stacks };
+});
+//# sourceMappingURL=local-state.js.map

package/dist/local-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-state.js","sourceRoot":"","sources":["../src/local-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAmB,cAAc,EAAE,MAAM,aAAa,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,4GAA4G;AAC5G,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,QAAQ,CAAC,EAChF,SAAiB,EACjB,cAA6B;IAE7B,IAAI,cAAc,KAAK,eAAe,IAAI,cAAc,KAAK,eAAe,EAAE,CAAC;QAC7E,OAAO,KAAK,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC5G,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACtD,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACxE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACpD,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAA;QACtE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW;YAAE,SAAQ;QACxD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;YACpE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW;gBAAE,SAAQ;YAC1D,MAAM,SAAS,GAAG,EAAE,CAAA;YACpB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,uBAAuB;oBAAE,SAAQ;gBACzE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAA;gBACnE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM;oBAAE,OAAO,KAAK,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;gBACtG,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;gBAC7D,IAAI,QAAQ,KAAK,IAAI;oBAAE,SAAQ;gBAC/B,IAAI,IAAI,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC1D,OAAO,KAAK,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;gBAC/D,CAAC;gBACD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,GAAG;gBACH,KAAK;gBACL,OAAO,EAAE,OAAO;gBAChB,cAAc;gBACd,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;aAChE,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACpC,CAAC,CAAC,CAAA"}

package/dist/profiles.d.ts

@@ -0,0 +1,24 @@
+import { Effect, Schema } from "effect";
+/** Server-private SSO configuration. Keep every field in memory, out of HTTP, browser storage, logs and telemetry. */
+export declare const SsoProfile: Schema.Struct<{
+    readonly name: Schema.NonEmptyString;
+    readonly configFile: Schema.NonEmptyString;
+    readonly account: Schema.NonEmptyString;
+    readonly role: Schema.NonEmptyString;
+    readonly region: Schema.NonEmptyString;
+    readonly ssoRegion: Schema.NonEmptyString;
+    readonly startUrl: Schema.NonEmptyString;
+    readonly session: Schema.NullOr<Schema.NonEmptyString>;
+}>;
+export interface SsoProfile extends Schema.Schema.Type<typeof SsoProfile> {
+}
+declare const SsoProfileError_base: Schema.Class<SsoProfileError, Schema.TaggedStruct<"SsoProfileError", {
+    readonly reason: Schema.Literals<readonly ["io", "limit", "invalid-config"]>;
+}>, import("effect/Cause").YieldableError>;
+/** Safe reason only; SDK/parser diagnostics can contain private configuration. */
+export declare class SsoProfileError extends SsoProfileError_base {
+}
+/** Read only the supplied AWS config; skip static/process/role profiles and resolve modern or legacy SSO sections. */
+export declare const discoverSsoProfiles: (configFile: string) => Effect.Effect<SsoProfile[], SsoProfileError, import("effect/FileSystem").FileSystem>;
+export {};
+//# sourceMappingURL=profiles.d.ts.map

package/dist/profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../src/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAGvC,sHAAsH;AACtH,eAAO,MAAM,UAAU;;;;;;;;;EASrB,CAAA;AACF,MAAM,WAAW,UAAW,SAAQ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,UAAU,CAAC;CAAG;;;;AAE5E,kFAAkF;AAClF,qBAAa,eAAgB,SAAQ,oBAEnC;CAAG;AA2BL,sHAAsH;AACtH,eAAO,MAAM,mBAAmB,8GAkC9B,CAAA"}

package/dist/profiles.js

@@ -0,0 +1,82 @@
+import { Effect, Schema } from "effect";
+import { exists, readText } from "./internal/files.js";
+/** Server-private SSO configuration. Keep every field in memory, out of HTTP, browser storage, logs and telemetry. */
+export const SsoProfile = Schema.Struct({
+    name: Schema.NonEmptyString,
+    configFile: Schema.NonEmptyString,
+    account: Schema.NonEmptyString,
+    role: Schema.NonEmptyString,
+    region: Schema.NonEmptyString,
+    ssoRegion: Schema.NonEmptyString,
+    startUrl: Schema.NonEmptyString,
+    session: Schema.NullOr(Schema.NonEmptyString)
+});
+/** Safe reason only; SDK/parser diagnostics can contain private configuration. */
+export class SsoProfileError extends Schema.TaggedError()("SsoProfileError", {
+    reason: Schema.Literals(["io", "limit", "invalid-config"])
+}) {
+}
+/** Select only SSO fields; static keys and commands are discarded while parsing. */
+const parseSections = Effect.fnUntraced(function* (text) {
+    const sections = new Map();
+    let fields;
+    for (const line of text.split(/\r?\n/)) {
+        const trimmed = line.split(/(^|\s)[;#]/)[0]?.trim() ?? "";
+        if (trimmed.length === 0)
+            continue;
+        if (trimmed.startsWith("[")) {
+            const match = /^\[([^\]]+)\]$/.exec(trimmed);
+            if (match?.[1] === undefined || match[1].length === 0) {
+                return yield* new SsoProfileError({ reason: "invalid-config" });
+            }
+            const name = match[1].trim().replace(/^(profile|sso-session)\s+["']?([^"']+)["']?$/, "$1.$2");
+            fields = sections.get(name) ?? new Map();
+            sections.set(name, fields);
+            continue;
+        }
+        const equals = trimmed.indexOf("=");
+        if (fields === undefined || equals <= 0)
+            continue;
+        const key = trimmed.slice(0, equals).trim();
+        if (key === "region" || key.startsWith("sso_"))
+            fields.set(key, trimmed.slice(equals + 1).trim());
+    }
+    return new Map([...sections].map(([name, fields]) => [name, Object.fromEntries(fields)]));
+});
+/** Read only the supplied AWS config; skip static/process/role profiles and resolve modern or legacy SSO sections. */
+export const discoverSsoProfiles = Effect.fn("AlchemyConsole.discoverSsoProfiles")(function* (configFile) {
+    const present = yield* exists(configFile).pipe(Effect.mapError(() => new SsoProfileError({ reason: "io" })));
+    if (!present)
+        return [];
+    const text = yield* readText(configFile).pipe(Effect.mapError((error) => new SsoProfileError({ reason: error.reason === "limit" ? "limit" : "io" })));
+    const ini = yield* parseSections(text);
+    const profiles = [];
+    for (const [section, fields] of ini) {
+        if (section !== "default" && !section.startsWith("profile."))
+            continue;
+        if (!Object.keys(fields).some((key) => key.startsWith("sso_")))
+            continue;
+        const session = fields.sso_session === undefined ? undefined : ini.get(`sso-session.${fields.sso_session}`);
+        if (fields.sso_session !== undefined && session === undefined) {
+            return yield* new SsoProfileError({ reason: "invalid-config" });
+        }
+        const ssoRegion = session?.sso_region ?? fields.sso_region;
+        const startUrl = session?.sso_start_url ?? fields.sso_start_url;
+        if ((fields.sso_region !== undefined && fields.sso_region !== ssoRegion) ||
+            (fields.sso_start_url !== undefined && fields.sso_start_url !== startUrl))
+            return yield* new SsoProfileError({ reason: "invalid-config" });
+        const profile = yield* Schema.decodeUnknownEffect(SsoProfile)({
+            name: section === "default" ? section : section.slice("profile.".length),
+            configFile,
+            account: fields.sso_account_id,
+            role: fields.sso_role_name,
+            region: fields.region ?? ssoRegion,
+            ssoRegion,
+            startUrl,
+            session: fields.sso_session ?? null
+        }).pipe(Effect.mapError(() => new SsoProfileError({ reason: "invalid-config" })));
+        profiles.push(profile);
+    }
+    return profiles.sort((a, b) => a.name.localeCompare(b.name));
+});
+//# sourceMappingURL=profiles.js.map

package/dist/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../src/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAEtD,sHAAsH;AACtH,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC,cAAc;IAC3B,UAAU,EAAE,MAAM,CAAC,cAAc;IACjC,OAAO,EAAE,MAAM,CAAC,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAC,cAAc;IAC3B,MAAM,EAAE,MAAM,CAAC,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC,cAAc;IAChC,QAAQ,EAAE,MAAM,CAAC,cAAc;IAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;CAC9C,CAAC,CAAA;AAGF,kFAAkF;AAClF,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,WAAW,EAAmB,CAAC,iBAAiB,EAAE;IAC5F,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;CAC3D,CAAC;CAAG;AAEL,oFAAoF;AACpF,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAC,IAAY;IAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAA;IACvD,IAAI,MAAuC,CAAA;IAC3C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAClC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC5C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtD,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,8CAA8C,EAAE,OAAO,CAAC,CAAA;YAC7F,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAkB,CAAA;YACxD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAC1B,SAAQ;QACV,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,CAAC;YAAE,SAAQ;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACnG,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;AAC3F,CAAC,CAAC,CAAA;AAEF,sHAAsH;AACtH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,oCAAoC,CAAC,CAAC,QAAQ,CAAC,EAAC,UAAkB;IAC7G,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC5G,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CACvG,CAAA;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAQ;QACtE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAAE,SAAQ;QACxE,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;QAC3G,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,EAAE,UAAU,IAAI,MAAM,CAAC,UAAU,CAAA;QAC1D,MAAM,QAAQ,GAAG,OAAO,EAAE,aAAa,IAAI,MAAM,CAAC,aAAa,CAAA;QAC/D,IACE,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC;YACpE,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC;YACzE,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACjE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC5D,IAAI,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;YACxE,UAAU;YACV,OAAO,EAAE,MAAM,CAAC,cAAc;YAC9B,IAAI,EAAE,MAAM,CAAC,aAAa;YAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;YAClC,SAAS;YACT,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;SACpC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAA;QACjF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;AAC9D,CAAC,CAAC,CAAA"}

package/dist/s3-live.d.ts

@@ -0,0 +1,8 @@
+import { Layer } from "effect";
+import * as HttpClient from "effect/http/HttpClient";
+import type { SsoProfile } from "./profiles.js";
+import { S3Reader } from "./s3-reader.js";
+import { SsoCredentials } from "./sso-credentials.js";
+/** Independent read-only adapter. ExpectedBucketOwner binds requests to the selected SSO account. */
+export declare const s3ReaderLayer: (profile: SsoProfile) => Layer.Layer<S3Reader, never, HttpClient.HttpClient | SsoCredentials>;
+//# sourceMappingURL=s3-live.d.ts.map

package/dist/s3-live.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-live.d.ts","sourceRoot":"","sources":["../src/s3-live.ts"],"names":[],"mappings":"AAcA,OAAO,EAAU,KAAK,EAAa,MAAM,QAAQ,CAAA;AACjD,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAA;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAiB,QAAQ,EAAmD,MAAM,gBAAgB,CAAA;AACzG,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAsBrD,qGAAqG;AACrG,eAAO,MAAM,aAAa,YAAa,UAAU,yEAqH9C,CAAA"}

package/dist/s3-live.js

@@ -0,0 +1,111 @@
+import { Credentials } from "@distilled.cloud/aws/Credentials";
+import { Region } from "@distilled.cloud/aws/Region";
+import { getObject, listBuckets, listObjectVersions } from "@distilled.cloud/aws/s3";
+import { collectBoundedText } from "@knpkv/bounded-io";
+import { Effect, Layer, Predicate } from "effect";
+import * as HttpClient from "effect/http/HttpClient";
+import { S3Reader, S3ReadError } from "./s3-reader.js";
+import { SsoCredentials } from "./sso-credentials.js";
+import { decodeResource } from "./state.js";
+const providerError = (error) => {
+    if (error._tag === "S3ReadError")
+        return error;
+    const tag = error._tag === "UnknownAwsError" ? error.errorTag : error._tag;
+    if (tag === "AccessDenied" || tag === "AccessDeniedException") {
+        return new S3ReadError({ reason: "denied" });
+    }
+    if (["NoSuchKey", "NoSuchVersion", "NoSuchBucket"].includes(tag))
+        return new S3ReadError({ reason: "not-found" });
+    if (["ExpiredToken", "ExpiredTokenException", "InvalidToken", "InvalidAccessKeyId", "SignatureDoesNotMatch"].includes(tag)) {
+        return new S3ReadError({ reason: "authentication" });
+    }
+    return new S3ReadError({ reason: "provider" });
+};
+/** Independent read-only adapter. ExpectedBucketOwner binds requests to the selected SSO account. */
+export const s3ReaderLayer = (profile) => Layer.effect(S3Reader, Effect.gen(function* () {
+    const client = yield* HttpClient.HttpClient;
+    const sso = yield* SsoCredentials;
+    const call = Effect.fn("AlchemyConsole.callS3")(function* (effect, region) {
+        const credentials = yield* sso.resolve(profile);
+        return yield* effect.pipe(Effect.provideService(Credentials, Effect.succeed(credentials)), Effect.provideService(Region, Effect.succeed(region)), Effect.provideService(HttpClient.HttpClient, client), 
+        // S3 request URLs contain server-private bucket, key and version locators.
+        Effect.provideService(HttpClient.TracerDisabledWhen, () => true), Effect.timeoutOrElse({
+            duration: "30 seconds",
+            orElse: () => Effect.fail(new S3ReadError({ reason: "provider" }))
+        }), Effect.mapError(providerError));
+    });
+    return S3Reader.of({
+        buckets: Effect.fn("AlchemyConsole.listS3Buckets")(function* (cursor) {
+            const request = { MaxBuckets: 1000 };
+            if (cursor !== null)
+                request.ContinuationToken = cursor;
+            const page = yield* call(listBuckets(request), profile.region);
+            const buckets = [];
+            for (const bucket of page.Buckets ?? []) {
+                if (bucket.Name === undefined || bucket.Name.length === 0 || bucket.BucketRegion === undefined ||
+                    bucket.BucketRegion.length === 0)
+                    return yield* new S3ReadError({ reason: "invalid-response" });
+                buckets.push({ name: bucket.Name, region: bucket.BucketRegion });
+            }
+            return { buckets, next: page.ContinuationToken ?? null };
+        }),
+        versions: Effect.fn("AlchemyConsole.listS3Versions")(function* (bucket, prefix, cursor) {
+            const request = {
+                Bucket: bucket.name,
+                ExpectedBucketOwner: profile.account,
+                Prefix: prefix,
+                MaxKeys: 1000
+            };
+            if (cursor !== null) {
+                request.KeyMarker = cursor.key;
+                if (cursor.versionId !== null)
+                    request.VersionIdMarker = cursor.versionId;
+            }
+            const page = yield* call(listObjectVersions(request), bucket.region);
+            const versions = [];
+            const groups = [
+                { rows: page.Versions ?? [], deleted: false },
+                { rows: page.DeleteMarkers ?? [], deleted: true }
+            ];
+            for (const { deleted, rows } of groups) {
+                for (const row of rows) {
+                    if (row.Key === undefined || row.Key.length === 0 || row.VersionId === undefined ||
+                        row.VersionId.length === 0 || row.IsLatest === undefined) {
+                        return yield* new S3ReadError({ reason: "invalid-response" });
+                    }
+                    versions.push({ key: row.Key, versionId: row.VersionId, latest: row.IsLatest, deleted });
+                }
+            }
+            if (page.IsTruncated === undefined ||
+                (page.IsTruncated && (page.NextKeyMarker === undefined || page.NextKeyMarker.length === 0))) {
+                return yield* new S3ReadError({ reason: "invalid-response" });
+            }
+            return {
+                versions,
+                next: page.IsTruncated === true ?
+                    {
+                        key: page.NextKeyMarker ?? "",
+                        versionId: page.NextVersionIdMarker ?? null
+                    } :
+                    null
+            };
+        }),
+        resource: Effect.fn("AlchemyConsole.getS3Resource")(function* (bucket, key, versionId) {
+            const result = yield* call(getObject({
+                Bucket: bucket.name,
+                ExpectedBucketOwner: profile.account,
+                Key: key,
+                VersionId: versionId
+            }), bucket.region);
+            if ((result.VersionId ?? "null") !== versionId || result.DeleteMarker === true || result.Body === undefined) {
+                return yield* new S3ReadError({ reason: "invalid-response" });
+            }
+            const text = yield* collectBoundedText(result.Body, 8 * 1024 * 1024).pipe(Effect.mapError((error) => new S3ReadError({ reason: Predicate.isTagged(error, "ByteLimitExceeded") ? "limit" : "provider" })), Effect.timeoutOrElse({
+                duration: "30 seconds",
+                orElse: () => Effect.fail(new S3ReadError({ reason: "provider" }))
+            }));
+            return yield* decodeResource(text);
+        })
+    });
+}));
+//# sourceMappingURL=s3-live.js.map