@samebase/alchemy-convex 0.1.0 → 0.3.0

package/lib/index.js

@@ -1,11 +1,1412 @@
-// @samebase/alchemy-convex: Convex resources for Alchemy v2.
-export { ACCESS_TOKEN_ENV, Credentials, CredentialsError, fromConfig, fromToken, } from "./Credentials.js";
-export { DefaultEnvironmentVariable, } from "./DefaultEnvironmentVariable.js";
-export { Deploy, deployArgs, parseDeployOutput, } from "./Deploy.js";
-export { DeployKey, } from "./DeployKey.js";
-export { EnvironmentVariable, } from "./EnvironmentVariable.js";
-export { ConvexApiError, ManagementApi } from "./ManagementApi.js";
-export { PreviewDeployKey, } from "./PreviewDeployKey.js";
-export { Project, } from "./Project.js";
-export { Providers, providers } from "./Providers.js";
+import { createRequire } from "node:module";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { stripVTControlCharacters } from "node:util";
+import { Resource } from "alchemy";
+import { AdoptPolicy, OwnedBySomeoneElse, Unowned } from "alchemy/AdoptPolicy";
+import * as Provider from "alchemy/Provider";
+import * as Clock from "effect/Clock";
+import * as Effect from "effect/Effect";
+import * as ChildProcess from "effect/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
+import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import { AlchemyContext } from "alchemy/AlchemyContext";
+import { Stack } from "alchemy/Stack";
+import * as Option from "effect/Option";
+import { havePropsChanged, isResolved } from "alchemy/Diff";
+import { createDeploymentClient, createManagementClient } from "@convex-dev/platform";
+import * as Context from "effect/Context";
+import * as Layer from "effect/Layer";
+import * as Schedule from "effect/Schedule";
+import * as Config from "effect/Config";
+import { CommandExecutor, CommandExecutorLive } from "alchemy/Command";
+import { hashDirectory } from "alchemy/Command/Memo";
+import { createHash } from "node:crypto";
+//#region src/Adoption.ts
+/** True when the resource `fqn` may take over an object that is not in state. */
+const shouldAdopt = (fqn) => Effect.gen(function* () {
+	const stack = yield* Effect.serviceOption(Stack);
+	const own = Option.isSome(stack) ? stack.value.resources[fqn]?.Adopt : void 0;
+	if (own !== void 0) return own;
+	const policy = yield* Effect.serviceOption(AdoptPolicy);
+	if (Option.isSome(policy)) return policy.value;
+	const context = yield* Effect.serviceOption(AlchemyContext);
+	return Option.isSome(context) && context.value.adopt;
+});
+//#endregion
+//#region src/Credentials.ts
+var Credentials = class extends Context.Service()("@samebase/alchemy-convex/Credentials") {};
+/** Environment variable read by {@link fromConfig}. */
+const ACCESS_TOKEN_ENV = "CONVEX_ACCESS_TOKEN";
+/** The Convex CLI stores its device login here after `npx convex login`. */
+const convexCliConfigPath = () => join(homedir(), ".convex", "config.json");
+const CliConfig = Schema.Struct({ accessToken: Schema.String });
+/**
+* Token the Convex CLI saved on this machine. It works on the Management API
+* for the teams the logged-in user belongs to. Fails when nobody is logged in.
+*/
+const readConvexCliLogin = Effect.gen(function* () {
+	const path = convexCliConfigPath();
+	const text = yield* Effect.tryPromise({
+		try: () => readFile(path, "utf8"),
+		catch: () => new CredentialsError({ reason: `no Convex CLI login at ${path}` })
+	});
+	const parsed = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(CliConfig))(text).pipe(Effect.mapError(() => new CredentialsError({ reason: `${path} has no accessToken` })));
+	return {
+		accessToken: Redacted.make(parsed.accessToken),
+		source: "convex-cli-login"
+	};
+});
+var CredentialsError = class extends Schema.TaggedError()("CredentialsError", { reason: Schema.String }) {};
+/**
+* Default resolution: `CONVEX_ACCESS_TOKEN` from the stack ConfigProvider
+* (process env, `.env`, stack secrets), then the Convex CLI login on this
+* machine. CI sets the variable; a developer who ran `npx convex login` needs
+* nothing.
+*/
+const fromConfig = () => Layer.succeed(Credentials, Effect.cached(Config.Redacted(ACCESS_TOKEN_ENV).pipe(Effect.map((accessToken) => ({
+	accessToken,
+	source: "env"
+})), Effect.catch(() => readConvexCliLogin), Effect.orDie)).pipe(Effect.flatten));
+/** Explicit token, for tests or callers that already hold a value. */
+const fromToken = (accessToken) => Layer.succeed(Credentials, Effect.succeed({
+	accessToken,
+	source: "explicit"
+}));
+//#endregion
+//#region src/ManagementApi.ts
+/**
+* One error for every control-plane and deployment call. Resources branch on
+* `status` (404 means absent for read and delete), so the class is load
+* bearing, not decorative.
+*/
+var ConvexApiError = class extends Schema.TaggedError()("ConvexApiError", {
+	operation: Schema.String,
+	status: Schema.Number,
+	code: Schema.optionalKey(Schema.String),
+	message: Schema.String
+}) {};
+const ErrorBody = Schema.Struct({
+	code: Schema.optionalKey(Schema.String),
+	message: Schema.optionalKey(Schema.String)
+});
+const toApiError = (operation, result) => {
+	const body = Schema.decodeUnknownSync(Schema.NullishOr(ErrorBody))(result.error ?? null);
+	const code = body?.code;
+	return new ConvexApiError({
+		operation,
+		status: result.response.status,
+		...code === void 0 ? {} : { code },
+		message: body?.message ?? `${operation} failed with HTTP ${result.response.status}`
+	});
+};
+/** The part of a Convex token after the first "|", or the whole value when it has none. */
+const tokenPart = (value) => value.slice(value.indexOf("|") + 1);
+var ManagementApi = class extends Context.Service()("@samebase/alchemy-convex/ManagementApi") {};
+const attempt = (operation, run) => Effect.tryPromise({
+	try: run,
+	catch: (cause) => new ConvexApiError({
+		operation,
+		status: 0,
+		message: cause instanceof Error ? cause.message : String(cause)
+	})
+});
+/** Reads `data` or fails with the HTTP status and the API's own code and message. */
+const settle = (operation, run) => attempt(operation, run).pipe(Effect.flatMap((result) => result.response.ok && result.data !== void 0 ? Effect.succeed(result.data) : Effect.fail(toApiError(operation, result))));
+/** For endpoints that answer with an empty body, such as delete calls. */
+const settleVoid = (operation, run) => attempt(operation, run).pipe(Effect.flatMap((result) => result.response.ok ? Effect.void : Effect.fail(toApiError(operation, result))));
+/**
+* True when an idempotent write can succeed on a new attempt:
+*
+* - A Convex write conflict. Two parallel update_environment_variables calls
+*   on one deployment gave HTTP 503 `OptimisticConcurrencyControlFailure`,
+*   "Data read or written in this mutation changed while it was being run",
+*   in a live run. The platform codes `OCC` and `WriteConflict` and the
+*   message "... changed while this mutation was being run ..." mean the same.
+* - Any other 5xx answer. Two parallel delete_preview_deploy_key calls on one
+*   project gave HTTP 500 `InternalServerError`, "Your request couldn't be
+*   completed. Try again later.", in a live run. The next attempt succeeded.
+*/
+const isRetryableWriteError = (error) => error.code === "OptimisticConcurrencyControlFailure" || error.code === "OCC" || error.code === "WriteConflict" || /changed while (it|this mutation) was being run/.test(error.message) || error.status >= 500;
+/**
+* Runs an idempotent write again after a retryable Convex error: at most
+* four more attempts, with exponential backoff from 100 ms and jitter. Other
+* errors fail at once, and so does the last retryable error. Use it only for
+* a write that has the same result when it runs twice, such as setting a
+* value or deleting by id. Never for a create that does not check first.
+*/
+const retryIdempotentWrite = (effect) => effect.pipe(Effect.retry({
+	while: (error) => error instanceof ConvexApiError && isRetryableWriteError(error),
+	times: 4,
+	schedule: Schedule.exponential("100 millis").pipe(Schedule.jittered)
+}));
+/** Turns a 404 into `undefined` so read and delete stay idempotent. */
+const absentAsUndefined = (effect) => effect.pipe(Effect.catchIf((error) => error.status === 404, () => Effect.succeed(void 0)));
+const TeamRow = Schema.Struct({
+	id: Schema.Number,
+	slug: Schema.String
+});
+const TeamRows = Schema.Array(TeamRow);
+const ManagementApiLive = () => Layer.effect(ManagementApi, Effect.gen(function* () {
+	const credentials = yield* Credentials;
+	const client = Effect.cached(credentials.pipe(Effect.map((resolved) => createManagementClient(Redacted.value(resolved.accessToken))))).pipe(Effect.flatten);
+	const request = (operation, run) => client.pipe(Effect.flatMap((c) => settle(operation, () => run(c))));
+	const requestVoid = (operation, run) => client.pipe(Effect.flatMap((c) => settleVoid(operation, () => run(c))));
+	const deploymentRequest = (operation, deploymentUrlOrName, deployKey, run) => settle(operation, () => run(createDeploymentClient(deploymentUrlOrName, Redacted.value(deployKey))));
+	const resolveTeamId = (team) => Effect.gen(function* () {
+		if (typeof team === "number") return team;
+		if (/^\d+$/.test(team)) return Number(team);
+		const resolved = yield* credentials;
+		const match = (yield* Effect.tryPromise({
+			try: async () => {
+				const response = await fetch("https://api.convex.dev/api/dashboard/teams", { headers: { Authorization: `Bearer ${Redacted.value(resolved.accessToken)}` } });
+				if (!response.ok) throw new Error(`team lookup for "${team}" failed with HTTP ${response.status}`);
+				return Schema.decodeUnknownSync(TeamRows)(await response.json());
+			},
+			catch: (cause) => new ConvexApiError({
+				operation: "resolve team",
+				status: 0,
+				message: cause instanceof Error ? cause.message : String(cause)
+			})
+		})).find((row) => row.slug === team);
+		if (match === void 0) return yield* new ConvexApiError({
+			operation: "resolve team",
+			status: 404,
+			message: `no team with slug "${team}" for this token`
+		});
+		return match.id;
+	});
+	const isCredentialToken = (secret) => credentials.pipe(Effect.map((resolved) => tokenPart(Redacted.value(resolved.accessToken)) === tokenPart(secret)));
+	return {
+		request,
+		requestVoid,
+		deploymentRequest,
+		resolveTeamId,
+		isCredentialToken
+	};
+}));
+//#endregion
+//#region src/Deployment.ts
+const Deployment = Resource("Convex.Deployment", { defaultRemovalPolicy: "retain" });
+/** The props name another deployment than the one in state. */
+var DeploymentIdentityChange = class extends Schema.TaggedError()("DeploymentIdentityChange", {
+	/** Name of the deployment in state, such as `happy-animal-123`. */
+	deployment: Schema.String,
+	field: Schema.Literals([
+		"projectId",
+		"type",
+		"name"
+	]),
+	current: Schema.String,
+	requested: Schema.String
+}) {
+	get message() {
+		return `Convex.Deployment cannot change the ${this.field} of deployment ${this.deployment} from ${this.current} to ${this.requested}. Set ${this.field} back to ${this.current}. For another deployment, create a new resource with a new logical id.`;
+	}
+};
+/** The project has no default production deployment for a `prod` resource to take over. */
+var ProductionDeploymentNotFound = class extends Schema.TaggedError()("ProductionDeploymentNotFound", { projectId: Schema.Number }) {
+	get message() {
+		return `Project ${this.projectId} has no default production deployment, and Convex.Deployment does not create one. Create it in the Convex dashboard, or with \`npx convex deployment create --type prod --default\` in the project, then run the deploy again.`;
+	}
+};
+/** More than one deployment of the project has the name, so the lookup cannot choose one. */
+var AmbiguousDeployment = class extends Schema.TaggedError()("AmbiguousDeployment", {
+	projectId: Schema.Number,
+	type: Schema.Literals(["dev", "preview"]),
+	name: Schema.String,
+	deployments: Schema.Array(Schema.String)
+}) {
+	get message() {
+		return `Project ${this.projectId} has ${this.deployments.length} ${this.type} deployments named "${this.name}" (${this.deployments.join(", ")}). Convex.Deployment does not choose one. Delete the extra deployments in the Convex dashboard, or use another name.`;
+	}
+};
+/**
+* The URL of a Convex cloud deployment: `https://<name>.convex.cloud`, or
+* `https://<name>.<region>.convex.cloud` outside US East.
+*/
+const CLOUD_URL = /^https:\/\/[a-z0-9]+(?:-[a-z0-9]+)*(?:\.[a-z0-9]+(?:-[a-z0-9]+)*)?\.convex\.cloud$/;
+/**
+* The HTTP actions URL of a deployment: the client URL with `.convex.site`
+* for `.convex.cloud`, as Convex sets CONVEX_SITE_URL. Custom domains are
+* not covered.
+*/
+const siteUrlOf = (url) => url.replace(/\.convex\.cloud$/, ".convex.site");
+/** One row of list_deployments, GET /deployments/{name}, and create_deployment. Only the fields the provider uses. */
+const DeploymentRow$1 = Schema.Struct({
+	name: Schema.String,
+	projectId: Schema.Number,
+	deploymentType: Schema.String,
+	isDefault: Schema.Boolean,
+	reference: Schema.String,
+	/** Set in list_deployments and create_deployment rows only: GET /deployments/{name} answers null. */
+	previewIdentifier: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	deploymentUrl: Schema.String.check(Schema.isPattern(CLOUD_URL))
+});
+const DeploymentRows$1 = Schema.Array(DeploymentRow$1);
+const attributesOf = (row, type, previewName) => ({
+	projectId: row.projectId,
+	type,
+	name: row.name,
+	reference: row.reference,
+	previewName: type === "preview" ? previewName : void 0,
+	url: row.deploymentUrl,
+	siteUrl: siteUrlOf(row.deploymentUrl)
+});
+/** The `name` prop of the deployment in state: the dev reference or the preview name. */
+const nameOf = (attributes) => attributes.type === "dev" ? attributes.reference : attributes.type === "preview" ? attributes.previewName : void 0;
+/**
+* Fails with {@link DeploymentIdentityChange} when the props name another
+* deployment than `current`: the attributes in state, or a live row.
+*/
+const checkIdentity$2 = (current, news) => {
+	const change = (field, from, to) => Effect.fail(new DeploymentIdentityChange({
+		deployment: current.name,
+		field,
+		current: from,
+		requested: to
+	}));
+	if (current.projectId !== news.projectId) return change("projectId", String(current.projectId), String(news.projectId));
+	if (current.type !== news.type) return change("type", current.type, news.type);
+	const currentName = nameOf(current);
+	if (news.type !== "prod" && currentName !== news.name) return change("name", currentName ?? "(none)", news.name);
+	return Effect.void;
+};
+const DeploymentProvider = () => Provider.effect(Deployment, Effect.gen(function* () {
+	const api = yield* ManagementApi;
+	/** The live deployment, or undefined after a 404. GET /deployments/{name} answers no preview identifier. */
+	const getByName = (name) => absentAsUndefined(api.request("get deployment", (client) => client.GET("/deployments/{deployment_name}", { params: { path: { deployment_name: name } } }))).pipe(Effect.map((body) => body === void 0 ? void 0 : Schema.decodeUnknownSync(DeploymentRow$1)(body)));
+	const listDeployments = (projectId, type, isDefault) => api.request("list deployments", (client) => client.GET("/projects/{project_id}/list_deployments", { params: {
+		path: { project_id: projectId },
+		query: {
+			deploymentType: type,
+			...isDefault === void 0 ? {} : { isDefault }
+		}
+	} })).pipe(Effect.map((body) => Schema.decodeUnknownSync(DeploymentRows$1)(body)));
+	/** The project's default production deployment, or undefined. */
+	const production = (projectId) => listDeployments(projectId, "prod", true).pipe(Effect.map((rows) => {
+		const row = rows.find((candidate) => candidate.deploymentType === "prod" && candidate.isDefault);
+		return row === void 0 ? void 0 : attributesOf(row, "prod", void 0);
+	}));
+	/**
+	* The one dev deployment with this reference, or the one preview
+	* deployment with this preview name, or undefined.
+	*/
+	const findByName = (projectId, type, name) => Effect.gen(function* () {
+		const matches = (yield* listDeployments(projectId, type)).filter((row) => row.deploymentType === type && (type === "dev" ? row.reference === name : row.previewIdentifier === name));
+		if (matches.length > 1) return yield* new AmbiguousDeployment({
+			projectId,
+			type,
+			name,
+			deployments: matches.map((row) => row.name)
+		});
+		return matches[0];
+	});
+	/** The deployment that the props name, for a resource without state. */
+	const lookup = (news) => news.type === "prod" ? production(news.projectId) : findByName(news.projectId, news.type, news.name).pipe(Effect.map((row) => row === void 0 ? void 0 : attributesOf(row, news.type, news.name)));
+	return {
+		stables: [
+			"projectId",
+			"type",
+			"previewName"
+		],
+		diff: Effect.fn(function* ({ news, output }) {
+			if (!isResolved(news) || output === void 0) return void 0;
+			yield* checkIdentity$2(output, news);
+			if (news.type === "prod") return (yield* absentAsUndefined(production(news.projectId)))?.name === output.name ? void 0 : { action: "update" };
+			return (yield* getByName(output.name)) === void 0 ? { action: "update" } : void 0;
+		}),
+		read: Effect.fn(function* ({ olds, output }) {
+			if (output?.type === "prod") return yield* absentAsUndefined(production(output.projectId));
+			if (output !== void 0) {
+				const live = yield* getByName(output.name);
+				return live === void 0 ? void 0 : attributesOf(live, output.type, output.previewName);
+			}
+			const found = yield* lookup(olds);
+			if (found === void 0) return void 0;
+			return olds.type === "prod" ? found : Unowned(found);
+		}),
+		reconcile: Effect.fn(function* ({ fqn, news, output }) {
+			if (output !== void 0) yield* checkIdentity$2(output, news);
+			if (news.type === "prod") {
+				const current = yield* production(news.projectId);
+				if (current === void 0) return yield* new ProductionDeploymentNotFound({ projectId: news.projectId });
+				return current;
+			}
+			if (output !== void 0) {
+				const live = yield* getByName(output.name);
+				if (live !== void 0) {
+					if (live.deploymentType !== output.type) return yield* new DeploymentIdentityChange({
+						deployment: live.name,
+						field: "type",
+						current: live.deploymentType,
+						requested: news.type
+					});
+					const current = attributesOf(live, output.type, output.previewName);
+					yield* checkIdentity$2(current, news);
+					return current;
+				}
+			}
+			const existing = yield* lookup(news);
+			if (existing !== void 0) {
+				if (!(yield* shouldAdopt(fqn))) return yield* new OwnedBySomeoneElse({
+					message: `Project ${news.projectId} already has ${news.type} deployment ${existing.name} named "${news.name}". Re-run with --adopt to take it over, or use another name.`,
+					resourceType: Deployment.Type,
+					physicalName: existing.name
+				});
+				return existing;
+			}
+			const created = yield* api.request("create deployment", (client) => client.POST("/projects/{project_id}/create_deployment", {
+				params: { path: { project_id: news.projectId } },
+				body: {
+					type: news.type,
+					reference: news.name
+				}
+			}));
+			return attributesOf(Schema.decodeUnknownSync(DeploymentRow$1)(created), news.type, news.name);
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			const keep = Effect.logWarning(`Convex.Deployment does not delete production deployment ${output.name}: it belongs to project ${output.projectId}. To delete it, delete the project with RemovalPolicy.destroy() on Convex.Project.`);
+			if (output.type === "prod") return yield* keep;
+			const live = yield* getByName(output.name);
+			if (live === void 0) return;
+			if (live.deploymentType === "prod") return yield* keep;
+			yield* absentAsUndefined(retryIdempotentWrite(api.requestVoid("delete deployment", (client) => client.POST("/deployments/{deployment_name}/delete", { params: { path: { deployment_name: output.name } } }))));
+		})
+	};
+}));
+//#endregion
+//#region src/EnvironmentVariable.ts
+/**
+* The variable's identity when the listing has `name`. Own keys only: a
+* valid variable name such as `toString` must not match the object prototype.
+*/
+const findVariable = (list, deployment, name) => Object.hasOwn(list.environmentVariables, name) ? {
+	deployment,
+	name
+} : void 0;
+/**
+* One attempt to set variables, or to remove those whose `value` is null, in
+* one call. The deployment answers 200 with an empty body, so this reads no
+* response data.
+*/
+const writeVariables = (deployment, deployKey, changes) => settleVoid("update environment variables", () => createDeploymentClient(deployment, Redacted.value(deployKey)).POST("/update_environment_variables", { body: { changes: changes.map(({ name, value }) => ({
+	name,
+	value: Redacted.isRedacted(value) ? Redacted.value(value) : value
+})) } }));
+/** One attempt to set one variable, or to remove it when `value` is null. */
+const writeVariable = (deployment, deployKey, name, value) => writeVariables(deployment, deployKey, [{
+	name,
+	value
+}]);
+/**
+* Sets one variable, or removes it when `value` is null. The call sets a
+* value, so it runs again after a write conflict or a 5xx answer, for example
+* when another resource writes a variable of the same deployment at the same
+* time. Use it only where the variable is already ours to set.
+*/
+const updateVariable = (deployment, deployKey, name, value) => retryIdempotentWrite(writeVariable(deployment, deployKey, name, value));
+/** GET https://<deployment>.convex.cloud/api/v1/list_environment_variables */
+const EnvironmentVariableList = Schema.Struct({ environmentVariables: Schema.Record(Schema.String, Schema.String) });
+/** Every variable of the deployment with its value. Fails with a 404 when the deployment is gone. */
+const listVariables = (deployment, deployKey) => settle("list environment variables", () => createDeploymentClient(deployment, Redacted.value(deployKey)).GET("/list_environment_variables")).pipe(Effect.map((body) => Schema.decodeUnknownSync(EnvironmentVariableList)(body).environmentVariables));
+/** The variable's identity, or undefined when the variable or the deployment is absent. */
+const readVariable = (api, deployment, deployKey, name) => absentAsUndefined(api.deploymentRequest("list environment variables", deployment, deployKey, (client) => client.GET("/list_environment_variables"))).pipe(Effect.map((body) => body === void 0 ? void 0 : findVariable(Schema.decodeUnknownSync(EnvironmentVariableList)(body), deployment, name)));
+const EnvironmentVariable = Resource("Convex.EnvironmentVariable");
+/**
+* The props name another variable than the one in state. Used by
+* Convex.EnvironmentVariable and Convex.DefaultEnvironmentVariable.
+*/
+var VariableIdentityChange = class extends Schema.TaggedError()("VariableIdentityChange", {
+	resourceType: Schema.String,
+	field: Schema.Literals([
+		"name",
+		"deployment",
+		"projectId",
+		"deploymentType"
+	]),
+	current: Schema.String,
+	requested: Schema.String
+}) {
+	get message() {
+		return `${this.resourceType} cannot change its ${this.field} from ${this.current} to ${this.requested}. Create a new resource with a new logical id for the new name or deployment, and remove this one.`;
+	}
+};
+/** Fails with {@link VariableIdentityChange} when the props name another variable than the one in state. */
+const checkIdentity$1 = (output, news) => output.name !== news.name ? Effect.fail(new VariableIdentityChange({
+	resourceType: EnvironmentVariable.Type,
+	field: "name",
+	current: output.name,
+	requested: news.name
+})) : output.deployment !== news.deployment ? Effect.fail(new VariableIdentityChange({
+	resourceType: EnvironmentVariable.Type,
+	field: "deployment",
+	current: output.deployment,
+	requested: news.deployment
+})) : Effect.void;
+/**
+* The deploy key for the variable in state: from the attributes, or, for
+* state from 0.1.x, from props that name the same deployment.
+*/
+const keyOf = (output, olds) => output.deployKey ?? (olds?.deployment === output.deployment ? olds.deployKey : void 0);
+const EnvironmentVariableProvider = () => Provider.effect(EnvironmentVariable, Effect.gen(function* () {
+	const api = yield* ManagementApi;
+	return {
+		diff: Effect.fn(function* ({ news, output }) {
+			if (!isResolved(news) || output === void 0) return void 0;
+			yield* checkIdentity$1(output, news);
+		}),
+		read: Effect.fn(function* ({ olds, output }) {
+			if (output !== void 0) {
+				const key = keyOf(output, olds);
+				if (key === void 0) return output;
+				return (yield* readVariable(api, output.deployment, key, output.name)) === void 0 ? void 0 : output;
+			}
+			const found = yield* readVariable(api, olds.deployment, olds.deployKey, olds.name);
+			return found === void 0 ? void 0 : Unowned({
+				...found,
+				deployKey: olds.deployKey
+			});
+		}),
+		reconcile: Effect.fn(function* ({ fqn, news, output }) {
+			if (output !== void 0) yield* checkIdentity$1(output, news);
+			const write = writeVariable(news.deployment, news.deployKey, news.name, news.value);
+			if (output !== void 0 || (yield* shouldAdopt(fqn))) yield* retryIdempotentWrite(write);
+			else yield* retryIdempotentWrite(Effect.gen(function* () {
+				if ((yield* readVariable(api, news.deployment, news.deployKey, news.name)) !== void 0) return yield* new OwnedBySomeoneElse({
+					message: `Environment variable ${news.name} already exists on deployment ${news.deployment}. Re-run with --adopt to take it over and overwrite its value, or use a different name.`,
+					resourceType: EnvironmentVariable.Type,
+					physicalName: news.name
+				});
+				yield* write;
+			}));
+			return {
+				deployment: news.deployment,
+				name: news.name,
+				deployKey: news.deployKey
+			};
+		}),
+		delete: Effect.fn(function* ({ olds, output }) {
+			const key = keyOf(output, olds);
+			if (key === void 0) {
+				yield* Effect.logWarning(`Environment variable ${output.name} on deployment ${output.deployment} stays: Alchemy has no deploy key for that deployment. Remove it in the Convex dashboard.`);
+				return;
+			}
+			yield* absentAsUndefined(updateVariable(output.deployment, key, output.name, null));
+		})
+	};
+}));
+//#endregion
+//#region src/Code.ts
+const Code = Resource("Convex.Code");
+/**
+* The CLI prints this line with `logFinishedStep` after the push succeeds, to
+* stderr (convex 1.46 `cli/lib/deploy2.js` for existing deployments,
+* `cli/deploy.js` for preview deployments). The host is
+* `<deployment>.convex.cloud` or `<deployment>.<region>.convex.cloud`.
+*/
+const DEPLOYED_LINE = /Deployed Convex functions to (https:\/\/([a-z0-9]+(?:-[a-z0-9]+)*)(?:\.[a-z0-9]+(?:-[a-z0-9]+)*)?\.convex\.cloud)\/?(?=\s|$)/m;
+/** Reads the deployment URL from `convex deploy` output. ANSI escape codes are removed first. */
+const parseDeployOutput = (text) => {
+	const match = DEPLOYED_LINE.exec(stripVTControlCharacters(text));
+	const url = match?.[1];
+	const deploymentName = match?.[2];
+	return url === void 0 || deploymentName === void 0 ? void 0 : {
+		url,
+		deploymentName
+	};
+};
+/**
+* What a deploy key targets, from its prefix: `<type>:<deployment>|<secret>`
+* (or `<deployment>|<secret>` in old keys) for one deployment,
+* `preview:<team>:<project>|<secret>` for preview deployments of a project,
+* `project:<team>:<project>|<secret>` for the project's production
+* deployment. Same rules as convex 1.46 `cli/lib/deployment.js`.
+*/
+const keyTargetOf = (key) => {
+	const bar = key.indexOf("|");
+	if (bar <= 0 || /[\s#'"`]/.test(key)) return { kind: "unknown" };
+	const parts = key.slice(0, bar).split(":");
+	const [first, second] = parts;
+	if (parts.length === 3 && first === "preview") return { kind: "preview" };
+	if (parts.length === 3 && first === "project") return { kind: "project" };
+	if (parts.length === 2 && second) return {
+		kind: "deployment",
+		deployment: second
+	};
+	if (parts.length === 1 && first) return {
+		kind: "deployment",
+		deployment: first
+	};
+	return { kind: "unknown" };
+};
+/** The deploy key does not fit the deployment. Checked before the push. */
+var DeployKeyMismatch = class extends Schema.TaggedError()("DeployKeyMismatch", {
+	/** The deployment that should receive the push. */
+	deployment: Schema.String,
+	/** What the key targets. */
+	key: Schema.Literals([
+		"deployment",
+		"preview",
+		"project",
+		"unknown"
+	]),
+	/** For a deployment key: the deployment in the key prefix. Never the secret. */
+	keyDeployment: Schema.UndefinedOr(Schema.String)
+}) {
+	get message() {
+		switch (this.key) {
+			case "deployment": return `The deploy key is for deployment ${this.keyDeployment}, not for ${this.deployment}. Pass a deploy key of ${this.deployment}, such as Convex.DeployKey with deployment ${this.deployment}.`;
+			case "preview": return `A preview deploy key pushes to a preview deployment by its preview name, and ${this.deployment} is not a Convex.Deployment of type "preview". Pass the Convex.Deployment preview resource as deployment, or a deploy key of ${this.deployment}.`;
+			case "project": return `Convex.Code does not take a project deploy key: it cannot check before the push that the key targets ${this.deployment}. Pass a deploy key of ${this.deployment} (Convex.DeployKey).`;
+			case "unknown": return `deployKey is not a Convex deploy key ("<type>:<deployment>|<secret>" or "preview:<team>:<project>|<secret>"). Pass Convex.DeployKey(...).deployKey or Convex.PreviewDeployKey(...).previewDeployKey.`;
+		}
+	}
+};
+/** `env` needs the deployment API, which takes only a deploy key of the deployment. */
+var EnvironmentNeedsDeployKey = class extends Schema.TaggedError()("EnvironmentNeedsDeployKey", { deployment: Schema.String }) {
+	get message() {
+		return `Convex.Code cannot set or remove env variables on ${this.deployment} with a preview deploy key: the deployment API takes only a deploy key of the deployment. Pass a Convex.DeployKey of ${this.deployment}, or use Convex.DefaultEnvironmentVariable with deploymentType "preview" for values that every new preview deployment gets.`;
+	}
+};
+/** No `convex` package resolves from `cwd`. */
+var ConvexCliNotFound = class extends Schema.TaggedError()("ConvexCliNotFound", { cwd: Schema.String }) {
+	get message() {
+		return `Convex.Code found no installed convex package from ${this.cwd}, and it does not download one. Install convex in the app (npm install convex), set cwd to the app directory, or set the command prop.`;
+	}
+};
+/** The Convex CLI failed, or exited 0 without the deployment URL. The output tail never contains the key. */
+var CodePushFailed = class extends Schema.TaggedError()("CodePushFailed", {
+	/** Exit code of the CLI. Undefined when it did not start or a signal stopped it. */
+	exitCode: Schema.UndefinedOr(Schema.Number),
+	/** The last lines of the CLI output, with the deploy key removed. */
+	outputTail: Schema.String
+}) {
+	get message() {
+		return this.exitCode === 0 ? `convex deploy exited 0 but printed no "Deployed Convex functions to <url>" line, so Convex.Code has no deployment URL. Last output, with the deploy key removed:\n${this.outputTail}` : `convex deploy failed${this.exitCode === void 0 ? "" : ` with exit code ${this.exitCode}`}. Last output, with the deploy key removed:\n${this.outputTail}`;
+	}
+};
+/** The CLI pushed to another deployment than the one in the props. Checked after the push. */
+var PushTargetMismatch = class extends Schema.TaggedError()("PushTargetMismatch", {
+	expected: Schema.String,
+	actual: Schema.String
+}) {
+	get message() {
+		return `The Convex CLI pushed the functions to deployment ${this.actual}, but Convex.Code expected ${this.expected}. With a preview deploy key, this happens when the key belongs to another project, or when the preview deployment ${this.expected} expired during the deploy and the CLI created ${this.actual} for the same preview name. Check the key. After an expiry, run the deploy again with --adopt, so that Convex.Deployment takes over ${this.actual}.`;
+	}
+};
+/**
+* Checks that the key fits the deployment, and returns the preview name for
+* `--preview-name` when the key is a preview deploy key.
+*/
+const previewNameFor = (target, keyTarget, changesEnvironment) => {
+	const mismatch = new DeployKeyMismatch({
+		deployment: target.name,
+		key: keyTarget.kind,
+		keyDeployment: keyTarget.kind === "deployment" ? keyTarget.deployment : void 0
+	});
+	switch (keyTarget.kind) {
+		case "deployment": return keyTarget.deployment === target.name ? Effect.succeed(void 0) : Effect.fail(mismatch);
+		case "preview":
+			if (target.type !== "preview" || target.previewName === void 0) return Effect.fail(mismatch);
+			return changesEnvironment ? Effect.fail(new EnvironmentNeedsDeployKey({ deployment: target.name })) : Effect.succeed(target.previewName);
+		case "project":
+		case "unknown": return Effect.fail(mismatch);
+		default: return keyTarget;
+	}
+};
+/** The last non-empty lines of `text`, without escape codes and with every secret replaced. */
+const outputTail = (text, secrets) => secrets.reduce((redacted, secret) => redacted.split(secret).join("[REDACTED]"), stripVTControlCharacters(text)).split(/\r?\n|\r/).filter((line) => line.trim() !== "").slice(-20).join("\n");
+const CliManifest = Schema.Struct({ bin: Schema.Union([Schema.String, Schema.Record(Schema.String, Schema.String)]) });
+/** `[node, <convex bin>]` for the `convex` package that `cwd` resolves. Never downloads. */
+const installedCli = (cwd) => Effect.tryPromise({
+	try: async () => {
+		const manifestPath = createRequire(join(cwd, "package.json")).resolve("convex/package.json");
+		const { bin } = Schema.decodeUnknownSync(Schema.fromJsonString(CliManifest))(await readFile(manifestPath, "utf8"));
+		const entry = typeof bin === "string" ? bin : bin["convex"];
+		if (entry === void 0) throw new Error("the convex package has no convex bin");
+		return [process.execPath, resolve(dirname(manifestPath), entry)];
+	},
+	catch: () => new ConvexCliNotFound({ cwd })
+});
+/**
+* Runs `use` with an env file that holds the key, in a new temporary
+* directory, and removes the directory afterwards: on success, on failure,
+* and on interruption.
+*/
+const withKeyFile = (key, use) => Effect.acquireUseRelease(Effect.promise(() => mkdtemp(join(tmpdir(), "alchemy-convex-"))), (home) => Effect.promise(() => writeFile(join(home, "deploy.env"), `CONVEX_DEPLOY_KEY=${key}\n`, { mode: 384 })).pipe(Effect.andThen(use({
+	envFile: join(home, "deploy.env"),
+	home
+}))), (home) => Effect.promise(() => rm(home, {
+	recursive: true,
+	force: true
+})));
+/**
+* The environment of the CLI: this process's variables without `CONVEX_*`,
+* with `home` as the home directory.
+*/
+const cliEnvironment = (home) => ({
+	...Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.toUpperCase().startsWith("CONVEX_"))),
+	HOME: home,
+	USERPROFILE: home,
+	XDG_CONFIG_HOME: home
+});
+const CodeProvider = () => Provider.effect(Code, Effect.gen(function* () {
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	/** Runs the CLI with piped output. Interruption stops its process group. */
+	const run = (argv, cwd, home) => Effect.gen(function* () {
+		const [command, ...args] = argv;
+		const child = yield* spawner.spawn(ChildProcess.make(command, args, {
+			cwd,
+			env: cliEnvironment(home),
+			extendEnv: false,
+			stdin: "ignore",
+			stdout: "pipe",
+			stderr: "pipe"
+		}));
+		const [exitCode, stdout, stderr] = yield* Effect.all([
+			child.exitCode,
+			Stream.mkString(Stream.decodeText(child.stdout)),
+			Stream.mkString(Stream.decodeText(child.stderr))
+		], { concurrency: "unbounded" });
+		return {
+			exitCode: Number(exitCode),
+			output: `${stdout}\n${stderr}`
+		};
+	}).pipe(Effect.scoped);
+	return {
+		diff: () => Effect.succeed({ action: "update" }),
+		reconcile: Effect.fn(function* ({ fqn, news, output }) {
+			const target = typeof news.deployment === "string" ? {
+				name: news.deployment,
+				address: news.deployment,
+				type: void 0,
+				previewName: void 0
+			} : {
+				...news.deployment,
+				address: news.deployment.url
+			};
+			const key = Redacted.value(news.deployKey);
+			const secrets = [key, key.slice(key.indexOf("|") + 1)].filter((secret) => secret.length >= 8);
+			const env = Object.entries(news.env ?? {}).sort(([a], [b]) => a < b ? -1 : 1);
+			const previous = output !== void 0 && output.deploymentName === target.name ? output.envNames : [];
+			const removed = previous.filter((name) => !env.some(([envName]) => envName === name));
+			const previewName = yield* previewNameFor(target, keyTargetOf(key), env.length > 0 || removed.length > 0);
+			const cwd = resolve(news.cwd);
+			const program = news.command ?? (yield* installedCli(cwd));
+			if (env.length > 0 || removed.length > 0) {
+				const adopt = yield* shouldAdopt(fqn);
+				const fresh = env.filter(([name]) => !previous.includes(name));
+				yield* retryIdempotentWrite(Effect.gen(function* () {
+					if (fresh.length > 0 && !adopt) {
+						const current = yield* listVariables(target.address, news.deployKey);
+						const taken = fresh.filter(([name, value]) => Object.hasOwn(current, name) && current[name] !== (Redacted.isRedacted(value) ? Redacted.value(value) : value)).map(([name]) => name);
+						if (taken.length > 0) return yield* new OwnedBySomeoneElse({
+							message: `Environment variables ${taken.join(", ")} already exist on deployment ${target.name} with other values. Re-run with --adopt to take them over and overwrite them, or remove them from env.`,
+							resourceType: Code.Type,
+							physicalName: target.name
+						});
+					}
+					yield* writeVariables(target.address, news.deployKey, [...env.map(([name, value]) => ({
+						name,
+						value
+					})), ...removed.map((name) => ({
+						name,
+						value: null
+					}))]);
+				}));
+			}
+			const args = [
+				"deploy",
+				...previewName === void 0 ? [] : ["--preview-name", previewName],
+				...news.typecheck === void 0 ? [] : [`--typecheck=${news.typecheck}`],
+				...news.codegen === void 0 ? [] : [`--codegen=${news.codegen}`]
+			];
+			const result = yield* withKeyFile(key, ({ envFile, home }) => run([
+				...program,
+				...args,
+				"--env-file",
+				envFile
+			], cwd, home)).pipe(Effect.mapError((error) => new CodePushFailed({
+				exitCode: void 0,
+				outputTail: outputTail(error.message, secrets)
+			})));
+			const deployed = parseDeployOutput(result.output);
+			if (result.exitCode !== 0 || deployed === void 0) return yield* new CodePushFailed({
+				exitCode: result.exitCode,
+				outputTail: outputTail(result.output, secrets)
+			});
+			if (deployed.deploymentName !== target.name) return yield* new PushTargetMismatch({
+				expected: target.name,
+				actual: deployed.deploymentName
+			});
+			return {
+				deploymentName: deployed.deploymentName,
+				url: deployed.url,
+				siteUrl: siteUrlOf(deployed.url),
+				deployedAt: yield* Clock.currentTimeMillis,
+				envNames: env.map(([name]) => name)
+			};
+		}),
+		delete: () => Effect.void
+	};
+}));
+//#endregion
+//#region src/DefaultEnvironmentVariable.ts
+/**
+* Attributes when the listing has `name` for `deploymentType`. An unfiltered
+* listing merges the deployment types that share one value into one row, so
+* the match checks membership in `deploymentTypes`.
+*/
+const findDefault = (list, projectId, name, deploymentType) => list.items.some((item) => item.name === name && item.deploymentTypes.includes(deploymentType)) ? {
+	projectId,
+	name,
+	deploymentType
+} : void 0;
+/**
+* Lists the defaults named `name` for `deploymentType`. Convex filters on
+* both, so the listing has at most one row and needs no pagination.
+*/
+const listDefaults = (api, projectId, name, deploymentType) => api.request("list default environment variables", (client) => client.GET("/projects/{project_id}/list_default_environment_variables", { params: {
+	path: { project_id: projectId },
+	query: {
+		name,
+		deploymentType
+	}
+} })).pipe(Effect.map((body) => Schema.decodeUnknownSync(DefaultEnvironmentVariableList)(body)));
+/** One attempt to set one default, or to remove it when `value` is null. */
+const writeDefault = (api, projectId, name, deploymentType, value) => api.requestVoid("update default environment variables", (client) => client.POST("/projects/{project_id}/update_default_environment_variables", {
+	params: { path: { project_id: projectId } },
+	body: { changes: [{
+		name,
+		deploymentType,
+		value: Redacted.isRedacted(value) ? Redacted.value(value) : value
+	}] }
+}));
+/**
+* Sets one default, or removes it when `value` is null. Convex answers 200
+* with an empty body, so this reads no response data. The call sets a value,
+* so it runs again after a write conflict or a 5xx answer, for example when
+* another resource writes a default of the same project at the same time.
+*/
+const updateDefault = (api, projectId, name, deploymentType, value) => retryIdempotentWrite(writeDefault(api, projectId, name, deploymentType, value));
+/** The default's identity, or undefined when the default or the project is absent. */
+const readDefault = (api, projectId, name, deploymentType) => absentAsUndefined(listDefaults(api, projectId, name, deploymentType)).pipe(Effect.map((list) => list === void 0 ? void 0 : findDefault(list, projectId, name, deploymentType)));
+/**
+* GET /projects/{project_id}/list_default_environment_variables. Only the
+* fields the provider uses: the row's `value` is the secret in plain text.
+*/
+const DefaultEnvironmentVariableList = Schema.Struct({ items: Schema.Array(Schema.Struct({
+	name: Schema.String,
+	deploymentTypes: Schema.Array(Schema.String)
+})) });
+const DefaultEnvironmentVariable = Resource("Convex.DefaultEnvironmentVariable");
+/** Fails with VariableIdentityChange when the props name another default than the one in state. */
+const checkIdentity = (output, news) => {
+	const changed = output.projectId !== news.projectId ? {
+		field: "projectId",
+		current: `${output.projectId}`,
+		requested: `${news.projectId}`
+	} : output.name !== news.name ? {
+		field: "name",
+		current: output.name,
+		requested: news.name
+	} : output.deploymentType !== news.deploymentType ? {
+		field: "deploymentType",
+		current: output.deploymentType,
+		requested: news.deploymentType
+	} : void 0;
+	return changed === void 0 ? Effect.void : Effect.fail(new VariableIdentityChange({
+		resourceType: DefaultEnvironmentVariable.Type,
+		...changed
+	}));
+};
+const DefaultEnvironmentVariableProvider = () => Provider.effect(DefaultEnvironmentVariable, Effect.gen(function* () {
+	const api = yield* ManagementApi;
+	return {
+		diff: Effect.fn(function* ({ news, output }) {
+			if (!isResolved(news) || output === void 0) return void 0;
+			yield* checkIdentity(output, news);
+		}),
+		read: Effect.fn(function* ({ olds, output }) {
+			const at = output ?? olds;
+			const found = yield* readDefault(api, at.projectId, at.name, at.deploymentType);
+			if (found === void 0) return void 0;
+			return output ?? Unowned(found);
+		}),
+		reconcile: Effect.fn(function* ({ fqn, news, output }) {
+			if (output !== void 0) yield* checkIdentity(output, news);
+			const write = writeDefault(api, news.projectId, news.name, news.deploymentType, news.value);
+			if (output !== void 0 || (yield* shouldAdopt(fqn))) yield* retryIdempotentWrite(write);
+			else yield* retryIdempotentWrite(Effect.gen(function* () {
+				if ((yield* readDefault(api, news.projectId, news.name, news.deploymentType)) !== void 0) return yield* new OwnedBySomeoneElse({
+					message: `Project ${news.projectId} already has a ${news.deploymentType} default environment variable ${news.name}. Re-run with --adopt to take it over and overwrite its value, or use a different name.`,
+					resourceType: DefaultEnvironmentVariable.Type,
+					physicalName: news.name
+				});
+				yield* write;
+			}));
+			return {
+				projectId: news.projectId,
+				name: news.name,
+				deploymentType: news.deploymentType
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* absentAsUndefined(updateDefault(api, output.projectId, output.name, output.deploymentType, null));
+		})
+	};
+}));
+//#endregion
+//#region src/Deploy.ts
+/**
+* @deprecated Since 0.3.0. Use Convex.Code with a Convex.Deployment: it
+* runs the installed Convex CLI, keeps the deploy key out of the process
+* environment, checks that the key fits the deployment, and outputs the site
+* URL. Removing a Deploy resource changes nothing in Convex.
+*/
+const Deploy = Resource("Convex.Deploy");
+/** The `convex deploy` argv, starting with `npx`. */
+const deployArgs = (props) => [
+	"npx",
+	"convex",
+	"deploy",
+	...props.previewName === void 0 ? [] : ["--preview-name", props.previewName],
+	...props.previewCreate === void 0 ? [] : ["--preview-create", props.previewCreate],
+	...props.previewRun === void 0 ? [] : ["--preview-run", props.previewRun],
+	...props.extraArgs ?? []
+];
+/** A `convex deploy` argument contains whitespace, which Alchemy's command runner splits on. */
+var DeployArgumentError = class extends Schema.TaggedError()("DeployArgumentError", { argument: Schema.String }) {
+	get message() {
+		return `Convex.Deploy argument "${this.argument}" contains whitespace, and Alchemy splits the command on whitespace. Use the --flag=value form, such as --typecheck=disable, and names without spaces.`;
+	}
+};
+/** `npx convex deploy` exited 0 but did not print the deployment URL. */
+var DeployOutputError = class extends Schema.TaggedError()("DeployOutputError", { outputTail: Schema.String }) {
+	get message() {
+		return `npx convex deploy exited 0 but printed no "Deployed Convex functions to <url>" line, so Convex.Deploy has no deployment URL. Remove --dry-run from extraArgs if it is there, and read the CLI output. Last output:\n${this.outputTail}`;
+	}
+};
+const DeployProvider = () => Provider.effect(Deploy, Effect.gen(function* () {
+	const { run } = yield* CommandExecutor;
+	const hashOf = (props) => props.memo === false ? Effect.succeed(void 0) : hashDirectory({
+		...props.cwd === void 0 ? {} : { cwd: props.cwd },
+		memo: props.memo === true || props.memo === void 0 ? {} : props.memo
+	});
+	return {
+		diff: Effect.fn(function* ({ olds, news, output }) {
+			if (!isResolved(news)) return void 0;
+			if (news.previewName !== void 0 || news.previewCreate !== void 0 || output === void 0 || output.hash === void 0 || havePropsChanged(olds, news)) return { action: "update" };
+			return { action: (yield* hashOf(news)) === output.hash ? "noop" : "update" };
+		}),
+		reconcile: Effect.fn(function* ({ news, session }) {
+			const args = deployArgs(news);
+			const spaced = args.find((arg) => /\s/.test(arg));
+			if (spaced !== void 0) return yield* new DeployArgumentError({ argument: spaced });
+			const { stdout, stderr } = yield* run({
+				command: args.join(" "),
+				...news.cwd === void 0 ? {} : { cwd: news.cwd },
+				...news.timeout === void 0 ? {} : { timeout: news.timeout },
+				env: {
+					...news.env,
+					CONVEX_DEPLOY_KEY: news.deployKey
+				}
+			}, session);
+			const output = `${stdout}\n${stderr}`;
+			const deployed = parseDeployOutput(output);
+			if (deployed === void 0) return yield* new DeployOutputError({ outputTail: stripVTControlCharacters(output).split(/\r?\n|\r/).filter((line) => line.trim() !== "").slice(-20).join("\n") });
+			return {
+				...deployed,
+				hash: yield* hashOf(news)
+			};
+		}),
+		delete: () => Effect.void
+	};
+}));
+//#endregion
+//#region src/DeployKey.ts
+/**
+* True when `listedName` is how Convex lists a key created as `name`: the
+* requested name itself, or the requested name, a space, and one
+* parenthesized suffix without spaces. The suffix check keeps `my-key` from
+* matching a key created as `my-key (old)`.
+*/
+const isListedAs = (listedName, name) => {
+	const prefix = `${name} (`;
+	return listedName === name || listedName.startsWith(prefix) && /^[^\s()]+\)$/.test(listedName.slice(prefix.length));
+};
+/**
+* True when the listing still has the key in state: by numeric id, or by
+* listed name for state written by 0.1.x, which has no id.
+*/
+const isKeyListed = (entries, key) => entries.some((entry) => key.keyId === void 0 ? entry.name === key.uniqueName : entry.id === key.keyId);
+/** The listed keys that Convex shows for a key created as `name`. */
+const keysListedAs = (entries, name) => entries.filter((entry) => isListedAs(entry.name, name));
+/**
+* The name that a resource instance requests: `name`, a dash, and the first
+* 12 hex characters of sha256("<fqn>:<instanceId>"). Two resources, or the
+* old and the new generation of one replaced resource, never request the
+* same name. Pattern from Confect `packages/alchemy/src/internal/ResourceIdentity.ts`
+* (https://github.com/rjdellecese/confect, ISC license).
+*/
+const requestedKeyName = (name, fqn, instanceId) => `${name}-${createHash("sha256").update(`${fqn}:${instanceId}`).digest("hex").slice(0, 12)}`;
+/** One row of list_deploy_keys and list_preview_deploy_keys. Only the fields the providers use. */
+const ListedKey = Schema.Struct({
+	id: Schema.Number,
+	name: Schema.String
+});
+/** GET /deployments/{deployment_name}/list_deploy_keys */
+const DeployKeyList = Schema.Array(ListedKey);
+/** POST /deployments/{deployment_name}/create_deploy_key */
+const CreatedDeployKey = Schema.Struct({ deployKey: Schema.String });
+/**
+* A key cannot be tied to one resource: before the create, listed keys
+* already have the requested name, or after the create, not exactly one has it.
+*/
+var DeployKeyRecoveryRequired = class extends Schema.TaggedError()("DeployKeyRecoveryRequired", {
+	/** Where the keys live, such as `deployment happy-otter-123` or `project 3145389`. */
+	target: Schema.String,
+	/** The requested name. */
+	name: Schema.String,
+	/** The listed keys with the requested name. */
+	keys: Schema.Array(ListedKey),
+	/** True when this run created a key before the listing check failed. */
+	afterCreate: Schema.Boolean
+}) {
+	get message() {
+		const listed = this.keys.length === 0 ? "no key" : this.keys.map((key) => `"${key.name}" (id ${key.id})`).join(", ");
+		return this.afterCreate ? `Convex created deploy key "${this.name}" on ${this.target}, but the listing shows ${listed} with that name, not exactly one, so this resource cannot track the new key. Alchemy does not revoke it. Delete the keys with that name in the Convex dashboard, then run the deploy again.` : `${this.target} already lists ${listed} with the name "${this.name}", but Alchemy state has no such key. An interrupted run probably created it, and its secret is lost. Delete these keys in the Convex dashboard, then run the deploy again.`;
+	}
+};
+/**
+* Convex returned the Management API credential itself as the new key. This
+* happens with an OAuth token: Convex creates no key. A delete of the
+* returned secret would revoke the credential, so the resource does not keep it.
+*/
+var DeployKeyIsCredential = class extends Schema.TaggedError()("DeployKeyIsCredential", {
+	target: Schema.String,
+	name: Schema.String
+}) {
+	get message() {
+		return `Convex returned the Management API credential itself as deploy key "${this.name}" on ${this.target}. With an OAuth token, Convex creates no new key, and deleting the returned key would revoke the OAuth token. Alchemy does not keep it. Use a team access token in CONVEX_ACCESS_TOKEN, or the Convex CLI login.`;
+	}
+};
+/**
+* Creates a key named `name` and ties it to the caller. Fails before the
+* create when keys with that name already exist. After the create, fails
+* when the secret is the Management API credential itself, or when the
+* listing does not show exactly one key with that name. It never revokes a
+* key: the returned secret can be a shared credential.
+*/
+const createTrackedKey = (options) => Effect.gen(function* () {
+	const { target, name } = options;
+	const existing = keysListedAs(yield* options.list, name);
+	if (existing.length > 0) return yield* new DeployKeyRecoveryRequired({
+		target,
+		name,
+		keys: existing,
+		afterCreate: false
+	});
+	const secret = yield* options.create;
+	if (yield* options.isCredentialToken(secret)) return yield* new DeployKeyIsCredential({
+		target,
+		name
+	});
+	const listed = keysListedAs(yield* options.list, name);
+	const [only] = listed;
+	if (only === void 0 || listed.length !== 1) return yield* new DeployKeyRecoveryRequired({
+		target,
+		name,
+		keys: listed,
+		afterCreate: true
+	});
+	return {
+		keyId: only.id,
+		uniqueName: only.name,
+		secret: Redacted.make(secret)
+	};
+});
+/**
+* The secret to send to a delete call, or undefined when a delete is not
+* safe. Only a key with a `keyId` in state is known to be a new key that
+* this resource owns: createTrackedKey found exactly one new listed key, and
+* the secret was not the credential. State from 0.1.x has no `keyId`, and its
+* secret can be an OAuth token that Convex returned as a key, so a delete
+* could revoke that OAuth token. Such a key stays, and a warning names it.
+*/
+const secretToDelete = (key, label) => Effect.gen(function* () {
+	if (key.keyId === void 0 || !Redacted.isRedacted(key.secret)) {
+		yield* Effect.logWarning(`${label} has no verified key id and secret in state (state from 0.1.x, for example), so Alchemy does not delete it. Delete it in the Convex dashboard.`);
+		return;
+	}
+	return Redacted.value(key.secret);
+});
+const DeployKey = Resource("Convex.DeployKey");
+const DeployKeyProvider = () => Provider.effect(DeployKey, Effect.gen(function* () {
+	const api = yield* ManagementApi;
+	const listKeys = (deployment) => api.request("list deploy keys", (client) => client.GET("/deployments/{deployment_name}/list_deploy_keys", { params: { path: { deployment_name: deployment } } })).pipe(Effect.map((body) => Schema.decodeUnknownSync(DeployKeyList)(body)));
+	/**
+	* `id` is the secret: Convex accepts it, and it matches only the key
+	* that this resource created. A second delete answers 404.
+	*/
+	const deleteKey = (deployment, secret) => retryIdempotentWrite(api.requestVoid("delete deploy key", (client) => client.POST("/deployments/{deployment_name}/delete_deploy_key", {
+		params: { path: { deployment_name: deployment } },
+		body: { id: secret }
+	})));
+	return {
+		stables: ["uniqueName", "deployment"],
+		diff: ({ olds, news, output }) => {
+			if (!isResolved(news)) return Effect.succeed(void 0);
+			return Effect.succeed(output !== void 0 && output.deployKey === void 0 || havePropsChanged(olds, news) ? { action: "replace" } : { action: "noop" });
+		},
+		read: Effect.fn(function* ({ output }) {
+			if (output === void 0) return void 0;
+			const entries = yield* absentAsUndefined(listKeys(output.deployment));
+			return entries !== void 0 && isKeyListed(entries, output) ? output : void 0;
+		}),
+		reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
+			if (output !== void 0) {
+				if (isKeyListed(yield* listKeys(news.deployment), output)) return output;
+			}
+			const name = requestedKeyName(news.name, fqn, instanceId);
+			const { keyId, uniqueName, secret } = yield* createTrackedKey({
+				target: `deployment ${news.deployment}`,
+				name,
+				list: listKeys(news.deployment),
+				create: api.request("create deploy key", (client) => client.POST("/deployments/{deployment_name}/create_deploy_key", {
+					params: { path: { deployment_name: news.deployment } },
+					body: {
+						name,
+						...news.allowedActions === void 0 ? {} : { allowedActions: [...news.allowedActions] }
+					}
+				})).pipe(Effect.map((body) => Schema.decodeUnknownSync(CreatedDeployKey)(body).deployKey)),
+				isCredentialToken: api.isCredentialToken
+			});
+			return {
+				uniqueName,
+				keyId,
+				deployment: news.deployment,
+				deployKey: secret
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			const secret = yield* secretToDelete({
+				keyId: output.keyId,
+				secret: output.deployKey
+			}, `Convex.DeployKey "${output.uniqueName}" on ${output.deployment}`);
+			if (secret === void 0) return;
+			yield* absentAsUndefined(deleteKey(output.deployment, secret));
+		})
+	};
+}));
+//#endregion
+//#region src/PreviewDeployKey.ts
+/** GET /projects/{project_id}/list_preview_deploy_keys */
+const PreviewDeployKeyList = Schema.Struct({ items: Schema.Array(ListedKey) });
+/** POST /projects/{project_id}/create_preview_deploy_key */
+const CreatedPreviewDeployKey = Schema.Struct({ previewDeployKey: Schema.String });
+const PreviewDeployKey = Resource("Convex.PreviewDeployKey");
+const PreviewDeployKeyProvider = () => Provider.effect(PreviewDeployKey, Effect.gen(function* () {
+	const api = yield* ManagementApi;
+	const listKeys = (projectId) => api.request("list preview deploy keys", (client) => client.GET("/projects/{project_id}/list_preview_deploy_keys", { params: { path: { project_id: projectId } } })).pipe(Effect.map((body) => Schema.decodeUnknownSync(PreviewDeployKeyList)(body).items));
+	/**
+	* `id` is the secret: Convex accepts it, and it matches only the key
+	* that this resource created. A second delete answers 404.
+	*/
+	const deleteKey = (projectId, secret) => retryIdempotentWrite(api.requestVoid("delete preview deploy key", (client) => client.POST("/projects/{project_id}/delete_preview_deploy_key", {
+		params: { path: { project_id: projectId } },
+		body: { id: secret }
+	})));
+	return {
+		stables: ["uniqueName", "projectId"],
+		diff: ({ olds, news, output }) => {
+			if (!isResolved(news)) return Effect.succeed(void 0);
+			return Effect.succeed(output !== void 0 && output.previewDeployKey === void 0 || havePropsChanged(olds, news) ? { action: "replace" } : { action: "noop" });
+		},
+		read: Effect.fn(function* ({ output }) {
+			if (output === void 0) return void 0;
+			const entries = yield* absentAsUndefined(listKeys(output.projectId));
+			return entries !== void 0 && isKeyListed(entries, output) ? output : void 0;
+		}),
+		reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
+			if (output !== void 0) {
+				if (isKeyListed(yield* listKeys(news.projectId), output)) return output;
+			}
+			const name = requestedKeyName(news.name, fqn, instanceId);
+			const { keyId, uniqueName, secret } = yield* createTrackedKey({
+				target: `project ${news.projectId}`,
+				name,
+				list: listKeys(news.projectId),
+				create: api.request("create preview deploy key", (client) => client.POST("/projects/{project_id}/create_preview_deploy_key", {
+					params: { path: { project_id: news.projectId } },
+					body: { name }
+				})).pipe(Effect.map((body) => Schema.decodeUnknownSync(CreatedPreviewDeployKey)(body).previewDeployKey)),
+				isCredentialToken: api.isCredentialToken
+			});
+			return {
+				uniqueName,
+				keyId,
+				projectId: news.projectId,
+				previewDeployKey: secret
+			};
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			const secret = yield* secretToDelete({
+				keyId: output.keyId,
+				secret: output.previewDeployKey
+			}, `Convex.PreviewDeployKey "${output.uniqueName}" in project ${output.projectId}`);
+			if (secret === void 0) return;
+			yield* absentAsUndefined(deleteKey(output.projectId, secret));
+		})
+	};
+}));
+//#endregion
+//#region src/Project.ts
+const Project = Resource("Convex.Project", { defaultRemovalPolicy: "retain" });
+/** The props change the team of an existing project. Convex cannot move a project. */
+var ProjectTeamChange = class extends Schema.TaggedError()("ProjectTeamChange", {
+	projectId: Schema.Number,
+	teamId: Schema.Number,
+	requestedTeamId: Schema.Number
+}) {
+	get message() {
+		return `Convex.Project cannot move project ${this.projectId} from team ${this.teamId} to team ${this.requestedTeamId}. Set team back to ${this.teamId}. To use the other team, create a new resource with a new logical id and move the data yourself.`;
+	}
+};
+/**
+* The props change `deploymentType` or `deploymentRegion` of an existing
+* project. Convex uses them only when it creates the project.
+*/
+var ProjectDeploymentChange = class extends Schema.TaggedError()("ProjectDeploymentChange", {
+	projectId: Schema.Number,
+	field: Schema.Literals(["deploymentType", "deploymentRegion"]),
+	current: Schema.UndefinedOr(Schema.String),
+	requested: Schema.UndefinedOr(Schema.String)
+}) {
+	get message() {
+		const show = (value) => value === void 0 ? "(not set)" : value;
+		return `Convex.Project cannot change ${this.field} of project ${this.projectId} from ${show(this.current)} to ${show(this.requested)}: Convex uses it only when it creates a project. Set ${this.field} back to ${show(this.current)}. For a new deployment, create a new resource with a new logical id and move the data yourself.`;
+	}
+};
+/** More than one project in the team has the name, so the lookup cannot choose one. */
+var AmbiguousProject = class extends Schema.TaggedError()("AmbiguousProject", {
+	teamId: Schema.Number,
+	name: Schema.String,
+	projectIds: Schema.Array(Schema.Number)
+}) {
+	get message() {
+		return `Team ${this.teamId} has ${this.projectIds.length} projects named "${this.name}" (ids ${this.projectIds.join(", ")}). Convex.Project does not choose one. Rename the projects in the Convex dashboard so that only one has this name, or use a different name.`;
+	}
+};
+/** Convex answered a create call but then did not return the project. */
+var CreatedProjectNotFound = class extends Schema.TaggedError()("CreatedProjectNotFound", { projectId: Schema.Number }) {
+	get message() {
+		return `Convex created project ${this.projectId} but GET /projects/${this.projectId} did not return it. Run the deploy again with --adopt to take over project ${this.projectId}.`;
+	}
+};
+/** Fields of GET /projects/{id}, PATCH /projects/{id}, and GET /teams/{team}/projects rows that the provider uses. */
+const ProjectDetails = Schema.Struct({
+	id: Schema.Number,
+	name: Schema.String,
+	slug: Schema.String,
+	teamId: Schema.Number,
+	prodDeploymentName: Schema.NullOr(Schema.String)
+});
+/** GET /teams/{team_id}/projects: one page of projects. */
+const ProjectPage = Schema.Struct({
+	items: Schema.Array(ProjectDetails),
+	pagination: Schema.Struct({
+		hasMore: Schema.Boolean,
+		nextCursor: Schema.optionalKey(Schema.NullOr(Schema.String))
+	})
+});
+/** POST /teams/{team_id}/create_project. Only the id: everything else comes from GET /projects/{id}. */
+const CreatedProject = Schema.Struct({ projectId: Schema.Number });
+const DeploymentRow = Schema.Struct({
+	name: Schema.String,
+	deploymentType: Schema.String,
+	isDefault: Schema.Boolean,
+	deploymentUrl: Schema.String
+});
+const DeploymentRows = Schema.Array(DeploymentRow);
+/**
+* Fails with {@link ProjectDeploymentChange} when a create-time prop
+* changed. An omitted `deploymentType` means `prod`.
+*/
+const checkCreateTimeProps = (projectId, olds, news) => {
+	const oldType = olds.deploymentType ?? "prod";
+	const newType = news.deploymentType ?? "prod";
+	if (oldType !== newType) return Effect.fail(new ProjectDeploymentChange({
+		projectId,
+		field: "deploymentType",
+		current: oldType,
+		requested: newType
+	}));
+	if (olds.deploymentRegion !== news.deploymentRegion) return Effect.fail(new ProjectDeploymentChange({
+		projectId,
+		field: "deploymentRegion",
+		current: olds.deploymentRegion,
+		requested: news.deploymentRegion
+	}));
+	return Effect.void;
+};
+const ProjectProvider = () => Provider.effect(Project, Effect.gen(function* () {
+	const api = yield* ManagementApi;
+	const prodDeployment = (projectId) => api.request("list deployments", (client) => client.GET("/projects/{project_id}/list_deployments", { params: { path: { project_id: projectId } } })).pipe(Effect.map((rows) => Schema.decodeUnknownSync(DeploymentRows)(rows).find((row) => row.deploymentType === "prod" && row.isDefault)));
+	const attributesOf = (details) => prodDeployment(details.id).pipe(Effect.map((prod) => ({
+		projectId: details.id,
+		slug: details.slug,
+		name: details.name,
+		teamId: details.teamId,
+		prodDeploymentName: prod?.name ?? details.prodDeploymentName ?? void 0,
+		prodDeploymentUrl: prod?.deploymentUrl
+	})));
+	const getById = (projectId) => absentAsUndefined(api.request("get project", (client) => client.GET("/projects/{project_id}", { params: { path: { project_id: projectId } } }))).pipe(Effect.map((body) => body === void 0 ? void 0 : Schema.decodeUnknownSync(ProjectDetails)(body)));
+	/**
+	* The one project in the team with exactly this name, or undefined.
+	* Reads every page. `q` narrows the listing on the server, and the
+	* exact match here decides. Pattern from Confect
+	* `packages/alchemy/src/ConvexClient.ts` and `Project.ts`
+	* (https://github.com/rjdellecese/confect, ISC license).
+	*/
+	const findByName = (teamId, name) => Effect.gen(function* () {
+		const matches = [];
+		const seenCursors = /* @__PURE__ */ new Set();
+		let cursor;
+		while (true) {
+			const body = yield* api.request("list projects", (client) => client.GET("/teams/{team_id}/projects", { params: {
+				path: { team_id: teamId },
+				query: {
+					q: name,
+					...cursor === void 0 ? {} : { cursor }
+				}
+			} }));
+			const page = Schema.decodeUnknownSync(ProjectPage)(body);
+			matches.push(...page.items.filter((row) => row.name === name));
+			if (!page.pagination.hasMore) break;
+			const next = page.pagination.nextCursor;
+			if (next === void 0 || next === null || seenCursors.has(next)) return yield* new ConvexApiError({
+				operation: "list projects",
+				status: 0,
+				code: "InvalidPagination",
+				message: `The project listing of team ${teamId} reports more pages but gives no new cursor. Convex.Project stops so that it does not miss a project named "${name}".`
+			});
+			seenCursors.add(next);
+			cursor = next;
+		}
+		if (matches.length > 1) return yield* new AmbiguousProject({
+			teamId,
+			name,
+			projectIds: matches.map((row) => row.id)
+		});
+		return matches[0];
+	});
+	/**
+	* Brings an existing project to the desired name. The team cannot
+	* change, so a project in another team fails.
+	*/
+	const converge = (details, teamId, name) => Effect.gen(function* () {
+		if (details.teamId !== teamId) return yield* new ProjectTeamChange({
+			projectId: details.id,
+			teamId: details.teamId,
+			requestedTeamId: teamId
+		});
+		if (details.name === name) return yield* attributesOf(details);
+		const updated = yield* api.request("update project", (client) => client.PATCH("/projects/{project_id}", {
+			params: { path: { project_id: details.id } },
+			body: { name }
+		}));
+		return yield* attributesOf(Schema.decodeUnknownSync(ProjectDetails)(updated));
+	});
+	return {
+		stables: [
+			"projectId",
+			"slug",
+			"teamId"
+		],
+		diff: Effect.fn(function* ({ olds, news, output }) {
+			if (!isResolved(news)) return void 0;
+			if (output === void 0) return void 0;
+			if (olds.team !== news.team) {
+				const requestedTeamId = yield* api.resolveTeamId(news.team);
+				if (requestedTeamId !== output.teamId) return yield* new ProjectTeamChange({
+					projectId: output.projectId,
+					teamId: output.teamId,
+					requestedTeamId
+				});
+			}
+			return olds.name === news.name ? void 0 : { action: "update" };
+		}),
+		read: Effect.fn(function* ({ olds, output }) {
+			if (output !== void 0) {
+				const details = yield* getById(output.projectId);
+				return details === void 0 ? void 0 : yield* attributesOf(details);
+			}
+			const existing = yield* findByName(yield* api.resolveTeamId(olds.team), olds.name);
+			return existing === void 0 ? void 0 : Unowned(yield* attributesOf(existing));
+		}),
+		reconcile: Effect.fn(function* ({ fqn, olds, news, output }) {
+			const teamId = yield* api.resolveTeamId(news.team);
+			if (output !== void 0) {
+				if (olds !== void 0) yield* checkCreateTimeProps(output.projectId, olds, news);
+				if (output.teamId !== teamId) return yield* new ProjectTeamChange({
+					projectId: output.projectId,
+					teamId: output.teamId,
+					requestedTeamId: teamId
+				});
+				const details = yield* getById(output.projectId);
+				if (details !== void 0) return yield* converge(details, teamId, news.name);
+			} else {
+				const existing = yield* findByName(teamId, news.name);
+				if (existing !== void 0) {
+					if (!(yield* shouldAdopt(fqn))) return yield* new OwnedBySomeoneElse({
+						message: `Convex project ${existing.id} in team ${teamId} already has the name "${news.name}". Re-run with --adopt to take it over, or use a different name.`,
+						resourceType: Project.Type,
+						physicalName: news.name
+					});
+					return yield* converge(existing, teamId, news.name);
+				}
+			}
+			const created = yield* api.request("create project", (client) => client.POST("/teams/{team_id}/create_project", {
+				params: { path: { team_id: teamId } },
+				body: {
+					projectName: news.name,
+					deploymentType: news.deploymentType ?? "prod",
+					...news.deploymentRegion === void 0 ? {} : { deploymentRegion: news.deploymentRegion }
+				}
+			}));
+			const { projectId } = Schema.decodeUnknownSync(CreatedProject)(created);
+			const details = yield* getById(projectId);
+			if (details === void 0) return yield* new CreatedProjectNotFound({ projectId });
+			return yield* converge(details, teamId, news.name);
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			yield* absentAsUndefined(api.requestVoid("delete project", (client) => client.POST("/projects/{project_id}/delete", { params: { path: { project_id: output.projectId } } })));
+		})
+	};
+}));
+//#endregion
+//#region src/Providers.ts
+var Providers = class extends Provider.ProviderCollection()("Convex") {};
+/**
+* All Convex resource providers. Pass a credentials layer to override the
+* default lookup (`CONVEX_ACCESS_TOKEN`, then the Convex CLI login).
+*/
+const providers = (credentials = fromConfig()) => Layer.effect(Providers, Provider.collection([
+	Project,
+	Deployment,
+	DeployKey,
+	PreviewDeployKey,
+	EnvironmentVariable,
+	DefaultEnvironmentVariable,
+	Code,
+	Deploy
+])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), DeploymentProvider(), DeployKeyProvider(), PreviewDeployKeyProvider(), EnvironmentVariableProvider(), DefaultEnvironmentVariableProvider(), CodeProvider(), DeployProvider())), Layer.provide(ManagementApiLive()), Layer.provide(credentials), Layer.provide(CommandExecutorLive()), Layer.orDie);
+//#endregion
+export { ACCESS_TOKEN_ENV, AmbiguousDeployment, AmbiguousProject, Code, CodePushFailed, ConvexApiError, ConvexCliNotFound, CreatedProjectNotFound, Credentials, CredentialsError, DefaultEnvironmentVariable, Deploy, DeployArgumentError, DeployKey, DeployKeyIsCredential, DeployKeyMismatch, DeployKeyRecoveryRequired, DeployOutputError, Deployment, DeploymentIdentityChange, EnvironmentNeedsDeployKey, EnvironmentVariable, ManagementApi, PreviewDeployKey, ProductionDeploymentNotFound, Project, ProjectDeploymentChange, ProjectTeamChange, Providers, PushTargetMismatch, VariableIdentityChange, deployArgs, fromConfig, fromToken, parseDeployOutput, providers };
+
 //# sourceMappingURL=index.js.map