@samebase/alchemy-convex 0.17.0 → 0.19.0

package/lib/cli.js

@@ -1,9 +1,207 @@
 #!/usr/bin/env node
-import { I as ManagementApiLive, M as installedCli, V as fromConfig, a as registerDevelopmentClient } from "./HubClient-BZKweNfD.js";
+import { I as ManagementApiLive, M as installedCli, V as fromConfig, a as registerDevelopmentClient, c as RUN_RECORD_KEY, s as state, u as runRecord } from "./HubClient-C0XxgkK3.js";
 import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
 import * as Layer from "effect/Layer";
 import { parseArgs } from "node:util";
+import { State } from "alchemy/State";
 import { execFileSync } from "node:child_process";
+import * as NodeServices from "@effect/platform-node/NodeServices";
+//#region src/StackComment.ts
+/** The first text of the comment, which finds it again. */
+const MARKER = "<!-- samebase-stacks -->";
+/** GitHub does not proxy this host, so a new icon needs no purge of its image cache. */
+const ICONS = "https://raw.githubusercontent.com/samebase/samebase/main/packages/alchemy-convex/assets/stack-comment";
+const GITHUB_API = "https://api.github.com";
+/** The resources that a card shows. A row of any other type, or without `attr` from an interrupted deploy, is left out. */
+const Resource = Schema.Union([
+	Schema.Struct({
+		resourceType: Schema.Literal("Convex.Deployment"),
+		attr: Schema.Struct({
+			name: Schema.String,
+			siteUrl: Schema.String
+		})
+	}),
+	Schema.Struct({
+		resourceType: Schema.Literal("Cloudflare.Worker"),
+		attr: Schema.Struct({
+			workerName: Schema.String,
+			url: Schema.optional(Schema.String)
+		})
+	}),
+	Schema.Struct({
+		resourceType: Schema.Literal("Cloudflare.R2.Bucket"),
+		attr: Schema.Struct({
+			bucketName: Schema.String,
+			accountId: Schema.String,
+			jurisdiction: Schema.String
+		})
+	})
+]);
+/** The fields of the run record that a card shows. */
+const StageOutput = Schema.Struct({ [RUN_RECORD_KEY]: Schema.Struct({
+	headCommit: Schema.String,
+	runUrl: Schema.NullOr(Schema.String),
+	recordedAt: Schema.String
+}) });
+var StackCommentError = class extends Schema.TaggedError()("StackCommentError", { reason: Schema.String }) {
+	get message() {
+		return `The stack comment cannot be updated: ${this.reason}`;
+	}
+};
+/** The cards of the stacks of `repository` that have `stage`, in name order. */
+const readStackCards = ({ repository, stage }) => Effect.gen(function* () {
+	const state = yield* yield* State;
+	const names = (yield* state.listStacks()).filter((name) => name === repository || name.startsWith(`${repository}/`));
+	const cards = [];
+	for (const name of names) {
+		if (!(yield* state.listStages(name)).includes(stage)) continue;
+		const request = {
+			stack: name,
+			stage
+		};
+		const rows = yield* Effect.forEach(yield* state.list(request), (fqn) => state.get({
+			...request,
+			fqn
+		}));
+		const output = yield* state.getOutput(request);
+		cards.push({
+			name,
+			stage,
+			resources: rows.filter(Schema.is(Resource)),
+			run: Schema.is(StageOutput)(output) ? output : null
+		});
+	}
+	return cards;
+});
+/** A stack can create a deployment in one resource and push to it in another: a card shows it once. */
+const withoutRepeats = (resources) => {
+	const deployments = /* @__PURE__ */ new Set();
+	return resources.filter((resource) => {
+		if (resource.resourceType !== "Convex.Deployment") return true;
+		const repeated = deployments.has(resource.attr.name);
+		deployments.add(resource.attr.name);
+		return !repeated;
+	});
+};
+const escapeHtml = (text) => text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;");
+const link = (href, text) => `<a href="${escapeHtml(href)}">${text}</a>`;
+const named = (href, icon, alt, name) => {
+	const image = `<img src="${ICONS}/${icon}.svg" width="16" align="absmiddle" alt="${alt}">`;
+	return `${link(href, image)} ${link(href, escapeHtml(name))}`;
+};
+const hostOf = (url) => escapeHtml(new URL(url).host);
+/** Where a stack serves: its Convex deployment, else its first Worker with a URL. */
+const addressOf = (resources) => {
+	for (const resource of resources) if (resource.resourceType === "Convex.Deployment") return resource.attr.siteUrl;
+	for (const resource of resources) if (resource.resourceType === "Cloudflare.Worker" && resource.attr.url !== void 0) return resource.attr.url;
+	return null;
+};
+const resourceRow = (resource, address) => {
+	switch (resource.resourceType) {
+		case "Convex.Deployment": {
+			const { name } = resource.attr;
+			return named(`https://dashboard.convex.dev/d/${encodeURIComponent(name)}`, "convex", "Convex", name);
+		}
+		case "Cloudflare.Worker": {
+			const { url, workerName } = resource.attr;
+			const row = named(`https://dash.cloudflare.com/?to=/:account/workers/services/view/${encodeURIComponent(workerName)}`, "worker", "Worker", workerName);
+			return url === void 0 || url === address ? row : `${row}<br><sub>${link(url, hostOf(url))}</sub>`;
+		}
+		case "Cloudflare.R2.Bucket": {
+			const { accountId, bucketName, jurisdiction } = resource.attr;
+			return named(`https://dash.cloudflare.com/${encodeURIComponent(accountId)}/r2/${encodeURIComponent(jurisdiction)}/buckets/${encodeURIComponent(bucketName)}`, "r2", "R2 bucket", bucketName);
+		}
+	}
+};
+const runLine = ({ run }) => {
+	if (run === null) return "";
+	const { headCommit, recordedAt, runUrl } = run[RUN_RECORD_KEY];
+	const commit = escapeHtml(headCommit.slice(0, 7));
+	const time = `${recordedAt.slice(0, 16).replace("T", " ")} UTC`;
+	return `<br><sub>${runUrl === null ? commit : link(runUrl, commit)} ${escapeHtml(time)}</sub>`;
+};
+const SPACER = `<div><img src="${ICONS}/spacer.svg" width="460" align="left" alt=""></div>`;
+/** `alone`: the one card of the repository. A card at the root then has no folder, as on the repository page. */
+const renderCard = (card, repository, alone) => {
+	const folder = card.name.slice(repository.length + 1);
+	const heading = [folder === "" && alone ? "" : `<b>${escapeHtml(folder || "/")}</b> `, `<sub>${escapeHtml(card.stage)}</sub>`].join("");
+	const resources = withoutRepeats(card.resources);
+	const address = addressOf(resources);
+	const addressLine = address === null ? "" : `<br>${link(address, hostOf(address))}`;
+	const rows = resources.map((resource) => `<tbody><tr><td>${resourceRow(resource, address)}</td></tr></tbody>`).join("\n");
+	return `<table>
+<tbody><tr><td>${SPACER}${heading}${addressLine}${runLine(card)}</td></tr></tbody>
+${rows}
+</table>`;
+};
+const renderStackComment = (cards, repository) => `${MARKER}
+${cards.map((card) => renderCard(card, repository, cards.length === 1)).join("\n\n")}
+`;
+const Comments = Schema.Array(Schema.Struct({
+	id: Schema.Number,
+	body: Schema.String
+}));
+const SavedComment = Schema.Struct({ html_url: Schema.String });
+const github = (token, path, init) => Effect.tryPromise({
+	try: async () => {
+		const response = await fetch(`${GITHUB_API}${path}`, {
+			...init,
+			headers: {
+				Accept: "application/vnd.github+json",
+				Authorization: `Bearer ${token}`,
+				"Content-Type": "application/json",
+				"X-GitHub-Api-Version": "2022-11-28"
+			}
+		});
+		if (!response.ok) throw new Error(`HTTP ${response.status}`);
+		return await response.json();
+	},
+	catch: (error) => new StackCommentError({ reason: `GitHub ${init.method} ${path} failed (${error instanceof Error ? error.message : String(error)})` })
+});
+const decode = (schema, what) => (value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(() => new StackCommentError({ reason: `GitHub gave a bad ${what}` })));
+const findComment = (token, path) => Effect.gen(function* () {
+	for (let page = 1;; page += 1) {
+		const comments = yield* github(token, `${path}?per_page=100&page=${page}`, { method: "GET" }).pipe(Effect.flatMap(decode(Comments, "comment list")));
+		const comment = comments.find(({ body }) => body.startsWith(MARKER));
+		if (comment !== void 0 || comments.length < 100) return comment;
+	}
+});
+/** Replaces the body of the comment of this command, or posts it on the first run, and gives its URL. */
+const saveStackComment = (args) => Effect.gen(function* () {
+	const { body, pullRequest, repository, token } = args;
+	const comments = `/repos/${repository}/issues/${pullRequest}/comments`;
+	const comment = yield* findComment(token, comments);
+	const reply = yield* comment === void 0 ? github(token, comments, {
+		method: "POST",
+		body: JSON.stringify({ body })
+	}) : github(token, `/repos/${repository}/issues/comments/${comment.id}`, {
+		method: "PATCH",
+		body: JSON.stringify({ body })
+	});
+	return (yield* decode(SavedComment, "comment")(reply)).html_url;
+});
+/** The step of a workflow: the run record names the repository and the pull request of the run. */
+const updateStackComment = Effect.gen(function* () {
+	const { pullRequest, repository } = yield* runRecord({
+		cwd: process.cwd(),
+		env: process.env
+	});
+	if (pullRequest === null) return yield* new StackCommentError({ reason: "this run has no pull request" });
+	const token = process.env["GITHUB_TOKEN"];
+	if (token === void 0 || token === "") return yield* new StackCommentError({ reason: "GITHUB_TOKEN is not set" });
+	const cards = yield* readStackCards({
+		repository,
+		stage: `pr-${pullRequest}`
+	});
+	return yield* saveStackComment({
+		token,
+		repository,
+		pullRequest,
+		body: renderStackComment(cards, repository)
+	});
+});
+//#endregion
 //#region src/cli.ts
 const { positionals, values } = parseArgs({
 	allowPositionals: true,
@@ -14,16 +212,13 @@ const { positionals, values } = parseArgs({
 	}
 });
 const { team, app, "callback-path": callbackPath } = values;
-if (positionals.join(" ") !== "hub-client" || team === void 0 || app === void 0 || callbackPath === void 0) {
-	console.error("Usage: alchemy-convex hub-client --team <team> --app <app> --callback-path <path>");
-	process.exit(1);
-}
-const program = Effect.gen(function* () {
+const USAGE = `Usage:
+  alchemy-convex hub-client --team <team> --app <app> --callback-path <path>
+  alchemy-convex stack-comment [--team <team>]`;
+const hubClient = (hub) => Effect.gen(function* () {
 	const [command, ...prefix] = yield* installedCli(process.cwd());
 	const callbackUrl = yield* registerDevelopmentClient({
-		team,
-		app,
-		callbackPath,
+		...hub,
 		convex: (args, input) => execFileSync(command, [...prefix, ...args], {
 			encoding: "utf8",
 			input,
@@ -36,6 +231,17 @@ const program = Effect.gen(function* () {
 	});
 	console.log(callbackUrl === void 0 ? "Hub client already registered." : `Hub client registered for ${callbackUrl}.`);
 }).pipe(Effect.provide(ManagementApiLive().pipe(Layer.provide(fromConfig()))));
+const stackComment = (options) => updateStackComment.pipe(Effect.tap((url) => Effect.sync(() => console.log(url))), Effect.provide(state(options).pipe(Layer.provide(NodeServices.layer))));
+const subcommand = positionals.join(" ");
+const program = subcommand === "stack-comment" ? stackComment(team === void 0 ? {} : { team }) : subcommand === "hub-client" && team !== void 0 && app !== void 0 && callbackPath !== void 0 ? hubClient({
+	team,
+	app,
+	callbackPath
+}) : void 0;
+if (program === void 0) {
+	console.error(USAGE);
+	process.exit(1);
+}
 await Effect.runPromise(program).catch((error) => {
 	console.error(error instanceof Error ? error.message : String(error));
 	process.exit(1);

package/lib/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","names":[],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n// The command of the package:\n//\n//   alchemy-convex hub-client --team <team> --app <app> --callback-path <path>\n//\n// It runs in the directory of a Convex app, and gives the development deployment of that directory\n// a client of the identity hub of the team: see registerDevelopmentClient. It uses\n// CONVEX_ACCESS_TOKEN or the Convex CLI login.\nimport { execFileSync } from \"node:child_process\";\nimport { parseArgs } from \"node:util\";\nimport * as Effect from \"effect/Effect\";\nimport * as Layer from \"effect/Layer\";\nimport { fromConfig } from \"./Credentials.ts\";\nimport { registerDevelopmentClient } from \"./HubClient.ts\";\nimport { ManagementApiLive } from \"./ManagementApi.ts\";\nimport { installedCli } from \"./Push.ts\";\n\nconst { positionals, values } = parseArgs({\n  allowPositionals: true,\n  options: {\n    team: { type: \"string\" },\n    app: { type: \"string\" },\n    \"callback-path\": { type: \"string\" },\n  },\n});\nconst { team, app, \"callback-path\": callbackPath } = values;\nif (\n  positionals.join(\" \") !== \"hub-client\" ||\n  team === undefined ||\n  app === undefined ||\n  callbackPath === undefined\n) {\n  console.error(\n    \"Usage: alchemy-convex hub-client --team <team> --app <app> --callback-path <path>\",\n  );\n  process.exit(1);\n}\n\nconst program = Effect.gen(function* () {\n  const [command, ...prefix] = yield* installedCli(process.cwd());\n  const callbackUrl = yield* registerDevelopmentClient({\n    team,\n    app,\n    callbackPath,\n    convex: (args, input) =>\n      execFileSync(command, [...prefix, ...args], {\n        encoding: \"utf8\",\n        input,\n        stdio: [\"pipe\", \"pipe\", \"inherit\"],\n      }).trim(),\n  });\n  console.log(\n    callbackUrl === undefined\n      ? \"Hub client already registered.\"\n      : `Hub client registered for ${callbackUrl}.`,\n  );\n}).pipe(Effect.provide(ManagementApiLive().pipe(Layer.provide(fromConfig()))));\n\nawait Effect.runPromise(program).catch((error: unknown) => {\n  console.error(error instanceof Error ? error.message : String(error));\n  process.exit(1);\n});\n"],"mappings":";;;;;;;AAiBA,MAAM,EAAE,aAAa,WAAW,UAAU;CACxC,kBAAkB;CAClB,SAAS;EACP,MAAM,EAAE,MAAM,SAAS;EACvB,KAAK,EAAE,MAAM,SAAS;EACtB,iBAAiB,EAAE,MAAM,SAAS;CACpC;AACF,CAAC;AACD,MAAM,EAAE,MAAM,KAAK,iBAAiB,iBAAiB;AACrD,IACE,YAAY,KAAK,GAAG,MAAM,gBAC1B,SAAS,KAAA,KACT,QAAQ,KAAA,KACR,iBAAiB,KAAA,GACjB;CACA,QAAQ,MACN,mFACF;CACA,QAAQ,KAAK,CAAC;AAChB;AAEA,MAAM,UAAU,OAAO,IAAI,aAAa;CACtC,MAAM,CAAC,SAAS,GAAG,UAAU,OAAO,aAAa,QAAQ,IAAI,CAAC;CAC9D,MAAM,cAAc,OAAO,0BAA0B;EACnD;EACA;EACA;EACA,SAAS,MAAM,UACb,aAAa,SAAS,CAAC,GAAG,QAAQ,GAAG,IAAI,GAAG;GAC1C,UAAU;GACV;GACA,OAAO;IAAC;IAAQ;IAAQ;GAAS;EACnC,CAAC,CAAC,CAAC,KAAK;CACZ,CAAC;CACD,QAAQ,IACN,gBAAgB,KAAA,IACZ,mCACA,6BAA6B,YAAY,EAC/C;AACF,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,kBAAkB,CAAC,CAAC,KAAK,MAAM,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC;AAE7E,MAAM,OAAO,WAAW,OAAO,CAAC,CAAC,OAAO,UAAmB;CACzD,QAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;CACpE,QAAQ,KAAK,CAAC;AAChB,CAAC"}
+{"version":3,"file":"cli.js","names":[],"sources":["../src/StackComment.ts","../src/cli.ts"],"sourcesContent":["// The command `alchemy-convex stack-comment`: one comment on a pull request with the stacks of the\n// repository, read from the state store after the deploys.\n//\n// A stack sees only itself, so a comment that a stack declares cannot show the other stacks of the\n// repository. This command runs as a step after them and reads each stack named `owner/name` or\n// `owner/name/<folder>` that has the stage `pr-<number>`. A stack without that stage has no card. A\n// run replaces the whole body, so the last run shows the newest state.\n//\n// It reads only the fields of the rows below, because Alchemy state holds secrets in clear text.\n//\n// GitHub keeps a fixed set of HTML in a comment and removes `style` and `class`, so every choice of\n// the markup is a fact about the sanitizer or the CSS of github.com:\n// - A table has `display: block` and `width: max-content`, so a `width` on it does nothing. The\n//   spacer, a floated image one pixel high in a block of its own, gives every card one width, and\n//   it shrinks on a narrow page.\n// - The CSS colors the even rows of a group, so each row has its own `tbody`.\n// - An HTML block ends at a blank line, so a table has none and is not indented.\n// - A bare image links to its raw file, and one link around an image and text underlines the space\n//   between them, so the icon and the name are two links to one place.\n// - An image with `height` gets a gray background, so each icon is square and has only `width`.\n// - `align=\"middle\"` is `-webkit-baseline-middle` in Chrome, which is below the text.\n//   `align=\"absmiddle\"` is the CSS value `middle`.\nimport { State } from \"alchemy/State\";\nimport * as Effect from \"effect/Effect\";\nimport * as Schema from \"effect/Schema\";\nimport { RUN_RECORD_KEY, runRecord } from \"./RunRecord.ts\";\n\n/** The first text of the comment, which finds it again. */\nconst MARKER = \"<!-- samebase-stacks -->\";\n\n/** GitHub does not proxy this host, so a new icon needs no purge of its image cache. */\nconst ICONS =\n  \"https://raw.githubusercontent.com/samebase/samebase/main/packages/alchemy-convex/assets/stack-comment\";\n\nconst GITHUB_API = \"https://api.github.com\";\n\n/** The resources that a card shows. A row of any other type, or without `attr` from an interrupted deploy, is left out. */\nconst Resource = Schema.Union([\n  Schema.Struct({\n    resourceType: Schema.Literal(\"Convex.Deployment\"),\n    attr: Schema.Struct({ name: Schema.String, siteUrl: Schema.String }),\n  }),\n  Schema.Struct({\n    resourceType: Schema.Literal(\"Cloudflare.Worker\"),\n    attr: Schema.Struct({ workerName: Schema.String, url: Schema.optional(Schema.String) }),\n  }),\n  Schema.Struct({\n    resourceType: Schema.Literal(\"Cloudflare.R2.Bucket\"),\n    attr: Schema.Struct({\n      bucketName: Schema.String,\n      accountId: Schema.String,\n      jurisdiction: Schema.String,\n    }),\n  }),\n]);\ntype Resource = typeof Resource.Type;\n\n/** The fields of the run record that a card shows. */\nconst StageOutput = Schema.Struct({\n  [RUN_RECORD_KEY]: Schema.Struct({\n    headCommit: Schema.String,\n    runUrl: Schema.NullOr(Schema.String),\n    recordedAt: Schema.String,\n  }),\n});\n\nexport interface StackCard {\n  readonly name: string;\n  readonly stage: string;\n  readonly resources: readonly Resource[];\n  readonly run: typeof StageOutput.Type | null;\n}\n\nexport class StackCommentError extends Schema.TaggedError<StackCommentError>()(\n  \"StackCommentError\",\n  { reason: Schema.String },\n) {\n  override get message() {\n    return `The stack comment cannot be updated: ${this.reason}`;\n  }\n}\n\n/** The cards of the stacks of `repository` that have `stage`, in name order. */\nexport const readStackCards = ({ repository, stage }: { repository: string; stage: string }) =>\n  Effect.gen(function* () {\n    const state = yield* yield* State;\n    const names = (yield* state.listStacks()).filter(\n      (name) => name === repository || name.startsWith(`${repository}/`),\n    );\n    const cards: StackCard[] = [];\n    for (const name of names) {\n      if (!(yield* state.listStages(name)).includes(stage)) {\n        continue;\n      }\n      const request = { stack: name, stage };\n      const rows = yield* Effect.forEach(yield* state.list(request), (fqn) =>\n        state.get({ ...request, fqn }),\n      );\n      const output = yield* state.getOutput(request);\n      cards.push({\n        name,\n        stage,\n        resources: rows.filter(Schema.is(Resource)),\n        run: Schema.is(StageOutput)(output) ? output : null,\n      });\n    }\n    return cards;\n  });\n\n/** A stack can create a deployment in one resource and push to it in another: a card shows it once. */\nconst withoutRepeats = (resources: readonly Resource[]) => {\n  const deployments = new Set<string>();\n  return resources.filter((resource) => {\n    if (resource.resourceType !== \"Convex.Deployment\") {\n      return true;\n    }\n    const repeated = deployments.has(resource.attr.name);\n    deployments.add(resource.attr.name);\n    return !repeated;\n  });\n};\n\nconst escapeHtml = (text: string) =>\n  text\n    .replaceAll(\"&\", \"&amp;\")\n    .replaceAll(\"<\", \"&lt;\")\n    .replaceAll(\">\", \"&gt;\")\n    .replaceAll('\"', \"&quot;\");\n\nconst link = (href: string, text: string) => `<a href=\"${escapeHtml(href)}\">${text}</a>`;\n\nconst named = (href: string, icon: string, alt: string, name: string) => {\n  const image = `<img src=\"${ICONS}/${icon}.svg\" width=\"16\" align=\"absmiddle\" alt=\"${alt}\">`;\n  return `${link(href, image)} ${link(href, escapeHtml(name))}`;\n};\n\nconst hostOf = (url: string) => escapeHtml(new URL(url).host);\n\n/** Where a stack serves: its Convex deployment, else its first Worker with a URL. */\nconst addressOf = (resources: readonly Resource[]) => {\n  for (const resource of resources) {\n    if (resource.resourceType === \"Convex.Deployment\") {\n      return resource.attr.siteUrl;\n    }\n  }\n  for (const resource of resources) {\n    if (resource.resourceType === \"Cloudflare.Worker\" && resource.attr.url !== undefined) {\n      return resource.attr.url;\n    }\n  }\n  return null;\n};\n\nconst resourceRow = (resource: Resource, address: string | null) => {\n  switch (resource.resourceType) {\n    case \"Convex.Deployment\": {\n      const { name } = resource.attr;\n      return named(\n        `https://dashboard.convex.dev/d/${encodeURIComponent(name)}`,\n        \"convex\",\n        \"Convex\",\n        name,\n      );\n    }\n    case \"Cloudflare.Worker\": {\n      const { url, workerName } = resource.attr;\n      const row = named(\n        `https://dash.cloudflare.com/?to=/:account/workers/services/view/${encodeURIComponent(workerName)}`,\n        \"worker\",\n        \"Worker\",\n        workerName,\n      );\n      return url === undefined || url === address\n        ? row\n        : `${row}<br><sub>${link(url, hostOf(url))}</sub>`;\n    }\n    case \"Cloudflare.R2.Bucket\": {\n      const { accountId, bucketName, jurisdiction } = resource.attr;\n      return named(\n        `https://dash.cloudflare.com/${encodeURIComponent(accountId)}/r2/${encodeURIComponent(jurisdiction)}/buckets/${encodeURIComponent(bucketName)}`,\n        \"r2\",\n        \"R2 bucket\",\n        bucketName,\n      );\n    }\n  }\n};\n\nconst runLine = ({ run }: StackCard) => {\n  if (run === null) {\n    return \"\";\n  }\n  const { headCommit, recordedAt, runUrl } = run[RUN_RECORD_KEY];\n  const commit = escapeHtml(headCommit.slice(0, 7));\n  const time = `${recordedAt.slice(0, 16).replace(\"T\", \" \")} UTC`;\n  return `<br><sub>${runUrl === null ? commit : link(runUrl, commit)} ${escapeHtml(time)}</sub>`;\n};\n\nconst SPACER = `<div><img src=\"${ICONS}/spacer.svg\" width=\"460\" align=\"left\" alt=\"\"></div>`;\n\n/** `alone`: the one card of the repository. A card at the root then has no folder, as on the repository page. */\nconst renderCard = (card: StackCard, repository: string, alone: boolean) => {\n  const folder = card.name.slice(repository.length + 1);\n  const heading = [\n    folder === \"\" && alone ? \"\" : `<b>${escapeHtml(folder || \"/\")}</b> `,\n    `<sub>${escapeHtml(card.stage)}</sub>`,\n  ].join(\"\");\n  const resources = withoutRepeats(card.resources);\n  const address = addressOf(resources);\n  const addressLine = address === null ? \"\" : `<br>${link(address, hostOf(address))}`;\n  const rows = resources\n    .map((resource) => `<tbody><tr><td>${resourceRow(resource, address)}</td></tr></tbody>`)\n    .join(\"\\n\");\n  return `<table>\n<tbody><tr><td>${SPACER}${heading}${addressLine}${runLine(card)}</td></tr></tbody>\n${rows}\n</table>`;\n};\n\nexport const renderStackComment = (cards: readonly StackCard[], repository: string) => `${MARKER}\n${cards.map((card) => renderCard(card, repository, cards.length === 1)).join(\"\\n\\n\")}\n`;\n\nconst Comments = Schema.Array(Schema.Struct({ id: Schema.Number, body: Schema.String }));\nconst SavedComment = Schema.Struct({ html_url: Schema.String });\n\nconst github = (token: string, path: string, init: { method: string; body?: string }) =>\n  Effect.tryPromise({\n    try: async (): Promise<unknown> => {\n      const response = await fetch(`${GITHUB_API}${path}`, {\n        ...init,\n        headers: {\n          Accept: \"application/vnd.github+json\",\n          Authorization: `Bearer ${token}`,\n          \"Content-Type\": \"application/json\",\n          \"X-GitHub-Api-Version\": \"2022-11-28\",\n        },\n      });\n      if (!response.ok) {\n        throw new Error(`HTTP ${response.status}`);\n      }\n      return await response.json();\n    },\n    catch: (error) =>\n      new StackCommentError({\n        reason: `GitHub ${init.method} ${path} failed (${error instanceof Error ? error.message : String(error)})`,\n      }),\n  });\n\nconst decode =\n  <S extends Schema.Codec<unknown, unknown>>(schema: S, what: string) =>\n  (value: unknown) =>\n    Schema.decodeUnknownEffect(schema)(value).pipe(\n      Effect.mapError(() => new StackCommentError({ reason: `GitHub gave a bad ${what}` })),\n    );\n\nconst findComment = (token: string, path: string) =>\n  Effect.gen(function* () {\n    for (let page = 1; ; page += 1) {\n      const comments = yield* github(token, `${path}?per_page=100&page=${page}`, {\n        method: \"GET\",\n      }).pipe(Effect.flatMap(decode(Comments, \"comment list\")));\n      const comment = comments.find(({ body }) => body.startsWith(MARKER));\n      if (comment !== undefined || comments.length < 100) {\n        return comment;\n      }\n    }\n  });\n\n/** Replaces the body of the comment of this command, or posts it on the first run, and gives its URL. */\nexport const saveStackComment = (args: {\n  readonly token: string;\n  readonly repository: string;\n  readonly pullRequest: number;\n  readonly body: string;\n}) =>\n  Effect.gen(function* () {\n    const { body, pullRequest, repository, token } = args;\n    const comments = `/repos/${repository}/issues/${pullRequest}/comments`;\n    const comment = yield* findComment(token, comments);\n    const reply = yield* comment === undefined\n      ? github(token, comments, { method: \"POST\", body: JSON.stringify({ body }) })\n      : github(token, `/repos/${repository}/issues/comments/${comment.id}`, {\n          method: \"PATCH\",\n          body: JSON.stringify({ body }),\n        });\n    const saved = yield* decode(SavedComment, \"comment\")(reply);\n    return saved.html_url;\n  });\n\n/** The step of a workflow: the run record names the repository and the pull request of the run. */\nexport const updateStackComment = Effect.gen(function* () {\n  const { pullRequest, repository } = yield* runRecord({ cwd: process.cwd(), env: process.env });\n  if (pullRequest === null) {\n    return yield* new StackCommentError({ reason: \"this run has no pull request\" });\n  }\n  const token = process.env[\"GITHUB_TOKEN\"];\n  if (token === undefined || token === \"\") {\n    return yield* new StackCommentError({ reason: \"GITHUB_TOKEN is not set\" });\n  }\n  const cards = yield* readStackCards({ repository, stage: `pr-${pullRequest}` });\n  return yield* saveStackComment({\n    token,\n    repository,\n    pullRequest,\n    body: renderStackComment(cards, repository),\n  });\n});\n","#!/usr/bin/env node\n// The commands of the package:\n//\n//   alchemy-convex hub-client --team <team> --app <app> --callback-path <path>\n//   alchemy-convex stack-comment [--team <team>]\n//\n// hub-client runs in the directory of a Convex app, and gives the development deployment of that\n// directory a client of the identity hub of the team: see registerDevelopmentClient. stack-comment\n// runs as a step of a pull request workflow after the deploys, and keeps one comment with the stacks\n// of the repository: see src/StackComment.ts. It needs GITHUB_TOKEN and, with a team access token,\n// no --team. Both use CONVEX_ACCESS_TOKEN or the Convex CLI login.\nimport { execFileSync } from \"node:child_process\";\nimport { parseArgs } from \"node:util\";\nimport * as NodeServices from \"@effect/platform-node/NodeServices\";\nimport * as Effect from \"effect/Effect\";\nimport * as Layer from \"effect/Layer\";\nimport { fromConfig } from \"./Credentials.ts\";\nimport { registerDevelopmentClient } from \"./HubClient.ts\";\nimport { ManagementApiLive } from \"./ManagementApi.ts\";\nimport { installedCli } from \"./Push.ts\";\nimport { updateStackComment } from \"./StackComment.ts\";\nimport { state } from \"./State.ts\";\n\nconst { positionals, values } = parseArgs({\n  allowPositionals: true,\n  options: {\n    team: { type: \"string\" },\n    app: { type: \"string\" },\n    \"callback-path\": { type: \"string\" },\n  },\n});\nconst { team, app, \"callback-path\": callbackPath } = values;\nconst USAGE = `Usage:\n  alchemy-convex hub-client --team <team> --app <app> --callback-path <path>\n  alchemy-convex stack-comment [--team <team>]`;\n\nconst hubClient = (hub: { team: string; app: string; callbackPath: string }) =>\n  Effect.gen(function* () {\n    const [command, ...prefix] = yield* installedCli(process.cwd());\n    const callbackUrl = yield* registerDevelopmentClient({\n      ...hub,\n      convex: (args, input) =>\n        execFileSync(command, [...prefix, ...args], {\n          encoding: \"utf8\",\n          input,\n          stdio: [\"pipe\", \"pipe\", \"inherit\"],\n        }).trim(),\n    });\n    console.log(\n      callbackUrl === undefined\n        ? \"Hub client already registered.\"\n        : `Hub client registered for ${callbackUrl}.`,\n    );\n  }).pipe(Effect.provide(ManagementApiLive().pipe(Layer.provide(fromConfig()))));\n\nconst stackComment = (options: { team?: string }) =>\n  updateStackComment.pipe(\n    Effect.tap((url) => Effect.sync(() => console.log(url))),\n    Effect.provide(state(options).pipe(Layer.provide(NodeServices.layer))),\n  );\n\nconst subcommand = positionals.join(\" \");\nconst program: Effect.Effect<unknown, unknown> | undefined =\n  subcommand === \"stack-comment\"\n    ? stackComment(team === undefined ? {} : { team })\n    : subcommand === \"hub-client\" &&\n        team !== undefined &&\n        app !== undefined &&\n        callbackPath !== undefined\n      ? hubClient({ team, app, callbackPath })\n      : undefined;\nif (program === undefined) {\n  console.error(USAGE);\n  process.exit(1);\n}\n\nawait Effect.runPromise(program).catch((error: unknown) => {\n  console.error(error instanceof Error ? error.message : String(error));\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;AA4BA,MAAM,SAAS;;AAGf,MAAM,QACJ;AAEF,MAAM,aAAa;;AAGnB,MAAM,WAAW,OAAO,MAAM;CAC5B,OAAO,OAAO;EACZ,cAAc,OAAO,QAAQ,mBAAmB;EAChD,MAAM,OAAO,OAAO;GAAE,MAAM,OAAO;GAAQ,SAAS,OAAO;EAAO,CAAC;CACrE,CAAC;CACD,OAAO,OAAO;EACZ,cAAc,OAAO,QAAQ,mBAAmB;EAChD,MAAM,OAAO,OAAO;GAAE,YAAY,OAAO;GAAQ,KAAK,OAAO,SAAS,OAAO,MAAM;EAAE,CAAC;CACxF,CAAC;CACD,OAAO,OAAO;EACZ,cAAc,OAAO,QAAQ,sBAAsB;EACnD,MAAM,OAAO,OAAO;GAClB,YAAY,OAAO;GACnB,WAAW,OAAO;GAClB,cAAc,OAAO;EACvB,CAAC;CACH,CAAC;AACH,CAAC;;AAID,MAAM,cAAc,OAAO,OAAO,GAC/B,iBAAiB,OAAO,OAAO;CAC9B,YAAY,OAAO;CACnB,QAAQ,OAAO,OAAO,OAAO,MAAM;CACnC,YAAY,OAAO;AACrB,CAAC,EACH,CAAC;AASD,IAAa,oBAAb,cAAuC,OAAO,YAA+B,CAAC,CAC5E,qBACA,EAAE,QAAQ,OAAO,OAAO,CAC1B,CAAC,CAAC;CACA,IAAa,UAAU;EACrB,OAAO,wCAAwC,KAAK;CACtD;AACF;;AAGA,MAAa,kBAAkB,EAAE,YAAY,YAC3C,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,OAAO;CAC5B,MAAM,SAAS,OAAO,MAAM,WAAW,EAAA,CAAG,QACvC,SAAS,SAAS,cAAc,KAAK,WAAW,GAAG,WAAW,EAAE,CACnE;CACA,MAAM,QAAqB,CAAC;CAC5B,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,EAAE,OAAO,MAAM,WAAW,IAAI,EAAA,CAAG,SAAS,KAAK,GACjD;EAEF,MAAM,UAAU;GAAE,OAAO;GAAM;EAAM;EACrC,MAAM,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,QAC9D,MAAM,IAAI;GAAE,GAAG;GAAS;EAAI,CAAC,CAC/B;EACA,MAAM,SAAS,OAAO,MAAM,UAAU,OAAO;EAC7C,MAAM,KAAK;GACT;GACA;GACA,WAAW,KAAK,OAAO,OAAO,GAAG,QAAQ,CAAC;GAC1C,KAAK,OAAO,GAAG,WAAW,CAAC,CAAC,MAAM,IAAI,SAAS;EACjD,CAAC;CACH;CACA,OAAO;AACT,CAAC;;AAGH,MAAM,kBAAkB,cAAmC;CACzD,MAAM,8BAAc,IAAI,IAAY;CACpC,OAAO,UAAU,QAAQ,aAAa;EACpC,IAAI,SAAS,iBAAiB,qBAC5B,OAAO;EAET,MAAM,WAAW,YAAY,IAAI,SAAS,KAAK,IAAI;EACnD,YAAY,IAAI,SAAS,KAAK,IAAI;EAClC,OAAO,CAAC;CACV,CAAC;AACH;AAEA,MAAM,cAAc,SAClB,KACG,WAAW,KAAK,OAAO,CAAC,CACxB,WAAW,KAAK,MAAM,CAAC,CACvB,WAAW,KAAK,MAAM,CAAC,CACvB,WAAW,MAAK,QAAQ;AAE7B,MAAM,QAAQ,MAAc,SAAiB,YAAY,WAAW,IAAI,EAAE,IAAI,KAAK;AAEnF,MAAM,SAAS,MAAc,MAAc,KAAa,SAAiB;CACvE,MAAM,QAAQ,aAAa,MAAM,GAAG,KAAK,0CAA0C,IAAI;CACvF,OAAO,GAAG,KAAK,MAAM,KAAK,EAAE,GAAG,KAAK,MAAM,WAAW,IAAI,CAAC;AAC5D;AAEA,MAAM,UAAU,QAAgB,WAAW,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI;;AAG5D,MAAM,aAAa,cAAmC;CACpD,KAAK,MAAM,YAAY,WACrB,IAAI,SAAS,iBAAiB,qBAC5B,OAAO,SAAS,KAAK;CAGzB,KAAK,MAAM,YAAY,WACrB,IAAI,SAAS,iBAAiB,uBAAuB,SAAS,KAAK,QAAQ,KAAA,GACzE,OAAO,SAAS,KAAK;CAGzB,OAAO;AACT;AAEA,MAAM,eAAe,UAAoB,YAA2B;CAClE,QAAQ,SAAS,cAAjB;EACE,KAAK,qBAAqB;GACxB,MAAM,EAAE,SAAS,SAAS;GAC1B,OAAO,MACL,kCAAkC,mBAAmB,IAAI,KACzD,UACA,UACA,IACF;EACF;EACA,KAAK,qBAAqB;GACxB,MAAM,EAAE,KAAK,eAAe,SAAS;GACrC,MAAM,MAAM,MACV,mEAAmE,mBAAmB,UAAU,KAChG,UACA,UACA,UACF;GACA,OAAO,QAAQ,KAAA,KAAa,QAAQ,UAChC,MACA,GAAG,IAAI,WAAW,KAAK,KAAK,OAAO,GAAG,CAAC,EAAE;EAC/C;EACA,KAAK,wBAAwB;GAC3B,MAAM,EAAE,WAAW,YAAY,iBAAiB,SAAS;GACzD,OAAO,MACL,+BAA+B,mBAAmB,SAAS,EAAE,MAAM,mBAAmB,YAAY,EAAE,WAAW,mBAAmB,UAAU,KAC5I,MACA,aACA,UACF;EACF;CACF;AACF;AAEA,MAAM,WAAW,EAAE,UAAqB;CACtC,IAAI,QAAQ,MACV,OAAO;CAET,MAAM,EAAE,YAAY,YAAY,WAAW,IAAI;CAC/C,MAAM,SAAS,WAAW,WAAW,MAAM,GAAG,CAAC,CAAC;CAChD,MAAM,OAAO,GAAG,WAAW,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,KAAK,GAAG,EAAE;CAC1D,OAAO,YAAY,WAAW,OAAO,SAAS,KAAK,QAAQ,MAAM,EAAE,GAAG,WAAW,IAAI,EAAE;AACzF;AAEA,MAAM,SAAS,kBAAkB,MAAM;;AAGvC,MAAM,cAAc,MAAiB,YAAoB,UAAmB;CAC1E,MAAM,SAAS,KAAK,KAAK,MAAM,WAAW,SAAS,CAAC;CACpD,MAAM,UAAU,CACd,WAAW,MAAM,QAAQ,KAAK,MAAM,WAAW,UAAU,GAAG,EAAE,QAC9D,QAAQ,WAAW,KAAK,KAAK,EAAE,OACjC,CAAC,CAAC,KAAK,EAAE;CACT,MAAM,YAAY,eAAe,KAAK,SAAS;CAC/C,MAAM,UAAU,UAAU,SAAS;CACnC,MAAM,cAAc,YAAY,OAAO,KAAK,OAAO,KAAK,SAAS,OAAO,OAAO,CAAC;CAChF,MAAM,OAAO,UACV,KAAK,aAAa,kBAAkB,YAAY,UAAU,OAAO,EAAE,mBAAmB,CAAC,CACvF,KAAK,IAAI;CACZ,OAAO;iBACQ,SAAS,UAAU,cAAc,QAAQ,IAAI,EAAE;EAC9D,KAAK;;AAEP;AAEA,MAAa,sBAAsB,OAA6B,eAAuB,GAAG,OAAO;EAC/F,MAAM,KAAK,SAAS,WAAW,MAAM,YAAY,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE;;AAGrF,MAAM,WAAW,OAAO,MAAM,OAAO,OAAO;CAAE,IAAI,OAAO;CAAQ,MAAM,OAAO;AAAO,CAAC,CAAC;AACvF,MAAM,eAAe,OAAO,OAAO,EAAE,UAAU,OAAO,OAAO,CAAC;AAE9D,MAAM,UAAU,OAAe,MAAc,SAC3C,OAAO,WAAW;CAChB,KAAK,YAA8B;EACjC,MAAM,WAAW,MAAM,MAAM,GAAG,aAAa,QAAQ;GACnD,GAAG;GACH,SAAS;IACP,QAAQ;IACR,eAAe,UAAU;IACzB,gBAAgB;IAChB,wBAAwB;GAC1B;EACF,CAAC;EACD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,QAAQ,SAAS,QAAQ;EAE3C,OAAO,MAAM,SAAS,KAAK;CAC7B;CACA,QAAQ,UACN,IAAI,kBAAkB,EACpB,QAAQ,UAAU,KAAK,OAAO,GAAG,KAAK,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAC1G,CAAC;AACL,CAAC;AAEH,MAAM,UACuC,QAAW,UACrD,UACC,OAAO,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACxC,OAAO,eAAe,IAAI,kBAAkB,EAAE,QAAQ,qBAAqB,OAAO,CAAC,CAAC,CACtF;AAEJ,MAAM,eAAe,OAAe,SAClC,OAAO,IAAI,aAAa;CACtB,KAAK,IAAI,OAAO,IAAK,QAAQ,GAAG;EAC9B,MAAM,WAAW,OAAO,OAAO,OAAO,GAAG,KAAK,qBAAqB,QAAQ,EACzE,QAAQ,MACV,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,OAAO,UAAU,cAAc,CAAC,CAAC;EACxD,MAAM,UAAU,SAAS,MAAM,EAAE,WAAW,KAAK,WAAW,MAAM,CAAC;EACnE,IAAI,YAAY,KAAA,KAAa,SAAS,SAAS,KAC7C,OAAO;CAEX;AACF,CAAC;;AAGH,MAAa,oBAAoB,SAM/B,OAAO,IAAI,aAAa;CACtB,MAAM,EAAE,MAAM,aAAa,YAAY,UAAU;CACjD,MAAM,WAAW,UAAU,WAAW,UAAU,YAAY;CAC5D,MAAM,UAAU,OAAO,YAAY,OAAO,QAAQ;CAClD,MAAM,QAAQ,OAAO,YAAY,KAAA,IAC7B,OAAO,OAAO,UAAU;EAAE,QAAQ;EAAQ,MAAM,KAAK,UAAU,EAAE,KAAK,CAAC;CAAE,CAAC,IAC1E,OAAO,OAAO,UAAU,WAAW,mBAAmB,QAAQ,MAAM;EAClE,QAAQ;EACR,MAAM,KAAK,UAAU,EAAE,KAAK,CAAC;CAC/B,CAAC;CAEL,QAAO,OADc,OAAO,cAAc,SAAS,CAAC,CAAC,KAAK,EAAA,CAC7C;AACf,CAAC;;AAGH,MAAa,qBAAqB,OAAO,IAAI,aAAa;CACxD,MAAM,EAAE,aAAa,eAAe,OAAO,UAAU;EAAE,KAAK,QAAQ,IAAI;EAAG,KAAK,QAAQ;CAAI,CAAC;CAC7F,IAAI,gBAAgB,MAClB,OAAO,OAAO,IAAI,kBAAkB,EAAE,QAAQ,+BAA+B,CAAC;CAEhF,MAAM,QAAQ,QAAQ,IAAI;CAC1B,IAAI,UAAU,KAAA,KAAa,UAAU,IACnC,OAAO,OAAO,IAAI,kBAAkB,EAAE,QAAQ,0BAA0B,CAAC;CAE3E,MAAM,QAAQ,OAAO,eAAe;EAAE;EAAY,OAAO,MAAM;CAAc,CAAC;CAC9E,OAAO,OAAO,iBAAiB;EAC7B;EACA;EACA;EACA,MAAM,mBAAmB,OAAO,UAAU;CAC5C,CAAC;AACH,CAAC;;;AC5RD,MAAM,EAAE,aAAa,WAAW,UAAU;CACxC,kBAAkB;CAClB,SAAS;EACP,MAAM,EAAE,MAAM,SAAS;EACvB,KAAK,EAAE,MAAM,SAAS;EACtB,iBAAiB,EAAE,MAAM,SAAS;CACpC;AACF,CAAC;AACD,MAAM,EAAE,MAAM,KAAK,iBAAiB,iBAAiB;AACrD,MAAM,QAAQ;;;AAId,MAAM,aAAa,QACjB,OAAO,IAAI,aAAa;CACtB,MAAM,CAAC,SAAS,GAAG,UAAU,OAAO,aAAa,QAAQ,IAAI,CAAC;CAC9D,MAAM,cAAc,OAAO,0BAA0B;EACnD,GAAG;EACH,SAAS,MAAM,UACb,aAAa,SAAS,CAAC,GAAG,QAAQ,GAAG,IAAI,GAAG;GAC1C,UAAU;GACV;GACA,OAAO;IAAC;IAAQ;IAAQ;GAAS;EACnC,CAAC,CAAC,CAAC,KAAK;CACZ,CAAC;CACD,QAAQ,IACN,gBAAgB,KAAA,IACZ,mCACA,6BAA6B,YAAY,EAC/C;AACF,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,kBAAkB,CAAC,CAAC,KAAK,MAAM,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC;AAE/E,MAAM,gBAAgB,YACpB,mBAAmB,KACjB,OAAO,KAAK,QAAQ,OAAO,WAAW,QAAQ,IAAI,GAAG,CAAC,CAAC,GACvD,OAAO,QAAQ,MAAM,OAAO,CAAC,CAAC,KAAK,MAAM,QAAQ,aAAa,KAAK,CAAC,CAAC,CACvE;AAEF,MAAM,aAAa,YAAY,KAAK,GAAG;AACvC,MAAM,UACJ,eAAe,kBACX,aAAa,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,CAAC,IAC/C,eAAe,gBACb,SAAS,KAAA,KACT,QAAQ,KAAA,KACR,iBAAiB,KAAA,IACjB,UAAU;CAAE;CAAM;CAAK;AAAa,CAAC,IACrC,KAAA;AACR,IAAI,YAAY,KAAA,GAAW;CACzB,QAAQ,MAAM,KAAK;CACnB,QAAQ,KAAK,CAAC;AAChB;AAEA,MAAM,OAAO,WAAW,OAAO,CAAC,CAAC,OAAO,UAAmB;CACzD,QAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;CACpE,QAAQ,KAAK,CAAC;AAChB,CAAC"}

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/Credentials.ts","../src/ManagementApi.ts","../src/Providers.ts","../src/Push.ts","../src/Deployment.ts","../src/Component.ts","../src/Project.ts","../src/HubClient.ts","../src/RunRecord.ts","../src/State.ts"],"mappings":";;;;;;;;;;;;;;;;UA6BiB;;WAEN,aAAa,SAAS;;WAEtB;;UAGM;;WAEN,aAAa,OAAO,OAAO;;WAE3B,gBAAgB,OAAO;;WAEvB,WAAW,OAAO,OAAO,SAAS;;;qBAGhC,oBAAoB;;qBAKpB;;qBAGA;;;;qBAOA,yBAAyB;;;;;;;;;qBAiCzB,kBAAiB,MAAM,MAAM;;qBA0B7B,aAAc;WAChB,cAAc,SAAS;WACvB,YAAY,SAAS;MAC5B,MAAM,MAAM;;;KC3GJ,mBAAmB,kBAAkB;KACrC,mBAAmB,kBAAkB;;UAGhC,YAAY;WAClB,OAAO;WACP;WACA,UAAU;;;;;;;;;;;;;qBAQR,uBAAuB;UAuBnB;;WAEN,UAAU,GACjB,mBACA,MAAM,QAAQ,qBAAqB,QAAQ,YAAY,QACpD,OAAO,OAAO,GAAG;;WAEb,cACP,mBACA,MAAM,QAAQ,qBAAqB,QAAQ,0BACxC,OAAO,aAAa;;WAEhB,oBAAoB,GAC3B,mBACA,6BACA,WAAW,SAAS,kBACpB,MAAM,QAAQ,qBAAqB,QAAQ,YAAY,QACpD,OAAO,OAAO,GAAG;;;;;;;;WAQb,gBACP,sCACG,OAAO,eAAe;;;;;;;;WAQlB,oBAAoB,mBAAmB,OAAO;;;;;WAK9C,YAAY,OAAO,SAAS,qBAAqB;;;qBAM/C,sBAAsB;;;;qBCzFtB,kBAAkB;;;;;;qBAOlB,YAAa,cAAa,MAAM,MAAM,iBAA2B,MAAA,MAAA,8CAAA,mCAAA,oDAAA;;;;KC8BlE,oBAAoB,SAAS;;;;;;KAO7B;;WAIG;;;;;;;;WAQA;;;;;;;WAOA;;;;;;qBAkCF,0BAA0B;MAIxB;;;;;;;qBAMF,0BAA0B;MAOxB;;;;;;;;;qBAMF,uBAAuB;MAMrB;;;;;;;qBAQF,2BAA2B;MAIzB;;;;;;;qBAMF,oCAAoC;MAIlC;;;;;;qBAMF,kCAAkC;MAIhC;;;qBAuCF,oBACX;EACG;EAAa;;;;UC3HR;;WAEC;aAAoB;;;;;;;;WAOpB;;;;;;WAMA,SAAS;;WAET,MAAM,SAAS,eAAe;;KAG7B,mBACP;;WAEU;MAEV;;WAEU;;;;;WAKA;;;UAIL;WACC;WACA,MAAM;;WAEN;;WAEA;;WAEA;;WAEA;;WAEA;;UAGM,6BAA6B;;WAEnC;;WAEA;;YAGC,aAAa,8BAEvB,iBACA,sBACA,kBACA;;KAQU,kBAAkB,+BAA8B,KACxD,UAAU,kBACR,WAAW;;;;;qBAWJ,wBAAwB;MAGtB;;;;;;;;;;;;qBAeF,cAAU,YACV,OAAS,oBAAe,OAAA,OAAA,mBAAA;;;;;;EAYvB,MAAA,YAAM;IAAc;IAAgB;QAAgB,OAAA,OAAA;;;;;;;;;;qBAMrD,iCAAiC;MAU/B;;;;;;qBAMF,qCAAqC;MAInC;;;;;;;;;qBAMF,4BAA4B;MAS1B;;;;;UC1OE;WACN;WACA;WACA;;;;;;;;;qBAUE,gBAAiB;EAC5B,YAAY;EACZ;EACA,WAAW;MACZ,OAAA,yBAAA;;;;KCWW,mBAAmB;KAEnB;;WAGG;;WAEA;;WAEA,mBAAmB;;WAEnB;;;WAIA;;WAEA;;UAGE;WACN;WACA;WACA;WACA;WACA;WACA;;YAGC,UAAU,2BAA2B,cAAc,0BAA0B;qBAC5E,2BAAO,cAAA;;;;;;;qBAGP,0BAA0B;MAIxB;;;;;;;;;;;;qBASF,gCAAgC;MAS9B;;;;;;;;qBAOF,yBAAyB;MAKvB;;;;;;qBAMF,+BAA+B;MAI7B;;;;;;;qBAMF,wBAAwB;MAItB;;;;;qBC/FF;KAED;UAEK;;WAEN;;WAEA;;WAEA;WACA,gBAAgB;;WAEhB;;WAEA;;UAGM;;WAEN;WACA;WACA,gBAAgB;;WAEhB;WACA;;WAEA,cAAc,SAAS;;YAGtB,YAAY,+BAEtB,gBACA,4BAEA;qBAEW,6BAAS,cAAA;;;;;;qBAGT,wBAAwB;MAItB;;;;;qBCzDF;;UAMI;WACN;;WAEA;;WAEA;;WAEA;;WAEA;;WAEA;;WAEA;WACA;;WAEA;;;;;qBAGE,uBAAuB;MAGrB;;;UAME;WACN;WACA,KAAK,SAAS;;;;;;;;qBAuIZ,YAAa,OAAO,mBAAiB,OAAO,OAAO,WAAW;;;;;;;qBAgB9D,gBAAiB,iBAAiB,QAAQ;;;;qBCxH1C;;;;;;;;;qBAgXA,QACX;WAAoB;MACnB,MAAM,MAAM,cAAc,oBAAoB"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/Credentials.ts","../src/ManagementApi.ts","../src/Providers.ts","../src/Push.ts","../src/Deployment.ts","../src/Component.ts","../src/Project.ts","../src/HubClient.ts","../src/RunRecord.ts","../src/State.ts"],"mappings":";;;;;;;;;;;;;;;;UA6BiB;;WAEN,aAAa,SAAS;;WAEtB;;UAGM;;WAEN,aAAa,OAAO,OAAO;;WAE3B,gBAAgB,OAAO;;WAEvB,WAAW,OAAO,OAAO,SAAS;;;qBAGhC,oBAAoB;;qBAKpB;;qBAGA;;;;qBAOA,yBAAyB;;;;;;;;;qBAiCzB,kBAAiB,MAAM,MAAM;;qBA0B7B,aAAc;WAChB,cAAc,SAAS;WACvB,YAAY,SAAS;MAC5B,MAAM,MAAM;;;KC3GJ,mBAAmB,kBAAkB;KACrC,mBAAmB,kBAAkB;;UAGhC,YAAY;WAClB,OAAO;WACP;WACA,UAAU;;;;;;;;;;;;;qBAQR,uBAAuB;UAuBnB;;WAEN,UAAU,GACjB,mBACA,MAAM,QAAQ,qBAAqB,QAAQ,YAAY,QACpD,OAAO,OAAO,GAAG;;WAEb,cACP,mBACA,MAAM,QAAQ,qBAAqB,QAAQ,0BACxC,OAAO,aAAa;;WAEhB,oBAAoB,GAC3B,mBACA,6BACA,WAAW,SAAS,kBACpB,MAAM,QAAQ,qBAAqB,QAAQ,YAAY,QACpD,OAAO,OAAO,GAAG;;;;;;;;WAQb,gBACP,sCACG,OAAO,eAAe;;;;;;;;WAQlB,oBAAoB,mBAAmB,OAAO;;;;;WAK9C,YAAY,OAAO,SAAS,qBAAqB;;;qBAM/C,sBAAsB;;;;qBCzFtB,kBAAkB;;;;;;qBAOlB,YAAa,cAAa,MAAM,MAAM,iBAA2B,MAAA,MAAA,8CAAA,mCAAA,oDAAA;;;;KC8BlE,oBAAoB,SAAS;;;;;;KAO7B;;WAIG;;;;;;;;WAQA;;;;;;;WAOA;;;;;;qBAkCF,0BAA0B;MAIxB;;;;;;;qBAMF,0BAA0B;MAOxB;;;;;;;;;qBAMF,uBAAuB;MAMrB;;;;;;;qBAQF,2BAA2B;MAIzB;;;;;;;qBAMF,oCAAoC;MAIlC;;;;;;qBAMF,kCAAkC;MAIhC;;;qBAuCF,oBACX;EACG;EAAa;;;;UC3HR;;WAEC;aAAoB;;;;;;;;WAOpB;;;;;;WAMA,SAAS;;WAET,MAAM,SAAS,eAAe;;KAG7B,mBACP;;WAEU;MAEV;;WAEU;;;;;WAKA;;;UAIL;WACC;WACA,MAAM;;WAEN;;WAEA;;WAEA;;WAEA;;WAEA;;UAGM,6BAA6B;;WAEnC;;WAEA;;YAGC,aAAa,8BAEvB,iBACA,sBACA,kBACA;;KAQU,kBAAkB,+BAA8B,KACxD,UAAU,kBACR,WAAW;;;;;qBAWJ,wBAAwB;MAGtB;;;;;;;;;;;;qBAeF,cAAU,YACV,OAAS,oBAAe,OAAA,OAAA,mBAAA;;;;;;EAYvB,MAAA,YAAM;IAAc;IAAgB;QAAgB,OAAA,OAAA;;;;;;;;;;qBAMrD,iCAAiC;MAU/B;;;;;;qBAMF,qCAAqC;MAInC;;;;;;;;;qBAMF,4BAA4B;MAS1B;;;;;UC1OE;WACN;WACA;WACA;;;;;;;;;qBAUE,gBAAiB;EAC5B,YAAY;EACZ;EACA,WAAW;MACZ,OAAA,yBAAA;;;;KCWW,mBAAmB;KAEnB;;WAGG;;WAEA;;WAEA,mBAAmB;;WAEnB;;;WAIA;;WAEA;;UAGE;WACN;WACA;WACA;WACA;WACA;WACA;;YAGC,UAAU,2BAA2B,cAAc,0BAA0B;qBAC5E,2BAAO,cAAA;;;;;;;qBAGP,0BAA0B;MAIxB;;;;;;;;;;;;qBASF,gCAAgC;MAS9B;;;;;;;;qBAOF,yBAAyB;MAKvB;;;;;;qBAMF,+BAA+B;MAI7B;;;;;;;qBAMF,wBAAwB;MAItB;;;;;qBC/FF;KAED;UAEK;;WAEN;;WAEA;;WAEA;WACA,gBAAgB;;WAEhB;;WAEA;;UAGM;;WAEN;WACA;WACA,gBAAgB;;WAEhB;WACA;;WAEA,cAAc,SAAS;;YAGtB,YAAY,+BAEtB,gBACA,4BAEA;qBAEW,6BAAS,cAAA;;;;;;qBAGT,wBAAwB;MAItB;;;;;qBCzDF;;UAMI;WACN;;WAEA;;WAEA;;WAEA;;WAEA;;WAEA;;WAEA;WACA;;WAEA;;;;;qBAGE,uBAAuB;MAGrB;;;UAME;WACN;WACA,KAAK,SAAS;;;;;;;;qBAuIZ,YAAa,OAAO,mBAAiB,OAAO,OAAO,WAAW;;;;;;;qBAiB9D,gBAAiB,iBAAiB,QAAQ;;;;qBClH1C;;;;;;;;;qBA8ZA,QACX;WAAoB;MACnB,MAAM,MAAM,cAAc,oBAAoB"}

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as PushTargetMismatch, B as DEPLOY_KEY_ENV, C as DeploymentProvider, D as ConvexAppNotFound, E as CodePushFailed, F as ManagementApi, H as fromValues, I as ManagementApiLive, L as ACCESS_TOKEN_ENV, N as parseDeployOutput, O as ConvexCliNotFound, P as ConvexApiError, R as Credentials, S as DeploymentIdentityChange, T as ProductionDeploymentNotFound, V as fromConfig, _ as ProjectProvider, b as AmbiguousDeployment, c as RUN_RECORD_KEY, d as withRunRecord, f as AmbiguousProject, g as ProjectNotFound, h as ProjectDeploymentChange, i as HubClientProvider, j as VariablesOwnedBySomeoneElse, k as EnvironmentNeedsDeployKey, l as RunRecordError, m as Project, n as HubClient, o as STORE_PROJECT_NAME, p as CreatedProjectNotFound, r as HubClientFailed, s as state, t as HUB_PROJECT_NAME, u as runRecord, v as ProjectTeamChange, w as DeploymentResource, x as Deployment, y as AbsoluteRootDir, z as CredentialsError } from "./HubClient-BZKweNfD.js";
+import { A as PushTargetMismatch, B as DEPLOY_KEY_ENV, C as DeploymentProvider, D as ConvexAppNotFound, E as CodePushFailed, F as ManagementApi, H as fromValues, I as ManagementApiLive, L as ACCESS_TOKEN_ENV, N as parseDeployOutput, O as ConvexCliNotFound, P as ConvexApiError, R as Credentials, S as DeploymentIdentityChange, T as ProductionDeploymentNotFound, V as fromConfig, _ as ProjectProvider, b as AmbiguousDeployment, c as RUN_RECORD_KEY, d as withRunRecord, f as AmbiguousProject, g as ProjectNotFound, h as ProjectDeploymentChange, i as HubClientProvider, j as VariablesOwnedBySomeoneElse, k as EnvironmentNeedsDeployKey, l as RunRecordError, m as Project, n as HubClient, o as STORE_PROJECT_NAME, p as CreatedProjectNotFound, r as HubClientFailed, s as state, t as HUB_PROJECT_NAME, u as runRecord, v as ProjectTeamChange, w as DeploymentResource, x as Deployment, y as AbsoluteRootDir, z as CredentialsError } from "./HubClient-C0XxgkK3.js";
 import { toPath } from "alchemy/FQN";
 import { Stack } from "alchemy/Stack";
 import * as Effect from "effect/Effect";

package/lib/sealedSecret-Bf8AeIp_.js

@@ -0,0 +1,86 @@
+//#region src/store/sealedSecret.ts
+const toBase64 = (bytes) => btoa(Array.from(bytes, (byte) => String.fromCharCode(byte)).join(""));
+const toBase64Url = (bytes) => toBase64(bytes).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+/** The bytes of base64 or base64url text. */
+const fromBase64 = (text) => {
+	const standard = text.replaceAll("-", "+").replaceAll("_", "/");
+	const padded = standard.padEnd(standard.length + (4 - standard.length % 4) % 4, "=");
+	return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+};
+/** A key of 32 bytes in base64 is 43 characters and one `=`. */
+const KEY_TEXT = /^[A-Za-z0-9+/]{43}=$/;
+/**
+* The key ring in the text of the variable `name`. It fails closed when the text is missing or
+* malformed, or when the current key id has no key. An error never quotes the text, which holds
+* the keys.
+*/
+const parseKeyRing = (name, text) => {
+	let value;
+	try {
+		value = JSON.parse(text ?? "");
+	} catch {
+		throw new Error(`${name} is missing or is not JSON.`);
+	}
+	const malformed = /* @__PURE__ */ new Error(`${name} must be {"current":"<keyId>","keys":{"<keyId>":"<base64 of 32 bytes>"}}.`);
+	if (typeof value !== "object" || value === null) throw malformed;
+	if (!("current" in value) || !("keys" in value)) throw malformed;
+	const { current, keys: keyTexts } = value;
+	if (typeof current !== "string" || typeof keyTexts !== "object" || keyTexts === null) throw malformed;
+	const keys = /* @__PURE__ */ new Map();
+	for (const [keyId, key] of Object.entries(keyTexts)) {
+		if (typeof key !== "string" || !KEY_TEXT.test(key)) throw malformed;
+		keys.set(keyId, fromBase64(key));
+	}
+	if (!keys.has(current)) throw new Error(`${name} has no key for its current key id.`);
+	return {
+		current,
+		keys
+	};
+};
+/** A random key id of 12 hexadecimal characters, which is also safe in a variable name. */
+const newKeyId = () => Array.from(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(6)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+/** A random key of 32 bytes in base64. It needs real randomness, like `sealSecret`. */
+const newKey = () => toBase64(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
+/** The text of a new key ring with one random key. */
+const newKeyRing = () => {
+	const keyId = newKeyId();
+	return JSON.stringify({
+		current: keyId,
+		keys: { [keyId]: newKey() }
+	});
+};
+const importKey = (ring, keyId) => {
+	const bytes = ring.keys.get(keyId);
+	if (bytes === void 0) throw new Error(`The key ring has no key "${keyId}".`);
+	return crypto.subtle.importKey("raw", bytes, "AES-GCM", false, ["encrypt", "decrypt"]);
+};
+/** Seals `plaintext` with the current key. `aad` names the owner, so the value opens only there. */
+const sealSecret = async (ring, args) => {
+	const key = await importKey(ring, ring.current);
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv,
+		additionalData: new TextEncoder().encode(args.aad)
+	}, key, new TextEncoder().encode(args.plaintext));
+	return {
+		keyId: ring.current,
+		iv: toBase64Url(iv),
+		ciphertext: toBase64Url(new Uint8Array(ciphertext))
+	};
+};
+/** Opens a sealed value with the key it names. A different `aad` or a changed value fails. */
+const openSecret = async (ring, args) => {
+	const { sealed } = args;
+	const key = await importKey(ring, sealed.keyId);
+	const plaintext = await crypto.subtle.decrypt({
+		name: "AES-GCM",
+		iv: fromBase64(sealed.iv),
+		additionalData: new TextEncoder().encode(args.aad)
+	}, key, fromBase64(sealed.ciphertext));
+	return new TextDecoder().decode(plaintext);
+};
+//#endregion
+export { parseKeyRing as a, openSecret as i, newKeyId as n, sealSecret as o, newKeyRing as r, newKey as t };
+
+//# sourceMappingURL=sealedSecret-Bf8AeIp_.js.map

package/lib/sealedSecret-Bf8AeIp_.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealedSecret-Bf8AeIp_.js","names":[],"sources":["../src/store/sealedSecret.ts"],"sourcesContent":["// AES-256-GCM sealing under a key ring, with Web Crypto only, so that it runs in Convex and in Node.\n//\n// A key ring is the JSON text `{\"current\":\"<keyId>\",\"keys\":{\"<keyId>\":\"<base64 of 32 bytes>\"}}`,\n// which a deployment keeps in one environment variable. `sealSecret` seals with the `current` key.\n// `openSecret` opens with the key that the sealed object names, so an old key stays in the ring\n// until a reseal moves its values to the current key.\n//\n// Seal only where randomness is real: in a Convex action, or outside Convex. In a Convex query or\n// mutation `crypto.getRandomValues` is a seeded deterministic generator, and a repeated IV under one\n// key breaks AES-GCM. Opening draws no randomness, so a query can open.\n\n/** A value sealed with AES-256-GCM under the key `keyId` of a key ring. */\nexport interface SealedSecret {\n  readonly keyId: string;\n  /** 12 random bytes, base64url. */\n  readonly iv: string;\n  /** The AES-GCM output with its 16-byte tag, base64url. */\n  readonly ciphertext: string;\n}\n\nexport interface KeyRing {\n  readonly current: string;\n  readonly keys: ReadonlyMap<string, Uint8Array<ArrayBuffer>>;\n}\n\nconst toBase64 = (bytes: Uint8Array) =>\n  btoa(Array.from(bytes, (byte) => String.fromCharCode(byte)).join(\"\"));\n\nconst toBase64Url = (bytes: Uint8Array) =>\n  toBase64(bytes).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/, \"\");\n\n/** The bytes of base64 or base64url text. */\nconst fromBase64 = (text: string) => {\n  const standard = text.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\");\n  const padded = standard.padEnd(standard.length + ((4 - (standard.length % 4)) % 4), \"=\");\n  return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));\n};\n\n/** A key of 32 bytes in base64 is 43 characters and one `=`. */\nconst KEY_TEXT = /^[A-Za-z0-9+/]{43}=$/;\n\n/**\n * The key ring in the text of the variable `name`. It fails closed when the text is missing or\n * malformed, or when the current key id has no key. An error never quotes the text, which holds\n * the keys.\n */\nexport const parseKeyRing = (name: string, text: string | undefined): KeyRing => {\n  let value: unknown;\n  try {\n    value = JSON.parse(text ?? \"\");\n  } catch {\n    throw new Error(`${name} is missing or is not JSON.`);\n  }\n  const malformed = new Error(\n    `${name} must be {\"current\":\"<keyId>\",\"keys\":{\"<keyId>\":\"<base64 of 32 bytes>\"}}.`,\n  );\n  if (typeof value !== \"object\" || value === null) throw malformed;\n  if (!(\"current\" in value) || !(\"keys\" in value)) throw malformed;\n  const { current, keys: keyTexts } = value;\n  if (typeof current !== \"string\" || typeof keyTexts !== \"object\" || keyTexts === null) {\n    throw malformed;\n  }\n  const keys = new Map<string, Uint8Array<ArrayBuffer>>();\n  for (const [keyId, key] of Object.entries(keyTexts)) {\n    if (typeof key !== \"string\" || !KEY_TEXT.test(key)) throw malformed;\n    keys.set(keyId, fromBase64(key));\n  }\n  if (!keys.has(current)) throw new Error(`${name} has no key for its current key id.`);\n  return { current, keys };\n};\n\n/** A random key id of 12 hexadecimal characters, which is also safe in a variable name. */\nexport const newKeyId = (): string =>\n  Array.from(crypto.getRandomValues(new Uint8Array(6)), (byte) =>\n    byte.toString(16).padStart(2, \"0\"),\n  ).join(\"\");\n\n/** A random key of 32 bytes in base64. It needs real randomness, like `sealSecret`. */\nexport const newKey = (): string => toBase64(crypto.getRandomValues(new Uint8Array(32)));\n\n/** The text of a new key ring with one random key. */\nexport const newKeyRing = (): string => {\n  const keyId = newKeyId();\n  return JSON.stringify({ current: keyId, keys: { [keyId]: newKey() } });\n};\n\nconst importKey = (ring: KeyRing, keyId: string) => {\n  const bytes = ring.keys.get(keyId);\n  if (bytes === undefined) throw new Error(`The key ring has no key \"${keyId}\".`);\n  return crypto.subtle.importKey(\"raw\", bytes, \"AES-GCM\", false, [\"encrypt\", \"decrypt\"]);\n};\n\n/** Seals `plaintext` with the current key. `aad` names the owner, so the value opens only there. */\nexport const sealSecret = async (\n  ring: KeyRing,\n  args: { readonly plaintext: string; readonly aad: string },\n): Promise<SealedSecret> => {\n  const key = await importKey(ring, ring.current);\n  const iv = crypto.getRandomValues(new Uint8Array(12));\n  const ciphertext = await crypto.subtle.encrypt(\n    { name: \"AES-GCM\", iv, additionalData: new TextEncoder().encode(args.aad) },\n    key,\n    new TextEncoder().encode(args.plaintext),\n  );\n  return {\n    keyId: ring.current,\n    iv: toBase64Url(iv),\n    ciphertext: toBase64Url(new Uint8Array(ciphertext)),\n  };\n};\n\n/** Opens a sealed value with the key it names. A different `aad` or a changed value fails. */\nexport const openSecret = async (\n  ring: KeyRing,\n  args: { readonly sealed: SealedSecret; readonly aad: string },\n): Promise<string> => {\n  const { sealed } = args;\n  const key = await importKey(ring, sealed.keyId);\n  const plaintext = await crypto.subtle.decrypt(\n    {\n      name: \"AES-GCM\",\n      iv: fromBase64(sealed.iv),\n      additionalData: new TextEncoder().encode(args.aad),\n    },\n    key,\n    fromBase64(sealed.ciphertext),\n  );\n  return new TextDecoder().decode(plaintext);\n};\n"],"mappings":";AAyBA,MAAM,YAAY,UAChB,KAAK,MAAM,KAAK,QAAQ,SAAS,OAAO,aAAa,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AAEtE,MAAM,eAAe,UACnB,SAAS,KAAK,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;;AAG7E,MAAM,cAAc,SAAiB;CACnC,MAAM,WAAW,KAAK,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;CAC9D,MAAM,SAAS,SAAS,OAAO,SAAS,UAAW,IAAK,SAAS,SAAS,KAAM,GAAI,GAAG;CACvF,OAAO,WAAW,KAAK,KAAK,MAAM,IAAI,cAAc,UAAU,WAAW,CAAC,CAAC;AAC7E;;AAGA,MAAM,WAAW;;;;;;AAOjB,MAAa,gBAAgB,MAAc,SAAsC;CAC/E,IAAI;CACJ,IAAI;EACF,QAAQ,KAAK,MAAM,QAAQ,EAAE;CAC/B,QAAQ;EACN,MAAM,IAAI,MAAM,GAAG,KAAK,4BAA4B;CACtD;CACA,MAAM,4BAAY,IAAI,MACpB,GAAG,KAAK,0EACV;CACA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,MAAM;CACvD,IAAI,EAAE,aAAa,UAAU,EAAE,UAAU,QAAQ,MAAM;CACvD,MAAM,EAAE,SAAS,MAAM,aAAa;CACpC,IAAI,OAAO,YAAY,YAAY,OAAO,aAAa,YAAY,aAAa,MAC9E,MAAM;CAER,MAAM,uBAAO,IAAI,IAAqC;CACtD,KAAK,MAAM,CAAC,OAAO,QAAQ,OAAO,QAAQ,QAAQ,GAAG;EACnD,IAAI,OAAO,QAAQ,YAAY,CAAC,SAAS,KAAK,GAAG,GAAG,MAAM;EAC1D,KAAK,IAAI,OAAO,WAAW,GAAG,CAAC;CACjC;CACA,IAAI,CAAC,KAAK,IAAI,OAAO,GAAG,MAAM,IAAI,MAAM,GAAG,KAAK,oCAAoC;CACpF,OAAO;EAAE;EAAS;CAAK;AACzB;;AAGA,MAAa,iBACX,MAAM,KAAK,OAAO,gCAAgB,IAAI,WAAW,CAAC,CAAC,IAAI,SACrD,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CACnC,CAAC,CAAC,KAAK,EAAE;;AAGX,MAAa,eAAuB,SAAS,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC,CAAC;;AAGvF,MAAa,mBAA2B;CACtC,MAAM,QAAQ,SAAS;CACvB,OAAO,KAAK,UAAU;EAAE,SAAS;EAAO,MAAM,GAAG,QAAQ,OAAO,EAAE;CAAE,CAAC;AACvE;AAEA,MAAM,aAAa,MAAe,UAAkB;CAClD,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK;CACjC,IAAI,UAAU,KAAA,GAAW,MAAM,IAAI,MAAM,4BAA4B,MAAM,GAAG;CAC9E,OAAO,OAAO,OAAO,UAAU,OAAO,OAAO,WAAW,OAAO,CAAC,WAAW,SAAS,CAAC;AACvF;;AAGA,MAAa,aAAa,OACxB,MACA,SAC0B;CAC1B,MAAM,MAAM,MAAM,UAAU,MAAM,KAAK,OAAO;CAC9C,MAAM,KAAK,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC;CACpD,MAAM,aAAa,MAAM,OAAO,OAAO,QACrC;EAAE,MAAM;EAAW;EAAI,gBAAgB,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,GAAG;CAAE,GAC1E,KACA,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,SAAS,CACzC;CACA,OAAO;EACL,OAAO,KAAK;EACZ,IAAI,YAAY,EAAE;EAClB,YAAY,YAAY,IAAI,WAAW,UAAU,CAAC;CACpD;AACF;;AAGA,MAAa,aAAa,OACxB,MACA,SACoB;CACpB,MAAM,EAAE,WAAW;CACnB,MAAM,MAAM,MAAM,UAAU,MAAM,OAAO,KAAK;CAC9C,MAAM,YAAY,MAAM,OAAO,OAAO,QACpC;EACE,MAAM;EACN,IAAI,WAAW,OAAO,EAAE;EACxB,gBAAgB,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,GAAG;CACnD,GACA,KACA,WAAW,OAAO,UAAU,CAC9B;CACA,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS;AAC3C"}

package/lib/sealedSecret.d.ts

@@ -0,0 +1,37 @@
+//#region src/store/sealedSecret.d.ts
+/** A value sealed with AES-256-GCM under the key `keyId` of a key ring. */
+export interface SealedSecret {
+  readonly keyId: string;
+  /** 12 random bytes, base64url. */
+  readonly iv: string;
+  /** The AES-GCM output with its 16-byte tag, base64url. */
+  readonly ciphertext: string;
+}
+export interface KeyRing {
+  readonly current: string;
+  readonly keys: ReadonlyMap<string, Uint8Array<ArrayBuffer>>;
+}
+/**
+ * The key ring in the text of the variable `name`. It fails closed when the text is missing or
+ * malformed, or when the current key id has no key. An error never quotes the text, which holds
+ * the keys.
+ */
+export declare const parseKeyRing: (name: string, text: string | undefined) => KeyRing;
+/** A random key id of 12 hexadecimal characters, which is also safe in a variable name. */
+export declare const newKeyId: () => string;
+/** A random key of 32 bytes in base64. It needs real randomness, like `sealSecret`. */
+export declare const newKey: () => string;
+/** The text of a new key ring with one random key. */
+export declare const newKeyRing: () => string;
+/** Seals `plaintext` with the current key. `aad` names the owner, so the value opens only there. */
+export declare const sealSecret: (ring: KeyRing, args: {
+  readonly plaintext: string;
+  readonly aad: string;
+}) => Promise<SealedSecret>;
+/** Opens a sealed value with the key it names. A different `aad` or a changed value fails. */
+export declare const openSecret: (ring: KeyRing, args: {
+  readonly sealed: SealedSecret;
+  readonly aad: string;
+}) => Promise<string>;
+//#endregion
+//# sourceMappingURL=sealedSecret.d.ts.map

package/lib/sealedSecret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealedSecret.d.ts","names":[],"sources":["../src/store/sealedSecret.ts"],"mappings":";;iBAYiB;WACN;;WAEA;;WAEA;;iBAGM;WACN;WACA,MAAM,oBAAoB,WAAW;;;;;;;qBAwBnC,eAAgB,cAAc,6BAA2B;;qBA0BzD;;qBAMA;;qBAGA;;qBAYA,aACX,MAAM,SACN;WAAiB;WAA4B;MAC5C,QAAQ;;qBAgBE,aACX,MAAM,SACN;WAAiB,QAAQ;WAAuB;MAC/C"}

package/lib/sealedSecret.js

@@ -0,0 +1 @@
+export { t as newKey, n as newKeyId, r as newKeyRing, i as openSecret, a as parseKeyRing, o as sealSecret } from "./sealedSecret-Bf8AeIp_.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@samebase/alchemy-convex",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "The Convex plane for Alchemy v2: projects, deployments, environment variables, and the push of the functions",
   "keywords": [
     "alchemy",
@@ -9,14 +9,15 @@
     "effect",
     "infrastructure-as-code"
   ],
-  "homepage": "https://github.com/samebase/alchemy-convex#readme",
+  "homepage": "https://github.com/samebase/samebase/tree/main/packages/alchemy-convex#readme",
   "bugs": {
-    "url": "https://github.com/samebase/alchemy-convex/issues"
+    "url": "https://github.com/samebase/samebase/issues"
   },
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/samebase/alchemy-convex.git"
+    "url": "git+https://github.com/samebase/samebase.git",
+    "directory": "packages/alchemy-convex"
   },
   "bin": {
     "alchemy-convex": "./lib/cli.js"
@@ -34,22 +35,15 @@
     ".": {
       "types": "./lib/index.d.ts",
       "import": "./lib/index.js"
+    },
+    "./sealed-secret": {
+      "types": "./lib/sealedSecret.d.ts",
+      "import": "./lib/sealedSecret.js"
     }
   },
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "check": "vp fmt --check && vp lint && pnpm run typecheck && vp test --run",
-    "typecheck": "tsc --noEmit",
-    "test": "vp test --run",
-    "test:live": "node ./scripts/test-live.ts",
-    "format": "vp fmt",
-    "lint": "vp lint",
-    "build": "vp pack",
-    "prepack": "pnpm run build",
-    "prepare": "vp config --no-agent"
-  },
   "dependencies": {
     "@convex-dev/platform": "0.1.11"
   },
@@ -65,8 +59,8 @@
     "effect": "4.0.5",
     "publint": "0.3.25",
     "typescript": "6.0.3",
-    "vite-plus": "1.1.0",
-    "vitest": "5.0.3"
+    "vite-plus": "1.3.0",
+    "vitest": "5.0.5"
   },
   "peerDependencies": {
     "@effect/platform-node": "^4.0.5",
@@ -77,5 +71,12 @@
   "engines": {
     "node": ">=22"
   },
-  "packageManager": "pnpm@11.28.5"
-}
+  "scripts": {
+    "check": "pnpm run typecheck && pnpm run lint && pnpm run test && pnpm run build",
+    "typecheck": "tsc --noEmit",
+    "test": "pnpm --dir ../.. exec vp test run --project alchemy-convex",
+    "test:live": "node ./scripts/test-live.ts",
+    "lint": "pnpm --dir ../.. exec vp lint --tsconfig packages/alchemy-convex/tsconfig.json --report-unused-disable-directives packages/alchemy-convex",
+    "build": "vp pack"
+  }
+}

package/src/Project.ts

@@ -249,7 +249,7 @@ export const listProjectsByName = (api: ManagementApiService, teamId: number, na
     const matches: ProjectDetails[] = [];
     const seenCursors = new Set<string>();
     let cursor: string | undefined;
-    while (true) {
+    for (;;) {
       const body = yield* api.request("list projects", (client) =>
         client.GET("/teams/{team_id}/projects", {
           params: {

package/src/Push.ts

@@ -458,7 +458,7 @@ const listVariables = (url: string, key: Redacted.Redacted<string>) =>
   );
 
 /** One call that sets variables, or removes those whose value is null. */
-const writeVariables = (
+export const writeVariables = (
   url: string,
   key: Redacted.Redacted<string>,
   changes: ReadonlyArray<{ readonly name: string; readonly value: string | null }>,

package/src/RunRecord.ts

@@ -188,6 +188,7 @@ export const runRecord = (where: RunEnvironment): Effect.Effect<RunRecord, RunRe
   where.env["GITHUB_ACTIONS"] === "true" ? fromGitHubActions(where) : fromGit(where);
 
 /** A plain object, which a spread keeps whole. A Date, a Duration, or a Redacted value is an object too, and a spread loses it. */
+// eslint-disable-next-line samebase/no-hand-written-type-predicate -- This published package depends on no app package; the body checks the prototype.
 const isPlainObject = (value: unknown): value is Record<string, unknown> => {
   if (typeof value !== "object" || value === null) return false;
   const prototype: unknown = Object.getPrototypeOf(value);