@samebase/alchemy-convex 0.2.0 → 0.3.0

package/lib/index.js

@@ -1,25 +1,42 @@
-import { readFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import * as Config from "effect/Config";
-import * as Context from "effect/Context";
-import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Redacted from "effect/Redacted";
-import * as Schema from "effect/Schema";
+import { createRequire } from "node:module";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { stripVTControlCharacters } from "node:util";
 import { Resource } from "alchemy";
 import { AdoptPolicy, OwnedBySomeoneElse, Unowned } from "alchemy/AdoptPolicy";
-import { havePropsChanged, isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
+import * as Clock from "effect/Clock";
+import * as Effect from "effect/Effect";
+import * as ChildProcess from "effect/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
+import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
 import { AlchemyContext } from "alchemy/AlchemyContext";
 import { Stack } from "alchemy/Stack";
 import * as Option from "effect/Option";
+import { havePropsChanged, isResolved } from "alchemy/Diff";
 import { createDeploymentClient, createManagementClient } from "@convex-dev/platform";
+import * as Context from "effect/Context";
+import * as Layer from "effect/Layer";
 import * as Schedule from "effect/Schedule";
-import { stripVTControlCharacters } from "node:util";
+import * as Config from "effect/Config";
 import { CommandExecutor, CommandExecutorLive } from "alchemy/Command";
 import { hashDirectory } from "alchemy/Command/Memo";
 import { createHash } from "node:crypto";
+//#region src/Adoption.ts
+/** True when the resource `fqn` may take over an object that is not in state. */
+const shouldAdopt = (fqn) => Effect.gen(function* () {
+	const stack = yield* Effect.serviceOption(Stack);
+	const own = Option.isSome(stack) ? stack.value.resources[fqn]?.Adopt : void 0;
+	if (own !== void 0) return own;
+	const policy = yield* Effect.serviceOption(AdoptPolicy);
+	if (Option.isSome(policy)) return policy.value;
+	const context = yield* Effect.serviceOption(AlchemyContext);
+	return Option.isSome(context) && context.value.adopt;
+});
+//#endregion
 //#region src/Credentials.ts
 var Credentials = class extends Context.Service()("@samebase/alchemy-convex/Credentials") {};
 /** Environment variable read by {@link fromConfig}. */
@@ -60,18 +77,6 @@ const fromToken = (accessToken) => Layer.succeed(Credentials, Effect.succeed({
 	source: "explicit"
 }));
 //#endregion
-//#region src/Adoption.ts
-/** True when the resource `fqn` may take over an object that is not in state. */
-const shouldAdopt = (fqn) => Effect.gen(function* () {
-	const stack = yield* Effect.serviceOption(Stack);
-	const own = Option.isSome(stack) ? stack.value.resources[fqn]?.Adopt : void 0;
-	if (own !== void 0) return own;
-	const policy = yield* Effect.serviceOption(AdoptPolicy);
-	if (Option.isSome(policy)) return policy.value;
-	const context = yield* Effect.serviceOption(AlchemyContext);
-	return Option.isSome(context) && context.value.adopt;
-});
-//#endregion
 //#region src/ManagementApi.ts
 /**
 * One error for every control-plane and deployment call. Resources branch on
@@ -184,6 +189,196 @@ const ManagementApiLive = () => Layer.effect(ManagementApi, Effect.gen(function*
 	};
 }));
 //#endregion
+//#region src/Deployment.ts
+const Deployment = Resource("Convex.Deployment", { defaultRemovalPolicy: "retain" });
+/** The props name another deployment than the one in state. */
+var DeploymentIdentityChange = class extends Schema.TaggedError()("DeploymentIdentityChange", {
+	/** Name of the deployment in state, such as `happy-animal-123`. */
+	deployment: Schema.String,
+	field: Schema.Literals([
+		"projectId",
+		"type",
+		"name"
+	]),
+	current: Schema.String,
+	requested: Schema.String
+}) {
+	get message() {
+		return `Convex.Deployment cannot change the ${this.field} of deployment ${this.deployment} from ${this.current} to ${this.requested}. Set ${this.field} back to ${this.current}. For another deployment, create a new resource with a new logical id.`;
+	}
+};
+/** The project has no default production deployment for a `prod` resource to take over. */
+var ProductionDeploymentNotFound = class extends Schema.TaggedError()("ProductionDeploymentNotFound", { projectId: Schema.Number }) {
+	get message() {
+		return `Project ${this.projectId} has no default production deployment, and Convex.Deployment does not create one. Create it in the Convex dashboard, or with \`npx convex deployment create --type prod --default\` in the project, then run the deploy again.`;
+	}
+};
+/** More than one deployment of the project has the name, so the lookup cannot choose one. */
+var AmbiguousDeployment = class extends Schema.TaggedError()("AmbiguousDeployment", {
+	projectId: Schema.Number,
+	type: Schema.Literals(["dev", "preview"]),
+	name: Schema.String,
+	deployments: Schema.Array(Schema.String)
+}) {
+	get message() {
+		return `Project ${this.projectId} has ${this.deployments.length} ${this.type} deployments named "${this.name}" (${this.deployments.join(", ")}). Convex.Deployment does not choose one. Delete the extra deployments in the Convex dashboard, or use another name.`;
+	}
+};
+/**
+* The URL of a Convex cloud deployment: `https://<name>.convex.cloud`, or
+* `https://<name>.<region>.convex.cloud` outside US East.
+*/
+const CLOUD_URL = /^https:\/\/[a-z0-9]+(?:-[a-z0-9]+)*(?:\.[a-z0-9]+(?:-[a-z0-9]+)*)?\.convex\.cloud$/;
+/**
+* The HTTP actions URL of a deployment: the client URL with `.convex.site`
+* for `.convex.cloud`, as Convex sets CONVEX_SITE_URL. Custom domains are
+* not covered.
+*/
+const siteUrlOf = (url) => url.replace(/\.convex\.cloud$/, ".convex.site");
+/** One row of list_deployments, GET /deployments/{name}, and create_deployment. Only the fields the provider uses. */
+const DeploymentRow$1 = Schema.Struct({
+	name: Schema.String,
+	projectId: Schema.Number,
+	deploymentType: Schema.String,
+	isDefault: Schema.Boolean,
+	reference: Schema.String,
+	/** Set in list_deployments and create_deployment rows only: GET /deployments/{name} answers null. */
+	previewIdentifier: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	deploymentUrl: Schema.String.check(Schema.isPattern(CLOUD_URL))
+});
+const DeploymentRows$1 = Schema.Array(DeploymentRow$1);
+const attributesOf = (row, type, previewName) => ({
+	projectId: row.projectId,
+	type,
+	name: row.name,
+	reference: row.reference,
+	previewName: type === "preview" ? previewName : void 0,
+	url: row.deploymentUrl,
+	siteUrl: siteUrlOf(row.deploymentUrl)
+});
+/** The `name` prop of the deployment in state: the dev reference or the preview name. */
+const nameOf = (attributes) => attributes.type === "dev" ? attributes.reference : attributes.type === "preview" ? attributes.previewName : void 0;
+/**
+* Fails with {@link DeploymentIdentityChange} when the props name another
+* deployment than `current`: the attributes in state, or a live row.
+*/
+const checkIdentity$2 = (current, news) => {
+	const change = (field, from, to) => Effect.fail(new DeploymentIdentityChange({
+		deployment: current.name,
+		field,
+		current: from,
+		requested: to
+	}));
+	if (current.projectId !== news.projectId) return change("projectId", String(current.projectId), String(news.projectId));
+	if (current.type !== news.type) return change("type", current.type, news.type);
+	const currentName = nameOf(current);
+	if (news.type !== "prod" && currentName !== news.name) return change("name", currentName ?? "(none)", news.name);
+	return Effect.void;
+};
+const DeploymentProvider = () => Provider.effect(Deployment, Effect.gen(function* () {
+	const api = yield* ManagementApi;
+	/** The live deployment, or undefined after a 404. GET /deployments/{name} answers no preview identifier. */
+	const getByName = (name) => absentAsUndefined(api.request("get deployment", (client) => client.GET("/deployments/{deployment_name}", { params: { path: { deployment_name: name } } }))).pipe(Effect.map((body) => body === void 0 ? void 0 : Schema.decodeUnknownSync(DeploymentRow$1)(body)));
+	const listDeployments = (projectId, type, isDefault) => api.request("list deployments", (client) => client.GET("/projects/{project_id}/list_deployments", { params: {
+		path: { project_id: projectId },
+		query: {
+			deploymentType: type,
+			...isDefault === void 0 ? {} : { isDefault }
+		}
+	} })).pipe(Effect.map((body) => Schema.decodeUnknownSync(DeploymentRows$1)(body)));
+	/** The project's default production deployment, or undefined. */
+	const production = (projectId) => listDeployments(projectId, "prod", true).pipe(Effect.map((rows) => {
+		const row = rows.find((candidate) => candidate.deploymentType === "prod" && candidate.isDefault);
+		return row === void 0 ? void 0 : attributesOf(row, "prod", void 0);
+	}));
+	/**
+	* The one dev deployment with this reference, or the one preview
+	* deployment with this preview name, or undefined.
+	*/
+	const findByName = (projectId, type, name) => Effect.gen(function* () {
+		const matches = (yield* listDeployments(projectId, type)).filter((row) => row.deploymentType === type && (type === "dev" ? row.reference === name : row.previewIdentifier === name));
+		if (matches.length > 1) return yield* new AmbiguousDeployment({
+			projectId,
+			type,
+			name,
+			deployments: matches.map((row) => row.name)
+		});
+		return matches[0];
+	});
+	/** The deployment that the props name, for a resource without state. */
+	const lookup = (news) => news.type === "prod" ? production(news.projectId) : findByName(news.projectId, news.type, news.name).pipe(Effect.map((row) => row === void 0 ? void 0 : attributesOf(row, news.type, news.name)));
+	return {
+		stables: [
+			"projectId",
+			"type",
+			"previewName"
+		],
+		diff: Effect.fn(function* ({ news, output }) {
+			if (!isResolved(news) || output === void 0) return void 0;
+			yield* checkIdentity$2(output, news);
+			if (news.type === "prod") return (yield* absentAsUndefined(production(news.projectId)))?.name === output.name ? void 0 : { action: "update" };
+			return (yield* getByName(output.name)) === void 0 ? { action: "update" } : void 0;
+		}),
+		read: Effect.fn(function* ({ olds, output }) {
+			if (output?.type === "prod") return yield* absentAsUndefined(production(output.projectId));
+			if (output !== void 0) {
+				const live = yield* getByName(output.name);
+				return live === void 0 ? void 0 : attributesOf(live, output.type, output.previewName);
+			}
+			const found = yield* lookup(olds);
+			if (found === void 0) return void 0;
+			return olds.type === "prod" ? found : Unowned(found);
+		}),
+		reconcile: Effect.fn(function* ({ fqn, news, output }) {
+			if (output !== void 0) yield* checkIdentity$2(output, news);
+			if (news.type === "prod") {
+				const current = yield* production(news.projectId);
+				if (current === void 0) return yield* new ProductionDeploymentNotFound({ projectId: news.projectId });
+				return current;
+			}
+			if (output !== void 0) {
+				const live = yield* getByName(output.name);
+				if (live !== void 0) {
+					if (live.deploymentType !== output.type) return yield* new DeploymentIdentityChange({
+						deployment: live.name,
+						field: "type",
+						current: live.deploymentType,
+						requested: news.type
+					});
+					const current = attributesOf(live, output.type, output.previewName);
+					yield* checkIdentity$2(current, news);
+					return current;
+				}
+			}
+			const existing = yield* lookup(news);
+			if (existing !== void 0) {
+				if (!(yield* shouldAdopt(fqn))) return yield* new OwnedBySomeoneElse({
+					message: `Project ${news.projectId} already has ${news.type} deployment ${existing.name} named "${news.name}". Re-run with --adopt to take it over, or use another name.`,
+					resourceType: Deployment.Type,
+					physicalName: existing.name
+				});
+				return existing;
+			}
+			const created = yield* api.request("create deployment", (client) => client.POST("/projects/{project_id}/create_deployment", {
+				params: { path: { project_id: news.projectId } },
+				body: {
+					type: news.type,
+					reference: news.name
+				}
+			}));
+			return attributesOf(Schema.decodeUnknownSync(DeploymentRow$1)(created), news.type, news.name);
+		}),
+		delete: Effect.fn(function* ({ output }) {
+			const keep = Effect.logWarning(`Convex.Deployment does not delete production deployment ${output.name}: it belongs to project ${output.projectId}. To delete it, delete the project with RemovalPolicy.destroy() on Convex.Project.`);
+			if (output.type === "prod") return yield* keep;
+			const live = yield* getByName(output.name);
+			if (live === void 0) return;
+			if (live.deploymentType === "prod") return yield* keep;
+			yield* absentAsUndefined(retryIdempotentWrite(api.requestVoid("delete deployment", (client) => client.POST("/deployments/{deployment_name}/delete", { params: { path: { deployment_name: output.name } } }))));
+		})
+	};
+}));
+//#endregion
 //#region src/EnvironmentVariable.ts
 /**
 * The variable's identity when the listing has `name`. Own keys only: a
@@ -194,13 +389,19 @@ const findVariable = (list, deployment, name) => Object.hasOwn(list.environmentV
 	name
 } : void 0;
 /**
-* One attempt to set one variable, or to remove it when `value` is null. The
-* deployment answers 200 with an empty body, so this reads no response data.
+* One attempt to set variables, or to remove those whose `value` is null, in
+* one call. The deployment answers 200 with an empty body, so this reads no
+* response data.
 */
-const writeVariable = (deployment, deployKey, name, value) => settleVoid("update environment variables", () => createDeploymentClient(deployment, Redacted.value(deployKey)).POST("/update_environment_variables", { body: { changes: [{
+const writeVariables = (deployment, deployKey, changes) => settleVoid("update environment variables", () => createDeploymentClient(deployment, Redacted.value(deployKey)).POST("/update_environment_variables", { body: { changes: changes.map(({ name, value }) => ({
 	name,
 	value: Redacted.isRedacted(value) ? Redacted.value(value) : value
-}] } }));
+})) } }));
+/** One attempt to set one variable, or to remove it when `value` is null. */
+const writeVariable = (deployment, deployKey, name, value) => writeVariables(deployment, deployKey, [{
+	name,
+	value
+}]);
 /**
 * Sets one variable, or removes it when `value` is null. The call sets a
 * value, so it runs again after a write conflict or a 5xx answer, for example
@@ -210,6 +411,8 @@ const writeVariable = (deployment, deployKey, name, value) => settleVoid("update
 const updateVariable = (deployment, deployKey, name, value) => retryIdempotentWrite(writeVariable(deployment, deployKey, name, value));
 /** GET https://<deployment>.convex.cloud/api/v1/list_environment_variables */
 const EnvironmentVariableList = Schema.Struct({ environmentVariables: Schema.Record(Schema.String, Schema.String) });
+/** Every variable of the deployment with its value. Fails with a 404 when the deployment is gone. */
+const listVariables = (deployment, deployKey) => settle("list environment variables", () => createDeploymentClient(deployment, Redacted.value(deployKey)).GET("/list_environment_variables")).pipe(Effect.map((body) => Schema.decodeUnknownSync(EnvironmentVariableList)(body).environmentVariables));
 /** The variable's identity, or undefined when the variable or the deployment is absent. */
 const readVariable = (api, deployment, deployKey, name) => absentAsUndefined(api.deploymentRequest("list environment variables", deployment, deployKey, (client) => client.GET("/list_environment_variables"))).pipe(Effect.map((body) => body === void 0 ? void 0 : findVariable(Schema.decodeUnknownSync(EnvironmentVariableList)(body), deployment, name)));
 const EnvironmentVariable = Resource("Convex.EnvironmentVariable");
@@ -297,6 +500,261 @@ const EnvironmentVariableProvider = () => Provider.effect(EnvironmentVariable, E
 	};
 }));
 //#endregion
+//#region src/Code.ts
+const Code = Resource("Convex.Code");
+/**
+* The CLI prints this line with `logFinishedStep` after the push succeeds, to
+* stderr (convex 1.46 `cli/lib/deploy2.js` for existing deployments,
+* `cli/deploy.js` for preview deployments). The host is
+* `<deployment>.convex.cloud` or `<deployment>.<region>.convex.cloud`.
+*/
+const DEPLOYED_LINE = /Deployed Convex functions to (https:\/\/([a-z0-9]+(?:-[a-z0-9]+)*)(?:\.[a-z0-9]+(?:-[a-z0-9]+)*)?\.convex\.cloud)\/?(?=\s|$)/m;
+/** Reads the deployment URL from `convex deploy` output. ANSI escape codes are removed first. */
+const parseDeployOutput = (text) => {
+	const match = DEPLOYED_LINE.exec(stripVTControlCharacters(text));
+	const url = match?.[1];
+	const deploymentName = match?.[2];
+	return url === void 0 || deploymentName === void 0 ? void 0 : {
+		url,
+		deploymentName
+	};
+};
+/**
+* What a deploy key targets, from its prefix: `<type>:<deployment>|<secret>`
+* (or `<deployment>|<secret>` in old keys) for one deployment,
+* `preview:<team>:<project>|<secret>` for preview deployments of a project,
+* `project:<team>:<project>|<secret>` for the project's production
+* deployment. Same rules as convex 1.46 `cli/lib/deployment.js`.
+*/
+const keyTargetOf = (key) => {
+	const bar = key.indexOf("|");
+	if (bar <= 0 || /[\s#'"`]/.test(key)) return { kind: "unknown" };
+	const parts = key.slice(0, bar).split(":");
+	const [first, second] = parts;
+	if (parts.length === 3 && first === "preview") return { kind: "preview" };
+	if (parts.length === 3 && first === "project") return { kind: "project" };
+	if (parts.length === 2 && second) return {
+		kind: "deployment",
+		deployment: second
+	};
+	if (parts.length === 1 && first) return {
+		kind: "deployment",
+		deployment: first
+	};
+	return { kind: "unknown" };
+};
+/** The deploy key does not fit the deployment. Checked before the push. */
+var DeployKeyMismatch = class extends Schema.TaggedError()("DeployKeyMismatch", {
+	/** The deployment that should receive the push. */
+	deployment: Schema.String,
+	/** What the key targets. */
+	key: Schema.Literals([
+		"deployment",
+		"preview",
+		"project",
+		"unknown"
+	]),
+	/** For a deployment key: the deployment in the key prefix. Never the secret. */
+	keyDeployment: Schema.UndefinedOr(Schema.String)
+}) {
+	get message() {
+		switch (this.key) {
+			case "deployment": return `The deploy key is for deployment ${this.keyDeployment}, not for ${this.deployment}. Pass a deploy key of ${this.deployment}, such as Convex.DeployKey with deployment ${this.deployment}.`;
+			case "preview": return `A preview deploy key pushes to a preview deployment by its preview name, and ${this.deployment} is not a Convex.Deployment of type "preview". Pass the Convex.Deployment preview resource as deployment, or a deploy key of ${this.deployment}.`;
+			case "project": return `Convex.Code does not take a project deploy key: it cannot check before the push that the key targets ${this.deployment}. Pass a deploy key of ${this.deployment} (Convex.DeployKey).`;
+			case "unknown": return `deployKey is not a Convex deploy key ("<type>:<deployment>|<secret>" or "preview:<team>:<project>|<secret>"). Pass Convex.DeployKey(...).deployKey or Convex.PreviewDeployKey(...).previewDeployKey.`;
+		}
+	}
+};
+/** `env` needs the deployment API, which takes only a deploy key of the deployment. */
+var EnvironmentNeedsDeployKey = class extends Schema.TaggedError()("EnvironmentNeedsDeployKey", { deployment: Schema.String }) {
+	get message() {
+		return `Convex.Code cannot set or remove env variables on ${this.deployment} with a preview deploy key: the deployment API takes only a deploy key of the deployment. Pass a Convex.DeployKey of ${this.deployment}, or use Convex.DefaultEnvironmentVariable with deploymentType "preview" for values that every new preview deployment gets.`;
+	}
+};
+/** No `convex` package resolves from `cwd`. */
+var ConvexCliNotFound = class extends Schema.TaggedError()("ConvexCliNotFound", { cwd: Schema.String }) {
+	get message() {
+		return `Convex.Code found no installed convex package from ${this.cwd}, and it does not download one. Install convex in the app (npm install convex), set cwd to the app directory, or set the command prop.`;
+	}
+};
+/** The Convex CLI failed, or exited 0 without the deployment URL. The output tail never contains the key. */
+var CodePushFailed = class extends Schema.TaggedError()("CodePushFailed", {
+	/** Exit code of the CLI. Undefined when it did not start or a signal stopped it. */
+	exitCode: Schema.UndefinedOr(Schema.Number),
+	/** The last lines of the CLI output, with the deploy key removed. */
+	outputTail: Schema.String
+}) {
+	get message() {
+		return this.exitCode === 0 ? `convex deploy exited 0 but printed no "Deployed Convex functions to <url>" line, so Convex.Code has no deployment URL. Last output, with the deploy key removed:\n${this.outputTail}` : `convex deploy failed${this.exitCode === void 0 ? "" : ` with exit code ${this.exitCode}`}. Last output, with the deploy key removed:\n${this.outputTail}`;
+	}
+};
+/** The CLI pushed to another deployment than the one in the props. Checked after the push. */
+var PushTargetMismatch = class extends Schema.TaggedError()("PushTargetMismatch", {
+	expected: Schema.String,
+	actual: Schema.String
+}) {
+	get message() {
+		return `The Convex CLI pushed the functions to deployment ${this.actual}, but Convex.Code expected ${this.expected}. With a preview deploy key, this happens when the key belongs to another project, or when the preview deployment ${this.expected} expired during the deploy and the CLI created ${this.actual} for the same preview name. Check the key. After an expiry, run the deploy again with --adopt, so that Convex.Deployment takes over ${this.actual}.`;
+	}
+};
+/**
+* Checks that the key fits the deployment, and returns the preview name for
+* `--preview-name` when the key is a preview deploy key.
+*/
+const previewNameFor = (target, keyTarget, changesEnvironment) => {
+	const mismatch = new DeployKeyMismatch({
+		deployment: target.name,
+		key: keyTarget.kind,
+		keyDeployment: keyTarget.kind === "deployment" ? keyTarget.deployment : void 0
+	});
+	switch (keyTarget.kind) {
+		case "deployment": return keyTarget.deployment === target.name ? Effect.succeed(void 0) : Effect.fail(mismatch);
+		case "preview":
+			if (target.type !== "preview" || target.previewName === void 0) return Effect.fail(mismatch);
+			return changesEnvironment ? Effect.fail(new EnvironmentNeedsDeployKey({ deployment: target.name })) : Effect.succeed(target.previewName);
+		case "project":
+		case "unknown": return Effect.fail(mismatch);
+		default: return keyTarget;
+	}
+};
+/** The last non-empty lines of `text`, without escape codes and with every secret replaced. */
+const outputTail = (text, secrets) => secrets.reduce((redacted, secret) => redacted.split(secret).join("[REDACTED]"), stripVTControlCharacters(text)).split(/\r?\n|\r/).filter((line) => line.trim() !== "").slice(-20).join("\n");
+const CliManifest = Schema.Struct({ bin: Schema.Union([Schema.String, Schema.Record(Schema.String, Schema.String)]) });
+/** `[node, <convex bin>]` for the `convex` package that `cwd` resolves. Never downloads. */
+const installedCli = (cwd) => Effect.tryPromise({
+	try: async () => {
+		const manifestPath = createRequire(join(cwd, "package.json")).resolve("convex/package.json");
+		const { bin } = Schema.decodeUnknownSync(Schema.fromJsonString(CliManifest))(await readFile(manifestPath, "utf8"));
+		const entry = typeof bin === "string" ? bin : bin["convex"];
+		if (entry === void 0) throw new Error("the convex package has no convex bin");
+		return [process.execPath, resolve(dirname(manifestPath), entry)];
+	},
+	catch: () => new ConvexCliNotFound({ cwd })
+});
+/**
+* Runs `use` with an env file that holds the key, in a new temporary
+* directory, and removes the directory afterwards: on success, on failure,
+* and on interruption.
+*/
+const withKeyFile = (key, use) => Effect.acquireUseRelease(Effect.promise(() => mkdtemp(join(tmpdir(), "alchemy-convex-"))), (home) => Effect.promise(() => writeFile(join(home, "deploy.env"), `CONVEX_DEPLOY_KEY=${key}\n`, { mode: 384 })).pipe(Effect.andThen(use({
+	envFile: join(home, "deploy.env"),
+	home
+}))), (home) => Effect.promise(() => rm(home, {
+	recursive: true,
+	force: true
+})));
+/**
+* The environment of the CLI: this process's variables without `CONVEX_*`,
+* with `home` as the home directory.
+*/
+const cliEnvironment = (home) => ({
+	...Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.toUpperCase().startsWith("CONVEX_"))),
+	HOME: home,
+	USERPROFILE: home,
+	XDG_CONFIG_HOME: home
+});
+const CodeProvider = () => Provider.effect(Code, Effect.gen(function* () {
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	/** Runs the CLI with piped output. Interruption stops its process group. */
+	const run = (argv, cwd, home) => Effect.gen(function* () {
+		const [command, ...args] = argv;
+		const child = yield* spawner.spawn(ChildProcess.make(command, args, {
+			cwd,
+			env: cliEnvironment(home),
+			extendEnv: false,
+			stdin: "ignore",
+			stdout: "pipe",
+			stderr: "pipe"
+		}));
+		const [exitCode, stdout, stderr] = yield* Effect.all([
+			child.exitCode,
+			Stream.mkString(Stream.decodeText(child.stdout)),
+			Stream.mkString(Stream.decodeText(child.stderr))
+		], { concurrency: "unbounded" });
+		return {
+			exitCode: Number(exitCode),
+			output: `${stdout}\n${stderr}`
+		};
+	}).pipe(Effect.scoped);
+	return {
+		diff: () => Effect.succeed({ action: "update" }),
+		reconcile: Effect.fn(function* ({ fqn, news, output }) {
+			const target = typeof news.deployment === "string" ? {
+				name: news.deployment,
+				address: news.deployment,
+				type: void 0,
+				previewName: void 0
+			} : {
+				...news.deployment,
+				address: news.deployment.url
+			};
+			const key = Redacted.value(news.deployKey);
+			const secrets = [key, key.slice(key.indexOf("|") + 1)].filter((secret) => secret.length >= 8);
+			const env = Object.entries(news.env ?? {}).sort(([a], [b]) => a < b ? -1 : 1);
+			const previous = output !== void 0 && output.deploymentName === target.name ? output.envNames : [];
+			const removed = previous.filter((name) => !env.some(([envName]) => envName === name));
+			const previewName = yield* previewNameFor(target, keyTargetOf(key), env.length > 0 || removed.length > 0);
+			const cwd = resolve(news.cwd);
+			const program = news.command ?? (yield* installedCli(cwd));
+			if (env.length > 0 || removed.length > 0) {
+				const adopt = yield* shouldAdopt(fqn);
+				const fresh = env.filter(([name]) => !previous.includes(name));
+				yield* retryIdempotentWrite(Effect.gen(function* () {
+					if (fresh.length > 0 && !adopt) {
+						const current = yield* listVariables(target.address, news.deployKey);
+						const taken = fresh.filter(([name, value]) => Object.hasOwn(current, name) && current[name] !== (Redacted.isRedacted(value) ? Redacted.value(value) : value)).map(([name]) => name);
+						if (taken.length > 0) return yield* new OwnedBySomeoneElse({
+							message: `Environment variables ${taken.join(", ")} already exist on deployment ${target.name} with other values. Re-run with --adopt to take them over and overwrite them, or remove them from env.`,
+							resourceType: Code.Type,
+							physicalName: target.name
+						});
+					}
+					yield* writeVariables(target.address, news.deployKey, [...env.map(([name, value]) => ({
+						name,
+						value
+					})), ...removed.map((name) => ({
+						name,
+						value: null
+					}))]);
+				}));
+			}
+			const args = [
+				"deploy",
+				...previewName === void 0 ? [] : ["--preview-name", previewName],
+				...news.typecheck === void 0 ? [] : [`--typecheck=${news.typecheck}`],
+				...news.codegen === void 0 ? [] : [`--codegen=${news.codegen}`]
+			];
+			const result = yield* withKeyFile(key, ({ envFile, home }) => run([
+				...program,
+				...args,
+				"--env-file",
+				envFile
+			], cwd, home)).pipe(Effect.mapError((error) => new CodePushFailed({
+				exitCode: void 0,
+				outputTail: outputTail(error.message, secrets)
+			})));
+			const deployed = parseDeployOutput(result.output);
+			if (result.exitCode !== 0 || deployed === void 0) return yield* new CodePushFailed({
+				exitCode: result.exitCode,
+				outputTail: outputTail(result.output, secrets)
+			});
+			if (deployed.deploymentName !== target.name) return yield* new PushTargetMismatch({
+				expected: target.name,
+				actual: deployed.deploymentName
+			});
+			return {
+				deploymentName: deployed.deploymentName,
+				url: deployed.url,
+				siteUrl: siteUrlOf(deployed.url),
+				deployedAt: yield* Clock.currentTimeMillis,
+				envNames: env.map(([name]) => name)
+			};
+		}),
+		delete: () => Effect.void
+	};
+}));
+//#endregion
 //#region src/DefaultEnvironmentVariable.ts
 /**
 * Attributes when the listing has `name` for `deploymentType`. An unfiltered
@@ -404,24 +862,13 @@ const DefaultEnvironmentVariableProvider = () => Provider.effect(DefaultEnvironm
 }));
 //#endregion
 //#region src/Deploy.ts
-const Deploy = Resource("Convex.Deploy");
 /**
-* The CLI prints this line with `logFinishedStep` after the push succeeds, to
-* stderr (convex 1.45 `cli/lib/deploy2.js` for existing deployments,
-* `cli/deploy.js` for preview deployments). The host is
-* `<deployment>.convex.cloud` or `<deployment>.<region>.convex.cloud`.
+* @deprecated Since 0.3.0. Use Convex.Code with a Convex.Deployment: it
+* runs the installed Convex CLI, keeps the deploy key out of the process
+* environment, checks that the key fits the deployment, and outputs the site
+* URL. Removing a Deploy resource changes nothing in Convex.
 */
-const DEPLOYED_LINE = /Deployed Convex functions to (https:\/\/([a-z0-9]+(?:-[a-z0-9]+)*)(?:\.[a-z0-9]+(?:-[a-z0-9]+)*)?\.convex\.cloud)\/?(?=\s|$)/m;
-/** Reads the deployment URL from `convex deploy` output. ANSI escape codes are removed first. */
-const parseDeployOutput = (text) => {
-	const match = DEPLOYED_LINE.exec(stripVTControlCharacters(text));
-	const url = match?.[1];
-	const deploymentName = match?.[2];
-	return url === void 0 || deploymentName === void 0 ? void 0 : {
-		url,
-		deploymentName
-	};
-};
+const Deploy = Resource("Convex.Deploy");
 /** The `convex deploy` argv, starting with `npx`. */
 const deployArgs = (props) => [
 	"npx",
@@ -951,13 +1398,15 @@ var Providers = class extends Provider.ProviderCollection()("Convex") {};
 */
 const providers = (credentials = fromConfig()) => Layer.effect(Providers, Provider.collection([
 	Project,
+	Deployment,
 	DeployKey,
 	PreviewDeployKey,
 	EnvironmentVariable,
 	DefaultEnvironmentVariable,
+	Code,
 	Deploy
-])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), DeployKeyProvider(), PreviewDeployKeyProvider(), EnvironmentVariableProvider(), DefaultEnvironmentVariableProvider(), DeployProvider())), Layer.provide(ManagementApiLive()), Layer.provide(credentials), Layer.provide(CommandExecutorLive()), Layer.orDie);
+])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), DeploymentProvider(), DeployKeyProvider(), PreviewDeployKeyProvider(), EnvironmentVariableProvider(), DefaultEnvironmentVariableProvider(), CodeProvider(), DeployProvider())), Layer.provide(ManagementApiLive()), Layer.provide(credentials), Layer.provide(CommandExecutorLive()), Layer.orDie);
 //#endregion
-export { ACCESS_TOKEN_ENV, AmbiguousProject, ConvexApiError, CreatedProjectNotFound, Credentials, CredentialsError, DefaultEnvironmentVariable, Deploy, DeployArgumentError, DeployKey, DeployKeyIsCredential, DeployKeyRecoveryRequired, DeployOutputError, EnvironmentVariable, ManagementApi, PreviewDeployKey, Project, ProjectDeploymentChange, ProjectTeamChange, Providers, VariableIdentityChange, deployArgs, fromConfig, fromToken, parseDeployOutput, providers };
+export { ACCESS_TOKEN_ENV, AmbiguousDeployment, AmbiguousProject, Code, CodePushFailed, ConvexApiError, ConvexCliNotFound, CreatedProjectNotFound, Credentials, CredentialsError, DefaultEnvironmentVariable, Deploy, DeployArgumentError, DeployKey, DeployKeyIsCredential, DeployKeyMismatch, DeployKeyRecoveryRequired, DeployOutputError, Deployment, DeploymentIdentityChange, EnvironmentNeedsDeployKey, EnvironmentVariable, ManagementApi, PreviewDeployKey, ProductionDeploymentNotFound, Project, ProjectDeploymentChange, ProjectTeamChange, Providers, PushTargetMismatch, VariableIdentityChange, deployArgs, fromConfig, fromToken, parseDeployOutput, providers };
 
 //# sourceMappingURL=index.js.map