@samebase/alchemy-convex 0.27.3 → 0.29.0

package/README.md

@@ -44,8 +44,8 @@ export default Alchemy.Stack(
     const backend =
       stage === "prod"
         ? yield* Convex.Deployment("Backend", {
-            // An existing project. A new one: { team: "my-team", name: "my-app" }.
-            project: yield* Convex.Project("Project", { team: "my-team", slug: "my-app" }),
+            // An existing project of the team of the token. A new one: { name: "my-app" }.
+            project: yield* Convex.Project("Project", { slug: "my-app" }),
             type: "prod",
             source: "./convex",
             env: { AUTH_SECRET: Config.Redacted("AUTH_SECRET") },
@@ -81,7 +81,7 @@ relative to it:
 
 ```ts
 Effect.gen(function* () {
-  const project = yield* Convex.Project("Project", { team: "my-team", slug: "my-app" });
+  const project = yield* Convex.Project("Project", { slug: "my-app" });
   const backend = yield* Convex.Deployment("Backend", {
     project,
     type: "prod",
@@ -166,34 +166,36 @@ values explicitly: `Convex.providers(Convex.fromValues({ accessToken, deployKey
 
 ## State in Convex
 
-`state: Convex.state({ team })` keeps the Alchemy state of every stack and stage of a Convex team in
-one project of that team, `alchemy-state-store`, the same name as the Cloudflare state store of
-Alchemy, so a repository holds one secret and a stack can create and destroy its own project.
+`state: Convex.state()` keeps the Alchemy state of every stack and stage of a Convex team in one
+project of that team, `alchemy-state-store`, the same name as the Cloudflare state store of Alchemy,
+so a repository holds one secret and a stack can create and destroy its own project.
 [docs/design/convex-state.md](docs/design/convex-state.md) records the decisions and the
 measurements.
 
 ```ts
 export default Alchemy.Stack(
   process.env["GITHUB_REPOSITORY"] ?? "my-org/my-app", // the stack name: the repository
-  { providers: Convex.providers(), state: Convex.state({ team: "my-team" }) },
+  { providers: Convex.providers(), state: Convex.state() },
   Effect.gen(function* () {
     /* ... */
   }),
 );
 ```
 
-Every run needs the team token in `CONVEX_ACCESS_TOKEN`, or the Convex CLI login on a laptop. A team
-access token names its team, so `Convex.state()` needs no `team` with one; a `team` slug that is set
-must be the slug of that team, checked against its projects, and a token of another team fails the
-run. The Convex CLI login needs the slug or the id. The first run of a team creates the project
-`alchemy-state-store` and pushes the store functions to its production deployment with the Convex
-CLI of the app; a later version of this package pushes a newer store when it finds an older one. A
-store that is newer than the package fails the run with both versions, so the repositories of a team
-upgrade the package together. Each run makes a deploy key of that deployment that can only run the
-store's internal functions, and deletes it at the end. Rows are in the tables `resources` and
-`outputs` of the component `alchemyState` in the dashboard, under the stack name. The store has no
-lock: run one deploy of a stage at a time, such as with a CI concurrency group. The store and its
-readers (Samebase) are released and upgraded together.
+Every run needs the team token in `CONVEX_ACCESS_TOKEN`, or the Convex CLI login on a laptop. The
+state and the projects are in the team of that credential. A team access token and an OAuth token of
+a team name their team. The Convex CLI login names no team, so the run uses the team of the
+deployment that the Convex CLI selected: `CONVEX_DEPLOYMENT` in the environment or in `.env.local`,
+which `npx convex dev` writes. A local or anonymous deployment is in no team, so the run stops and
+asks for a cloud deployment. The first run of a team creates the project `alchemy-state-store` and
+pushes the store functions to its production deployment with the Convex CLI of the app; a later
+version of this package pushes a newer store when it finds an older one. A store that is newer than
+the package fails the run with both versions, so the repositories of a team upgrade the package
+together. Each run makes a deploy key of that deployment that can only run the store's internal
+functions, and deletes it at the end. Rows are in the tables `resources` and `outputs` of the
+component `alchemyState` in the dashboard, under the stack name. The store has no lock: run one
+deploy of a stage at a time, such as with a CI concurrency group. The store and its readers
+(Samebase) are released and upgraded together.
 
 Store version 3 supports native subscriptions. A trusted server checks repository access, then calls
 internal `reader:authorize({ repository, subject })` with a deployment credential. It gives the
@@ -264,20 +266,22 @@ call.
 
 ## Resources
 
-- `Convex.Project`: `{ team, name, deploymentRegion?, deploymentType? }` creates a project with its
-  default deployment, or takes over one with that exact name with `--adopt`. A changed `name`
-  renames the project in place. `{ team, slug }` is an existing project, found by its slug and taken
-  over with `--adopt`; it never creates or renames a project. Outputs `projectId`, `slug`, `name`,
-  `teamId`, `prodDeploymentName`, `prodDeploymentUrl`.
+- `Convex.Project`: `{ name, deploymentRegion?, deploymentType? }` creates a project with its
+  default deployment in the team of the credential, or takes over one with that exact name with
+  `--adopt`. A changed `name` renames the project in place. `{ slug }` is an existing project of
+  that team, found by its slug and taken over with `--adopt`; it never creates or renames a project.
+  Outputs `projectId`, `slug`, `name`, `teamId`, `prodDeploymentName`, `prodDeploymentUrl`.
 - `Convex.Deployment`: `{ project, type: "prod" }` or `{ project, type: "dev" | "preview", name }`,
   each with optional `rootDir`, `source`, and `env`. Outputs `name` (such as `happy-animal-123`),
   `url`, `siteUrl`, `type`, `projectId`, `reference`, `previewName`, `hash`, and `envNames`.
   - `prod` is the project's default production deployment (with a deploy key: the key's production
     deployment). The resource never creates or deletes one. A production deployment with code that
     is not in state is taken over only with `--adopt`.
-  - `dev` creates a dev deployment with `name` as its reference; `preview` creates a preview
-    deployment with `name` as its preview name. An expired preview is created again on the next
-    deploy.
+  - `dev` creates a dev deployment with `name` as its reference. With `--adopt`, `name` can also be
+    the Convex name of a dev deployment that exists, such as `happy-animal-123` from `.env.local`,
+    which `npx convex dev` made: the resource takes it over. A name that matches nothing creates a
+    dev deployment with that reference. `preview` creates a preview deployment with `name` as its
+    preview name. An expired preview is created again on the next deploy.
   - `rootDir` is the app directory, relative to the directory where the deploy runs, `"."` by
     default. It must be relative (`AbsoluteRootDir`) and have a package.json (`ConvexAppNotFound`).
     There is no search in the directories above it. When convex.json puts the functions outside
@@ -371,27 +375,29 @@ variables. Each callback remains one exact registered URI.
 
 ### The development stage
 
-A laptop is a stage `dev-<name>` of the app's stack, with its own cloud development deployment. Run
-`alchemy deploy --stage dev-<name>` with `CONVEX_ACCESS_TOKEN` or the Convex CLI login of the app's
-team, before `convex dev`. The stage has the same three rows as a preview:
+A laptop gets its client from a stage `dev-<name>` of the app's stack, run on purpose, not at each
+dev start: `npx convex dev` has made and selected the dev deployment and pushed the code, and then
+`alchemy deploy --stage dev-<name>` gives that deployment its variables. The stage creates nothing
+and pushes nothing. It has three rows on the deployment that `.env.local` selects, taken over by its
+Convex name:
 
 ```ts
-// The stage is dev-<name>. `project` is the project of the deployment that the Convex CLI selects.
+// `selected` is the name in CONVEX_DEPLOYMENT of .env.local, such as happy-animal-123, and
+// `project` is the project of stage `prod`.
 const prod = Convex.SharedHubClient.read("HubClient", { stage: "prod" });
-const deployment =
+const site =
   yield *
-  Convex.Deployment("Deployment", {
+  Convex.Deployment("Verification", {
     project,
     type: "dev",
-    name: stage,
-    source: "./convex",
+    name: selected,
     env: { SAMEBASE_REPOSITORY_ID: prod.repository },
   }).pipe(adopt(true));
 const hub =
   yield *
   Convex.SharedHubClient("HubClient", {
     app: "scout",
-    redirectUri: Output.interpolate`${deployment.siteUrl}/auth/hub/callback`,
+    redirectUri: Output.interpolate`${site.siteUrl}/auth/hub/callback`,
     deploymentType: "development",
     initialAccessToken: prod.initialAccessToken,
   });
@@ -400,7 +406,7 @@ yield *
   Convex.Deployment("Site", {
     project,
     type: "dev",
-    name: stage,
+    name: selected,
     env: {
       HUB_ISSUER: variables.issuer,
       HUB_CLIENT_ID: variables.clientId,
@@ -412,11 +418,13 @@ yield *
 The imports are `alchemy/AdoptPolicy` for `adopt` and `alchemy/Output` for `Output`.
 
 1. `read` gives the initial access token and the repository id from the `HubClient` row of stage
-   `prod`. Before the first deploy to main, they are empty.
-2. "Deployment" finds the development deployment by its reference, or creates it. It sets
-   `SAMEBASE_REPOSITORY_ID`, which the site serves as `/samebase-verification.json`, and pushes.
-3. "HubClient" asks the hub for a development client on the deployment's site URL with the token.
-   Each later run renews it. A development client expires 14 days after its last run or use.
+   `prod`.
+2. "Verification" sets `SAMEBASE_REPOSITORY_ID`, which the site serves as
+   `/samebase-verification.json`. `adopt` takes over the deployment and the variables that the dev
+   start set before.
+3. "HubClient" asks the hub for a development client on the deployment's site URL with the token. A
+   later run renews it. A sign-in renews it too, so a laptop in use never needs the stage again; a
+   development client expires 14 days after its last run or sign-in.
 4. "Site" writes the three variables. It removes only a name that leaves its own `env`, so
    `SAMEBASE_REPOSITORY_ID` stays.
 
@@ -455,8 +463,8 @@ repository `owner/name`. A stack without the stage of the pull request has no ca
 
 - `Convex.Project` and `Convex.Deployment` have the removal policy `retain`. `alchemy destroy`
   forgets them and Convex keeps them. Add `RemovalPolicy.destroy()` to delete with the resource.
-- A project is never replaced. A change of `team`, `slug`, `deploymentType`, or `deploymentRegion`
-  stops the deploy with a typed error that names the fix.
+- A project is never replaced. A change of `slug`, `deploymentType`, or `deploymentRegion`, or a
+  credential of another team, stops the deploy with a typed error that names the fix.
 - A deployment keeps its `project`, `type`, and `name`; a change stops the deploy with
   `DeploymentIdentityChange`. A production deployment is never deleted, also not with
   `RemovalPolicy.destroy()`, and also not a dev deployment that became one.
@@ -488,8 +496,6 @@ repository `owner/name`. A stack without the stage of the pull request has no ca
   deployment must answer there.
 - A run that stops between a deployment create and the state write leaves a deployment that state
   does not know. The next run stops with `OwnedBySomeoneElse`; run it with `--adopt`.
-- Team slugs for `{ team, name }` resolve through an unofficial dashboard endpoint. Pass the numeric
-  team id to avoid it. `{ team, slug }` uses the official endpoint.
 - Not covered: deployment regions and classes, custom domains, log streams, teams and members,
   components, snapshots.
 
@@ -506,11 +512,11 @@ pnpm run test:live        # real API calls, see below
 
 Unit tests run against recorded Management API payloads in `test/fixtures/management/` and a fake
 Convex CLI. Live tests run only with `ALCHEMY_CONVEX_LIVE=1`, which `pnpm run test:live` sets. They
-need a Convex login or `CONVEX_ACCESS_TOKEN` that can create projects in `ALCHEMY_CONVEX_LIVE_TEAM`.
-Each test creates a project whose name starts with `ALCHEMY_CONVEX_LIVE_PREFIX` (default
-`tmp-alchemy-convex-`), deletes it at the end, also after a failure, and refuses to delete a
-project, or a deployment of a project, without that prefix. A file argument runs one live file only,
-for example `pnpm run test:live test/live/plane.live.test.ts`.
+need a team access token of `ALCHEMY_CONVEX_LIVE_TEAM` in `CONVEX_ACCESS_TOKEN`: the projects are in
+the team of the token. Each test creates a project whose name starts with
+`ALCHEMY_CONVEX_LIVE_PREFIX` (default `tmp-alchemy-convex-`), deletes it at the end, also after a
+failure, and refuses to delete a project, or a deployment of a project, without that prefix. A file
+argument runs one live file only, for example `pnpm run test:live test/live/plane.live.test.ts`.
 
 Releases: change `version` in `package.json` in a pull request. After the merge,
 `.github/workflows/release.yml` publishes that version from `main` with npm trusted publishing.

package/lib/{HubClient-Bs5_j18U.js → HubClient-HeGoVOLO.js}

@@ -18,10 +18,11 @@ import { diffBindings, isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
 import { AlchemyContext } from "alchemy/AlchemyContext";
+import { readFileSync } from "node:fs";
+import { parseEnv, promisify, stripVTControlCharacters } from "node:util";
 import { createDeploymentClient, createManagementClient } from "@convex-dev/platform";
 import * as Schedule from "effect/Schedule";
 import { createHash } from "node:crypto";
-import { promisify, stripVTControlCharacters } from "node:util";
 import { hashDirectory } from "alchemy/Command/Memo";
 import * as Clock from "effect/Clock";
 import * as ChildProcess from "effect/process/ChildProcess";
@@ -173,6 +174,28 @@ const TeamRow = Schema.Struct({
 const TeamRows = Schema.Array(TeamRow);
 /** The first page of GET /teams/{team_id}/projects: every row carries the slug of the team. */
 const ProjectSlugRows = Schema.Struct({ items: Schema.Array(Schema.Struct({ teamSlug: Schema.String })) });
+/** GET /deployments/{name}: the project of the deployment. */
+const DeploymentProject = Schema.Struct({ projectId: Schema.Number });
+/** GET /projects/{id}: the team of the project. */
+const ProjectTeam = Schema.Struct({ teamId: Schema.Number });
+/**
+* The cloud deployment that the Convex CLI selected: CONVEX_DEPLOYMENT in the environment or in
+* `.env.local` of the working directory, as `npx convex dev` writes it (`dev:happy-animal-123`),
+* without the type prefix. Undefined when neither has it, and for a local or anonymous deployment
+* (`local:local-team-app`, `anonymous:anonymous-app`), which runs on this machine and is in no team.
+*/
+const selectedDeployment = () => {
+	const fromEnv = process.env["CONVEX_DEPLOYMENT"];
+	const value = fromEnv !== void 0 && fromEnv !== "" ? fromEnv : (() => {
+		try {
+			return parseEnv(readFileSync(".env.local", "utf8"))["CONVEX_DEPLOYMENT"];
+		} catch {
+			return;
+		}
+	})();
+	const name = /^(?:(?:dev|prod|preview):)?([^:]+)$/.exec(value ?? "")?.[1];
+	return name === void 0 || name.startsWith("anonymous-") ? void 0 : name;
+};
 /** GET /token_details: the team of a team token, or the project of a project token. */
 const TokenDetails = Schema.Union([Schema.Struct({
 	type: Schema.Literal("teamToken"),
@@ -194,17 +217,36 @@ const makeService = (source) => {
 	const tokenDetails = Effect.runSync(Effect.cached(request("get token details", (c) => c.GET("/token_details")).pipe(Effect.map((body) => Schema.decodeUnknownSync(TokenDetails)(body)), Effect.catchIf((error) => error.status === 403, () => Effect.succeed(void 0)))));
 	/** The slug of the team, from the first project of its listing, or undefined for a team without one. Read once. */
 	const teamSlug = (teamId) => request("list projects", (c) => c.GET("/teams/{team_id}/projects", { params: { path: { team_id: teamId } } })).pipe(Effect.map((body) => Schema.decodeUnknownSync(ProjectSlugRows)(body).items[0]?.teamSlug));
+	const projectTokenError = (projectId) => new ConvexApiError({
+		operation: "resolve team",
+		status: 403,
+		message: `the access token belongs to project ${projectId}, and a project token cannot create projects. Use a team access token.`
+	});
+	const teamId = Effect.runSync(Effect.cached(Effect.gen(function* () {
+		const details = yield* tokenDetails;
+		if (details?.type === "teamToken") return details.teamId;
+		if (details?.type === "projectToken") return yield* projectTokenError(details.projectId);
+		const selected = selectedDeployment();
+		if (selected === void 0) return yield* new ConvexApiError({
+			operation: "resolve team",
+			status: 0,
+			message: "the Convex CLI login names no team, and no cloud deployment is selected. Run `npx convex dev` once with a cloud deployment."
+		});
+		const deployment = yield* request("get deployment", (c) => c.GET("/deployments/{deployment_name}", { params: { path: { deployment_name: selected } } }));
+		const { projectId } = Schema.decodeUnknownSync(DeploymentProject)(deployment);
+		const project = yield* request("get project", (c) => c.GET("/projects/{project_id}", { params: { path: { project_id: projectId } } }));
+		return Schema.decodeUnknownSync(ProjectTeam)(project).teamId;
+	})));
 	const resolveTeamId = (team) => Effect.gen(function* () {
 		if (typeof team === "number") return team;
-		if (team !== void 0 && /^\d+$/.test(team)) return Number(team);
+		if (/^\d+$/.test(team)) return Number(team);
 		const details = yield* tokenDetails;
 		if (details?.type === "teamToken") {
-			if (team === void 0) return details.teamId;
 			const slug = yield* teamSlug(details.teamId);
 			if (slug === void 0) return yield* new ConvexApiError({
 				operation: "resolve team",
 				status: 0,
-				message: `team "${team}" cannot be checked against the access token: team ${details.teamId} has no project yet. Set team to ${details.teamId}, or leave it out.`
+				message: `team "${team}" cannot be checked against the access token: team ${details.teamId} has no project yet. Set team to ${details.teamId}.`
 			});
 			if (slug !== team) return yield* new ConvexApiError({
 				operation: "resolve team",
@@ -213,16 +255,7 @@ const makeService = (source) => {
 			});
 			return details.teamId;
 		}
-		if (details?.type === "projectToken") return yield* new ConvexApiError({
-			operation: "resolve team",
-			status: 403,
-			message: `the access token belongs to project ${details.projectId}, and a project token cannot create projects. Use a team access token.`
-		});
-		if (team === void 0) return yield* new ConvexApiError({
-			operation: "resolve team",
-			status: 0,
-			message: "set team to the slug or the id of the Convex team: this access token does not name a team."
-		});
+		if (details?.type === "projectToken") return yield* projectTokenError(details.projectId);
 		const resolved = yield* credentials;
 		const match = (yield* Effect.tryPromise({
 			try: async () => {
@@ -253,6 +286,7 @@ const makeService = (source) => {
 		request,
 		requestVoid,
 		deploymentRequest,
+		teamId,
 		resolveTeamId,
 		isCredentialToken,
 		isOAuthCredential,
@@ -782,7 +816,8 @@ const checkIdentity = (current, news) => {
 	if (current.projectId !== news.project.projectId) return change("projectId", String(current.projectId), String(news.project.projectId));
 	if (current.type !== news.type) return change("type", current.type, news.type);
 	const currentName = nameOf(current);
-	if (news.type !== "prod" && currentName !== news.name) return change("name", currentName ?? "(none)", news.name);
+	const named = news.type === "dev" && current.name === news.name;
+	if (news.type !== "prod" && currentName !== news.name && !named) return change("name", currentName ?? "(none)", news.name);
 	return Effect.void;
 };
 const addressOf = (props) => ({
@@ -824,11 +859,13 @@ const DeploymentProvider = () => Provider.effect(DeploymentResource, Effect.gen(
 	/** The project's default production deployment, or undefined. */
 	const production = (management, projectId) => productionRow(management, projectId).pipe(Effect.map((row) => row === void 0 ? void 0 : targetOf(row, "prod", void 0)));
 	/**
-	* The one dev deployment with this reference, or the one preview
-	* deployment with this preview name, or undefined.
+	* The one dev deployment with this reference or this Convex name, or the
+	* one preview deployment with this preview name, or undefined. The name
+	* form takes the dev deployment that `npx convex dev` made, such as the
+	* one `.env.local` selects, which has a reference the stack never chose.
 	*/
 	const findByName = (management, projectId, type, name) => Effect.gen(function* () {
-		const matches = (yield* listDeployments(management, projectId, type)).filter((row) => row.deploymentType === type && (type === "dev" ? row.reference === name : row.previewIdentifier === name));
+		const matches = (yield* listDeployments(management, projectId, type)).filter((row) => row.deploymentType === type && (type === "dev" ? row.reference === name || row.name === name : row.previewIdentifier === name));
 		if (matches.length > 1) return yield* new AmbiguousDeployment({
 			projectId,
 			type,
@@ -843,7 +880,7 @@ const DeploymentProvider = () => Provider.effect(DeploymentResource, Effect.gen(
 	const deployKeyTarget = (key, deployment, address) => Effect.gen(function* () {
 		const info = Schema.decodeUnknownSync(DeploymentInfo)(yield* api.deploymentRequest("get deployment info", deployment, key, (client) => client.GET("/deployment_info")));
 		const reference = info.reference ?? "";
-		if (info.projectId !== address.projectId || info.deploymentType !== address.type || address.type === "dev" && reference !== address.name) return;
+		if (info.projectId !== address.projectId || info.deploymentType !== address.type || address.type === "dev" && reference !== address.name && deployment !== address.name) return;
 		const urls = Schema.decodeUnknownSync(CanonicalUrls)(yield* api.deploymentRequest("get canonical urls", deployment, key, (client) => client.GET("/get_canonical_urls")));
 		return {
 			projectId: info.projectId,
@@ -1094,14 +1131,14 @@ const DeploymentProvider = () => Provider.effect(DeploymentResource, Effect.gen(
 //#endregion
 //#region src/Project.ts
 const Project = Resource("Convex.Project", { defaultRemovalPolicy: "retain" });
-/** The props change the team of an existing project. Convex cannot move a project. */
+/** The credential is of another team than the project. Convex cannot move a project. */
 var ProjectTeamChange = class extends Schema.TaggedError()("ProjectTeamChange", {
 	projectId: Schema.Number,
 	teamId: Schema.Number,
 	requestedTeamId: Schema.Number
 }) {
 	get message() {
-		return `Convex.Project cannot move project ${this.projectId} from team ${this.teamId} to team ${this.requestedTeamId}. Set team back to ${this.teamId}. To use the other team, create a new resource with a new logical id and move the data yourself.`;
+		return `Convex.Project cannot move project ${this.projectId} from team ${this.teamId} to team ${this.requestedTeamId}, the team of the credential. Use a token of team ${this.teamId}, or with the Convex CLI login, select a deployment of team ${this.teamId}. To use the other team, create a new resource with a new logical id and move the data yourself.`;
 	}
 };
 /**
@@ -1137,11 +1174,11 @@ var CreatedProjectNotFound = class extends Schema.TaggedError()("CreatedProjectN
 };
 /** No project in the team has the slug. A `slug` resource never creates one. */
 var ProjectNotFound = class extends Schema.TaggedError()("ProjectNotFound", {
-	team: Schema.String,
+	teamId: Schema.Number,
 	slug: Schema.String
 }) {
 	get message() {
-		return `Team ${this.team} has no project with the slug "${this.slug}", and a Convex.Project with a slug never creates one. Check the slug in the project URL of the Convex dashboard, or use name to create a project.`;
+		return `Team ${this.teamId} has no project with the slug "${this.slug}", and a Convex.Project with a slug never creates one. Check the slug in the project URL of the Convex dashboard, or use name to create a project.`;
 	}
 };
 /** The props change the slug of a `slug` resource: that is another project. */
@@ -1203,8 +1240,6 @@ const checkCreateTimeProps = (projectId, olds, news) => {
 	}));
 	return Effect.void;
 };
-/** True when `team`, a slug or a numeric id, names the team of the project. */
-const isTeamOf = (details, team) => typeof team === "number" || /^\d+$/.test(team) ? details.teamId === Number(team) : details.teamSlug === team;
 /** The row of the project's default production deployment, or undefined. */
 const prodDeploymentOf = (api, projectId) => api.request("list deployments", (client) => client.GET("/projects/{project_id}/list_deployments", { params: { path: { project_id: projectId } } })).pipe(Effect.map((rows) => Schema.decodeUnknownSync(DeploymentRows)(rows).find((row) => row.deploymentType === "prod" && row.isDefault)));
 /** GET /projects/{id}, or undefined after a 404. */
@@ -1278,9 +1313,9 @@ const ProjectProvider = () => Provider.effect(Project, Effect.gen(function* () {
 		prodDeploymentUrl: prod?.deploymentUrl
 	})));
 	const getById = (projectId) => getProjectById(api, projectId);
-	/** The project with this slug in the team, or undefined. Official endpoint; the team can be a slug. */
-	const getBySlug = (team, slug) => absentAsUndefined(api.request("get project by slug", (client) => client.GET("/teams/{team_id_or_slug}/projects/{project_slug}", { params: { path: {
-		team_id_or_slug: String(team),
+	/** The project with this slug in the team, or undefined. */
+	const getBySlug = (teamId, slug) => absentAsUndefined(api.request("get project by slug", (client) => client.GET("/teams/{team_id_or_slug}/projects/{project_slug}", { params: { path: {
+		team_id_or_slug: String(teamId),
 		project_slug: slug
 	} } }))).pipe(Effect.map((body) => body === void 0 ? void 0 : Schema.decodeUnknownSync(ProjectDetails)(body)));
 	const findByName = (teamId, name) => findProjectByName(api, teamId, name);
@@ -1310,45 +1345,37 @@ const ProjectProvider = () => Provider.effect(Project, Effect.gen(function* () {
 		diff: Effect.fn(function* ({ olds, news, output }) {
 			if (!isResolved(news)) return void 0;
 			if (output === void 0) return void 0;
-			if ("slug" in news) {
+			const teamId = yield* api.teamId;
+			if (teamId !== output.teamId) return yield* new ProjectTeamChange({
+				projectId: output.projectId,
+				teamId: output.teamId,
+				requestedTeamId: teamId
+			});
+			if (news.slug !== void 0) {
 				if (news.slug !== output.slug) return yield* new ProjectSlugChange({
 					projectId: output.projectId,
 					slug: output.slug,
 					requestedSlug: news.slug
 				});
-				if (olds.team !== news.team) {
-					const details = yield* getById(output.projectId);
-					if (details !== void 0 && !isTeamOf(details, news.team)) return yield* new ProjectTeamChange({
-						projectId: output.projectId,
-						teamId: output.teamId,
-						requestedTeamId: yield* api.resolveTeamId(news.team)
-					});
-				}
 				return { action: "noop" };
 			}
-			if (olds.team !== news.team) {
-				const requestedTeamId = yield* api.resolveTeamId(news.team);
-				if (requestedTeamId !== output.teamId) return yield* new ProjectTeamChange({
-					projectId: output.projectId,
-					teamId: output.teamId,
-					requestedTeamId
-				});
-			}
-			return "name" in olds && olds.name === news.name ? void 0 : { action: "update" };
+			return olds.name === news.name ? void 0 : { action: "update" };
 		}),
 		read: Effect.fn(function* ({ olds, output }) {
 			if (output !== void 0) {
 				const details = yield* getById(output.projectId);
 				return details === void 0 ? void 0 : yield* attributesOf(details);
 			}
-			const existing = "slug" in olds ? yield* getBySlug(olds.team, olds.slug) : yield* findByName(yield* api.resolveTeamId(olds.team), olds.name);
+			const teamId = yield* api.teamId;
+			const existing = olds.slug !== void 0 ? yield* getBySlug(teamId, olds.slug) : yield* findByName(teamId, olds.name);
 			return existing === void 0 ? void 0 : Unowned(yield* attributesOf(existing));
 		}),
 		reconcile: Effect.fn(function* ({ fqn, olds, news, output }) {
-			if ("slug" in news) {
-				const details = output === void 0 ? yield* getBySlug(news.team, news.slug) : yield* getById(output.projectId);
+			const teamId = yield* api.teamId;
+			if (news.slug !== void 0) {
+				const details = output === void 0 ? yield* getBySlug(teamId, news.slug) : yield* getById(output.projectId);
 				if (details === void 0) return yield* new ProjectNotFound({
-					team: String(news.team),
+					teamId,
 					slug: news.slug
 				});
 				if (details.slug !== news.slug) return yield* new ProjectSlugChange({
@@ -1356,10 +1383,10 @@ const ProjectProvider = () => Provider.effect(Project, Effect.gen(function* () {
 					slug: details.slug,
 					requestedSlug: news.slug
 				});
-				if (!isTeamOf(details, news.team)) return yield* new ProjectTeamChange({
+				if (details.teamId !== teamId) return yield* new ProjectTeamChange({
 					projectId: details.id,
 					teamId: details.teamId,
-					requestedTeamId: yield* api.resolveTeamId(news.team)
+					requestedTeamId: teamId
 				});
 				if (output === void 0 && !(yield* shouldAdopt(fqn))) return yield* new OwnedBySomeoneElse({
 					message: `Convex project ${details.id} ("${news.slug}") exists and is not in this stack's state. Re-run with --adopt to take it over.`,
@@ -1368,9 +1395,8 @@ const ProjectProvider = () => Provider.effect(Project, Effect.gen(function* () {
 				});
 				return yield* attributesOf(details);
 			}
-			const teamId = yield* api.resolveTeamId(news.team);
 			if (output !== void 0) {
-				if (olds !== void 0 && "name" in olds) yield* checkCreateTimeProps(output.projectId, olds, news);
+				if (olds !== void 0 && olds.name !== void 0) yield* checkCreateTimeProps(output.projectId, olds, news);
 				if (output.teamId !== teamId) return yield* new ProjectTeamChange({
 					projectId: output.projectId,
 					teamId: output.teamId,
@@ -1712,8 +1738,8 @@ const ensureSealed = (options, deployment, functions) => Effect.gen(function* ()
 * the run whose project is not the oldest deletes its own, which holds
 * nothing yet, and uses the oldest, so that every run ends on one store.
 */
-const createStoreProject = (api, teamId, team) => Effect.gen(function* () {
-	yield* Effect.logInfo(`Convex state: creating the project ${STORE_PROJECT_NAME} in team ${team}`);
+const createStoreProject = (api, teamId) => Effect.gen(function* () {
+	yield* Effect.logInfo(`Convex state: creating the project ${STORE_PROJECT_NAME} in team ${teamId}`);
 	const created = yield* createProject(api, teamId, {
 		name: STORE_PROJECT_NAME,
 		deploymentType: "prod",
@@ -1732,9 +1758,8 @@ const createStoreProject = (api, teamId, team) => Effect.gen(function* () {
 */
 const makeConvexState = (options) => Effect.gen(function* () {
 	const { api } = options;
-	const teamId = yield* api.resolveTeamId(options.team);
-	const team = options.team ?? teamId;
-	const project = (yield* findProjectByName(api, teamId, "alchemy-state-store")) ?? (yield* createStoreProject(api, teamId, team));
+	const teamId = yield* api.teamId;
+	const project = (yield* findProjectByName(api, teamId, "alchemy-state-store")) ?? (yield* createStoreProject(api, teamId));
 	const deployment = yield* prodDeploymentOf(api, project.id);
 	if (deployment === void 0) return yield* new ProductionDeploymentNotFound({ projectId: project.id });
 	const keys = [];
@@ -1750,7 +1775,7 @@ const makeConvexState = (options) => Effect.gen(function* () {
 	})))) };
 	let version = yield* storeVersion(functions);
 	if (version === void 0 || version < 5) {
-		if (version === void 0 && deployment.lastDeployTime) return yield* failure(`project ${STORE_PROJECT_NAME} (${project.id}) of team ${team} has code that is not the state store, and Convex.state does not push over it. Rename that project in the Convex dashboard.`);
+		if (version === void 0 && deployment.lastDeployTime) return yield* failure(`project ${STORE_PROJECT_NAME} (${project.id}) of team ${teamId} has code that is not the state store, and Convex.state does not push over it. Rename that project in the Convex dashboard.`);
 		version = yield* storeVersion(functions);
 		if (version === void 0 || version < 5) {
 			yield* pushStore(options, deployment);
@@ -1799,14 +1824,13 @@ const makeConvexState = (options) => Effect.gen(function* () {
 	};
 });
 /**
-* Alchemy state in the `alchemy-state-store` project of `team`, with the team token
-* in CONVEX_ACCESS_TOKEN or the Convex CLI login. A team access token names
-* its team, so `team` is optional with one; the Convex CLI login needs the
-* slug or the id. The first use of the run finds or creates the project and
-* pushes the store when it is missing or older. `alchemy plan` on another
-* stack never touches Convex.
+* Alchemy state in the `alchemy-state-store` project of the team of the credential: the team token
+* in CONVEX_ACCESS_TOKEN, which names its team, or the Convex CLI login, with the team of the
+* deployment that the CLI selected (CONVEX_DEPLOYMENT, see ManagementApi.teamId). The first use of
+* the run finds or creates the project and pushes the store when it is missing or older.
+* `alchemy plan` on another stack never touches Convex.
 */
-const state = (options = {}) => Layer.effect(State, Effect.gen(function* () {
+const state = () => Layer.effect(State, Effect.gen(function* () {
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
 	const scope = yield* Scope.Scope;
 	const context = yield* Effect.context();
@@ -1817,7 +1841,6 @@ const state = (options = {}) => Layer.effect(State, Effect.gen(function* () {
 			env: process.env
 		}).pipe(Effect.catch((error) => Effect.logWarning(`Convex state: the stage outputs of this run carry no record. ${error.message}`).pipe(Effect.as(void 0))));
 		return yield* makeConvexState({
-			team: options.team,
 			api,
 			spawner,
 			scope,
@@ -1989,4 +2012,4 @@ const registerDevelopmentClient = (options) => Effect.gen(function* () {
 //#endregion
 export { PushTargetMismatch as A, DEPLOY_KEY_ENV as B, DeploymentProvider as C, ConvexAppNotFound as D, CodePushFailed as E, ManagementApi as F, fromValues as H, ManagementApiLive as I, ACCESS_TOKEN_ENV as L, installedCli as M, parseDeployOutput as N, ConvexCliNotFound as O, ConvexApiError as P, Credentials as R, DeploymentIdentityChange as S, ProductionDeploymentNotFound as T, fromConfig as V, ProjectProvider as _, registerDevelopmentClient as a, AmbiguousDeployment as b, RUN_RECORD_KEY as c, withRunRecord as d, AmbiguousProject as f, ProjectNotFound as g, ProjectDeploymentChange as h, HubClientProvider as i, VariablesOwnedBySomeoneElse as j, EnvironmentNeedsDeployKey as k, RunRecordError as l, Project as m, HubClient as n, STORE_PROJECT_NAME as o, CreatedProjectNotFound as p, HubClientFailed as r, state as s, HUB_PROJECT_NAME as t, runRecord as u, ProjectTeamChange as v, DeploymentResource as w, Deployment as x, AbsoluteRootDir as y, CredentialsError as z };
 
-//# sourceMappingURL=HubClient-Bs5_j18U.js.map
+//# sourceMappingURL=HubClient-HeGoVOLO.js.map