alchemy 2.0.0-beta.10 → 2.0.0-beta.13

package/src/AWS/Endpoint.ts

@@ -1,16 +1,20 @@
 import { Endpoint } from "@distilled.cloud/aws";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { StageConfig } from "./StageConfig.ts";
+import { AWSEnvironment } from "./Environment.ts";
 
 export const of = (endpoint: string) =>
   Layer.succeed(Endpoint.Endpoint, endpoint);
 
-export const fromStageConfig = () =>
-  Layer.unwrap(
-    StageConfig.asEffect().pipe(
-      Effect.map((config) =>
-        config.endpoint === undefined ? Layer.empty : of(config.endpoint),
-      ),
+/**
+ * Derive a custom endpoint (if any) from the surrounding
+ * {@link AWSEnvironment}. If the environment has no `endpoint` set, this
+ * Layer is empty (the SDK uses its default endpoint resolver).
+ */
+export const fromEnvironment = Layer.unwrap(
+  AWSEnvironment.asEffect().pipe(
+    Effect.map((env) =>
+      env.endpoint === undefined ? Layer.empty : of(env.endpoint),
     ),
-  );
+  ),
+);

package/src/AWS/Environment.ts

@@ -0,0 +1,123 @@
+import * as Auth from "@distilled.cloud/aws/Auth";
+import {
+  fromAwsCredentialIdentity,
+  type CredentialsError,
+  type ResolvedCredentials,
+} from "@distilled.cloud/aws/Credentials";
+import type { AwsCredentialIdentity } from "@smithy/types";
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+
+export const AWS_PROFILE = Config.string("AWS_PROFILE").pipe(
+  Config.withDefault("default"),
+);
+
+export const AWS_REGION = Config.string("AWS_REGION");
+
+export type AccountID = string;
+export type RegionID = string;
+
+export class FailedToGetAccount extends Data.TaggedError(
+  "AWS::Environment::FailedToGetAccount",
+)<{
+  message: string;
+  cause: Error;
+}> {}
+
+/**
+ * Fully-resolved AWS environment for a stack. Mirrors `CloudflareEnvironment`:
+ * one Context.Service that holds account, region, credentials, endpoint, and
+ * (optionally) the SSO profile name.
+ *
+ * `credentials` is held as an Effect so callers can refresh on each access
+ * (SSO sessions expire). The Effect itself is constructed once when this
+ * service is built; resolving it lazily preserves @distilled.cloud/aws's
+ * existing `Credentials` semantics.
+ */
+export interface AWSEnvironmentShape {
+  accountId: AccountID;
+  region: RegionID;
+  credentials: Effect.Effect<ResolvedCredentials, CredentialsError>;
+  endpoint?: string;
+  profile?: string;
+}
+
+export class AWSEnvironment extends Context.Service<
+  AWSEnvironment,
+  AWSEnvironmentShape
+>()("AWS::Environment") {}
+
+/**
+ * Build an `AWSEnvironment` from an SSO profile (`AWS_PROFILE` env var,
+ * defaults to `"default"`). Uses the profile's `sso_account_id` and `region`,
+ * and resolves credentials lazily via `aws sso login`.
+ */
+export const Default = Layer.effect(
+  AWSEnvironment,
+  Effect.suspend(() => loadDefault()),
+).pipe(Layer.orDie);
+
+export const loadDefault = () =>
+  Effect.gen(function* () {
+    const profileName = yield* AWS_PROFILE;
+    const auth = yield* Auth.Default;
+    const profile = yield* auth.loadProfile(profileName);
+    if (!profile.sso_account_id) {
+      return yield* Effect.die(
+        `AWS SSO profile '${profileName}' is missing sso_account_id`,
+      );
+    }
+    const region =
+      profile.region ??
+      (yield* AWS_REGION.pipe(
+        Config.option,
+        Config.map(Option.getOrElse(() => "us-east-1")),
+      ));
+    return {
+      profile: profileName,
+      accountId: profile.sso_account_id,
+      region,
+      credentials: auth.loadProfileCredentials(profileName),
+    } satisfies AWSEnvironmentShape;
+  });
+
+export interface AWSEnvironmentStaticInput {
+  accountId: AccountID;
+  region: RegionID;
+  credentials: AwsCredentialIdentity;
+  endpoint?: string;
+  profile?: string;
+}
+
+const isStatic = (
+  shape: AWSEnvironmentShape | AWSEnvironmentStaticInput,
+): shape is AWSEnvironmentStaticInput =>
+  shape.credentials != null &&
+  typeof (shape.credentials as AwsCredentialIdentity).accessKeyId === "string";
+
+/**
+ * Build an `AWSEnvironment` Layer directly from values — useful for
+ * static credentials in CI or tests.
+ *
+ * Named `makeEnvironment` rather than `of` because `Context.Service.of`
+ * already exists with different semantics (builds the service value, not
+ * a Layer); putting both on `AWSEnvironment` would be confusing.
+ */
+export const makeEnvironment = (
+  shape: AWSEnvironmentShape | AWSEnvironmentStaticInput,
+) =>
+  Layer.succeed(
+    AWSEnvironment,
+    isStatic(shape)
+      ? {
+          ...shape,
+          credentials: Effect.succeed(
+            fromAwsCredentialIdentity(shape.credentials),
+          ),
+        }
+      : shape,
+  );

package/src/AWS/EventBridge/EventBus.ts

@@ -13,7 +13,7 @@ import {
   diffTags,
   hasAlchemyTags,
 } from "../../Tags.ts";
-import { Account, type AccountID } from "../Account.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
 import type { RegionID } from "../Region.ts";
 import type { QueueArn } from "../SQS/Queue.ts";
 
@@ -121,7 +121,7 @@ export const EventBusProvider = () =>
     EventBus,
     Effect.gen(function* () {
       const region = yield* Region;
-      const accountId = yield* Account;
+      const { accountId } = yield* AWSEnvironment;
 
       const createEventBusName = (id: string, props: { name?: string } = {}) =>
         Effect.gen(function* () {

package/src/AWS/EventBridge/ListRules.ts

@@ -4,7 +4,7 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Binding from "../../Binding.ts";
 import * as Output from "../../Output.ts";
-import { Account } from "../Account.ts";
+import { AWSEnvironment } from "../Environment.ts";
 import { isFunction } from "../Lambda/Function.ts";
 import type { EventBus } from "./EventBus.ts";
 
@@ -58,7 +58,7 @@ export class ListRulesPolicy extends Binding.Policy<
 export const ListRulesPolicyLive = ListRulesPolicy.layer.effect(
   Effect.gen(function* () {
     const region = yield* Region;
-    const accountId = yield* Account;
+    const { accountId } = yield* AWSEnvironment;
 
     return Effect.fn(function* (host, bus?: EventBus) {
       if (isFunction(host)) {

package/src/AWS/EventBridge/PutEvents.ts

@@ -3,7 +3,7 @@ import * as eventbridge from "@distilled.cloud/aws/eventbridge";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Binding from "../../Binding.ts";
-import { Account } from "../Account.ts";
+import { AWSEnvironment } from "../Environment.ts";
 import { isFunction } from "../Lambda/Function.ts";
 import type { EventBus } from "./EventBus.ts";
 
@@ -62,7 +62,7 @@ export class PutEventsPolicy extends Binding.Policy<
 export const PutEventsPolicyLive = PutEventsPolicy.layer.effect(
   Effect.gen(function* () {
     const region = yield* Region;
-    const accountId = yield* Account;
+    const { accountId } = yield* AWSEnvironment;
 
     return Effect.fn(function* (host, bus?: EventBus) {
       if (isFunction(host)) {

package/src/AWS/EventBridge/Rule.ts

@@ -13,7 +13,7 @@ import {
   diffTags,
   hasAlchemyTags,
 } from "../../Tags.ts";
-import { Account, type AccountID } from "../Account.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
 import type { RegionID } from "../Region.ts";
 
 export type {
@@ -273,7 +273,7 @@ export const RuleProvider = () =>
     Rule,
     Effect.gen(function* () {
       const region = yield* Region;
-      const accountId = yield* Account;
+      const { accountId } = yield* AWSEnvironment;
 
       const createRuleName = (id: string, props: { name?: string } = {}) => {
         if (props.name) {

package/src/AWS/IAM/OpenIDConnectProvider.ts

@@ -5,7 +5,7 @@ import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import type { Providers } from "../Providers.ts";
 import { diffTags } from "../../Tags.ts";
-import { Account } from "../Account.ts";
+import { AWSEnvironment } from "../Environment.ts";
 import { toTagRecord } from "./common.ts";
 
 export interface OpenIDConnectProviderProps {
@@ -65,7 +65,7 @@ export const OpenIDConnectProviderProvider = () =>
   Provider.effect(
     OpenIDConnectProvider,
     Effect.gen(function* () {
-      const accountId = yield* Account;
+      const { accountId } = yield* AWSEnvironment;
       const oidcArnFromUrl = (url: string) =>
         `arn:aws:iam::${accountId}:oidc-provider/${url.replace(/^https?:\/\//, "")}`;
 

package/src/AWS/IAM/Policy.ts

@@ -11,8 +11,8 @@ import {
   diffTags,
   hasTags,
 } from "../../Tags.ts";
-import type { AccountID } from "../Account.ts";
-import { Account } from "../Account.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
 import {
   oldestNondefaultPolicyVersion,
   parsePolicyDocument,
@@ -113,7 +113,7 @@ export const PolicyProvider = () =>
   Provider.effect(
     Policy,
     Effect.gen(function* () {
-      const accountId = yield* Account;
+      const { accountId } = yield* AWSEnvironment;
 
       const toPolicyName = (id: string, props: PolicyProps) =>
         props.policyName

package/src/AWS/IAM/Role.ts

@@ -11,8 +11,8 @@ import {
   diffTags,
   hasTags,
 } from "../../Tags.ts";
-import type { AccountID } from "../Account.ts";
-import { Account } from "../Account.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
 import type { PolicyDocument } from "./Policy.ts";
 import {
   parsePolicyDocument,
@@ -107,7 +107,7 @@ export const RoleProvider = () =>
   Provider.effect(
     Role,
     Effect.gen(function* () {
-      yield* Account;
+      yield* AWSEnvironment;
 
       const toRoleName = (id: string, props: { roleName?: string } = {}) =>
         props.roleName
@@ -337,7 +337,7 @@ export const RoleProvider = () =>
           });
 
           const roleArn = (created.Role?.Arn ??
-            `arn:aws:iam::${yield* Account}:role/${roleName}`) as RoleArn;
+            `arn:aws:iam::${(yield* AWSEnvironment).accountId}:role/${roleName}`) as RoleArn;
           yield* session.note(roleArn);
 
           return {

package/src/AWS/Kinesis/Stream.ts

@@ -17,7 +17,7 @@ import {
   hasAlchemyTags,
   type Tags,
 } from "../../Tags.ts";
-import { Account, type AccountID } from "../Account.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
 import type { RegionID } from "../Region.ts";
 
 export type StreamRecord = lambda.KinesisStreamRecord;
@@ -445,7 +445,7 @@ export const StreamProvider = () =>
     Stream,
     Effect.gen(function* () {
       const region = yield* Region;
-      const accountId = yield* Account;
+      const { accountId } = yield* AWSEnvironment;
 
       return {
         stables: ["streamName", "streamArn"],

package/src/AWS/Lambda/EventSourceMapping.ts

@@ -9,7 +9,7 @@ import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import type { Providers } from "../Providers.ts";
 import { createInternalTags, diffTags, hasTags } from "../../Tags.ts";
-import { Account } from "../Account.ts";
+import { AWSEnvironment } from "../Environment.ts";
 
 export type StartingPosition = "TRIM_HORIZON" | "LATEST" | "AT_TIMESTAMP";
 
@@ -180,7 +180,7 @@ export const EventSourceMappingProvider = () =>
     EventSourceMapping,
     Effect.gen(function* () {
       const region = yield* Region;
-      const accountId = yield* Account;
+      const { accountId } = yield* AWSEnvironment;
 
       const createEventSourceMappingTags = Effect.fn(function* (id: string) {
         const internalTags = yield* createInternalTags(id);

package/src/AWS/Lambda/Function.ts

@@ -29,7 +29,7 @@ import { Stack } from "../../Stack.ts";
 import { createInternalTags, createTagsList, hasTags } from "../../Tags.ts";
 import { sha256 } from "../../Util/sha256.ts";
 import { zipCode } from "../../Util/zip.ts";
-import { Account } from "../Account.ts";
+import { AWSEnvironment } from "../Environment.ts";
 import { Assets } from "../Assets.ts";
 import * as IAM from "../IAM/index.ts";
 import type { PolicyStatement } from "../IAM/Policy.ts";
@@ -428,7 +428,7 @@ export const FunctionProvider = () =>
     Function,
     Effect.gen(function* () {
       const stack = yield* Stack;
-      const accountId = yield* Account;
+      const { accountId } = yield* AWSEnvironment;
       const region = yield* Region;
       const fs = yield* FileSystem.FileSystem;
       const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;

package/src/AWS/Lambda/Permission.ts

@@ -90,7 +90,7 @@ export interface Permission extends Resource<
  *   functionName: yield* fn.functionArn(),
  *   principal: "s3.amazonaws.com",
  *   sourceArn: yield* bucket.bucketArn,
- *   sourceAccount: yield* Account,
+ *   sourceAccount: (yield* AWSEnvironment).accountId,
  * });
  * ```
  *

package/src/AWS/Logs/LogGroup.ts

@@ -7,8 +7,8 @@ import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import type { Providers } from "../Providers.ts";
 import { createInternalTags, diffTags } from "../../Tags.ts";
-import type { AccountID } from "../Account.ts";
-import { Account } from "../Account.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
 import type { RegionID } from "../Region.ts";
 
 export type LogGroupName = string;
@@ -66,7 +66,7 @@ export const LogGroupProvider = () =>
     LogGroup,
     Effect.gen(function* () {
       const region = yield* Region;
-      const accountId = yield* Account;
+      const { accountId } = yield* AWSEnvironment;
 
       const toLogGroupName = (
         id: string,

package/src/AWS/Providers.ts

@@ -2,9 +2,9 @@ import * as Layer from "effect/Layer";
 import { Command, CommandProvider } from "../Build/Command.ts";
 import * as Provider from "../Provider.ts";
 import { Random, RandomProvider } from "../Random.ts";
-import * as Account from "./Account.ts";
 import * as ACM from "./ACM/index.ts";
 import * as Assets from "./Assets.ts";
+import { AwsAuth } from "./AuthProvider.ts";
 import * as AutoScaling from "./AutoScaling/index.ts";
 import * as CloudFront from "./CloudFront/index.ts";
 import * as CloudWatch from "./CloudWatch/index.ts";
@@ -32,7 +32,7 @@ import * as Scheduler from "./Scheduler/index.ts";
 import * as SecretsManager from "./SecretsManager/index.ts";
 import * as SNS from "./SNS/index.ts";
 import * as SQS from "./SQS/index.ts";
-import { DefaultStageConfig } from "./StageConfig.ts";
+import { Default as DefaultEnvironment } from "./Environment.ts";
 import * as Website from "./Website/index.ts";
 
 export class Providers extends Provider.ProviderCollection<Providers>()(
@@ -516,10 +516,10 @@ export const providers = () =>
         Assets.AssetsProvider(),
       ),
     ),
-    Layer.provideMerge(Account.fromStageConfig()),
-    Layer.provideMerge(Region.fromStageConfig()),
-    Layer.provideMerge(Credentials.fromStageConfig()),
-    Layer.provideMerge(Endpoint.fromStageConfig()),
-    Layer.provideMerge(DefaultStageConfig),
+    Layer.provideMerge(Region.fromEnvironment),
+    Layer.provideMerge(Credentials.fromEnvironment),
+    Layer.provideMerge(Endpoint.fromEnvironment),
+    Layer.provideMerge(DefaultEnvironment),
+    Layer.provideMerge(AwsAuth),
     Layer.orDie,
   );

package/src/AWS/Region.ts

@@ -1,77 +1,20 @@
-import * as Auth from "@distilled.cloud/aws/Auth";
 import * as Region from "@distilled.cloud/aws/Region";
-import * as Config from "effect/Config";
-import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import * as Option from "effect/Option";
-import { StageConfig } from "./StageConfig.ts";
+import { AWSEnvironment } from "./Environment.ts";
 
 export { Region } from "@distilled.cloud/aws/Region";
-
-export const AWS_REGION = Config.string("AWS_REGION");
-
-export type RegionID = string;
+export { AWS_REGION, type RegionID } from "./Environment.ts";
 
 export const of = (region: string) => Layer.succeed(Region.Region, region);
 
 export const fromEnvOrElse = (region: string) =>
   Layer.succeed(Region.Region, process.env.AWS_REGION ?? region);
 
-export class EnvironmentVariableNotSet extends Data.TaggedError(
-  "EnvironmentVariableNotSet",
-)<{
-  message: string;
-  variable: string;
-}> {}
-
-const tryGetAWSRegion = () =>
-  Config.option(AWS_REGION).pipe(Config.map(Option.getOrUndefined));
-
-export const fromEnv = () =>
-  Layer.effect(
-    Region.Region,
-    Effect.gen(function* () {
-      const region = yield* tryGetAWSRegion();
-      if (!region) {
-        return yield* Effect.fail(
-          new EnvironmentVariableNotSet({
-            message: "AWS_REGION is not set",
-            variable: "AWS_REGION",
-          }),
-        );
-      }
-      return region;
-    }),
-  );
-
-export class AWSStageConfigRegionMissing extends Data.TaggedError(
-  "AWSStageConfigMissing",
-)<{
-  message: string;
-  stage: string;
-}> {}
-
-export const fromStageConfig = () =>
-  Layer.effect(
-    Region.Region,
-    Effect.gen(function* () {
-      const config = yield* StageConfig;
-      const auth = yield* Auth.Default;
-      if (config.region) {
-        return config.region;
-      } else if (config.profile) {
-        const profile = yield* auth.loadProfile(config.profile);
-        if (profile.region) {
-          return profile.region;
-        }
-      }
-      const region = yield* tryGetAWSRegion();
-      if (region) {
-        return region;
-      }
-      return yield* Effect.die(
-        "No AWS region found in stage config, SSO profile, or environment variable",
-      );
-    }),
-  );
+/**
+ * Derive the AWS region from the surrounding {@link AWSEnvironment}.
+ */
+export const fromEnvironment = Layer.effect(
+  Region.Region,
+  Effect.map(AWSEnvironment.asEffect(), (env) => env.region),
+);

package/src/AWS/S3/Bucket.ts

@@ -10,7 +10,7 @@ import * as Provider from "../../Provider.ts";
 import { Resource, type ResourceBinding } from "../../Resource.ts";
 import type { Providers } from "../Providers.ts";
 import { diffTags } from "../../Tags.ts";
-import { Account, type AccountID } from "../Account.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
 import type { PolicyStatement } from "../IAM/Policy.ts";
 import type { RegionID } from "../Region.ts";
 
@@ -257,7 +257,7 @@ export const BucketProvider = () =>
         news: BucketProps;
       }) {
         const region = yield* Region;
-        const accountId = yield* Account;
+        const { accountId } = yield* AWSEnvironment;
         const bucketName = yield* createBucketName(id, news);
 
         yield* Effect.logInfo(

package/src/AWS/SNS/Topic.ts

@@ -6,7 +6,7 @@ import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import type { Providers } from "../Providers.ts";
 import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
-import type { AccountID } from "../Account.ts";
+import type { AccountID } from "../Environment.ts";
 import type { RegionID } from "../Region.ts";
 
 export type TopicName = string;

package/src/AWS/SQS/Queue.ts

@@ -6,9 +6,9 @@ import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource, type ResourceBinding } from "../../Resource.ts";
-import type { Providers } from "../Providers.ts";
-import { Account, type AccountID } from "../Account.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
 import type { PolicyStatement } from "../IAM/Policy.ts";
+import type { Providers } from "../Providers.ts";
 import type { RegionID } from "../Region.ts";
 
 export type QueueName = string;
@@ -160,7 +160,7 @@ export const QueueProvider = () =>
     Queue,
     Effect.gen(function* () {
       const region = yield* Region;
-      const accountId = yield* Account;
+      const { accountId } = yield* AWSEnvironment;
       const createQueueName = Effect.fnUntraced(function* (
         id: string,
         props: {

package/src/AWS/index.ts

@@ -1,11 +1,9 @@
-export * from "./Account.ts";
 export * from "./Arn.ts";
 export * from "./Assets.ts";
 export * from "./Bootstrap.ts";
 export * from "./Context.ts";
-export * from "./Profile.ts";
+export * from "./Environment.ts";
 export * from "./Providers.ts";
-export * from "./StageConfig.ts";
 
 export { Region } from "@distilled.cloud/aws/Region";