alchemy 2.0.0-beta.10 → 2.0.0-beta.13

package/src/Apply.ts

@@ -88,70 +88,68 @@ export const apply = <P extends Plan>(
   Output.InvalidReferenceError | Output.MissingSourceError | StateStoreError,
   Cli | State | Stack | Stage
 > =>
-  ensureArtifactStore(
-    Effect.gen(function* () {
-      const cli = yield* Cli;
-      const session = yield* cli.startApplySession(plan);
-      const state = yield* State;
-      const stack = yield* Stack;
-      const stage = yield* Stage;
-      const stackName = stack.name;
-
-      const tracker: Record<string, ResourceTracker> = {};
-      const terminalStatuses = new Map<
-        string,
-        {
-          id: string;
-          type: string;
-          status: Extract<ApplyStatus, "created" | "updated">;
-        }
-      >();
-
-      yield* executePlan(
-        plan,
-        tracker,
-        terminalStatuses,
-        session,
-        state,
-        stackName,
-        stage,
-      );
+  Effect.gen(function* () {
+    const cli = yield* Cli;
+    const session = yield* cli.startApplySession(plan);
+    const state = yield* State;
+    const stack = yield* Stack;
+    const stage = yield* Stage;
+    const stackName = stack.name;
+
+    const tracker: Record<string, ResourceTracker> = {};
+    const terminalStatuses = new Map<
+      string,
+      {
+        id: string;
+        type: string;
+        status: Extract<ApplyStatus, "created" | "updated">;
+      }
+    >();
+
+    yield* executePlan(
+      plan,
+      tracker,
+      terminalStatuses,
+      session,
+      state,
+      stackName,
+      stage,
+    );
 
-      // TODO(sam): support roll back to previous state if errors occur during expansion
-      // -> RISK: some UPDATEs may not be reversible (i.e. trigger replacements)
-      // TODO(sam): should pivot be done separately? E.g shift traffic?
+    // TODO(sam): support roll back to previous state if errors occur during expansion
+    // -> RISK: some UPDATEs may not be reversible (i.e. trigger replacements)
+    // TODO(sam): should pivot be done separately? E.g shift traffic?
 
-      yield* collectGarbage(plan, session);
+    yield* collectGarbage(plan, session);
 
-      yield* converge(
-        plan,
-        tracker,
-        terminalStatuses,
-        session,
-        state,
-        stackName,
-        stage,
-      );
+    yield* converge(
+      plan,
+      tracker,
+      terminalStatuses,
+      session,
+      state,
+      stackName,
+      stage,
+    );
 
-      yield* Effect.forEach(
-        Array.from(terminalStatuses.values()),
-        ({ id, type, status }) =>
-          session.emit({ kind: "status-change", id, type, status }),
-        { concurrency: "unbounded" },
-      );
+    yield* Effect.forEach(
+      Array.from(terminalStatuses.values()),
+      ({ id, type, status }) =>
+        session.emit({ kind: "status-change", id, type, status }),
+      { concurrency: "unbounded" },
+    );
 
-      yield* session.done();
+    yield* session.done();
 
-      if (!plan.output) {
-        return undefined;
-      }
+    if (!plan.output) {
+      return undefined;
+    }
 
-      const outputs = Object.fromEntries(
-        Object.entries(tracker).map(([fqn, t]) => [fqn, t.output]),
-      );
-      return yield* Output.evaluate(plan.output, outputs);
-    }),
-  );
+    const outputs = Object.fromEntries(
+      Object.entries(tracker).map(([fqn, t]) => [fqn, t.output]),
+    );
+    return yield* Output.evaluate(plan.output, outputs);
+  }).pipe(ensureArtifactStore);
 
 // ── Phase 1: concurrent initial execution ──────────────────────────────────
 //

package/src/Auth/AuthProvider.ts

@@ -1,4 +1,6 @@
-import type * as Effect from "effect/Effect";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
 import * as Schema from "effect/Schema";
 
 export class AuthError extends Schema.TaggedErrorClass<AuthError>()(
@@ -9,25 +11,203 @@ export class AuthError extends Schema.TaggedErrorClass<AuthError>()(
   },
 ) {}
 
-export interface AuthProvider<Config extends { method: string }, Credentials> {
-  readonly name: string;
+export class AuthProviders extends Context.Service<
+  AuthProviders,
+  {
+    [providerName: string]: AuthProvider;
+  }
+>()("AuthProviders") {}
 
-  configure(profileName: string): Effect.Effect<Config, AuthError>;
+/**
+ * Context passed to {@link AuthProviderImpl.configure}.
+ */
+export interface ConfigureContext {
+  /**
+   * `true` when running in a CI/CD environment (resolved from the `CI`
+   * env/config). Providers MUST NOT prompt interactively when `ci` is true;
+   * they should pick a non-interactive default (typically
+   * `{ method: "env" }`) so unattended runs work.
+   */
+  readonly ci: boolean;
+}
+
+export interface AuthProviderImpl<
+  Config extends { method: string } = any,
+  Credentials = any,
+  ConfigureReq = any,
+  LoginReq = any,
+  LogoutReq = any,
+  PrettyPrintReq = any,
+  ReadReq = any,
+> {
+  configure(
+    profileName: string,
+    ctx: ConfigureContext,
+  ): Effect.Effect<Config, AuthError, ConfigureReq>;
 
   login(
     profileName: string,
     config: Config,
-  ): Effect.Effect<void, AuthError, never>;
+  ): Effect.Effect<void, AuthError, LoginReq>;
 
   logout(
     profileName: string,
     config: Config,
-  ): Effect.Effect<void, AuthError, never>;
+  ): Effect.Effect<void, AuthError, LogoutReq>;
 
-  prettyPrint(profileName: string, config: Config): Effect.Effect<void>;
+  prettyPrint(
+    profileName: string,
+    config: Config,
+  ): Effect.Effect<void, AuthError, PrettyPrintReq>;
 
   read(
     profileName: string,
     config: Config,
-  ): Effect.Effect<Credentials, AuthError, never>;
+  ): Effect.Effect<Credentials, AuthError, ReadReq>;
 }
+
+export interface AuthProvider<
+  Config extends { method: string } = any,
+  Credentials = any,
+> extends AuthProviderImpl<
+  Config,
+  Credentials,
+  never,
+  never,
+  never,
+  never,
+  never
+> {
+  readonly kind: "AuthProvider";
+  readonly name: string;
+}
+
+export const AuthProvider =
+  <Config extends { method: string }, Credentials>() =>
+  <
+    ImplReq = never,
+    ConfigureReq = never,
+    LoginReq = never,
+    LogoutReq = never,
+    PrettyPrintReq = never,
+    ReadReq = never,
+  >(
+    name: string,
+    impl:
+      | AuthProviderImpl<
+          Config,
+          Credentials,
+          ConfigureReq,
+          LoginReq,
+          LogoutReq,
+          PrettyPrintReq,
+          ReadReq
+        >
+      | Effect.Effect<
+          AuthProviderImpl<
+            Config,
+            Credentials,
+            ConfigureReq,
+            LoginReq,
+            LogoutReq,
+            PrettyPrintReq,
+            ReadReq
+          >,
+          never,
+          ImplReq
+        >,
+  ) =>
+    Effect.gen(function* () {
+      const ctx = yield* Effect.context();
+      const providers = yield* AuthProviders;
+      const service = yield* Effect.isEffect(impl)
+        ? impl
+        : Effect.succeed(impl);
+      return yield* Effect.sync(
+        () =>
+          (providers[name] = {
+            kind: "AuthProvider",
+            name,
+            ...Object.fromEntries(
+              Object.entries(service).map(([name, fn]) => [
+                name,
+                (...args: Parameters<typeof fn>) =>
+                  fn(...args).pipe(Effect.provideContext(ctx)),
+              ]),
+            ),
+          } as AuthProvider<Config, Credentials>),
+      );
+    });
+
+/**
+ * Build a Layer that registers an AuthProvider into the {@link AuthProviders}
+ * registry when its parent layer is built. Use this from a provider's
+ * top-level `providers()` Layer so that `alchemy login` can discover the
+ * provider via the registry without forcing credential resolution.
+ */
+export const AuthProviderLayer =
+  <Config extends { method: string }, Credentials>() =>
+  <
+    ImplReq = never,
+    ConfigureReq = never,
+    LoginReq = never,
+    LogoutReq = never,
+    PrettyPrintReq = never,
+    ReadReq = never,
+  >(
+    name: string,
+    impl:
+      | AuthProviderImpl<
+          Config,
+          Credentials,
+          ConfigureReq,
+          LoginReq,
+          LogoutReq,
+          PrettyPrintReq,
+          ReadReq
+        >
+      | Effect.Effect<
+          AuthProviderImpl<
+            Config,
+            Credentials,
+            ConfigureReq,
+            LoginReq,
+            LogoutReq,
+            PrettyPrintReq,
+            ReadReq
+          >,
+          never,
+          ImplReq
+        >,
+  ) =>
+    Layer.effectDiscard(
+      AuthProvider<Config, Credentials>()<
+        ImplReq,
+        ConfigureReq,
+        LoginReq,
+        LogoutReq,
+        PrettyPrintReq,
+        ReadReq
+      >(name, impl),
+    );
+
+/**
+ * Look up a registered {@link AuthProvider} by name. Fails with
+ * {@link AuthError} if the provider hasn't been registered (typically because
+ * its layer hasn't been built).
+ */
+export const getAuthProvider = <
+  Config extends { method: string } = any,
+  Credentials = any,
+>(
+  name: string,
+): Effect.Effect<AuthProvider<Config, Credentials>, AuthError, AuthProviders> =>
+  Effect.flatMap(AuthProviders.asEffect(), (registry) =>
+    registry[name] == null
+      ? Effect.fail(
+          new AuthError({
+            message: `AuthProvider '${name}' is not registered. Make sure its layer has been built.`,
+          }),
+        )
+      : Effect.succeed(registry[name] as AuthProvider<Config, Credentials>),
+  );

package/src/Auth/Profile.ts

@@ -1,72 +1,135 @@
+import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
-import type { PlatformError } from "effect/PlatformError";
 import os from "node:os";
 import path from "pathe";
+import type { AuthProvider, ConfigureContext } from "./AuthProvider.ts";
 
 export const rootDir = path.join(os.homedir(), ".alchemy");
 export const configFilePath = path.join(rootDir, "profiles.json");
 
-export const CONFIG_VERSION = 2;
+/**
+ * Config key consulted by the various `fromAuthProvider` /
+ * `fromEnvironment` layers to pick which named profile in
+ * `~/.alchemy/profiles.json` to use. Defaults to `"default"`.
+ */
+export const ALCHEMY_PROFILE = Config.string("ALCHEMY_PROFILE").pipe(
+  Config.withDefault("default"),
+);
 
-export interface AlchemyProfiles {
-  version: typeof CONFIG_VERSION;
-  profiles: Record<string, AlchemyProfile>;
-}
+export const CONFIG_VERSION = 0;
+
+export class AlchemyConfig extends Context.Service<
+  AlchemyConfig,
+  {
+    version: typeof CONFIG_VERSION;
+    profiles: {
+      [profileName: string]: AlchemyProfile;
+    };
+  }
+>()("Alchemy::Profiles") {}
 
-export type AlchemyProfile = Record<string, { method: string }>;
+export interface AlchemyProfile {
+  [providerName: string]: {
+    /**
+     * The method used to login to the provider. Different providers may use different methods, but common ones are:
+     * - oauth: OAuth authentication
+     * - api-key: API key authentication
+     * - username-password: Username and password authentication
+     * - token: Token authentication
+     * - certificate: Certificate authentication
+     * - ssh: SSH authentication
+     * - other: Other authentication methods
+     */
+    method: string;
+  };
+}
 
-const emptyConfig = (): AlchemyProfiles => ({
+const emptyConfig = (): AlchemyConfig["Service"] => ({
   version: CONFIG_VERSION,
   profiles: {},
 });
 
-export const readConfig: Effect.Effect<
-  AlchemyProfiles,
-  never,
-  FileSystem.FileSystem
-> = Effect.gen(function* () {
-  const fs = yield* FileSystem.FileSystem;
-  const data = yield* fs
-    .readFileString(configFilePath)
-    .pipe(Effect.orElseSucceed(() => undefined));
-  if (data === undefined) return emptyConfig();
-  try {
-    const parsed = JSON.parse(data);
-    if (parsed?.version !== CONFIG_VERSION) {
-      return emptyConfig();
-    }
-    return parsed as AlchemyProfiles;
-  } catch {
-    return emptyConfig();
-  }
-});
+export const readConfig = FileSystem.FileSystem.asEffect().pipe(
+  Effect.flatMap((fs) => fs.readFileString(configFilePath)),
+  Effect.flatMap((data) =>
+    Effect.try({
+      try: () => {
+        const parsed = JSON.parse(data);
+        if (parsed?.version !== CONFIG_VERSION) {
+          // TODO(sam): this is destructive, should we maintain a chain of migrations from 0 to current?
+          return emptyConfig();
+        }
+        return parsed as AlchemyConfig["Service"];
+      },
+      catch: emptyConfig,
+    }),
+  ),
+  Effect.orElseSucceed(emptyConfig),
+);
+
+export const writeConfig = (config: AlchemyConfig["Service"]) =>
+  FileSystem.FileSystem.asEffect().pipe(
+    Effect.tap((fs) =>
+      fs.makeDirectory(path.dirname(configFilePath), { recursive: true }),
+    ),
+    Effect.flatMap((fs) =>
+      fs.writeFileString(configFilePath, JSON.stringify(config, null, 2)),
+    ),
+  );
+
+export const getProfile = (name: string) =>
+  readConfig.pipe(Effect.map((config) => config.profiles[name]));
 
-export const writeConfig = (
-  config: AlchemyProfiles,
-): Effect.Effect<void, PlatformError, FileSystem.FileSystem> =>
-  Effect.gen(function* () {
-    const fs = yield* FileSystem.FileSystem;
-    yield* fs.makeDirectory(path.dirname(configFilePath), {
-      recursive: true,
-    });
-    yield* fs.writeFileString(configFilePath, JSON.stringify(config, null, 2));
-  });
+export const setProfile = (name: string, profile: AlchemyProfile) =>
+  readConfig.pipe(
+    Effect.tap((config) =>
+      Effect.sync(() => (config.profiles[name] = profile)),
+    ),
+    Effect.flatMap(writeConfig),
+  );
 
-export const getProfile = (
-  name: string,
-): Effect.Effect<AlchemyProfile | undefined, never, FileSystem.FileSystem> =>
-  Effect.gen(function* () {
-    const config = yield* readConfig;
-    return config.profiles[name];
-  });
+/**
+ * Returns a `ConfigProvider` that overrides `ALCHEMY_PROFILE` with the
+ * given `profile` (when explicitly passed via the CLI `--profile` flag),
+ * falling through to `base` for everything else.
+ *
+ * Use this to let the CLI's `--profile <name>` win over `$ALCHEMY_PROFILE`
+ * without disturbing other config lookups.
+ */
+export const withProfileOverride = (
+  base: ConfigProvider.ConfigProvider,
+  profile: string | undefined,
+): ConfigProvider.ConfigProvider => {
+  if (profile === undefined) return base;
+  const overrides: Record<string, string> = { ALCHEMY_PROFILE: profile };
+  const overrideProvider = ConfigProvider.make((path) =>
+    Effect.succeed(
+      path.length === 1 && typeof path[0] === "string" && path[0] in overrides
+        ? ConfigProvider.makeValue(overrides[path[0]]!)
+        : undefined,
+    ),
+  );
+  return ConfigProvider.orElse(base)(overrideProvider);
+};
 
-export const setProfile = (
-  name: string,
-  profile: AlchemyProfile,
-): Effect.Effect<void, PlatformError, FileSystem.FileSystem> =>
-  Effect.gen(function* () {
-    const config = yield* readConfig;
-    config.profiles[name] = profile;
-    yield* writeConfig(config);
-  });
+/**
+ * Load the stored config for the given AuthProvider in `profileName`.
+ * If absent, run the provider's `configure` step (passing through `ctx` so
+ * providers can pick a CI-friendly default) and persist the resulting config
+ * under the provider's name.
+ */
+export const loadOrConfigure = <Config extends { method: string }>(
+  auth: AuthProvider<Config>,
+  profileName: string,
+  ctx: ConfigureContext,
+) =>
+  Effect.flatMap(getProfile(profileName), (existing) =>
+    existing?.[auth.name]
+      ? Effect.succeed(existing?.[auth.name])
+      : Effect.tap(auth.configure(profileName, ctx), (config) =>
+          setProfile(profileName, { ...existing, [auth.name]: config }),
+        ),
+  );

package/src/Auth/index.ts

@@ -1,2 +1,2 @@
 export * from "./AuthProvider.ts";
-export type { AlchemyProfile, AlchemyProfiles } from "./Profile.ts";
+export type * from "./Profile.ts";