alchemy 2.0.0-beta.34 → 2.0.0-beta.35

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alchemy",
-  "version": "2.0.0-beta.34",
+  "version": "2.0.0-beta.35",
   "homepage": "https://alchemy.run",
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",
@@ -275,14 +275,14 @@
     "@ai-sdk/provider": "^3.0.8",
     "@aws-sdk/credential-providers": "^3.0.0",
     "@clack/prompts": "^0.11.0",
-    "@distilled.cloud/aws": "^0.17.0",
-    "@distilled.cloud/axiom": "^0.17.0",
-    "@distilled.cloud/cloudflare": "^0.17.0",
+    "@distilled.cloud/aws": "^0.19.0",
+    "@distilled.cloud/axiom": "^0.19.0",
+    "@distilled.cloud/cloudflare": "^0.19.0",
     "@distilled.cloud/cloudflare-rolldown-plugin": "0.3.0",
-    "@distilled.cloud/cloudflare-runtime": "0.2.1",
+    "@distilled.cloud/cloudflare-runtime": "0.3.2",
     "@distilled.cloud/cloudflare-vite-plugin": "0.2.0",
-    "@distilled.cloud/core": "^0.17.0",
-    "@distilled.cloud/neon": "^0.17.0",
+    "@distilled.cloud/core": "^0.19.0",
+    "@distilled.cloud/neon": "^0.19.0",
     "pg": "^8.13.0",
     "@effect/vitest": ">=4.0.0-beta.60 || >=4.0.0",
     "@libsql/client": "^0.17.0",
@@ -294,9 +294,7 @@
     "@types/libsodium-wrappers": "^0.8.2",
     "ai": "^6.0.62",
     "aws4fetch": "^1.0.20",
-    "capnp-es": "^0.0.14",
     "capnweb": "^0.6.1",
-    "cloudflare": "^5.2.0",
     "fast-glob": "^3.3.2",
     "fast-xml-parser": "^5.3.4",
     "foreground-child": "^4.0.3",
@@ -312,7 +310,6 @@
     "rolldown": "1.0.0-rc.17",
     "sonda": "^0.11.1",
     "web-tree-sitter": "0.25.10",
-    "workerd": "1.20260417.1",
     "yaml": "^2.0.0"
   },
   "devDependencies": {
@@ -329,6 +326,7 @@
     "@types/picomatch": "^4.0.0",
     "@types/proper-lockfile": "^4.1.4",
     "@types/react": "^19.2.2",
+    "@types/ws": "^8.18.1",
     "better-auth": "^1.6.2",
     "effect": ">=4.0.0-beta.60 || >=4.0.0",
     "react-devtools-core": "^7.0.1",
@@ -336,7 +334,8 @@
     "tsconfig-paths": "^4.2.0",
     "tsdown": "^0.15.4",
     "tsx": "^4.20.6",
-    "typescript": "^6.0.3"
+    "typescript": "^6.0.3",
+    "ws": "^8.20.0"
   },
   "peerDependencies": {
     "@effect/platform-bun": ">=4.0.0-beta.60 || >=4.0.0",
@@ -345,7 +344,8 @@
     "drizzle-kit": ">=1.0.0-rc.1",
     "drizzle-orm": ">=1.0.0-rc.1",
     "effect": ">=4.0.0-beta.60 || >=4.0.0",
-    "vite": "^8.0.7"
+    "vite": "^8.0.7",
+    "ws": "^8.20.0"
   },
   "peerDependenciesMeta": {
     "@effect/platform-node": {
@@ -365,6 +365,9 @@
     },
     "vite": {
       "optional": true
+    },
+    "ws": {
+      "optional": true
     }
   }
 }

package/src/AWS/AuthProvider.ts

@@ -13,12 +13,7 @@ import {
   AuthProviderLayer,
   type ConfigureContext,
 } from "../Auth/AuthProvider.ts";
-import {
-  deleteCredentials,
-  displayRedacted,
-  readCredentials,
-  writeCredentials,
-} from "../Auth/Credentials.ts";
+import { CredentialsStore, displayRedacted } from "../Auth/Credentials.ts";
 import {
   getEnv,
   getEnvRedacted,
@@ -29,22 +24,6 @@ import * as Clank from "../Util/Clank.ts";
 
 export const AWS_AUTH_PROVIDER_NAME = "AWS";
 
-/**
- * Layer that registers the AWS {@link AuthProvider} into the
- * {@link AuthProviders} registry when built. Include this in the AWS
- * `providers()` layer so `alchemy login` can discover it.
- */
-export const AwsAuth = AuthProviderLayer<
-  AwsAuthConfig,
-  AwsResolvedCredentials
->()(AWS_AUTH_PROVIDER_NAME, {
-  configure: (profileName, ctx) => configureCredentials(profileName, ctx),
-  login: (profileName, config) => login(profileName, config),
-  logout: (profileName, config) => logout(profileName, config),
-  prettyPrint: (profileName, config) => prettyPrint(profileName, config),
-  read: (profileName, config) => resolveCredentials(profileName, config),
-});
-
 export type AwsAuthConfig =
   | { method: "sso"; ssoProfile: string }
   | { method: "stored" }
@@ -112,111 +91,15 @@ const runSsoCommand = (command: "login" | "logout", ssoProfile: string) =>
     }
   }).pipe(Effect.scoped);
 
-const resolveCredentials = (profileName: string, config: AwsAuthConfig) =>
-  Match.value(config)
-    .pipe(
-      Match.when(
-        { method: "env" },
-        Effect.fnUntraced(function* () {
-          const accessKeyId =
-            yield* getEnvRedactedRequired("AWS_ACCESS_KEY_ID");
-          const secretAccessKey = yield* getEnvRedactedRequired(
-            "AWS_SECRET_ACCESS_KEY",
-          );
-          const sessionToken = yield* getEnvRedacted("AWS_SESSION_TOKEN");
-          const region = yield* (
-            getEnv("AWS_REGION") ?? getEnv("AWS_DEFAULT_REGION") ?? undefined
-          );
-          return {
-            accessKeyId,
-            secretAccessKey,
-            sessionToken,
-            region,
-            source: { type: "env" as const },
-          };
-        }),
-      ),
-      Match.when({ method: "stored" }, () =>
-        readCredentials<AwsStoredCredentials>(profileName, "aws").pipe(
-          Effect.flatMap((creds) =>
-            creds == null
-              ? Effect.fail(
-                  new AuthError({
-                    message:
-                      "AWS stored credentials not found. Run: alchemy-effect login --configure",
-                  }),
-                )
-              : Effect.succeed({
-                  accessKeyId: Redacted.make(creds.accessKeyId),
-                  secretAccessKey: Redacted.make(creds.secretAccessKey),
-                  sessionToken: creds.sessionToken
-                    ? Redacted.make(creds.sessionToken)
-                    : undefined,
-                  region: creds.region,
-                  source: { type: "stored" as const },
-                }),
-          ),
-        ),
-      ),
-      Match.when({ method: "sso" }, (config) =>
-        Effect.gen(function* () {
-          const auth = yield* DistilledAuth.Default;
-          const creds = yield* auth
-            .loadProfileCredentials(config.ssoProfile)
-            .pipe(
-              Effect.mapError(
-                (e) =>
-                  new AuthError({
-                    message: "failed to load credentials",
-                    cause: e,
-                  }),
-              ),
-            );
-          const profile = yield* auth
-            .loadProfile(config.ssoProfile)
-            .pipe(Effect.catch(() => Effect.succeed(undefined)));
-          return {
-            accessKeyId: creds.accessKeyId,
-            secretAccessKey: creds.secretAccessKey,
-            sessionToken: creds.sessionToken,
-            region: profile?.region,
-            source: { type: "sso" as const, details: config.ssoProfile },
-          };
-        }),
-      ),
-      Match.exhaustive,
-    )
-    .pipe(
-      Effect.mapError(
-        (e) => new AuthError({ message: "login failed", cause: e }),
-      ),
-    );
-
-const prettyPrint = (profileName: string, config: AwsAuthConfig) =>
-  resolveCredentials(profileName, config).pipe(
-    Effect.tap((creds) =>
-      Effect.all([
-        Console.log(`  accessKeyId:     ${displayRedacted(creds.accessKeyId)}`),
-        Console.log(
-          `  secretAccessKey: ${displayRedacted(creds.secretAccessKey)}`,
-        ),
-        creds.sessionToken
-          ? Console.log(
-              `  sessionToken:    ${displayRedacted(creds.sessionToken)}`,
-            )
-          : Effect.void,
-        creds.region
-          ? Console.log(`  region:          ${creds.region}`)
-          : Effect.void,
-        Console.log(
-          //@ts-expect-error
-          `  source: ${creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type}`,
-        ),
-      ]),
-    ),
-    Effect.catch((e) =>
-      Console.error(`  Failed to retrieve credentials: ${e}`),
-    ),
+const loginSSO = (config: Extract<AwsAuthConfig, { method: "sso" }>) =>
+  Clank.info(
+    `AWS SSO: running 'aws sso login --profile ${config.ssoProfile}'...`,
+  ).pipe(
+    Effect.andThen(runSsoCommand("login", config.ssoProfile)),
+    Effect.matchEffect({
+      onSuccess: () => Clank.success("AWS SSO: login complete"),
+      onFailure: (e) => Clank.warn(`AWS SSO: login faield: \`${e.message}\``),
+    }),
   );
 
 /**
@@ -245,148 +128,275 @@ const clearDistilledSsoCache = (ssoProfile: string) =>
     yield* fs.remove(cacheFile).pipe(Effect.catch(() => Effect.void));
   }).pipe(Effect.catch(() => Effect.void));
 
-const logout = (profileName: string, config: AwsAuthConfig) =>
-  Match.value(config).pipe(
-    Match.when({ method: "env" }, () => Effect.void),
-    Match.when({ method: "sso" }, (config) =>
-      Clank.info(
-        `AWS: running 'aws sso logout --profile ${config.ssoProfile}'...`,
-      ).pipe(
-        Effect.zip(runSsoCommand("logout", config.ssoProfile)),
-        Effect.zip(clearDistilledSsoCache(config.ssoProfile)),
-        Effect.match({
-          onSuccess: () => Clank.success("AWS: SSO logout complete"),
-          onFailure: (e) =>
-            Clank.warn(`AWS: SSO logout failed: \`${e.message}\``),
-        }),
-      ),
-    ),
-    Match.when({ method: "stored" }, () =>
-      deleteCredentials(profileName, "aws").pipe(
-        Effect.andThen(Clank.success("AWS: stored credentials removed")),
-      ),
-    ),
-    Match.exhaustive,
-  );
+/**
+ * Layer that registers the AWS {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the AWS
+ * `providers()` layer so `alchemy login` can discover it.
+ */
+export const AwsAuth = AuthProviderLayer<
+  AwsAuthConfig,
+  AwsResolvedCredentials
+>()(
+  AWS_AUTH_PROVIDER_NAME,
+  Effect.gen(function* () {
+    const store = yield* CredentialsStore;
 
-const login = (profileName: string, config: AwsAuthConfig) =>
-  Match.value(config)
-    .pipe(
-      Match.when({ method: "env" }, () => Effect.void),
-      Match.when({ method: "sso" }, (config) =>
-        DistilledAuth.loadProfileCredentials(config.ssoProfile).pipe(
-          Effect.matchEffect({
-            onSuccess: () =>
-              Clank.info(
-                `AWS: SSO profile '${config.ssoProfile}' already has valid credentials`,
-              ),
-            onFailure: () => loginSSO(config),
-          }),
-        ),
-      ),
-      Match.when({ method: "stored" }, () =>
-        readCredentials<AwsStoredCredentials>(profileName, "aws").pipe(
-          Effect.flatMap((creds) =>
-            creds == null ? loginStored(profileName) : Effect.void,
-          ),
-        ),
-      ),
-      Match.exhaustive,
-    )
-    .pipe(
-      Effect.mapError(
-        (e) => new AuthError({ message: "login failed", cause: e }),
-      ),
-    );
+    const loginStored = Effect.fnUntraced(function* (profileName: string) {
+      const accessKeyId = yield* Clank.text({
+        message: "AWS Access Key ID",
+        validate: (v) => (v.length === 0 ? "Required" : undefined),
+      }).pipe(retryOnce);
 
-const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
-  Effect.gen(function* () {
-    if (ctx.ci) {
-      return { method: "env" as const };
-    }
-    return yield* configureInteractive(profileName);
-  }).pipe(
-    Effect.mapError(
-      (e) =>
-        new AuthError({
-          message: "failed to configure credentials",
-          cause: e,
-        }),
-    ),
-  );
+      const secretAccessKey = yield* Clank.password({
+        message: "AWS Secret Access Key",
+        validate: (v) => (v.length === 0 ? "Required" : undefined),
+      }).pipe(retryOnce);
 
-const configureInteractive = (profileName: string) =>
-  Clank.select({
-    message: "AWS authentication method",
-    options,
-  }).pipe(
-    Effect.flatMap((method) =>
-      Match.value(method).pipe(
-        Match.when("env", () => Effect.succeed({ method: "env" as const })),
-        Match.when("sso", () =>
-          Effect.gen(function* () {
-            const ssoProfile = yield* Clank.text({
-              message: "AWS profile name (from ~/.aws/config)",
-              placeholder: "default",
-              defaultValue: "default",
-            });
+      const sessionToken = yield* Clank.text({
+        message: "AWS Session Token (optional — press Enter or Esc to skip)",
+        placeholder: "(none)",
+      }).pipe(Effect.catch(() => Effect.succeed("")));
 
-            const config = {
-              method: "sso" as const,
-              ssoProfile: ssoProfile ?? "default",
-            };
+      const region = yield* Clank.text({
+        message: "AWS Region",
+        placeholder: "us-east-1",
+        defaultValue: "us-east-1",
+      }).pipe(retryOnce);
 
-            yield* loginSSO(config);
+      yield* store.write<AwsStoredCredentials>(profileName, "aws", {
+        accessKeyId,
+        secretAccessKey,
+        sessionToken,
+        region,
+      });
+      yield* Clank.success("AWS credentials saved.");
 
-            return config;
-          }),
-        ),
-        Match.when("stored", () => loginStored(profileName)),
-        Match.exhaustive,
-      ),
-    ),
-  );
+      return { method: "stored" as const };
+    });
 
-const loginSSO = (config: Extract<AwsAuthConfig, { method: "sso" }>) =>
-  Clank.info(
-    `AWS SSO: running 'aws sso login --profile ${config.ssoProfile}'...`,
-  ).pipe(
-    Effect.andThen(runSsoCommand("login", config.ssoProfile)),
-    Effect.matchEffect({
-      onSuccess: () => Clank.success("AWS SSO: login complete"),
-      onFailure: (e) => Clank.warn(`AWS SSO: login faield: \`${e.message}\``),
-    }),
-  );
+    const configureInteractive = (profileName: string) =>
+      Clank.select({
+        message: "AWS authentication method",
+        options,
+      }).pipe(
+        Effect.flatMap((method) =>
+          Match.value(method).pipe(
+            Match.when("env", () => Effect.succeed({ method: "env" as const })),
+            Match.when("sso", () =>
+              Effect.gen(function* () {
+                const ssoProfile = yield* Clank.text({
+                  message: "AWS profile name (from ~/.aws/config)",
+                  placeholder: "default",
+                  defaultValue: "default",
+                });
 
-const loginStored = Effect.fnUntraced(function* (profileName: string) {
-  const accessKeyId = yield* Clank.text({
-    message: "AWS Access Key ID",
-    validate: (v) => (v.length === 0 ? "Required" : undefined),
-  }).pipe(retryOnce);
+                const config = {
+                  method: "sso" as const,
+                  ssoProfile: ssoProfile ?? "default",
+                };
 
-  const secretAccessKey = yield* Clank.password({
-    message: "AWS Secret Access Key",
-    validate: (v) => (v.length === 0 ? "Required" : undefined),
-  }).pipe(retryOnce);
+                yield* loginSSO(config);
 
-  const sessionToken = yield* Clank.text({
-    message: "AWS Session Token (optional — press Enter or Esc to skip)",
-    placeholder: "(none)",
-  }).pipe(Effect.catch(() => Effect.succeed("")));
+                return config;
+              }),
+            ),
+            Match.when("stored", () => loginStored(profileName)),
+            Match.exhaustive,
+          ),
+        ),
+      );
 
-  const region = yield* Clank.text({
-    message: "AWS Region",
-    placeholder: "us-east-1",
-    defaultValue: "us-east-1",
-  }).pipe(retryOnce);
+    const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
+      Effect.gen(function* () {
+        if (ctx.ci) {
+          return { method: "env" as const };
+        }
+        return yield* configureInteractive(profileName);
+      }).pipe(
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: "failed to configure credentials",
+              cause: e,
+            }),
+        ),
+      );
 
-  yield* writeCredentials<AwsStoredCredentials>(profileName, "aws", {
-    accessKeyId,
-    secretAccessKey,
-    sessionToken,
-    region,
-  });
-  yield* Clank.success("AWS credentials saved.");
+    const resolveCredentials = (profileName: string, config: AwsAuthConfig) =>
+      Match.value(config)
+        .pipe(
+          Match.when(
+            { method: "env" },
+            Effect.fnUntraced(function* () {
+              const accessKeyId =
+                yield* getEnvRedactedRequired("AWS_ACCESS_KEY_ID");
+              const secretAccessKey = yield* getEnvRedactedRequired(
+                "AWS_SECRET_ACCESS_KEY",
+              );
+              const sessionToken = yield* getEnvRedacted("AWS_SESSION_TOKEN");
+              const region = yield* (
+                getEnv("AWS_REGION") ??
+                  getEnv("AWS_DEFAULT_REGION") ??
+                  undefined
+              );
+              return {
+                accessKeyId,
+                secretAccessKey,
+                sessionToken,
+                region,
+                source: { type: "env" as const },
+              };
+            }),
+          ),
+          Match.when({ method: "stored" }, () =>
+            store.read<AwsStoredCredentials>(profileName, "aws").pipe(
+              Effect.flatMap((creds) =>
+                creds == null
+                  ? Effect.fail(
+                      new AuthError({
+                        message:
+                          "AWS stored credentials not found. Run: alchemy-effect login --configure",
+                      }),
+                    )
+                  : Effect.succeed({
+                      accessKeyId: Redacted.make(creds.accessKeyId),
+                      secretAccessKey: Redacted.make(creds.secretAccessKey),
+                      sessionToken: creds.sessionToken
+                        ? Redacted.make(creds.sessionToken)
+                        : undefined,
+                      region: creds.region,
+                      source: { type: "stored" as const },
+                    }),
+              ),
+            ),
+          ),
+          Match.when({ method: "sso" }, (config) =>
+            Effect.gen(function* () {
+              const auth = yield* DistilledAuth.Default;
+              const creds = yield* auth
+                .loadProfileCredentials(config.ssoProfile)
+                .pipe(
+                  Effect.mapError(
+                    (e) =>
+                      new AuthError({
+                        message: "failed to load credentials",
+                        cause: e,
+                      }),
+                  ),
+                );
+              const profile = yield* auth
+                .loadProfile(config.ssoProfile)
+                .pipe(Effect.catch(() => Effect.succeed(undefined)));
+              return {
+                accessKeyId: creds.accessKeyId,
+                secretAccessKey: creds.secretAccessKey,
+                sessionToken: creds.sessionToken,
+                region: profile?.region,
+                source: { type: "sso" as const, details: config.ssoProfile },
+              };
+            }),
+          ),
+          Match.exhaustive,
+        )
+        .pipe(
+          Effect.mapError(
+            (e) => new AuthError({ message: "login failed", cause: e }),
+          ),
+        );
+
+    const prettyPrint = (profileName: string, config: AwsAuthConfig) =>
+      resolveCredentials(profileName, config).pipe(
+        Effect.tap((creds) =>
+          Effect.all([
+            Console.log(
+              `  accessKeyId:     ${displayRedacted(creds.accessKeyId)}`,
+            ),
+            Console.log(
+              `  secretAccessKey: ${displayRedacted(creds.secretAccessKey)}`,
+            ),
+            creds.sessionToken
+              ? Console.log(
+                  `  sessionToken:    ${displayRedacted(creds.sessionToken)}`,
+                )
+              : Effect.void,
+            creds.region
+              ? Console.log(`  region:          ${creds.region}`)
+              : Effect.void,
+            Console.log(
+              //@ts-expect-error
+              `  source: ${creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type}`,
+            ),
+          ]),
+        ),
+        Effect.catch((e) =>
+          Console.error(`  Failed to retrieve credentials: ${e}`),
+        ),
+      );
+
+    const logout = (profileName: string, config: AwsAuthConfig) =>
+      Match.value(config).pipe(
+        Match.when({ method: "env" }, () => Effect.void),
+        Match.when({ method: "sso" }, (config) =>
+          Clank.info(
+            `AWS: running 'aws sso logout --profile ${config.ssoProfile}'...`,
+          ).pipe(
+            Effect.zip(runSsoCommand("logout", config.ssoProfile)),
+            Effect.zip(clearDistilledSsoCache(config.ssoProfile)),
+            Effect.match({
+              onSuccess: () => Clank.success("AWS: SSO logout complete"),
+              onFailure: (e) =>
+                Clank.warn(`AWS: SSO logout failed: \`${e.message}\``),
+            }),
+          ),
+        ),
+        Match.when({ method: "stored" }, () =>
+          store
+            .delete(profileName, "aws")
+            .pipe(
+              Effect.andThen(Clank.success("AWS: stored credentials removed")),
+            ),
+        ),
+        Match.exhaustive,
+      );
+
+    const login = (profileName: string, config: AwsAuthConfig) =>
+      Match.value(config)
+        .pipe(
+          Match.when({ method: "env" }, () => Effect.void),
+          Match.when({ method: "sso" }, (config) =>
+            DistilledAuth.loadProfileCredentials(config.ssoProfile).pipe(
+              Effect.matchEffect({
+                onSuccess: () =>
+                  Clank.info(
+                    `AWS: SSO profile '${config.ssoProfile}' already has valid credentials`,
+                  ),
+                onFailure: () => loginSSO(config),
+              }),
+            ),
+          ),
+          Match.when({ method: "stored" }, () =>
+            store
+              .read<AwsStoredCredentials>(profileName, "aws")
+              .pipe(
+                Effect.flatMap((creds) =>
+                  creds == null ? loginStored(profileName) : Effect.void,
+                ),
+              ),
+          ),
+          Match.exhaustive,
+        )
+        .pipe(
+          Effect.mapError(
+            (e) => new AuthError({ message: "login failed", cause: e }),
+          ),
+        );
 
-  return { method: "stored" as const };
-});
+    return {
+      configure: configureCredentials,
+      login,
+      logout,
+      prettyPrint,
+      read: resolveCredentials,
+    };
+  }),
+);