alchemy 2.0.0-beta.34 → 2.0.0-beta.35

package/src/Drizzle/Schema.ts

@@ -170,10 +170,12 @@ export const SchemaProvider = () =>
         });
 
       /**
-       * Generate a new migration directory if the schema has drifted from
-       * the latest snapshot. Returns the new state regardless.
+       * Run drizzle-kit's diff against the latest stored snapshot and
+       * return whether any SQL statements would be emitted. Used by both
+       * `diff` (to decide whether the resource actually needs an update)
+       * and `regenerate` (to decide whether to write a new migration dir).
        */
-      const regenerate = (props: SchemaProps) =>
+      const detectDrift = (props: SchemaProps) =>
         Effect.gen(function* () {
           const out = resolveOut(props);
           const dialect = props.dialect ?? "postgres";
@@ -203,6 +205,16 @@ export const SchemaProvider = () =>
             catch: (cause) =>
               new Error(`drizzle-kit generateMigration failed: ${cause}`),
           });
+          return { out, cur, prevEntry, sqlStatements };
+        });
+
+      /**
+       * Generate a new migration directory if the schema has drifted from
+       * the latest snapshot. Returns the new state regardless.
+       */
+      const regenerate = (props: SchemaProps) =>
+        Effect.gen(function* () {
+          const { out, cur, sqlStatements } = yield* detectDrift(props);
 
           if (sqlStatements.length > 0) {
             yield* fs.makeDirectory(out, { recursive: true });
@@ -231,8 +243,12 @@ export const SchemaProvider = () =>
         diff: Effect.fn(function* ({ news, output }) {
           if (!isResolved(news)) return undefined;
           if (!output) return undefined;
-          // Force `update` so the provider runs `regenerate` on every deploy.
-          // `regenerate` itself is a no-op when nothing has drifted.
+          // Only flag an update when drizzle-kit would emit new SQL —
+          // otherwise downstream resources (e.g. Neon.Branch) would see
+          // `schema.out` as an unresolved Output during plan and cascade
+          // into spurious updates of their own.
+          const { sqlStatements } = yield* detectDrift(news);
+          if (sqlStatements.length === 0) return undefined;
           return { action: "update" } as const;
         }),
         read: Effect.fn(function* ({ olds, output }) {

package/src/GitHub/AuthProvider.ts

@@ -1,22 +1,16 @@
 import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
 import * as Match from "effect/Match";
 import * as Redacted from "effect/Redacted";
 import * as Stream from "effect/Stream";
 import * as ChildProcess from "effect/unstable/process/ChildProcess";
-import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
 import {
   AuthError,
   AuthProviderLayer,
   type ConfigureContext,
 } from "../Auth/AuthProvider.ts";
-import {
-  deleteCredentials,
-  displayRedacted,
-  readCredentials,
-  writeCredentials,
-} from "../Auth/Credentials.ts";
+import { CredentialsStore, displayRedacted } from "../Auth/Credentials.ts";
 import { getEnvRedacted, retryOnce } from "../Auth/Env.ts";
 import * as Clank from "../Util/Clank.ts";
 
@@ -60,6 +54,10 @@ export interface GitHubResolvedCredentials {
 
 export const GITHUB_AUTH_PROVIDER_NAME = "GitHub";
 
+class GhCliError extends Error {
+  readonly _tag = "GhCliError";
+}
+
 /**
  * Layer that registers the GitHub {@link AuthProvider} into the
  * {@link AuthProviders} registry when built. Include this in the GitHub
@@ -77,233 +75,239 @@ export const GITHUB_AUTH_PROVIDER_NAME = "GitHub";
 export const GitHubAuth = AuthProviderLayer<
   GitHubAuthConfig,
   GitHubResolvedCredentials
->()(GITHUB_AUTH_PROVIDER_NAME, {
-  configure: (profileName, ctx) => configureCredentials(profileName, ctx),
-  logout: (profileName, config) => logout(profileName, config),
-  login: (profileName, config) => login(profileName, config),
-  prettyPrint: (profileName, config) => prettyPrint(profileName, config),
-  read: (profileName, config) => resolveCredentials(profileName, config),
-});
+>()(
+  GITHUB_AUTH_PROVIDER_NAME,
+  Effect.gen(function* () {
+    const store = yield* CredentialsStore;
+    const cp = yield* ChildProcessSpawner;
 
-const resolveCredentials = (
-  profileName: string,
-  config: GitHubAuthConfig,
-): Effect.Effect<
-  GitHubResolvedCredentials,
-  AuthError,
-  FileSystem.FileSystem | ChildProcessSpawner
-> =>
-  Match.value(config).pipe(
-    Match.when(
-      { method: "env" },
-      Effect.fnUntraced(function* () {
-        const access = yield* getEnvRedacted("GITHUB_ACCESS_TOKEN");
-        if (access) {
-          return {
-            type: "token" as const,
-            token: access,
-            source: {
-              type: "env" as const,
-              details: "GITHUB_ACCESS_TOKEN",
-            },
-          };
+    const ghCliToken = (): Effect.Effect<string, AuthError> =>
+      Effect.gen(function* () {
+        const handle = yield* cp.spawn(
+          ChildProcess.make("gh", ["auth", "token"], { shell: false }),
+        );
+        const [exitCode, stdout, stderr] = yield* Effect.all(
+          [
+            handle.exitCode,
+            Stream.mkString(Stream.decodeText(handle.stdout)),
+            Stream.mkString(Stream.decodeText(handle.stderr)),
+          ],
+          { concurrency: 3 },
+        );
+        if (exitCode !== 0) {
+          return yield* Effect.fail(
+            new GhCliError(
+              `gh auth token exited with ${exitCode}: ${stderr.trim() || stdout.trim()}`,
+            ),
+          );
         }
-        const token = yield* getEnvRedacted("GITHUB_TOKEN");
-        if (token) {
-          return {
-            type: "token" as const,
-            token,
-            source: { type: "env" as const, details: "GITHUB_TOKEN" },
-          };
+        const token = stdout.trim();
+        if (!token) {
+          return yield* Effect.fail(
+            new GhCliError("gh auth token returned empty output"),
+          );
         }
-        return yield* new AuthError({
-          message:
-            "GitHub env credentials not found. Set GITHUB_ACCESS_TOKEN or GITHUB_TOKEN.",
-        });
-      }),
-    ),
-    Match.when({ method: "stored" }, () =>
-      readCredentials<GitHubStoredCredentials>(profileName, "gh-stored").pipe(
-        Effect.flatMap((creds) =>
-          creds == null
-            ? Effect.fail(
-                new AuthError({
-                  message:
-                    "GitHub stored credentials not found. Run: alchemy login --configure",
-                }),
-              )
-            : Effect.succeed({
-                type: "token" as const,
-                token: Redacted.make(creds.token),
-                source: { type: "stored" as const },
+        return token;
+      }).pipe(
+        Effect.scoped,
+        Effect.mapError((e) =>
+          e instanceof GhCliError
+            ? new AuthError({ message: e.message, cause: e })
+            : new AuthError({
+                message:
+                  "Could not invoke `gh`. Install GitHub CLI from https://cli.github.com/ and run `gh auth login`.",
+                cause: e,
               }),
         ),
-      ),
-    ),
-    Match.when({ method: "gh-cli" }, () =>
-      ghCliToken().pipe(
-        Effect.map((token) => ({
-          type: "token" as const,
-          token: Redacted.make(token),
-          source: { type: "gh-cli" as const },
-        })),
-      ),
-    ),
-    Match.exhaustive,
-  );
+      );
 
-const logout = (profileName: string, config: GitHubAuthConfig) =>
-  Match.value(config).pipe(
-    Match.when({ method: "env" }, () => Effect.void),
-    Match.when({ method: "gh-cli" }, () => Effect.void),
-    Match.when({ method: "stored" }, () =>
-      deleteCredentials(profileName, "gh-stored").pipe(
-        Effect.andThen(Clank.success("GitHub: stored credentials removed")),
-      ),
-    ),
-    Match.exhaustive,
-  );
+    const loginStored = Effect.fnUntraced(function* (profileName: string) {
+      const token = yield* Clank.password({
+        message:
+          "GitHub Personal Access Token (needs `repo` scope; `workflow` for Actions)",
+        validate: (v) => (v.length === 0 ? "Required" : undefined),
+      }).pipe(retryOnce);
 
-const login = (profileName: string, config: GitHubAuthConfig) =>
-  Match.value(config)
-    .pipe(
-      Match.when({ method: "env" }, () => Effect.void),
-      Match.when({ method: "gh-cli" }, () =>
-        ghCliToken().pipe(
-          Effect.tap(() =>
-            Clank.success("GitHub: gh CLI authentication available."),
-          ),
-          Effect.asVoid,
-        ),
-      ),
-      Match.when({ method: "stored" }, () =>
-        readCredentials<GitHubStoredCredentials>(profileName, "gh-stored").pipe(
-          Effect.flatMap((creds) =>
-            creds == null ? loginStored(profileName) : Effect.void,
+      yield* store.write<GitHubStoredCredentials>(profileName, "gh-stored", {
+        type: "pat",
+        token,
+      });
+      yield* Clank.success("GitHub: credentials saved.");
+      return { method: "stored" as const };
+    });
+
+    const configureInteractive = (profileName: string) =>
+      Clank.select({
+        message: "GitHub authentication method",
+        options,
+      }).pipe(
+        Effect.flatMap((method) =>
+          Match.value(method).pipe(
+            Match.when("env", () => Effect.succeed({ method: "env" as const })),
+            Match.when("gh-cli", () =>
+              ghCliToken().pipe(
+                Effect.as({ method: "gh-cli" as const }),
+                Effect.mapError(
+                  (e) =>
+                    new AuthError({
+                      message: `gh CLI not available: ${e.message}`,
+                      cause: e,
+                    }),
+                ),
+              ),
+            ),
+            Match.when("stored", () => loginStored(profileName)),
+            Match.exhaustive,
           ),
         ),
-      ),
-      Match.exhaustive,
-    )
-    .pipe(
-      Effect.mapError(
-        (e) => new AuthError({ message: "login failed", cause: e }),
-      ),
-    );
+      );
 
-const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
-  Effect.gen(function* () {
-    if (ctx.ci) {
-      return { method: "env" as const };
-    }
-    return yield* configureInteractive(profileName);
-  }).pipe(
-    Effect.mapError(
-      (e) =>
-        new AuthError({
-          message: "failed to configure credentials",
-          cause: e,
-        }),
-    ),
-  );
+    const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
+      Effect.gen(function* () {
+        if (ctx.ci) {
+          return { method: "env" as const };
+        }
+        return yield* configureInteractive(profileName);
+      }).pipe(
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: "failed to configure credentials",
+              cause: e,
+            }),
+        ),
+      );
 
-const configureInteractive = (profileName: string) =>
-  Clank.select({
-    message: "GitHub authentication method",
-    options,
-  }).pipe(
-    Effect.flatMap((method) =>
-      Match.value(method).pipe(
-        Match.when("env", () => Effect.succeed({ method: "env" as const })),
-        Match.when("gh-cli", () =>
-          ghCliToken().pipe(
-            Effect.as({ method: "gh-cli" as const }),
-            Effect.mapError(
-              (e) =>
-                new AuthError({
-                  message: `gh CLI not available: ${e.message}`,
-                  cause: e,
-                }),
+    const resolveCredentials = (
+      profileName: string,
+      config: GitHubAuthConfig,
+    ): Effect.Effect<GitHubResolvedCredentials, AuthError> =>
+      Match.value(config).pipe(
+        Match.when(
+          { method: "env" },
+          Effect.fnUntraced(function* () {
+            const access = yield* getEnvRedacted("GITHUB_ACCESS_TOKEN");
+            if (access) {
+              return {
+                type: "token" as const,
+                token: access,
+                source: {
+                  type: "env" as const,
+                  details: "GITHUB_ACCESS_TOKEN",
+                },
+              };
+            }
+            const token = yield* getEnvRedacted("GITHUB_TOKEN");
+            if (token) {
+              return {
+                type: "token" as const,
+                token,
+                source: { type: "env" as const, details: "GITHUB_TOKEN" },
+              };
+            }
+            return yield* new AuthError({
+              message:
+                "GitHub env credentials not found. Set GITHUB_ACCESS_TOKEN or GITHUB_TOKEN.",
+            });
+          }),
+        ),
+        Match.when({ method: "stored" }, () =>
+          store.read<GitHubStoredCredentials>(profileName, "gh-stored").pipe(
+            Effect.flatMap((creds) =>
+              creds == null
+                ? Effect.fail(
+                    new AuthError({
+                      message:
+                        "GitHub stored credentials not found. Run: alchemy login --configure",
+                    }),
+                  )
+                : Effect.succeed({
+                    type: "token" as const,
+                    token: Redacted.make(creds.token),
+                    source: { type: "stored" as const },
+                  }),
             ),
           ),
         ),
-        Match.when("stored", () => loginStored(profileName)),
+        Match.when({ method: "gh-cli" }, () =>
+          ghCliToken().pipe(
+            Effect.map((token) => ({
+              type: "token" as const,
+              token: Redacted.make(token),
+              source: { type: "gh-cli" as const },
+            })),
+          ),
+        ),
         Match.exhaustive,
-      ),
-    ),
-  );
-
-const loginStored = Effect.fnUntraced(function* (profileName: string) {
-  const token = yield* Clank.password({
-    message:
-      "GitHub Personal Access Token (needs `repo` scope; `workflow` for Actions)",
-    validate: (v) => (v.length === 0 ? "Required" : undefined),
-  }).pipe(retryOnce);
+      );
 
-  yield* writeCredentials<GitHubStoredCredentials>(profileName, "gh-stored", {
-    type: "pat",
-    token,
-  });
-  yield* Clank.success("GitHub: credentials saved.");
-  return { method: "stored" as const };
-});
+    const logout = (profileName: string, config: GitHubAuthConfig) =>
+      Match.value(config).pipe(
+        Match.when({ method: "env" }, () => Effect.void),
+        Match.when({ method: "gh-cli" }, () => Effect.void),
+        Match.when({ method: "stored" }, () =>
+          store
+            .delete(profileName, "gh-stored")
+            .pipe(
+              Effect.andThen(
+                Clank.success("GitHub: stored credentials removed"),
+              ),
+            ),
+        ),
+        Match.exhaustive,
+      );
 
-class GhCliError extends Error {
-  readonly _tag = "GhCliError";
-}
+    const login = (profileName: string, config: GitHubAuthConfig) =>
+      Match.value(config)
+        .pipe(
+          Match.when({ method: "env" }, () => Effect.void),
+          Match.when({ method: "gh-cli" }, () =>
+            ghCliToken().pipe(
+              Effect.tap(() =>
+                Clank.success("GitHub: gh CLI authentication available."),
+              ),
+              Effect.asVoid,
+            ),
+          ),
+          Match.when({ method: "stored" }, () =>
+            store
+              .read<GitHubStoredCredentials>(profileName, "gh-stored")
+              .pipe(
+                Effect.flatMap((creds) =>
+                  creds == null ? loginStored(profileName) : Effect.void,
+                ),
+              ),
+          ),
+          Match.exhaustive,
+        )
+        .pipe(
+          Effect.mapError(
+            (e) => new AuthError({ message: "login failed", cause: e }),
+          ),
+        );
 
-const ghCliToken = () =>
-  Effect.gen(function* () {
-    const handle = yield* ChildProcess.make("gh", ["auth", "token"], {
-      shell: false,
-    });
-    const [exitCode, stdout, stderr] = yield* Effect.all(
-      [
-        handle.exitCode,
-        Stream.mkString(Stream.decodeText(handle.stdout)),
-        Stream.mkString(Stream.decodeText(handle.stderr)),
-      ],
-      { concurrency: 3 },
-    );
-    if (exitCode !== 0) {
-      return yield* Effect.fail(
-        new GhCliError(
-          `gh auth token exited with ${exitCode}: ${stderr.trim() || stdout.trim()}`,
+    const prettyPrint = (profileName: string, config: GitHubAuthConfig) =>
+      resolveCredentials(profileName, config).pipe(
+        Effect.tap((creds) => {
+          const sourceStr = creds.source.details
+            ? `${creds.source.type} - ${creds.source.details}`
+            : creds.source.type;
+          return Effect.all([
+            Console.log(`  token: ${displayRedacted(creds.token, 6)}`),
+            Console.log(`  source: ${sourceStr}`),
+          ]);
+        }),
+        Effect.catch((e) =>
+          Console.error(`  Failed to retrieve credentials: ${e}`),
         ),
       );
-    }
-    const token = stdout.trim();
-    if (!token) {
-      return yield* Effect.fail(
-        new GhCliError("gh auth token returned empty output"),
-      );
-    }
-    return token;
-  }).pipe(
-    Effect.scoped,
-    Effect.mapError((e) =>
-      e instanceof GhCliError
-        ? new AuthError({ message: e.message, cause: e })
-        : new AuthError({
-            message:
-              "Could not invoke `gh`. Install GitHub CLI from https://cli.github.com/ and run `gh auth login`.",
-            cause: e,
-          }),
-    ),
-  );
 
-const prettyPrint = (profileName: string, config: GitHubAuthConfig) =>
-  resolveCredentials(profileName, config).pipe(
-    Effect.tap((creds) => {
-      const sourceStr = creds.source.details
-        ? `${creds.source.type} - ${creds.source.details}`
-        : creds.source.type;
-      return Effect.all([
-        Console.log(`  token: ${displayRedacted(creds.token, 6)}`),
-        Console.log(`  source: ${sourceStr}`),
-      ]);
-    }),
-    Effect.catch((e) =>
-      Console.error(`  Failed to retrieve credentials: ${e}`),
-    ),
-  );
+    return {
+      configure: configureCredentials,
+      logout,
+      login,
+      prettyPrint,
+      read: resolveCredentials,
+    };
+  }),
+);

package/src/GitHub/Credentials.ts

@@ -5,7 +5,7 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
 import { AuthError, getAuthProvider } from "../Auth/AuthProvider.ts";
-import { ALCHEMY_PROFILE, loadOrConfigure } from "../Auth/Profile.ts";
+import { ALCHEMY_PROFILE, Profile } from "../Auth/Profile.ts";
 import {
   GITHUB_AUTH_PROVIDER_NAME,
   type GitHubAuthConfig,
@@ -74,15 +74,15 @@ export const fromAuthProvider = () =>
   Layer.effect(
     GitHubCredentials,
     Effect.gen(function* () {
+      const profile = yield* Profile;
       const auth = yield* getAuthProvider<
         GitHubAuthConfig,
         GitHubResolvedCredentials
       >(GITHUB_AUTH_PROVIDER_NAME);
       const profileName = yield* ALCHEMY_PROFILE;
       const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
-      const ctx = yield* Effect.context<never>();
 
-      return yield* loadOrConfigure(auth, profileName, { ci }).pipe(
+      return yield* profile.loadOrConfigure(auth, profileName, { ci }).pipe(
         Effect.flatMap((config) =>
           auth.read(profileName, config as GitHubAuthConfig),
         ),
@@ -93,7 +93,6 @@ export const fromAuthProvider = () =>
               message: `Failed to resolve GitHub credentials for profile '${profileName}': ${(e as { message?: string }).message ?? String(e)}`,
             }),
         ),
-        Effect.provide(ctx),
       );
     }).pipe(Effect.orDie),
   );

package/src/GitHub/Providers.ts

@@ -1,4 +1,6 @@
 import * as Layer from "effect/Layer";
+import { CredentialsStoreLive } from "../Auth/Credentials.ts";
+import { ProfileLive } from "../Auth/Profile.ts";
 import * as Provider from "../Provider.ts";
 import { GitHubAuth } from "./AuthProvider.ts";
 import { Comment, CommentProvider } from "./Comment.ts";
@@ -28,5 +30,7 @@ export const providers = () =>
     ),
     Layer.provideMerge(Credentials.fromAuthProvider()),
     Layer.provideMerge(GitHubAuth),
+    Layer.provideMerge(ProfileLive),
+    Layer.provideMerge(CredentialsStoreLive),
     Layer.orDie,
   );

package/src/GitHub/Secrets.ts

@@ -2,6 +2,7 @@ import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
 
 import type { Input } from "../Input.ts";
+import * as Output from "../Output.ts";
 import { Secret } from "./Secret.ts";
 
 export interface SecretsProps {
@@ -60,7 +61,30 @@ export const Secrets = ({
         repository,
         environment,
         name,
-        value: Redacted.make(value),
+        value: liftValue(value),
       }),
     ),
   );
+
+// Accepts a plain string, an existing `Redacted<string>`, or an `Output`
+// of either. We must lift via `Output.map` for the `Output` case so the
+// inner string gets wrapped after the engine resolves it — otherwise the
+// `Redacted.make(output)` path produces `Redacted<Output<...>>`, which
+// later double-wraps to `Redacted<Redacted<string>>` and stringifies to
+// `<redacted>` inside `sodium.from_string`.
+const liftValue = (
+  value: Input<string | Redacted.Redacted<string>>,
+): Input<Redacted.Redacted<string>> =>
+  Output.isOutput(value)
+    ? Output.map(
+        value as Output.Output<string | Redacted.Redacted<string>>,
+        toRedacted,
+      )
+    : toRedacted(value as string | Redacted.Redacted<string>);
+
+const toRedacted = (
+  value: string | Redacted.Redacted<string>,
+): Redacted.Redacted<string> =>
+  Redacted.isRedacted(value)
+    ? (value as Redacted.Redacted<string>)
+    : Redacted.make(value);