alchemy 2.0.0-beta.34 → 2.0.0-beta.35

package/src/GitHub/Variables.ts

@@ -0,0 +1,54 @@
+import * as Effect from "effect/Effect";
+
+import type { Input } from "../Input.ts";
+import { Variable } from "./Variable.ts";
+
+export interface VariablesProps {
+  /**
+   * Repository owner (user or organization).
+   */
+  owner: string;
+
+  /**
+   * Repository name.
+   */
+  repository: string;
+
+  /**
+   * Map of variable name to value. Each entry becomes one
+   * `GitHub.Variable` resource, using the map key as both the alchemy
+   * logical id and the variable name.
+   */
+  variables: Record<string, Input<string>>;
+}
+
+/**
+ * Bulk-creates a set of {@link Variable}s in the same repository.
+ *
+ * Plural counterpart of {@link import("./Secrets.ts").Secrets}, for
+ * non-sensitive values like region names, role ARNs, environment labels,
+ * or feature flags.
+ *
+ * @example
+ * ```ts
+ * yield* GitHub.Variables({
+ *   owner: "alchemy-run",
+ *   repository: "alchemy-effect",
+ *   variables: {
+ *     AWS_ROLE_ARN: role.roleArn,
+ *     AWS_REGION: region,
+ *   },
+ * });
+ * ```
+ */
+export const Variables = ({ owner, repository, variables }: VariablesProps) =>
+  Effect.all(
+    Object.entries(variables).map(([name, value]) =>
+      Variable(name, {
+        owner,
+        repository,
+        name,
+        value,
+      }),
+    ),
+  );

package/src/GitHub/index.ts

@@ -5,3 +5,4 @@ export * from "./Providers.ts";
 export * from "./Secret.ts";
 export * from "./Secrets.ts";
 export * from "./Variable.ts";
+export * from "./Variables.ts";

package/src/Neon/AuthProvider.ts

@@ -1,6 +1,5 @@
 import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
 import * as Match from "effect/Match";
 import * as Redacted from "effect/Redacted";
 import {
@@ -8,14 +7,9 @@ import {
   AuthProviderLayer,
   type ConfigureContext,
 } from "../Auth/AuthProvider.ts";
-import {
-  deleteCredentials,
-  displayRedacted,
-  readCredentials,
-  writeCredentials,
-} from "../Auth/Credentials.ts";
+import { CredentialsStore, displayRedacted } from "../Auth/Credentials.ts";
 import { getEnvRedacted, retryOnce } from "../Auth/Env.ts";
-import { getProfile, setProfile } from "../Auth/Profile.ts";
+import { Profile } from "../Auth/Profile.ts";
 import * as Clank from "../Util/Clank.ts";
 
 export const NEON_AUTH_PROVIDER_NAME = "Neon";
@@ -57,161 +51,173 @@ const options: Array<{
 export const NeonAuth = AuthProviderLayer<
   NeonAuthConfig,
   NeonResolvedCredentials
->()(NEON_AUTH_PROVIDER_NAME, {
-  configure: (profileName, ctx) => configureCredentials(profileName, ctx),
-  logout: (profileName, config) => logout(profileName, config),
-  login: (profileName, config) => login(profileName, config),
-  prettyPrint: (profileName, config) => prettyPrint(profileName, config),
-  read: (profileName, config) => resolveCredentials(profileName, config),
-});
+>()(
+  NEON_AUTH_PROVIDER_NAME,
+  Effect.gen(function* () {
+    const profiles = yield* Profile;
+    const store = yield* CredentialsStore;
 
-const resolveCredentials = (
-  profileName: string,
-  config: NeonAuthConfig,
-): Effect.Effect<NeonResolvedCredentials, AuthError, FileSystem.FileSystem> =>
-  Match.value(config).pipe(
-    Match.when(
-      { method: "env" },
-      Effect.fnUntraced(function* () {
-        const apiKey = yield* getEnvRedacted("NEON_API_KEY");
-        if (!apiKey) {
-          return yield* new AuthError({
-            message: "Neon env credentials not found. Set NEON_API_KEY.",
-          });
-        }
-        return {
-          type: "apiKey" as const,
-          apiKey,
-          source: { type: "env" as const },
-        };
-      }),
-    ),
-    Match.when({ method: "stored" }, () =>
-      readCredentials<NeonStoredCredentials>(profileName, "neon-stored").pipe(
-        Effect.flatMap((creds) =>
-          creds == null
-            ? Effect.fail(
-                new AuthError({
-                  message:
-                    "Neon stored credentials not found. Run: alchemy-effect login --configure",
-                }),
-              )
-            : Effect.succeed({
-                type: "apiKey" as const,
-                apiKey: Redacted.make(creds.apiKey),
-                source: { type: "stored" as const },
-              }),
-        ),
-      ),
-    ),
-    Match.exhaustive,
-  );
+    const loginStored = Effect.fnUntraced(function* (profileName: string) {
+      const apiKey = yield* Clank.password({
+        message: "Neon API Key",
+        validate: (v) => (v.length === 0 ? "Required" : undefined),
+      }).pipe(retryOnce);
 
-const logout = (profileName: string, config: NeonAuthConfig) =>
-  Match.value(config).pipe(
-    Match.when({ method: "env" }, () => Effect.void),
-    Match.when({ method: "stored" }, () =>
-      deleteCredentials(profileName, "neon-stored").pipe(
-        Effect.andThen(Clank.success("Neon: stored credentials removed")),
-      ),
-    ),
-    Match.exhaustive,
-  );
+      yield* store.write<NeonStoredCredentials>(profileName, "neon-stored", {
+        type: "apiKey",
+        apiKey,
+      });
+      yield* Clank.success("Neon: credentials saved.");
+      return { method: "stored" as const };
+    });
 
-const login = (profileName: string, config: NeonAuthConfig) =>
-  Match.value(config)
-    .pipe(
-      Match.when({ method: "env" }, () =>
-        // If NEON_API_KEY isn't set, fall through to the interactive picker
-        // so the user can switch to `stored` (or be told to set the env var)
-        // instead of silently failing later in `read`. The new selection is
-        // persisted to the profile so subsequent logins don't re-prompt.
-        getEnvRedacted("NEON_API_KEY").pipe(
-          Effect.flatMap((apiKey) =>
-            apiKey
-              ? Effect.void
-              : Effect.gen(function* () {
-                  const next = yield* configureInteractive(profileName);
-                  const existing = yield* getProfile(profileName);
-                  yield* setProfile(profileName, {
-                    ...existing,
-                    [NEON_AUTH_PROVIDER_NAME]: next,
-                  });
-                }),
+    const configureInteractive = (profileName: string) =>
+      Clank.select({
+        message: "Neon authentication method",
+        options,
+      }).pipe(
+        Effect.flatMap((method) =>
+          Match.value(method).pipe(
+            Match.when("env", () => Effect.succeed({ method: "env" as const })),
+            Match.when("stored", () => loginStored(profileName)),
+            Match.exhaustive,
           ),
         ),
-      ),
-      Match.when({ method: "stored" }, () =>
-        readCredentials<NeonStoredCredentials>(profileName, "neon-stored").pipe(
-          Effect.flatMap((creds) =>
-            creds == null ? loginStored(profileName) : Effect.void,
-          ),
+      );
+
+    const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
+      Effect.gen(function* () {
+        if (ctx.ci) {
+          return { method: "env" as const };
+        }
+        return yield* configureInteractive(profileName);
+      }).pipe(
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: "failed to configure credentials",
+              cause: e,
+            }),
         ),
-      ),
-      Match.exhaustive,
-    )
-    .pipe(
-      Effect.mapError(
-        (e) => new AuthError({ message: "login failed", cause: e }),
-      ),
-    );
+      );
 
-const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
-  Effect.gen(function* () {
-    if (ctx.ci) {
-      return { method: "env" as const };
-    }
-    return yield* configureInteractive(profileName);
-  }).pipe(
-    Effect.mapError(
-      (e) =>
-        new AuthError({
-          message: "failed to configure credentials",
-          cause: e,
-        }),
-    ),
-  );
+    const resolveCredentials = (
+      profileName: string,
+      config: NeonAuthConfig,
+    ): Effect.Effect<NeonResolvedCredentials, AuthError> =>
+      Match.value(config).pipe(
+        Match.when(
+          { method: "env" },
+          Effect.fnUntraced(function* () {
+            const apiKey = yield* getEnvRedacted("NEON_API_KEY");
+            if (!apiKey) {
+              return yield* new AuthError({
+                message: "Neon env credentials not found. Set NEON_API_KEY.",
+              });
+            }
+            return {
+              type: "apiKey" as const,
+              apiKey,
+              source: { type: "env" as const },
+            };
+          }),
+        ),
+        Match.when({ method: "stored" }, () =>
+          store.read<NeonStoredCredentials>(profileName, "neon-stored").pipe(
+            Effect.flatMap((creds) =>
+              creds == null
+                ? Effect.fail(
+                    new AuthError({
+                      message:
+                        "Neon stored credentials not found. Run: alchemy-effect login --configure",
+                    }),
+                  )
+                : Effect.succeed({
+                    type: "apiKey" as const,
+                    apiKey: Redacted.make(creds.apiKey),
+                    source: { type: "stored" as const },
+                  }),
+            ),
+          ),
+        ),
+        Match.exhaustive,
+      );
 
-const configureInteractive = (profileName: string) =>
-  Clank.select({
-    message: "Neon authentication method",
-    options,
-  }).pipe(
-    Effect.flatMap((method) =>
-      Match.value(method).pipe(
-        Match.when("env", () => Effect.succeed({ method: "env" as const })),
-        Match.when("stored", () => loginStored(profileName)),
+    const logout = (profileName: string, config: NeonAuthConfig) =>
+      Match.value(config).pipe(
+        Match.when({ method: "env" }, () => Effect.void),
+        Match.when({ method: "stored" }, () =>
+          store
+            .delete(profileName, "neon-stored")
+            .pipe(
+              Effect.andThen(Clank.success("Neon: stored credentials removed")),
+            ),
+        ),
         Match.exhaustive,
-      ),
-    ),
-  );
+      );
 
-const loginStored = Effect.fnUntraced(function* (profileName: string) {
-  const apiKey = yield* Clank.password({
-    message: "Neon API Key",
-    validate: (v) => (v.length === 0 ? "Required" : undefined),
-  }).pipe(retryOnce);
+    const login = (profileName: string, config: NeonAuthConfig) =>
+      Match.value(config)
+        .pipe(
+          Match.when({ method: "env" }, () =>
+            // If NEON_API_KEY isn't set, fall through to the interactive picker
+            // so the user can switch to `stored` (or be told to set the env var)
+            // instead of silently failing later in `read`. The new selection is
+            // persisted to the profile so subsequent logins don't re-prompt.
+            getEnvRedacted("NEON_API_KEY").pipe(
+              Effect.flatMap((apiKey) =>
+                apiKey
+                  ? Effect.void
+                  : Effect.gen(function* () {
+                      const next = yield* configureInteractive(profileName);
+                      const existing = yield* profiles.getProfile(profileName);
+                      yield* profiles.setProfile(profileName, {
+                        ...existing,
+                        [NEON_AUTH_PROVIDER_NAME]: next,
+                      });
+                    }),
+              ),
+            ),
+          ),
+          Match.when({ method: "stored" }, () =>
+            store
+              .read<NeonStoredCredentials>(profileName, "neon-stored")
+              .pipe(
+                Effect.flatMap((creds) =>
+                  creds == null ? loginStored(profileName) : Effect.void,
+                ),
+              ),
+          ),
+          Match.exhaustive,
+        )
+        .pipe(
+          Effect.mapError(
+            (e) => new AuthError({ message: "login failed", cause: e }),
+          ),
+        );
 
-  yield* writeCredentials<NeonStoredCredentials>(profileName, "neon-stored", {
-    type: "apiKey",
-    apiKey,
-  });
-  yield* Clank.success("Neon: credentials saved.");
-  return { method: "stored" as const };
-});
+    const prettyPrint = (profileName: string, config: NeonAuthConfig) =>
+      resolveCredentials(profileName, config).pipe(
+        Effect.tap((creds) => {
+          const sourceStr = creds.source.details
+            ? `${creds.source.type} - ${creds.source.details}`
+            : creds.source.type;
+          return Effect.all([
+            Console.log(`  apiKey: ${displayRedacted(creds.apiKey, 9)}`),
+            Console.log(`  source: ${sourceStr}`),
+          ]);
+        }),
+        Effect.catch((e) =>
+          Console.error(`  Failed to retrieve credentials: ${e}`),
+        ),
+      );
 
-const prettyPrint = (profileName: string, config: NeonAuthConfig) =>
-  resolveCredentials(profileName, config).pipe(
-    Effect.tap((creds) => {
-      const sourceStr = creds.source.details
-        ? `${creds.source.type} - ${creds.source.details}`
-        : creds.source.type;
-      return Effect.all([
-        Console.log(`  apiKey: ${displayRedacted(creds.apiKey, 9)}`),
-        Console.log(`  source: ${sourceStr}`),
-      ]);
-    }),
-    Effect.catch((e) =>
-      Console.error(`  Failed to retrieve credentials: ${e}`),
-    ),
-  );
+    return {
+      configure: configureCredentials,
+      logout,
+      login,
+      prettyPrint,
+      read: resolveCredentials,
+    };
+  }),
+);

package/src/Neon/Credentials.ts

@@ -4,7 +4,7 @@ import * as Config from "effect/Config";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import { getAuthProvider } from "../Auth/AuthProvider.ts";
-import { ALCHEMY_PROFILE, loadOrConfigure } from "../Auth/Profile.ts";
+import { ALCHEMY_PROFILE, Profile } from "../Auth/Profile.ts";
 import {
   NEON_AUTH_PROVIDER_NAME,
   type NeonAuthConfig,
@@ -19,15 +19,15 @@ export const fromAuthProvider = () =>
   Layer.effect(
     Credentials,
     Effect.gen(function* () {
+      const profile = yield* Profile;
       const auth = yield* getAuthProvider<
         NeonAuthConfig,
         NeonResolvedCredentials
       >(NEON_AUTH_PROVIDER_NAME);
       const profileName = yield* ALCHEMY_PROFILE;
       const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
-      const ctx = yield* Effect.context<never>();
 
-      return yield* loadOrConfigure(auth, profileName, { ci }).pipe(
+      return yield* profile.loadOrConfigure(auth, profileName, { ci }).pipe(
         Effect.flatMap((config) =>
           auth.read(profileName, config as NeonAuthConfig),
         ),
@@ -41,7 +41,6 @@ export const fromAuthProvider = () =>
               message: `Failed to resolve Neon credentials for profile '${profileName}': ${(e as { message?: string }).message ?? String(e)}`,
             }),
         ),
-        Effect.provide(ctx),
       );
     }),
   );

package/src/Neon/NeonEnvironment.ts

@@ -3,7 +3,7 @@ import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import { getAuthProvider } from "../Auth/AuthProvider.ts";
-import { ALCHEMY_PROFILE, loadOrConfigure } from "../Auth/Profile.ts";
+import { ALCHEMY_PROFILE, Profile } from "../Auth/Profile.ts";
 import {
   NEON_AUTH_PROVIDER_NAME,
   type NeonAuthConfig,
@@ -19,13 +19,14 @@ export const fromProfile = () =>
   Layer.effect(
     NeonEnvironment,
     Effect.gen(function* () {
+      const profile = yield* Profile;
       const auth = yield* getAuthProvider<
         NeonAuthConfig,
         NeonResolvedCredentials
       >(NEON_AUTH_PROVIDER_NAME);
       const profileName = yield* ALCHEMY_PROFILE;
       const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
-      const config = yield* loadOrConfigure(auth, profileName, { ci });
+      const config = yield* profile.loadOrConfigure(auth, profileName, { ci });
       return yield* auth.read(profileName, config as NeonAuthConfig);
     }),
   );

package/src/Neon/Project.ts

@@ -74,6 +74,14 @@ export type ProjectProps = {
    * Optional Neon organization ID. Cannot be changed after creation.
    */
   orgId?: string;
+  /**
+   * Enable Postgres logical replication on the project. Once enabled,
+   * Neon does not support disabling it again.
+   *
+   * @default false
+   * @see https://neon.tech/docs/guides/logical-replication-neon
+   */
+  enableLogicalReplication?: boolean;
   /**
    * Directory containing `.sql` migration files. Files are sorted by their
    * numeric prefix (e.g. `0001_init.sql`) and applied in order against the
@@ -118,6 +126,7 @@ export type Project = Resource<
      */
     origin: PostgresOrigin;
     historyRetentionSeconds: number;
+    enableLogicalReplication: boolean;
     migrationsDir: string | undefined;
     migrationsTable: string | undefined;
     migrationsHashes: Record<string, string>;
@@ -148,6 +157,13 @@ export type Project = Resource<
  * });
  * ```
  *
+ * @example Project with logical replication enabled
+ * ```typescript
+ * const project = yield* Neon.Project("my-project", {
+ *   enableLogicalReplication: true,
+ * });
+ * ```
+ *
  * @section Migrations and seed data
  * @example Apply migrations and seed files
  * ```typescript
@@ -242,6 +258,12 @@ export const ProjectProvider = () =>
           ) {
             return { action: "update" } as const;
           }
+          if (
+            (news.enableLogicalReplication ?? false) !==
+            (output?.enableLogicalReplication ?? false)
+          ) {
+            return { action: "update" } as const;
+          }
           if (news.migrationsDir) {
             const newHashes = yield* hashMigrations(news.migrationsDir);
             if (!recordsEqual(newHashes, output?.migrationsHashes ?? {})) {
@@ -269,6 +291,8 @@ export const ProjectProvider = () =>
                 ...output,
                 projectName: project.name,
                 historyRetentionSeconds: project.history_retention_seconds,
+                enableLogicalReplication:
+                  project.settings?.enable_logical_replication === true,
               })),
               Effect.catchTag("ProjectNotFound", () =>
                 Effect.succeed(undefined),
@@ -310,6 +334,8 @@ export const ProjectProvider = () =>
             pooledConnectionUri: conn.pooled,
             origin: parsePostgresOrigin(conn.uri),
             historyRetentionSeconds: match.history_retention_seconds,
+            enableLogicalReplication:
+              match.settings?.enable_logical_replication === true,
             migrationsDir: olds?.migrationsDir,
             migrationsTable: olds?.migrationsTable,
             migrationsHashes: {},
@@ -325,6 +351,14 @@ export const ProjectProvider = () =>
                 .updateProject(output.projectId, {
                   name: news.name,
                   history_retention_seconds: news.historyRetentionSeconds,
+                  settings:
+                    (news.enableLogicalReplication ?? false) !==
+                    (output.enableLogicalReplication ?? false)
+                      ? {
+                          enable_logical_replication:
+                            news.enableLogicalReplication ?? false,
+                        }
+                      : undefined,
                 })
                 .pipe(
                   Effect.map((r) => ({
@@ -342,6 +376,8 @@ export const ProjectProvider = () =>
                     historyRetentionSeconds:
                       r.project.history_retention_seconds ??
                       output.historyRetentionSeconds,
+                    enableLogicalReplication:
+                      r.project.settings?.enable_logical_replication === true,
                   })),
                 )
             : yield* Effect.gen(function* () {
@@ -357,6 +393,9 @@ export const ProjectProvider = () =>
                   },
                   history_retention_seconds: news.historyRetentionSeconds,
                   org_id: news.orgId,
+                  settings: news.enableLogicalReplication
+                    ? { enable_logical_replication: true }
+                    : undefined,
                 });
                 yield* api.waitForOperations(created.operations);
 
@@ -383,6 +422,9 @@ export const ProjectProvider = () =>
                   origin: parsePostgresOrigin(conn.uri),
                   historyRetentionSeconds:
                     created.project.history_retention_seconds ?? 86400,
+                  enableLogicalReplication:
+                    created.project.settings?.enable_logical_replication ===
+                    true,
                 };
               });
 

package/src/Neon/Providers.ts

@@ -1,5 +1,7 @@
 import * as Layer from "effect/Layer";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import { CredentialsStoreLive } from "../Auth/Credentials.ts";
+import { ProfileLive } from "../Auth/Profile.ts";
 import * as Provider from "../Provider.ts";
 import { NeonAuth } from "./AuthProvider.ts";
 import { Branch, BranchProvider } from "./Branch.ts";
@@ -48,6 +50,8 @@ export const providers = () =>
     Layer.provideMerge(Credentials.fromAuthProvider()),
     Layer.provideMerge(fromProfile()),
     Layer.provideMerge(NeonAuth),
+    Layer.provideMerge(ProfileLive),
+    Layer.provideMerge(CredentialsStoreLive),
     Layer.provideMerge(FetchHttpClient.layer),
     Layer.orDie,
   );

package/src/Neon/api.ts

@@ -146,6 +146,7 @@ export interface CreateProjectInput {
   };
   history_retention_seconds?: number;
   org_id?: string;
+  settings?: Record<string, unknown>;
 }
 
 export interface CreateProjectOutput {
@@ -288,6 +289,7 @@ export const createProject = (input: CreateProjectInput) =>
           : undefined),
       history_retention_seconds: input.history_retention_seconds,
       org_id: input.org_id,
+      settings: input.settings,
     },
   });
 

package/src/Sidecar/RpcClient.ts

@@ -7,7 +7,6 @@ import * as Layer from "effect/Layer";
 import * as Schedule from "effect/Schedule";
 import * as Schema from "effect/Schema";
 import * as ChildProcess from "effect/unstable/process/ChildProcess";
-import { fileURLToPath } from "node:url";
 import * as Lock from "./Lock.ts";
 import {
   deserializeRpcHandlers,
@@ -39,9 +38,7 @@ export const layer = <Self, T extends RpcHandlers>(
   Layer.effect(
     tag,
     Effect.gen(function* () {
-      const fiber = yield* maybeStartRpcServer(
-        fileURLToPath(options.main),
-      ).pipe(
+      const fiber = yield* maybeStartRpcServer(options.main).pipe(
         Effect.flatMap(() => RpcSession),
         Effect.map((session) =>
           deserializeRpcHandlers(
@@ -56,7 +53,7 @@ export const layer = <Self, T extends RpcHandlers>(
         Effect.forkScoped,
       );
       return new Proxy({} as T, {
-        get(target, prop) {
+        get(_, prop) {
           return (...args: any[]) =>
             Fiber.join(fiber).pipe(
               Effect.flatMap((session) => session[prop as never](...args)),
@@ -69,11 +66,15 @@ export const layer = <Self, T extends RpcHandlers>(
 const maybeStartRpcServer = Effect.fn(function* (main: string) {
   const lock = yield* Lock.Lock;
   if (!(yield* lock.check)) {
+    main = RpcPaths.sanitizeSidecarMain(main);
+    const bin = typeof globalThis.Bun !== "undefined" ? "bun" : "node";
     yield* Effect.logDebug("[RpcClient] Starting RPC server", main);
-    yield* ChildProcess.make("bun", ["run", main], {
+    yield* ChildProcess.make(bin, { bun: ["run", main], node: [main] }[bin], {
       stdout: "inherit",
       stderr: "inherit",
-      detached: true,
+      extendEnv: true,
+      // Effect's default behavior is detached: true on posix and false on Windows.
+      // Ideally we would set detached: true on Windows, but that would create a separate console window for every server instance.
     });
   } else {
     yield* Effect.logDebug("[RpcClient] RPC server already running", main);