alchemy 2.0.0-beta.4 → 2.0.0-beta.test-export-fix-4

package/src/AWS/AuthProvider.ts

@@ -1,392 +0,0 @@
-import * as DistilledAuth from "@distilled.cloud/aws/Auth";
-import * as Console from "effect/Console";
-import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
-import * as Match from "effect/Match";
-import * as Path from "effect/Path";
-import * as Redacted from "effect/Redacted";
-import * as HttpClient from "effect/unstable/http/HttpClient";
-import {
-  ChildProcess,
-  type ChildProcessSpawner,
-} from "effect/unstable/process";
-import * as NodeCrypto from "node:crypto";
-import * as NodeOs from "node:os";
-import { AuthError, type AuthProvider } from "../Auth/AuthProvider.ts";
-import {
-  deleteCredentials,
-  displayRedacted,
-  readCredentials,
-  writeCredentials,
-} from "../Auth/Credentials.ts";
-import {
-  getEnv,
-  getEnvRedacted,
-  getEnvRedactedRequired,
-  retryOnce,
-} from "../Auth/Env.ts";
-import * as Clank from "../Util/Clank.ts";
-
-export type AwsAuthConfig =
-  | { method: "sso"; ssoProfile: string }
-  | { method: "stored" }
-  | { method: "env" };
-
-const options: Array<{
-  value: AwsAuthConfig["method"];
-  label: string;
-  hint?: string;
-}> = [
-  {
-    value: "sso",
-    label: "SSO",
-    hint: "aws sso login — credentials loaded from AWS SSO cache",
-  },
-  {
-    value: "env",
-    label: "Environment Variables",
-    hint: "AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY",
-  },
-  {
-    value: "stored",
-    label: "Stored",
-    hint: "stored in ~/.alchemy/credentials",
-  },
-];
-
-export interface AwsStoredCredentials {
-  accessKeyId: string;
-  secretAccessKey: string;
-  sessionToken?: string;
-  region?: string;
-}
-
-export interface AwsResolvedCredentials {
-  accessKeyId: Redacted.Redacted<string>;
-  secretAccessKey: Redacted.Redacted<string>;
-  sessionToken?: Redacted.Redacted<string>;
-  region?: string;
-  source: { type: AwsAuthConfig["method"]; details?: string };
-}
-
-export const AwsAuth = Effect.gen(function* () {
-  const context = yield* Effect.context<
-    | FileSystem.FileSystem
-    | Path.Path
-    | HttpClient.HttpClient
-    | ChildProcessSpawner.ChildProcessSpawner
-  >();
-
-  return {
-    name: "AWS",
-    configure: (profileName: string) =>
-      configureCredentials(profileName).pipe(Effect.provide(context)),
-
-    logout: (profileName, config) =>
-      logout(profileName, config).pipe(Effect.provide(context)),
-
-    login: (profileName, config) =>
-      login(profileName, config).pipe(Effect.provide(context)),
-
-    prettyPrint: (profileName, config) =>
-      prettyPrint(profileName, config).pipe(Effect.provide(context)),
-
-    read: (profileName, config) =>
-      resolveCredentials(profileName, config).pipe(Effect.provide(context)),
-  } satisfies AuthProvider<AwsAuthConfig, AwsResolvedCredentials>;
-});
-
-const runSsoCommand = (command: "login" | "logout", ssoProfile: string) =>
-  Effect.gen(function* () {
-    const handle = yield* ChildProcess.make(
-      "aws",
-      ["sso", command, "--profile", ssoProfile],
-      {
-        shell: false,
-        stdin: "inherit",
-        stdout: "inherit",
-        stderr: "inherit",
-      },
-    );
-    const exit = yield* handle.exitCode;
-    if (exit !== 0) {
-      yield* Effect.fail(
-        new AuthError({
-          message: `aws sso ${command} exited with code ${exit}`,
-        }),
-      );
-    }
-  }).pipe(Effect.scoped);
-
-const resolveCredentials = (profileName: string, config: AwsAuthConfig) =>
-  Match.value(config)
-    .pipe(
-      Match.when(
-        { method: "env" },
-        Effect.fnUntraced(function* () {
-          const accessKeyId =
-            yield* getEnvRedactedRequired("AWS_ACCESS_KEY_ID");
-          const secretAccessKey = yield* getEnvRedactedRequired(
-            "AWS_SECRET_ACCESS_KEY",
-          );
-          const sessionToken = yield* getEnvRedacted("AWS_SESSION_TOKEN");
-          const region = yield* (
-            getEnv("AWS_REGION") ?? getEnv("AWS_DEFAULT_REGION") ?? undefined
-          );
-          return {
-            accessKeyId,
-            secretAccessKey,
-            sessionToken,
-            region,
-            source: { type: "env" as const },
-          };
-        }),
-      ),
-      Match.when({ method: "stored" }, () =>
-        readCredentials<AwsStoredCredentials>(profileName, "aws").pipe(
-          Effect.flatMap((creds) =>
-            creds == null
-              ? Effect.fail(
-                  new AuthError({
-                    message:
-                      "AWS stored credentials not found. Run: alchemy-effect login --configure",
-                  }),
-                )
-              : Effect.succeed({
-                  accessKeyId: Redacted.make(creds.accessKeyId),
-                  secretAccessKey: Redacted.make(creds.secretAccessKey),
-                  sessionToken: creds.sessionToken
-                    ? Redacted.make(creds.sessionToken)
-                    : undefined,
-                  region: creds.region,
-                  source: { type: "stored" as const },
-                }),
-          ),
-        ),
-      ),
-      Match.when({ method: "sso" }, (config) =>
-        Effect.gen(function* () {
-          const auth = yield* DistilledAuth.Default;
-          const creds = yield* auth
-            .loadProfileCredentials(config.ssoProfile)
-            .pipe(
-              Effect.mapError(
-                (e) =>
-                  new AuthError({
-                    message: "failed to load credentials",
-                    cause: e,
-                  }),
-              ),
-            );
-          const profile = yield* auth
-            .loadProfile(config.ssoProfile)
-            .pipe(Effect.catch(() => Effect.succeed(undefined)));
-          return {
-            accessKeyId: creds.accessKeyId,
-            secretAccessKey: creds.secretAccessKey,
-            sessionToken: creds.sessionToken,
-            region: profile?.region,
-            source: { type: "sso" as const, details: config.ssoProfile },
-          };
-        }),
-      ),
-      Match.exhaustive,
-    )
-    .pipe(
-      Effect.mapError(
-        (e) => new AuthError({ message: "login failed", cause: e }),
-      ),
-    );
-
-const prettyPrint = (profileName: string, config: AwsAuthConfig) =>
-  resolveCredentials(profileName, config).pipe(
-    Effect.tap((creds) =>
-      Effect.all([
-        Console.log(`  accessKeyId:     ${displayRedacted(creds.accessKeyId)}`),
-        Console.log(
-          `  secretAccessKey: ${displayRedacted(creds.secretAccessKey)}`,
-        ),
-        creds.sessionToken
-          ? Console.log(
-              `  sessionToken:    ${displayRedacted(creds.sessionToken)}`,
-            )
-          : Effect.void,
-        creds.region
-          ? Console.log(`  region:          ${creds.region}`)
-          : Effect.void,
-        Console.log(
-          //@ts-expect-error
-          `  source: ${creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type}`,
-        ),
-      ]),
-    ),
-    Effect.catch((e) =>
-      Console.error(`  Failed to retrieve credentials: ${e}`),
-    ),
-  );
-
-/**
- * `aws sso logout` only clears AWS CLI's own caches — it does not know about the
- * `<sha1(sso_session)>.credentials.json` file that `@distilled.cloud/aws`
- * writes alongside the SSO token. Without this cleanup, `loadProfileCredentials`
- * short-circuits on the stale distilled cache file after logout and appears to
- * stay logged in until the role creds hit their TTL.
- */
-const clearDistilledSsoCache = (ssoProfile: string) =>
-  Effect.gen(function* () {
-    const auth = yield* DistilledAuth.Default;
-    const profile = yield* auth.loadProfile(ssoProfile);
-    const ssoSession = (profile as { sso_session?: string }).sso_session;
-    if (!ssoSession) return;
-    const fs = yield* FileSystem.FileSystem;
-    const path = yield* Path.Path;
-    const hash = NodeCrypto.createHash("sha1").update(ssoSession).digest("hex");
-    const cacheFile = path.join(
-      NodeOs.homedir(),
-      ".aws",
-      "sso",
-      "cache",
-      `${hash}.credentials.json`,
-    );
-    yield* fs.remove(cacheFile).pipe(Effect.catch(() => Effect.void));
-  }).pipe(Effect.catch(() => Effect.void));
-
-const logout = (profileName: string, config: AwsAuthConfig) =>
-  Match.value(config).pipe(
-    Match.when({ method: "env" }, () => Effect.void),
-    Match.when({ method: "sso" }, (config) =>
-      Clank.info(
-        `AWS: running 'aws sso logout --profile ${config.ssoProfile}'...`,
-      ).pipe(
-        Effect.zip(runSsoCommand("logout", config.ssoProfile)),
-        Effect.zip(clearDistilledSsoCache(config.ssoProfile)),
-        Effect.match({
-          onSuccess: () => Clank.success("AWS: SSO logout complete"),
-          onFailure: (e) =>
-            Clank.warn(`AWS: SSO logout failed: \`${e.message}\``),
-        }),
-      ),
-    ),
-    Match.when({ method: "stored" }, () =>
-      deleteCredentials(profileName, "aws").pipe(
-        Effect.andThen(Clank.success("AWS: stored credentials removed")),
-      ),
-    ),
-    Match.exhaustive,
-  );
-
-const login = (profileName: string, config: AwsAuthConfig) =>
-  Match.value(config)
-    .pipe(
-      Match.when({ method: "env" }, () => Effect.void),
-      Match.when({ method: "sso" }, (config) =>
-        DistilledAuth.loadProfileCredentials(config.ssoProfile).pipe(
-          Effect.matchEffect({
-            onSuccess: () =>
-              Clank.info(
-                `AWS: SSO profile '${config.ssoProfile}' already has valid credentials`,
-              ),
-            onFailure: () => loginSSO(config),
-          }),
-        ),
-      ),
-      Match.when({ method: "stored" }, () =>
-        readCredentials<AwsStoredCredentials>(profileName, "aws").pipe(
-          Effect.flatMap((creds) =>
-            creds == null ? loginStored(profileName) : Effect.void,
-          ),
-        ),
-      ),
-      Match.exhaustive,
-    )
-    .pipe(
-      Effect.mapError(
-        (e) => new AuthError({ message: "login failed", cause: e }),
-      ),
-    );
-
-const configureCredentials = (profileName: string) =>
-  Clank.select({
-    message: "AWS authentication method",
-    options,
-  })
-    .pipe(
-      Effect.flatMap((method) =>
-        Match.value(method).pipe(
-          Match.when("env", () => Effect.succeed({ method: "env" as const })),
-          Match.when("sso", () =>
-            Effect.gen(function* () {
-              const ssoProfile = yield* Clank.text({
-                message: "AWS profile name (from ~/.aws/config)",
-                placeholder: "default",
-                defaultValue: "default",
-              });
-
-              const config = {
-                method: "sso" as const,
-                ssoProfile: ssoProfile ?? "default",
-              };
-
-              yield* loginSSO(config);
-
-              return config;
-            }),
-          ),
-          Match.when("stored", () => loginStored(profileName)),
-          Match.exhaustive,
-        ),
-      ),
-    )
-    .pipe(
-      Effect.mapError(
-        (e) =>
-          new AuthError({
-            message: "failed to configure credentials",
-            cause: e,
-          }),
-      ),
-    );
-
-const loginSSO = (config: Extract<AwsAuthConfig, { method: "sso" }>) =>
-  Clank.info(
-    `AWS SSO: running 'aws sso login --profile ${config.ssoProfile}'...`,
-  ).pipe(
-    Effect.andThen(runSsoCommand("login", config.ssoProfile)),
-    Effect.matchEffect({
-      onSuccess: () => Clank.success("AWS SSO: login complete"),
-      onFailure: (e) => Clank.warn(`AWS SSO: login faield: \`${e.message}\``),
-    }),
-  );
-
-const loginStored = Effect.fnUntraced(function* (profileName: string) {
-  const accessKeyId = yield* Clank.text({
-    message: "AWS Access Key ID",
-    validate: (v) => (v.length === 0 ? "Required" : undefined),
-  }).pipe(retryOnce);
-
-  const secretAccessKey = yield* Clank.password({
-    message: "AWS Secret Access Key",
-    validate: (v) => (v.length === 0 ? "Required" : undefined),
-  }).pipe(retryOnce);
-
-  const sessionToken = yield* Clank.text({
-    message: "AWS Session Token (optional — press Enter or Esc to skip)",
-    placeholder: "(none)",
-  }).pipe(Effect.catch(() => Effect.succeed("")));
-
-  const region = yield* Clank.text({
-    message: "AWS Region",
-    placeholder: "us-east-1",
-    defaultValue: "us-east-1",
-  }).pipe(retryOnce);
-
-  yield* writeCredentials<AwsStoredCredentials>(profileName, "aws", {
-    accessKeyId,
-    secretAccessKey,
-    sessionToken,
-    region,
-  });
-  yield* Clank.success("AWS credentials saved.");
-
-  return { method: "stored" as const };
-});

package/src/Auth/AuthProvider.ts

@@ -1,33 +0,0 @@
-import type * as Effect from "effect/Effect";
-import * as Schema from "effect/Schema";
-
-export class AuthError extends Schema.TaggedErrorClass<AuthError>()(
-  "AuthError",
-  {
-    message: Schema.String,
-    cause: Schema.optional(Schema.Defect),
-  },
-) {}
-
-export interface AuthProvider<Config extends { method: string }, Credentials> {
-  readonly name: string;
-
-  configure(profileName: string): Effect.Effect<Config, AuthError>;
-
-  login(
-    profileName: string,
-    config: Config,
-  ): Effect.Effect<void, AuthError, never>;
-
-  logout(
-    profileName: string,
-    config: Config,
-  ): Effect.Effect<void, AuthError, never>;
-
-  prettyPrint(profileName: string, config: Config): Effect.Effect<void>;
-
-  read(
-    profileName: string,
-    config: Config,
-  ): Effect.Effect<Credentials, AuthError, never>;
-}

package/src/Auth/Credentials.ts

@@ -1,56 +0,0 @@
-import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
-import * as Redacted from "effect/Redacted";
-import path from "pathe";
-import { rootDir } from "./Profile.ts";
-
-const credentialsDirPath = path.join(rootDir, "credentials");
-
-export const credentialsFilePath = (profile: string, provider: string) =>
-  path.join(credentialsDirPath, profile, `${provider}.json`);
-
-export const readCredentials = Effect.fnUntraced(function* <T>(
-  profile: string,
-  provider: string,
-) {
-  const fs = yield* FileSystem.FileSystem;
-  const data = yield* fs
-    .readFileString(credentialsFilePath(profile, provider))
-    .pipe(Effect.catch(() => Effect.succeed(undefined)));
-  if (data === undefined) return undefined as T | undefined;
-  try {
-    return JSON.parse(data) as T;
-  } catch {
-    return undefined as T | undefined;
-  }
-});
-
-export const writeCredentials = Effect.fnUntraced(function* <T>(
-  profile: string,
-  provider: string,
-  credentials: T,
-) {
-  const fs = yield* FileSystem.FileSystem;
-  const filePath = credentialsFilePath(profile, provider);
-  yield* fs.makeDirectory(path.dirname(filePath), { recursive: true });
-  yield* fs.writeFileString(filePath, JSON.stringify(credentials, null, 2));
-});
-
-export const deleteCredentials = Effect.fnUntraced(function* (
-  profile: string,
-  provider: string,
-) {
-  const fs = yield* FileSystem.FileSystem;
-  yield* fs
-    .remove(credentialsFilePath(profile, provider))
-    .pipe(Effect.catch(() => Effect.void));
-});
-
-export function displayRedacted(
-  r: Redacted.Redacted<string>,
-  visibleChars = 4,
-): string {
-  const raw = Redacted.value(r);
-  if (raw.length <= visibleChars) return "****";
-  return `${raw.slice(0, visibleChars)}****`;
-}

package/src/Auth/Env.ts

@@ -1,45 +0,0 @@
-import * as Config from "effect/Config";
-import * as Effect from "effect/Effect";
-import * as Clank from "../Util/Clank.ts";
-import { AuthError } from "./AuthProvider.ts";
-
-export const getEnv = (key: string) =>
-  Config.string(key)
-    .asEffect()
-    .pipe(Effect.orElseSucceed(() => undefined));
-
-export const getEnvRequired = (key: string) =>
-  Config.string(key)
-    .asEffect()
-    .pipe(
-      Effect.catch(() =>
-        Effect.fail(new AuthError({ message: `Missing required env: ${key}` })),
-      ),
-    );
-
-export const getEnvRedacted = (key: string) =>
-  Config.redacted(key)
-    .asEffect()
-    .pipe(Effect.orElseSucceed(() => undefined));
-
-export const getEnvRedactedRequired = (key: string) =>
-  Config.redacted(key)
-    .asEffect()
-    .pipe(
-      Effect.catch(() =>
-        Effect.fail(new AuthError({ message: `Missing required env: ${key}` })),
-      ),
-    );
-
-export const retryOnce = <A, R>(
-  self: Effect.Effect<A, Clank.PromptCancelled, R>,
-) =>
-  self.pipe(
-    Effect.retry({
-      times: 1,
-      while: (e) => e instanceof Clank.PromptCancelled,
-    }),
-    Effect.mapError(
-      (e) => new AuthError({ message: "User cancelled prompt", cause: e }),
-    ),
-  );

package/src/Auth/Profile.ts

@@ -1,72 +0,0 @@
-import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
-import type { PlatformError } from "effect/PlatformError";
-import os from "node:os";
-import path from "pathe";
-
-export const rootDir = path.join(os.homedir(), ".alchemy");
-export const configFilePath = path.join(rootDir, "profiles.json");
-
-export const CONFIG_VERSION = 2;
-
-export interface AlchemyProfiles {
-  version: typeof CONFIG_VERSION;
-  profiles: Record<string, AlchemyProfile>;
-}
-
-export type AlchemyProfile = Record<string, { method: string }>;
-
-const emptyConfig = (): AlchemyProfiles => ({
-  version: CONFIG_VERSION,
-  profiles: {},
-});
-
-export const readConfig: Effect.Effect<
-  AlchemyProfiles,
-  never,
-  FileSystem.FileSystem
-> = Effect.gen(function* () {
-  const fs = yield* FileSystem.FileSystem;
-  const data = yield* fs
-    .readFileString(configFilePath)
-    .pipe(Effect.orElseSucceed(() => undefined));
-  if (data === undefined) return emptyConfig();
-  try {
-    const parsed = JSON.parse(data);
-    if (parsed?.version !== CONFIG_VERSION) {
-      return emptyConfig();
-    }
-    return parsed as AlchemyProfiles;
-  } catch {
-    return emptyConfig();
-  }
-});
-
-export const writeConfig = (
-  config: AlchemyProfiles,
-): Effect.Effect<void, PlatformError, FileSystem.FileSystem> =>
-  Effect.gen(function* () {
-    const fs = yield* FileSystem.FileSystem;
-    yield* fs.makeDirectory(path.dirname(configFilePath), {
-      recursive: true,
-    });
-    yield* fs.writeFileString(configFilePath, JSON.stringify(config, null, 2));
-  });
-
-export const getProfile = (
-  name: string,
-): Effect.Effect<AlchemyProfile | undefined, never, FileSystem.FileSystem> =>
-  Effect.gen(function* () {
-    const config = yield* readConfig;
-    return config.profiles[name];
-  });
-
-export const setProfile = (
-  name: string,
-  profile: AlchemyProfile,
-): Effect.Effect<void, PlatformError, FileSystem.FileSystem> =>
-  Effect.gen(function* () {
-    const config = yield* readConfig;
-    config.profiles[name] = profile;
-    yield* writeConfig(config);
-  });

package/src/Auth/index.ts

@@ -1,2 +0,0 @@
-export * from "./AuthProvider.ts";
-export type { AlchemyProfile, AlchemyProfiles } from "./Profile.ts";