alchemy 2.0.0-beta.41 → 2.0.0-beta.43

package/src/Cloudflare/Workers/Workflow.ts

@@ -1,7 +1,7 @@
 import * as workflows from "@distilled.cloud/cloudflare/workflows";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
-import * as Option from "effect/Option";
+import { ALCHEMY_PHASE } from "../../Phase.ts";
 import type { PlatformServices } from "../../Platform.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
@@ -99,12 +99,9 @@ export const sleepUntil = (
  * reflect that or `yield* WorkerEnvironment` fails to type-check inside a
  * body even though it succeeds at runtime.
  */
-export type WorkflowRunServices =
-  | WorkflowEvent
-  | WorkflowStep
-  | WorkerEnvironment;
+export type WorkflowRunServices = WorkflowEvent | WorkflowStep | WorkerServices;
 
-export type WorkflowServices = WorkerServices | PlatformServices;
+export type WorkflowServices = WorkflowRunServices | PlatformServices;
 
 /**
  * Metadata stored in the worker export map to distinguish workflow exports
@@ -122,7 +119,7 @@ export interface WorkflowExport {
  */
 export type WorkflowImpl<Input = unknown, Result = unknown> = (
   input: Input,
-) => Effect.Effect<Result, never, WorkflowRunServices>;
+) => Effect.Effect<Result, never, WorkflowServices>;
 
 export const isWorkflowExport = (value: unknown): value is WorkflowExport =>
   typeof value === "object" &&
@@ -391,10 +388,12 @@ export const Workflow: WorkflowClass = taggedFunction(WorkflowScope, ((
           const services =
             yield* Effect.context<Effect.Services<typeof impl>>();
 
-          const binding = yield* Effect.serviceOption(WorkerEnvironment).pipe(
-            Effect.map(Option.getOrUndefined),
-            Effect.flatMap((env) => {
-              if (env === undefined) {
+          const binding = yield* Effect.all([
+            WorkerEnvironment,
+            ALCHEMY_PHASE,
+          ]).pipe(
+            Effect.flatMap(([env, phase]) => {
+              if (env === undefined || phase === "plan") {
                 return Effect.succeed(undefined as any);
               }
               const wf = env[name];

package/src/Neon/Branch.ts

@@ -18,7 +18,7 @@ import { applyMigrations, runSql } from "./Migrations.ts";
 import { parsePostgresOrigin, type PostgresOrigin } from "./PostgresOrigin.ts";
 import { type Project, waitForOperations } from "./Project.ts";
 import type { Providers } from "./Providers.ts";
-import { listSqlFiles, readSqlFile } from "./SqlFile.ts";
+import { listSqlFiles, readSqlFile } from "../Sql/SqlFile.ts";
 
 const findBranchByName = (projectId: string, name: string) =>
   Effect.gen(function* () {

package/src/Neon/Migrations.ts

@@ -2,7 +2,7 @@ import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
 import { Client } from "pg";
-import type { SqlFile } from "./SqlFile.ts";
+import type { SqlFile } from "../Sql/SqlFile.ts";
 
 export class PgError extends Data.TaggedError("PgError")<{
   message: string;

package/src/Neon/Project.ts

@@ -24,7 +24,12 @@ import { Resource } from "../Resource.ts";
 import { applyMigrations, runSql } from "./Migrations.ts";
 import { parsePostgresOrigin, type PostgresOrigin } from "./PostgresOrigin.ts";
 import type { Providers } from "./Providers.ts";
-import { listSqlFiles, readSqlFile } from "./SqlFile.ts";
+import {
+  listSqlFiles,
+  readSqlFile,
+  hashMigrations,
+  hashImports,
+} from "../Sql/SqlFile.ts";
 
 type NeonOperationStatus =
   | "scheduling"
@@ -638,25 +643,6 @@ const runImports = (
     return hashes;
   });
 
-const hashMigrations = (migrationsDir: string) =>
-  listSqlFiles(migrationsDir).pipe(
-    Effect.map((files) => {
-      const hashes: Record<string, string> = {};
-      for (const file of files) hashes[file.id] = file.hash;
-      return hashes;
-    }),
-  );
-
-const hashImports = (importFiles: ReadonlyArray<string>, rootDir: string) =>
-  Effect.gen(function* () {
-    const hashes: Record<string, string> = {};
-    for (const filePath of importFiles) {
-      const file = yield* readSqlFile(rootDir, filePath);
-      hashes[filePath] = file.hash;
-    }
-    return hashes;
-  });
-
 const recordsEqual = (
   a: Record<string, string>,
   b: Record<string, string>,

package/src/Phase.ts

@@ -1,5 +1,7 @@
 import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
 
 export const ALCHEMY_PHASE = Config.string("ALCHEMY_PHASE").pipe(
   Config.withDefault("plan"),
+  Effect.orDie,
 );

package/src/Planetscale/AuthProvider.ts

@@ -0,0 +1,285 @@
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Match from "effect/Match";
+import * as Redacted from "effect/Redacted";
+import {
+  AuthError,
+  AuthProviderLayer,
+  type ConfigureContext,
+} from "../Auth/AuthProvider.ts";
+import { CredentialsStore, displayRedacted } from "../Auth/Credentials.ts";
+import {
+  getEnvRedactedRequired,
+  getEnvRequired,
+  retryOnce,
+} from "../Auth/Env.ts";
+import * as Clank from "../Util/Clank.ts";
+
+/**
+ * Canonical name registered in {@link AuthProviders}. Use this key to look
+ * up the PlanetScale {@link AuthProvider} from inside provider Layers.
+ */
+export const PLANETSCALE_AUTH_PROVIDER_NAME = "Planetscale";
+
+const options: Array<{
+  value: PlanetscaleAuthConfig["method"];
+  label: string;
+  hint?: string;
+}> = [
+  {
+    value: "env",
+    label: "Environment Variables",
+    hint: "PLANETSCALE_API_TOKEN_ID + PLANETSCALE_API_TOKEN + PLANETSCALE_ORGANIZATION",
+  },
+  {
+    value: "stored",
+    label: "Service Token",
+    hint: "enter service token interactively, stored in ~/.alchemy/credentials",
+  },
+  //todo(pear): add planetscale oauth
+];
+
+/**
+ * Auth configuration persisted in `~/.alchemy/profiles.json` for the
+ * PlanetScale provider.
+ *
+ * - `env`: read credentials from environment variables at resolution time.
+ * - `stored`: read credentials from `~/.alchemy/credentials/<profile>/planetscale-stored.json`.
+ *
+ * OAuth is intentionally not implemented because PlanetScale does not
+ * publish a redirect-based OAuth client; service tokens are the canonical
+ * credential.
+ */
+export type PlanetscaleAuthConfig = { method: "env" } | { method: "stored" };
+
+/**
+ * apiToken credentials persisted to disk for `method: "stored"`.
+ * Stored under the file key `"planetscale-stored"`.
+ */
+export interface PlanetscaleStoredCredentials {
+  type: "apiToken";
+  tokenId: string;
+  token: string;
+  organization: string;
+}
+
+/**
+ * Resolved in-memory PlanetScale credentials returned by
+ * {@link AuthProviderImpl.read}.
+ */
+export interface PlanetscaleResolvedCredentials {
+  type: "apiToken";
+  tokenId: Redacted.Redacted<string>;
+  token: Redacted.Redacted<string>;
+  organization: string;
+  source: {
+    type: PlanetscaleAuthConfig["method"];
+    details?: string;
+  };
+}
+
+/**
+ * Layer that registers the PlanetScale {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the
+ * PlanetScale `providers()` layer so `alchemy login` can discover it.
+ *
+ * Supported methods:
+ * - `env`: reads `PLANETSCALE_API_TOKEN_ID`/`PLANETSCALE_API_TOKEN`/`PLANETSCALE_ORGANIZATION`.
+ * - `stored`: prompts for a service token interactively and writes it to
+ *   `~/.alchemy/credentials/<profile>/planetscale-stored.json`.
+ */
+export const PlanetscaleAuth = AuthProviderLayer<
+  PlanetscaleAuthConfig,
+  PlanetscaleResolvedCredentials
+>()(
+  PLANETSCALE_AUTH_PROVIDER_NAME,
+  Effect.gen(function* () {
+    const store = yield* CredentialsStore;
+
+    const loginStored = Effect.fnUntraced(function* (profileName: string) {
+      const tokenId = yield* Clank.text({
+        message: "Planetscale Service Token ID",
+        validate: (v) => (v.length === 0 ? "Required" : undefined),
+      }).pipe(retryOnce);
+
+      const token = yield* Clank.password({
+        message: "Planetscale Service Token",
+        validate: (v) => (v.length === 0 ? "Required" : undefined),
+      }).pipe(retryOnce);
+
+      const organization = yield* Clank.text({
+        message: "Planetscale Organization (URL slug)",
+        validate: (v) => (v.length === 0 ? "Required" : undefined),
+      }).pipe(retryOnce);
+
+      yield* store.write<PlanetscaleStoredCredentials>(
+        profileName,
+        "planetscale-stored",
+        {
+          type: "apiToken",
+          tokenId,
+          token,
+          organization,
+        },
+      );
+      yield* Clank.success("Planetscale: credentials saved.");
+      return { method: "stored" as const };
+    });
+
+    const configureInteractive = (profileName: string) =>
+      Clank.select({
+        message: "Planetscale authentication method",
+        options,
+      }).pipe(
+        Effect.flatMap((method) =>
+          Match.value(method).pipe(
+            Match.when("env", () => Effect.succeed({ method: "env" as const })),
+            Match.when("stored", () => loginStored(profileName)),
+            Match.exhaustive,
+          ),
+        ),
+      );
+
+    const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
+      Effect.gen(function* () {
+        if (ctx.ci) {
+          return { method: "env" as const };
+        }
+        return yield* configureInteractive(profileName);
+      }).pipe(
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: "failed to configure credentials",
+              cause: e,
+            }),
+        ),
+      );
+
+    const resolveCredentials = (
+      profileName: string,
+      config: PlanetscaleAuthConfig,
+    ): Effect.Effect<PlanetscaleResolvedCredentials, AuthError> =>
+      Match.value(config).pipe(
+        Match.when(
+          { method: "env" },
+          Effect.fnUntraced(function* () {
+            const tokenId = yield* getEnvRedactedRequired(
+              "PLANETSCALE_API_TOKEN_ID",
+            );
+            const token = yield* getEnvRedactedRequired(
+              "PLANETSCALE_API_TOKEN",
+            );
+            const organization = yield* getEnvRequired(
+              "PLANETSCALE_ORGANIZATION",
+            );
+
+            return {
+              type: "apiToken" as const,
+              tokenId,
+              token,
+              organization,
+              source: {
+                type: "env" as const,
+                details: "PLANETSCALE_API_TOKEN_ID/PLANETSCALE_API_TOKEN",
+              },
+            } satisfies PlanetscaleResolvedCredentials;
+          }),
+        ),
+        Match.when({ method: "stored" }, () =>
+          store
+            .read<PlanetscaleStoredCredentials>(
+              profileName,
+              "planetscale-stored",
+            )
+            .pipe(
+              Effect.flatMap((creds) =>
+                creds == null
+                  ? Effect.fail(
+                      new AuthError({
+                        message:
+                          "Planetscale stored credentials not found. Run: alchemy login --configure",
+                      }),
+                    )
+                  : Effect.succeed({
+                      type: "apiToken" as const,
+                      tokenId: Redacted.make(creds.tokenId),
+                      token: Redacted.make(creds.token),
+                      organization: creds.organization,
+                      source: {
+                        type: "stored" as const,
+                        details: undefined,
+                      },
+                    } satisfies PlanetscaleResolvedCredentials),
+              ),
+            ),
+        ),
+        Match.exhaustive,
+      );
+
+    const logout = (profileName: string, config: PlanetscaleAuthConfig) =>
+      Match.value(config).pipe(
+        Match.when({ method: "env" }, () => Effect.void),
+        Match.when({ method: "stored" }, () =>
+          store
+            .delete(profileName, "planetscale-stored")
+            .pipe(
+              Effect.andThen(
+                Clank.success("Planetscale: stored credentials removed"),
+              ),
+            ),
+        ),
+        Match.exhaustive,
+      );
+
+    const login = (profileName: string, config: PlanetscaleAuthConfig) =>
+      Match.value(config)
+        .pipe(
+          Match.when({ method: "env" }, () => Effect.void),
+          Match.when({ method: "stored" }, () =>
+            store
+              .read<PlanetscaleStoredCredentials>(
+                profileName,
+                "planetscale-stored",
+              )
+              .pipe(
+                Effect.flatMap((creds) =>
+                  creds == null ? loginStored(profileName) : Effect.void,
+                ),
+              ),
+          ),
+          Match.exhaustive,
+        )
+        .pipe(
+          Effect.mapError(
+            (e) => new AuthError({ message: "login failed", cause: e }),
+          ),
+        );
+
+    const prettyPrint = (profileName: string, config: PlanetscaleAuthConfig) =>
+      resolveCredentials(profileName, config).pipe(
+        Effect.tap((creds) => {
+          const sourceStr = creds.source.details
+            ? `${creds.source.type} - ${creds.source.details}`
+            : creds.source.type;
+          return Effect.all([
+            Console.log(`  tokenId: ${displayRedacted(creds.token, 3)}`),
+            Console.log(`  token: ${displayRedacted(creds.token, 6)}`),
+            Console.log(`  organization: ${creds.organization}`),
+            Console.log(`  source: ${sourceStr}`),
+          ]);
+        }),
+        Effect.catch((e) =>
+          Console.error(`  Failed to retrieve credentials: ${e}`),
+        ),
+      );
+
+    return {
+      configure: configureCredentials,
+      logout,
+      login,
+      prettyPrint,
+      read: resolveCredentials,
+    };
+  }),
+);