alchemy 2.0.0-beta.50 → 2.0.0-beta.52

package/bin/exec.js

@@ -24,7 +24,7 @@ import * as Data from "effect/Data";
 import * as Duration from "effect/Duration";
 import { flow, pipe } from "effect/Function";
 import { SingleShotGen } from "effect/Utils";
-import { pipeArguments } from "effect/Pipeable";
+import * as Effectable from "effect/Effectable";
 import "effect/Predicate";
 import "effect/Record";
 import * as Cause from "effect/Cause";
@@ -232,6 +232,108 @@ const RefMetadata = Symbol.for("alchemy/RefMetadata");
 const isRef = (s) => s && s[RefMetadata] !== void 0;
 const getRefMetadata = (ref) => ref[RefMetadata];
 
+//#endregion
+//#region lib/AdoptPolicy.js
+/**
+* AdoptPolicy controls whether the engine should "adopt" pre-existing cloud
+* resources that conflict with this stack instead of failing.
+*
+* The engine always calls a provider's `read` lifecycle operation when there
+* is no prior state and `read` is implemented. The provider's job is to
+* report two things:
+*
+*   1. Whether the resource exists (returns attributes vs. `undefined`).
+*   2. Whether *we* own it (plain attributes vs. {@link Unowned}-branded).
+*
+* The engine then routes:
+*
+*   | `read` outcome      | `adopt: false` | `adopt: true`     |
+*   | ------------------- | -------------- | ----------------- |
+*   | undefined           | create         | create            |
+*   | owned (plain attrs) | silent adopt   | silent adopt      |
+*   | {@link Unowned}     | fail           | takeover (adopt)  |
+*
+* "Owned" means a provider has affirmatively determined the resource was
+* created by this stack/stage/logical-id (typically by inspecting tags or
+* naming conventions). Resources without ownership semantics simply always
+* return plain attrs — they are treated as owned by default, so silent
+* adoption is the norm and `--adopt` is unnecessary.
+*
+* The policy can be overridden per-effect via {@link adopt} — most commonly
+* applied at the resource or stack scope.
+*/
+var AdoptPolicy = class extends EffectContext.Service()("AdoptPolicy") {};
+/**
+* Engine-raised failure produced when `read` reports an existing resource
+* marked as {@link Unowned} and `adopt` is `false`. Surface this to the user
+* to indicate they should either re-tag the cloud resource, pick a different
+* physical name, or re-run with `--adopt` (or `adopt(true)`) to force a
+* takeover.
+*/
+var OwnedBySomeoneElse = class extends Data.TaggedError("OwnedBySomeoneElse") {};
+/**
+* Private symbol used to brand attribute objects returned by `read` as
+* "exists in cloud, but not owned by this stack/stage/logical-id".
+*
+* Deliberately *not* registered via `Symbol.for` — the brand is an
+* engine-internal routing hint and must not be observable or
+* forgeable from outside this module. The engine strips it before any
+* state persistence (see {@link stripUnowned}) so it never leaks into
+* the state store, JSON serialization, or downstream `Output`s.
+*/
+const UnownedTag = Symbol("alchemy/Unowned");
+/**
+* Brand a `read` return value as belonging to a different owner.
+*
+* Use this in a provider's `read` implementation when the resource exists in
+* the cloud but a positive ownership check (e.g. tag inspection) shows it
+* was *not* created by this stack/stage/logical-id:
+*
+* ```ts
+* read: Effect.fnUntraced(function* ({ id, output, olds }) {
+*   const settings = yield* getScriptSettings({ ... }).pipe(
+*     Effect.catchTag("WorkerNotFound", () => Effect.succeed(undefined)),
+*   );
+*   if (!settings) return undefined;
+*
+*   const attrs = { workerName, ...buildAttrs(settings) };
+*   return hasAlchemyWorkerTags(id, settings.tags) ? attrs : Unowned(attrs);
+* }),
+* ```
+*
+* The returned value is structurally still `T` — there is no wrapper to
+* unwrap. The brand is a non-enumerable symbol that the engine inspects
+* during planning to decide whether to take over (`adopt: true`) or fail
+* loudly (`adopt: false`).
+*
+* Resources without ownership semantics should simply return plain attrs —
+* the engine treats them as owned and silent adoption is the default.
+*/
+const Unowned = Object.assign((attrs) => {
+	const cloned = { ...attrs };
+	Object.defineProperty(cloned, UnownedTag, {
+		value: true,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return cloned;
+}, { is: (value) => typeof value === "object" && value !== null && value[UnownedTag] === true });
+/**
+* Strip the {@link Unowned} brand from an attributes object before persisting
+* it — state should not carry per-deploy ownership-routing metadata.
+*
+* The brand is intentionally non-enumerable, so a plain spread already
+* drops it; the additional `delete` is defense-in-depth in case a future
+* change makes the descriptor enumerable. Always returns a fresh object
+* (never mutates the input).
+*/
+const stripUnowned = (attrs) => {
+	const out = { ...attrs };
+	if (UnownedTag in out) delete out[UnownedTag];
+	return out;
+};
+
 //#endregion
 //#region lib/FQN.js
 /**
@@ -366,6 +468,7 @@ const of = (resource) => {
 const asOutput = (t) => isOutput(t) ? t : Effect.isEffect(t) ? new EffectExpr(VoidExpr, () => t) : new LiteralExpr(t);
 const isOutput = (value) => value && (typeof value === "object" || typeof value === "function") && ExprSymbol in value;
 const ExprSymbol = Symbol.for("alchemy/Expr");
+const exprKind = (node) => node?.[ExprSymbol]?.kind ?? node?.kind;
 const isExpr = (value) => value && (typeof value === "object" || typeof value === "function") && ExprSymbol in value;
 var BaseExpr = class {
 	constructor() {}
@@ -389,7 +492,7 @@ var BaseExpr = class {
 		return this[inspect]();
 	}
 };
-const isResourceExpr = (node) => node?.kind === "ResourceExpr";
+const isResourceExpr = (node) => exprKind(node) === "ResourceExpr";
 var ResourceExpr = class extends BaseExpr {
 	src;
 	stables;
@@ -404,7 +507,7 @@ var ResourceExpr = class extends BaseExpr {
 		return this.src.LogicalId;
 	}
 };
-const isPropExpr = (node) => node?.kind === "PropExpr";
+const isPropExpr = (node) => exprKind(node) === "PropExpr";
 var PropExpr = class extends BaseExpr {
 	expr;
 	identifier;
@@ -419,7 +522,7 @@ var PropExpr = class extends BaseExpr {
 		return `${this.expr[inspect]()}.${this.identifier.toString()}`;
 	}
 };
-const isLiteralExpr = (node) => node?.kind === "LiteralExpr";
+const isLiteralExpr = (node) => exprKind(node) === "LiteralExpr";
 var LiteralExpr = class extends BaseExpr {
 	value;
 	kind = "LiteralExpr";
@@ -433,7 +536,7 @@ var LiteralExpr = class extends BaseExpr {
 	}
 };
 const VoidExpr = new LiteralExpr(void 0);
-const isApplyExpr = (node) => node?.kind === "ApplyExpr";
+const isApplyExpr = (node) => exprKind(node) === "ApplyExpr";
 var ApplyExpr = class extends BaseExpr {
 	expr;
 	f;
@@ -448,7 +551,7 @@ var ApplyExpr = class extends BaseExpr {
 		return `${this.expr[inspect]()}.map(${this.f.toString()})`;
 	}
 };
-const isFlatMapExpr = (node) => node?.kind === "FlatMapExpr";
+const isFlatMapExpr = (node) => exprKind(node) === "FlatMapExpr";
 var FlatMapExpr = class extends BaseExpr {
 	expr;
 	f;
@@ -463,7 +566,7 @@ var FlatMapExpr = class extends BaseExpr {
 		return `${this.expr[inspect]()}.flatMap(${this.f.toString()})`;
 	}
 };
-const isEffectExpr = (node) => node?.kind === "EffectExpr";
+const isEffectExpr = (node) => exprKind(node) === "EffectExpr";
 var EffectExpr = class extends BaseExpr {
 	expr;
 	f;
@@ -478,7 +581,7 @@ var EffectExpr = class extends BaseExpr {
 		return `${this.expr[inspect]()}.mapEffect(${this.f.toString()})`;
 	}
 };
-const isNamedExpr = (node) => node?.kind === "NamedExpr";
+const isNamedExpr = (node) => exprKind(node) === "NamedExpr";
 /**
 * Wraps another `Expr` and overrides its `toString()` / inspect output.
 *
@@ -500,7 +603,7 @@ var NamedExpr = class extends BaseExpr {
 		return this.bindingName;
 	}
 };
-const isAllExpr = (node) => node?.kind === "AllExpr";
+const isAllExpr = (node) => exprKind(node) === "AllExpr";
 var AllExpr = class extends BaseExpr {
 	outs;
 	kind = "AllExpr";
@@ -513,7 +616,7 @@ var AllExpr = class extends BaseExpr {
 		return `all(${this.outs.map((out) => out[inspect]()).join(", ")})`;
 	}
 };
-const isRefExpr = (node) => node?.kind === "RefExpr";
+const isRefExpr = (node) => exprKind(node) === "RefExpr";
 var RefExpr = class extends BaseExpr {
 	stack;
 	stage;
@@ -530,7 +633,7 @@ var RefExpr = class extends BaseExpr {
 		return `ref(${this.resourceId}, { stack: ${this.stack}, stage: ${this.stage} })`;
 	}
 };
-const isStackRefExpr = (node) => node?.kind === "StackRefExpr";
+const isStackRefExpr = (node) => exprKind(node) === "StackRefExpr";
 /**
 * A reference to the persisted output of a Stack at `(stack, stage)`.
 *
@@ -695,24 +798,12 @@ const loadConfigProvider = (envFile$1) => {
 
 //#endregion
 //#region lib/Util/effect.js
-const effectClass = ((impl) => impl === void 0 ? (innerImpl) => effectClass(innerImpl) : Object.assign(class {
-	static asEffect() {
-		return impl;
-	}
-	static [Symbol.iterator]() {
-		return new SingleShotGen(this.asEffect());
-	}
-	static pipe(...fns) {
-		return pipeArguments(this, fns);
-	}
-}, impl));
+const effectClass = ((impl) => impl === void 0 ? (innerImpl) => effectClass(innerImpl) : Object.assign(class {}, Effectable.Prototype({
+	label: "alchemy/EffectClass",
+	evaluate: () => impl
+})));
 const taggedFunction = (tag$1, fn) => {
-	const overrides = {
-		asEffect: () => tag$1,
-		[Symbol.iterator]: () => tag$1[Symbol.iterator](),
-		pipe: (...fns) => pipeArguments(tag$1, fns),
-		toString: () => `${tag$1.toString()}.${fn.name}`
-	};
+	const overrides = { toString: () => `${tag$1.toString()}.${fn.name}` };
 	return new Proxy(fn, {
 		get: (target, prop, receiver) => Reflect.has(overrides, prop) ? Reflect.get(overrides, prop, receiver) : Reflect.has(target, prop) ? Reflect.get(target, prop, receiver) : Reflect.get(tag$1, prop, tag$1),
 		has: (target, prop) => Reflect.has(overrides, prop) || Reflect.has(target, prop) || Reflect.has(tag$1, prop)
@@ -804,7 +895,7 @@ const platform = Layer.mergeAll(PlatformServices, FetchHttpClient.layer, Logger.
 const unwrapRpcHandlers = (handlers, streamKeys) => {
 	return Object.fromEntries(Object.entries(handlers).map(([key, value]) => [key, typeof value === "function" ? streamKeys?.includes(key) ? unwrapRpcStreamHandler(value) : unwrapRpcEffectHandler(value) : typeof value === "object" && value !== null ? unwrapRpcHandlers(value) : value]));
 };
-const serializeError = Schema.encodeSync(Schema.Defect);
+const serializeError = Schema.encodeSync(Schema.Defect());
 const unwrapRpcEffectHandler = (handler) => flow((...args) => serializeRpcArgs(args), (args) => Effect.promise(() => handler(args)), Effect.flatMap((exit) => {
 	if (exit._tag === "Success") return Exit.succeed(exit.value);
 	return Exit.failCause(Cause.fromReasons(exit.cause.map((reason) => {
@@ -865,108 +956,6 @@ const make$1 = Effect.fnUntraced(function* (spawnerUrl) {
 });
 const fromEnv = () => Layer.effect(RpcProviderProxy, Config.string(SPAWNER_URL_ENV_KEY).pipe(Effect.flatMap(make$1)));
 
-//#endregion
-//#region lib/AdoptPolicy.js
-/**
-* AdoptPolicy controls whether the engine should "adopt" pre-existing cloud
-* resources that conflict with this stack instead of failing.
-*
-* The engine always calls a provider's `read` lifecycle operation when there
-* is no prior state and `read` is implemented. The provider's job is to
-* report two things:
-*
-*   1. Whether the resource exists (returns attributes vs. `undefined`).
-*   2. Whether *we* own it (plain attributes vs. {@link Unowned}-branded).
-*
-* The engine then routes:
-*
-*   | `read` outcome      | `adopt: false` | `adopt: true`     |
-*   | ------------------- | -------------- | ----------------- |
-*   | undefined           | create         | create            |
-*   | owned (plain attrs) | silent adopt   | silent adopt      |
-*   | {@link Unowned}     | fail           | takeover (adopt)  |
-*
-* "Owned" means a provider has affirmatively determined the resource was
-* created by this stack/stage/logical-id (typically by inspecting tags or
-* naming conventions). Resources without ownership semantics simply always
-* return plain attrs — they are treated as owned by default, so silent
-* adoption is the norm and `--adopt` is unnecessary.
-*
-* The policy can be overridden per-effect via {@link adopt} — most commonly
-* applied at the resource or stack scope.
-*/
-var AdoptPolicy = class extends EffectContext.Service()("AdoptPolicy") {};
-/**
-* Engine-raised failure produced when `read` reports an existing resource
-* marked as {@link Unowned} and `adopt` is `false`. Surface this to the user
-* to indicate they should either re-tag the cloud resource, pick a different
-* physical name, or re-run with `--adopt` (or `adopt(true)`) to force a
-* takeover.
-*/
-var OwnedBySomeoneElse = class extends Data.TaggedError("OwnedBySomeoneElse") {};
-/**
-* Private symbol used to brand attribute objects returned by `read` as
-* "exists in cloud, but not owned by this stack/stage/logical-id".
-*
-* Deliberately *not* registered via `Symbol.for` — the brand is an
-* engine-internal routing hint and must not be observable or
-* forgeable from outside this module. The engine strips it before any
-* state persistence (see {@link stripUnowned}) so it never leaks into
-* the state store, JSON serialization, or downstream `Output`s.
-*/
-const UnownedTag = Symbol("alchemy/Unowned");
-/**
-* Brand a `read` return value as belonging to a different owner.
-*
-* Use this in a provider's `read` implementation when the resource exists in
-* the cloud but a positive ownership check (e.g. tag inspection) shows it
-* was *not* created by this stack/stage/logical-id:
-*
-* ```ts
-* read: Effect.fnUntraced(function* ({ id, output, olds }) {
-*   const settings = yield* getScriptSettings({ ... }).pipe(
-*     Effect.catchTag("WorkerNotFound", () => Effect.succeed(undefined)),
-*   );
-*   if (!settings) return undefined;
-*
-*   const attrs = { workerName, ...buildAttrs(settings) };
-*   return hasAlchemyWorkerTags(id, settings.tags) ? attrs : Unowned(attrs);
-* }),
-* ```
-*
-* The returned value is structurally still `T` — there is no wrapper to
-* unwrap. The brand is a non-enumerable symbol that the engine inspects
-* during planning to decide whether to take over (`adopt: true`) or fail
-* loudly (`adopt: false`).
-*
-* Resources without ownership semantics should simply return plain attrs —
-* the engine treats them as owned and silent adoption is the default.
-*/
-const Unowned = Object.assign((attrs) => {
-	const cloned = { ...attrs };
-	Object.defineProperty(cloned, UnownedTag, {
-		value: true,
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
-	return cloned;
-}, { is: (value) => typeof value === "object" && value !== null && value[UnownedTag] === true });
-/**
-* Strip the {@link Unowned} brand from an attributes object before persisting
-* it — state should not carry per-deploy ownership-routing metadata.
-*
-* The brand is intentionally non-enumerable, so a plain spread already
-* drops it; the additional `delete` is defense-in-depth in case a future
-* change makes the descriptor enumerable. Always returns a fresh object
-* (never mutates the input).
-*/
-const stripUnowned = (attrs) => {
-	const out = { ...attrs };
-	if (UnownedTag in out) delete out[UnownedTag];
-	return out;
-};
-
 //#endregion
 //#region lib/Diff.js
 const isResolved = (value) => !_hasUnresolved(value);
@@ -980,6 +969,10 @@ const _hasUnresolved = (value) => {
 const havePropsChanged = (oldProps, newProps) => hasOutputs(newProps) || JSON.stringify(canonicalize(oldProps ?? {}, false)) !== JSON.stringify(canonicalize(newProps ?? {}, false));
 const canonicalize = (value, stripNullish) => {
 	if (stripNullish && value == null) return void 0;
+	if (Redacted.isRedacted(value)) return {
+		_tag: "Redacted",
+		value: Redacted.value(value)
+	};
 	if (Array.isArray(value)) return value.map((v) => canonicalize(v, stripNullish));
 	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).filter(([, nested]) => !stripNullish || nested != null).sort(([a], [b]) => a.localeCompare(b)).map(([key, nested]) => [key, canonicalize(nested, stripNullish)]));
 	return value;
@@ -1372,7 +1365,9 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 				output: void 0
 			}).pipe(providePlanScope(fqn, adoptInstanceId));
 			if (readResult !== void 0) {
-				if (Unowned.is(readResult) && !(yield* shouldAdopt)) return yield* new OwnedBySomeoneElse({
+				const isUnowned = Unowned.is(readResult);
+				const adoptThis = resource.Adopt ?? (yield* shouldAdopt);
+				if (isUnowned && !adoptThis) return yield* new OwnedBySomeoneElse({
 					message: `Cannot adopt resource '${fqn}' (${resource.Type}): it exists in the cloud but is not owned by this stack/stage/logical-id. Re-run with \`--adopt\` (or wrap the effect in \`adopt(true)\`) to take it over.`,
 					resourceType: resource.Type,
 					logicalId: id
@@ -1667,6 +1662,7 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 					Binding: void 0,
 					Provider: Provider(resourceType),
 					RemovalPolicy: oldState.removalPolicy,
+					Adopt: void 0,
 					RuntimeContext: void 0,
 					Providers: void 0
 				},
@@ -2483,7 +2479,9 @@ const collectGarbage = Effect.fnUntraced(function* (plan, session) {
 						removalPolicy: node.resource.RemovalPolicy
 					});
 				}
-				if (attr !== void 0) yield* provider.delete({
+				const retainOldGeneration = !isDeleteNode(node) && node.removalPolicy === "retain";
+				if (retainOldGeneration) yield* scopedSession.note("Retaining replaced resource (removal policy: retain)...");
+				if (attr !== void 0 && !retainOldGeneration) yield* provider.delete({
 					id: logicalId,
 					instanceId,
 					olds: props,
@@ -2499,7 +2497,7 @@ const collectGarbage = Effect.fnUntraced(function* (plan, session) {
 					});
 					yield* report("deleted");
 				} else {
-					yield* scopedSession.note("Cleaning up replaced resource...");
+					if (!retainOldGeneration) yield* scopedSession.note("Cleaning up replaced resource...");
 					if (node.old.status === "replacing" || node.old.status === "replaced") yield* commit({
 						status: "replaced",
 						fqn,
@@ -2528,7 +2526,7 @@ const collectGarbage = Effect.fnUntraced(function* (plan, session) {
 						bindings: excludeDeletedBindings(node.bindings),
 						removalPolicy: node.removalPolicy
 					});
-					yield* scopedSession.note("Replaced resource cleanup complete.");
+					yield* scopedSession.note(retainOldGeneration ? "Replaced resource retained." : "Replaced resource cleanup complete.");
 				}
 			}));
 		});