alchemy 2.0.0-beta.51 → 2.0.0-beta.53

package/src/Drizzle/Schema.ts

@@ -1,7 +1,7 @@
-import * as crypto from "node:crypto";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
+import * as crypto from "node:crypto";
 import { isResolved } from "../Diff.ts";
 import * as Provider from "../Provider.ts";
 import { Resource } from "../Resource.ts";
@@ -45,7 +45,7 @@ export type Schema = Resource<
   "Drizzle.Schema",
   SchemaProps,
   {
-    /** Absolute path to the migrations directory. */
+    /** Path to the migrations directory, relative to the current working directory. */
     out: string;
     /**
      * sha256 of the latest snapshot.json. Stable across deploys when the
@@ -117,6 +117,12 @@ export const SchemaProvider = () =>
       const resolveOut = (p: SchemaProps) =>
         path.resolve(process.cwd(), p.out ?? "./migrations");
 
+      // The `out` attribute is exposed as a path relative to the current
+      // working directory so that persisted state stays portable across
+      // machines/checkouts. Internal filesystem ops always use the absolute
+      // `resolveOut` form.
+      const relativeOut = (abs: string) => path.relative(process.cwd(), abs);
+
       const resolveSchema = (p: SchemaProps) =>
         path.resolve(process.cwd(), p.schema);
 
@@ -241,7 +247,7 @@ export const SchemaProvider = () =>
           const migrations = yield* listMigrationDirs(out);
           const latest = yield* readLatestSnapshot(out);
           return {
-            out,
+            out: relativeOut(out),
             snapshotHash: latest?.hash ?? sha(JSON.stringify(cur)),
             migrations,
           };
@@ -256,8 +262,12 @@ export const SchemaProvider = () =>
           // `schema.out` as an unresolved Output during plan and cascade
           // into spurious updates of their own.
           const { sqlStatements } = yield* detectDrift(news);
-          if (sqlStatements.length === 0) return undefined;
-          return { action: "update" } as const;
+          // Originally `output.out` was an absolute path, which is not portable.
+          // So, we trigger an update to migrate existing resources.
+          // This is safe because `regenerate` is idempotent.
+          return sqlStatements.length > 0 || path.isAbsolute(output.out)
+            ? { action: "update" }
+            : undefined;
         }),
         read: Effect.fn(function* ({ olds, output }) {
           if (!output) return undefined;
@@ -267,7 +277,7 @@ export const SchemaProvider = () =>
           const latest = yield* readLatestSnapshot(out);
           const migrations = yield* listMigrationDirs(out);
           return {
-            out,
+            out: relativeOut(out),
             snapshotHash: latest?.hash ?? output.snapshotHash,
             migrations,
           };

package/src/GitHub/Comment.ts

@@ -1,8 +1,8 @@
-import { Octokit } from "@octokit/rest";
 import * as Effect from "effect/Effect";
 import * as Provider from "../Provider.ts";
 import { Resource } from "../Resource.ts";
 import { dedent } from "../Util/dedent.ts";
+import { Octokit } from "./Octokit.ts";
 import * as GitHub from "./Providers.ts";
 
 export interface CommentProps {
@@ -37,12 +37,6 @@ export interface CommentProps {
    * @default false
    */
   allowDelete?: boolean;
-
-  /**
-   * GitHub API token. If not provided, falls back to
-   * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` environment variables.
-   */
-  token?: string;
 }
 
 export interface Comment extends Resource<
@@ -149,22 +143,11 @@ export interface Comment extends Resource<
  */
 export const Comment = Resource<Comment>("GitHub.Comment");
 
-function resolveToken(props: CommentProps): string | undefined {
-  return (
-    props.token ?? process.env.GITHUB_ACCESS_TOKEN ?? process.env.GITHUB_TOKEN
-  );
-}
-
-function createClient(props: CommentProps): Octokit {
-  return new Octokit({ auth: resolveToken(props) });
-}
-
 export const CommentProvider = () =>
   Provider.succeed(Comment, {
     stables: ["commentId"],
-
     reconcile: Effect.fn(function* ({ news, output }) {
-      const octokit = createClient(news);
+      const octokit = yield* Octokit;
       const body = dedent(news.body);
 
       // Observe — GitHub assigns `comment_id` server-side. Probe for live
@@ -230,7 +213,7 @@ export const CommentProvider = () =>
         return;
       }
 
-      const octokit = createClient(olds);
+      const octokit = yield* Octokit;
 
       yield* Effect.tryPromise(async () => {
         try {

package/src/GitHub/Credentials.ts

@@ -5,7 +5,7 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
 import { AuthError, getAuthProvider } from "../Auth/AuthProvider.ts";
-import { ALCHEMY_PROFILE, Profile } from "../Auth/Profile.ts";
+import { ALCHEMY_PROFILE, AlchemyProfile } from "../Auth/Profile.ts";
 import {
   GITHUB_AUTH_PROVIDER_NAME,
   type GitHubAuthConfig,
@@ -19,7 +19,7 @@ export interface GitHubCredentialsService {
 
 export class GitHubCredentials extends Context.Service<
   GitHubCredentials,
-  GitHubCredentialsService
+  Effect.Effect<GitHubCredentialsService>
 >()("GitHub::Credentials") {}
 
 const make = (token: Redacted.Redacted<string>): GitHubCredentialsService => ({
@@ -34,7 +34,9 @@ const make = (token: Redacted.Redacted<string>): GitHubCredentialsService => ({
 export const fromToken = (token: string | Redacted.Redacted<string>) =>
   Layer.succeed(
     GitHubCredentials,
-    make(typeof token === "string" ? Redacted.make(token) : token),
+    Effect.succeed(
+      make(typeof token === "string" ? Redacted.make(token) : token),
+    ),
   );
 
 /**
@@ -42,7 +44,7 @@ export const fromToken = (token: string | Redacted.Redacted<string>) =>
  * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` at layer build time.
  */
 export const fromEnv = () =>
-  Layer.effect(
+  Layer.succeed(
     GitHubCredentials,
     Effect.gen(function* () {
       const access = yield* Config.redacted("GITHUB_ACCESS_TOKEN").pipe(
@@ -74,7 +76,7 @@ export const fromAuthProvider = () =>
   Layer.effect(
     GitHubCredentials,
     Effect.gen(function* () {
-      const profile = yield* Profile;
+      const profile = yield* AlchemyProfile;
       const auth = yield* getAuthProvider<
         GitHubAuthConfig,
         GitHubResolvedCredentials
@@ -93,6 +95,8 @@ export const fromAuthProvider = () =>
               message: `Failed to resolve GitHub credentials for profile '${profileName}': ${(e as { message?: string }).message ?? String(e)}`,
             }),
         ),
+        Effect.orDie,
+        Effect.cached,
       );
     }).pipe(Effect.orDie),
   );

package/src/GitHub/Octokit.ts

@@ -0,0 +1,9 @@
+import type { Octokit as _Octokit } from "@octokit/rest";
+import * as Effect from "effect/Effect";
+import { GitHubCredentials } from "./Credentials.ts";
+
+export const Octokit: Effect.Effect<_Octokit, never, GitHubCredentials> =
+  Effect.gen(function* () {
+    const creds = yield* yield* GitHubCredentials;
+    return creds.octokit();
+  });

package/src/GitHub/Secret.ts

@@ -1,9 +1,8 @@
-import type { Octokit } from "@octokit/rest";
 import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
 import * as Provider from "../Provider.ts";
 import { Resource } from "../Resource.ts";
-import { GitHubCredentials } from "./Credentials.ts";
+import { Octokit } from "./Octokit.ts";
 import type * as GitHub from "./Providers.ts";
 
 export interface SecretProps {
@@ -129,11 +128,6 @@ export interface Secret extends Resource<
  */
 export const Secret = Resource<Secret>("GitHub.Secret");
 
-const getOctokit = Effect.gen(function* () {
-  const creds = yield* GitHubCredentials;
-  return creds.octokit();
-});
-
 async function encryptValue(
   plaintext: string,
   publicKey: string,
@@ -153,8 +147,6 @@ async function encryptValue(
 export const SecretProvider = () =>
   Provider.succeed(Secret, {
     reconcile: Effect.fn(function* ({ news, olds }) {
-      const octokit = yield* getOctokit;
-
       // Observe — there's no API to read a secret's value back, so we can
       // only observe its location (repo vs. environment, environment name).
       // If the location changed, the previous secret is orphaned: delete
@@ -164,7 +156,7 @@ export const SecretProvider = () =>
         const wasEnv = !!olds.environment;
         const isEnv = !!news.environment;
         if (wasEnv !== isEnv || olds.environment !== news.environment) {
-          yield* deleteSecret(octokit, olds);
+          yield* deleteSecret(olds);
         }
       }
 
@@ -173,20 +165,17 @@ export const SecretProvider = () =>
       // value is encrypted client-side with the repo/environment public
       // key, so we re-encrypt and re-upload on every reconcile (Redacted
       // values can't be diffed across runs anyway).
-      yield* upsertSecret(octokit, news);
+      yield* upsertSecret(news);
       return { updatedAt: new Date().toISOString() };
     }),
 
     delete: Effect.fn(function* ({ olds }) {
-      const octokit = yield* getOctokit;
-      yield* deleteSecret(octokit, olds);
+      yield* deleteSecret(olds);
     }),
   });
 
-const upsertSecret = Effect.fn(function* (
-  octokit: Octokit,
-  props: SecretProps,
-) {
+const upsertSecret = Effect.fn(function* (props: SecretProps) {
+  const octokit = yield* Octokit;
   const plaintext = Redacted.value(props.value);
   const isEnv = !!props.environment;
 
@@ -232,10 +221,8 @@ const upsertSecret = Effect.fn(function* (
   });
 });
 
-const deleteSecret = Effect.fn(function* (
-  octokit: Octokit,
-  props: SecretProps,
-) {
+const deleteSecret = Effect.fn(function* (props: SecretProps) {
+  const octokit = yield* Octokit;
   yield* Effect.tryPromise(async () => {
     try {
       if (props.environment) {

package/src/GitHub/Variable.ts

@@ -1,7 +1,7 @@
 import * as Effect from "effect/Effect";
 import * as Provider from "../Provider.ts";
 import { Resource } from "../Resource.ts";
-import { GitHubCredentials } from "./Credentials.ts";
+import { Octokit } from "./Octokit.ts";
 import type * as GitHub from "./Providers.ts";
 
 export interface VariableProps {
@@ -102,15 +102,10 @@ export interface Variable extends Resource<
  */
 export const Variable = Resource<Variable>("GitHub.Variable");
 
-const getOctokit = Effect.gen(function* () {
-  const creds = yield* GitHubCredentials;
-  return creds.octokit();
-});
-
 export const VariableProvider = () =>
   Provider.succeed(Variable, {
     reconcile: Effect.fn(function* ({ news }) {
-      const octokit = yield* getOctokit;
+      const octokit = yield* Octokit;
 
       // Observe — `name` is the path identifier for repo variables; ask
       // GitHub directly for the live row. A 404 means it doesn't exist
@@ -162,7 +157,7 @@ export const VariableProvider = () =>
     }),
 
     delete: Effect.fn(function* ({ olds }) {
-      const octokit = yield* getOctokit;
+      const octokit = yield* Octokit;
 
       yield* Effect.tryPromise(async () => {
         try {

package/src/Kubernetes/client.ts

@@ -1,10 +1,10 @@
 import { Credentials } from "@distilled.cloud/aws/Credentials";
-import { Region } from "@distilled.cloud/aws/Region";
 import { AwsClient } from "aws4fetch";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
 import * as https from "node:https";
+import { AWSEnvironment } from "../AWS/Environment.ts";
 import {
   buildKubernetesObjectPath,
   chunkByApplyRank,
@@ -32,7 +32,7 @@ const fieldManager = "alchemy";
 
 const createBearerToken = Effect.fn(function* (clusterName: string) {
   const credentials = yield* yield* Credentials;
-  const region = yield* Region;
+  const { region } = yield* AWSEnvironment.current;
 
   const client = new AwsClient({
     accessKeyId: Redacted.value(credentials.accessKeyId),

package/src/Local/RpcSerialization.ts

@@ -89,7 +89,7 @@ export const unwrapRpcHandlers = <T extends Record<string, any>>(
   ) as RpcUnwrapped<T>;
 };
 
-const serializeError = Schema.encodeSync(Schema.Defect);
+const serializeError = Schema.encodeSync(Schema.Defect());
 
 const wrapRpcEffectHandler = <Args extends Array<any>, Success, Error>(
   handler: RpcEffectHandler<Args, Success, Error>,
@@ -107,7 +107,10 @@ const wrapRpcEffectHandler = <Args extends Array<any>, Success, Error>(
         cause: exit.cause.reasons.map((reason): RpcSerializedCause<Error> => {
           switch (reason._tag) {
             case "Fail":
-              return { _tag: "Fail", error: serializeError(reason.error) };
+              return {
+                _tag: "Fail",
+                error: serializeError(reason.error) as Error,
+              };
             case "Die":
               return { _tag: "Die", defect: serializeError(reason.defect) };
             case "Interrupt":

package/src/Neon/AuthProvider.ts

@@ -9,7 +9,7 @@ import {
 } from "../Auth/AuthProvider.ts";
 import { CredentialsStore, displayRedacted } from "../Auth/Credentials.ts";
 import { getEnvRedacted, retryOnce } from "../Auth/Env.ts";
-import { Profile } from "../Auth/Profile.ts";
+import { AlchemyProfile } from "../Auth/Profile.ts";
 import * as Clank from "../Util/Clank.ts";
 
 export const NEON_AUTH_PROVIDER_NAME = "Neon";
@@ -54,7 +54,7 @@ export const NeonAuth = AuthProviderLayer<
 >()(
   NEON_AUTH_PROVIDER_NAME,
   Effect.gen(function* () {
-    const profiles = yield* Profile;
+    const profiles = yield* AlchemyProfile;
     const store = yield* CredentialsStore;
 
     const loginStored = Effect.fnUntraced(function* (profileName: string) {