alchemy 2.0.0-beta.52 → 2.0.0-beta.53

package/src/AWS/AuthProvider.ts

@@ -1,7 +1,10 @@
 import * as DistilledAuth from "@distilled.cloud/aws/Auth";
+import { Credentials } from "@distilled.cloud/aws/Credentials";
+import * as STS from "@distilled.cloud/aws/sts";
 import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
 import * as Match from "effect/Match";
 import * as Path from "effect/Path";
 import * as Redacted from "effect/Redacted";
@@ -18,6 +21,7 @@ import {
   getEnv,
   getEnvRedacted,
   getEnvRedactedRequired,
+  getEnvRequired,
   retryOnce,
 } from "../Auth/Env.ts";
 import * as Clank from "../Util/Clank.ts";
@@ -52,82 +56,27 @@ const options: Array<{
 ];
 
 export interface AwsStoredCredentials {
+  accountId: string;
   accessKeyId: string;
   secretAccessKey: string;
   sessionToken?: string;
-  region?: string;
+  region: string;
 }
 
 export interface AwsResolvedCredentials {
-  accessKeyId: Redacted.Redacted<string>;
-  secretAccessKey: Redacted.Redacted<string>;
-  sessionToken?: Redacted.Redacted<string>;
-  region?: string;
+  accountId: string;
+  credentials: Effect.Effect<{
+    accessKeyId: Redacted.Redacted<string>;
+    secretAccessKey: Redacted.Redacted<string>;
+    sessionToken: Redacted.Redacted<string> | undefined;
+  }>;
+  region: string;
   source: {
     type: AwsAuthConfig["method"];
     details?: string;
   };
 }
 
-const runSsoCommand = (command: "login" | "logout", ssoProfile: string) =>
-  Effect.gen(function* () {
-    const handle = yield* ChildProcess.make(
-      "aws",
-      ["sso", command, "--profile", ssoProfile],
-      {
-        shell: false,
-        stdin: "inherit",
-        stdout: "inherit",
-        stderr: "inherit",
-      },
-    );
-    const exit = yield* handle.exitCode;
-    if (exit !== 0) {
-      yield* Effect.fail(
-        new AuthError({
-          message: `aws sso ${command} exited with code ${exit}`,
-        }),
-      );
-    }
-  }).pipe(Effect.scoped);
-
-const loginSSO = (config: Extract<AwsAuthConfig, { method: "sso" }>) =>
-  Clank.info(
-    `AWS SSO: running 'aws sso login --profile ${config.ssoProfile}'...`,
-  ).pipe(
-    Effect.andThen(runSsoCommand("login", config.ssoProfile)),
-    Effect.matchEffect({
-      onSuccess: () => Clank.success("AWS SSO: login complete"),
-      onFailure: (e) => Clank.warn(`AWS SSO: login faield: \`${e.message}\``),
-    }),
-  );
-
-/**
- * `aws sso logout` only clears AWS CLI's own caches — it does not know about the
- * `<sha1(sso_session)>.credentials.json` file that `@distilled.cloud/aws`
- * writes alongside the SSO token. Without this cleanup, `loadProfileCredentials`
- * short-circuits on the stale distilled cache file after logout and appears to
- * stay logged in until the role creds hit their TTL.
- */
-const clearDistilledSsoCache = (ssoProfile: string) =>
-  Effect.gen(function* () {
-    const auth = yield* DistilledAuth.Default;
-    const profile = yield* auth.loadProfile(ssoProfile);
-    const ssoSession = (profile as { sso_session?: string }).sso_session;
-    if (!ssoSession) return;
-    const fs = yield* FileSystem.FileSystem;
-    const path = yield* Path.Path;
-    const hash = NodeCrypto.createHash("sha1").update(ssoSession).digest("hex");
-    const cacheFile = path.join(
-      NodeOs.homedir(),
-      ".aws",
-      "sso",
-      "cache",
-      `${hash}.credentials.json`,
-    );
-    yield* fs.remove(cacheFile).pipe(Effect.catch(() => Effect.void));
-  }).pipe(Effect.catch(() => Effect.void));
-
 /**
  * Layer that registers the AWS {@link AuthProvider} into the
  * {@link AuthProviders} registry when built. Include this in the AWS
@@ -141,6 +90,33 @@ export const AwsAuth = AuthProviderLayer<
   Effect.gen(function* () {
     const store = yield* CredentialsStore;
 
+    const getAccountId = ({
+      accessKeyId,
+      secretAccessKey,
+      sessionToken,
+    }: {
+      accessKeyId: Redacted.Redacted<string>;
+      secretAccessKey: Redacted.Redacted<string>;
+      sessionToken?: Redacted.Redacted<string>;
+    }) =>
+      STS.getCallerIdentity({}).pipe(
+        Effect.provide(
+          Layer.succeed(
+            Credentials,
+            Effect.succeed({
+              accessKeyId,
+              secretAccessKey,
+              sessionToken,
+            }),
+          ),
+        ),
+        Effect.flatMap((self) =>
+          self.Account
+            ? Effect.succeed(self.Account)
+            : Effect.die(new Error("No account ID found")),
+        ),
+      );
+
     const loginStored = Effect.fnUntraced(function* (profileName: string) {
       const accessKeyId = yield* Clank.text({
         message: "AWS Access Key ID",
@@ -163,7 +139,14 @@ export const AwsAuth = AuthProviderLayer<
         defaultValue: "us-east-1",
       }).pipe(retryOnce);
 
+      const accountId = yield* getAccountId({
+        accessKeyId: Redacted.make(accessKeyId),
+        secretAccessKey: Redacted.make(secretAccessKey),
+        sessionToken: sessionToken ? Redacted.make(sessionToken) : undefined,
+      });
+
       yield* store.write<AwsStoredCredentials>(profileName, "aws", {
+        accountId,
         accessKeyId,
         secretAccessKey,
         sessionToken,
@@ -234,18 +217,36 @@ export const AwsAuth = AuthProviderLayer<
                 "AWS_SECRET_ACCESS_KEY",
               );
               const sessionToken = yield* getEnvRedacted("AWS_SESSION_TOKEN");
-              const region = yield* (
-                getEnv("AWS_REGION") ??
-                  getEnv("AWS_DEFAULT_REGION") ??
-                  undefined
+              const region = yield* getEnv("AWS_REGION").pipe(
+                Effect.flatMap((region) =>
+                  region
+                    ? Effect.succeed(region)
+                    : getEnv("AWS_DEFAULT_REGION"),
+                ),
+              );
+              if (!region) {
+                return yield* Effect.fail(
+                  new AuthError({
+                    message:
+                      "AWS region not found. Set AWS_REGION or AWS_DEFAULT_REGION.",
+                  }),
+                );
+              }
+              const accountId = yield* getEnvRequired("AWS_ACCOUNT_ID").pipe(
+                Effect.catch(() =>
+                  getAccountId({ accessKeyId, secretAccessKey, sessionToken }),
+                ),
               );
               return {
-                accessKeyId,
-                secretAccessKey,
-                sessionToken,
+                accountId,
+                credentials: Effect.succeed({
+                  accessKeyId,
+                  secretAccessKey,
+                  sessionToken,
+                }),
                 region,
                 source: { type: "env" as const },
-              };
+              } satisfies AwsResolvedCredentials;
             }),
           ),
           Match.when({ method: "stored" }, () =>
@@ -259,41 +260,86 @@ export const AwsAuth = AuthProviderLayer<
                       }),
                     )
                   : Effect.succeed({
-                      accessKeyId: Redacted.make(creds.accessKeyId),
-                      secretAccessKey: Redacted.make(creds.secretAccessKey),
-                      sessionToken: creds.sessionToken
-                        ? Redacted.make(creds.sessionToken)
-                        : undefined,
+                      accountId: creds.accountId,
+                      credentials: Effect.succeed({
+                        accessKeyId: Redacted.make(creds.accessKeyId),
+                        secretAccessKey: Redacted.make(creds.secretAccessKey),
+                        sessionToken: creds.sessionToken
+                          ? Redacted.make(creds.sessionToken)
+                          : undefined,
+                      }),
                       region: creds.region,
                       source: { type: "stored" as const },
-                    }),
+                    } satisfies AwsResolvedCredentials),
+              ),
+              // an older verson of the stored credentials didn't include the account ID, so we patch it hre
+              Effect.flatMap((creds) =>
+                creds.accountId
+                  ? Effect.succeed(creds)
+                  : creds.credentials.pipe(
+                      Effect.flatMap((creds) =>
+                        getAccountId({
+                          accessKeyId: creds.accessKeyId,
+                          secretAccessKey: creds.secretAccessKey,
+                          sessionToken: creds.sessionToken,
+                        }),
+                      ),
+                      Effect.map(
+                        (accountId) =>
+                          ({
+                            ...creds,
+                            accountId,
+                          }) satisfies AwsResolvedCredentials,
+                      ),
+                      // re-write the stored credentials
+                      Effect.tap((creds) =>
+                        creds.credentials.pipe(
+                          Effect.tap(
+                            ({ accessKeyId, secretAccessKey, sessionToken }) =>
+                              store.write<AwsStoredCredentials>(
+                                profileName,
+                                "aws",
+                                {
+                                  accessKeyId: Redacted.value(accessKeyId),
+                                  secretAccessKey:
+                                    Redacted.value(secretAccessKey),
+                                  sessionToken: sessionToken
+                                    ? Redacted.value(sessionToken)
+                                    : undefined,
+                                  region: creds.region,
+                                  accountId: creds.accountId,
+                                },
+                              ),
+                          ),
+                        ),
+                      ),
+                    ),
               ),
             ),
           ),
           Match.when({ method: "sso" }, (config) =>
             Effect.gen(function* () {
               const auth = yield* DistilledAuth.Default;
-              const creds = yield* auth
-                .loadProfileCredentials(config.ssoProfile)
-                .pipe(
-                  Effect.mapError(
-                    (e) =>
-                      new AuthError({
-                        message: "failed to load credentials",
-                        cause: e,
-                      }),
-                  ),
-                );
               const profile = yield* auth
                 .loadProfile(config.ssoProfile)
                 .pipe(Effect.catch(() => Effect.succeed(undefined)));
               return {
-                accessKeyId: creds.accessKeyId,
-                secretAccessKey: creds.secretAccessKey,
-                sessionToken: creds.sessionToken,
-                region: profile?.region,
+                accountId: profile?.sso_account_id!,
+                credentials: auth
+                  .loadProfileCredentials(config.ssoProfile)
+                  .pipe(
+                    Effect.mapError(
+                      (e) =>
+                        new AuthError({
+                          message: "failed to load credentials",
+                          cause: e,
+                        }),
+                    ),
+                    Effect.orDie,
+                  ),
+                region: profile?.region!,
                 source: { type: "sso" as const, details: config.ssoProfile },
-              };
+              } satisfies AwsResolvedCredentials;
             }),
           ),
           Match.exhaustive,
@@ -306,27 +352,29 @@ export const AwsAuth = AuthProviderLayer<
 
     const prettyPrint = (profileName: string, config: AwsAuthConfig) =>
       resolveCredentials(profileName, config).pipe(
-        Effect.tap((creds) =>
-          Effect.all([
-            Console.log(
-              `  accessKeyId:     ${displayRedacted(creds.accessKeyId)}`,
-            ),
-            Console.log(
-              `  secretAccessKey: ${displayRedacted(creds.secretAccessKey)}`,
-            ),
-            creds.sessionToken
-              ? Console.log(
-                  `  sessionToken:    ${displayRedacted(creds.sessionToken)}`,
-                )
-              : Effect.void,
-            creds.region
-              ? Console.log(`  region:          ${creds.region}`)
-              : Effect.void,
-            Console.log(
+        Effect.tap(
+          Effect.fnUntraced(function* (creds) {
+            const { accessKeyId, secretAccessKey, sessionToken } =
+              yield* creds.credentials;
+            yield* Console.log(
+              `  accessKeyId:     ${displayRedacted(accessKeyId)}`,
+            );
+            yield* Console.log(
+              `  secretAccessKey: ${displayRedacted(secretAccessKey)}`,
+            );
+            if (sessionToken) {
+              yield* Console.log(
+                `  sessionToken:    ${displayRedacted(sessionToken)}`,
+              );
+            }
+            if (creds.region) {
+              yield* Console.log(`  region:          ${creds.region}`);
+            }
+            yield* Console.log(
               //@ts-expect-error
               `  source: ${creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type}`,
-            ),
-          ]),
+            );
+          }),
         ),
         Effect.catch((e) =>
           Console.error(`  Failed to retrieve credentials: ${e}`),
@@ -363,17 +411,7 @@ export const AwsAuth = AuthProviderLayer<
       Match.value(config)
         .pipe(
           Match.when({ method: "env" }, () => Effect.void),
-          Match.when({ method: "sso" }, (config) =>
-            DistilledAuth.loadProfileCredentials(config.ssoProfile).pipe(
-              Effect.matchEffect({
-                onSuccess: () =>
-                  Clank.info(
-                    `AWS: SSO profile '${config.ssoProfile}' already has valid credentials`,
-                  ),
-                onFailure: () => loginSSO(config),
-              }),
-            ),
-          ),
+          Match.when({ method: "sso" }, loginSSO),
           Match.when({ method: "stored" }, () =>
             store
               .read<AwsStoredCredentials>(profileName, "aws")
@@ -400,3 +438,62 @@ export const AwsAuth = AuthProviderLayer<
     };
   }),
 );
+
+const runSsoCommand = (command: "login" | "logout", ssoProfile: string) =>
+  Effect.gen(function* () {
+    const handle = yield* ChildProcess.make(
+      "aws",
+      ["sso", command, "--profile", ssoProfile],
+      {
+        shell: false,
+        stdin: "inherit",
+        stdout: "inherit",
+        stderr: "inherit",
+      },
+    );
+    const exit = yield* handle.exitCode;
+    if (exit !== 0) {
+      yield* Effect.fail(
+        new AuthError({
+          message: `aws sso ${command} exited with code ${exit}`,
+        }),
+      );
+    }
+  }).pipe(Effect.scoped);
+
+const loginSSO = (config: Extract<AwsAuthConfig, { method: "sso" }>) =>
+  Clank.info(
+    `AWS SSO: running 'aws sso login --profile ${config.ssoProfile}'...`,
+  ).pipe(
+    Effect.andThen(runSsoCommand("login", config.ssoProfile)),
+    Effect.matchEffect({
+      onSuccess: () => Clank.success("AWS SSO: login complete"),
+      onFailure: (e) => Clank.warn(`AWS SSO: login faield: \`${e.message}\``),
+    }),
+  );
+
+/**
+ * `aws sso logout` only clears AWS CLI's own caches — it does not know about the
+ * `<sha1(sso_session)>.credentials.json` file that `@distilled.cloud/aws`
+ * writes alongside the SSO token. Without this cleanup, `loadProfileCredentials`
+ * short-circuits on the stale distilled cache file after logout and appears to
+ * stay logged in until the role creds hit their TTL.
+ */
+const clearDistilledSsoCache = (ssoProfile: string) =>
+  Effect.gen(function* () {
+    const auth = yield* DistilledAuth.Default;
+    const profile = yield* auth.loadProfile(ssoProfile);
+    const ssoSession = (profile as { sso_session?: string }).sso_session;
+    if (!ssoSession) return;
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const hash = NodeCrypto.createHash("sha1").update(ssoSession).digest("hex");
+    const cacheFile = path.join(
+      NodeOs.homedir(),
+      ".aws",
+      "sso",
+      "cache",
+      `${hash}.credentials.json`,
+    );
+    yield* fs.remove(cacheFile).pipe(Effect.catch(() => Effect.void));
+  }).pipe(Effect.catch(() => Effect.void));

package/src/AWS/AutoScaling/LaunchTemplate.ts

@@ -3,7 +3,6 @@ import { Region } from "@distilled.cloud/aws/Region";
 import * as ec2 from "@distilled.cloud/aws/ec2";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
-import * as Option from "effect/Option";
 import type * as rolldown from "rolldown";
 import * as Bundle from "../../Bundle/Bundle.ts";
 import { deepEqual, isResolved } from "../../Diff.ts";
@@ -15,7 +14,6 @@ import { Resource } from "../../Resource.ts";
 import { Stack } from "../../Stack.ts";
 import { Stage } from "../../Stage.ts";
 import { createInternalTags, diffTags, hasTags } from "../../Tags.ts";
-import { Assets } from "../Assets.ts";
 import type { SecurityGroupId } from "../EC2/SecurityGroup.ts";
 import {
   createEc2HostRuntimeContext,
@@ -23,10 +21,10 @@ import {
   type Ec2HostRuntimeContext,
 } from "../EC2/hosted.ts";
 import type { AccountID } from "../Environment.ts";
-import { AWSEnvironment } from "../Environment.ts";
 import type { PolicyStatement } from "../IAM/Policy.ts";
 import type { Providers } from "../Providers.ts";
 import type { RegionID } from "../Region.ts";
+import { AWSEnvironment } from "../index.ts";
 
 export type LaunchTemplateId = `lt-${string}`;
 export type LaunchTemplateName = string;
@@ -175,24 +173,16 @@ export const LaunchTemplateProvider = () =>
   Provider.effect(
     LaunchTemplate,
     Effect.gen(function* () {
-      const { accountId } = yield* AWSEnvironment;
-      const region = yield* Region;
       const stack = yield* Stack;
       const stage = yield* Stage;
       const fs = yield* FileSystem.FileSystem;
       const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
-      const assets = (yield* Effect.serviceOption(Assets)).pipe(
-        Option.getOrUndefined,
-      );
 
       const hosted = createEc2HostedSupport({
-        accountId,
-        region,
         stackName: stack.name,
         stage,
         fs,
         virtualEntryPlugin,
-        assets,
         resourceType: "AWS.AutoScaling.LaunchTemplate",
       });
 
@@ -205,7 +195,12 @@ export const LaunchTemplateProvider = () =>
           : createPhysicalName({ id, maxLength: 128, lowercase: true });
 
       const toArn = (launchTemplateId: LaunchTemplateId) =>
-        `arn:aws:ec2:${region}:${accountId}:launch-template/${launchTemplateId}` as LaunchTemplateArn;
+        AWSEnvironment.current.pipe(
+          Effect.map(
+            (env) =>
+              `arn:aws:ec2:${env.region}:${env.accountId}:launch-template/${launchTemplateId}` as LaunchTemplateArn,
+          ),
+        );
 
       const describeById = (launchTemplateId: string) =>
         ec2
@@ -307,25 +302,29 @@ export const LaunchTemplateProvider = () =>
         return Number(versionNumber);
       });
 
-      const toAttributes = (
+      const toAttributes = Effect.fnUntraced(function* (
         template: ec2.LaunchTemplate,
         runtime: Partial<LaunchTemplate["Attributes"]> = {},
-      ): LaunchTemplate["Attributes"] => ({
-        launchTemplateId: template.LaunchTemplateId as LaunchTemplateId,
-        launchTemplateArn: toArn(template.LaunchTemplateId as LaunchTemplateId),
-        launchTemplateName: template.LaunchTemplateName!,
-        defaultVersionNumber: Number(template.DefaultVersionNumber ?? 1),
-        latestVersionNumber: Number(
-          template.LatestVersionNumber ?? template.DefaultVersionNumber ?? 1,
-        ),
-        tags: toTagRecord(template.Tags),
-        roleArn: runtime.roleArn,
-        roleName: runtime.roleName,
-        policyName: runtime.policyName,
-        managedIam: runtime.managedIam,
-        runtimeUnitName: runtime.runtimeUnitName,
-        assetPrefix: runtime.assetPrefix,
-        code: runtime.code,
+      ) {
+        return {
+          launchTemplateId: template.LaunchTemplateId as LaunchTemplateId,
+          launchTemplateArn: yield* toArn(
+            template.LaunchTemplateId as LaunchTemplateId,
+          ),
+          launchTemplateName: template.LaunchTemplateName!,
+          defaultVersionNumber: Number(template.DefaultVersionNumber ?? 1),
+          latestVersionNumber: Number(
+            template.LatestVersionNumber ?? template.DefaultVersionNumber ?? 1,
+          ),
+          tags: toTagRecord(template.Tags),
+          roleArn: runtime.roleArn,
+          roleName: runtime.roleName,
+          policyName: runtime.policyName,
+          managedIam: runtime.managedIam,
+          runtimeUnitName: runtime.runtimeUnitName,
+          assetPrefix: runtime.assetPrefix,
+          code: runtime.code,
+        } satisfies LaunchTemplate["Attributes"];
       });
 
       return {
@@ -361,7 +360,7 @@ export const LaunchTemplateProvider = () =>
             (yield* describeByName(yield* toName(id, olds ?? {})));
 
           return template
-            ? toAttributes(template, {
+            ? yield* toAttributes(template, {
                 roleArn: output?.roleArn,
                 roleName: output?.roleName,
                 policyName: output?.policyName,
@@ -439,7 +438,7 @@ export const LaunchTemplateProvider = () =>
               );
             }
             yield* session.note(template.LaunchTemplateId);
-            return toAttributes(template as ec2.LaunchTemplate, runtime);
+            return yield* toAttributes(template as ec2.LaunchTemplate, runtime);
           }
 
           if (!hasTags(desiredTags, toTagRecord(existing.Tags))) {
@@ -475,7 +474,7 @@ export const LaunchTemplateProvider = () =>
             );
           }
           yield* session.note(refreshed.LaunchTemplateId!);
-          return toAttributes(refreshed, runtime);
+          return yield* toAttributes(refreshed, runtime);
         }),
         delete: Effect.fn(function* ({ output, session }) {
           yield* ec2