alchemy 2.0.0-beta.57 → 2.0.0-beta.59

package/README.md

@@ -27,7 +27,7 @@ export default Cloudflare.Worker(
   "api",
   { main: import.meta.filename },
   Effect.gen(function* () {
-    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+    const bucket = yield* Cloudflare.R2.ReadWrite(Bucket);
     return {
       fetch: Effect.gen(function* () {
         const request = yield* HttpServerRequest;
@@ -44,7 +44,7 @@ One `bind()` wires the binding, env var, and typed connection — at deploy time
 ---
 
 - **One program, one language.** Resources, Lambdas/Workers, IAM, and SDKs live in the same Effect program — no YAML, no second runtime.
-- **Bindings, not glue code.** `S3.GetObject.bind(bucket)` wires the IAM policy, env var, and a typed SDK call in a single line.
+- **Bindings, not glue code.** `S3.GetObject(bucket)` wires the IAM policy, env var, and a typed SDK call in a single line.
 - **Errors in the type system.** Every cloud API failure is a tagged Effect error you handle — or don't — on purpose.
 - **AWS + Cloudflare today.** S3, SQS, DynamoDB, Kinesis, Lambda, EC2 / Workers, R2, D1, Durable Objects, Containers.
 - **Same code, every stage.** Local dev, `plan` / `deploy`, smoke tests, and CI all share one mental model.

package/bin/exec.js

@@ -11,6 +11,7 @@ import * as Redacted from "effect/Redacted";
 import path from "pathe";
 import * as Config from "effect/Config";
 import os from "node:os";
+import * as Semaphore from "effect/Semaphore";
 import { newWebSocketRpcSession } from "capnweb";
 import * as Cache from "effect/Cache";
 import * as HttpBody from "effect/unstable/http/HttpBody";
@@ -19,7 +20,6 @@ import * as Logger from "effect/Logger";
 import * as Option from "effect/Option";
 import "effect/Scope";
 import * as Deferred from "effect/Deferred";
-import * as Semaphore from "effect/Semaphore";
 import * as Data from "effect/Data";
 import * as Duration from "effect/Duration";
 import { flow, pipe } from "effect/Function";
@@ -35,7 +35,6 @@ import * as Console from "effect/Console";
 import * as Command from "effect/unstable/cli/Command";
 import * as Flag from "effect/unstable/cli/Flag";
 import * as Metric from "effect/Metric";
-import { createHash } from "node:crypto";
 import * as Argument from "effect/unstable/cli/Argument";
 import * as CliError from "effect/unstable/cli/CliError";
 import { jsx, jsxs } from "react/jsx-runtime";
@@ -72,6 +71,41 @@ const AlchemyContextLive = Layer.effect(AlchemyContext, Effect.gen(function* ()
 	};
 }));
 
+//#endregion
+//#region lib/Util/interactive.js
+/**
+* Returns true when the current process looks like it's being driven by a
+* coding agent, CI runner, test runner, or anything else that won't render an
+* interactive TUI / prompt well.
+*
+* Two callers rely on this:
+*  - `Cli/selectCli.ts` uses it to pick `LoggingCli` over the Ink TUI.
+*  - `Auth/Profile.ts` uses it to refuse to launch an interactive credential
+*    configure flow (and thus avoid acquiring an auth lockfile) when there's
+*    no TTY to drive the prompts.
+*
+* Kept in `Util` (rather than `Cli`) so `Auth` can depend on it without
+* pulling in the CLI layer.
+*/
+const isNonInteractive = () => {
+	const env = process.env;
+	if (env.ALCHEMY_PLAIN === "1" || env.ALCHEMY_NO_TUI === "1") return true;
+	if (env.ALCHEMY_TUI === "1") return false;
+	if (!process.stdout.isTTY) return true;
+	if (env.CI) return true;
+	if (env.CLAUDECODE || env.CLAUDE_CODE_ENTRYPOINT || env.CURSOR_AGENT || env.AIDER_MODEL || env.CODEX_CLI) return true;
+	return false;
+};
+
+//#endregion
+//#region lib/Auth/AuthProvider.js
+const interactiveMutex = Semaphore.makeUnsafe(1);
+var AuthError = class extends Schema.TaggedErrorClass()("AuthError", {
+	message: Schema.String,
+	cause: Schema.optional(Schema.Defect())
+}) {};
+var AuthProviders = class extends EffectContext.Service()("AuthProviders") {};
+
 //#endregion
 //#region lib/Auth/Profile.js
 const rootDir = path.join(os.homedir(), ".alchemy");
@@ -113,10 +147,15 @@ const ProfileLive = Layer.effect(AlchemyProfile, Effect.gen(function* () {
 		delete config.profiles[name];
 		return writeConfig(config).pipe(Effect.as(true));
 	}));
-	const loadOrConfigure = (auth, profileName, ctx) => Effect.flatMap(getProfile(profileName), (existing) => existing?.[auth.name] ? Effect.succeed(existing[auth.name]) : Effect.tap(auth.configure(profileName, ctx), (config) => setProfile(profileName, {
-		...existing,
-		[auth.name]: config
-	})));
+	const loadOrConfigure = (auth, profileName, ctx) => Effect.flatMap(getProfile(profileName), (existing) => {
+		const stored = existing?.[auth.name];
+		if (stored) return Effect.succeed(stored);
+		if (!ctx.ci && isNonInteractive()) return Effect.fail(new AuthError({ message: `No credentials configured for '${auth.name}' in profile '${profileName}', and this process is non-interactive so it can't be configured interactively. Run \`alchemy login --profile ${profileName}\` to configure it, or set CI=1 to use environment-variable credentials.` }));
+		return Effect.tap(auth.configure(profileName, ctx), (config) => setProfile(profileName, {
+			...existing,
+			[auth.name]: config
+		}));
+	});
 	return {
 		readConfig,
 		writeConfig,
@@ -233,11 +272,6 @@ const makeScopedArtifacts = (store, fqn) => {
 */
 const ensureArtifactStore = (effect) => Effect.serviceOption(ArtifactStore).pipe(Effect.map(Option.getOrUndefined), Effect.flatMap((existing) => effect.pipe(Effect.provideService(ArtifactStore, existing ?? createArtifactStore()))));
 
-//#endregion
-//#region lib/Auth/AuthProvider.js
-const interactiveMutex = Semaphore.makeUnsafe(1);
-var AuthProviders = class extends EffectContext.Service()("AuthProviders") {};
-
 //#endregion
 //#region lib/Cli/Cli.js
 var Cli;
@@ -309,7 +343,7 @@ const UnownedTag = Symbol("alchemy/Unowned");
 * was *not* created by this stack/stage/logical-id:
 *
 * ```ts
-* read: Effect.fnUntraced(function* ({ id, output, olds }) {
+* read: Effect.fn(function* ({ id, output, olds }) {
 *   const settings = yield* getScriptSettings({ ... }).pipe(
 *     Effect.catchTag("WorkerNotFound", () => Effect.succeed(undefined)),
 *   );
@@ -355,7 +389,7 @@ const stripUnowned = (attrs) => {
 
 //#endregion
 //#region lib/FQN.js
-var FQN_SEPARATOR, toPath, toFqn, parseFqn;
+var FQN_SEPARATOR, toPath, parseFqn;
 var init_FQN = __esm({ "lib/FQN.js": (() => {
 	FQN_SEPARATOR = "/";
 	toPath = (ns) => {
@@ -368,11 +402,6 @@ var init_FQN = __esm({ "lib/FQN.js": (() => {
 		}
 		return path$1;
 	};
-	toFqn = (ns, logicalId) => {
-		const path$1 = toPath(ns);
-		path$1.push(logicalId);
-		return path$1.join(FQN_SEPARATOR);
-	};
 	parseFqn = (fqn) => {
 		const parts = fqn.split(FQN_SEPARATOR);
 		return {
@@ -388,11 +417,11 @@ const Provider = (type) => EffectContext.Service()(type);
 const isProviderCollectionService = (value) => {
 	return typeof value === "object" && value !== null && "kind" in value && value.kind === "ProviderCollection";
 };
-const findProviderByType = (type) => tryFindProviderByType(type).pipe(Effect.flatMap(Option.match({
+const findProviderByType = ((type) => tryFindProviderByType(type).pipe(Effect.flatMap(Option.match({
 	onNone: () => Effect.die(`Provider not found for ${type}`),
 	onSome: (provider) => Effect.succeed(provider)
-})));
-const tryFindProviderByType = Effect.fnUntraced(function* (resourceType) {
+}))));
+const tryFindProviderByType = Effect.fn(function* (resourceType) {
 	const Tag = Provider(resourceType);
 	const direct = yield* Effect.serviceOption(Tag);
 	if (Option.isSome(direct)) return direct;
@@ -429,7 +458,9 @@ const sanitizeKey = (key) => key.replaceAll(/[^a-zA-Z0-9]/g, "_");
 *
 * E.g. the context of a running Worker, Task, Process, Function
 */
-var RuntimeContext = class extends EffectContext.Service()("RuntimeContext") {};
+var RuntimeContext = class extends EffectContext.Service()("RuntimeContext") {
+	static phantom = Layer.empty;
+};
 const CurrentRuntimeContext = Effect.serviceOption(RuntimeContext).pipe(Effect.map(Option.getOrUndefined));
 
 //#endregion
@@ -802,7 +833,7 @@ const taggedFunction = (tag$1, fn) => {
 
 //#endregion
 //#region lib/Util/FileLogger.js
-const fileLogger = Effect.fnUntraced(function* (...segments) {
+const fileLogger = Effect.fn(function* (...segments) {
 	const { dotAlchemy } = yield* AlchemyContext;
 	const fs = yield* FileSystem.FileSystem;
 	const path$1 = yield* Path;
@@ -919,9 +950,9 @@ const serializeRpcArgs = (value) => {
 //#region lib/Local/RpcProviderProxy.js
 var RpcProviderProxy = class extends EffectContext.Service()("alchemy/Local/RpcProviderProxy") {};
 const SPAWNER_URL_ENV_KEY = "ALCHEMY_RPC_SPAWNER_URL";
-const make$1 = Effect.fnUntraced(function* (spawnerUrl) {
+const make$1 = Effect.fn(function* (spawnerUrl) {
 	const client = yield* HttpClient.HttpClient;
-	const getSession = Effect.fnUntraced(function* (serverEntryUrl) {
+	const getSession = Effect.fn(function* (serverEntryUrl) {
 		const alchemyContext = yield* AlchemyContext;
 		const stack = yield* Stack;
 		const payload = {
@@ -939,7 +970,7 @@ const make$1 = Effect.fnUntraced(function* (spawnerUrl) {
 		capacity: Infinity,
 		requireServicesAt: "lookup"
 	});
-	return RpcProviderProxy.of({ get: Effect.fnUntraced(function* (mainUrl, providerName) {
+	return RpcProviderProxy.of({ get: Effect.fn(function* (mainUrl, providerName) {
 		const session = yield* cache.lookup(mainUrl);
 		return unwrapRpcHandlers(yield* Effect.promise(() => session.getProvider(providerName)), ["tail"]);
 	}) });
@@ -1095,13 +1126,23 @@ const recordOutcome = (baseAttrs, status, duration) => {
 };
 
 //#endregion
-//#region lib/Util/hash.js
+//#region lib/Util/sha256.js
+const sha256 = (input) => Effect.promise(async () => {
+	const digest = await crypto.subtle.digest("SHA-256", toArrayBuffer(input));
+	return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+});
 /**
-* Stable hash of a resolved Task input. Wrapped in `Effect.sync` so the
-* call participates in the Effect runtime (tracing/interruption) per the
-* Effect-platform conventions.
+* Stable sha256 hex digest of a resolved Task input. Unlike
+* {@link sha256Object} this does not stabilize key ordering — it hashes the
+* raw `JSON.stringify(input ?? null)` so identical inputs map to identical
+* hashes for caching/equality checks.
 */
-const hashInput = (input) => Effect.sync(() => createHash("sha256").update(JSON.stringify(input ?? null)).digest("hex"));
+const hashInput = (input) => sha256(JSON.stringify(input ?? null));
+const toArrayBuffer = (input) => {
+	if (input instanceof ArrayBuffer) return input;
+	if (typeof input === "string") return new TextEncoder().encode(input);
+	return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
+};
 
 //#endregion
 //#region lib/Util/scc.js
@@ -1245,8 +1286,11 @@ const make = (stack, options = {}) => Effect.gen(function* () {
 		else if (Config.isConfig(input)) return yield* resolveInput(yield* input);
 		else if (Duration.isDuration(input) || Redacted.isRedacted(input)) return input;
 		else if (Array.isArray(input)) return yield* Effect.all(input.map(resolveInput), { concurrency: "unbounded" });
-		else if (isResource(input)) return yield* resolveInput(yield* resolveOutput(of(input)));
-		else if (typeof input === "object") return Object.fromEntries(yield* Effect.all(Object.entries(input).map(([key, value]) => resolveInput(value).pipe(Effect.map((value$1) => [key, value$1]))), { concurrency: "unbounded" }));
+		else if (isResource(input)) {
+			const resolved = yield* resolveOutput(of(input));
+			if (isResourceExpr(resolved) && resolved.stables) return yield* resolveInput(resolved.stables);
+			return yield* resolveInput(resolved);
+		} else if (typeof input === "object") return Object.fromEntries(yield* Effect.all(Object.entries(input).map(([key, value]) => resolveInput(value).pipe(Effect.map((value$1) => [key, value$1]))), { concurrency: "unbounded" }));
 		return input;
 	});
 	const resolveOutput = (expr) => Effect.gen(function* () {
@@ -1695,7 +1739,6 @@ var UnsatisfiedResourceCycle = class extends Data.TaggedError("UnsatisfiedResour
 //#endregion
 //#region lib/Apply.js
 init_Cli();
-init_FQN();
 const provideLifecycleScope = (fqn, instanceId) => (effect) => Effect.serviceOption(ArtifactStore).pipe(Effect.map(Option.getOrElse(createArtifactStore)), Effect.flatMap((store) => effect.pipe(Effect.provideService(Artifacts, makeScopedArtifacts(store, fqn)), Effect.provideService(InstanceId, instanceId))));
 /**
 * Instruments a single provider lifecycle call with an OTel span
@@ -1745,7 +1788,7 @@ const apply = (plan) => Effect.gen(function* () {
 	"alchemy.resources.count": Object.keys(plan.resources).length,
 	"alchemy.deletions.count": Object.keys(plan.deletions).length
 } }));
-const executePlan = Effect.fnUntraced(function* (plan, tracker, terminalStatuses, session, state, stackName, stage$1) {
+const executePlan = Effect.fn(function* (plan, tracker, terminalStatuses, session, state, stackName, stage$1) {
 	const allNodes = {
 		...plan.resources,
 		...plan.actions
@@ -2047,6 +2090,22 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				removalPolicy: node.resource.RemovalPolicy
 			});
 			else replState = node.state;
+			const deleteOldGenerations = (old) => Effect.gen(function* () {
+				const retain = node.resource.RemovalPolicy === "retain";
+				if (old.attr !== void 0 && !retain) yield* node.provider.delete({
+					id: logicalId,
+					instanceId: old.instanceId,
+					olds: old.props,
+					output: old.attr,
+					session: scopedSession,
+					bindings: []
+				}).pipe(instrumentLifecycle("delete", fqn, node.resource.Type, logicalId, old.instanceId));
+				if (old.status === "replacing" || old.status === "replaced") yield* deleteOldGenerations(old.old);
+			});
+			if (node.deleteFirst) {
+				yield* scopedSession.note("Deleting previous resource before creating its replacement (deleteFirst)...");
+				yield* deleteOldGenerations(replState.old);
+			}
 			let attr = replState.attr;
 			if (attr !== void 0) yield* storeAndSignal({
 				output: attr,
@@ -2100,7 +2159,20 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
 				olds: void 0,
 				output: attr
 			}).pipe(instrumentLifecycle("create", fqn, node.resource.Type, logicalId, instanceId));
-			yield* commit({
+			if (node.deleteFirst) yield* commit({
+				status: "created",
+				fqn,
+				logicalId,
+				instanceId,
+				resourceType: node.resource.Type,
+				props: news,
+				attr,
+				providerVersion: node.provider.version ?? 0,
+				bindings: excludeDeletedBindings(node.bindings),
+				downstream: node.downstream,
+				removalPolicy: node.resource.RemovalPolicy
+			});
+			else yield* commit({
 				status: "replaced",
 				fqn,
 				logicalId,
@@ -2250,7 +2322,7 @@ const executeActionNode = (fqn, node, tracker, ready, readyStable, terminalStatu
 	"alchemy.action.logical_id": node.def.LogicalId,
 	"alchemy.action.verb": node.action
 } }));
-const converge = Effect.fnUntraced(function* (plan, tracker, terminalStatuses, session, state, stackName, stage$1) {
+const converge = Effect.fn(function* (plan, tracker, terminalStatuses, session, state, stackName, stage$1) {
 	for (;;) {
 		let anyUpdated = false;
 		for (const [fqn, node] of Object.entries(plan.resources)) {
@@ -2374,7 +2446,7 @@ const converge = Effect.fnUntraced(function* (plan, tracker, terminalStatuses, s
 		if (!anyUpdated) break;
 	}
 });
-const collectGarbage = Effect.fnUntraced(function* (plan, session) {
+const collectGarbage = Effect.fn(function* (plan, session) {
 	const state = yield* yield* State;
 	const stackName = (yield* Stack).name;
 	const stage$1 = yield* Stage;
@@ -2397,11 +2469,12 @@ const collectGarbage = Effect.fnUntraced(function* (plan, session) {
 			status: "deleted"
 		});
 	})), { concurrency: "unbounded" });
-	const deleteGraph = Effect.fnUntraced(function* (deletionGraph) {
+	const deleteGraph = Effect.fn(function* (deletionGraph) {
 		const deletions = {};
 		const deleteResource = (node, ancestors = /* @__PURE__ */ new Set()) => Effect.gen(function* () {
 			const isDeleteNode = (node$1) => "action" in node$1;
-			const { logicalId, namespace, resourceType, instanceId, downstream, props, attr, provider } = isDeleteNode(node) ? {
+			const { fqn, logicalId, namespace, resourceType, instanceId, downstream, props, attr, provider } = isDeleteNode(node) ? {
+				fqn: node.resource.FQN,
 				logicalId: node.resource.LogicalId,
 				namespace: node.resource.Namespace,
 				resourceType: node.resource.Type,
@@ -2411,6 +2484,7 @@ const collectGarbage = Effect.fnUntraced(function* (plan, session) {
 				attr: node.state.attr,
 				provider: node.provider
 			} : {
+				fqn: node.fqn,
 				logicalId: node.logicalId,
 				namespace: node.namespace,
 				resourceType: node.old.resourceType,
@@ -2420,7 +2494,6 @@ const collectGarbage = Effect.fnUntraced(function* (plan, session) {
 				attr: node.old.attr,
 				provider: yield* findProviderByType(node.old.resourceType)
 			};
-			const fqn = toFqn(namespace, logicalId);
 			const nextAncestors = new Set(ancestors).add(fqn);
 			const commit = (value) => state.set({
 				stack: stackName,
@@ -2534,7 +2607,7 @@ const collectGarbage = Effect.fnUntraced(function* (plan, session) {
 		if (!first && remainingReplacedResources.length === 0) break;
 		yield* deleteGraph({
 			...first ? plan.deletions : {},
-			...Object.fromEntries(remainingReplacedResources.map((replaced) => [toFqn(replaced.namespace, replaced.logicalId), replaced]))
+			...Object.fromEntries(remainingReplacedResources.map((replaced) => [replaced.fqn, replaced]))
 		});
 		first = false;
 	}
@@ -3509,22 +3582,6 @@ var init_InkCLI = __esm({ "lib/Cli/tui/InkCLI.js": (() => {
 
 //#endregion
 //#region lib/Cli/selectCli.js
-/**
-* Returns true when the current process looks like it's being driven by a
-* coding agent, CI runner, or anything else that won't render an interactive
-* TUI well. The Ink renderer repaints the screen on every event, which floods
-* agent transcripts with redundant frames; LoggingCli emits one line per
-* status change instead.
-*/
-const isNonInteractive = () => {
-	const env = process.env;
-	if (env.ALCHEMY_PLAIN === "1" || env.ALCHEMY_NO_TUI === "1") return true;
-	if (env.ALCHEMY_TUI === "1") return false;
-	if (!process.stdout.isTTY) return true;
-	if (env.CI) return true;
-	if (env.CLAUDECODE || env.CLAUDE_CODE_ENTRYPOINT || env.CURSOR_AGENT || env.AIDER_MODEL || env.CODEX_CLI) return true;
-	return false;
-};
 const selectCli = () => isNonInteractive() ? LoggingCli : Layer.unwrap(Effect.promise(() => Promise.resolve().then(() => (init_InkCLI(), InkCLI_exports)).then((m) => m.inkCLI())));
 
 //#endregion