alchemy 2.0.0-beta.57 → 2.0.0-beta.59

package/src/Apply.ts

@@ -17,7 +17,6 @@ import {
 } from "./Cli/Cli.ts";
 import type { ApplyStatus } from "./Cli/Event.ts";
 import { havePropsChanged } from "./Diff.ts";
-import { toFqn } from "./FQN.ts";
 import type { Input } from "./Input.ts";
 import { generateInstanceId, InstanceId } from "./InstanceId.ts";
 import * as Output from "./Output.ts";
@@ -39,6 +38,7 @@ import {
   type PersistedState,
   type RanActionState,
   type ReplacedResourceState,
+  type ReplacementOldResourceState,
   type ReplacingResourceState,
   type ResourceState,
   type RunningActionState,
@@ -48,7 +48,7 @@ import {
   StateStoreError,
 } from "./State/index.ts";
 import { type ResourceOp, recordResourceOp } from "./Telemetry/Metrics.ts";
-import { hashInput } from "./Util/hash.ts";
+import { hashInput } from "./Util/sha256.ts";
 
 export type ApplyEffect<
   P extends Plan,
@@ -220,7 +220,7 @@ export const apply = <P extends Plan>(
 // downstream resources can resolve stable identifiers without deadlocking.
 // The actual output lives in the mutable `tracker` map, not in the Deferred.
 
-const executePlan = Effect.fnUntraced(function* (
+const executePlan = Effect.fn(function* (
   plan: Plan,
   tracker: Record<string, ResourceTracker>,
   terminalStatuses: Map<
@@ -855,6 +855,58 @@ const executeNode = (
           replState = node.state;
         }
 
+        // ── delete-first replacements ──
+        //
+        // By default a replacement is create-first: the new generation is
+        // created here and the old generation(s) are reclaimed afterwards by
+        // `collectGarbage` (Phase 2). That ordering keeps the old resource
+        // alive if the create fails, but it is wrong for resources whose
+        // replacement cannot coexist with the original — a fixed physical
+        // name, a singleton, etc. Those providers return
+        // `{ action: "replace", deleteFirst: true }`.
+        //
+        // When `deleteFirst` is set we tear the previous generation(s) down
+        // BEFORE creating the new one, and commit the result as a terminal
+        // `created` state (rather than `replaced`) so Phase 2 has no old chain
+        // left to drain. `delete` is required to be idempotent, so a re-run
+        // after an interrupted apply simply re-converges.
+        const deleteOldGenerations = (
+          old: ReplacementOldResourceState,
+        ): Effect.Effect<void, any, any> =>
+          Effect.gen(function* () {
+            const retain = node.resource.RemovalPolicy === "retain";
+            if (old.attr !== undefined && !retain) {
+              yield* node.provider
+                .delete({
+                  id: logicalId,
+                  instanceId: old.instanceId,
+                  olds: old.props as never,
+                  output: old.attr,
+                  session: scopedSession,
+                  bindings: [],
+                })
+                .pipe(
+                  instrumentLifecycle(
+                    "delete",
+                    fqn,
+                    node.resource.Type,
+                    logicalId,
+                    old.instanceId,
+                  ),
+                );
+            }
+            if (old.status === "replacing" || old.status === "replaced") {
+              yield* deleteOldGenerations(old.old);
+            }
+          });
+
+        if (node.deleteFirst) {
+          yield* scopedSession.note(
+            "Deleting previous resource before creating its replacement (deleteFirst)...",
+          );
+          yield* deleteOldGenerations(replState.old);
+        }
+
         let attr: any = replState.attr;
 
         if (attr !== undefined) {
@@ -950,25 +1002,44 @@ const executeNode = (
             ),
           );
 
-        yield* commit<ReplacedResourceState>({
-          // Creation of the new generation succeeded; from here on the only remaining
-          // work is draining the old chain via garbage collection.
-          status: "replaced",
-          fqn,
-          logicalId,
-          instanceId,
-          resourceType: node.resource.Type,
-          props: news,
-          attr,
-          providerVersion: node.provider.version ?? 0,
-          bindings: excludeDeletedBindings(node.bindings),
-          downstream: node.downstream,
-          // Preserve the remaining backlog exactly as-is. GC is responsible for
-          // popping one generation at a time until the chain is exhausted.
-          old: replState.old,
-          deleteFirst: node.deleteFirst,
-          removalPolicy: node.resource.RemovalPolicy,
-        });
+        if (node.deleteFirst) {
+          // The old generation(s) were already torn down above, so there is
+          // nothing left for `collectGarbage` to drain — collapse straight to
+          // the terminal `created` state.
+          yield* commit<CreatedResourceState>({
+            status: "created",
+            fqn,
+            logicalId,
+            instanceId,
+            resourceType: node.resource.Type,
+            props: news,
+            attr,
+            providerVersion: node.provider.version ?? 0,
+            bindings: excludeDeletedBindings(node.bindings),
+            downstream: node.downstream,
+            removalPolicy: node.resource.RemovalPolicy,
+          });
+        } else {
+          yield* commit<ReplacedResourceState>({
+            // Creation of the new generation succeeded; from here on the only remaining
+            // work is draining the old chain via garbage collection.
+            status: "replaced",
+            fqn,
+            logicalId,
+            instanceId,
+            resourceType: node.resource.Type,
+            props: news,
+            attr,
+            providerVersion: node.provider.version ?? 0,
+            bindings: excludeDeletedBindings(node.bindings),
+            downstream: node.downstream,
+            // Preserve the remaining backlog exactly as-is. GC is responsible for
+            // popping one generation at a time until the chain is exhausted.
+            old: replState.old,
+            deleteFirst: node.deleteFirst,
+            removalPolicy: node.resource.RemovalPolicy,
+          });
+        }
 
         tracker[fqn] = {
           output: attr,
@@ -1200,7 +1271,7 @@ const executeActionNode = (
 // resource whose resolved inputs differ from what it was last applied with.
 // Repeat until no resource needs updating.
 
-const converge = Effect.fnUntraced(function* (
+const converge = Effect.fn(function* (
   plan: Plan,
   tracker: Record<string, ResourceTracker>,
   terminalStatuses: Map<
@@ -1393,7 +1464,7 @@ const converge = Effect.fnUntraced(function* (
 
 // ── Phase 2: delete orphans and old replaced resources ─────────────────────
 
-const collectGarbage = Effect.fnUntraced(function* (
+const collectGarbage = Effect.fn(function* (
   plan: Plan,
   session: PlanStatusSession,
 ) {
@@ -1428,7 +1499,7 @@ const collectGarbage = Effect.fnUntraced(function* (
     { concurrency: "unbounded" },
   );
 
-  const deleteGraph = Effect.fnUntraced(function* (
+  const deleteGraph = Effect.fn(function* (
     deletionGraph: Record<string, Delete | ReplacedResourceState | undefined>,
   ) {
     const deletions: {
@@ -1445,6 +1516,7 @@ const collectGarbage = Effect.fnUntraced(function* (
         ): node is Delete => "action" in node;
 
         const {
+          fqn,
           logicalId,
           namespace,
           resourceType,
@@ -1455,6 +1527,13 @@ const collectGarbage = Effect.fnUntraced(function* (
           provider,
         } = isDeleteNode(node)
           ? {
+              // Use the persisted FQN verbatim — never recompute it from
+              // `toFqn(namespace, logicalId)`. A logical ID may legitimately
+              // contain the FQN separator (`/`), in which case `parseFqn`
+              // truncated it and a recomputed key would miss the real state
+              // row (the row would then resurface as an orphan on every
+              // subsequent destroy, never getting deleted).
+              fqn: node.resource.FQN,
               logicalId: node.resource.LogicalId,
               namespace: node.resource.Namespace,
               resourceType: node.resource.Type,
@@ -1465,6 +1544,7 @@ const collectGarbage = Effect.fnUntraced(function* (
               provider: node.provider,
             }
           : {
+              fqn: node.fqn,
               logicalId: node.logicalId,
               namespace: node.namespace,
               resourceType: node.old.resourceType,
@@ -1475,7 +1555,6 @@ const collectGarbage = Effect.fnUntraced(function* (
               provider: yield* findProviderByType(node.old.resourceType),
             };
 
-        const fqn = toFqn(namespace, logicalId);
         const nextAncestors = new Set(ancestors).add(fqn);
 
         const commit = <S extends ResourceState>(value: Omit<S, "namespace">) =>
@@ -1663,7 +1742,9 @@ const collectGarbage = Effect.fnUntraced(function* (
       ...(first ? plan.deletions : {}),
       ...Object.fromEntries(
         remainingReplacedResources.map((replaced) => [
-          toFqn(replaced.namespace, replaced.logicalId),
+          // Key by the persisted FQN (not a recomputed one) so logical IDs
+          // containing the FQN separator round-trip correctly.
+          replaced.fqn,
           replaced,
         ]),
       ),

package/src/Auth/Lock.ts

@@ -4,8 +4,6 @@ import * as fs from "node:fs/promises";
 import * as path from "pathe";
 import { rootDir } from "./Profile.ts";
 
-const lockDir = path.join(rootDir, "lock");
-
 /**
  * Serialise execution of `effect` so no two callers ever run inside the
  * critical section concurrently for the same `key`, both within this
@@ -20,6 +18,10 @@ export const withLock = <A, E, R>(
   key: string,
   effect: Effect.Effect<A, E, R>,
 ): Effect.Effect<A, E, R> => {
+  // Computed lazily (not at module-eval time) so that the
+  // `Profile -> AuthProvider -> Lock -> Profile` import cycle never reads
+  // `rootDir` before `Profile.ts` has finished initialising it.
+  const lockDir = path.join(rootDir, "lock");
   const lockPath = path.join(lockDir, `${key}.lock`);
   return Effect.acquireUseRelease(
     Effect.promise(async () => {

package/src/Auth/Profile.ts

@@ -7,11 +7,9 @@ import * as Layer from "effect/Layer";
 import type { PlatformError } from "effect/PlatformError";
 import os from "node:os";
 import path from "pathe";
-import type {
-  AuthError,
-  AuthProvider,
-  ConfigureContext,
-} from "./AuthProvider.ts";
+import { isNonInteractive } from "../Util/interactive.ts";
+import { AuthError } from "./AuthProvider.ts";
+import type { AuthProvider, ConfigureContext } from "./AuthProvider.ts";
 
 export const rootDir = path.join(os.homedir(), ".alchemy");
 export const configFilePath = path.join(rootDir, "profiles.json");
@@ -161,13 +159,37 @@ export const ProfileLive = Layer.effect(
       profileName: string,
       ctx: ConfigureContext,
     ) =>
-      Effect.flatMap(getProfile(profileName), (existing) =>
-        existing?.[auth.name]
-          ? Effect.succeed(existing[auth.name] as Config)
-          : Effect.tap(auth.configure(profileName, ctx), (config) =>
-              setProfile(profileName, { ...existing, [auth.name]: config }),
-            ),
-      );
+      Effect.flatMap(getProfile(profileName), (existing) => {
+        const stored = existing?.[auth.name];
+        if (stored) {
+          return Effect.succeed(stored as Config);
+        }
+        // No credentials are configured for this provider+profile. Driving
+        // `auth.configure` requires an interactive terminal (clack prompts,
+        // browser-based OAuth, ...). In a non-interactive, non-CI context
+        // (e.g. a `vitest` run or piped stdout) there is no TTY to drive
+        // those prompts, so bail *before* calling `auth.configure`.
+        //
+        // This matters beyond just avoiding a hang: `configure` is a locked
+        // method, so entering it acquires a cross-process auth lockfile. We
+        // must avoid creating that lock when we can't actually configure —
+        // for OAuth providers a refresh token is typically single-use, so a
+        // stray lock left by a doomed configure can wedge concurrent refreshes.
+        if (!ctx.ci && isNonInteractive()) {
+          return Effect.fail(
+            new AuthError({
+              message:
+                `No credentials configured for '${auth.name}' in profile '${profileName}', ` +
+                `and this process is non-interactive so it can't be configured interactively. ` +
+                `Run \`alchemy login --profile ${profileName}\` to configure it, ` +
+                `or set CI=1 to use environment-variable credentials.`,
+            }),
+          );
+        }
+        return Effect.tap(auth.configure(profileName, ctx), (config) =>
+          setProfile(profileName, { ...existing, [auth.name]: config }),
+        );
+      });
 
     return {
       readConfig,

package/src/Axiom/ApiToken.ts

@@ -63,7 +63,7 @@ export type ApiToken = Resource<
  * @section Consuming the Token
  * @example Forward the token via Cloudflare Secrets
  * ```typescript
- * const secret = yield* Cloudflare.Secret("axiom-token", {
+ * const secret = yield* Cloudflare.SecretsStore.Secret("axiom-token", {
  *   value: ingest.token,
  * });
  * ```

package/src/Axiom/AuthProvider.ts

@@ -87,7 +87,7 @@ export const AxiomAuth = AuthProviderLayer<
   Effect.gen(function* () {
     const store = yield* CredentialsStore;
 
-    const loginStored = Effect.fnUntraced(function* (profileName: string) {
+    const loginStored = Effect.fn(function* (profileName: string) {
       const credentialType = yield* Clank.select({
         message: "Axiom credential type",
         options: [
@@ -201,7 +201,7 @@ export const AxiomAuth = AuthProviderLayer<
       Match.value(config).pipe(
         Match.when(
           { method: "env" },
-          Effect.fnUntraced(function* () {
+          Effect.fn(function* () {
             const apiToken =
               (yield* getEnvRedacted("AXIOM_TOKEN")) ??
               (yield* getEnvRedacted("AXIOM_API_KEY"));

package/src/Binding.ts

@@ -1,16 +1,9 @@
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
-import * as Effectable from "effect/Effectable";
-import * as Layer from "effect/Layer";
-import * as Option from "effect/Option";
 import type { Input } from "./Input.ts";
-import * as Namespace from "./Namespace.ts";
-import { ALCHEMY_PHASE } from "./Phase.ts";
-import { tryFindProviderByType } from "./Provider.ts";
 import type { ResourceLike } from "./Resource.ts";
-import { RuntimeContext } from "./RuntimeContext.ts";
 import { Self } from "./Self.ts";
-import { CurrentStack } from "./Stack.ts";
+import { taggedFunction } from "./Util/effect.ts";
 
 export interface ServiceLike {
   kind: "Service";
@@ -22,23 +15,6 @@ export interface ServiceShape<
 >
   extends Context.ServiceClass.Shape<Identifier, Shape>, ServiceLike {}
 
-export interface Service<
-  Self,
-  Identifier extends string,
-  Shape extends (...args: any[]) => Effect.Effect<any, any, any>,
->
-  extends Context.Service<Self, Shape>, ServiceLike {
-  readonly key: Identifier;
-  new (_: never): ServiceShape<Identifier, Shape>;
-  bind: <Req = never>(
-    ...args: BindParameters<Parameters<Shape>, Req>
-  ) => Effect.Effect<
-    Effect.Success<ReturnType<Shape>>,
-    Effect.Error<ReturnType<Shape>>,
-    Self | Effect.Services<ReturnType<Shape>> | Req
-  >;
-}
-
 type BindParameters<
   Parameters extends any[],
   Req = never,
@@ -50,174 +26,59 @@ type BindParameters<
   : [];
 
 /**
- * Creates a runtime binding service.
- *
- * A `Binding.Service` is the runtime-facing half of an operation such as
- * `GetItem`, `PutObject`, or `Fetch`. It is provided on the function or worker
- * effect so user code can call `.bind(resource)` and receive a typed runtime
- * API that already knows how to talk to the target resource.
+ * The combined tag + callable + type form of a binding (the `Resource.ts`-style
+ * single-identifier pattern). `interface X extends Binding.Service<X, Id, Shape>`
+ * declares the type; `const X = Binding.Service<X>(id)` produces a value that is at
+ * once the Context tag (usable in `Layer.effect(X, …)` / `Effect.provide`), the
+ * callable (`X(resource)`), and carries the type.
  */
-export const Service =
-  <Self, Shape extends (...args: any[]) => Effect.Effect<any, any, any>>() =>
-  <Identifier extends string>(id: Identifier) => {
-    const self = Context.Service<Self, Shape>(id) as Service<
-      Self,
-      Identifier,
-      Shape
-    >;
-    return Object.assign(self, {
-      bind: (...args: Parameters<Shape>) =>
-        self.use((f) =>
-          Effect.all(
-            args.map((arg) =>
-              Effect.isEffect(arg) ? arg : Effect.succeed(arg),
-            ),
-            {
-              concurrency: "unbounded",
-            },
-          ).pipe(Effect.flatMap((args) => f(...args))),
-        ),
-    });
-  };
-
-export interface PolicyLike {
-  kind: "Policy";
-}
-
-export interface PolicyShape<
+export interface Service<
+  Self,
   Identifier extends string,
   Shape extends (...args: any[]) => Effect.Effect<any, any, any>,
 >
-  extends Context.ServiceClass.Shape<Identifier, Shape>, PolicyLike {}
-
-export interface Policy<
-  in out Self,
-  in out Identifier extends string,
-  in out Shape extends (...args: any[]) => Effect.Effect<any, any, any>,
-> extends Effect.Effect<Shape, never, Self> {
+  extends Context.Service<Self, Shape>, ServiceLike {
   readonly key: Identifier;
-  new (_: never): PolicyShape<Identifier, Shape>;
-  layer: {
-    succeed(
-      fn: (ctx: ResourceLike, ...args: Parameters<Shape>) => ReturnType<Shape>,
-    ): Layer.Layer<Self>;
-    effect<Req = never>(
-      fn: Effect.Effect<
-        (ctx: ResourceLike, ...args: Parameters<Shape>) => ReturnType<Shape>,
-        never,
-        Req
-      >,
-    ): Layer.Layer<Self, never, Req>;
-  };
-  bind(
-    ...args: Parameters<Shape>
+  new (_: never): ServiceShape<Identifier, Shape>;
+  <Req = never>(
+    ...args: BindParameters<Parameters<Shape>, Req>
   ): Effect.Effect<
     Effect.Success<ReturnType<Shape>>,
     Effect.Error<ReturnType<Shape>>,
-    Self | RuntimeContext | Effect.Services<ReturnType<Shape>>
+    Self | Effect.Services<ReturnType<Shape>> | Req
   >;
 }
 
 /**
- * Creates a deploy-time binding policy.
- *
- * A `Binding.Policy` attaches the infrastructure-side permissions or bindings
- * that make a runtime binding usable. At deploy time it records IAM statements
- * or host bindings on the target function/worker. At runtime the layer is
- * absent, so the policy gracefully becomes a no-op.
+ * Build a combined tag+callable binding (see {@link Service}). The returned
+ * value forwards the Effect/Tag protocol to its Context tag (via `taggedFunction`)
+ * so `Layer.effect`/`provide` work, while being directly callable to bind a
+ * resource at the call site.
  */
-export const Policy =
-  <Self, Shape extends (...args: any[]) => Effect.Effect<void, any, any>>() =>
-  <Identifier extends string>(
-    Identifier: Identifier,
-  ): Policy<Self, `Policy<${Identifier}>`, Shape> => {
-    const self = Context.Service<Self, Shape>(`Policy<${Identifier}>`);
-
-    // we use a service option because at runtime (e.g. in a Lambda Function or Cloudflare Worker)
-    // the Policy Layer is not provided and this becomes a no-op
-    const Service = tryFindProviderByType<Policy<Self, Identifier, Shape>>(
-      self.key as Identifier,
-    ).pipe(
-      Effect.map(Option.getOrUndefined),
-      Effect.flatMap((service) =>
-        service
-          ? Effect.succeed(service)
-          : Effect.all([CurrentStack, ALCHEMY_PHASE]).pipe(
-              Effect.flatMap(([stack, phase]) =>
-                stack && phase === "plan"
-                  ? Effect.die(
-                      `Binding.Policy provider 'Policy<${Identifier}>' was not provided at Plan Time in Stack '${stack.name}'`,
-                    )
-                  : Effect.succeed((() => Effect.void) as any as Shape),
-              ),
-            ),
-      ),
+export const Service = <
+  Self extends ServiceLike & {
+    readonly key: string;
+  },
+>(
+  id: Self["key"],
+): Self => {
+  const tag = Context.Service<Self, (...args: any[]) => Effect.Effect<any>>(id);
+  const callable = (...args: any[]) =>
+    tag.use((f: (...a: any[]) => Effect.Effect<any>) =>
+      Effect.all(
+        args.map((arg) => (Effect.isEffect(arg) ? arg : Effect.succeed(arg))),
+        { concurrency: "unbounded" },
+      ).pipe(Effect.flatMap((resolved) => f(...resolved))),
     );
+  return taggedFunction(tag as any, callable) as unknown as Self;
+};
 
-    const evaluate = () =>
-      Effect.all([Self, Service]).pipe(
-        Effect.map(
-          ([resource, fn]) =>
-            (...args: any[]) =>
-              Effect.all(
-                args.map((arg) =>
-                  Effect.isEffect(arg) ? arg : Effect.succeed(arg),
-                ),
-              ).pipe(
-                Effect.flatMap((args) =>
-                  fn(...args).pipe(
-                    Namespace.push((resource as ResourceLike).LogicalId),
-                  ),
-                ),
-              ),
-        ),
-      );
-    // @ts-expect-error
-    return Object.assign(
-      self,
-      // `self` is a Context tag (already an Effect). Spreading the Effect
-      // prototype retargets `yield* Policy` from the raw tag to the resolved
-      // bind-function while keeping `Effect.isEffect(Policy)` true so
-      // `Effect.all`/`forEach` behave.
-      Effectable.Prototype({
-        label: `Policy<${Identifier}>`,
-        evaluate,
-      }),
-      {
-        bind: (...args: any[]) =>
-          evaluate().pipe(Effect.flatMap((fn) => fn(...args))),
-        layer: {
-          succeed: (
-            fn: (
-              self: ResourceLike,
-              ...args: Parameters<Shape>
-            ) => Effect.Effect<void>,
-          ) =>
-            Layer.succeed(
-              self,
-              // @ts-expect-error
-              (...args: Parameters<Shape>) =>
-                Self.use((self) => fn(self as ResourceLike, ...args)),
-            ),
-          effect: (
-            fn: Effect.Effect<
-              (
-                self: ResourceLike,
-                ...args: Parameters<Shape>
-              ) => Effect.Effect<void>
-            >,
-          ) =>
-            Layer.effect(
-              self,
-              // @ts-expect-error
-              Effect.map(
-                fn,
-                (fn) =>
-                  (...args: Parameters<Shape>) =>
-                    Self.use((self) => fn(self as ResourceLike, ...args)),
-              ),
-            ),
-        },
-      },
-    );
-  };
+/**
+ * Resolves the host resource a binding is attaching to (the Worker / Lambda
+ * Function), i.e. `Self`. It is typed WITHOUT a Context requirement because it
+ * is only ever read at DEPLOY time, inside the `if (!globalThis.__ALCHEMY_RUNTIME__)`
+ * guard of a binding's impl layer — at runtime the host is absent and the guard
+ * skips it, so leaking a `Self` requirement onto the runtime client would be
+ * wrong. Narrow it with `isWorker`/`isFunction` before calling `host.bind`.
+ */
+export const Host = Self as unknown as Effect.Effect<ResourceLike>;