alchemy 2.0.0-beta.60 → 2.0.0-beta.62

package/src/AWS/SQS/Queue.ts

@@ -517,9 +517,9 @@ export const QueueProvider = () =>
                 Effect.retry({
                   while: (e) => e._tag === "QueueDeletedRecently",
                   schedule: Schedule.fixed(1000).pipe(
-                    Schedule.tapOutput((i) =>
+                    Schedule.tap(({ attempt }) =>
                       session.note(
-                        `Queue was deleted recently, retrying... ${i + 1}s`,
+                        `Queue was deleted recently, retrying... ${attempt}s`,
                       ),
                     ),
                   ),
@@ -531,9 +531,10 @@ export const QueueProvider = () =>
                 // genuine validation failure, so retry on a bounded schedule.
                 Effect.retry({
                   while: (e) => e._tag === "InvalidParameterValueException",
-                  schedule: Schedule.fixed(1000).pipe(
-                    Schedule.both(Schedule.recurs(30)),
-                  ),
+                  schedule: Schedule.max([
+                    Schedule.fixed(1000),
+                    Schedule.recurs(30),
+                  ]),
                 }),
                 Effect.catchTag("QueueNameExists", () =>
                   sqs.getQueueUrl({ QueueName: queueName }),
@@ -558,9 +559,10 @@ export const QueueProvider = () =>
             .pipe(
               Effect.retry({
                 while: (e) => e._tag === "QueueDoesNotExist",
-                schedule: Schedule.fixed(1000).pipe(
-                  Schedule.both(Schedule.recurs(30)),
-                ),
+                schedule: Schedule.max([
+                  Schedule.fixed(1000),
+                  Schedule.recurs(30),
+                ]),
               }),
               Effect.map((r) => r.Attributes ?? {}),
             );
@@ -588,9 +590,10 @@ export const QueueProvider = () =>
               .pipe(
                 Effect.retry({
                   while: (e) => e._tag === "QueueDoesNotExist",
-                  schedule: Schedule.fixed(1000).pipe(
-                    Schedule.both(Schedule.recurs(30)),
-                  ),
+                  schedule: Schedule.max([
+                    Schedule.fixed(1000),
+                    Schedule.recurs(30),
+                  ]),
                 }),
               );
           }
@@ -603,9 +606,10 @@ export const QueueProvider = () =>
             .pipe(
               Effect.retry({
                 while: (e) => e._tag === "QueueDoesNotExist",
-                schedule: Schedule.fixed(1000).pipe(
-                  Schedule.both(Schedule.recurs(30)),
-                ),
+                schedule: Schedule.max([
+                  Schedule.fixed(1000),
+                  Schedule.recurs(30),
+                ]),
               }),
               Effect.map((r) => r.Tags ?? {}),
               Effect.catch(() => Effect.succeed({} as Record<string, string>)),
@@ -631,9 +635,10 @@ export const QueueProvider = () =>
               .pipe(
                 Effect.retry({
                   while: (e) => e._tag === "QueueDoesNotExist",
-                  schedule: Schedule.fixed(1000).pipe(
-                    Schedule.both(Schedule.recurs(30)),
-                  ),
+                  schedule: Schedule.max([
+                    Schedule.fixed(1000),
+                    Schedule.recurs(30),
+                  ]),
                 }),
               );
           }
@@ -643,9 +648,10 @@ export const QueueProvider = () =>
               .pipe(
                 Effect.retry({
                   while: (e) => e._tag === "QueueDoesNotExist",
-                  schedule: Schedule.fixed(1000).pipe(
-                    Schedule.both(Schedule.recurs(30)),
-                  ),
+                  schedule: Schedule.max([
+                    Schedule.fixed(1000),
+                    Schedule.recurs(30),
+                  ]),
                 }),
               );
           }

package/src/AWS/StateStore/State.ts

@@ -416,7 +416,7 @@ const ensureStateBucket = (bucket: string, region: string) =>
       .headBucket({ Bucket: bucket })
       .pipe(
         Effect.retry(
-          Schedule.spaced("1 second").pipe(Schedule.both(Schedule.recurs(15))),
+          Schedule.max([Schedule.spaced("1 second"), Schedule.recurs(15)]),
         ),
       );
   }).pipe(
@@ -430,8 +430,9 @@ const ensureStateBucket = (bucket: string, region: string) =>
         e._tag === "OperationAborted" ||
         e._tag === "NoSuchBucket" ||
         e._tag === "NotFound",
-      schedule: Schedule.spaced("2 seconds").pipe(
-        Schedule.both(Schedule.recurs(10)),
-      ),
+      schedule: Schedule.max([
+        Schedule.spaced("2 seconds"),
+        Schedule.recurs(10),
+      ]),
     }),
   );

package/src/AWS/Website/AssetDeployment.ts

@@ -380,12 +380,16 @@ const retryForBucketReadiness = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
   effect.pipe(
     Effect.retry({
       while: isMissingBucket,
-      schedule: Schedule.exponential("100 millis").pipe(
-        Schedule.both(Schedule.recurs(30)),
-        Schedule.map(([duration]) =>
-          Duration.isGreaterThan(duration, Duration.seconds(2))
-            ? Duration.seconds(2)
-            : duration,
+      schedule: Schedule.max([
+        Schedule.exponential("100 millis"),
+        Schedule.recurs(30),
+      ]).pipe(
+        Schedule.modifyDelay(({ duration }) =>
+          Effect.succeed(
+            Duration.isGreaterThan(duration, Duration.seconds(2))
+              ? Duration.seconds(2)
+              : duration,
+          ),
         ),
       ),
     }),

package/src/Apply.ts

@@ -465,7 +465,13 @@ const executeNode = (
     // ── noop ──
 
     if (node.action === "noop") {
-      // No work to do — the persisted attr is already stable.
+      // No work to do — the persisted attr is already stable. If the row was
+      // persisted under a legacy type name (the type was since renamed and
+      // carries the old name as an alias), migrate it to the canonical type
+      // so the state stops depending on the alias.
+      if (node.state.resourceType !== node.resource.Type) {
+        yield* commit({ ...node.state, resourceType: node.resource.Type });
+      }
       yield* signalReadyStable;
       yield* storeAndSignal({
         output: node.state.attr,
@@ -578,6 +584,7 @@ const executeNode = (
           attr = yield* node.provider
             .precreate({
               id: logicalId,
+              fqn,
               news: node.props,
               session: scopedSession,
               instanceId,
@@ -637,6 +644,7 @@ const executeNode = (
         attr = yield* node.provider
           .reconcile({
             id: logicalId,
+            fqn,
             news,
             instanceId,
             bindings: bindingOutputs,
@@ -759,6 +767,7 @@ const executeNode = (
         const attr = yield* node.provider
           .reconcile({
             id: logicalId,
+            fqn,
             news,
             instanceId,
             bindings: bindingOutputs,
@@ -881,6 +890,7 @@ const executeNode = (
               yield* node.provider
                 .delete({
                   id: logicalId,
+                  fqn,
                   instanceId: old.instanceId,
                   olds: old.props as never,
                   output: old.attr,
@@ -927,6 +937,7 @@ const executeNode = (
           attr = yield* node.provider
             .precreate({
               id: logicalId,
+              fqn,
               news: node.props,
               session: scopedSession,
               instanceId,
@@ -987,6 +998,7 @@ const executeNode = (
         attr = yield* node.provider
           .reconcile({
             id: logicalId,
+            fqn,
             news,
             instanceId,
             bindings: bindingOutputs,
@@ -1340,6 +1352,7 @@ const converge = Effect.fn(function* (
       const attr = yield* node.provider
         .reconcile({
           id: logicalId,
+          fqn,
           news: newProps,
           instanceId,
           bindings: newBindings,
@@ -1642,6 +1655,7 @@ const collectGarbage = Effect.fn(function* (
               yield* provider
                 .delete({
                   id: logicalId,
+                  fqn,
                   instanceId,
                   olds: props as never,
                   output: attr,

package/src/Auth/AuthProvider.ts

@@ -5,6 +5,17 @@ import * as Schema from "effect/Schema";
 import * as Semaphore from "effect/Semaphore";
 import { withLock } from "./Lock.ts";
 
+/**
+ * Canonical web host for OAuth provider-agnostic landing pages
+ * (`/auth/success`, `/auth/error`). The CLI's loopback server 302s the
+ * browser to one of these after handling the OAuth callback. Centralized
+ * here so the redirect target lives in exactly one place across all
+ * provider OAuth clients.
+ */
+export const AUTH_LANDING_HOST = "https://v2.alchemy.run";
+export const AUTH_SUCCESS_URL = `${AUTH_LANDING_HOST}/auth/success`;
+export const AUTH_ERROR_URL = `${AUTH_LANDING_HOST}/auth/error`;
+
 /**
  * Methods on an {@link AuthProviderImpl} that mutate (or could trigger
  * mutation of) on-disk credentials. The factory wraps these in a

package/src/Auth/Lock.ts

@@ -4,6 +4,23 @@ import * as fs from "node:fs/promises";
 import * as path from "pathe";
 import { rootDir } from "./Profile.ts";
 
+/**
+ * Make a lock key safe to use as a file name on every platform.
+ *
+ * Keys are derived from user-controlled values (profile names), which
+ * have shown up in production containing shell placeholders like
+ * `${ALCHEMY_PROFILE:-default}` — `:`/`{`/`$` are invalid in Windows
+ * file names and mkdir fails with EINVAL. Collapse anything outside a
+ * conservative allow-list to `_`.
+ *
+ * @internal exported for unit testing.
+ */
+export const sanitizeLockKey = (key: string): string =>
+  key.replace(/[^A-Za-z0-9._-]/g, "_");
+
+/** File-system errors that mean "we cannot lock here at all". */
+const UNLOCKABLE_FS_CODES = new Set(["EROFS", "EACCES", "EPERM", "ENOSPC"]);
+
 /**
  * Serialise execution of `effect` so no two callers ever run inside the
  * critical section concurrently for the same `key`, both within this
@@ -13,6 +30,11 @@ import { rootDir } from "./Profile.ts";
  * holders by path (so same-process callers wait via `retries`) and uses
  * an OS file lock for cross-process coordination, with stale-lock
  * detection at 60s.
+ *
+ * Locking is best-effort: on file systems where the lock directory
+ * cannot be created at all (read-only home in containers/CI), the
+ * effect runs unserialised with a warning instead of failing — a
+ * missed lock only risks a redundant credential refresh.
  */
 export const withLock = <A, E, R>(
   key: string,
@@ -22,26 +44,48 @@ export const withLock = <A, E, R>(
   // `Profile -> AuthProvider -> Lock -> Profile` import cycle never reads
   // `rootDir` before `Profile.ts` has finished initialising it.
   const lockDir = path.join(rootDir, "lock");
-  const lockPath = path.join(lockDir, `${key}.lock`);
+  const lockPath = path.join(lockDir, `${sanitizeLockKey(key)}.lock`);
   return Effect.acquireUseRelease(
     Effect.promise(async () => {
-      await fs.mkdir(lockDir, { recursive: true });
-      return await lock(lockPath, {
-        retries: { retries: 600, minTimeout: 50, maxTimeout: 50 },
-        // The holder refreshes the lockfile mtime on a timer. Under heavy
-        // load (e.g. a full test run saturating every core) that timer can
-        // be starved for several seconds, so keep the stale threshold well
-        // above any realistic starvation pause.
-        stale: 30_000,
-        realpath: false,
-        // The library's default handler throws from a timer callback,
-        // which surfaces as an uncaught exception and kills the process.
-        // A compromised auth lock is benign here (worst case two refreshes
-        // race), so log and continue.
-        onCompromised: (err) => {
-          console.warn(`auth lock compromised (continuing): ${err.message}`);
-        },
-      });
+      try {
+        await fs.mkdir(lockDir, { recursive: true });
+        return await lock(lockPath, {
+          retries: { retries: 600, minTimeout: 50, maxTimeout: 50 },
+          // The holder refreshes the lockfile mtime on a timer. Under heavy
+          // load (e.g. a full test run saturating every core) that timer can
+          // be starved for several seconds, so keep the stale threshold well
+          // above any realistic starvation pause.
+          stale: 30_000,
+          realpath: false,
+          // The library's default handler throws from a timer callback,
+          // which surfaces as an uncaught exception and kills the process.
+          // A compromised auth lock is benign here (worst case two refreshes
+          // race), so log and continue.
+          onCompromised: (err) => {
+            console.warn(`auth lock compromised (continuing): ${err.message}`);
+          },
+        });
+      } catch (err) {
+        const code = (err as NodeJS.ErrnoException).code;
+        if (code !== undefined && UNLOCKABLE_FS_CODES.has(code)) {
+          console.warn(
+            `auth lock unavailable (${code} at '${lockPath}') — continuing without cross-process locking`,
+          );
+          return async () => {};
+        }
+        if (
+          err instanceof Error &&
+          err.message.includes("already being held")
+        ) {
+          throw new Error(
+            `Timed out waiting for the alchemy auth lock '${lockPath}' — another alchemy ` +
+              `process has held it for over 30s. If no other alchemy process is running, ` +
+              `delete the lock file and retry.`,
+            { cause: err },
+          );
+        }
+        throw err;
+      }
     }),
     () => effect,
     (release) => Effect.promise(() => release().catch(() => {})),

package/src/Axiom/AuthProvider.ts

@@ -328,9 +328,6 @@ export const AxiomAuth = AuthProviderLayer<
             Match.exhaustive,
           );
         }),
-        Effect.catch((e) =>
-          Console.error(`  Failed to retrieve credentials: ${e}`),
-        ),
       );
 
     return {

package/src/Bundle/PurePlugin.ts

@@ -314,6 +314,11 @@ export async function resolvePackageInfo(
   let foundInfo: PackageInfo | null = null;
   // Hard ceiling to prevent runaway walks on weird ids.
   for (let i = 0; i < 64; i++) {
+    // Never walk above a `node_modules` boundary: the owning package of a
+    // `node_modules/<pkg>/...` id lives at or below `<pkg>`. Climbing past
+    // it can latch onto an unrelated package.json higher up (e.g. a stray
+    // one at the filesystem root) and poison the shared-ancestor cache.
+    if (path.basename(dir) === "node_modules") break;
     const cached = cache.get(dir);
     if (cached !== undefined) {
       cacheDescendants(cache, visited, dir, cached);
@@ -348,8 +353,16 @@ export async function resolvePackageInfo(
     dir = parent;
   }
   if (foundInfo !== null && foundRoot !== null) {
-    cacheDescendants(cache, visited, foundRoot, foundInfo);
-    return foundInfo;
+    // A nameless package.json (e.g. a nested `dist/package.json` holding
+    // only `{"type": "module"}`, or a stray file high up the tree) can't be
+    // matched against the configured patterns — prefer the path-derived
+    // `node_modules/<pkg>` name when one exists.
+    const info =
+      foundInfo.name === null && fastName !== null
+        ? { name: fastName, sideEffects: foundInfo.sideEffects }
+        : foundInfo;
+    cacheDescendants(cache, visited, foundRoot, info);
+    return info;
   }
   // No `package.json` found on disk. If we have a path-derived name
   // (from a `node_modules/<pkg>/...` segment), use it with no

package/src/Bundle/Vite.ts

@@ -1,6 +1,5 @@
 import type { NonEmptyArray } from "effect/Array";
 import * as Cause from "effect/Cause";
-import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
@@ -45,11 +44,18 @@ export const viteBuildOutputPlugin = Effect.fn(function* ({
     string,
     Effect.Effect<BundleFile, BundleError>
   >();
-  const deferred = yield* Deferred.make<ViteBuildOutput, BundleError>();
 
   const plugin: vite.Plugin = {
     name: "alchemy:build-output",
     sharedDuringBuild: true,
+    // Collect the client output directory and server chunks as each
+    // environment writes its bundle. We deliberately do NOT resolve the build
+    // result from a `buildApp` hook: on Vite 8, when a project declares no
+    // `builder.buildApp` (e.g. a plain client-only SPA), `builder.buildApp()`
+    // runs post-order `buildApp` hooks *before* the default environment builds,
+    // so a hook fires while the output is still empty (issue #792). Instead,
+    // `viteBuild` reads `output` *after* `builder.buildApp()` resolves — by
+    // which point every environment that actually built has run `writeBundle`.
     async writeBundle(_, bundle) {
       if (this.environment.name === "client") {
         clientDirectory = path.resolve(
@@ -107,18 +113,6 @@ export const viteBuildOutputPlugin = Effect.fn(function* ({
         }),
       );
     },
-    buildApp: {
-      order: "post",
-      async handler() {
-        Deferred.doneUnsafe(
-          deferred,
-          Effect.succeed({
-            clientDirectory,
-            serverBundle: makeServerBundle(),
-          }),
-        );
-      },
-    },
   };
 
   // The server bundle may include chunks from more than one Vite environment, so we need to prefix them with the environment-specific output directory.
@@ -199,6 +193,13 @@ export const viteBuildOutputPlugin = Effect.fn(function* ({
 
   return {
     plugin,
-    output: Deferred.await(deferred),
+    // Read lazily so callers observe the state collected during the build.
+    // Only safe to await *after* `builder.buildApp()` has resolved.
+    output: Effect.sync(
+      (): ViteBuildOutput => ({
+        clientDirectory,
+        serverBundle: makeServerBundle(),
+      }),
+    ),
   };
 });

package/src/Cli/commands/_shared.ts

@@ -1,8 +1,10 @@
 import * as Cause from "effect/Cause";
 import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
 import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
 import * as Option from "effect/Option";
 import * as Path from "effect/Path";
 import * as S from "effect/Schema";
@@ -16,10 +18,17 @@ import {
   AuthError,
   AuthProviders,
 } from "../../Auth/AuthProvider.ts";
-import type { AlchemyProfileProviders } from "../../Auth/Profile.ts";
-import type * as Stack from "../../Stack.ts";
+import {
+  type AlchemyProfileProviders,
+  ALCHEMY_PROFILE,
+  withProfileOverride,
+} from "../../Auth/Profile.ts";
+import * as Stack from "../../Stack.ts";
+import { Stage } from "../../Stage.ts";
 import { recordCli } from "../../Telemetry/Metrics.ts";
 import { PromptCancelled } from "../../Util/Clank.ts";
+import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
+import { fileLogger } from "../../Util/FileLogger.ts";
 
 export const USER = Config.string("USER").pipe(
   Config.orElse(() => Config.string("USERNAME")),
@@ -147,10 +156,22 @@ export const script = Argument.file("main", {
 
 export const profile = Flag.string("profile").pipe(
   Flag.withDescription(
-    "Auth profile to use (~/.alchemy/profiles.json). Defaults to 'default' or $ALCHEMY_PROFILE.",
+    "Auth profile to use (~/.alchemy/profiles.json). Defaults to $ALCHEMY_PROFILE or 'default'.",
   ),
   Flag.optional,
-  Flag.map(Option.getOrElse(() => "default")),
+  Flag.mapEffect(
+    Effect.fn(function* (profile) {
+      // --profile wins; otherwise fall back to $ALCHEMY_PROFILE (which
+      // itself defaults to "default"). Without this, the flag's default
+      // would shadow the env var via withProfileOverride.
+      if (Option.isSome(profile)) {
+        return profile.value;
+      }
+      return yield* ALCHEMY_PROFILE.pipe(
+        Effect.catch(() => Effect.succeed("default")),
+      );
+    }),
+  ),
 );
 
 export const resourceFilter = Flag.string("filter").pipe(
@@ -296,7 +317,19 @@ export const printProfile = Effect.fn(function* (
       }
       continue;
     }
-    yield* provider.prettyPrint(profile, cfg);
+    // A provider's `prettyPrint` catches its own credential-resolution
+    // failures, but some resolve paths `Effect.orDie` (e.g. AWS SSO with an
+    // expired token), which escapes as a defect. Contain it here — via
+    // `Console.log` so the message stays on stdout under this provider's
+    // header instead of interleaving on stderr — so one broken provider
+    // can't abort rendering the rest of the profile.
+    yield* provider.prettyPrint(profile, cfg).pipe(
+      Effect.catchCause((cause) => {
+        const error = Cause.squash(cause);
+        const message = error instanceof Error ? error.message : String(error);
+        return Console.log(`  Failed to retrieve credentials: ${message}`);
+      }),
+    );
   }
 });
 
@@ -326,3 +359,84 @@ export const importStack = Effect.fn(function* (main: string) {
     state: Layer.Layer<never>;
   };
 });
+
+/**
+ * Placeholder {@link Stack.Stack} value used while building a stack's
+ * `providers()` layer out of band. No real resources exist yet — we only
+ * want the layer's provider/auth registrations and cloud-environment
+ * services, so `resources`/`bindings`/`actions` are empty and the stage is a
+ * sentinel.
+ */
+const placeholderStack = (name: string) => ({
+  actions: {},
+  bindings: {},
+  name,
+  resources: {},
+  stage: "placeholder",
+});
+
+export interface BuildStackProvidersOptions {
+  /** Stack entrypoint to import (e.g. `"alchemy.run.ts"`). */
+  main: string;
+  envFile: Option.Option<string>;
+  profile: string;
+  /**
+   * Registry to populate. Pass a pre-seeded registry (e.g. one that already
+   * has built-in providers) to layer the stack's providers on top of it,
+   * overriding by name. Defaults to a fresh empty registry.
+   */
+  registry?: AuthProviders["Service"];
+  /**
+   * Logger layer used during the build. Defaults to the file logger
+   * (`out`). `alchemy unsafe nuke` overrides this to log to the console in
+   * debug mode.
+   */
+  logger?: Layer.Layer<never, never, never>;
+  /**
+   * Extra layer merged into the placeholder scaffold — e.g.
+   * `Layer.succeed(MinimumLogLevel, ...)`, which sets a fiber-ref default
+   * and so contributes no context service (`Layer<never>`).
+   */
+  extra?: Layer.Layer<never, never, never>;
+}
+
+/**
+ * Import a stack entrypoint and build its `providers()` (+ `state()`) layer
+ * out of band against placeholder {@link Stack.Stack}/{@link Stage} services,
+ * so its `AuthProviderLayer` registrations land in an {@link AuthProviders}
+ * registry and the built context holds every resource provider plus the
+ * cloud-environment services their operations need.
+ *
+ * Shared by `alchemy login`, `alchemy profile show`, and `alchemy unsafe
+ * nuke`. The caller decides what to do with the result — use `authProviders`
+ * (login / profile show) or `context` (nuke) — and whether a missing/invalid
+ * entrypoint is fatal (login / nuke let it propagate) or best-effort
+ * (profile show wraps the call in `Effect.catchCause`).
+ */
+export const buildStackProviders = Effect.fn("buildStackProviders")(function* (
+  options: BuildStackProvidersOptions,
+) {
+  const authProviders = options.registry ?? {};
+  const stackEffect = yield* importStack(options.main);
+  const configProvider = withProfileOverride(
+    yield* loadConfigProvider(options.envFile),
+    options.profile,
+  );
+  const context = yield* Layer.build(
+    (stackEffect.providers ?? Layer.empty).pipe(
+      Layer.provideMerge(stackEffect.state ?? Layer.empty),
+      Layer.provideMerge(
+        Layer.mergeAll(
+          Layer.succeed(AuthProviders, authProviders),
+          ConfigProvider.layer(configProvider),
+          options.logger ??
+            Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
+          Layer.succeed(Stage, "placeholder"),
+          Layer.succeed(Stack.Stack, placeholderStack(stackEffect.stackName)),
+          options.extra ?? Layer.empty,
+        ),
+      ),
+    ),
+  );
+  return { authProviders, context, stackEffect };
+});

package/src/Cli/commands/login.ts

@@ -1,21 +1,13 @@
 import * as Config from "effect/Config";
-import * as ConfigProvider from "effect/ConfigProvider";
 import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
 import { Command, Flag } from "effect/unstable/cli";
 
-import { AuthProviders } from "../../Auth/AuthProvider.ts";
-import { AlchemyProfile, withProfileOverride } from "../../Auth/Profile.ts";
-import { Stage } from "../../Stage.ts";
-import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
-import { fileLogger } from "../../Util/FileLogger.ts";
+import { AlchemyProfile } from "../../Auth/Profile.ts";
 
-import { Stack } from "../../Stack.ts";
 import {
+  buildStackProviders,
   envFile,
-  importStack,
   instrumentCommand,
   printProfile,
   profile,
@@ -46,36 +38,13 @@ export const loginCommand = Command.make(
     }),
   )(
     Effect.fn(function* ({ main, envFile, profile, configure }) {
-      const stackEffect = yield* importStack(main);
-
-      const authProviders: AuthProviders["Service"] = {};
-
-      // build the state + providers layer to capture the Auth Providers
-      yield* Layer.build(
-        (stackEffect.providers ?? Layer.empty).pipe(
-          Layer.provideMerge(stackEffect.state ?? Layer.empty),
-          Layer.provideMerge(
-            Layer.mergeAll(
-              Layer.succeed(AuthProviders, authProviders),
-              ConfigProvider.layer(
-                withProfileOverride(
-                  yield* loadConfigProvider(envFile),
-                  profile,
-                ),
-              ),
-              Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
-              Layer.succeed(Stage, "placeholder"),
-              Layer.succeed(Stack, {
-                actions: {},
-                bindings: {},
-                name: stackEffect.stackName,
-                resources: {},
-                stage: "placeholder",
-              }),
-            ),
-          ),
-        ),
-      );
+      // Build the user's providers() (+ state) layer to capture the auth
+      // providers their stack wires up.
+      const { authProviders } = yield* buildStackProviders({
+        main,
+        envFile,
+        profile,
+      });
 
       const profiles = yield* AlchemyProfile;