alchemy 2.0.0-beta.60 → 2.0.0-beta.62

package/src/Cli/commands/logs.ts

@@ -126,6 +126,7 @@ export const logsCommand = Command.make(
 
             const lines = yield* provider.logs({
               id: resource.LogicalId,
+              fqn,
               instanceId: (resourceState as any).instanceId,
               props: (resourceState as any).props,
               output: (resourceState as any).attr,

package/src/Cli/commands/nuke.ts

@@ -1,4 +1,3 @@
-import * as ConfigProvider from "effect/ConfigProvider";
 import * as Console from "effect/Console";
 import type * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
@@ -8,22 +7,16 @@ import { MinimumLogLevel } from "effect/References";
 import { Command, Flag } from "effect/unstable/cli";
 import picomatch from "picomatch";
 
-import { AuthProviders } from "../../Auth/AuthProvider.ts";
-import { withProfileOverride } from "../../Auth/Profile.ts";
 import type { ProviderService } from "../../Provider.ts";
-import { Stack } from "../../Stack.ts";
-import { Stage } from "../../Stage.ts";
 import * as Clank from "../../Util/Clank.ts";
-import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
-import { fileLogger } from "../../Util/FileLogger.ts";
 import type { ScopedPlanStatusSession } from "../Cli.ts";
 import { isNonInteractive } from "../selectCli.ts";
 import * as NukeUI from "../tui/components/Nuke.tsx";
 
 import {
+  buildStackProviders,
   dryRun,
   envFile,
-  importStack,
   instrumentCommand,
   profile,
   script,
@@ -311,42 +304,18 @@ const nukeCommand = Command.make(
       // log stream isn't clobbered by the progress renderer.
       const debug = !!process.env.DEBUG;
       const interactive = !isNonInteractive() && !debug;
-      const stackEffect = yield* importStack(main);
-      const authProviders: AuthProviders["Service"] = {};
-
-      // Build the state + providers layer (same wiring as `alchemy login`) so
-      // that the resulting context holds every resource provider plus the
-      // cloud-environment services their `list`/`delete` need at call time.
-      const context = yield* Layer.build(
-        (stackEffect.providers ?? Layer.empty).pipe(
-          Layer.provideMerge(stackEffect.state ?? Layer.empty),
-          Layer.provideMerge(
-            Layer.mergeAll(
-              Layer.succeed(AuthProviders, authProviders),
-              ConfigProvider.layer(
-                withProfileOverride(
-                  yield* loadConfigProvider(envFile),
-                  profile,
-                ),
-              ),
-              debug
-                ? Logger.layer([Logger.defaultLogger])
-                : Logger.layer([fileLogger("out")], {
-                    mergeWithExisting: true,
-                  }),
-              Layer.succeed(MinimumLogLevel, debug ? "Debug" : "Info"),
-              Layer.succeed(Stage, "placeholder"),
-              Layer.succeed(Stack, {
-                actions: {},
-                bindings: {},
-                name: stackEffect.stackName,
-                resources: {},
-                stage: "placeholder",
-              }),
-            ),
-          ),
-        ),
-      );
+
+      // Build the user's providers() (+ state) layer so the resulting context
+      // holds every resource provider plus the cloud-environment services
+      // their `list`/`delete` need at call time. DEBUG=1 routes provider logs
+      // to the console at Debug level instead of the .alchemy/log/out file.
+      const { context } = yield* buildStackProviders({
+        main,
+        envFile,
+        profile,
+        logger: debug ? Logger.layer([Logger.defaultLogger]) : undefined,
+        extra: Layer.succeed(MinimumLogLevel, debug ? "Debug" : "Info"),
+      });
 
       const discovered = discoverProviders(context as Context.Context<never>);
 
@@ -521,6 +490,9 @@ const nukeCommand = Command.make(
                 item.provider
                   .delete({
                     id: displayName(item.attr),
+                    // Enumerated straight from the cloud, so there is no
+                    // Alchemy namespace — an un-namespaced fqn is just the id.
+                    fqn: displayName(item.attr),
                     instanceId: "",
                     olds: item.attr as never,
                     output: item.attr as never,

package/src/Cli/commands/profile.ts

@@ -3,7 +3,9 @@ import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Logger from "effect/Logger";
+import * as Option from "effect/Option";
 import { Command } from "effect/unstable/cli";
+import * as Argument from "effect/unstable/cli/Argument";
 
 import { AuthProviders } from "../../Auth/AuthProvider.ts";
 import { CredentialsStore } from "../../Auth/Credentials.ts";
@@ -18,19 +20,98 @@ import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
 import { fileLogger } from "../../Util/FileLogger.ts";
 
 import {
+  buildStackProviders,
   envFile,
   instrumentCommand,
   printProfile,
   profile,
 } from "./_shared.ts";
 
+/**
+ * The auth providers Alchemy ships with. Built into the registry as a
+ * baseline so `profile show` can pretty-print any provider a profile
+ * mentions, even one the current stack doesn't wire up.
+ */
+const builtinAuth = Layer.mergeAll(
+  AwsAuth,
+  AxiomAuth,
+  CloudflareAuth,
+  GitHubAuth,
+  NeonAuth,
+  PlanetscaleAuth,
+);
+
+/**
+ * Entrypoint whose `providers()` layer contributes the user's own auth
+ * providers. Optional and best-effort — if it's missing or fails to load,
+ * `profile show` still renders the built-in providers.
+ */
+const mainFile = Argument.file("main").pipe(
+  Argument.withDescription(
+    "Stack entrypoint whose providers() should be used, defaults to alchemy.run.ts",
+  ),
+  Argument.withDefault("alchemy.run.ts"),
+);
+
+/**
+ * Populate an {@link AuthProviders} registry for display: the built-in
+ * providers first, then the user's stack `providers()` layer on top so a
+ * customized provider (same name) overrides the built-in one. Loading the
+ * user's stack is best-effort — a missing or invalid entrypoint leaves the
+ * built-ins in place.
+ *
+ * Registration happens as a side effect of building each layer (see
+ * `AuthProviderLayer`), and later builds overwrite earlier entries by name,
+ * so build order is what gives the user's providers precedence.
+ */
+export const collectAuthProviders = Effect.fn("collectAuthProviders")(
+  function* (options: {
+    main: string;
+    envFile: Option.Option<string>;
+    profile: string;
+  }) {
+    const authProviders: AuthProviders["Service"] = {};
+
+    // 1. Built-in providers first (baseline).
+    yield* Layer.build(
+      Layer.provide(
+        builtinAuth,
+        Layer.mergeAll(
+          Layer.succeed(AuthProviders, authProviders),
+          ConfigProvider.layer(
+            withProfileOverride(
+              yield* loadConfigProvider(options.envFile),
+              options.profile,
+            ),
+          ),
+          Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
+        ),
+      ),
+    );
+
+    // 2. The user's own providers() layer on top — building into the same
+    //    registry overrides the built-ins by name. Best-effort: swallow
+    //    load/build failures (including a missing entrypoint) so display
+    //    still works with just the built-ins.
+    yield* buildStackProviders({ ...options, registry: authProviders }).pipe(
+      Effect.catchCause((cause) =>
+        Effect.logDebug("profile show: could not load user stack providers", {
+          cause,
+        }),
+      ),
+    );
+
+    return authProviders;
+  },
+);
+
 const showCommand = Command.make(
   "show",
-  { profile, envFile },
+  { profile, envFile, main: mainFile },
   instrumentCommand("profile.show", (a: { profile: string }) => ({
     "alchemy.profile": a.profile,
   }))(
-    Effect.fn(function* ({ profile, envFile }) {
+    Effect.fn(function* ({ profile, envFile, main }) {
       const profiles = yield* AlchemyProfile;
       const stored = yield* profiles.getProfile(profile);
       if (stored == null) {
@@ -45,32 +126,13 @@ const showCommand = Command.make(
         return;
       }
 
-      const authProviders: AuthProviders["Service"] = {};
-      const authRegistry = Layer.succeed(AuthProviders, authProviders);
-      const services = Layer.mergeAll(
-        authRegistry,
-        ConfigProvider.layer(
-          withProfileOverride(yield* loadConfigProvider(envFile), profile),
-        ),
-        Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
-        // Building these layers triggers their AuthProviderLayer effect, which
-        // registers the provider into the shared `authProviders` registry.
-        Layer.provide(
-          Layer.mergeAll(
-            AwsAuth,
-            AxiomAuth,
-            CloudflareAuth,
-            GitHubAuth,
-            NeonAuth,
-            PlanetscaleAuth,
-          ),
-          authRegistry,
-        ),
-      );
+      const authProviders = yield* collectAuthProviders({
+        main,
+        envFile,
+        profile,
+      });
 
-      yield* printProfile(profile, stored, authProviders).pipe(
-        Effect.provide(services),
-      );
+      yield* printProfile(profile, stored, authProviders);
     }),
   ),
 );

package/src/Cli/commands/sync.ts

@@ -0,0 +1,123 @@
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Option from "effect/Option";
+import * as Command from "effect/unstable/cli/Command";
+import * as Flag from "effect/unstable/cli/Flag";
+
+import { AdoptPolicy } from "../../AdoptPolicy.ts";
+import { ArtifactStore, createArtifactStore } from "../../Artifacts.ts";
+import { AuthProviders } from "../../Auth/AuthProvider.ts";
+import { withProfileOverride } from "../../Auth/Profile.ts";
+import * as CLI from "../../Cli/Cli.ts";
+import { Stage } from "../../Stage.ts";
+import * as Sync from "../../Sync.ts";
+import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
+import { fileLogger } from "../../Util/FileLogger.ts";
+
+import {
+  envFile,
+  importStack,
+  instrumentCommand,
+  profile,
+  script,
+  stage,
+  yes,
+} from "./_shared.ts";
+
+const dryRunFlag = Flag.boolean("dry-run").pipe(
+  Flag.withDescription(
+    "Detect and report drift without repairing it (no reconcile, no state writes)",
+  ),
+  Flag.withDefault(false),
+);
+
+export interface SyncArgs {
+  main: string;
+  stage: string;
+  envFile: Option.Option<string>;
+  profile?: string;
+  dryRun?: boolean;
+  yes?: boolean;
+}
+
+export const execSync = Effect.fn(function* ({
+  main,
+  stage,
+  envFile,
+  profile,
+  dryRun = false,
+  yes = false,
+}: SyncArgs) {
+  const stackEffect = yield* importStack(main);
+
+  const services = Layer.mergeAll(
+    Layer.succeed(AdoptPolicy, false),
+    Layer.succeed(ArtifactStore, createArtifactStore()),
+    Layer.succeed(
+      AuthProviders,
+      yield* Effect.serviceOption(AuthProviders).pipe(
+        Effect.map(Option.getOrElse(() => ({}))),
+      ),
+    ),
+    ConfigProvider.layer(
+      withProfileOverride(yield* loadConfigProvider(envFile), profile),
+    ),
+    Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
+    Layer.succeed(Stage, stage),
+  );
+
+  yield* Effect.gen(function* () {
+    const cli = yield* CLI.Cli;
+    const stack = yield* stackEffect;
+
+    yield* Effect.gen(function* () {
+      // Detection pass: project the drift onto the engine's Plan shape so
+      // the CLI renders a sync exactly like a deploy plan (ink TUI when
+      // interactive, plain logging otherwise).
+      const { result, plan } = yield* Sync.plan({
+        name: stack.name,
+        stage: stack.stage,
+      });
+
+      if (dryRun) {
+        yield* cli.displayPlan(plan);
+        return;
+      }
+
+      const hasChanges = Object.values(result.resources).some(
+        (r) => r.action === "drifted" || r.action === "missing",
+      );
+      if (!yes && hasChanges) {
+        const approved = yield* cli.approvePlan(plan);
+        if (!approved) {
+          return;
+        }
+      }
+
+      // Repair pass: re-observes the cloud (rather than trusting the
+      // detection snapshot) and reports progress through the session.
+      const session = yield* cli.startApplySession(plan);
+      yield* Sync.sync({ name: stack.name, stage: stack.stage }, { session });
+    }).pipe(Effect.provide(stack.services));
+  }).pipe(Effect.provide(services));
+});
+
+export const syncCommand = Command.make(
+  "sync",
+  {
+    dryRun: dryRunFlag,
+    main: script,
+    envFile,
+    stage,
+    yes,
+    profile,
+  },
+  instrumentCommand("sync", (args: SyncArgs) => ({
+    "alchemy.stage": args.stage,
+    "alchemy.profile": args.profile,
+    "alchemy.main": args.main,
+    "alchemy.dry_run": !!args.dryRun,
+  }))(execSync),
+);

package/src/Cli/commands/tail.ts

@@ -104,6 +104,7 @@ export const tailCommand = Command.make(
               logicalId: resource.LogicalId,
               stream: provider.tail({
                 id: resource.LogicalId,
+                fqn,
                 instanceId: (resourceState as any).instanceId,
                 props: (resourceState as any).props,
                 output: (resourceState as any).attr,

package/src/Cli/main.ts

@@ -26,6 +26,7 @@ import { logsCommand } from "./commands/logs.ts";
 import { unsafeCommand } from "./commands/nuke.ts";
 import { profileCommand } from "./commands/profile.ts";
 import { stateCommand } from "./commands/state.ts";
+import { syncCommand } from "./commands/sync.ts";
 import { tailCommand } from "./commands/tail.ts";
 import { selectCli } from "./selectCli.ts";
 
@@ -42,6 +43,7 @@ const root = Command.make("alchemy", {}).pipe(
     loginCommand,
     profileCommand,
     stateCommand,
+    syncCommand,
     unsafeCommand,
   ]),
 );

package/src/Cloudflare/AI/CustomTopics.ts

@@ -101,7 +101,9 @@ export type CustomTopics = Resource<
  *
  * @see https://developers.cloudflare.com/waf/detections/firewall-for-ai/
  */
-export const CustomTopics = Resource<CustomTopics>(TypeId);
+export const CustomTopics = Resource<CustomTopics>(TypeId, {
+  aliases: ["Cloudflare.AiSecurity.CustomTopics"],
+});
 
 /**
  * Returns true if the given value is a CustomTopics resource.

package/src/Cloudflare/AI/Dataset.ts

@@ -165,7 +165,9 @@ export type Dataset = Resource<
  *
  * @see https://developers.cloudflare.com/ai-gateway/evaluations/set-up-evaluations/
  */
-export const Dataset = Resource<Dataset>(TypeId);
+export const Dataset = Resource<Dataset>(TypeId, {
+  aliases: ["Cloudflare.AiGateway.Dataset"],
+});
 
 /**
  * Returns true if the given value is a Dataset resource.

package/src/Cloudflare/AI/Evaluation.ts

@@ -124,7 +124,9 @@ export type Evaluation = Resource<
  *
  * @see https://developers.cloudflare.com/ai-gateway/evaluations/
  */
-export const Evaluation = Resource<Evaluation>(TypeId);
+export const Evaluation = Resource<Evaluation>(TypeId, {
+  aliases: ["Cloudflare.AiGateway.Evaluation"],
+});
 
 /**
  * Returns true if the given value is an Evaluation resource.

package/src/Cloudflare/AI/Gateway.ts

@@ -5,7 +5,7 @@ import * as Stream from "effect/Stream";
 import { deepEqual, isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
-import { Resource } from "../../Resource.ts";
+import { isResourceOfType, Resource } from "../../Resource.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Providers } from "../Providers.ts";
 
@@ -302,10 +302,7 @@ const nullIfZero = (value: number | null | undefined): number | null =>
   value == null || value === 0 ? null : value;
 
 export const isAiGateway = (value: unknown): value is Gateway =>
-  typeof value === "object" &&
-  value !== null &&
-  "Type" in value &&
-  (value as Gateway).Type === "Cloudflare.AI.Gateway";
+  isResourceOfType(value, "Cloudflare.AI.Gateway");
 
 /**
  * A Cloudflare.AI. Gateway for observability, caching, rate limiting, and
@@ -470,7 +467,9 @@ export const isAiGateway = (value: unknown): value is Gateway =>
  * });
  * ```
  */
-export const Gateway = Resource<Gateway>("Cloudflare.AI.Gateway");
+export const Gateway = Resource<Gateway>("Cloudflare.AI.Gateway", {
+  aliases: ["Cloudflare.AiGateway"],
+});
 
 export const GatewayResourceProvider = () =>
   Provider.succeed(Gateway, {

package/src/Cloudflare/AI/GatewayDynamicRouting.ts

@@ -302,7 +302,9 @@ export type GatewayDynamicRouting = Resource<
  *
  * @see https://developers.cloudflare.com/ai-gateway/features/dynamic-routing/
  */
-export const GatewayDynamicRouting = Resource<GatewayDynamicRouting>(TypeId);
+export const GatewayDynamicRouting = Resource<GatewayDynamicRouting>(TypeId, {
+  aliases: ["Cloudflare.AiGateway.DynamicRouting"],
+});
 
 /**
  * Returns true if the given value is a GatewayDynamicRouting resource.
@@ -404,12 +406,44 @@ export const DynamicRoutingProvider = () =>
       });
 
       if (current.name !== name) {
-        yield* aiGateway.patchDynamicRouting({
-          accountId,
-          gatewayId,
-          id: routeId,
-          name,
-        });
+        yield* aiGateway
+          .patchDynamicRouting({
+            accountId,
+            gatewayId,
+            id: routeId,
+            name,
+          })
+          .pipe(
+            // Cloudflare does not cascade-delete a gateway's routes when the
+            // gateway itself is deleted: recreating a gateway with the same
+            // id resurrects its old route rows, and a rename onto one of
+            // those ghosts trips the backing `UNIQUE(routes.name,
+            // routes.gateway_id)` constraint (leaked as a 500, typed as
+            // `RouteAlreadyExists` via a distilled patch). Route names are
+            // unique and deterministic, so the holder is a stale duplicate
+            // of this logical resource — delete it and retry the rename.
+            Effect.catchTag("RouteAlreadyExists", (error) =>
+              Effect.gen(function* () {
+                const holder = yield* findByName(accountId, gatewayId, name);
+                if (holder === undefined || holder.id === routeId) {
+                  return yield* Effect.fail(error);
+                }
+                yield* aiGateway
+                  .deleteDynamicRouting({
+                    accountId,
+                    gatewayId,
+                    id: holder.id,
+                  })
+                  .pipe(Effect.catchTag("RouteNotFound", () => Effect.void));
+                yield* aiGateway.patchDynamicRouting({
+                  accountId,
+                  gatewayId,
+                  id: routeId,
+                  name,
+                });
+              }),
+            ),
+          );
       }
 
       // `get` returns the *deployed* version's graph, so an undeployed

package/src/Cloudflare/AI/GatewayProvider.ts

@@ -145,10 +145,11 @@ export type GatewayProvider = Resource<
  * });
  *
  * // The secret name must be `{gatewayId}_{providerSlug}_{alias}`.
+ * // Prefer `Cloudflare.AI.ProviderKey` to wire this secret automatically.
  * const secret = yield* Cloudflare.SecretsStore.Secret("OpenAiKey", {
  *   store,
  *   name: "my-gateway_openai_default",
- *   value: Redacted.make(process.env.OPENAI_API_KEY!),
+ *   value: yield* Config.redacted("OPENAI_API_KEY"),
  *   scopes: ["ai_gateway"],
  * });
  *
@@ -175,7 +176,9 @@ export type GatewayProvider = Resource<
  *
  * @see https://developers.cloudflare.com/ai-gateway/configuration/bring-your-own-keys/
  */
-export const GatewayProvider = Resource<GatewayProvider>(TypeId);
+export const GatewayProvider = Resource<GatewayProvider>(TypeId, {
+  aliases: ["Cloudflare.AiGateway.ProviderConfig"],
+});
 
 /**
  * Returns true if the given value is a GatewayProvider resource.