alchemy 2.0.0-beta.61 → 2.0.0-beta.62

package/src/Cli/commands/_shared.ts

@@ -1,8 +1,10 @@
 import * as Cause from "effect/Cause";
 import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
 import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
 import * as Option from "effect/Option";
 import * as Path from "effect/Path";
 import * as S from "effect/Schema";
@@ -16,10 +18,17 @@ import {
   AuthError,
   AuthProviders,
 } from "../../Auth/AuthProvider.ts";
-import type { AlchemyProfileProviders } from "../../Auth/Profile.ts";
-import type * as Stack from "../../Stack.ts";
+import {
+  type AlchemyProfileProviders,
+  ALCHEMY_PROFILE,
+  withProfileOverride,
+} from "../../Auth/Profile.ts";
+import * as Stack from "../../Stack.ts";
+import { Stage } from "../../Stage.ts";
 import { recordCli } from "../../Telemetry/Metrics.ts";
 import { PromptCancelled } from "../../Util/Clank.ts";
+import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
+import { fileLogger } from "../../Util/FileLogger.ts";
 
 export const USER = Config.string("USER").pipe(
   Config.orElse(() => Config.string("USERNAME")),
@@ -147,10 +156,22 @@ export const script = Argument.file("main", {
 
 export const profile = Flag.string("profile").pipe(
   Flag.withDescription(
-    "Auth profile to use (~/.alchemy/profiles.json). Defaults to 'default' or $ALCHEMY_PROFILE.",
+    "Auth profile to use (~/.alchemy/profiles.json). Defaults to $ALCHEMY_PROFILE or 'default'.",
   ),
   Flag.optional,
-  Flag.map(Option.getOrElse(() => "default")),
+  Flag.mapEffect(
+    Effect.fn(function* (profile) {
+      // --profile wins; otherwise fall back to $ALCHEMY_PROFILE (which
+      // itself defaults to "default"). Without this, the flag's default
+      // would shadow the env var via withProfileOverride.
+      if (Option.isSome(profile)) {
+        return profile.value;
+      }
+      return yield* ALCHEMY_PROFILE.pipe(
+        Effect.catch(() => Effect.succeed("default")),
+      );
+    }),
+  ),
 );
 
 export const resourceFilter = Flag.string("filter").pipe(
@@ -296,7 +317,19 @@ export const printProfile = Effect.fn(function* (
       }
       continue;
     }
-    yield* provider.prettyPrint(profile, cfg);
+    // A provider's `prettyPrint` catches its own credential-resolution
+    // failures, but some resolve paths `Effect.orDie` (e.g. AWS SSO with an
+    // expired token), which escapes as a defect. Contain it here — via
+    // `Console.log` so the message stays on stdout under this provider's
+    // header instead of interleaving on stderr — so one broken provider
+    // can't abort rendering the rest of the profile.
+    yield* provider.prettyPrint(profile, cfg).pipe(
+      Effect.catchCause((cause) => {
+        const error = Cause.squash(cause);
+        const message = error instanceof Error ? error.message : String(error);
+        return Console.log(`  Failed to retrieve credentials: ${message}`);
+      }),
+    );
   }
 });
 
@@ -326,3 +359,84 @@ export const importStack = Effect.fn(function* (main: string) {
     state: Layer.Layer<never>;
   };
 });
+
+/**
+ * Placeholder {@link Stack.Stack} value used while building a stack's
+ * `providers()` layer out of band. No real resources exist yet — we only
+ * want the layer's provider/auth registrations and cloud-environment
+ * services, so `resources`/`bindings`/`actions` are empty and the stage is a
+ * sentinel.
+ */
+const placeholderStack = (name: string) => ({
+  actions: {},
+  bindings: {},
+  name,
+  resources: {},
+  stage: "placeholder",
+});
+
+export interface BuildStackProvidersOptions {
+  /** Stack entrypoint to import (e.g. `"alchemy.run.ts"`). */
+  main: string;
+  envFile: Option.Option<string>;
+  profile: string;
+  /**
+   * Registry to populate. Pass a pre-seeded registry (e.g. one that already
+   * has built-in providers) to layer the stack's providers on top of it,
+   * overriding by name. Defaults to a fresh empty registry.
+   */
+  registry?: AuthProviders["Service"];
+  /**
+   * Logger layer used during the build. Defaults to the file logger
+   * (`out`). `alchemy unsafe nuke` overrides this to log to the console in
+   * debug mode.
+   */
+  logger?: Layer.Layer<never, never, never>;
+  /**
+   * Extra layer merged into the placeholder scaffold — e.g.
+   * `Layer.succeed(MinimumLogLevel, ...)`, which sets a fiber-ref default
+   * and so contributes no context service (`Layer<never>`).
+   */
+  extra?: Layer.Layer<never, never, never>;
+}
+
+/**
+ * Import a stack entrypoint and build its `providers()` (+ `state()`) layer
+ * out of band against placeholder {@link Stack.Stack}/{@link Stage} services,
+ * so its `AuthProviderLayer` registrations land in an {@link AuthProviders}
+ * registry and the built context holds every resource provider plus the
+ * cloud-environment services their operations need.
+ *
+ * Shared by `alchemy login`, `alchemy profile show`, and `alchemy unsafe
+ * nuke`. The caller decides what to do with the result — use `authProviders`
+ * (login / profile show) or `context` (nuke) — and whether a missing/invalid
+ * entrypoint is fatal (login / nuke let it propagate) or best-effort
+ * (profile show wraps the call in `Effect.catchCause`).
+ */
+export const buildStackProviders = Effect.fn("buildStackProviders")(function* (
+  options: BuildStackProvidersOptions,
+) {
+  const authProviders = options.registry ?? {};
+  const stackEffect = yield* importStack(options.main);
+  const configProvider = withProfileOverride(
+    yield* loadConfigProvider(options.envFile),
+    options.profile,
+  );
+  const context = yield* Layer.build(
+    (stackEffect.providers ?? Layer.empty).pipe(
+      Layer.provideMerge(stackEffect.state ?? Layer.empty),
+      Layer.provideMerge(
+        Layer.mergeAll(
+          Layer.succeed(AuthProviders, authProviders),
+          ConfigProvider.layer(configProvider),
+          options.logger ??
+            Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
+          Layer.succeed(Stage, "placeholder"),
+          Layer.succeed(Stack.Stack, placeholderStack(stackEffect.stackName)),
+          options.extra ?? Layer.empty,
+        ),
+      ),
+    ),
+  );
+  return { authProviders, context, stackEffect };
+});

package/src/Cli/commands/login.ts

@@ -1,21 +1,13 @@
 import * as Config from "effect/Config";
-import * as ConfigProvider from "effect/ConfigProvider";
 import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
 import { Command, Flag } from "effect/unstable/cli";
 
-import { AuthProviders } from "../../Auth/AuthProvider.ts";
-import { AlchemyProfile, withProfileOverride } from "../../Auth/Profile.ts";
-import { Stage } from "../../Stage.ts";
-import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
-import { fileLogger } from "../../Util/FileLogger.ts";
+import { AlchemyProfile } from "../../Auth/Profile.ts";
 
-import { Stack } from "../../Stack.ts";
 import {
+  buildStackProviders,
   envFile,
-  importStack,
   instrumentCommand,
   printProfile,
   profile,
@@ -46,36 +38,13 @@ export const loginCommand = Command.make(
     }),
   )(
     Effect.fn(function* ({ main, envFile, profile, configure }) {
-      const stackEffect = yield* importStack(main);
-
-      const authProviders: AuthProviders["Service"] = {};
-
-      // build the state + providers layer to capture the Auth Providers
-      yield* Layer.build(
-        (stackEffect.providers ?? Layer.empty).pipe(
-          Layer.provideMerge(stackEffect.state ?? Layer.empty),
-          Layer.provideMerge(
-            Layer.mergeAll(
-              Layer.succeed(AuthProviders, authProviders),
-              ConfigProvider.layer(
-                withProfileOverride(
-                  yield* loadConfigProvider(envFile),
-                  profile,
-                ),
-              ),
-              Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
-              Layer.succeed(Stage, "placeholder"),
-              Layer.succeed(Stack, {
-                actions: {},
-                bindings: {},
-                name: stackEffect.stackName,
-                resources: {},
-                stage: "placeholder",
-              }),
-            ),
-          ),
-        ),
-      );
+      // Build the user's providers() (+ state) layer to capture the auth
+      // providers their stack wires up.
+      const { authProviders } = yield* buildStackProviders({
+        main,
+        envFile,
+        profile,
+      });
 
       const profiles = yield* AlchemyProfile;
 

package/src/Cli/commands/logs.ts

@@ -126,6 +126,7 @@ export const logsCommand = Command.make(
 
             const lines = yield* provider.logs({
               id: resource.LogicalId,
+              fqn,
               instanceId: (resourceState as any).instanceId,
               props: (resourceState as any).props,
               output: (resourceState as any).attr,

package/src/Cli/commands/nuke.ts

@@ -1,4 +1,3 @@
-import * as ConfigProvider from "effect/ConfigProvider";
 import * as Console from "effect/Console";
 import type * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
@@ -8,22 +7,16 @@ import { MinimumLogLevel } from "effect/References";
 import { Command, Flag } from "effect/unstable/cli";
 import picomatch from "picomatch";
 
-import { AuthProviders } from "../../Auth/AuthProvider.ts";
-import { withProfileOverride } from "../../Auth/Profile.ts";
 import type { ProviderService } from "../../Provider.ts";
-import { Stack } from "../../Stack.ts";
-import { Stage } from "../../Stage.ts";
 import * as Clank from "../../Util/Clank.ts";
-import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
-import { fileLogger } from "../../Util/FileLogger.ts";
 import type { ScopedPlanStatusSession } from "../Cli.ts";
 import { isNonInteractive } from "../selectCli.ts";
 import * as NukeUI from "../tui/components/Nuke.tsx";
 
 import {
+  buildStackProviders,
   dryRun,
   envFile,
-  importStack,
   instrumentCommand,
   profile,
   script,
@@ -311,42 +304,18 @@ const nukeCommand = Command.make(
       // log stream isn't clobbered by the progress renderer.
       const debug = !!process.env.DEBUG;
       const interactive = !isNonInteractive() && !debug;
-      const stackEffect = yield* importStack(main);
-      const authProviders: AuthProviders["Service"] = {};
-
-      // Build the state + providers layer (same wiring as `alchemy login`) so
-      // that the resulting context holds every resource provider plus the
-      // cloud-environment services their `list`/`delete` need at call time.
-      const context = yield* Layer.build(
-        (stackEffect.providers ?? Layer.empty).pipe(
-          Layer.provideMerge(stackEffect.state ?? Layer.empty),
-          Layer.provideMerge(
-            Layer.mergeAll(
-              Layer.succeed(AuthProviders, authProviders),
-              ConfigProvider.layer(
-                withProfileOverride(
-                  yield* loadConfigProvider(envFile),
-                  profile,
-                ),
-              ),
-              debug
-                ? Logger.layer([Logger.defaultLogger])
-                : Logger.layer([fileLogger("out")], {
-                    mergeWithExisting: true,
-                  }),
-              Layer.succeed(MinimumLogLevel, debug ? "Debug" : "Info"),
-              Layer.succeed(Stage, "placeholder"),
-              Layer.succeed(Stack, {
-                actions: {},
-                bindings: {},
-                name: stackEffect.stackName,
-                resources: {},
-                stage: "placeholder",
-              }),
-            ),
-          ),
-        ),
-      );
+
+      // Build the user's providers() (+ state) layer so the resulting context
+      // holds every resource provider plus the cloud-environment services
+      // their `list`/`delete` need at call time. DEBUG=1 routes provider logs
+      // to the console at Debug level instead of the .alchemy/log/out file.
+      const { context } = yield* buildStackProviders({
+        main,
+        envFile,
+        profile,
+        logger: debug ? Logger.layer([Logger.defaultLogger]) : undefined,
+        extra: Layer.succeed(MinimumLogLevel, debug ? "Debug" : "Info"),
+      });
 
       const discovered = discoverProviders(context as Context.Context<never>);
 
@@ -521,6 +490,9 @@ const nukeCommand = Command.make(
                 item.provider
                   .delete({
                     id: displayName(item.attr),
+                    // Enumerated straight from the cloud, so there is no
+                    // Alchemy namespace — an un-namespaced fqn is just the id.
+                    fqn: displayName(item.attr),
                     instanceId: "",
                     olds: item.attr as never,
                     output: item.attr as never,

package/src/Cli/commands/profile.ts

@@ -3,7 +3,9 @@ import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Logger from "effect/Logger";
+import * as Option from "effect/Option";
 import { Command } from "effect/unstable/cli";
+import * as Argument from "effect/unstable/cli/Argument";
 
 import { AuthProviders } from "../../Auth/AuthProvider.ts";
 import { CredentialsStore } from "../../Auth/Credentials.ts";
@@ -18,19 +20,98 @@ import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
 import { fileLogger } from "../../Util/FileLogger.ts";
 
 import {
+  buildStackProviders,
   envFile,
   instrumentCommand,
   printProfile,
   profile,
 } from "./_shared.ts";
 
+/**
+ * The auth providers Alchemy ships with. Built into the registry as a
+ * baseline so `profile show` can pretty-print any provider a profile
+ * mentions, even one the current stack doesn't wire up.
+ */
+const builtinAuth = Layer.mergeAll(
+  AwsAuth,
+  AxiomAuth,
+  CloudflareAuth,
+  GitHubAuth,
+  NeonAuth,
+  PlanetscaleAuth,
+);
+
+/**
+ * Entrypoint whose `providers()` layer contributes the user's own auth
+ * providers. Optional and best-effort — if it's missing or fails to load,
+ * `profile show` still renders the built-in providers.
+ */
+const mainFile = Argument.file("main").pipe(
+  Argument.withDescription(
+    "Stack entrypoint whose providers() should be used, defaults to alchemy.run.ts",
+  ),
+  Argument.withDefault("alchemy.run.ts"),
+);
+
+/**
+ * Populate an {@link AuthProviders} registry for display: the built-in
+ * providers first, then the user's stack `providers()` layer on top so a
+ * customized provider (same name) overrides the built-in one. Loading the
+ * user's stack is best-effort — a missing or invalid entrypoint leaves the
+ * built-ins in place.
+ *
+ * Registration happens as a side effect of building each layer (see
+ * `AuthProviderLayer`), and later builds overwrite earlier entries by name,
+ * so build order is what gives the user's providers precedence.
+ */
+export const collectAuthProviders = Effect.fn("collectAuthProviders")(
+  function* (options: {
+    main: string;
+    envFile: Option.Option<string>;
+    profile: string;
+  }) {
+    const authProviders: AuthProviders["Service"] = {};
+
+    // 1. Built-in providers first (baseline).
+    yield* Layer.build(
+      Layer.provide(
+        builtinAuth,
+        Layer.mergeAll(
+          Layer.succeed(AuthProviders, authProviders),
+          ConfigProvider.layer(
+            withProfileOverride(
+              yield* loadConfigProvider(options.envFile),
+              options.profile,
+            ),
+          ),
+          Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
+        ),
+      ),
+    );
+
+    // 2. The user's own providers() layer on top — building into the same
+    //    registry overrides the built-ins by name. Best-effort: swallow
+    //    load/build failures (including a missing entrypoint) so display
+    //    still works with just the built-ins.
+    yield* buildStackProviders({ ...options, registry: authProviders }).pipe(
+      Effect.catchCause((cause) =>
+        Effect.logDebug("profile show: could not load user stack providers", {
+          cause,
+        }),
+      ),
+    );
+
+    return authProviders;
+  },
+);
+
 const showCommand = Command.make(
   "show",
-  { profile, envFile },
+  { profile, envFile, main: mainFile },
   instrumentCommand("profile.show", (a: { profile: string }) => ({
     "alchemy.profile": a.profile,
   }))(
-    Effect.fn(function* ({ profile, envFile }) {
+    Effect.fn(function* ({ profile, envFile, main }) {
       const profiles = yield* AlchemyProfile;
       const stored = yield* profiles.getProfile(profile);
       if (stored == null) {
@@ -45,32 +126,13 @@ const showCommand = Command.make(
         return;
       }
 
-      const authProviders: AuthProviders["Service"] = {};
-      const authRegistry = Layer.succeed(AuthProviders, authProviders);
-      const services = Layer.mergeAll(
-        authRegistry,
-        ConfigProvider.layer(
-          withProfileOverride(yield* loadConfigProvider(envFile), profile),
-        ),
-        Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
-        // Building these layers triggers their AuthProviderLayer effect, which
-        // registers the provider into the shared `authProviders` registry.
-        Layer.provide(
-          Layer.mergeAll(
-            AwsAuth,
-            AxiomAuth,
-            CloudflareAuth,
-            GitHubAuth,
-            NeonAuth,
-            PlanetscaleAuth,
-          ),
-          authRegistry,
-        ),
-      );
+      const authProviders = yield* collectAuthProviders({
+        main,
+        envFile,
+        profile,
+      });
 
-      yield* printProfile(profile, stored, authProviders).pipe(
-        Effect.provide(services),
-      );
+      yield* printProfile(profile, stored, authProviders);
     }),
   ),
 );

package/src/Cli/commands/tail.ts

@@ -104,6 +104,7 @@ export const tailCommand = Command.make(
               logicalId: resource.LogicalId,
               stream: provider.tail({
                 id: resource.LogicalId,
+                fqn,
                 instanceId: (resourceState as any).instanceId,
                 props: (resourceState as any).props,
                 output: (resourceState as any).attr,

package/src/Cloudflare/AI/GatewayDynamicRouting.ts

@@ -406,12 +406,44 @@ export const DynamicRoutingProvider = () =>
       });
 
       if (current.name !== name) {
-        yield* aiGateway.patchDynamicRouting({
-          accountId,
-          gatewayId,
-          id: routeId,
-          name,
-        });
+        yield* aiGateway
+          .patchDynamicRouting({
+            accountId,
+            gatewayId,
+            id: routeId,
+            name,
+          })
+          .pipe(
+            // Cloudflare does not cascade-delete a gateway's routes when the
+            // gateway itself is deleted: recreating a gateway with the same
+            // id resurrects its old route rows, and a rename onto one of
+            // those ghosts trips the backing `UNIQUE(routes.name,
+            // routes.gateway_id)` constraint (leaked as a 500, typed as
+            // `RouteAlreadyExists` via a distilled patch). Route names are
+            // unique and deterministic, so the holder is a stale duplicate
+            // of this logical resource — delete it and retry the rename.
+            Effect.catchTag("RouteAlreadyExists", (error) =>
+              Effect.gen(function* () {
+                const holder = yield* findByName(accountId, gatewayId, name);
+                if (holder === undefined || holder.id === routeId) {
+                  return yield* Effect.fail(error);
+                }
+                yield* aiGateway
+                  .deleteDynamicRouting({
+                    accountId,
+                    gatewayId,
+                    id: holder.id,
+                  })
+                  .pipe(Effect.catchTag("RouteNotFound", () => Effect.void));
+                yield* aiGateway.patchDynamicRouting({
+                  accountId,
+                  gatewayId,
+                  id: routeId,
+                  name,
+                });
+              }),
+            ),
+          );
       }
 
       // `get` returns the *deployed* version's graph, so an undeployed

package/src/Cloudflare/AI/SearchInstance.ts

@@ -835,9 +835,10 @@ const retryTokenPropagation = <A, E extends { _tag: string }, R>(
       // sparsely and detects a settled token tens of seconds late. Capped
       // polling detects within 6s of propagation completing while still
       // covering a long total window.
-      schedule: Schedule.exponential("1 second", 1.5).pipe(
-        Schedule.either(Schedule.spaced("6 seconds")),
-      ),
+      schedule: Schedule.min([
+        Schedule.exponential("1 second", 1.5),
+        Schedule.spaced("6 seconds"),
+      ]),
       times: 22,
     }),
   );

package/src/Cloudflare/Access/Application.ts

@@ -292,10 +292,13 @@ const retryTransientAccessError = <A, E extends { _tag: string }, R>(
     Effect.retry({
       while: (e) =>
         e._tag === "AccessReferenceNotFound" || e._tag === "Forbidden",
-      schedule: Schedule.exponential("1 second", 1.5).pipe(
-        Schedule.either(Schedule.spaced("5 seconds")),
-        Schedule.both(Schedule.recurs(12)),
-      ),
+      schedule: Schedule.max([
+        Schedule.min([
+          Schedule.exponential("1 second", 1.5),
+          Schedule.spaced("5 seconds"),
+        ]),
+        Schedule.recurs(12),
+      ]),
     }),
   );
 

package/src/Cloudflare/Alerting/Silence.ts

@@ -250,9 +250,10 @@ export const SilenceProvider = () =>
           ),
           Effect.retry({
             while: (e) => e._tag === "SilencePending",
-            schedule: Schedule.exponential("500 millis").pipe(
-              Schedule.both(Schedule.recurs(8)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential("500 millis"),
+              Schedule.recurs(8),
+            ]),
           }),
         );
         return toSilenceAttributes(observed, accountId);

package/src/Cloudflare/Alerting/Webhook.ts

@@ -211,9 +211,10 @@ export const NotificationWebhookProvider = () =>
           .pipe(
             Effect.retry({
               while: (e) => e._tag === "WebhookTestFailed",
-              schedule: Schedule.exponential("1 second").pipe(
-                Schedule.both(Schedule.recurs(5)),
-              ),
+              schedule: Schedule.max([
+                Schedule.exponential("1 second"),
+                Schedule.recurs(5),
+              ]),
             }),
           );
         if (!created.id) {
@@ -247,9 +248,10 @@ export const NotificationWebhookProvider = () =>
           .pipe(
             Effect.retry({
               while: (e) => e._tag === "WebhookTestFailed",
-              schedule: Schedule.exponential("1 second").pipe(
-                Schedule.both(Schedule.recurs(5)),
-              ),
+              schedule: Schedule.max([
+                Schedule.exponential("1 second"),
+                Schedule.recurs(5),
+              ]),
             }),
           );
         const fresh = yield* observeWebhook(accountId, observed.id);