alchemy 2.0.0-beta.61 → 2.0.0-beta.63

package/src/Cli/commands/_shared.ts

@@ -1,8 +1,10 @@
 import * as Cause from "effect/Cause";
 import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
 import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
 import * as Option from "effect/Option";
 import * as Path from "effect/Path";
 import * as S from "effect/Schema";
@@ -16,10 +18,23 @@ import {
   AuthError,
   AuthProviders,
 } from "../../Auth/AuthProvider.ts";
-import type { AlchemyProfileProviders } from "../../Auth/Profile.ts";
-import type * as Stack from "../../Stack.ts";
+import {
+  type AlchemyProfileProviders,
+  ALCHEMY_PROFILE,
+  withProfileOverride,
+} from "../../Auth/Profile.ts";
+import { AwsAuth } from "../../AWS/AuthProvider.ts";
+import { AxiomAuth } from "../../Axiom/AuthProvider.ts";
+import { CloudflareAuth } from "../../Cloudflare/Auth/AuthProvider.ts";
+import { GitHubAuth } from "../../GitHub/AuthProvider.ts";
+import { NeonAuth } from "../../Neon/AuthProvider.ts";
+import { PlanetscaleAuth } from "../../Planetscale/AuthProvider.ts";
+import * as Stack from "../../Stack.ts";
+import { Stage } from "../../Stage.ts";
 import { recordCli } from "../../Telemetry/Metrics.ts";
 import { PromptCancelled } from "../../Util/Clank.ts";
+import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
+import { fileLogger } from "../../Util/FileLogger.ts";
 
 export const USER = Config.string("USER").pipe(
   Config.orElse(() => Config.string("USERNAME")),
@@ -147,10 +162,22 @@ export const script = Argument.file("main", {
 
 export const profile = Flag.string("profile").pipe(
   Flag.withDescription(
-    "Auth profile to use (~/.alchemy/profiles.json). Defaults to 'default' or $ALCHEMY_PROFILE.",
+    "Auth profile to use (~/.alchemy/profiles.json). Defaults to $ALCHEMY_PROFILE or 'default'.",
   ),
   Flag.optional,
-  Flag.map(Option.getOrElse(() => "default")),
+  Flag.mapEffect(
+    Effect.fn(function* (profile) {
+      // --profile wins; otherwise fall back to $ALCHEMY_PROFILE (which
+      // itself defaults to "default"). Without this, the flag's default
+      // would shadow the env var via withProfileOverride.
+      if (Option.isSome(profile)) {
+        return profile.value;
+      }
+      return yield* ALCHEMY_PROFILE.pipe(
+        Effect.catch(() => Effect.succeed("default")),
+      );
+    }),
+  ),
 );
 
 export const resourceFilter = Flag.string("filter").pipe(
@@ -296,7 +323,19 @@ export const printProfile = Effect.fn(function* (
       }
       continue;
     }
-    yield* provider.prettyPrint(profile, cfg);
+    // A provider's `prettyPrint` catches its own credential-resolution
+    // failures, but some resolve paths `Effect.orDie` (e.g. AWS SSO with an
+    // expired token), which escapes as a defect. Contain it here — via
+    // `Console.log` so the message stays on stdout under this provider's
+    // header instead of interleaving on stderr — so one broken provider
+    // can't abort rendering the rest of the profile.
+    yield* provider.prettyPrint(profile, cfg).pipe(
+      Effect.catchCause((cause) => {
+        const error = Cause.squash(cause);
+        const message = error instanceof Error ? error.message : String(error);
+        return Console.log(`  Failed to retrieve credentials: ${message}`);
+      }),
+    );
   }
 });
 
@@ -326,3 +365,130 @@ export const importStack = Effect.fn(function* (main: string) {
     state: Layer.Layer<never>;
   };
 });
+
+/**
+ * Placeholder {@link Stack.Stack} value used while building a stack's
+ * `providers()` layer out of band. No real resources exist yet — we only
+ * want the layer's provider/auth registrations and cloud-environment
+ * services, so `resources`/`bindings`/`actions` are empty and the stage is a
+ * sentinel.
+ */
+const placeholderStack = (name: string) => ({
+  actions: {},
+  bindings: {},
+  name,
+  resources: {},
+  stage: "placeholder",
+});
+
+export interface BuildStackProvidersOptions {
+  /** Stack entrypoint to import (e.g. `"alchemy.run.ts"`). */
+  main: string;
+  envFile: Option.Option<string>;
+  profile: string;
+  /**
+   * Registry to populate. Pass a pre-seeded registry (e.g. one that already
+   * has built-in providers) to layer the stack's providers on top of it,
+   * overriding by name. Defaults to a fresh empty registry.
+   */
+  registry?: AuthProviders["Service"];
+  /**
+   * Logger layer used during the build. Defaults to the file logger
+   * (`out`). `alchemy unsafe nuke` overrides this to log to the console in
+   * debug mode.
+   */
+  logger?: Layer.Layer<never, never, never>;
+  /**
+   * Extra layer merged into the placeholder scaffold — e.g.
+   * `Layer.succeed(MinimumLogLevel, ...)`, which sets a fiber-ref default
+   * and so contributes no context service (`Layer<never>`).
+   */
+  extra?: Layer.Layer<never, never, never>;
+}
+
+/**
+ * Import a stack entrypoint and build its `providers()` (+ `state()`) layer
+ * out of band against placeholder {@link Stack.Stack}/{@link Stage} services,
+ * so its `AuthProviderLayer` registrations land in an {@link AuthProviders}
+ * registry and the built context holds every resource provider plus the
+ * cloud-environment services their operations need.
+ *
+ * Shared by `alchemy login`, `alchemy profile show`, and `alchemy unsafe
+ * nuke`. The caller decides what to do with the result — use `authProviders`
+ * (login / profile show) or `context` (nuke) — and whether a missing/invalid
+ * entrypoint is fatal (login / nuke let it propagate) or best-effort
+ * (profile show wraps the call in `Effect.catchCause`).
+ */
+export const buildStackProviders = Effect.fn("buildStackProviders")(function* (
+  options: BuildStackProvidersOptions,
+) {
+  const authProviders = options.registry ?? {};
+  const stackEffect = yield* importStack(options.main);
+  const configProvider = withProfileOverride(
+    yield* loadConfigProvider(options.envFile),
+    options.profile,
+  );
+  const context = yield* Layer.build(
+    (stackEffect.providers ?? Layer.empty).pipe(
+      Layer.provideMerge(stackEffect.state ?? Layer.empty),
+      Layer.provideMerge(
+        Layer.mergeAll(
+          Layer.succeed(AuthProviders, authProviders),
+          ConfigProvider.layer(configProvider),
+          options.logger ??
+            Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
+          Layer.succeed(Stage, "placeholder"),
+          Layer.succeed(Stack.Stack, placeholderStack(stackEffect.stackName)),
+          options.extra ?? Layer.empty,
+        ),
+      ),
+    ),
+  );
+  return { authProviders, context, stackEffect };
+});
+
+/**
+ * The auth providers Alchemy ships with. Used as the baseline registry so
+ * `alchemy login` works from any folder (no `alchemy.run.ts` required) and
+ * `alchemy profile show` can pretty-print any provider a profile mentions,
+ * even one the current stack doesn't wire up.
+ */
+export const builtinAuth = Layer.mergeAll(
+  AwsAuth,
+  AxiomAuth,
+  CloudflareAuth,
+  GitHubAuth,
+  NeonAuth,
+  PlanetscaleAuth,
+);
+
+/**
+ * Build {@link builtinAuth} against `registry` so every built-in auth
+ * provider registers itself, without importing any stack entrypoint.
+ */
+export const buildBuiltinAuthProviders = Effect.fn("buildBuiltinAuthProviders")(
+  function* (options: {
+    envFile: Option.Option<string>;
+    profile: string;
+    /** Registry to populate. Defaults to a fresh empty registry. */
+    registry?: AuthProviders["Service"];
+  }) {
+    const authProviders = options.registry ?? {};
+    yield* Layer.build(
+      Layer.provide(
+        builtinAuth,
+        Layer.mergeAll(
+          Layer.succeed(AuthProviders, authProviders),
+          ConfigProvider.layer(
+            withProfileOverride(
+              yield* loadConfigProvider(options.envFile),
+              options.profile,
+            ),
+          ),
+          Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
+        ),
+      ),
+    );
+    return authProviders;
+  },
+);

package/src/Cli/commands/login.ts

@@ -1,25 +1,23 @@
 import * as Config from "effect/Config";
-import * as ConfigProvider from "effect/ConfigProvider";
 import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
+import * as FileSystem from "effect/FileSystem";
+import * as Option from "effect/Option";
 import { Command, Flag } from "effect/unstable/cli";
+import * as Argument from "effect/unstable/cli/Argument";
+import * as CliError from "effect/unstable/cli/CliError";
 
-import { AuthProviders } from "../../Auth/AuthProvider.ts";
-import { AlchemyProfile, withProfileOverride } from "../../Auth/Profile.ts";
-import { Stage } from "../../Stage.ts";
-import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
-import { fileLogger } from "../../Util/FileLogger.ts";
+import type { AuthProviders } from "../../Auth/AuthProvider.ts";
+import { AlchemyProfile } from "../../Auth/Profile.ts";
+import * as Clank from "../../Util/Clank.ts";
 
-import { Stack } from "../../Stack.ts";
 import {
+  buildBuiltinAuthProviders,
+  buildStackProviders,
   envFile,
-  importStack,
   instrumentCommand,
   printProfile,
   profile,
-  script,
 } from "./_shared.ts";
 
 const loginConfigure = Flag.boolean("configure").pipe(
@@ -29,62 +27,109 @@ const loginConfigure = Flag.boolean("configure").pipe(
   Flag.withDefault(false),
 );
 
+/**
+ * Stack entrypoint whose `providers()` layer selects which auth providers
+ * to log in with. Optional: when omitted and no `alchemy.run.ts` exists in
+ * the current folder, `alchemy login` falls back to every built-in auth
+ * provider, so logging in (and refreshing credentials) works from any
+ * folder.
+ */
+const loginMain = Argument.file("main").pipe(
+  Argument.withDescription(
+    "Stack entrypoint whose providers() to log in with, defaults to alchemy.run.ts (falls back to all built-in providers when absent)",
+  ),
+  Argument.optional,
+);
+
 export const loginCommand = Command.make(
   "login",
   {
-    main: script,
+    main: loginMain,
     envFile,
     profile,
     configure: loginConfigure,
   },
   instrumentCommand(
     "login",
-    (a: { main: string; profile: string; configure: boolean }) => ({
+    (a: {
+      main: Option.Option<string>;
+      profile: string;
+      configure: boolean;
+    }) => ({
       "alchemy.profile": a.profile,
-      "alchemy.main": a.main,
+      "alchemy.main": Option.getOrElse(a.main, () => "alchemy.run.ts"),
       "alchemy.configure": a.configure,
     }),
   )(
     Effect.fn(function* ({ main, envFile, profile, configure }) {
-      const stackEffect = yield* importStack(main);
-
-      const authProviders: AuthProviders["Service"] = {};
+      const fs = yield* FileSystem.FileSystem;
+      const explicitMain = Option.getOrUndefined(main);
+      const mainPath = explicitMain ?? "alchemy.run.ts";
+      const mainExists = yield* fs
+        .exists(mainPath)
+        .pipe(Effect.catch(() => Effect.succeed(false)));
 
-      // build the state + providers layer to capture the Auth Providers
-      yield* Layer.build(
-        (stackEffect.providers ?? Layer.empty).pipe(
-          Layer.provideMerge(stackEffect.state ?? Layer.empty),
-          Layer.provideMerge(
-            Layer.mergeAll(
-              Layer.succeed(AuthProviders, authProviders),
-              ConfigProvider.layer(
-                withProfileOverride(
-                  yield* loadConfigProvider(envFile),
-                  profile,
-                ),
-              ),
-              Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
-              Layer.succeed(Stage, "placeholder"),
-              Layer.succeed(Stack, {
-                actions: {},
-                bindings: {},
-                name: stackEffect.stackName,
-                resources: {},
-                stage: "placeholder",
-              }),
-            ),
-          ),
-        ),
-      );
+      // An explicitly-passed entrypoint must exist; only the default may
+      // fall back to the built-in providers.
+      if (explicitMain != null && !mainExists) {
+        return yield* Effect.fail(
+          new CliError.InvalidValue({
+            option: "main",
+            value: explicitMain,
+            expected: "an existing stack entrypoint file",
+            kind: "argument",
+          }),
+        );
+      }
 
       const profiles = yield* AlchemyProfile;
-
       const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
-      const providers = Object.values(authProviders);
+
+      let authProviders: AuthProviders["Service"];
+      // Providers to actually log in with; `undefined` means all registered.
+      let selected: string[] | undefined;
+      if (mainExists) {
+        // Build the user's providers() (+ state) layer to capture the auth
+        // providers their stack wires up.
+        ({ authProviders } = yield* buildStackProviders({
+          main: mainPath,
+          envFile,
+          profile,
+        }));
+      } else {
+        // No stack entrypoint — register every built-in auth provider so
+        // `alchemy login` works from any folder. Interactively, let the
+        // user pick which ones to log in with; in CI, take them all.
+        yield* Console.log(
+          "No alchemy.run.ts found — using Alchemy's built-in providers.",
+        );
+        authProviders = yield* buildBuiltinAuthProviders({ envFile, profile });
+        if (!ci) {
+          const existing = yield* profiles.getProfile(profile);
+          const names = Object.keys(authProviders).sort();
+          selected = yield* Clank.multiselect({
+            message: "Select providers to log in with",
+            options: names.map((name) => ({
+              value: name,
+              label: name,
+              hint: existing?.[name] != null ? "configured" : undefined,
+            })),
+            // Pre-select providers already in the profile so re-running
+            // login naturally refreshes/re-prints what's set up.
+            initialValues: names.filter((name) => existing?.[name] != null),
+          });
+        }
+      }
+
+      const providers = Object.values(authProviders).filter(
+        (provider) => selected == null || selected.includes(provider.name),
+      );
 
       if (providers.length === 0) {
         yield* Console.log(
-          "No AuthProviders registered. Make sure the stack's providers() layer includes AuthProviderLayer entries.",
+          selected != null
+            ? "No providers selected."
+            : "No AuthProviders registered. Make sure the stack's providers() layer includes AuthProviderLayer entries.",
         );
         return;
       }

package/src/Cli/commands/logs.ts

@@ -126,6 +126,7 @@ export const logsCommand = Command.make(
 
             const lines = yield* provider.logs({
               id: resource.LogicalId,
+              fqn,
               instanceId: (resourceState as any).instanceId,
               props: (resourceState as any).props,
               output: (resourceState as any).attr,

package/src/Cli/commands/nuke.ts

@@ -1,4 +1,3 @@
-import * as ConfigProvider from "effect/ConfigProvider";
 import * as Console from "effect/Console";
 import type * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
@@ -8,22 +7,16 @@ import { MinimumLogLevel } from "effect/References";
 import { Command, Flag } from "effect/unstable/cli";
 import picomatch from "picomatch";
 
-import { AuthProviders } from "../../Auth/AuthProvider.ts";
-import { withProfileOverride } from "../../Auth/Profile.ts";
 import type { ProviderService } from "../../Provider.ts";
-import { Stack } from "../../Stack.ts";
-import { Stage } from "../../Stage.ts";
 import * as Clank from "../../Util/Clank.ts";
-import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
-import { fileLogger } from "../../Util/FileLogger.ts";
 import type { ScopedPlanStatusSession } from "../Cli.ts";
 import { isNonInteractive } from "../selectCli.ts";
 import * as NukeUI from "../tui/components/Nuke.tsx";
 
 import {
+  buildStackProviders,
   dryRun,
   envFile,
-  importStack,
   instrumentCommand,
   profile,
   script,
@@ -311,42 +304,18 @@ const nukeCommand = Command.make(
       // log stream isn't clobbered by the progress renderer.
       const debug = !!process.env.DEBUG;
       const interactive = !isNonInteractive() && !debug;
-      const stackEffect = yield* importStack(main);
-      const authProviders: AuthProviders["Service"] = {};
-
-      // Build the state + providers layer (same wiring as `alchemy login`) so
-      // that the resulting context holds every resource provider plus the
-      // cloud-environment services their `list`/`delete` need at call time.
-      const context = yield* Layer.build(
-        (stackEffect.providers ?? Layer.empty).pipe(
-          Layer.provideMerge(stackEffect.state ?? Layer.empty),
-          Layer.provideMerge(
-            Layer.mergeAll(
-              Layer.succeed(AuthProviders, authProviders),
-              ConfigProvider.layer(
-                withProfileOverride(
-                  yield* loadConfigProvider(envFile),
-                  profile,
-                ),
-              ),
-              debug
-                ? Logger.layer([Logger.defaultLogger])
-                : Logger.layer([fileLogger("out")], {
-                    mergeWithExisting: true,
-                  }),
-              Layer.succeed(MinimumLogLevel, debug ? "Debug" : "Info"),
-              Layer.succeed(Stage, "placeholder"),
-              Layer.succeed(Stack, {
-                actions: {},
-                bindings: {},
-                name: stackEffect.stackName,
-                resources: {},
-                stage: "placeholder",
-              }),
-            ),
-          ),
-        ),
-      );
+
+      // Build the user's providers() (+ state) layer so the resulting context
+      // holds every resource provider plus the cloud-environment services
+      // their `list`/`delete` need at call time. DEBUG=1 routes provider logs
+      // to the console at Debug level instead of the .alchemy/log/out file.
+      const { context } = yield* buildStackProviders({
+        main,
+        envFile,
+        profile,
+        logger: debug ? Logger.layer([Logger.defaultLogger]) : undefined,
+        extra: Layer.succeed(MinimumLogLevel, debug ? "Debug" : "Info"),
+      });
 
       const discovered = discoverProviders(context as Context.Context<never>);
 
@@ -521,6 +490,9 @@ const nukeCommand = Command.make(
                 item.provider
                   .delete({
                     id: displayName(item.attr),
+                    // Enumerated straight from the cloud, so there is no
+                    // Alchemy namespace — an un-namespaced fqn is just the id.
+                    fqn: displayName(item.attr),
                     instanceId: "",
                     olds: item.attr as never,
                     output: item.attr as never,

package/src/Cli/commands/profile.ts

@@ -1,36 +1,83 @@
-import * as ConfigProvider from "effect/ConfigProvider";
 import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
+import * as Option from "effect/Option";
 import { Command } from "effect/unstable/cli";
+import * as Argument from "effect/unstable/cli/Argument";
 
 import { AuthProviders } from "../../Auth/AuthProvider.ts";
 import { CredentialsStore } from "../../Auth/Credentials.ts";
-import { AlchemyProfile, withProfileOverride } from "../../Auth/Profile.ts";
-import { AwsAuth } from "../../AWS/AuthProvider.ts";
-import { AxiomAuth } from "../../Axiom/AuthProvider.ts";
-import { CloudflareAuth } from "../../Cloudflare/Auth/AuthProvider.ts";
-import { GitHubAuth } from "../../GitHub/AuthProvider.ts";
-import { NeonAuth } from "../../Neon/AuthProvider.ts";
-import { PlanetscaleAuth } from "../../Planetscale/AuthProvider.ts";
-import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
-import { fileLogger } from "../../Util/FileLogger.ts";
+import { AlchemyProfile } from "../../Auth/Profile.ts";
 
 import {
+  buildBuiltinAuthProviders,
+  buildStackProviders,
   envFile,
   instrumentCommand,
   printProfile,
   profile,
 } from "./_shared.ts";
 
+/**
+ * Entrypoint whose `providers()` layer contributes the user's own auth
+ * providers. Optional and best-effort — if it's missing or fails to load,
+ * `profile show` still renders the built-in providers.
+ */
+const mainFile = Argument.file("main").pipe(
+  Argument.withDescription(
+    "Stack entrypoint whose providers() should be used, defaults to alchemy.run.ts",
+  ),
+  Argument.withDefault("alchemy.run.ts"),
+);
+
+/**
+ * Populate an {@link AuthProviders} registry for display: the built-in
+ * providers first, then the user's stack `providers()` layer on top so a
+ * customized provider (same name) overrides the built-in one. Loading the
+ * user's stack is best-effort — a missing or invalid entrypoint leaves the
+ * built-ins in place.
+ *
+ * Registration happens as a side effect of building each layer (see
+ * `AuthProviderLayer`), and later builds overwrite earlier entries by name,
+ * so build order is what gives the user's providers precedence.
+ */
+export const collectAuthProviders = Effect.fn("collectAuthProviders")(
+  function* (options: {
+    main: string;
+    envFile: Option.Option<string>;
+    profile: string;
+  }) {
+    const authProviders: AuthProviders["Service"] = {};
+
+    // 1. Built-in providers first (baseline).
+    yield* buildBuiltinAuthProviders({
+      envFile: options.envFile,
+      profile: options.profile,
+      registry: authProviders,
+    });
+
+    // 2. The user's own providers() layer on top — building into the same
+    //    registry overrides the built-ins by name. Best-effort: swallow
+    //    load/build failures (including a missing entrypoint) so display
+    //    still works with just the built-ins.
+    yield* buildStackProviders({ ...options, registry: authProviders }).pipe(
+      Effect.catchCause((cause) =>
+        Effect.logDebug("profile show: could not load user stack providers", {
+          cause,
+        }),
+      ),
+    );
+
+    return authProviders;
+  },
+);
+
 const showCommand = Command.make(
   "show",
-  { profile, envFile },
+  { profile, envFile, main: mainFile },
   instrumentCommand("profile.show", (a: { profile: string }) => ({
     "alchemy.profile": a.profile,
   }))(
-    Effect.fn(function* ({ profile, envFile }) {
+    Effect.fn(function* ({ profile, envFile, main }) {
       const profiles = yield* AlchemyProfile;
       const stored = yield* profiles.getProfile(profile);
       if (stored == null) {
@@ -45,32 +92,13 @@ const showCommand = Command.make(
         return;
       }
 
-      const authProviders: AuthProviders["Service"] = {};
-      const authRegistry = Layer.succeed(AuthProviders, authProviders);
-      const services = Layer.mergeAll(
-        authRegistry,
-        ConfigProvider.layer(
-          withProfileOverride(yield* loadConfigProvider(envFile), profile),
-        ),
-        Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
-        // Building these layers triggers their AuthProviderLayer effect, which
-        // registers the provider into the shared `authProviders` registry.
-        Layer.provide(
-          Layer.mergeAll(
-            AwsAuth,
-            AxiomAuth,
-            CloudflareAuth,
-            GitHubAuth,
-            NeonAuth,
-            PlanetscaleAuth,
-          ),
-          authRegistry,
-        ),
-      );
+      const authProviders = yield* collectAuthProviders({
+        main,
+        envFile,
+        profile,
+      });
 
-      yield* printProfile(profile, stored, authProviders).pipe(
-        Effect.provide(services),
-      );
+      yield* printProfile(profile, stored, authProviders);
     }),
   ),
 );

package/src/Cli/commands/tail.ts

@@ -104,6 +104,7 @@ export const tailCommand = Command.make(
               logicalId: resource.LogicalId,
               stream: provider.tail({
                 id: resource.LogicalId,
+                fqn,
                 instanceId: (resourceState as any).instanceId,
                 props: (resourceState as any).props,
                 output: (resourceState as any).attr,