alchemy 2.0.0-beta.61 → 2.0.0-beta.63

package/src/Drizzle/Postgres.ts

@@ -4,10 +4,21 @@ import type { EffectPgDatabase } from "drizzle-orm/effect-postgres";
 import * as PgDrizzle from "drizzle-orm/effect-postgres";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import * as Redacted from "effect/Redacted";
-import { ExecutionContext } from "../ExecutionContext.ts";
+import type * as Redacted from "effect/Redacted";
+import type * as Scope from "effect/Scope";
 import { proxyChain } from "../Util/proxy-chain.ts";
 
+/**
+ * Per-execution pool memos, keyed on the execution's `Scope` object. Every
+ * bridge (Worker event, Durable Object call, Workflow run, Lambda invoke)
+ * provides a fresh `Scope` per execution, so an entry lives exactly as long
+ * as its execution and is garbage-collected with the scope object.
+ */
+const caches = new WeakMap<
+  Scope.Scope,
+  Map<symbol, Effect.Effect<any, any, any>>
+>();
+
 /**
  * Open a Drizzle/Postgres database from a connection URL using the
  * `drizzle-orm/effect-postgres` integration.
@@ -26,19 +37,20 @@ import { proxyChain } from "../Util/proxy-chain.ts";
  * ```
  *
  * The connect work is deferred until the first query and memoized on the
- * current `ExecutionContext` (`ctx.cache`), so the pool is built at most
- * once per execution — a Worker `fetch`/`queue`/`scheduled` event or a
- * Workflow run — and reused across every query and `task` step in that
- * execution. Yielding the connection string is likewise deferred, so
- * deploy / plan-time invocations (where `WorkerEnvironment` isn't
- * provided) never trigger a real connection attempt.
+ * current execution's `Scope` (`yield* Effect.scope`), so the pool is built
+ * at most once per execution — a Worker `fetch`/`queue`/`scheduled` event, a
+ * Durable Object call, a Workflow run, or a Lambda invocation — and reused
+ * across every query and `task` step in that execution. Yielding the
+ * connection string is likewise deferred, so deploy / plan-time invocations
+ * (where `WorkerEnvironment` isn't provided) never trigger a real connection
+ * attempt.
  *
- * The pool is built against the execution's `Scope` (`ctx.scope`), so its
- * `end` finalizer fires when that scope closes — when the request / run
- * settles, not when the `Cloudflare.Worker` init scope closes. Init runs
- * inside `Effect.scoped` and closes after returning the exports object;
- * building lazily against `ctx.scope` (rather than that init scope) is
- * what keeps later requests from seeing "Cannot use a pool after end".
+ * The pool is built against that same execution scope, so its `end`
+ * finalizer fires when the scope closes — when the request / run settles,
+ * not when the Worker's isolate-lifetime init completes. Wrapping queries in
+ * a nested `Effect.scoped` narrows both the memo and the pool's lifetime to
+ * that block: memo key and finalizer target are always the same scope
+ * object, so they cannot disagree.
  *
  * @binding
  */
@@ -60,16 +72,32 @@ export const postgres = <
       }
     >(
       Effect.gen(function* () {
-        const ctx = yield* ExecutionContext;
-        return yield* (ctx.cache[symbol] ??= yield* Effect.gen(function* () {
-          const pgCtx = yield* Layer.buildWithScope(
-            PgClient.layer({ url: yield* connectionString }),
-            ctx.scope,
-          );
-          return yield* PgDrizzle.makeWithDefaults(config).pipe(
-            Effect.provideContext(pgCtx),
+        const scope = yield* Effect.scope;
+        let cache = caches.get(scope);
+        if (cache === undefined) {
+          caches.set(scope, (cache = new Map()));
+        }
+        let memo = cache.get(symbol);
+        if (memo === undefined) {
+          // `Effect.cached` only allocates the memo cell — the build runs
+          // on first evaluation — so this yield is synchronous and the
+          // fiber cannot be interleaved between the miss check and the
+          // set: a concurrent first query joins this memo (evaluating the
+          // same cached effect) instead of building a second pool.
+          memo = yield* Effect.cached(
+            Effect.gen(function* () {
+              const pgCtx = yield* Layer.buildWithScope(
+                PgClient.layer({ url: yield* connectionString }),
+                scope,
+              );
+              return yield* PgDrizzle.makeWithDefaults(config).pipe(
+                Effect.provideContext(pgCtx),
+              );
+            }),
           );
-        }).pipe(Effect.cached));
+          cache.set(symbol, memo);
+        }
+        return yield* memo;
       }) as Effect.Effect<
         EffectPgDatabase<TRelations> & {
           $client: PgClient.PgClient;

package/src/GitHub/AuthProvider.ts

@@ -297,9 +297,6 @@ export const GitHubAuth = AuthProviderLayer<
             Console.log(`  source: ${sourceStr}`),
           ]);
         }),
-        Effect.catch((e) =>
-          Console.error(`  Failed to retrieve credentials: ${e}`),
-        ),
       );
 
     return {

package/src/GitHub/Env.ts

@@ -0,0 +1,57 @@
+import * as Array from "effect/Array";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import { flow } from "effect/Function";
+import * as Option from "effect/Option";
+import * as String from "effect/String";
+
+export interface GitHubEnv {
+  /** The commit SHA that triggered the workflow run. */
+  readonly sha: string;
+  /** The repository owner from `GITHUB_REPOSITORY_OWNER`. */
+  readonly owner: string;
+  /** The repository name parsed from `GITHUB_REPOSITORY`. */
+  readonly repository: string;
+  /** The pull request number exported by the Alchemy GitHub Action. */
+  readonly pr: number | undefined;
+}
+
+/**
+ * GitHub Actions metadata for conditional resources in `alchemy.run.ts`.
+ *
+ * Resolves to `undefined` outside GitHub Actions. In GitHub Actions, it reads
+ * `GITHUB_SHA`, `GITHUB_REPOSITORY_OWNER`, `GITHUB_REPOSITORY`, and the optional
+ * `PULL_REQUEST` variable exported by the Alchemy GitHub Action.
+ */
+export const GitHubEnv: Config.Config<GitHubEnv | undefined> = Config.boolean(
+  "GITHUB_ACTIONS",
+).pipe(
+  Config.withDefault(false),
+  // Config has no flatMap in Effect 4; a Config is itself an Effect, so the
+  // enabled branch returns the inner config for mapOrFail to evaluate.
+  Config.mapOrFail(
+    (enabled): Effect.Effect<GitHubEnv | undefined, Config.ConfigError> =>
+      enabled
+        ? Config.all({
+            sha: Config.string("GITHUB_SHA"),
+            owner: Config.string("GITHUB_REPOSITORY_OWNER"),
+            repository: Config.string("GITHUB_REPOSITORY").pipe(
+              Config.mapOrFail(
+                flow(
+                  String.split("/"),
+                  Array.get(1),
+                  Effect.fromOption,
+                  Effect.catchTags({
+                    NoSuchElementError: Effect.die,
+                  }),
+                ),
+              ),
+            ),
+            pr: Config.number("PULL_REQUEST").pipe(
+              Config.option,
+              Config.map(Option.getOrUndefined),
+            ),
+          })
+        : Effect.succeed(undefined),
+  ),
+);

package/src/GitHub/Secrets.ts

@@ -41,7 +41,7 @@ export interface SecretsProps {
  * ```ts
  * yield* GitHub.Secrets({
  *   owner: "alchemy-run",
- *   repository: "alchemy-effect",
+ *   repository: "alchemy",
  *   secrets: {
  *     AXIOM_INGEST_TOKEN: tokenValue,
  *     AXIOM_DATASET_TRACES: traces.name,

package/src/GitHub/Variables.ts

@@ -33,7 +33,7 @@ export interface VariablesProps {
  * ```ts
  * yield* GitHub.Variables({
  *   owner: "alchemy-run",
- *   repository: "alchemy-effect",
+ *   repository: "alchemy",
  *   variables: {
  *     AWS_ROLE_ARN: role.roleArn,
  *     AWS_REGION: region,

package/src/GitHub/index.ts

@@ -1,6 +1,7 @@
 export * as Auth from "./AuthProvider.ts";
 export * from "./Comment.ts";
 export { GitHubCredentials, fromEnv, fromToken } from "./Credentials.ts";
+export * from "./Env.ts";
 export * from "./Providers.ts";
 export * from "./Repository.ts";
 export * from "./RepositoryEventSource.ts";

package/src/Http.ts

@@ -16,6 +16,17 @@ export type HttpEffect<Req = never> = Effect.Effect<
   HttpServerRequest | Scope | Req
 >;
 
+/**
+ * `effect`'s HttpEffect brands a request scope as "ejected" when ownership
+ * is transferred to a consumer that outlives the handler's return — a
+ * streaming response body, a WebSocket upgrade, an RPC stream. Bridges check
+ * this before their close-on-return path: an ejected scope is closed by its
+ * new owner when it finishes, not by the bridge.
+ */
+const scopeEjected = Symbol.for("effect/http/HttpEffect/scopeEjected");
+
+export const isScopeEjected = (scope: Scope) => scopeEjected in scope;
+
 export const serve = <Req = never>(
   handler: Effect.Effect<
     HttpServerResponse.HttpServerResponse,

package/src/Local/RpcProviderProxy.ts

@@ -65,7 +65,7 @@ const make = Effect.fn(function* (spawnerUrl: string) {
 
   return RpcProviderProxy.of({
     get: Effect.fn(function* (mainUrl, providerName) {
-      const session = yield* cache.lookup(mainUrl);
+      const session = yield* Cache.get(cache, mainUrl);
       const provider = yield* Effect.promise(
         () =>
           session.getProvider(providerName) as ReturnType<

package/src/Local/RpcSerialization.ts

@@ -7,6 +7,7 @@ import * as Schema from "effect/Schema";
 import * as Stream from "effect/Stream";
 import * as NodeUtil from "node:util";
 import * as Output from "../Output.ts";
+import { isRedactedMarker, type RedactedMarker } from "../RuntimeContext.ts";
 
 type RpcEffectHandler<Args extends Array<any>, Success, Error> = (
   ...args: Args
@@ -173,7 +174,10 @@ const unwrapRpcStreamHandler = <Args extends Array<any>, Success, Error>(
 
 const serializeRpcArgs = (value: unknown): unknown => {
   if (Redacted.isRedacted(value)) {
-    return { _tag: "Redacted", value: Redacted.value(value) };
+    return {
+      _tag: "Redacted",
+      value: Redacted.value(value),
+    } satisfies RedactedMarker;
   }
   if (Output.isOutput(value)) {
     return {
@@ -204,7 +208,7 @@ const deserializeRpcArgs = (value: unknown): unknown => {
   } else if (typeof value === "object" && value !== null) {
     // These values are serialized as `{_tag: "Redacted", value: ...}` and `{_tag: "Output", description: ...}`,
     // so we need to detect them manually - Redacted.isRedacted and Output.isOutput do not work.
-    if ("_tag" in value && value._tag === "Redacted" && "value" in value) {
+    if (isRedactedMarker(value)) {
       return Redacted.make(value.value);
     } else if (
       "_tag" in value &&

package/src/Local/RpcSpawner.ts

@@ -1,5 +1,6 @@
 import { exitHook } from "@alchemy.run/node-utils/exit-hook";
 import * as Cache from "effect/Cache";
+import * as Console from "effect/Console";
 import * as Context from "effect/Context";
 import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
@@ -78,7 +79,11 @@ export const make = Effect.fn(function* ({
       }[bin],
       {
         stdout: "pipe",
-        stderr: "inherit",
+        // Piped (NOT inherited) so the child's output routes through the
+        // Effect Console service: raw writes to the parent's fd corrupt the
+        // test runner's reporter/TUI. The drain below is mandatory — an
+        // unread pipe eventually fills and blocks the child.
+        stderr: "pipe",
         detached: false,
         env: {
           [RPC_SERVER_ENVIRONMENT_KEY]: JSON.stringify(environment),
@@ -87,6 +92,13 @@ export const make = Effect.fn(function* ({
       },
     );
     const handle = yield* spawner.spawn(command);
+    yield* handle.stderr.pipe(
+      Stream.decodeText,
+      Stream.splitLines,
+      Stream.runForEach((line) => Console.error(line)),
+      Effect.ignore,
+      Effect.forkScoped,
+    );
     const unregister = exitHook(() => {
       killProcessGroup(handle.pid, "SIGKILL");
     });
@@ -168,13 +180,14 @@ const getRpcAddress = (stdout: Stream.Stream<Uint8Array, PlatformError>) =>
       Stream.splitLines,
       Stream.runForEach((line) => {
         if (done) {
-          console.log(line);
-        } else {
-          const match = line.match(RPC_ADDRESS_REGEX);
-          if (match) {
-            done = true;
-            return Deferred.succeed(address, match[2]);
-          }
+          // Through the Console SERVICE so runners that override it (e.g.
+          // alchemy-test's per-test buffer) capture the sidecar's output.
+          return Console.log(line);
+        }
+        const match = line.match(RPC_ADDRESS_REGEX);
+        if (match) {
+          done = true;
+          return Deferred.succeed(address, match[2]);
         }
         return Effect.void;
       }),

package/src/Neon/AuthProvider.ts

@@ -129,7 +129,7 @@ export const NeonAuth = AuthProviderLayer<
                 ? Effect.fail(
                     new AuthError({
                       message:
-                        "Neon stored credentials not found. Run: alchemy-effect login --configure",
+                        "Neon stored credentials not found. Run: alchemy login --configure",
                     }),
                   )
                 : Effect.succeed({
@@ -207,9 +207,6 @@ export const NeonAuth = AuthProviderLayer<
             Console.log(`  source: ${sourceStr}`),
           ]);
         }),
-        Effect.catch((e) =>
-          Console.error(`  Failed to retrieve credentials: ${e}`),
-        ),
       );
 
     return {

package/src/Neon/Project.ts

@@ -565,10 +565,10 @@ export const waitForOperations = (
               tag === "GatewayTimeout"
             );
           },
-          schedule: Schedule.both(
+          schedule: Schedule.max([
             Schedule.exponential(Duration.millis(500), 1.5),
             Schedule.recurs(60),
-          ),
+          ]),
         }),
         Effect.catchTag("OperationPending", () => Effect.void),
       );

package/src/Plan.ts

@@ -324,6 +324,7 @@ export const make = <A>(
                 ? provider
                     .diff({
                       id: resource.LogicalId,
+                      fqn: resource.FQN,
                       olds: oldProps,
                       instanceId: oldState.instanceId,
                       news: props,
@@ -542,7 +543,18 @@ export const make = <A>(
         (action) =>
           [
             action.FQN,
-            Object.values(Output.upstreamAny(action.Input)).map((r) => r.FQN),
+            // An Action depends on the resources referenced by its Input *and*
+            // any Output captured via `yield* output` inside its init Effect.
+            Array.from(
+              new Set([
+                ...Object.values(Output.upstreamAny(action.Input)).map(
+                  (r) => r.FQN,
+                ),
+                ...Object.values(Output.upstreamAny(action.Captures)).map(
+                  (r) => r.FQN,
+                ),
+              ]),
+            ),
           ] as const,
       ),
     ]);
@@ -571,7 +583,8 @@ export const make = <A>(
         const bindDeps = bindingUpstreamDependencies[fqn] ?? [];
         return [fqn, [...new Set([...propDeps, ...bindDeps])]];
       }),
-      // Actions have no bindings — their upstream is purely their input.
+      // Actions have no bindings — their upstream is input + init captures,
+      // both already folded into newUpstreamDependencies above.
       ...actions.map((action): [string, string[]] => {
         const fqn = action.FQN;
         return [fqn, newUpstreamDependencies[fqn] ?? []];
@@ -697,21 +710,32 @@ export const make = <A>(
             //   - `Unowned(attrs)`   → exists but is *not* ours
             //
             // Routing:
-            //   - owned                          → persist `created` state
+            //   - owned                          → adopt the `created` state
             //                                      from attrs and continue
             //                                      through the normal diff
             //                                      path (so subsequent props
             //                                      drift produces an update).
-            //   - unowned + adopt enabled        → take over: persist `created`
-            //                                      state and let the next
-            //                                      update overwrite tags / etc.
+            //   - unowned + adopt enabled        → take over: adopt the
+            //                                      `created` state and let the
+            //                                      next update overwrite tags.
             //   - unowned + adopt disabled       → fail with
             //                                      `OwnedBySomeoneElse`.
+            //
+            // Plan construction is side-effect-free: the adopted `created`
+            // state is only held in-memory here (to drive the diff) and rides
+            // onto the plan node as `node.state`. Persisting it to the state
+            // store happens exclusively during APPLY of that node (the update
+            // lifecycle commits `updating` / `updated` carrying this state).
+            // If planning persisted here, a mere `alchemy plan` / `--dry-run`
+            // would claim ownership of an unowned cloud resource, arming a
+            // later unrelated deploy to orphan-delete it. See
+            // https://github.com/alchemy-run/alchemy/issues/793.
+            //
             // After a cold-start adoption (engine just discovered an
             // existing cloud resource via `read`), force the engine's
             // normal `update` path so the provider can re-sync ownership
             // tags, configuration, etc. against the desired props.
-            // Adoption persists state with `props: news`, so the default
+            // Adoption carries state with `props: news`, so the default
             // diff sees no drift and would noop — which would leave any
             // foreign-owned tags / divergent config in place. Forcing
             // update keeps the deploy idempotent: if cloud state already
@@ -730,6 +754,7 @@ export const make = <A>(
               const readResult = yield* provider
                 .read({
                   id,
+                  fqn,
                   instanceId: adoptInstanceId,
                   olds: news,
                   output: undefined,
@@ -765,12 +790,13 @@ export const make = <A>(
                   downstream,
                   removalPolicy: resource.RemovalPolicy,
                 } satisfies CreatedResourceState;
-                yield* state.set({
-                  stack: stackName,
-                  stage: stage,
-                  fqn,
-                  value: adoptedState,
-                });
+                // In-memory only — do NOT persist here. Plan.make runs for
+                // `alchemy plan` / `deploy --dry-run` too, so a `state.set`
+                // would mutate persistent state during a read-only preview.
+                // The adopted state rides onto the plan node via `oldState`
+                // (→ `node.state`) and is persisted at APPLY time by the
+                // update lifecycle's `updating` / `updated` commits. See
+                // https://github.com/alchemy-run/alchemy/issues/793.
                 oldState = adoptedState;
                 forceUpdateAfterAdoption = true;
               }
@@ -813,6 +839,7 @@ export const make = <A>(
                 const attr = yield* provider
                   .read({
                     id,
+                    fqn,
                     instanceId: oldState.instanceId,
                     olds: oldState.props,
                     output: oldState.attr,
@@ -837,6 +864,7 @@ export const make = <A>(
               provider
                 ?.diff?.({
                   id,
+                  fqn,
                   olds: oldProps,
                   instanceId: oldState.instanceId,
                   output: oldState.attr,
@@ -1196,6 +1224,7 @@ export const make = <A>(
                   LogicalId: logicalId,
                   Type: persisted.actionType,
                   Input: persisted.input,
+                  Captures: {},
                   Run: () => undefined as any,
                   Output: undefined as any,
                 } satisfies ActionLike,
@@ -1232,6 +1261,7 @@ export const make = <A>(
                   attr = yield* provider
                     .read({
                       id: logicalId,
+                      fqn,
                       instanceId: oldState.instanceId,
                       olds: oldState.props as never,
                       output: oldState.attr as never,