alchemy 2.0.0-beta.75 → 2.0.0-beta.77

package/src/Prisma/AuthProvider.ts

@@ -1,260 +1,82 @@
-import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
-import * as Match from "effect/Match";
 import * as Redacted from "effect/Redacted";
+import { AuthError } from "../Auth/AuthProvider.ts";
+import { getEnvRedacted } from "../Auth/Env.ts";
 import {
-  AuthError,
-  AuthProviderLayer,
-  type ConfigureContext,
-} from "../Auth/AuthProvider.ts";
-import { CredentialsStore, displayRedacted } from "../Auth/Credentials.ts";
-import { getEnvRedacted, retryOnce } from "../Auth/Env.ts";
-import { AlchemyProfile } from "../Auth/Profile.ts";
-import * as Clank from "../Util/Clank.ts";
+  makeStoredAuthProvider,
+  storedSecret,
+  type StoredAuthConfig,
+} from "../Auth/StoredAuthProvider.ts";
 
 export const PRISMA_AUTH_PROVIDER_NAME = "Prisma";
-export const PRISMA_SERVICE_TOKEN_ENV = "PRISMA_SERVICE_TOKEN";
-export const PRISMA_API_TOKEN_ENV = "PRISMA_API_TOKEN";
 
-export type PrismaAuthConfig = { method: "env" } | { method: "stored" };
-
-export interface PrismaStoredCredentials {
-  type: "serviceToken";
-  serviceToken: string;
-}
+export type PrismaAuthConfig = StoredAuthConfig;
 
 export interface PrismaResolvedCredentials {
   type: "serviceToken";
   serviceToken: Redacted.Redacted<string>;
-  source: { type: PrismaAuthConfig["method"]; details?: string };
+  source: { type: PrismaAuthConfig["method"] | "env"; details?: string };
 }
 
-const options: Array<{
-  value: PrismaAuthConfig["method"];
-  label: string;
-  hint?: string;
-}> = [
-  {
-    value: "env",
-    label: "Environment Variable",
-    hint: `${PRISMA_SERVICE_TOKEN_ENV} or ${PRISMA_API_TOKEN_ENV}`,
-  },
-  {
-    value: "stored",
-    label: "Service Token",
-    hint: "enter interactively, stored in ~/.alchemy/credentials",
-  },
-];
-
-const nonEmptyToken = (
-  token: Redacted.Redacted<string> | undefined,
-): token is Redacted.Redacted<string> =>
-  token !== undefined && Redacted.value(token).trim().length > 0;
-
-const validStoredCredentials = (
-  credentials: PrismaStoredCredentials | undefined,
-): credentials is PrismaStoredCredentials =>
-  credentials?.type === "serviceToken" &&
-  credentials.serviceToken.trim().length > 0;
-
-const trimToken = (token: Redacted.Redacted<string>) =>
-  Redacted.make(Redacted.value(token).trim());
-
-const readEnvServiceToken = Effect.fnUntraced(function* () {
-  const serviceToken = yield* getEnvRedacted(PRISMA_SERVICE_TOKEN_ENV);
-  if (nonEmptyToken(serviceToken)) {
-    return {
-      serviceToken: trimToken(serviceToken),
-      envName: PRISMA_SERVICE_TOKEN_ENV,
-    };
-  }
-
-  const apiToken = yield* getEnvRedacted(PRISMA_API_TOKEN_ENV);
-  if (nonEmptyToken(apiToken)) {
+const prismaAuth = makeStoredAuthProvider<PrismaResolvedCredentials>({
+  provider: PRISMA_AUTH_PROVIDER_NAME,
+  fields: [
+    {
+      name: "serviceToken",
+      label: "Prisma Service Token",
+      secret: true,
+      validate: (value) => (value.trim().length === 0 ? "Required" : undefined),
+    },
+  ],
+  toResolved: (values) => ({
+    type: "serviceToken",
+    serviceToken: storedSecret(values.serviceToken) ?? Redacted.make(""),
+    source: { type: "stored" },
+  }),
+  readEnvironment: Effect.gen(function* () {
+    const serviceToken = yield* getEnvRedacted("PRISMA_SERVICE_TOKEN");
+    const apiToken = yield* getEnvRedacted("PRISMA_API_TOKEN");
+    const token = serviceToken ?? apiToken;
+    if (token === undefined || Redacted.value(token).trim().length === 0) {
+      return yield* new AuthError({
+        message:
+          "Prisma CI credentials not found. Set PRISMA_SERVICE_TOKEN or PRISMA_API_TOKEN.",
+      });
+    }
     return {
-      serviceToken: trimToken(apiToken),
-      envName: PRISMA_API_TOKEN_ENV,
+      type: "serviceToken" as const,
+      serviceToken: Redacted.make(Redacted.value(token).trim()),
+      source: {
+        type: "env" as const,
+        details:
+          serviceToken === undefined
+            ? "PRISMA_API_TOKEN"
+            : "PRISMA_SERVICE_TOKEN",
+      },
     };
-  }
-
-  return undefined;
+  }),
+  environment: [
+    {
+      name: "PRISMA_SERVICE_TOKEN",
+      required: true,
+      secret: true,
+      alternatives: ["PRISMA_API_TOKEN"],
+      description: "Prisma Platform service token.",
+    },
+    {
+      name: "PRISMA_API_URL",
+      required: false,
+      alternatives: ["PRISMA_MANAGEMENT_API_URL"],
+      description: "Management API base URL override.",
+    },
+  ],
 });
 
 /**
  * Layer that registers the Prisma Management API auth provider.
  */
-export const PrismaAuth = AuthProviderLayer<
-  PrismaAuthConfig,
-  PrismaResolvedCredentials
->()(
-  PRISMA_AUTH_PROVIDER_NAME,
-  Effect.gen(function* () {
-    const profiles = yield* AlchemyProfile;
-    const store = yield* CredentialsStore;
-
-    const loginStored = Effect.fnUntraced(function* (profileName: string) {
-      const serviceToken = yield* Clank.password({
-        message: "Prisma Service Token",
-        validate: (v) => (v.trim().length === 0 ? "Required" : undefined),
-      }).pipe(retryOnce);
-
-      yield* store.write<PrismaStoredCredentials>(
-        profileName,
-        "prisma-stored",
-        {
-          type: "serviceToken",
-          serviceToken: serviceToken.trim(),
-        },
-      );
-      yield* Clank.success("Prisma: credentials saved.");
-      return { method: "stored" as const };
-    });
-
-    const configureInteractive = (profileName: string) =>
-      Clank.select({
-        message: "Prisma authentication method",
-        options,
-      }).pipe(
-        Effect.flatMap((method) =>
-          Match.value(method).pipe(
-            Match.when("env", () => Effect.succeed({ method: "env" as const })),
-            Match.when("stored", () => loginStored(profileName)),
-            Match.exhaustive,
-          ),
-        ),
-      );
-
-    const configure = (profileName: string, ctx: ConfigureContext) =>
-      Effect.gen(function* () {
-        if (ctx.ci) return { method: "env" as const };
-        return yield* configureInteractive(profileName);
-      }).pipe(
-        Effect.mapError(
-          (e) =>
-            new AuthError({
-              message: "failed to configure credentials",
-              cause: e,
-            }),
-        ),
-      );
+export const PrismaAuth = prismaAuth.layer;
 
-    const read = (
-      profileName: string,
-      config: PrismaAuthConfig,
-    ): Effect.Effect<PrismaResolvedCredentials, AuthError> =>
-      Match.value(config).pipe(
-        Match.when(
-          { method: "env" },
-          Effect.fnUntraced(function* () {
-            const envToken = yield* readEnvServiceToken();
-            if (!envToken) {
-              return yield* new AuthError({
-                message: `Prisma env credentials not found. Set ${PRISMA_SERVICE_TOKEN_ENV} or ${PRISMA_API_TOKEN_ENV}.`,
-              });
-            }
-            return {
-              type: "serviceToken" as const,
-              serviceToken: envToken.serviceToken,
-              source: { type: "env" as const, details: envToken.envName },
-            };
-          }),
-        ),
-        Match.when({ method: "stored" }, () =>
-          store
-            .read<PrismaStoredCredentials>(profileName, "prisma-stored")
-            .pipe(
-              Effect.flatMap((creds) =>
-                !validStoredCredentials(creds)
-                  ? Effect.fail(
-                      new AuthError({
-                        message:
-                          creds == null
-                            ? "Prisma stored credentials not found. Run: alchemy login --configure"
-                            : "Prisma stored credentials are invalid. Run: alchemy login --configure",
-                      }),
-                    )
-                  : Effect.succeed({
-                      type: "serviceToken" as const,
-                      serviceToken: Redacted.make(creds.serviceToken.trim()),
-                      source: { type: "stored" as const },
-                    }),
-              ),
-            ),
-        ),
-        Match.exhaustive,
-      );
-
-    const login = (profileName: string, config: PrismaAuthConfig) =>
-      Match.value(config)
-        .pipe(
-          Match.when({ method: "env" }, () =>
-            readEnvServiceToken().pipe(
-              Effect.flatMap((envToken) =>
-                envToken
-                  ? Effect.void
-                  : Effect.gen(function* () {
-                      const next = yield* configureInteractive(profileName);
-                      const existing = yield* profiles.getProfile(profileName);
-                      yield* profiles.setProfile(profileName, {
-                        ...existing,
-                        [PRISMA_AUTH_PROVIDER_NAME]: next,
-                      });
-                    }),
-              ),
-            ),
-          ),
-          Match.when({ method: "stored" }, () =>
-            store
-              .read<PrismaStoredCredentials>(profileName, "prisma-stored")
-              .pipe(
-                Effect.flatMap((creds) =>
-                  validStoredCredentials(creds)
-                    ? Effect.void
-                    : loginStored(profileName),
-                ),
-              ),
-          ),
-          Match.exhaustive,
-        )
-        .pipe(
-          Effect.mapError(
-            (e) => new AuthError({ message: "login failed", cause: e }),
-          ),
-        );
-
-    const logout = (profileName: string, config: PrismaAuthConfig) =>
-      Match.value(config).pipe(
-        Match.when({ method: "env" }, () => Effect.void),
-        Match.when({ method: "stored" }, () =>
-          store
-            .delete(profileName, "prisma-stored")
-            .pipe(
-              Effect.andThen(
-                Clank.success("Prisma: stored credentials removed"),
-              ),
-            ),
-        ),
-        Match.exhaustive,
-      );
-
-    const prettyPrint = (profileName: string, config: PrismaAuthConfig) =>
-      read(profileName, config).pipe(
-        Effect.tap((creds) => {
-          const source = creds.source.details
-            ? `${creds.source.type} - ${creds.source.details}`
-            : creds.source.type;
-          return Effect.all([
-            Console.log(
-              `  serviceToken: ${displayRedacted(creds.serviceToken, 9)}`,
-            ),
-            Console.log(`  source: ${source}`),
-          ]);
-        }),
-        Effect.catch((e) =>
-          Console.error(`  Failed to retrieve credentials: ${e}`),
-        ),
-      );
-
-    return { configure, login, logout, prettyPrint, read };
-  }),
-);
+/** Schema of Prisma's inline static-token values. */
+export const PrismaStoredCredentials = prismaAuth.storedSchema;
+export type PrismaStoredCredentials = typeof PrismaStoredCredentials.Type;

package/src/Prisma/Compute.ts

@@ -585,16 +585,13 @@ const isEffectNativeCompute = (props: ComputeProps) =>
  * ```
  *
  * ### Bundling & Tree-shaking
- * `main` is bundled with rolldown at deploy time. Top-level calls in the
- * `effect`, `@effect/*`, `alchemy`, `@alchemy.run/*`, and
- * `@distilled.cloud/*` packages receive `#__PURE__` annotations by
- * default, so anything the app doesn't use from those packages is
- * tree-shaken out of the bundle. Any other package — including your own
- * app — is left untouched unless you list it explicitly.
+ * `main` is bundled with rolldown at deploy time. Unused code is
+ * tree-shaken. `effect`, alchemy, and `@distilled.cloud` are marked
+ * pure so unused parts prune more aggressively. Your app is not
+ * marked pure.
  *
- * **Example:** Treat additional packages as pure
- * Pass package names (or picomatch globs) via `bundle.extra.pure.packages` to
- * annotate them in addition to the defaults.
+ * **Example:** Mark additional packages as pure
+ * Only list packages with no top-level side effects.
  * ```typescript
  * {
  *   main: "./src/app.ts",
@@ -604,18 +601,7 @@ const isEffectNativeCompute = (props: ComputeProps) =>
  * }
  * ```
  *
- * Listing a package annotates calls whose result is bound (variable
- * initializers, exports) — safe anywhere. If a listed package also
- * declares `"sideEffects": false` (or `[]`) in its `package.json`, that
- * combination opts it into full annotation: top-level calls whose result
- * is discarded (e.g. `router.on("/path", handler)` registrations) are
- * also marked pure and deleted under minification when unused. Only list
- * a `sideEffects: false` package if its modules really are free of
- * meaningful top-level side effects. The `effect`, `alchemy`, and
- * `@distilled.cloud` defaults declare exactly that, on purpose — their
- * modules are designed to be fully tree-shakeable.
- *
- * **Example:** Disable pure annotations
+ * **Example:** Turn it off
  * ```typescript
  * {
  *   main: "./src/app.ts",

package/src/Prisma/PrismaEnvironment.ts

@@ -2,8 +2,7 @@ import * as Config from "effect/Config";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { getAuthProvider } from "../Auth/AuthProvider.ts";
-import { ALCHEMY_PROFILE, AlchemyProfile } from "../Auth/Profile.ts";
+import { resolveProviderConfig } from "../Auth/Resolve.ts";
 import {
   PRISMA_AUTH_PROVIDER_NAME,
   type PrismaAuthConfig,
@@ -67,23 +66,16 @@ export const fromProfile = () =>
   Layer.effect(
     PrismaEnvironment,
     Effect.gen(function* () {
-      const profile = yield* AlchemyProfile;
-      const auth = yield* getAuthProvider<
-        PrismaAuthConfig,
-        PrismaResolvedCredentials
-      >(PRISMA_AUTH_PROVIDER_NAME);
-      const profileName = yield* ALCHEMY_PROFILE;
-      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
       const baseUrl = yield* Config.string(PRISMA_API_URL_ENV).pipe(
         Config.orElse(() => Config.string(PRISMA_MANAGEMENT_API_URL_ENV)),
         Config.withDefault(DEFAULT_BASE_URL),
         Effect.flatMap(normalizeBaseUrl),
       );
-      const config = yield* profile.loadOrConfigure(auth, profileName, { ci });
-      const credentials = yield* auth.read(
-        profileName,
-        config as PrismaAuthConfig,
-      );
+      const { resolve } = yield* resolveProviderConfig<
+        PrismaAuthConfig,
+        PrismaResolvedCredentials
+      >(PRISMA_AUTH_PROVIDER_NAME);
+      const credentials = yield* resolve;
       return { ...credentials, baseUrl };
     }),
   );

package/src/Prisma/Providers.ts

@@ -3,7 +3,7 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import { AuthProviders } from "../Auth/AuthProvider.ts";
 import { CredentialsStoreLive } from "../Auth/Credentials.ts";
-import { AlchemyProfile, ProfileLive } from "../Auth/Profile.ts";
+import { ProfileStore, ProfileStoreLive } from "../Auth/Profile.ts";
 import * as Provider from "../Provider.ts";
 import { PlatformServices } from "../Util/PlatformServices.ts";
 import { proxyChain } from "../Util/proxy-chain.ts";
@@ -60,7 +60,7 @@ const standaloneManagementApiLayer = () =>
         // The Prisma-scoped upload client (node transport) rides the
         // providers' output so artifact uploads can reach it at op time.
         PrismaUploadClientLive,
-        Layer.provide(ProfileLive, PlatformServices),
+        Layer.provide(ProfileStoreLive, PlatformServices),
         Layer.provide(CredentialsStoreLive, PlatformServices),
       ),
     ),
@@ -76,8 +76,8 @@ const standaloneManagementApiLayer = () =>
 /**
  * Stack provider discovery must register auth without requiring credentials.
  * The management client is resolved on its first API operation, after
- * `alchemy login` has had a chance to configure the registered Prisma auth
- * provider. The nested client layer shares the provider layer's lifetime.
+ * `alchemy profile edit` has had a chance to configure the registered Prisma
+ * auth provider. The nested client layer shares the provider layer's lifetime.
  */
 const stackManagementApiLayer = () =>
   Layer.effect(
@@ -85,7 +85,7 @@ const stackManagementApiLayer = () =>
     Effect.gen(function* () {
       const scope = yield* Effect.scope;
       const authProviders = yield* AuthProviders;
-      const profile = yield* AlchemyProfile;
+      const profileStore = yield* ProfileStore;
       const client = Layer.buildWithScope(
         PrismaClientLive.pipe(
           Layer.provideMerge(
@@ -93,7 +93,7 @@ const stackManagementApiLayer = () =>
               Layer.provide(
                 Layer.mergeAll(
                   Layer.succeed(AuthProviders, authProviders),
-                  Layer.succeed(AlchemyProfile, profile),
+                  Layer.succeed(ProfileStore, profileStore),
                 ),
               ),
             ),
@@ -112,7 +112,7 @@ const stackManagementApiLayer = () =>
         // The Prisma-scoped upload client (node transport) rides the
         // providers' output so artifact uploads can reach it at op time.
         PrismaUploadClientLive,
-        Layer.provide(ProfileLive, PlatformServices),
+        Layer.provide(ProfileStoreLive, PlatformServices),
         Layer.provide(CredentialsStoreLive, PlatformServices),
       ),
     ),

package/src/Provider.ts

@@ -3,9 +3,10 @@ import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
+import * as Predicate from "effect/Predicate";
 import type * as Stream from "effect/Stream";
 import type { Artifacts } from "./Artifacts.ts";
-import type { ScopedPlanStatusSession } from "./Cli/Cli.ts";
+import type { ScopedPlanStatusSession } from "./Report.ts";
 import type { Diff } from "./Diff.ts";
 import type { Input } from "./Input.ts";
 import type { InstanceId } from "./InstanceId.ts";
@@ -220,7 +221,7 @@ export interface ProviderService<
   list(): Effect.Effect<Res["Attributes"][], any, ListReq>;
   /**
    * Returns a stream of log lines for a deployed resource.
-   * Used by `alchemy tail` to stream real-time logs.
+   * Used by `alchemy logs --tail` to stream real-time logs.
    */
   tail?(input: {
     id: string;
@@ -575,13 +576,12 @@ export const collection = <
     };
   }) as any;
 
-const isProviderCollectionService = (
+export const isProviderCollectionService = (
   value: unknown,
 ): value is ProviderCollectionService => {
   return (
-    typeof value === "object" &&
-    value !== null &&
-    "kind" in value &&
+    Predicate.isObject(value) &&
+    Predicate.hasProperty(value, "kind") &&
     value.kind === "ProviderCollection"
   );
 };
@@ -592,13 +592,12 @@ const isProviderCollectionService = (
  * searching for a legacy alias, the tag key won't match, so lookup has to
  * recognize provider services by shape.
  */
-const isProviderService = (value: unknown): value is ProviderService =>
-  typeof value === "object" &&
-  value !== null &&
-  "reconcile" in value &&
-  typeof (value as ProviderService).reconcile === "function" &&
-  "delete" in value &&
-  typeof (value as ProviderService).delete === "function";
+export const isProviderService = (value: unknown): value is ProviderService =>
+  Predicate.isObject(value) &&
+  Predicate.hasProperty(value, "reconcile") &&
+  Predicate.isFunction(value.reconcile) &&
+  Predicate.hasProperty(value, "delete") &&
+  Predicate.isFunction(value.delete);
 
 /**
  * Resolve the concrete service for `mode` from a provider found in context.