alchemy 2.0.0-beta.75 → 2.0.0-beta.77

package/src/Cli/commands/_shared.ts

@@ -1,498 +0,0 @@
-import * as Cause from "effect/Cause";
-import * as Config from "effect/Config";
-import * as ConfigProvider from "effect/ConfigProvider";
-import * as Console from "effect/Console";
-import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
-import * as Option from "effect/Option";
-import * as Path from "effect/Path";
-import * as S from "effect/Schema";
-import * as Argument from "effect/unstable/cli/Argument";
-import * as CliError from "effect/unstable/cli/CliError";
-import * as Flag from "effect/unstable/cli/Flag";
-import { pathToFileURL } from "node:url";
-
-import {
-  type AuthProvider,
-  AuthError,
-  AuthProviders,
-} from "../../Auth/AuthProvider.ts";
-import {
-  type AlchemyProfileProviders,
-  ALCHEMY_PROFILE,
-  withProfileOverride,
-} from "../../Auth/Profile.ts";
-import { AwsAuth } from "../../AWS/AuthProvider.ts";
-import { AxiomAuth } from "../../Axiom/AuthProvider.ts";
-import { CloudflareAuth } from "../../Cloudflare/Auth/AuthProvider.ts";
-import { GitHubAuth } from "../../GitHub/AuthProvider.ts";
-import { HetznerAuth } from "../../Hetzner/AuthProvider.ts";
-import { NeonAuth } from "../../Neon/AuthProvider.ts";
-import { PlanetscaleAuth } from "../../Planetscale/AuthProvider.ts";
-import { PrismaAuth } from "../../Prisma/AuthProvider.ts";
-import * as Stack from "../../Stack.ts";
-import { Stage } from "../../Stage.ts";
-import { recordCli } from "../../Telemetry/Metrics.ts";
-import { PromptCancelled } from "../../Util/Clank.ts";
-import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
-import { fileLogger } from "../../Util/FileLogger.ts";
-
-export const USER = Config.string("USER").pipe(
-  Config.orElse(() => Config.string("USERNAME")),
-  Config.withDefault("unknown"),
-);
-
-export const STAGE = Config.string("STAGE").pipe(
-  Config.option,
-  (a) => a,
-  Effect.map(Option.getOrUndefined),
-);
-
-/**
- * `true` if `e` is a {@link PromptCancelled}, or an {@link AuthError} whose
- * `cause` chain bottoms out in one. Schema-tagged errors don't always
- * survive `instanceof` across module boundaries, so we also accept any
- * object whose `_tag` matches.
- */
-const isPromptCancellation = (e: unknown): boolean => {
-  for (let cur: unknown = e, i = 0; cur != null && i < 16; i++) {
-    if (cur instanceof PromptCancelled) return true;
-    if (
-      typeof cur === "object" &&
-      (cur as { _tag?: unknown })._tag === "PromptCancelled"
-    ) {
-      return true;
-    }
-    if (
-      cur instanceof AuthError ||
-      (typeof cur === "object" &&
-        (cur as { _tag?: unknown })._tag === "AuthError")
-    ) {
-      cur = (cur as { cause?: unknown }).cause;
-      continue;
-    }
-    return false;
-  }
-  return false;
-};
-
-/**
- * Catches user cancellations (Ctrl+C inside a prompt, surfaced as
- * {@link PromptCancelled} or wrapped in an {@link AuthError}) and exits
- * the CLI cleanly with a friendly message instead of dumping a stack
- * trace.
- */
-export const handleCancellation = <A, E, R>(self: Effect.Effect<A, E, R>) =>
-  self.pipe(
-    Effect.catchCause((cause) => {
-      const cancelled = cause.reasons.some((r) => {
-        if (Cause.isFailReason(r)) return isPromptCancellation(r.error);
-        if (Cause.isDieReason(r)) return isPromptCancellation(r.defect);
-        return false;
-      });
-      return cancelled
-        ? Console.log("\nCancelled.")
-        : (Effect.failCause(cause) as Effect.Effect<never, E, never>);
-    }),
-    // A bare fiber interrupt (Ctrl+C while not inside a prompt) shouldn't
-    // dump a stack trace either.
-    Effect.onInterrupt(() => Console.log("\nInterrupted.")),
-  );
-
-export const stage = Flag.string("stage").pipe(
-  Flag.withSchema(S.String.check(S.isPattern(/^[a-z0-9]+([-_a-z0-9]+)*$/gi))),
-  Flag.withDescription("Stage to deploy to, defaults to dev_${USER}"),
-  Flag.optional,
-  Flag.map(Option.getOrUndefined),
-  Flag.mapEffect(
-    Effect.fn(function* (stage) {
-      if (stage) {
-        return stage;
-      }
-      return yield* STAGE.pipe(
-        Effect.catch(() =>
-          Effect.fail(
-            new CliError.MissingOption({
-              option: "stage",
-            }),
-          ),
-        ),
-        Effect.flatMap((s) =>
-          s === undefined
-            ? USER.pipe(
-                Effect.map((user) => `dev_${user}`),
-                Effect.catch(() => Effect.succeed("unknown")),
-              )
-            : Effect.succeed(s),
-        ),
-      );
-    }),
-  ),
-);
-
-export const envFile = Flag.file("env-file").pipe(
-  Flag.optional,
-  Flag.withDescription(
-    "File to load environment variables from, defaults to .env",
-  ),
-);
-
-export const dryRun = Flag.boolean("dry-run").pipe(
-  Flag.withDescription("Dry run the deployment, do not actually deploy"),
-  Flag.withDefault(false),
-);
-
-export const yes = Flag.boolean("yes").pipe(
-  Flag.withDescription("Yes to all prompts"),
-  Flag.withDefault(false),
-);
-
-export const force = Flag.boolean("force").pipe(
-  Flag.withDescription(
-    "Force updates for resources that would otherwise no-op",
-  ),
-  Flag.withDefault(false),
-);
-
-export const script = Argument.file("main", {
-  mustExist: true,
-}).pipe(
-  Argument.withDescription("Main file to deploy, defaults to alchemy.run.ts"),
-  Argument.withDefault("alchemy.run.ts"),
-);
-
-export const profile = Flag.string("profile").pipe(
-  Flag.withDescription(
-    "Auth profile to use (~/.alchemy/profiles.json). Defaults to $ALCHEMY_PROFILE or 'default'.",
-  ),
-  Flag.optional,
-  Flag.mapEffect(
-    Effect.fn(function* (profile) {
-      // --profile wins; otherwise fall back to $ALCHEMY_PROFILE (which
-      // itself defaults to "default"). Without this, the flag's default
-      // would shadow the env var via withProfileOverride.
-      if (Option.isSome(profile)) {
-        return profile.value;
-      }
-      return yield* ALCHEMY_PROFILE.pipe(
-        Effect.catch(() => Effect.succeed("default")),
-      );
-    }),
-  ),
-);
-
-export const resourceFilter = Flag.string("filter").pipe(
-  Flag.withDescription(
-    "Comma-separated logical resource IDs (e.g. Api,Sandbox). Only those resources are included.",
-  ),
-  Flag.optional,
-  Flag.map(Option.getOrUndefined),
-);
-
-export const TAIL_COLORS = [
-  "\x1b[36m", // cyan
-  "\x1b[35m", // magenta
-  "\x1b[33m", // yellow
-  "\x1b[32m", // green
-  "\x1b[34m", // blue
-  "\x1b[91m", // bright red
-  "\x1b[96m", // bright cyan
-  "\x1b[95m", // bright magenta
-  "\x1b[93m", // bright yellow
-  "\x1b[92m", // bright green
-];
-export const TAIL_RESET = "\x1b[0m";
-
-export const formatLocalTimestamp = (date: Date): string => {
-  const y = date.getFullYear();
-  const mo = String(date.getMonth() + 1).padStart(2, "0");
-  const d = String(date.getDate()).padStart(2, "0");
-  const h = String(date.getHours()).padStart(2, "0");
-  const mi = String(date.getMinutes()).padStart(2, "0");
-  const s = String(date.getSeconds()).padStart(2, "0");
-  const ms = String(date.getMilliseconds()).padStart(3, "0");
-  const tz =
-    new Intl.DateTimeFormat("en-US", { timeZoneName: "short" })
-      .formatToParts(date)
-      .find((p) => p.type === "timeZoneName")?.value ?? "";
-  return `${y}-${mo}-${d} ${h}:${mi}:${s}.${ms} ${tz}`;
-};
-
-export const parseResourceFilter = (
-  filter: string | undefined,
-): ReadonlySet<string> | undefined => {
-  if (filter === undefined) return undefined;
-  const ids = filter
-    .split(",")
-    .map((s) => s.trim())
-    .filter((s) => s.length > 0);
-  if (ids.length === 0) return undefined;
-  return new Set(ids);
-};
-
-export const parseSince = (value: string): Date => {
-  const match = value.match(/^(\d+)([smhd])$/);
-  if (match) {
-    const num = parseInt(match[1]!, 10);
-    const unit = match[2]!;
-    const ms =
-      unit === "s"
-        ? num * 1000
-        : unit === "m"
-          ? num * 60_000
-          : unit === "h"
-            ? num * 3_600_000
-            : num * 86_400_000;
-    return new Date(Date.now() - ms);
-  }
-  const parsed = new Date(value);
-  if (isNaN(parsed.getTime())) {
-    throw new Error(
-      `Invalid --since value: '${value}'. Use a duration (e.g. '1h', '30m') or ISO date.`,
-    );
-  }
-  return parsed;
-};
-
-/**
- * Wraps a CLI command handler with a top-level OpenTelemetry span
- * (`cli.<command>`) and bumps the `alchemy.cli.invocations` counter.
- *
- * `attrs` runs against the parsed command args and contributes
- * additional attributes to the span (e.g. stage, profile, dry-run flag).
- *
- * Usage:
- * ```ts
- * Command.make(
- *   "deploy",
- *   { ...flags },
- *   instrumentCommand("deploy", (a) => ({
- *     "alchemy.stage": a.stage,
- *     "alchemy.profile": a.profile,
- *   }))(execStack),
- * );
- * ```
- */
-export const instrumentCommand =
-  <AttrsArgs = unknown>(
-    command: string,
-    attrs?: (args: AttrsArgs) => Record<string, unknown>,
-  ) =>
-  <Args extends AttrsArgs, A, E, R>(
-    handler: (args: Args) => Effect.Effect<A, E, R>,
-  ): ((args: Args) => Effect.Effect<A, E, R>) =>
-  (args) =>
-    handler(args).pipe(
-      Effect.withSpan(`cli.${command}`, {
-        attributes: attrs ? attrs(args) : {},
-      }),
-      recordCli(command),
-    );
-
-/**
- * Render a profile's stored credential entries the same way across
- * `alchemy login` and `alchemy profile show`: one `── Provider ──`
- * header per entry, then either the provider's own `prettyPrint` block
- * (preferred) or a JSON-style fallback when the provider isn't
- * registered in the supplied {@link AuthProviders} registry.
- */
-export const printProfile = Effect.fn(function* (
-  profile: string,
-  stored: AlchemyProfileProviders,
-  registry: AuthProviders["Service"],
-) {
-  yield* Console.log(`Profile: ${profile}`);
-  const names = Object.keys(stored).sort();
-  if (names.length === 0) {
-    yield* Console.log("(no providers configured)");
-    return;
-  }
-  for (const name of names) {
-    const cfg = stored[name]!;
-    yield* Console.log("");
-    yield* Console.log(`── ${name} ──`);
-    const provider: AuthProvider | undefined = registry[name];
-    if (provider == null) {
-      yield* Console.log(`  method: ${cfg.method}`);
-      const { method: _method, ...rest } = cfg as Record<string, unknown> & {
-        method: string;
-      };
-      for (const [k, v] of Object.entries(rest)) {
-        yield* Console.log(
-          `  ${k}: ${typeof v === "string" ? v : JSON.stringify(v)}`,
-        );
-      }
-      continue;
-    }
-    // A provider's `prettyPrint` catches its own credential-resolution
-    // failures, but some resolve paths `Effect.orDie` (e.g. AWS SSO with an
-    // expired token), which escapes as a defect. Contain it here — via
-    // `Console.log` so the message stays on stdout under this provider's
-    // header instead of interleaving on stderr — so one broken provider
-    // can't abort rendering the rest of the profile.
-    yield* provider.prettyPrint(profile, cfg).pipe(
-      Effect.catchCause((cause) => {
-        const error = Cause.squash(cause);
-        const message = error instanceof Error ? error.message : String(error);
-        return Console.log(`  Failed to retrieve credentials: ${message}`);
-      }),
-    );
-  }
-});
-
-export const importStack = Effect.fn(function* (main: string) {
-  const path = yield* Path.Path;
-  // Build a `file://` URL from the absolute path. `import.meta.resolve` expects a
-  // module specifier / URL, not a raw filesystem path: on Windows an absolute
-  // path like `D:\stack.ts` is not a valid specifier and fails to resolve, so the
-  // CLI cannot load the user's stack. `pathToFileURL` produces a valid URL on
-  // every platform.
-  const url = pathToFileURL(path.resolve(main)).href;
-  const module = yield* Effect.promise(() => import(url));
-  const stackEffect = module.default as ReturnType<
-    ReturnType<typeof Stack.make>
-  >;
-  if (!Effect.isEffect(stackEffect)) {
-    return yield* Effect.die(
-      new Error(
-        `Main file '${main}' must export a default stack definition (export default Alchemy.Stack({...}))`,
-      ),
-    );
-  }
-  return stackEffect as typeof stackEffect & {
-    stackName: string;
-    stage: string;
-    providers: Layer.Layer<never>;
-    state: Layer.Layer<never>;
-  };
-});
-
-/**
- * Placeholder {@link Stack.Stack} value used while building a stack's
- * `providers()` layer out of band. No real resources exist yet — we only
- * want the layer's provider/auth registrations and cloud-environment
- * services, so `resources`/`bindings`/`actions` are empty and the stage is a
- * sentinel.
- */
-const placeholderStack = (name: string) => ({
-  actions: {},
-  bindings: {},
-  name,
-  resources: {},
-  stage: "placeholder",
-});
-
-export interface BuildStackProvidersOptions {
-  /** Stack entrypoint to import (e.g. `"alchemy.run.ts"`). */
-  main: string;
-  envFile: Option.Option<string>;
-  profile: string;
-  /**
-   * Registry to populate. Pass a pre-seeded registry (e.g. one that already
-   * has built-in providers) to layer the stack's providers on top of it,
-   * overriding by name. Defaults to a fresh empty registry.
-   */
-  registry?: AuthProviders["Service"];
-  /**
-   * Logger layer used during the build. Defaults to the file logger
-   * (`out`). `alchemy unsafe nuke` overrides this to log to the console in
-   * debug mode.
-   */
-  logger?: Layer.Layer<never, never, never>;
-  /**
-   * Extra layer merged into the placeholder scaffold — e.g.
-   * `Layer.succeed(MinimumLogLevel, ...)`, which sets a fiber-ref default
-   * and so contributes no context service (`Layer<never>`).
-   */
-  extra?: Layer.Layer<never, never, never>;
-}
-
-/**
- * Import a stack entrypoint and build its `providers()` (+ `state()`) layer
- * out of band against placeholder {@link Stack.Stack}/{@link Stage} services,
- * so its `AuthProviderLayer` registrations land in an {@link AuthProviders}
- * registry and the built context holds every resource provider plus the
- * cloud-environment services their operations need.
- *
- * Shared by `alchemy login`, `alchemy profile show`, and `alchemy unsafe
- * nuke`. The caller decides what to do with the result — use `authProviders`
- * (login / profile show) or `context` (nuke) — and whether a missing/invalid
- * entrypoint is fatal (login / nuke let it propagate) or best-effort
- * (profile show wraps the call in `Effect.catchCause`).
- */
-export const buildStackProviders = Effect.fn("buildStackProviders")(function* (
-  options: BuildStackProvidersOptions,
-) {
-  const authProviders = options.registry ?? {};
-  const stackEffect = yield* importStack(options.main);
-  const configProvider = withProfileOverride(
-    yield* loadConfigProvider(options.envFile),
-    options.profile,
-  );
-  const context = yield* Layer.build(
-    (stackEffect.providers ?? Layer.empty).pipe(
-      Layer.provideMerge(stackEffect.state ?? Layer.empty),
-      Layer.provideMerge(
-        Layer.mergeAll(
-          Layer.succeed(AuthProviders, authProviders),
-          ConfigProvider.layer(configProvider),
-          options.logger ??
-            Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
-          Layer.succeed(Stage, "placeholder"),
-          Layer.succeed(Stack.Stack, placeholderStack(stackEffect.stackName)),
-          options.extra ?? Layer.empty,
-        ),
-      ),
-    ),
-  );
-  return { authProviders, context, stackEffect };
-});
-
-/**
- * The auth providers Alchemy ships with. Used as the baseline registry so
- * `alchemy login` works from any folder (no `alchemy.run.ts` required) and
- * `alchemy profile show` can pretty-print any provider a profile mentions,
- * even one the current stack doesn't wire up.
- */
-export const builtinAuth = Layer.mergeAll(
-  AwsAuth,
-  AxiomAuth,
-  CloudflareAuth,
-  GitHubAuth,
-  HetznerAuth,
-  NeonAuth,
-  PlanetscaleAuth,
-  PrismaAuth,
-);
-
-/**
- * Build {@link builtinAuth} against `registry` so every built-in auth
- * provider registers itself, without importing any stack entrypoint.
- */
-export const buildBuiltinAuthProviders = Effect.fn("buildBuiltinAuthProviders")(
-  function* (options: {
-    envFile: Option.Option<string>;
-    profile: string;
-    /** Registry to populate. Defaults to a fresh empty registry. */
-    registry?: AuthProviders["Service"];
-  }) {
-    const authProviders = options.registry ?? {};
-    yield* Layer.build(
-      Layer.provide(
-        builtinAuth,
-        Layer.mergeAll(
-          Layer.succeed(AuthProviders, authProviders),
-          ConfigProvider.layer(
-            withProfileOverride(
-              yield* loadConfigProvider(options.envFile),
-              options.profile,
-            ),
-          ),
-          Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
-        ),
-      ),
-    );
-    return authProviders;
-  },
-);

package/src/Cli/commands/login.ts

@@ -1,169 +0,0 @@
-import * as Config from "effect/Config";
-import * as Console from "effect/Console";
-import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
-import * as Option from "effect/Option";
-import { Command, Flag } from "effect/unstable/cli";
-import * as Argument from "effect/unstable/cli/Argument";
-import * as CliError from "effect/unstable/cli/CliError";
-
-import type { AuthProviders } from "../../Auth/AuthProvider.ts";
-import { AlchemyProfile } from "../../Auth/Profile.ts";
-import * as Clank from "../../Util/Clank.ts";
-
-import {
-  buildBuiltinAuthProviders,
-  buildStackProviders,
-  envFile,
-  instrumentCommand,
-  printProfile,
-  profile,
-} from "./_shared.ts";
-
-const loginConfigure = Flag.boolean("configure").pipe(
-  Flag.withDescription(
-    "Run the provider's interactive configure step before logging in",
-  ),
-  Flag.withDefault(false),
-);
-
-/**
- * Stack entrypoint whose `providers()` layer selects which auth providers
- * to log in with. Optional: when omitted and no `alchemy.run.ts` exists in
- * the current folder, `alchemy login` falls back to every built-in auth
- * provider, so logging in (and refreshing credentials) works from any
- * folder.
- */
-const loginMain = Argument.file("main").pipe(
-  Argument.withDescription(
-    "Stack entrypoint whose providers() to log in with, defaults to alchemy.run.ts (falls back to all built-in providers when absent)",
-  ),
-  Argument.optional,
-);
-
-export const loginCommand = Command.make(
-  "login",
-  {
-    main: loginMain,
-    envFile,
-    profile,
-    configure: loginConfigure,
-  },
-  instrumentCommand(
-    "login",
-    (a: {
-      main: Option.Option<string>;
-      profile: string;
-      configure: boolean;
-    }) => ({
-      "alchemy.profile": a.profile,
-      "alchemy.main": Option.getOrElse(a.main, () => "alchemy.run.ts"),
-      "alchemy.configure": a.configure,
-    }),
-  )(
-    Effect.fn(function* ({ main, envFile, profile, configure }) {
-      const fs = yield* FileSystem.FileSystem;
-      const explicitMain = Option.getOrUndefined(main);
-      const mainPath = explicitMain ?? "alchemy.run.ts";
-      const mainExists = yield* fs
-        .exists(mainPath)
-        .pipe(Effect.catch(() => Effect.succeed(false)));
-
-      // An explicitly-passed entrypoint must exist; only the default may
-      // fall back to the built-in providers.
-      if (explicitMain != null && !mainExists) {
-        return yield* Effect.fail(
-          new CliError.InvalidValue({
-            option: "main",
-            value: explicitMain,
-            expected: "an existing stack entrypoint file",
-            kind: "argument",
-          }),
-        );
-      }
-
-      const profiles = yield* AlchemyProfile;
-      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
-
-      let authProviders: AuthProviders["Service"];
-      // Providers to actually log in with; `undefined` means all registered.
-      let selected: string[] | undefined;
-      if (mainExists) {
-        // Build the user's providers() (+ state) layer to capture the auth
-        // providers their stack wires up.
-        ({ authProviders } = yield* buildStackProviders({
-          main: mainPath,
-          envFile,
-          profile,
-        }));
-      } else {
-        // No stack entrypoint — register every built-in auth provider so
-        // `alchemy login` works from any folder. Interactively, let the
-        // user pick which ones to log in with; in CI, take them all.
-        yield* Console.log(
-          "No alchemy.run.ts found — using Alchemy's built-in providers.",
-        );
-        authProviders = yield* buildBuiltinAuthProviders({ envFile, profile });
-        if (!ci) {
-          const existing = yield* profiles.getProfile(profile);
-          const names = Object.keys(authProviders).sort();
-          selected = yield* Clank.multiselect({
-            message: "Select providers to log in with",
-            options: names.map((name) => ({
-              value: name,
-              label: name,
-              hint: existing?.[name] != null ? "configured" : undefined,
-            })),
-            // Pre-select providers already in the profile so re-running
-            // login naturally refreshes/re-prints what's set up.
-            initialValues: names.filter((name) => existing?.[name] != null),
-          });
-        }
-      }
-
-      const providers = Object.values(authProviders).filter(
-        (provider) => selected == null || selected.includes(provider.name),
-      );
-
-      if (providers.length === 0) {
-        yield* Console.log(
-          selected != null
-            ? "No providers selected."
-            : "No AuthProviders registered. Make sure the stack's providers() layer includes AuthProviderLayer entries.",
-        );
-        return;
-      }
-
-      yield* Effect.forEach(
-        providers,
-        (provider) =>
-          Effect.gen(function* () {
-            const existing = yield* profiles.getProfile(profile);
-            // --configure treats every provider as missing, so configure
-            // runs unconditionally and overwrites the stored entry.
-            const stored = configure ? undefined : existing?.[provider.name];
-
-            let cfg: { method: string };
-            if (stored == null) {
-              cfg = yield* provider.configure(profile, { ci });
-              yield* profiles.setProfile(profile, {
-                ...existing,
-                [provider.name]: cfg,
-              });
-            } else {
-              cfg = stored;
-            }
-          }),
-        { discard: true },
-      );
-
-      // Print the resulting profile using the same renderer as
-      // `alchemy profile show`.
-      const final = yield* profiles.getProfile(profile);
-      if (final != null) {
-        yield* Console.log("");
-        yield* printProfile(profile, final, authProviders);
-      }
-    }),
-  ),
-);