alchemy 2.0.0-beta.76 → 2.0.0-beta.77

package/src/AWS/Organizations/DelegatedAdministrator.ts

@@ -4,7 +4,7 @@ import { isResolved } from "../../Diff.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import type { Providers } from "../Providers.ts";
-import { collectPages, retryOrganizations } from "./common.ts";
+import { collectPages, retryOrganizations, unredact } from "./common.ts";
 
 export interface DelegatedAdministratorProps {
   /**
@@ -32,11 +32,11 @@ export interface DelegatedAdministrator extends Resource<
     /**
      * Friendly name of the delegated administrator account.
      */
-    accountName: organizations.DelegatedAdministrator["Name"] | undefined;
+    accountName: string | undefined;
     /**
      * Email address of the delegated administrator account.
      */
-    accountEmail: organizations.DelegatedAdministrator["Email"] | undefined;
+    accountEmail: string | undefined;
     /**
      * Service principal delegated to the account.
      */
@@ -179,8 +179,8 @@ export const DelegatedAdministratorProvider = () =>
                           ({
                             accountId: admin.Id,
                             accountArn: admin.Arn,
-                            accountName: admin.Name,
-                            accountEmail: admin.Email,
+                            accountName: unredact(admin.Name),
+                            accountEmail: unredact(admin.Email),
                             servicePrincipal: service.ServicePrincipal,
                             delegationEnabledDate:
                               service.DelegationEnabledDate ??
@@ -289,8 +289,8 @@ const readDelegatedAdministrator = Effect.fn(function* ({
     ? ({
         accountId,
         accountArn: account.Arn,
-        accountName: account.Name,
-        accountEmail: account.Email,
+        accountName: unredact(account.Name),
+        accountEmail: unredact(account.Email),
         servicePrincipal,
         delegationEnabledDate:
           service.DelegationEnabledDate ?? account.DelegationEnabledDate,

package/src/AWS/Organizations/Organization.ts

@@ -3,7 +3,7 @@ import * as Effect from "effect/Effect";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import type { Providers } from "../Providers.ts";
-import { retryOrganizations } from "./common.ts";
+import { retryOrganizations, unredact } from "./common.ts";
 
 export type OrganizationId = string;
 export type OrganizationArn = string;
@@ -45,9 +45,7 @@ export interface Organization extends Resource<
     /**
      * Email address of the management account.
      */
-    managementAccountEmail:
-      | organizations.Organization["MasterAccountEmail"]
-      | undefined;
+    managementAccountEmail: string | undefined;
     /**
      * Policy types available to the organization.
      */
@@ -163,7 +161,7 @@ const toAttrs = (
   featureSet: org.FeatureSet,
   managementAccountArn: org.MasterAccountArn,
   managementAccountId: org.MasterAccountId,
-  managementAccountEmail: org.MasterAccountEmail,
+  managementAccountEmail: unredact(org.MasterAccountEmail),
   availablePolicyTypes: org.AvailablePolicyTypes ?? [],
 });
 

package/src/AWS/Organizations/common.ts

@@ -1,9 +1,26 @@
 import * as organizations from "@distilled.cloud/aws/organizations";
 import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import { createInternalTags, diffTags } from "../../Tags.ts";
 
+/**
+ * Distilled decodes `smithy.api#sensitive` strings (`Name`, `Email`,
+ * `MasterAccountEmail`) into `Redacted.Redacted<string>` at runtime.
+ * Attributes and equality checks must unwrap first — comparing the wrapper
+ * against a plain string is always `false` and would persist
+ * `{ "__redacted__": … }` into state.
+ */
+export const unredact = (
+  value: string | Redacted.Redacted<string> | undefined,
+): string | undefined =>
+  value === undefined
+    ? undefined
+    : Redacted.isRedacted(value)
+      ? Redacted.value(value)
+      : value;
+
 export type OrganizationsTags = Record<string, string>;
 
 export const createName = (

package/src/AWS/Providers.ts

@@ -530,7 +530,10 @@ export const providers = () =>
         EKS.FargateProfile,
         EKS.Nodegroup,
         EKS.PodIdentityAssociation,
+        ElastiCache.CacheCluster,
+        ElastiCache.ReplicationGroup,
         ElastiCache.ServerlessCache,
+        ElastiCache.SubnetGroup,
         ELBv2.Listener,
         ELBv2.ListenerCertificate,
         ELBv2.ListenerRule,
@@ -1338,7 +1341,16 @@ export const providers = () =>
           EKS.FargateProfileProvider(),
           EKS.NodegroupProvider(),
           EKS.PodIdentityAssociationProvider(),
+          flociDual(ElastiCache.CacheCluster, () =>
+            ElastiCache.CacheClusterProvider(),
+          ),
+          flociDual(ElastiCache.ReplicationGroup, () =>
+            ElastiCache.ReplicationGroupProvider(),
+          ),
           ElastiCache.ServerlessCacheProvider(),
+          flociDual(ElastiCache.SubnetGroup, () =>
+            ElastiCache.SubnetGroupProvider(),
+          ),
           // Dual ELBv2: floci emulates ALBs with locally-resolvable DNS
           // (`*.elb.localhost.floci.io` → 127.0.0.1, host-routed on the
           // gateway port) so local ECS services are reachable behind a

package/src/AWS/S3/Bucket.ts

@@ -8,7 +8,7 @@ import * as Order from "effect/Order";
 import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import type { HttpClient } from "effect/unstable/http";
-import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
+import type { ScopedPlanStatusSession } from "../../Report.ts";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";

package/src/Alchemist/Errors.ts

@@ -0,0 +1,36 @@
+import * as Data from "effect/Data";
+import { UserFacingError } from "../UserFacingError.ts";
+
+/** A non-fatal note attached to a successful result. */
+export interface Diagnostic {
+  readonly severity: "debug" | "info" | "warning" | "error";
+  readonly code: string;
+  readonly message: string;
+}
+
+// Tag names are prefixed because the bare ones are already taken by the
+// clouds we talk to — distilled's core ships `NotFound`, Route53 ships
+// `InvalidInput` — and these errors travel in unions with cloud errors,
+// where `catchTag` discriminates by tag alone.
+
+/** The caller sent something the route cannot act on. */
+export class AlchemistInvalidInput extends Data.TaggedError(
+  "AlchemistInvalidInput",
+)<{
+  readonly message: string;
+  readonly field?: string;
+}> {
+  readonly [UserFacingError] = true;
+}
+
+/** A named entity (profile, provider) does not resolve. */
+export class AlchemistNotFound extends Data.TaggedError("AlchemistNotFound")<{
+  readonly kind: string;
+  readonly id: string;
+}> {
+  readonly [UserFacingError] = true;
+  /** Human-readable line derived from the missing entity's kind and id. */
+  override get message(): string {
+    return `No ${this.kind} named '${this.id}'.`;
+  }
+}

package/src/Alchemist/Progress.ts

@@ -0,0 +1,175 @@
+import * as Clock from "effect/Clock";
+import * as Effect from "effect/Effect";
+import type { PlanStatusSession, ProgressEvent } from "../Report.ts";
+import { type ProgressReporter } from "../Report.ts";
+
+// The event contract itself lives in Report.ts (one flat `_tag` union, the
+// `Progress` reference the engine emits into). This module adds the
+// Alchemist-side plumbing: the OTEL span-event bridge routes wrap their
+// reporter with, and the adapter to the engine's apply-session contract.
+export {
+  Progress,
+  type ActionPlanned,
+  type ApplyEvent,
+  type NukeEvent,
+  type NukeScanStarted,
+  type NukeProviderScanStarted,
+  type NukePassStarted,
+  type NukeProviderScanned,
+  type NukeResourceDeleted,
+  type NukeResourceFailed,
+  type PlanEvent,
+  type PlanNodeEvent,
+  type PlanPhaseChanged,
+  type PlanningPhase,
+  type ProgressEvent,
+  type ProgressReporter,
+  type ProviderConfigureCompleted,
+  type ProviderConfigureStarted,
+  type ProviderEvent,
+  type ProviderRefreshCompleted,
+  type ProviderRefreshStarted,
+  type ResourceAnnotated,
+  type ResourceDiffStarted,
+  type ResourcePlanned,
+  type ResourceStatusChanged,
+  type StateBootstrapCompleted,
+  type StateBootstrapStarted,
+  type StateEvent,
+} from "../Report.ts";
+
+/**
+ * The OTEL span-event shape of one {@link ProgressEvent}, or `undefined`
+ * for events that are renderer-only. Per-node plan events are deliberately
+ * excluded: a plan emits one per resource *including noops* on every
+ * (re)plan — dev-watch replans would flood the collector with rows that
+ * mostly say "noop", and the node's own `plan.diff.resource` span already
+ * carries the diff. The phase markers are enough to know planning started
+ * and where the time went.
+ */
+const spanEventOf = (
+  event: ProgressEvent,
+): { name: string; attributes: Record<string, unknown> } | undefined => {
+  switch (event._tag) {
+    case "plan.phase":
+      return {
+        name: "alchemy.plan.phase",
+        attributes: { "alchemy.plan.phase": event.phase },
+      };
+    case "plan.resource.started":
+    case "plan.resource.completed":
+    case "plan.action.completed":
+      return undefined;
+    case "apply.resource.status":
+      return {
+        name: "alchemy.apply.resource.status",
+        attributes: {
+          "alchemy.resource.fqn": event.fqn,
+          "alchemy.resource.logical_id": event.id,
+          "alchemy.resource.type": event.type,
+          "alchemy.apply.resource.status": event.status,
+          ...(event.message === undefined
+            ? {}
+            : { "alchemy.apply.message": event.message }),
+        },
+      };
+    case "apply.resource.note":
+      return {
+        name: "alchemy.apply.resource.note",
+        attributes: {
+          "alchemy.resource.fqn": event.fqn,
+          "alchemy.resource.logical_id": event.id,
+          "alchemy.apply.message": event.message,
+          ...(event.kind === undefined
+            ? {}
+            : { "alchemy.apply.note.kind": event.kind }),
+        },
+      };
+    case "state.bootstrap.started":
+    case "state.bootstrap.completed":
+      return {
+        name: `alchemy.${event._tag}`,
+        attributes: { "alchemy.state_store.name": event.store },
+      };
+    case "nuke.scan.started":
+      return {
+        name: "alchemy.nuke.scan.started",
+        attributes: { "alchemy.nuke.providers": event.total },
+      };
+    case "nuke.pass.started":
+      return {
+        name: "alchemy.nuke.pass.started",
+        attributes: { "alchemy.nuke.pass": event.pass },
+      };
+    case "nuke.scan.provider.started":
+      return {
+        name: "alchemy.nuke.scan.provider.started",
+        attributes: { "alchemy.provider": event.provider },
+      };
+    case "nuke.scan.provider.completed":
+      return {
+        name: "alchemy.nuke.scan.provider.completed",
+        attributes: {
+          "alchemy.provider": event.provider,
+          "alchemy.nuke.resources": event.resources,
+          ...(event.error === undefined
+            ? {}
+            : { "alchemy.nuke.message": event.error }),
+        },
+      };
+    case "nuke.resource.deleted":
+      return {
+        name: "alchemy.nuke.resource.deleted",
+        attributes: { "alchemy.resource.display_name": event.resource },
+      };
+    case "nuke.resource.failed":
+      return {
+        name: "alchemy.nuke.resource.failed",
+        attributes: {
+          "alchemy.resource.display_name": event.resource,
+          "alchemy.nuke.message": event.message,
+        },
+      };
+    case "provider.configure.started":
+    case "provider.configure.completed":
+    case "provider.refresh.started":
+    case "provider.refresh.completed":
+      return {
+        name: `alchemy.${event._tag}`,
+        attributes: { "alchemy.provider": event.provider },
+      };
+  }
+};
+
+/**
+ * Decorate a reporter so a {@link ProgressEvent} with a span-event shape is
+ * also recorded on the currently active span before it reaches the
+ * renderer. Emission happens inside the engine's instrumented fibers, so
+ * apply events land on `apply.resource` / `provider.<op>` spans — giving
+ * traces a within-span timeline of status transitions. A no-op when no
+ * span is active (tracing disabled), and independent of whether a renderer
+ * is attached, so `--yes` and CI runs still produce the events.
+ */
+export const withSpanEvents =
+  (report: ProgressReporter): ProgressReporter =>
+  (event) => {
+    const spanEvent = spanEventOf(event);
+    if (spanEvent === undefined) return report(event);
+    return Effect.currentSpan.pipe(
+      Effect.flatMap((span) =>
+        Effect.flatMap(Clock.currentTimeNanos, (now) =>
+          Effect.sync(() =>
+            span.event(spanEvent.name, now, spanEvent.attributes),
+          ),
+        ),
+      ),
+      Effect.ignore,
+      Effect.andThen(report(event)),
+    );
+  };
+
+/** Adapt the ambient reporter to the engine's apply-session contract. */
+export const applySession = (report: ProgressReporter): PlanStatusSession => ({
+  emit: (event) => report(event),
+  done: () => Effect.void,
+});

package/src/Alchemist/Runtime.ts

@@ -0,0 +1,40 @@
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Layer from "effect/Layer";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import { AlchemyContextLive } from "../AlchemyContext.ts";
+import { ArtifactStore, createArtifactStore } from "../Artifacts.ts";
+import { CredentialsStoreLive } from "../Auth/Credentials.ts";
+import { ProfileStoreLive } from "../Auth/Profile.ts";
+import * as Interaction from "../Interaction.ts";
+import { PlatformServices } from "../Util/PlatformServices.ts";
+import { routeCacheLayer } from "./Session.ts";
+
+/**
+ * All services required by the programmatic Alchemist API.
+ *
+ * Progress reporting remains caller-controlled: without an override the
+ * default reporter is a no-op, while interactive and plain renderers can
+ * provide {@link import("./Progress.ts").Progress} around individual calls.
+ * The non-interactive Interaction default serves the engine paths that need
+ * one (state-store confirms fail typed; profile probes never prompt).
+ *
+ * @example
+ * ```ts
+ * Effect.runPromise(
+ *   program.pipe(Effect.provide(Alchemist.layer()), Effect.scoped),
+ * )
+ * ```
+ */
+export const layer = () =>
+  Layer.mergeAll(
+    Layer.mergeAll(
+      AlchemyContextLive,
+      ProfileStoreLive,
+      CredentialsStoreLive,
+    ).pipe(Layer.provideMerge(PlatformServices)),
+    FetchHttpClient.layer,
+    ConfigProvider.layer(ConfigProvider.fromEnv()),
+    Layer.succeed(ArtifactStore, createArtifactStore()),
+    routeCacheLayer,
+    Interaction.layerNonInteractive(),
+  );