alchemy 2.0.0-beta.84 → 2.0.0-beta.85

package/THIRD_PARTY_LICENSES.md

@@ -125,8 +125,8 @@ been dedicated to the public domain. See <https://www.sqlite.org/copyright.html>
 - Astro: [`a2240c43830e29c1d85667f4c610655d6b10253f`](https://github.com/withastro/astro/tree/a2240c43830e29c1d85667f4c610655d6b10253f)
 - SvelteKit: [`f36b3a4cd307bd8c89e03fa191becc175e7b3077`](https://github.com/sveltejs/kit/tree/f36b3a4cd307bd8c89e03fa191becc175e7b3077)
 - Waku: [`39e868f2638c27de9635c68ebf965e14a4112e9b`](https://github.com/wakujs/waku/tree/39e868f2638c27de9635c68ebf965e14a4112e9b)
-- Cloudflare Workers SDK: [`22dbde63a5726ba5d17c15270db0b11b50122b79`](https://github.com/cloudflare/workers-sdk/tree/22dbde63a5726ba5d17c15270db0b11b50122b79)
-- Cloudflare Workers SDK (local R2 S3 endpoint, `R2BucketS3.worker.ts`): [`22dbde63a5726ba5d17c15270db0b11b50122b79`](https://github.com/cloudflare/workers-sdk/tree/22dbde63a5726ba5d17c15270db0b11b50122b79)
+- Cloudflare Workers SDK: [`8d98a15a05fa1f4d27654168ed16df1ff4ff1173`](https://github.com/cloudflare/workers-sdk/tree/8d98a15a05fa1f4d27654168ed16df1ff4ff1173)
+- Cloudflare Workers SDK (local R2 S3 endpoint, `R2BucketS3.worker.ts`): [`8d98a15a05fa1f4d27654168ed16df1ff4ff1173`](https://github.com/cloudflare/workers-sdk/tree/8d98a15a05fa1f4d27654168ed16df1ff4ff1173)
 - OpenNext for Cloudflare: [`da4b7fc8c89441a6f96205635fa70e329d1f0df7`](https://github.com/opennextjs/opennextjs-cloudflare/tree/da4b7fc8c89441a6f96205635fa70e329d1f0df7)
 - SST: <https://github.com/sst/sst>
 - node-sanitize-filename: <https://github.com/parshap/node-sanitize-filename>

package/bin/cli.js

@@ -4,6 +4,8 @@
 import { spawn } from "node:child_process";
 import * as NodeModule from "node:module";
 import { pathToFileURL } from "node:url";
+import * as SemVer from "effect/SemVer";
+import * as SemVerRange from "effect/SemVerRange";
 import path from "pathe";
 
 const binDir = path.dirname(import.meta.filename);
@@ -114,6 +116,14 @@ async function runUnderNode() {
     process.exit(1);
   }
   NodeModule.enableCompileCache?.();
+  // `--fast-distilled` opts in to distilled's lazy service stubs (see
+  // register-oxc.js). The env var carries the choice to the loader and to
+  // every Node child alchemy starts with it (dev exec child, sidecar).
+  // Flags after a `--` separator belong to someone else.
+  const separator = args.indexOf("--");
+  if ((separator === -1 ? args : args.slice(0, separator)).includes("--fast-distilled")) {
+    process.env.ALCHEMY_FAST_DISTILLED = "1";
+  }
   const isCheckout = !(binDir.includes("/node_modules/") || binDir.includes("\\node_modules\\"));
   const register = isCheckout ? "register-dev-mode.js" : "register-oxc.js";
   await import(new URL(register, import.meta.url).href);
@@ -127,11 +137,9 @@ async function runUnderNode() {
  * launcher must run before any TypeScript can be loaded.
  */
 function supportsModuleHooks() {
-  const [major = 0, minor = 0, patch = 0] = process.versions.node.split(".").map(Number);
-  return (
-    (major === 22 && (minor > 22 || (minor === 22 && patch >= 3))) ||
-    (major === 24 && (minor > 11 || (minor === 11 && patch >= 1))) ||
-    (major === 25 && minor >= 1) ||
-    major >= 26
+  return SemVerRange.matches(
+    SemVerRange.parseUnsafe(">=22.22.3 <23.0.0-0 || >=24.11.1 <25.0.0-0 || >=25.1.0"),
+    SemVer.parseUnsafe(process.versions.node),
+    { includePrerelease: true },
   );
 }

package/bin/register-oxc.js

@@ -34,18 +34,22 @@ enableCompileCache();
 // distilled's lazy service stubs: with the `distilled-lazy` export condition
 // a service module resolves to a stub that loads each operation on first
 // use, so importing whole providers (as a stack does) costs a fraction of
-// the heap. Only this process opts in. Bundles never see the condition: a
-// stub `require`s its full module at runtime, which no bundle contains.
-// Installed before anything imports a provider.
-registerHooks({
-  resolve(specifier, context, nextResolve) {
-    if (!specifier.startsWith("@distilled.cloud/")) return nextResolve(specifier, context);
-    return nextResolve(specifier, {
-      ...context,
-      conditions: [...context.conditions, "distilled-lazy"],
-    });
-  },
-});
+// the heap. Opt-in: `alchemy --fast-distilled` (bin/cli.js turns the flag
+// into `ALCHEMY_FAST_DISTILLED=1`, which child processes inherit), or the
+// env var directly. Bundles never see the condition: a stub `require`s its
+// full module at runtime, which no bundle contains. Installed before
+// anything imports a provider.
+if (process.env.ALCHEMY_FAST_DISTILLED === "1") {
+  registerHooks({
+    resolve(specifier, context, nextResolve) {
+      if (!specifier.startsWith("@distilled.cloud/")) return nextResolve(specifier, context);
+      return nextResolve(specifier, {
+        ...context,
+        conditions: [...context.conditions, "distilled-lazy"],
+      });
+    },
+  });
+}
 
 const { registerOxc } = await import("@alchemy.run/node-utils/register-oxc");
 

package/lib/AdoptPolicy.d.ts

@@ -52,6 +52,27 @@ export declare class OwnedBySomeoneElse extends OwnedBySomeoneElse_base<{
     physicalName?: string;
 }> {
 }
+declare const UnverifiableReplacement_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "UnverifiableReplacement";
+} & Readonly<A>;
+/**
+ * Engine-raised failure produced when a delete-first replacement in a
+ * dependency cycle must delete its previous generation before its new
+ * identity is known: precreate runs on unresolved props, and a provider
+ * without `observe`, or whose `observe` reports {@link Unresolved}, cannot
+ * check ownership first. Refusing before the delete keeps the
+ * previous generation; re-run with `--adopt` (or `adopt(true)`) to accept
+ * whatever the identity resolves to.
+ */
+export declare class UnverifiableReplacement extends UnverifiableReplacement_base<{
+    /** A human-readable description of why the replacement was refused. */
+    message: string;
+    /** The Resource Type (e.g. `AWS.Lambda.Function`). */
+    resourceType?: string;
+    /** The logical ID of the refused resource. */
+    logicalId?: string;
+}> {
+}
 /**
  * Brand a `read` return value as belonging to a different owner.
  *
@@ -83,6 +104,58 @@ export declare const Unowned: {
     <T extends object>(attrs: T): T;
     is: (value: unknown) => boolean;
 };
+/**
+ * {@link Unowned} unless `attrs` is the generation a replacement is replacing:
+ * during a replacement `read` and `observe` receive that generation's
+ * attributes as `previous`, and a delete-first replacement that reuses its
+ * identity finds it under that same identity. `key` must identify the
+ * resource uniquely (a full resource name or an API id, not a display name).
+ *
+ * ```ts
+ * read: Effect.fn(function* ({ output, olds, previous }) {
+ *   // ...
+ *   return output ? attrs : unownedUnlessPrevious(attrs, previous, "name");
+ * }),
+ * ```
+ */
+export declare const unownedUnlessPrevious: <T extends object, K extends keyof T>(attrs: T, previous: Partial<Record<K, unknown>> | undefined, key: K) => T;
+/**
+ * A provider's `observe` answer when the identity `precreate` would claim
+ * depends on props that have not resolved yet, so nothing can be checked.
+ * Unlike `undefined`, it does not report the identity as absent: the engine
+ * checks the resolved identity before `reconcile` claims it, and refuses a
+ * delete-first replacement that would delete its previous generation first.
+ *
+ * ```ts
+ * observe: Effect.fn(function* ({ id, news }) {
+ *   if (!isResolved(news.namespace)) return Unresolved;
+ *   // ...
+ * }),
+ * ```
+ *
+ * `precreate` must not write to an identity it cannot resolve.
+ */
+export declare const Unresolved: unique symbol;
+export type Unresolved = typeof Unresolved;
+declare const UnresolvedIdentity_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "UnresolvedIdentity";
+} & Readonly<A>;
+/**
+ * Raised by a provider's `precreate` when the identity it must claim is still
+ * {@link Unresolved}. The engine resolves every prop that comes from outside
+ * a dependency cycle before precreate, so the identity depends on a peer in
+ * the resource's own cycle. Name the resource with a literal, or a value from
+ * outside the cycle.
+ */
+export declare class UnresolvedIdentity extends UnresolvedIdentity_base<{
+    /** A human-readable description of the unresolved identity. */
+    message: string;
+    /** The Resource Type (e.g. `AWS.Lambda.Function`). */
+    resourceType?: string;
+    /** The logical ID of the resource. */
+    logicalId?: string;
+}> {
+}
 /**
  * Strip the {@link Unowned} brand from an attributes object before persisting
  * it — state should not carry per-deploy ownership-routing metadata.

package/lib/AdoptPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdoptPolicy.d.ts","sourceRoot":"","sources":["../src/AdoptPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAE1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,WAAY,SAAQ,gBAAsD;CAAG;;;;AAE1F;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;CAAG;AAcL;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,OAAO,EAAE;IACpB,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;IAChC,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CAgBjC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS,MAAM,SAAS,CAAC,KAAG,CAIzD,CAAC;AAEF,eAAO,MAAM,KAAK,EAAE;IAClB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACjG,CAAC,EAAE,GAAG,KAAK,EACT,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,GACzC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;CAO5E,CAAC"}
+{"version":3,"file":"AdoptPolicy.d.ts","sourceRoot":"","sources":["../src/AdoptPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAE1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,WAAY,SAAQ,gBAAsD;CAAG;;;;AAE1F;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;CAAG;;;;AAEL;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,SAAQ,6BAA4C;IACvF,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;CAAG;AAcL;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,OAAO,EAAE;IACpB,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;IAChC,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CAgBjC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,CAAC,SAChE,CAAC,YACE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,OAC5C,CAAC,KACL,CAGiB,CAAC;AAErB;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,UAAU,EAAE,OAAO,MAAqC,CAAC;AACtE,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC;;;;AAE3C;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;CAAG;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS,MAAM,SAAS,CAAC,KAAG,CAIzD,CAAC;AAEF,eAAO,MAAM,KAAK,EAAE;IAClB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACjG,CAAC,EAAE,GAAG,KAAK,EACT,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,GACzC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;CAO5E,CAAC"}

package/lib/AdoptPolicy.js

@@ -40,6 +40,17 @@ export class AdoptPolicy extends Context.Service()("AdoptPolicy") {
  */
 export class OwnedBySomeoneElse extends Data.TaggedError("OwnedBySomeoneElse") {
 }
+/**
+ * Engine-raised failure produced when a delete-first replacement in a
+ * dependency cycle must delete its previous generation before its new
+ * identity is known: precreate runs on unresolved props, and a provider
+ * without `observe`, or whose `observe` reports {@link Unresolved}, cannot
+ * check ownership first. Refusing before the delete keeps the
+ * previous generation; re-run with `--adopt` (or `adopt(true)`) to accept
+ * whatever the identity resolves to.
+ */
+export class UnverifiableReplacement extends Data.TaggedError("UnverifiableReplacement") {
+}
 /**
  * Private symbol used to brand attribute objects returned by `read` as
  * "exists in cloud, but not owned by this stack/stage/logical-id".
@@ -90,6 +101,49 @@ export const Unowned = Object.assign((attrs) => {
 }, {
     is: (value) => typeof value === "object" && value !== null && value[UnownedTag] === true,
 });
+/**
+ * {@link Unowned} unless `attrs` is the generation a replacement is replacing:
+ * during a replacement `read` and `observe` receive that generation's
+ * attributes as `previous`, and a delete-first replacement that reuses its
+ * identity finds it under that same identity. `key` must identify the
+ * resource uniquely (a full resource name or an API id, not a display name).
+ *
+ * ```ts
+ * read: Effect.fn(function* ({ output, olds, previous }) {
+ *   // ...
+ *   return output ? attrs : unownedUnlessPrevious(attrs, previous, "name");
+ * }),
+ * ```
+ */
+export const unownedUnlessPrevious = (attrs, previous, key) => previous !== undefined && previous[key] !== undefined && previous[key] === attrs[key]
+    ? attrs
+    : Unowned(attrs);
+/**
+ * A provider's `observe` answer when the identity `precreate` would claim
+ * depends on props that have not resolved yet, so nothing can be checked.
+ * Unlike `undefined`, it does not report the identity as absent: the engine
+ * checks the resolved identity before `reconcile` claims it, and refuses a
+ * delete-first replacement that would delete its previous generation first.
+ *
+ * ```ts
+ * observe: Effect.fn(function* ({ id, news }) {
+ *   if (!isResolved(news.namespace)) return Unresolved;
+ *   // ...
+ * }),
+ * ```
+ *
+ * `precreate` must not write to an identity it cannot resolve.
+ */
+export const Unresolved = Symbol("alchemy/Unresolved");
+/**
+ * Raised by a provider's `precreate` when the identity it must claim is still
+ * {@link Unresolved}. The engine resolves every prop that comes from outside
+ * a dependency cycle before precreate, so the identity depends on a peer in
+ * the resource's own cycle. Name the resource with a literal, or a value from
+ * outside the cycle.
+ */
+export class UnresolvedIdentity extends Data.TaggedError("UnresolvedIdentity") {
+}
 /**
  * Strip the {@link Unowned} brand from an attributes object before persisting
  * it — state should not carry per-deploy ownership-routing metadata.

package/lib/AdoptPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"AdoptPolicy.js","sourceRoot":"","sources":["../src/AdoptPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,OAAO,EAAwB,CAAC,aAAa,CAAC;CAAG;AAE1F;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAS3E;CAAG;AAEL;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAkB,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,OAAO,GAGhB,MAAM,CAAC,MAAM,CACf,CAAmB,KAAQ,EAAK,EAAE;IAChC,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAO,CAAC;IACjC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE;QACxC,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC,EACD;IACE,EAAE,EAAE,CAAC,KAAc,EAAW,EAAE,CAC9B,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAK,KAAa,CAAC,UAAU,CAAC,KAAK,IAAI;CACrF,CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAmB,KAAQ,EAAK,EAAE;IAC5D,MAAM,GAAG,GAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;IAC9B,IAAI,UAAU,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,KAAK,GAKd,CAAC,CAAC,OAAO,GAAiD,IAAI,EAAE,EAAE,CACpE,CAAC,GAAiC,EAAE,EAAE,CACpC,GAAG,CAAC,IAAI,CACN,OAAO,OAAO,KAAK,SAAS;IAC1B,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,OAAO,IAAI,IAAI,CAAC;IACrD,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,EAAE,OAAO,CAAC,CACtD,CAAQ,CAAC"}
+{"version":3,"file":"AdoptPolicy.js","sourceRoot":"","sources":["../src/AdoptPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,OAAO,EAAwB,CAAC,aAAa,CAAC;CAAG;AAE1F;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAS3E;CAAG;AAEL;;;;;;;;GAQG;AACH,MAAM,OAAO,uBAAwB,SAAQ,IAAI,CAAC,WAAW,CAAC,yBAAyB,CAOrF;CAAG;AAEL;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAkB,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,OAAO,GAGhB,MAAM,CAAC,MAAM,CACf,CAAmB,KAAQ,EAAK,EAAE;IAChC,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAO,CAAC;IACjC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE;QACxC,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC,EACD;IACE,EAAE,EAAE,CAAC,KAAc,EAAW,EAAE,CAC9B,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAK,KAAa,CAAC,UAAU,CAAC,KAAK,IAAI;CACrF,CACF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,KAAQ,EACR,QAAiD,EACjD,GAAM,EACH,EAAE,CACL,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC;IACnF,CAAC,CAAC,KAAK;IACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAErB;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,UAAU,GAAkB,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAGtE;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAO3E;CAAG;AAEL;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAmB,KAAQ,EAAK,EAAE;IAC5D,MAAM,GAAG,GAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;IAC9B,IAAI,UAAU,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,KAAK,GAKd,CAAC,CAAC,OAAO,GAAiD,IAAI,EAAE,EAAE,CACpE,CAAC,GAAiC,EAAE,EAAE,CACpC,GAAG,CAAC,IAAI,CACN,OAAO,OAAO,KAAK,SAAS;IAC1B,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,OAAO,IAAI,IAAI,CAAC;IACrD,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,EAAE,OAAO,CAAC,CACtD,CAAQ,CAAC"}

package/lib/Alchemist/AuthRegistry.d.ts

@@ -0,0 +1,31 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import type { PlatformError } from "effect/PlatformError";
+import * as Scope from "effect/Scope";
+import { AuthError } from "../Auth/AuthProvider.ts";
+import type { ContributionError } from "../Contributions.ts";
+import type { Services } from "./Runtime.ts";
+/** What collecting an auth registry can fail with. */
+export type CollectAuthProvidersError = AuthError | ContributionError | PlatformError;
+/** What collecting an auth registry runs under. */
+export type CollectAuthProvidersServices = Services | Scope.Scope;
+export interface CollectAuthProvidersOptions {
+    readonly main: string;
+    readonly envFile: Option.Option<string>;
+    readonly profile: string;
+}
+/**
+ * Memoize auth registries for one command or API runtime: profile flows
+ * collect them repeatedly, and concurrent collections of the same project
+ * share one. Registries are built in this layer's scope, so a cached one
+ * never outlives the services its providers captured. Failures are not
+ * cached.
+ */
+export declare const authRegistryLayer: Layer.Layer<never, never, never>;
+export declare const collectAuthProviders: (options: CollectAuthProvidersOptions) => Effect.Effect<{
+    [providerName: string]: import("../Auth/AuthProvider.ts").AuthProvider<{
+        method: string;
+    }, unknown>;
+}, CollectAuthProvidersError, CollectAuthProvidersServices>;
+//# sourceMappingURL=AuthRegistry.d.ts.map

package/lib/Alchemist/AuthRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthRegistry.d.ts","sourceRoot":"","sources":["../../src/Alchemist/AuthRegistry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAiB,MAAM,yBAAyB,CAAC;AAGnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAI7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAM7C,sDAAsD;AACtD,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,iBAAiB,GAAG,aAAa,CAAC;AAEtF,mDAAmD;AACnD,MAAM,MAAM,4BAA4B,GAAG,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;AAUlE,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAoGD;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,kCAY7B,CAAC;AAEF,eAAO,MAAM,oBAAoB,YAAa,2BAA2B;;;;2DACZ,CAAC"}

package/lib/Alchemist/AuthRegistry.js

@@ -0,0 +1,95 @@
+import * as Cause from "effect/Cause";
+import * as Context from "effect/Context";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import * as Scope from "effect/Scope";
+import { AuthError, AuthProviders } from "../Auth/AuthProvider.js";
+import { SuppressMissingProviderConfig } from "../Auth/Profile.js";
+import * as Contributions from "../Contributions.js";
+import { makeCachedFunction } from "../Util/cached-function.js";
+import { DEFAULT_ENTRYPOINT, importStack } from "./Entrypoint.js";
+import * as Operations from "./Operations.js";
+/**
+ * Every provider's auth provider, merged into one registering layer. One
+ * provider whose auth fails to load is skipped with a warning, so it can't
+ * take every other provider's auth down with it.
+ */
+const contributedAuth = Effect.gen(function* () {
+    const layers = yield* Effect.forEach(yield* Contributions.load(), (provider) => provider.auth
+        ? Contributions.resolve(provider, "auth", provider.auth).pipe(Effect.catch((error) => Effect.as(Effect.logWarning(error.message), Layer.empty)))
+        : Effect.succeed(Layer.empty), { concurrency: "unbounded" });
+    return Layer.mergeAll(Layer.empty, ...layers);
+});
+/** Register every installed provider's auth into the ambient registry. */
+const registerContributedAuth = Effect.fn("registerContributedAuth")(function* (options) {
+    const shared = yield* Operations.configServices({
+        ...options,
+        envFile: Option.getOrUndefined(options.envFile),
+    });
+    yield* Layer.build(Layer.provide(yield* contributedAuth, shared));
+});
+const isMissingProviderConfig = Schema.is(Schema.Struct({ _tag: Schema.Literals(["MissingProviderConfig"]) }));
+/**
+ * Every auth provider reachable from the current project: the built-ins, plus
+ * whatever the user's stack module registers when it is importable.
+ */
+const collectAuthProvidersUncached = Effect.fn("collectAuthProvidersUncached")(function* (options) {
+    // Everything built below registers into this one registry: the
+    // registry layers reuse an ambient registry instead of starting fresh.
+    const authProviders = {};
+    const collect = Effect.provideService(AuthProviders, authProviders);
+    yield* registerContributedAuth(options).pipe(collect);
+    const fs = yield* FileSystem.FileSystem;
+    const entrypointExists = yield* fs.exists(options.main);
+    const missingDefault = options.main === DEFAULT_ENTRYPOINT && !entrypointExists;
+    if (!entrypointExists && !missingDefault) {
+        return yield* AuthError.make({
+            message: `Stack entrypoint '${options.main}' does not exist.`,
+        });
+    }
+    if (!missingDefault) {
+        yield* importStack(options.main).pipe(Effect.flatMap((stack) => Operations.buildProviders(stack, {
+            profile: options.profile,
+            envFile: Option.getOrUndefined(options.envFile),
+        })), collect, Effect.timeoutOption(Duration.seconds(15)), Effect.catchCause((cause) => {
+            const suppressed = cause.reasons.some((reason) => {
+                const error = Cause.isFailReason(reason)
+                    ? reason.error
+                    : Cause.isDieReason(reason)
+                        ? reason.defect
+                        : undefined;
+                return isMissingProviderConfig(error);
+            });
+            return suppressed
+                ? Effect.void
+                : Effect.fail(AuthError.make({
+                    message: `Could not load auth providers from '${options.main}'.`,
+                    cause,
+                }));
+        }));
+    }
+    return authProviders;
+}, Effect.provideService(SuppressMissingProviderConfig, true));
+/**
+ * Collects auth registries. Uncached by default; {@link authRegistryLayer}
+ * memoizes them for its own lifetime.
+ */
+const AuthRegistry = Context.Reference("Alchemy/Alchemist/AuthRegistry", {
+    defaultValue: () => collectAuthProvidersUncached,
+});
+/**
+ * Memoize auth registries for one command or API runtime: profile flows
+ * collect them repeatedly, and concurrent collections of the same project
+ * share one. Registries are built in this layer's scope, so a cached one
+ * never outlives the services its providers captured. Failures are not
+ * cached.
+ */
+export const authRegistryLayer = Layer.effect(AuthRegistry, Effect.map(Effect.scope, (scope) => makeCachedFunction((options) => collectAuthProvidersUncached(options).pipe(Scope.provide(scope)), {
+    key: ([options]) => JSON.stringify([options.main, Option.getOrNull(options.envFile), options.profile]),
+})));
+export const collectAuthProviders = (options) => Effect.flatMap(AuthRegistry, (collect) => collect(options));
+//# sourceMappingURL=AuthRegistry.js.map

package/lib/Alchemist/AuthRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthRegistry.js","sourceRoot":"","sources":["../../src/Alchemist/AuthRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAC;AA2B9C;;;;GAIG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAClC,KAAK,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,EAC3B,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,IAAI;QACX,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CACzD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAClF;QACH,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EACjC,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;IACF,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,QAAQ,CAAC,EAAE,OAG/E;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC;QAC9C,GAAG,OAAO;QACV,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;KAChD,CAAC,CAAC;IACH,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CACvC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CACpE,CAAC;AAEF;;;GAGG;AACH,MAAM,4BAA4B,GAAG,MAAM,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAC5E,QAAQ,CAAC,EAAE,OAAoC;IAC7C,+DAA+D;IAC/D,uEAAuE;IACvE,MAAM,aAAa,GAA6B,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IACpE,KAAK,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEtD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,gBAAgB,CAAC;IAChF,IAAI,CAAC,gBAAgB,IAAI,CAAC,cAAc,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3B,OAAO,EAAE,qBAAqB,OAAO,CAAC,IAAI,mBAAmB;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CACnC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,UAAU,CAAC,cAAc,CAAC,KAAK,EAAE;YAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;SAChD,CAAC,CACH,EACD,OAAO,EACP,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAC1C,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC;oBACtC,CAAC,CAAC,MAAM,CAAC,KAAK;oBACd,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC;wBACzB,CAAC,CAAC,MAAM,CAAC,MAAM;wBACf,CAAC,CAAC,SAAS,CAAC;gBAChB,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACxC,CAAC,CAAC,CAAC;YACH,OAAO,UAAU;gBACf,CAAC,CAAC,MAAM,CAAC,IAAI;gBACb,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,SAAS,CAAC,IAAI,CAAC;oBACb,OAAO,EAAE,uCAAuC,OAAO,CAAC,IAAI,IAAI;oBAChE,KAAK;iBACN,CAAC,CACH,CAAC;QACR,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC,EACD,MAAM,CAAC,cAAc,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAC3D,CAAC;AAEF;;;GAGG;AACH,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAuB,gCAAgC,EAAE;IAC7F,YAAY,EAAE,GAAG,EAAE,CAAC,4BAA4B;CACjD,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC,MAAM,CAC3C,YAAY,EACZ,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACjC,kBAAkB,CAChB,CAAC,OAAoC,EAAE,EAAE,CACvC,4BAA4B,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAClE;IACE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CACjB,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;CACrF,CACF,CACF,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAoC,EAAE,EAAE,CAC3E,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC"}

package/lib/Alchemist/Drift.d.ts

@@ -0,0 +1,70 @@
+import type * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as EngineDrift from "../Drift.ts";
+import type { Plan } from "../Plan.ts";
+import type { ConfiguredStack } from "../Stack.ts";
+import type { State } from "../State/State.ts";
+import { type BuildOptions, type PlanSummary } from "./Operations.ts";
+export interface DriftedResource {
+    readonly fqn: string;
+    readonly logicalId: string;
+    readonly resourceType: string;
+    /** `skipped`: not checked (no `read`, or an interrupted deploy); see `reason`. */
+    readonly status: "in-sync" | "drifted" | "missing" | "skipped";
+    readonly reason?: string;
+    readonly actual?: unknown;
+}
+/** A drift check and the repair it proposes; only {@link execute} runs it. */
+export interface DriftScan {
+    readonly stack: {
+        readonly name: string;
+        readonly stage: string;
+    };
+    readonly resources: ReadonlyArray<DriftedResource>;
+    /** What the repair would change. */
+    readonly summary: PlanSummary;
+    /**
+     * The repair as an engine plan, for renderers.
+     * @internal its shape may change.
+     */
+    readonly native: Plan;
+    /**
+     * The stack services drift was checked under.
+     * @internal {@link execute} runs in them.
+     */
+    readonly context: Context.Context<State>;
+}
+export interface ScanOptions extends BuildOptions {
+    readonly stack: ConfiguredStack<unknown, unknown>;
+}
+/** Whether the drift check found anything worth repairing. */
+export declare const hasDrift: (scan: DriftScan) => boolean;
+/**
+ * Compare deployed state against the real cloud and plan the repair. Drift
+ * reads state and providers only, so the stack's program never runs.
+ */
+export declare const scan: (input: ScanOptions) => Effect.Effect<{
+    stack: {
+        name: string;
+        stage: string;
+    };
+    resources: {
+        fqn: string;
+        logicalId: string;
+        resourceType: string;
+        status: "drifted" | "in-sync" | "missing" | "skipped";
+        reason: string | undefined;
+        actual: any;
+    }[];
+    summary: PlanSummary;
+    native: Plan;
+    context: Context.Context<import("../AdoptPolicy.ts").AdoptPolicy | import("../AlchemyContext.ts").AlchemyContext | import("../Artifacts.ts").ArtifactStore | import("../index.ts").AuthProviders | import("../Stack.ts").Stack | import("../Stage.ts").Stage | State>;
+}, any, import("../AlchemyContext.ts").AlchemyContext | import("effect/process/ChildProcessSpawner").ChildProcessSpawner | import("../Auth/Credentials.ts").CredentialsStore | import("effect/crypto/Digest").Digest | import("effect/FileSystem").FileSystem | import("effect/http/HttpClient").HttpClient | import("../Interaction.ts").Interaction | import("effect/Path").Path | import("../Auth/Profile.ts").ProfileStore | import("effect/Scope").Scope | import("effect/crypto/SecureRandom").SecureRandom>;
+/**
+ * Repair the drift `scan` found: reconcile each drifted or missing resource
+ * back to its last-deployed desired state. Only those resources are touched;
+ * they are re-read first, so one that is back in sync is left alone, and
+ * drift that appeared after the scan waits for the next one.
+ */
+export declare const execute: (scan: DriftScan) => Effect.Effect<EngineDrift.DriftResult, any, never>;
+//# sourceMappingURL=Drift.d.ts.map

package/lib/Alchemist/Drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Drift.d.ts","sourceRoot":"","sources":["../../src/Alchemist/Drift.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,WAAW,MAAM,aAAa,CAAC;AAE3C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IACnD,oCAAoC;IACpC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;CACnD;AAED,8DAA8D;AAC9D,eAAO,MAAM,QAAQ,SAAU,SAAS,KAAG,OACwD,CAAC;AASpG;;;GAGG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;kfAyBf,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,OAAO,yEAQlB,CAAC"}

package/lib/Alchemist/Drift.js

@@ -0,0 +1,54 @@
+import * as Effect from "effect/Effect";
+import * as EngineDrift from "../Drift.js";
+import { emit } from "../Events.js";
+import { buildWithoutProgram, summarize, } from "./Operations.js";
+/** Whether the drift check found anything worth repairing. */
+export const hasDrift = (scan) => scan.resources.some((resource) => resource.status === "drifted" || resource.status === "missing");
+const status = (action) => action === "unchanged"
+    ? "in-sync"
+    : action === "missing" || action === "skipped"
+        ? action
+        : "drifted";
+/**
+ * Compare deployed state against the real cloud and plan the repair. Drift
+ * reads state and providers only, so the stack's program never runs.
+ */
+export const scan = Effect.fn("Alchemist.Drift.scan")(function* (input) {
+    const built = yield* buildWithoutProgram(input.stack, input);
+    const identity = {
+        name: built.stack.name,
+        stage: built.stack.stage,
+    };
+    // The engine's phase and per-resource observation events flow through the
+    // log as events; drift-flavored wording is the renderer's job
+    // (renderPlanning's computingLabel).
+    const { result, plan } = yield* EngineDrift.plan(identity).pipe(Effect.provide(built.context));
+    yield* emit({ type: "plan.phase", phase: "plan-ready" });
+    return {
+        stack: identity,
+        resources: Object.values(result.resources).map((resource) => ({
+            fqn: resource.fqn,
+            logicalId: resource.logicalId,
+            resourceType: resource.resourceType,
+            status: status(resource.action),
+            reason: resource.reason,
+            actual: resource.attr,
+        })),
+        summary: summarize(plan),
+        native: plan,
+        context: built.context,
+    };
+});
+/**
+ * Repair the drift `scan` found: reconcile each drifted or missing resource
+ * back to its last-deployed desired state. Only those resources are touched;
+ * they are re-read first, so one that is back in sync is left alone, and
+ * drift that appeared after the scan waits for the next one.
+ */
+export const execute = Effect.fn("Alchemist.Drift.execute")(function* (scan) {
+    const only = scan.resources
+        .filter((resource) => resource.status === "drifted" || resource.status === "missing")
+        .map((resource) => resource.fqn);
+    return yield* Effect.provide(EngineDrift.repair({ name: scan.stack.name, stage: scan.stack.stage }, { only }), scan.context);
+});
+//# sourceMappingURL=Drift.js.map

package/lib/Alchemist/Drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Drift.js","sourceRoot":"","sources":["../../src/Alchemist/Drift.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,WAAW,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAIpC,OAAO,EACL,mBAAmB,EACnB,SAAS,GAGV,MAAM,iBAAiB,CAAC;AAkCzB,8DAA8D;AAC9D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAe,EAAW,EAAE,CACnD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;AAEpG,MAAM,MAAM,GAAG,CAAC,MAAc,EAA6B,EAAE,CAC3D,MAAM,KAAK,WAAW;IACpB,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAC5C,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,SAAS,CAAC;AAElB;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAkB;IACjF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;KACzB,CAAC;IACF,0EAA0E;IAC1E,8DAA8D;IAC9D,qCAAqC;IACrC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/F,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IACzD,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC5D,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,QAAQ,CAAC,IAAI;SACtB,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC;QACxB,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;KACH,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAe;IACpF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS;SACxB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC;SACpF,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAC1B,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAChF,IAAI,CAAC,OAAO,CACb,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/lib/Alchemist/Entrypoint.d.ts

@@ -1,6 +1,8 @@
+import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
+import type { ConfiguredStack } from "../Stack.ts";
 import { UserFacingError } from "../UserFacingError.ts";
 declare const StackEntrypointError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "StackEntrypointError";
@@ -13,10 +15,32 @@ export declare class StackEntrypointError extends StackEntrypointError_base<{
 export declare const DEFAULT_ENTRYPOINT = "alchemy.run.ts";
 /**
  * The absolute path of the stack entrypoint, or the user-facing error for
- * a missing one. Kept apart from `Session.ts` so the `alchemy dev`
- * supervisor can check the entry before it starts an exec child, without
- * loading the engine that module carries.
+ * a missing one. Kept free of the engine so the `alchemy dev` supervisor can
+ * check the entry before it starts an exec child.
  */
 export declare const resolveStackEntrypoint: (main: string) => Effect.Effect<string, import("effect/PlatformError").PlatformError | StackEntrypointError, FileSystem.FileSystem | Path.Path>;
+export interface StackModuleLoader {
+    readonly import: (url: string) => Promise<{
+        readonly default?: unknown;
+    }>;
+}
+export declare const StackModuleLoader: Context.Reference<StackModuleLoader>;
+/**
+ * Import a stack entrypoint and return its default export, the stack value
+ * every stack operation takes.
+ */
+export declare const importStack: (main: string) => Effect.Effect<ConfiguredStack<unknown, unknown>, import("effect/PlatformError").PlatformError | StackEntrypointError, FileSystem.FileSystem | Path.Path>;
+/**
+ * Which project and credentials an operation acts under. The optional fields
+ * fall back to the same defaults the CLI uses.
+ */
+export interface Target {
+    /** Stack entrypoint. @default "alchemy.run.ts" */
+    readonly entrypoint?: string;
+    /** Profile whose credentials the run uses. Falls back to the active profile. */
+    readonly profile?: string;
+    /** `.env` file layered under the process environment. */
+    readonly envFile?: string;
+}
 export {};
 //# sourceMappingURL=Entrypoint.d.ts.map

package/lib/Alchemist/Entrypoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Entrypoint.d.ts","sourceRoot":"","sources":["../../src/Alchemist/Entrypoint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;;;;AAExD,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,QAAQ,CAAC,CAAC,eAAe,CAAC,QAAQ;CACnC;AAED,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,iJAUjC,CAAC"}
+{"version":3,"file":"Entrypoint.d.ts","sourceRoot":"","sources":["../../src/Alchemist/Entrypoint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAE1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAGpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;;;;AAExD,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,QAAQ,CAAC,CAAC,eAAe,CAAC,QAAQ;CACnC;AAED,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,iJAUjC,CAAC;AAEH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC3E;AAED,eAAO,MAAM,iBAAiB,sCAG7B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,4KAgBtB,CAAC;AAEH;;;GAGG;AACH,MAAM,WAAW,MAAM;IACrB,kDAAkD;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B"}