alchemy 2.0.0-beta.test-export-fix-4 → 2.0.0-cli-bundle-fix.1

package/lib/index.d.ts

@@ -0,0 +1,26 @@
+export * as AdoptPolicy from "./AdoptPolicy.ts";
+export * from "./AlchemyContext.ts";
+export * from "./Apply.ts";
+export { Service as BindingService, Policy, type ServiceLike as BindingServiceLike, type ServiceShape as BindingServiceShape, type PolicyLike, type PolicyShape, } from "./Binding.ts";
+export * from "./Destroy.ts";
+export * from "./Diff.ts";
+export * from "./Input.ts";
+export * from "./InstanceId.ts";
+export * from "./Namespace.ts";
+export type { Output } from "./Output.ts";
+export * from "./PhysicalName.ts";
+export * as Plan from "./Plan.ts";
+export { Provider, ProviderCollection } from "./Provider.ts";
+export * from "./Random.ts";
+export * from "./Ref.ts";
+export * as RemovalPolicy from "./RemovalPolicy.ts";
+export * from "./Resource.ts";
+export * as Schema from "./Schema.ts";
+export * as Server from "./Server/index.ts";
+export * as Serverless from "./Serverless/index.ts";
+export { Stack } from "./Stack.ts";
+export * from "./Stage.ts";
+export { inMemoryState, localState } from "./State/index.ts";
+export * from "./Trait.ts";
+export * as Construct from "./Construct.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAChD,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,OAAO,IAAI,cAAc,EACzB,MAAM,EACN,KAAK,WAAW,IAAI,kBAAkB,EACtC,KAAK,YAAY,IAAI,mBAAmB,EACxC,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,cAAc,CAAC;AACtB,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,YAAY,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7D,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AACpD,cAAc,eAAe,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,UAAU,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC7D,cAAc,YAAY,CAAC;AAE3B,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAC"}

package/lib/index.js

@@ -0,0 +1,25 @@
+export * as AdoptPolicy from "./AdoptPolicy.js";
+export * from "./AlchemyContext.js";
+export * from "./Apply.js";
+export { Service as BindingService, Policy, } from "./Binding.js";
+export * from "./Destroy.js";
+export * from "./Diff.js";
+export * from "./Input.js";
+export * from "./InstanceId.js";
+export * from "./Namespace.js";
+export * from "./PhysicalName.js";
+export * as Plan from "./Plan.js";
+export { Provider, ProviderCollection } from "./Provider.js";
+export * from "./Random.js";
+export * from "./Ref.js";
+export * as RemovalPolicy from "./RemovalPolicy.js";
+export * from "./Resource.js";
+export * as Schema from "./Schema.js";
+export * as Server from "./Server/index.js";
+export * as Serverless from "./Serverless/index.js";
+export { Stack } from "./Stack.js";
+export * from "./Stage.js";
+export { inMemoryState, localState } from "./State/index.js";
+export * from "./Trait.js";
+export * as Construct from "./Construct.js";
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAChD,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,OAAO,IAAI,cAAc,EACzB,MAAM,GAKP,MAAM,cAAc,CAAC;AACtB,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,mBAAmB,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7D,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AACpD,cAAc,eAAe,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,UAAU,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC7D,cAAc,YAAY,CAAC;AAE3B,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAC"}

package/package.json

@@ -1,16 +1,16 @@
 {
   "name": "alchemy",
-  "version": "2.0.0-beta.test-export-fix-4",
+  "version": "2.0.0-cli-bundle-fix.1",
   "homepage": "https://alchemy.run",
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
-    "directory": "alchemy"
+    "directory": "package/alchemy"
   },
   "bin": {
-    "alchemy": "bin/alchemy.sh"
+    "alchemy": "./bin/cli.js"
   },
   "files": [
     "bin",
@@ -21,7 +21,7 @@
   "sideEffects": false,
   "scripts": {
     "dev": "tsdown --watch",
-    "build": "bun bundle && bun pm pack",
+    "build": "tsc -b && bun bundle",
     "bundle": "tsdown",
     "bundle:watch": "tsdown --watch",
     "publish:npm": "cp ../README.md . && bun publish && rm README.md",
@@ -37,8 +37,8 @@
     "./*": {
       "types": "./src/*.ts",
       "bun": "./src/*.ts",
-      "import": "./lib/*.js",
-      "worker": "./src/*.ts"
+      "worker": "./src/*.ts",
+      "import": "./lib/*.js"
     },
     "./Agent": {
       "types": "./src/Agent/index.ts",
@@ -46,6 +46,12 @@
       "worker": "./src/Agent/index.ts",
       "import": "./lib/Agent/index.js"
     },
+    "./Auth": {
+      "types": "./src/Auth/index.ts",
+      "bun": "./src/Auth/index.ts",
+      "worker": "./src/Auth/index.ts",
+      "import": "./lib/Auth/index.js"
+    },
     "./AWS": {
       "types": "./src/AWS/index.ts",
       "bun": "./src/AWS/index.ts",
@@ -178,12 +184,24 @@
       "worker": "./src/Server/index.ts",
       "import": "./lib/Server/index.js"
     },
+    "./Stack": {
+      "types": "./src/Stack.ts",
+      "bun": "./src/Stack.ts",
+      "worker": "./src/Stack.ts",
+      "import": "./lib/Stack.js"
+    },
     "./State": {
       "types": "./src/State/index.ts",
       "bun": "./src/State/index.ts",
       "worker": "./src/State/index.ts",
       "import": "./lib/State/index.js"
     },
+    "./State/*": {
+      "types": "./src/State/*.ts",
+      "bun": "./src/State/*.ts",
+      "worker": "./src/State/*.ts",
+      "import": "./lib/State/*.js"
+    },
     "./Test/Bun": {
       "types": "./src/Test/Bun.ts",
       "bun": "./src/Test/Bun.ts",
@@ -195,7 +213,14 @@
       "bun": "./src/Util/index.ts",
       "worker": "./src/Util/index.ts",
       "import": "./lib/Util/index.js"
-    }
+    },
+    "./Util/Clank": {
+      "types": "./src/Util/Clank.ts",
+      "bun": "./src/Util/Clank.ts",
+      "worker": "./src/Util/Clank.ts",
+      "import": "./lib/Util/Clank.js"
+    },
+    "./bin/alchemy.js": "./bin/alchemy.js"
   },
   "publishConfig": {
     "access": "public"
@@ -205,11 +230,12 @@
     "@ai-sdk/openai": "^3.0.23",
     "@ai-sdk/provider": "^3.0.8",
     "@aws-sdk/credential-providers": "^3.0.0",
-    "@distilled.cloud/aws": "^0.10.0",
-    "@distilled.cloud/cloudflare": "^0.10.0",
+    "@clack/prompts": "^0.11.0",
+    "@distilled.cloud/aws": "^0.10.2",
+    "@distilled.cloud/cloudflare": "^0.10.2",
     "@distilled.cloud/cloudflare-rolldown-plugin": "0.3.0",
     "@distilled.cloud/cloudflare-vite-plugin": "0.2.0",
-    "@distilled.cloud/core": "^0.10.0",
+    "@distilled.cloud/core": "^0.10.2",
     "@effect/vitest": "4.0.0-beta.48",
     "@libsql/client": "^0.17.0",
     "@octokit/rest": "^22.0.1",
@@ -224,14 +250,14 @@
     "cloudflare": "^5.2.0",
     "fast-glob": "^3.3.2",
     "fast-xml-parser": "^5.3.4",
+    "foreground-child": "^4.0.3",
     "ignore": "^7.0.5",
     "jszip": "^3.10.1",
     "libsodium-wrappers": "^0.8.3",
     "rolldown": "1.0.0-rc.13",
-    "solid-js": "latest",
     "sonda": "^0.11.1",
     "web-tree-sitter": "0.25.10",
-    "workerd": "1.20260412.1",
+    "workerd": "1.20260417.1",
     "yaml": "^2.0.0"
   },
   "devDependencies": {
@@ -250,15 +276,16 @@
     "pathe": "^2.0.3",
     "react": "^19.2.0",
     "react-devtools-core": "^7.0.1",
+    "solid-js": "latest",
     "tsconfig-paths": "^4.2.0",
     "tsdown": "^0.15.4",
     "tsx": "^4.20.6",
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@effect/platform-bun": "*",
-    "@effect/platform-node": "*",
-    "effect": "*",
+    "@effect/platform-bun": "4.0.0-beta.48",
+    "@effect/platform-node": "4.0.0-beta.48",
+    "effect": "4.0.0-beta.48",
     "vite": "^8.0.7"
   },
   "peerDependenciesMeta": {
@@ -268,9 +295,6 @@
     "@effect/platform-bun": {
       "optional": true
     },
-    "effect": {
-      "optional": true
-    },
     "vite": {
       "optional": true
     }

package/src/AWS/AuthProvider.ts

@@ -0,0 +1,392 @@
+import * as DistilledAuth from "@distilled.cloud/aws/Auth";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Match from "effect/Match";
+import * as Path from "effect/Path";
+import * as Redacted from "effect/Redacted";
+import { ChildProcess } from "effect/unstable/process";
+import * as NodeCrypto from "node:crypto";
+import * as NodeOs from "node:os";
+import {
+  AuthError,
+  AuthProviderLayer,
+  type ConfigureContext,
+} from "../Auth/AuthProvider.ts";
+import {
+  deleteCredentials,
+  displayRedacted,
+  readCredentials,
+  writeCredentials,
+} from "../Auth/Credentials.ts";
+import {
+  getEnv,
+  getEnvRedacted,
+  getEnvRedactedRequired,
+  retryOnce,
+} from "../Auth/Env.ts";
+import * as Clank from "../Util/Clank.ts";
+
+export const AWS_AUTH_PROVIDER_NAME = "AWS";
+
+/**
+ * Layer that registers the AWS {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the AWS
+ * `providers()` layer so `alchemy login` can discover it.
+ */
+export const AwsAuth = AuthProviderLayer<
+  AwsAuthConfig,
+  AwsResolvedCredentials
+>()(AWS_AUTH_PROVIDER_NAME, {
+  configure: (profileName, ctx) => configureCredentials(profileName, ctx),
+  login: (profileName, config) => login(profileName, config),
+  logout: (profileName, config) => logout(profileName, config),
+  prettyPrint: (profileName, config) => prettyPrint(profileName, config),
+  read: (profileName, config) => resolveCredentials(profileName, config),
+});
+
+export type AwsAuthConfig =
+  | { method: "sso"; ssoProfile: string }
+  | { method: "stored" }
+  | { method: "env" };
+
+const options: Array<{
+  value: AwsAuthConfig["method"];
+  label: string;
+  hint?: string;
+}> = [
+  {
+    value: "sso",
+    label: "SSO",
+    hint: "aws sso login — credentials loaded from AWS SSO cache",
+  },
+  {
+    value: "env",
+    label: "Environment Variables",
+    hint: "AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY",
+  },
+  {
+    value: "stored",
+    label: "Stored",
+    hint: "stored in ~/.alchemy/credentials",
+  },
+];
+
+export interface AwsStoredCredentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string;
+  region?: string;
+}
+
+export interface AwsResolvedCredentials {
+  accessKeyId: Redacted.Redacted<string>;
+  secretAccessKey: Redacted.Redacted<string>;
+  sessionToken?: Redacted.Redacted<string>;
+  region?: string;
+  source: {
+    type: AwsAuthConfig["method"];
+    details?: string;
+  };
+}
+
+const runSsoCommand = (command: "login" | "logout", ssoProfile: string) =>
+  Effect.gen(function* () {
+    const handle = yield* ChildProcess.make(
+      "aws",
+      ["sso", command, "--profile", ssoProfile],
+      {
+        shell: false,
+        stdin: "inherit",
+        stdout: "inherit",
+        stderr: "inherit",
+      },
+    );
+    const exit = yield* handle.exitCode;
+    if (exit !== 0) {
+      yield* Effect.fail(
+        new AuthError({
+          message: `aws sso ${command} exited with code ${exit}`,
+        }),
+      );
+    }
+  }).pipe(Effect.scoped);
+
+const resolveCredentials = (profileName: string, config: AwsAuthConfig) =>
+  Match.value(config)
+    .pipe(
+      Match.when(
+        { method: "env" },
+        Effect.fnUntraced(function* () {
+          const accessKeyId =
+            yield* getEnvRedactedRequired("AWS_ACCESS_KEY_ID");
+          const secretAccessKey = yield* getEnvRedactedRequired(
+            "AWS_SECRET_ACCESS_KEY",
+          );
+          const sessionToken = yield* getEnvRedacted("AWS_SESSION_TOKEN");
+          const region = yield* (
+            getEnv("AWS_REGION") ?? getEnv("AWS_DEFAULT_REGION") ?? undefined
+          );
+          return {
+            accessKeyId,
+            secretAccessKey,
+            sessionToken,
+            region,
+            source: { type: "env" as const },
+          };
+        }),
+      ),
+      Match.when({ method: "stored" }, () =>
+        readCredentials<AwsStoredCredentials>(profileName, "aws").pipe(
+          Effect.flatMap((creds) =>
+            creds == null
+              ? Effect.fail(
+                  new AuthError({
+                    message:
+                      "AWS stored credentials not found. Run: alchemy-effect login --configure",
+                  }),
+                )
+              : Effect.succeed({
+                  accessKeyId: Redacted.make(creds.accessKeyId),
+                  secretAccessKey: Redacted.make(creds.secretAccessKey),
+                  sessionToken: creds.sessionToken
+                    ? Redacted.make(creds.sessionToken)
+                    : undefined,
+                  region: creds.region,
+                  source: { type: "stored" as const },
+                }),
+          ),
+        ),
+      ),
+      Match.when({ method: "sso" }, (config) =>
+        Effect.gen(function* () {
+          const auth = yield* DistilledAuth.Default;
+          const creds = yield* auth
+            .loadProfileCredentials(config.ssoProfile)
+            .pipe(
+              Effect.mapError(
+                (e) =>
+                  new AuthError({
+                    message: "failed to load credentials",
+                    cause: e,
+                  }),
+              ),
+            );
+          const profile = yield* auth
+            .loadProfile(config.ssoProfile)
+            .pipe(Effect.catch(() => Effect.succeed(undefined)));
+          return {
+            accessKeyId: creds.accessKeyId,
+            secretAccessKey: creds.secretAccessKey,
+            sessionToken: creds.sessionToken,
+            region: profile?.region,
+            source: { type: "sso" as const, details: config.ssoProfile },
+          };
+        }),
+      ),
+      Match.exhaustive,
+    )
+    .pipe(
+      Effect.mapError(
+        (e) => new AuthError({ message: "login failed", cause: e }),
+      ),
+    );
+
+const prettyPrint = (profileName: string, config: AwsAuthConfig) =>
+  resolveCredentials(profileName, config).pipe(
+    Effect.tap((creds) =>
+      Effect.all([
+        Console.log(`  accessKeyId:     ${displayRedacted(creds.accessKeyId)}`),
+        Console.log(
+          `  secretAccessKey: ${displayRedacted(creds.secretAccessKey)}`,
+        ),
+        creds.sessionToken
+          ? Console.log(
+              `  sessionToken:    ${displayRedacted(creds.sessionToken)}`,
+            )
+          : Effect.void,
+        creds.region
+          ? Console.log(`  region:          ${creds.region}`)
+          : Effect.void,
+        Console.log(
+          //@ts-expect-error
+          `  source: ${creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type}`,
+        ),
+      ]),
+    ),
+    Effect.catch((e) =>
+      Console.error(`  Failed to retrieve credentials: ${e}`),
+    ),
+  );
+
+/**
+ * `aws sso logout` only clears AWS CLI's own caches — it does not know about the
+ * `<sha1(sso_session)>.credentials.json` file that `@distilled.cloud/aws`
+ * writes alongside the SSO token. Without this cleanup, `loadProfileCredentials`
+ * short-circuits on the stale distilled cache file after logout and appears to
+ * stay logged in until the role creds hit their TTL.
+ */
+const clearDistilledSsoCache = (ssoProfile: string) =>
+  Effect.gen(function* () {
+    const auth = yield* DistilledAuth.Default;
+    const profile = yield* auth.loadProfile(ssoProfile);
+    const ssoSession = (profile as { sso_session?: string }).sso_session;
+    if (!ssoSession) return;
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const hash = NodeCrypto.createHash("sha1").update(ssoSession).digest("hex");
+    const cacheFile = path.join(
+      NodeOs.homedir(),
+      ".aws",
+      "sso",
+      "cache",
+      `${hash}.credentials.json`,
+    );
+    yield* fs.remove(cacheFile).pipe(Effect.catch(() => Effect.void));
+  }).pipe(Effect.catch(() => Effect.void));
+
+const logout = (profileName: string, config: AwsAuthConfig) =>
+  Match.value(config).pipe(
+    Match.when({ method: "env" }, () => Effect.void),
+    Match.when({ method: "sso" }, (config) =>
+      Clank.info(
+        `AWS: running 'aws sso logout --profile ${config.ssoProfile}'...`,
+      ).pipe(
+        Effect.zip(runSsoCommand("logout", config.ssoProfile)),
+        Effect.zip(clearDistilledSsoCache(config.ssoProfile)),
+        Effect.match({
+          onSuccess: () => Clank.success("AWS: SSO logout complete"),
+          onFailure: (e) =>
+            Clank.warn(`AWS: SSO logout failed: \`${e.message}\``),
+        }),
+      ),
+    ),
+    Match.when({ method: "stored" }, () =>
+      deleteCredentials(profileName, "aws").pipe(
+        Effect.andThen(Clank.success("AWS: stored credentials removed")),
+      ),
+    ),
+    Match.exhaustive,
+  );
+
+const login = (profileName: string, config: AwsAuthConfig) =>
+  Match.value(config)
+    .pipe(
+      Match.when({ method: "env" }, () => Effect.void),
+      Match.when({ method: "sso" }, (config) =>
+        DistilledAuth.loadProfileCredentials(config.ssoProfile).pipe(
+          Effect.matchEffect({
+            onSuccess: () =>
+              Clank.info(
+                `AWS: SSO profile '${config.ssoProfile}' already has valid credentials`,
+              ),
+            onFailure: () => loginSSO(config),
+          }),
+        ),
+      ),
+      Match.when({ method: "stored" }, () =>
+        readCredentials<AwsStoredCredentials>(profileName, "aws").pipe(
+          Effect.flatMap((creds) =>
+            creds == null ? loginStored(profileName) : Effect.void,
+          ),
+        ),
+      ),
+      Match.exhaustive,
+    )
+    .pipe(
+      Effect.mapError(
+        (e) => new AuthError({ message: "login failed", cause: e }),
+      ),
+    );
+
+const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
+  Effect.gen(function* () {
+    if (ctx.ci) {
+      return { method: "env" as const };
+    }
+    return yield* configureInteractive(profileName);
+  }).pipe(
+    Effect.mapError(
+      (e) =>
+        new AuthError({
+          message: "failed to configure credentials",
+          cause: e,
+        }),
+    ),
+  );
+
+const configureInteractive = (profileName: string) =>
+  Clank.select({
+    message: "AWS authentication method",
+    options,
+  }).pipe(
+    Effect.flatMap((method) =>
+      Match.value(method).pipe(
+        Match.when("env", () => Effect.succeed({ method: "env" as const })),
+        Match.when("sso", () =>
+          Effect.gen(function* () {
+            const ssoProfile = yield* Clank.text({
+              message: "AWS profile name (from ~/.aws/config)",
+              placeholder: "default",
+              defaultValue: "default",
+            });
+
+            const config = {
+              method: "sso" as const,
+              ssoProfile: ssoProfile ?? "default",
+            };
+
+            yield* loginSSO(config);
+
+            return config;
+          }),
+        ),
+        Match.when("stored", () => loginStored(profileName)),
+        Match.exhaustive,
+      ),
+    ),
+  );
+
+const loginSSO = (config: Extract<AwsAuthConfig, { method: "sso" }>) =>
+  Clank.info(
+    `AWS SSO: running 'aws sso login --profile ${config.ssoProfile}'...`,
+  ).pipe(
+    Effect.andThen(runSsoCommand("login", config.ssoProfile)),
+    Effect.matchEffect({
+      onSuccess: () => Clank.success("AWS SSO: login complete"),
+      onFailure: (e) => Clank.warn(`AWS SSO: login faield: \`${e.message}\``),
+    }),
+  );
+
+const loginStored = Effect.fnUntraced(function* (profileName: string) {
+  const accessKeyId = yield* Clank.text({
+    message: "AWS Access Key ID",
+    validate: (v) => (v.length === 0 ? "Required" : undefined),
+  }).pipe(retryOnce);
+
+  const secretAccessKey = yield* Clank.password({
+    message: "AWS Secret Access Key",
+    validate: (v) => (v.length === 0 ? "Required" : undefined),
+  }).pipe(retryOnce);
+
+  const sessionToken = yield* Clank.text({
+    message: "AWS Session Token (optional — press Enter or Esc to skip)",
+    placeholder: "(none)",
+  }).pipe(Effect.catch(() => Effect.succeed("")));
+
+  const region = yield* Clank.text({
+    message: "AWS Region",
+    placeholder: "us-east-1",
+    defaultValue: "us-east-1",
+  }).pipe(retryOnce);
+
+  yield* writeCredentials<AwsStoredCredentials>(profileName, "aws", {
+    accessKeyId,
+    secretAccessKey,
+    sessionToken,
+    region,
+  });
+  yield* Clank.success("AWS credentials saved.");
+
+  return { method: "stored" as const };
+});

package/src/AWS/AutoScaling/LaunchTemplate.ts

@@ -16,8 +16,8 @@ import type { Providers } from "../Providers.ts";
 import { Stack } from "../../Stack.ts";
 import { Stage } from "../../Stage.ts";
 import { createInternalTags, diffTags, hasTags } from "../../Tags.ts";
-import type { AccountID } from "../Account.ts";
-import { Account } from "../Account.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
 import { Assets } from "../Assets.ts";
 import type { SecurityGroupId } from "../EC2/SecurityGroup.ts";
 import {
@@ -175,7 +175,7 @@ export const LaunchTemplateProvider = () =>
   Provider.effect(
     LaunchTemplate,
     Effect.gen(function* () {
-      const accountId = yield* Account;
+      const { accountId } = yield* AWSEnvironment;
       const region = yield* Region;
       const stack = yield* Stack;
       const stage = yield* Stage;