@homeflare/alchemy 0.1.2 → 0.2.0

package/README.md

@@ -24,7 +24,7 @@ credential can delete it.
 
 ```ts
 import { R2BucketLock } from '@homeflare/alchemy';
-import { providers } from '@homeflare/alchemy/providers';
+import { providers } from '@homeflare/alchemy/cloudflare';
 
 export class BackupLock extends R2BucketLock('backup-lock', {
   bucketName: 'my-backups',
@@ -36,10 +36,28 @@ export class BackupLock extends R2BucketLock('backup-lock', {
 Add the provider layer to your stack:
 
 ```ts
-import { providers } from '@homeflare/alchemy/providers';
+import { providers } from '@homeflare/alchemy/cloudflare';
 // …then provide `providers()` alongside Cloudflare.providers()
 ```
 
+## Website.Astro / Website.Vite
+
+House flags on Alchemy's own stacks — the two this estate actually ships.
+
+```ts
+import { astroWebsite, viteWebsite } from '@homeflare/alchemy/cloudflare';
+
+const site = yield * astroWebsite('subnetcalc', { rootDir });
+const app = yield * viteWebsite('aimto', { rootDir: webRoot });
+```
+
+⛔ Astro needs `disable_nodejs_process_v2` — workerd process-v2 makes every page return
+`[object Object]`. Vite / TanStack Start does not. Alchemy injects
+`@alchemy.run/frontend-frameworks/astro`; do not add `@astrojs/cloudflare`.
+
+⛔ Not Nextjs. `Website.Nextjs` hashes source and plans as **create** against a live
+Worker. Adopt that shape with `Worker`, not a helper here.
+
 ⚠️ **The rule set is REPLACE, not merge.** The API `PUT`s the whole set, so a rule omitted
 from `rules` is a rule deleted. That is the same shape as the Cloudflare API itself.
 

package/dist/cloudflare/index.d.ts

@@ -8,4 +8,5 @@
 export type { R2LockRule } from './lock-rules.ts';
 export { R2BucketLock, type R2BucketLockProps } from './r2-bucket-lock.ts';
 export { providers } from './providers.ts';
+export { astroWebsite, viteWebsite, type AstroWebsiteProps, type ViteWebsiteProps, } from './website.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/cloudflare/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC"}

package/dist/cloudflare/index.js

@@ -120,10 +120,31 @@ import * as Layer2 from "effect/Layer";
 class Providers extends Provider2.ProviderCollection()("HomeflareCloudflare") {
 }
 var providers = () => Layer2.effect(Providers, Provider2.collection([R2BucketLock])).pipe(Layer2.provide(R2BucketLockProvider()), Layer2.provideMerge(CloudflareApiLive));
+// src/cloudflare/website.ts
+import * as AdoptPolicy from "alchemy/AdoptPolicy";
+import * as Cloudflare2 from "alchemy/Cloudflare";
+import * as RemovalPolicy from "alchemy/RemovalPolicy";
+var ASTRO_FLAGS = ["nodejs_compat", "disable_nodejs_process_v2"];
+function astroWebsite(name, props) {
+  const flags = props.compatibility?.flags ?? ASTRO_FLAGS;
+  const merged = {
+    ...props,
+    name: props.name ?? name,
+    sessionKVBindingName: props.sessionKVBindingName ?? false,
+    compatibility: { ...props.compatibility, flags: [...flags] }
+  };
+  return Cloudflare2.Website.Astro(name, merged).pipe(AdoptPolicy.adopt(true), RemovalPolicy.retain());
+}
+function viteWebsite(name, props) {
+  const merged = { ...props, name: props?.name ?? name };
+  return Cloudflare2.Website.Vite(name, merged).pipe(AdoptPolicy.adopt(true), RemovalPolicy.retain());
+}
 export {
   R2BucketLock,
-  providers
+  astroWebsite,
+  providers,
+  viteWebsite
 };
 
-//# debugId=DE23078825F2DFD564756E2164756E21
+//# debugId=BAAC749CC302533C64756E2164756E21
 //# sourceMappingURL=index.js.map

package/dist/cloudflare/index.js.map

@@ -1,13 +1,14 @@
 {
   "version": 3,
-  "sources": ["../src/cloudflare/r2-bucket-lock.ts", "../src/cloudflare/client.ts", "../src/cloudflare/lock-rules.ts", "../src/cloudflare/providers.ts"],
+  "sources": ["../src/cloudflare/r2-bucket-lock.ts", "../src/cloudflare/client.ts", "../src/cloudflare/lock-rules.ts", "../src/cloudflare/providers.ts", "../src/cloudflare/website.ts"],
   "sourcesContent": [
     "import { Unowned } from 'alchemy/AdoptPolicy';\nimport * as Provider from 'alchemy/Provider';\nimport { Resource, type ResourceClass } from 'alchemy/Resource';\n/**\n * `Cloudflare.R2BucketLock` — the lock rule set on one R2 bucket, declared rather than applied by\n * hand. A bucket lock is a RETENTION FLOOR: while a rule covers an object, no API call, no\n * lifecycle rule and no credential can delete it.\n *\n * 🔴 WHY THIS EXISTS AT ALL, AND WHAT IT REPLACES. a consuming stack shipped the retention floor as a\n *   documented `wrangler r2 bucket lock add …` step in the runbook, on the measured ground that\n *   `alchemy@2.0.0-beta.77` has no lock property anywhere in its R2 namespace. That measurement is\n *   still true and it was the wrong conclusion: a step a human runs once is a step an Alchemy plan\n *   can never show missing, so removing the floor by hand leaves that stack, its plan and\n *   every gate completely green. The operator's rule (2026-09-15) is to cover such a gap with a\n *   custom resource over the vendor's SDK, which is what this is.\n *\n * ⛔ THE SDK ALREADY HAD IT, AND THAT IS WORTH SAYING BECAUSE IT DECIDED THE SHAPE. Measured\n *   2026-09-15 in `cloudflare@4.5.0`, `resources/r2/buckets/locks.d.ts`:\n *\n *       update(bucketName: string, params: LockUpdateParams, options?): APIPromise<…>\n *       get(bucketName: string, params: LockGetParams, options?): APIPromise<LockGetResponse>\n *\n *   over `PUT`/`GET /accounts/{account_id}/r2/buckets/{bucket_name}/lock` with the jurisdiction\n *   carried as the `cf-r2-jurisdiction` header (`locks.mjs:17` and `:41`). So there is no raw\n *   `client.put` fallback here and no path string this package invented — the fallback the rule\n *   allows was not needed.\n *\n * ⚠️ THE RULE SET IS A REPLACE, NOT A MERGE. `PUT` takes the WHOLE list, exactly like R2's\n *   lifecycle rules — which is the trap a consuming stack records for\n *   `homeflare-git`. Declaring this resource on a bucket whose live rules nobody has read would\n *   drop them, so `read` fetches them first and `reconcile` refuses to write when they already\n *   match.\n */\nimport type Cloudflare from 'cloudflare';\nimport { NotFoundError } from 'cloudflare';\nimport * as Effect from 'effect/Effect';\nimport { CloudflareApi } from './client.ts';\nimport {\n  type Jurisdiction,\n  type R2LockRule,\n  jurisdictionOf,\n  rulesEqual,\n  toBody,\n} from './lock-rules.ts';\nimport type { Providers } from './providers.ts';\n\nexport interface R2BucketLockProps {\n  readonly accountId: string;\n  readonly bucketName: string;\n  /** ⚠️ Part of the bucket's IDENTITY, not a preference — a bucket in another jurisdiction is another bucket. */\n  readonly jurisdiction?: Jurisdiction;\n  /**\n   * ⛔ REQUIRED, AND ITS EMPTY VALUE IS THE DANGEROUS ONE. `rules: []` means NO FLOOR: it is what\n   *   `delete` sends to take a lock off deliberately. An optional property would let a declaration\n   *   that simply forgot it send `[]` and silently unlock the repository, reporting success — the\n   *   same reasoning `LiteLLM.McpServer.allowedTools` is required for.\n   */\n  readonly rules: readonly R2LockRule[];\n}\n\nexport type R2BucketLockAttributes = {\n  readonly bucketName: string;\n  readonly jurisdiction: Jurisdiction;\n  readonly rules: readonly R2LockRule[];\n};\n\nexport interface R2BucketLock extends Resource<\n  'Cloudflare.R2BucketLock',\n  R2BucketLockProps,\n  R2BucketLockAttributes,\n  never,\n  Providers\n> {}\n\n// ⚠️ EXPLICIT ANNOTATION, REQUIRED BY isolatedDeclarations. This file was internal to a\n//   monorepo before it was published; a published package emits its .d.ts from a separate\n//   tsc pass, so every exported symbol must state its type rather than infer it.\nexport const R2BucketLock: ResourceClass<R2BucketLock> = Resource<R2BucketLock>(\n  'Cloudflare.R2BucketLock',\n  {\n    /**\n     * ⛔ RETAIN, AND ON THIS RESOURCE IT IS NOT THE ESTATE'S HABIT BUT THE WHOLE POINT. A lock is a\n     *   safety floor: removing the declaration must not remove the floor, because the state it\n     *   protects is the only physical backup of the estate's one Postgres. `delete` below is\n     *   implemented — a provider that cannot delete cannot be tested or corrected — and it is\n     *   reachable only by an operator running the CLI directly, past a deploy wrapper.\n     */\n    defaultRemovalPolicy: 'retain',\n  },\n);\n\n/**\n * 🔴 A 404 HERE IS \"NOTHING TO ADOPT\", AND THE FIRST PLAN PROVED IT IS THE ORDINARY CASE.\n *   Measured 2026-09-15, an alchemy plan --detailed on a bucket that does not\n *   exist yet: `404 {\"success\":false,\"errors\":[{\"code\":10006,\"message\":\"The specified bucket does\n *   not exist.\"}]}` — raised from `read`, during PLANNING, before anything is created. Alchemy\n *   calls `read` for a resource with no prior state, so on every first deploy the lock is asked\n *   about a bucket the same plan is about to create. Letting that throw makes the resource\n *   impossible to plan; swallowing it with `catchAll` would also hide a 403 from a mis-scoped\n *   token, which is the failure this estate spends the most time on. So: 404 → absent, everything\n *   else propagates.\n *\n * ⛔ AN EMPTY LIVE RULE SET IS \"NO LOCK\", NOT \"A LOCK WITH NOTHING IN IT\", so it reads as absent\n *   and the resource CREATES. The API answers `{}` for a bucket that has never been locked and\n *   `{ rules: [] }` for one whose rules were removed; both mean the floor is gone.\n * ⚠️ `Unowned` UNTIL THIS STACK HAS WRITTEN IT. A lock someone applied by hand — which is exactly\n *   what the retired runbook step did — must not be silently rewritten by a mistyped declaration;\n *   the planner refuses until the resource is piped through `adopt(true)`, which is one line an\n *   operator reads in the diff. An adopted rule set that already MATCHES then costs no request at\n *   all, because `reconcile` below returns before writing.\n */\nexport const readLock = (\n  client: Cloudflare,\n  props: { accountId: string; bucketName: string; jurisdiction?: Jurisdiction },\n  written: boolean,\n): Effect.Effect<R2BucketLockAttributes | undefined> =>\n  Effect.gen(function* () {\n    const jurisdiction = jurisdictionOf(props);\n    const live = yield* Effect.tryPromise({\n      try: () =>\n        client.r2.buckets.locks.get(props.bucketName, {\n          account_id: props.accountId,\n          jurisdiction,\n        }),\n      catch: (cause) => cause,\n    }).pipe(\n      Effect.catchIf(\n        (cause) => cause instanceof NotFoundError,\n        () => Effect.succeed(undefined),\n      ),\n      Effect.orDie,\n    );\n    if (live === undefined) return undefined;\n    const rules = (live.rules ?? []) as readonly R2LockRule[];\n    if (rules.length === 0) return undefined;\n    const attributes: R2BucketLockAttributes = {\n      bucketName: props.bucketName,\n      jurisdiction,\n      rules,\n    };\n    return written ? attributes : Unowned(attributes);\n  });\n\n/**\n * ⛔ A NO-OP MAKES NO REQUEST, AND ON A LOCK THAT MATTERS MORE THAN TIDINESS. `PUT` replaces the\n *   rule set; re-sending an identical one on every deploy is a write against the only thing\n *   standing between this repository and a delete, for no change. `output` is what the last deploy\n *   persisted (or what `read` just adopted), so the comparison costs nothing either.\n */\nexport const reconcileLock = (\n  client: Cloudflare,\n  news: R2BucketLockProps,\n  output: R2BucketLockAttributes | undefined,\n): Effect.Effect<R2BucketLockAttributes> =>\n  Effect.gen(function* () {\n    const jurisdiction = jurisdictionOf(news);\n    if (output !== undefined && rulesEqual(output.rules, news.rules)) return output;\n    yield* Effect.promise(() =>\n      client.r2.buckets.locks.update(news.bucketName, {\n        account_id: news.accountId,\n        jurisdiction,\n        ...toBody(news.rules),\n      }),\n    );\n    return { bucketName: news.bucketName, jurisdiction, rules: news.rules };\n  });\n\n/**\n * ⛔ DELETING THIS RESOURCE MEANS PUTTING AN EMPTY RULE SET, WHICH IS UNLOCKING THE BUCKET. It is\n *   implemented because the retirement path is real — R2 refuses to empty a bucket while any lock\n *   rule is configured, so retiring the repository has to start here — and it is behind\n *   `defaultRemovalPolicy: 'retain'` and the estate CLI's refusal of `destroy` precisely because\n *   no ordinary deploy should ever reach it.\n */\nexport const deleteLock = (\n  client: Cloudflare,\n  output: R2BucketLockAttributes,\n  accountId: string,\n): Effect.Effect<void> =>\n  Effect.gen(function* () {\n    yield* Effect.promise(() =>\n      client.r2.buckets.locks.update(output.bucketName, {\n        account_id: accountId,\n        jurisdiction: output.jurisdiction,\n        rules: [],\n      }),\n    );\n  });\n\nexport const R2BucketLockProvider = () =>\n  Provider.effect(\n    R2BucketLock,\n    Effect.gen(function* () {\n      const client = yield* CloudflareApi;\n      return R2BucketLock.Provider.of({\n        /**\n         * ⛔ EMPTY, AND ALCHEMY'S OWN CONTRACT ASKS FOR EXACTLY THAT. `ProviderService.list`:\n         *   \"Resources with no native enumeration API (… sub-resources keyed entirely by a parent)\n         *   should return an empty array rather than throwing.\" There is no list-locks endpoint —\n         *   a lock is reachable only through the bucket that owns it — so enumerating would mean\n         *   listing every bucket in the account and GETting each one's lock.\n         * ⛔⛔ AND `nuke.singleton` IS WHY THAT IS NOT MERELY UNAVAILABLE BUT UNWANTED. `list`\n         *   feeds `alchemy unsafe nuke`, which lists and then deletes; `delete` here is an UNLOCK.\n         *   A working enumeration would hand one command the ability to strip the retention floor\n         *   off every bucket in the account — the precise event a floor exists to make impossible.\n         *   `singleton` is the documented word for it: always-present configuration whose delete\n         *   resets rather than removes.\n         */\n        list: () => Effect.succeed([]),\n        nuke: { singleton: true },\n        read: Effect.fn(function* ({ olds, output }) {\n          const props = olds ?? undefined;\n          if (props === undefined) return undefined;\n          return yield* readLock(client, props, output !== undefined);\n        }),\n        reconcile: Effect.fn(({ news, output }) => reconcileLock(client, news, output)),\n        delete: Effect.fn(({ olds, output }) => deleteLock(client, output, olds.accountId)),\n      });\n    }),\n  );\n",
     "/**\n * The Cloudflare REST API as an Effect service, over `cloudflare-typescript`. Codex standard 5:\n * the vendor's SDK, never a hand-rolled client — and never a hand-rolled `fetch` either.\n *\n * ⛔ THE SDK WAS ALREADY IN THE STORE AND DECLARED BY NOBODY. Measured 2026-09-15:\n *   `node_modules/.pnpm/cloudflare@4.5.0` exists as a transitive dependency of `alchemy`, and\n *   `pnpm ls cloudflare --depth 0` at the root and in every workspace package returns nothing.\n *   `house/local/scripts/vendor-sdk-ratchet.ts` row R2 says exactly that — \"not declared anywhere\n *   in the workspace yet … the row adds the dependency once, then converts the TS callers\" — so\n *   this package is that row's first half, and the twenty ratcheted offences keep their rows.\n *\n * ⛔ AND IT IS PINNED EXACTLY, NOT `catalog:`. There is no catalog entry for `cloudflare`, and the\n *   version that resolves today is the one alchemy pulls in. Pinning `4.5.0` means a future\n *   alchemy bump moves alchemy's copy and not this package's contract — the alternative is a\n *   provider whose request shape changes because an unrelated dependency was upgraded.\n *\n * ⚠️ `fetch` IS A SEAM, NOT A CONVENIENCE — the same argument `packages/litellm-client` makes. The\n *   SDK hands its custom fetch the URL and init it built, so a test double conforming to\n *   `Core.Fetch` exercises the real path assembly, the real body serialisation and the real header\n *   set. A test that stubbed `client.r2.buckets.locks.update` would prove only that a stub was\n *   called, which is precisely the class of check this estate keeps finding green over nothing.\n */\nimport Cloudflare from 'cloudflare';\nimport * as Config from 'effect/Config';\nimport * as Context from 'effect/Context';\nimport * as Effect from 'effect/Effect';\nimport * as Layer from 'effect/Layer';\nimport * as Redacted from 'effect/Redacted';\n\n/** What the SDK accepts for `fetch`, restated so tests can name it without importing SDK internals. */\nexport type ClientFetch = (url: string | URL | Request, init?: RequestInit) => Promise<Response>;\n\nexport class CloudflareApi extends Context.Service<CloudflareApi, Cloudflare>()(\n  'homeflare/CloudflareApi',\n) {}\n\n/**\n * ⚠️ THE FAKE FETCH IS THE ONLY REASON THIS TAKES OPTIONS AT ALL. Everything else the SDK reads\n *   from the environment the estate CLI already populates.\n */\nexport const makeClient = (options: { apiToken: string; fetch?: ClientFetch }): Cloudflare =>\n  new Cloudflare({\n    apiToken: options.apiToken,\n    ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n  });\n\n/**\n * ⛔ FAIL CLOSED ON THE VALUE, NEVER ON THE VARIABLE EXISTING. AGENTS.md \"the four that cost the\n *   most\" §4: a denied OpenBao path renders the template EMPTY rather than erroring, and every\n *   Cloudflare call then answers 403 exactly like a revoked token — which sends the operator to\n *   Cloudflare to rotate a credential that was fine. Your deploy wrapper should write\n *   CLOUDFLARE_API_TOKEN from the stack's declared role, short-lived and scoped.\n */\nconst MISSING_TOKEN =\n  'CLOUDFLARE_API_TOKEN is not set. Mint a short-lived, scoped token and export it before ' +\n  'role named in estate.stack.ts; running `alchemy` directly skips that and there is no default.';\n\nconst EMPTY_TOKEN =\n  'CLOUDFLARE_API_TOKEN is set but EMPTY. That is a denied or missing OpenBao grant on the ' +\n  'stack’s role, not a rotated token — re-mint it rather than rotating anything at Cloudflare.';\n\n/**\n * ⛔ A LAYER'S ERROR CHANNEL MUST BE `never`, so a ConfigError becomes a defect carrying a sentence\n *   rather than a type error pushed up into `Stack`. Same decision, same words, as `LiteLLMLive`.\n */\nexport const CloudflareApiLive = Layer.effect(\n  CloudflareApi,\n  Effect.gen(function* () {\n    const token = yield* Config.redacted('CLOUDFLARE_API_TOKEN').pipe(\n      Effect.catchTag('ConfigError', () => Effect.die(new Error(MISSING_TOKEN))),\n    );\n    const value = Redacted.value(token);\n    if (value.length === 0) return yield* Effect.die(new Error(EMPTY_TOKEN));\n    return makeClient({ apiToken: value });\n  }),\n);\n",
     "/**\n * The vocabulary of an R2 lock rule, and the comparison that decides whether to write one.\n *\n * ★ ITS OWN MODULE FOR THE REASON `house/litellm/src/equal.ts` IS ONE: the comparison is the\n *   riskiest function in the provider and it deserves to be readable and testable without the\n *   lifecycle around it. An equality that returned true for everything would make every reconcile\n *   a no-op and the resource would silently never write anything — which looks exactly like a\n *   converged stack.\n */\n/** Jurisdictions the API accepts, as the SDK declares them. */\nexport type Jurisdiction = 'default' | 'eu' | 'fedramp';\n\n/**\n * One lock rule. ⚠️ `prefix` OMITTED MEANS THE WHOLE BUCKET — the SDK documents an empty prefix as\n * the way to scope a rule to every object, and omitting the key is how that is spelled on the wire.\n */\nexport type R2LockRule = {\n  readonly id: string;\n  readonly enabled: boolean;\n  readonly prefix?: string;\n  readonly condition:\n    | { readonly type: 'Age'; readonly maxAgeSeconds: number }\n    | { readonly type: 'Date'; readonly date: string }\n    | { readonly type: 'Indefinite' };\n};\n\n/** ⚠️ `undefined` and `'default'` are the same jurisdiction; normalise so a diff never sees both. */\nexport const jurisdictionOf = (props: { readonly jurisdiction?: Jurisdiction }): Jurisdiction =>\n  props.jurisdiction ?? 'default';\n\n/**\n * ⛔ FIELD BY FIELD, IN ORDER, AND NOT `JSON.stringify` OF EITHER SIDE. The API returns rules in\n *   its own key order and omits `prefix` where this repo may spell it `''`; a stringify compare\n *   would report drift on every plan and PUT an identical body each deploy. Order across the list\n *   IS compared, because the rule set is a replace and the list is what gets sent.\n */\nexport function rulesEqual(a: readonly R2LockRule[], b: readonly R2LockRule[]): boolean {\n  if (a.length !== b.length) return false;\n  return a.every((left, index) => {\n    const right = b[index];\n    if (right === undefined) return false;\n    if (left.id !== right.id || left.enabled !== right.enabled) return false;\n    if ((left.prefix ?? '') !== (right.prefix ?? '')) return false;\n    const [lc, rc] = [left.condition, right.condition];\n    if (lc.type !== rc.type) return false;\n    if (lc.type === 'Age') return rc.type === 'Age' && lc.maxAgeSeconds === rc.maxAgeSeconds;\n    if (lc.type === 'Date') return rc.type === 'Date' && lc.date === rc.date;\n    return true;\n  });\n}\n\n/**\n * The body the SDK sends. Split out so the test can assert the wire shape against one function.\n *\n * ⚠️ IT TAKES THE RULES, NOT THE PROPS, so this module names nothing from the resource — the\n *   comparison and the vocabulary stay readable without the lifecycle around them.\n */\nexport const toBody = (rules: readonly R2LockRule[]): { rules: R2LockRule[] } => ({\n  rules: rules.map((rule) => ({ ...rule })),\n});\n",
-    "/**\n * The HomeFlare Cloudflare provider collection, in the shape `LiteLLM.providers()` has.\n *\n * ★ ONE LAYER, BUILT ONCE, so the single `Config.redacted('CLOUDFLARE_API_TOKEN')` read is shared\n *   by every resource in the stack rather than repeated per resource.\n *\n * ⚠️ THIS IS NOT `alchemy/Cloudflare`'s COLLECTION AND DOES NOT REPLACE IT. A stack that declares\n *   both a `Cloudflare.R2.Bucket` and this lock merges the two:\n *   `Layer.mergeAll(Cloudflare.providers(), HomeflareCloudflare.providers())` — the shape\n *   a consuming stack names for one talking to more than one account.\n */\nimport * as Provider from 'alchemy/Provider';\nimport * as Layer from 'effect/Layer';\nimport { CloudflareApiLive } from './client.ts';\nimport { R2BucketLock, R2BucketLockProvider } from './r2-bucket-lock.ts';\n\nexport class Providers extends Provider.ProviderCollection<Providers>()('HomeflareCloudflare') {}\n\nexport const providers = () =>\n  Layer.effect(Providers, Provider.collection([R2BucketLock])).pipe(\n    Layer.provide(R2BucketLockProvider()),\n    Layer.provideMerge(CloudflareApiLive),\n  );\n"
+    "/**\n * The HomeFlare Cloudflare provider collection, in the shape `LiteLLM.providers()` has.\n *\n * ★ ONE LAYER, BUILT ONCE, so the single `Config.redacted('CLOUDFLARE_API_TOKEN')` read is shared\n *   by every resource in the stack rather than repeated per resource.\n *\n * ⚠️ THIS IS NOT `alchemy/Cloudflare`'s COLLECTION AND DOES NOT REPLACE IT. A stack that declares\n *   both a `Cloudflare.R2.Bucket` and this lock merges the two:\n *   `Layer.mergeAll(Cloudflare.providers(), HomeflareCloudflare.providers())` — the shape\n *   a consuming stack names for one talking to more than one account.\n */\nimport * as Provider from 'alchemy/Provider';\nimport * as Layer from 'effect/Layer';\nimport { CloudflareApiLive } from './client.ts';\nimport { R2BucketLock, R2BucketLockProvider } from './r2-bucket-lock.ts';\n\nexport class Providers extends Provider.ProviderCollection<Providers>()('HomeflareCloudflare') {}\n\nexport const providers = () =>\n  Layer.effect(Providers, Provider.collection([R2BucketLock])).pipe(\n    Layer.provide(R2BucketLockProvider()),\n    Layer.provideMerge(CloudflareApiLive),\n  );\n",
+    "/**\n * House defaults on Alchemy's Website stacks — Astro and Vite, which is what we ship.\n *\n * ★ NOT Nextjs. The blog measured Website.Nextjs planning as **create** because it\n *   hashes source; adopt is `Worker`, not Nextjs. Do not add a Nextjs helper until an\n *   app actually deploys that way.\n *\n * ⛔ `disable_nodejs_process_v2` ON ASTRO IS LOAD-BEARING. Workerd process-v2 (compat\n *   date 2025-09-15) makes every Astro page return `[object Object]`. Vite/TanStack\n *   Start does not need that flag; it needs `nodejs_compat` (Alchemy already defaults\n *   it on Vite).\n *\n * ⛔ Alchemy injects `@alchemy.run/frontend-frameworks/astro`. Do not add\n *   `@astrojs/cloudflare` — that is the wrangler path.\n *\n * ★ Alchemy's Website props are an Effect-wrapped InputProps union. We do not re-export\n *   that type — isolatedDeclarations cannot name it. Extra Alchemy fields still pass\n *   through via the rest bag; the assertion is only at the call into Alchemy.\n */\nimport * as AdoptPolicy from 'alchemy/AdoptPolicy';\nimport * as Cloudflare from 'alchemy/Cloudflare';\nimport * as RemovalPolicy from 'alchemy/RemovalPolicy';\n\nconst ASTRO_FLAGS: readonly string[] = ['nodejs_compat', 'disable_nodejs_process_v2'];\n\nexport interface AstroWebsiteProps {\n  readonly rootDir?: string;\n  readonly name?: string;\n  readonly sessionKVBindingName?: string | false;\n  readonly compatibility?: { readonly flags?: readonly string[]; readonly date?: string };\n}\n\nexport interface ViteWebsiteProps {\n  readonly rootDir?: string;\n  readonly name?: string;\n}\n\n/**\n * `Cloudflare.Website.Astro` with house flags, no auto session KV, adopt+retain.\n *\n *     const site = yield* astroWebsite('subnetcalc', { rootDir });\n */\nexport function astroWebsite(\n  name: string,\n  props: AstroWebsiteProps,\n): ReturnType<typeof Cloudflare.Website.Astro> {\n  const flags = props.compatibility?.flags ?? ASTRO_FLAGS;\n  const merged = {\n    ...props,\n    name: props.name ?? name,\n    sessionKVBindingName: props.sessionKVBindingName ?? false,\n    compatibility: { ...props.compatibility, flags: [...flags] },\n  };\n  return Cloudflare.Website.Astro(name, merged as never).pipe(\n    AdoptPolicy.adopt(true),\n    RemovalPolicy.retain(),\n  );\n}\n\n/**\n * `Cloudflare.Website.Vite` — TanStack Start, SolidStart, static Vite.\n * `nodejs_compat` is Alchemy's Vite default; we do not add process-v2 here.\n *\n *     const app = yield* viteWebsite('aimto', { rootDir: webRoot });\n */\nexport function viteWebsite(\n  name: string,\n  props?: ViteWebsiteProps,\n): ReturnType<typeof Cloudflare.Website.Vite> {\n  const merged = { ...props, name: props?.name ?? name };\n  return Cloudflare.Website.Vite(name, merged as never).pipe(\n    AdoptPolicy.adopt(true),\n    RemovalPolicy.retain(),\n  );\n}\n"
   ],
-  "mappings": ";AAAA;AACA;AACA;AAgCA;AACA;;;ACbA;AACA;AACA;AACA;AACA;AACA;AAAA;AAKO,MAAM,sBAA8B,gBAAmC,EAC5E,yBACF,EAAE;AAAC;AAMI,IAAM,aAAa,CAAC,YACzB,IAAI,WAAW;AAAA,EACb,UAAU,QAAQ;AAAA,KACd,QAAQ,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;AAChE,CAAC;AASH,IAAM,gBACJ,4FACA;AAEF,IAAM,cACJ,6FACA;AAMK,IAAM,oBAA0B,aACrC,eACO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,gBAAS,sBAAsB,EAAE,KACpD,gBAAS,eAAe,MAAa,WAAI,IAAI,MAAM,aAAa,CAAC,CAAC,CAC3E;AAAA,EACA,MAAM,SAAiB,eAAM,KAAK;AAAA,EAClC,IAAI,OAAM,WAAW;AAAA,IAAG,OAAO,OAAc,WAAI,IAAI,MAAM,WAAW,CAAC;AAAA,EACvE,OAAO,WAAW,EAAE,UAAU,OAAM,CAAC;AAAA,CACtC,CACH;;;AChDO,IAAM,iBAAiB,CAAC,UAC7B,MAAM,gBAAgB;AAQjB,SAAS,UAAU,CAAC,GAA0B,GAAmC;AAAA,EACtF,IAAI,EAAE,WAAW,EAAE;AAAA,IAAQ,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,CAAC,MAAM,UAAU;AAAA,IAC9B,MAAM,QAAQ,EAAE;AAAA,IAChB,IAAI,UAAU;AAAA,MAAW,OAAO;AAAA,IAChC,IAAI,KAAK,OAAO,MAAM,MAAM,KAAK,YAAY,MAAM;AAAA,MAAS,OAAO;AAAA,IACnE,KAAK,KAAK,UAAU,SAAS,MAAM,UAAU;AAAA,MAAK,OAAO;AAAA,IACzD,OAAO,IAAI,MAAM,CAAC,KAAK,WAAW,MAAM,SAAS;AAAA,IACjD,IAAI,GAAG,SAAS,GAAG;AAAA,MAAM,OAAO;AAAA,IAChC,IAAI,GAAG,SAAS;AAAA,MAAO,OAAO,GAAG,SAAS,SAAS,GAAG,kBAAkB,GAAG;AAAA,IAC3E,IAAI,GAAG,SAAS;AAAA,MAAQ,OAAO,GAAG,SAAS,UAAU,GAAG,SAAS,GAAG;AAAA,IACpE,OAAO;AAAA,GACR;AAAA;AASI,IAAM,SAAS,CAAC,WAA2D;AAAA,EAChF,OAAO,MAAM,IAAI,CAAC,UAAU,KAAK,KAAK,EAAE;AAC1C;;;AFkBO,IAAM,eAA4C,SACvD,2BACA;AAAA,EAQE,sBAAsB;AACxB,CACF;AAsBO,IAAM,WAAW,CACtB,QACA,OACA,YAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,eAAe,eAAe,KAAK;AAAA,EACzC,MAAM,OAAO,OAAc,mBAAW;AAAA,IACpC,KAAK,MACH,OAAO,GAAG,QAAQ,MAAM,IAAI,MAAM,YAAY;AAAA,MAC5C,YAAY,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,IACH,OAAO,CAAC,UAAU;AAAA,EACpB,CAAC,EAAE,KACM,gBACL,CAAC,UAAU,iBAAiB,eAC5B,MAAa,gBAAQ,SAAS,CAChC,GACO,aACT;AAAA,EACA,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAS,KAAK,SAAS,CAAC;AAAA,EAC9B,IAAI,MAAM,WAAW;AAAA,IAAG;AAAA,EACxB,MAAM,aAAqC;AAAA,IACzC,YAAY,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,EACF;AAAA,EACA,OAAO,UAAU,aAAa,QAAQ,UAAU;AAAA,CACjD;AAQI,IAAM,gBAAgB,CAC3B,QACA,MACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,eAAe,eAAe,IAAI;AAAA,EACxC,IAAI,WAAW,aAAa,WAAW,OAAO,OAAO,KAAK,KAAK;AAAA,IAAG,OAAO;AAAA,EACzE,OAAc,gBAAQ,MACpB,OAAO,GAAG,QAAQ,MAAM,OAAO,KAAK,YAAY;AAAA,IAC9C,YAAY,KAAK;AAAA,IACjB;AAAA,OACG,OAAO,KAAK,KAAK;AAAA,EACtB,CAAC,CACH;AAAA,EACA,OAAO,EAAE,YAAY,KAAK,YAAY,cAAc,OAAO,KAAK,MAAM;AAAA,CACvE;AASI,IAAM,aAAa,CACxB,QACA,QACA,cAEO,YAAI,UAAU,GAAG;AAAA,EACtB,OAAc,gBAAQ,MACpB,OAAO,GAAG,QAAQ,MAAM,OAAO,OAAO,YAAY;AAAA,IAChD,YAAY;AAAA,IACZ,cAAc,OAAO;AAAA,IACrB,OAAO,CAAC;AAAA,EACV,CAAC,CACH;AAAA,CACD;AAEI,IAAM,uBAAuB,MACzB,gBACP,cACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,aAAa,SAAS,GAAG;AAAA,IAc9B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,EAAE,WAAW,KAAK;AAAA,IACxB,MAAa,WAAG,UAAU,GAAG,MAAM,UAAU;AAAA,MAC3C,MAAM,QAAQ,QAAQ;AAAA,MACtB,IAAI,UAAU;AAAA,QAAW;AAAA,MACzB,OAAO,OAAO,SAAS,QAAQ,OAAO,WAAW,SAAS;AAAA,KAC3D;AAAA,IACD,WAAkB,WAAG,GAAG,MAAM,aAAa,cAAc,QAAQ,MAAM,MAAM,CAAC;AAAA,IAC9E,QAAe,WAAG,GAAG,MAAM,aAAa,WAAW,QAAQ,QAAQ,KAAK,SAAS,CAAC;AAAA,EACpF,CAAC;AAAA,CACF,CACH;;AGhNF;AACA;AAIO,MAAM,kBAA2B,6BAA8B,EAAE,qBAAqB,EAAE;AAAC;AAEzF,IAAM,YAAY,MACjB,cAAO,WAAoB,qBAAW,CAAC,YAAY,CAAC,CAAC,EAAE,KACrD,eAAQ,qBAAqB,CAAC,GAC9B,oBAAa,iBAAiB,CACtC;",
-  "debugId": "DE23078825F2DFD564756E2164756E21",
+  "mappings": ";AAAA;AACA;AACA;AAgCA;AACA;;;ACbA;AACA;AACA;AACA;AACA;AACA;AAAA;AAKO,MAAM,sBAA8B,gBAAmC,EAC5E,yBACF,EAAE;AAAC;AAMI,IAAM,aAAa,CAAC,YACzB,IAAI,WAAW;AAAA,EACb,UAAU,QAAQ;AAAA,KACd,QAAQ,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;AAChE,CAAC;AASH,IAAM,gBACJ,4FACA;AAEF,IAAM,cACJ,6FACA;AAMK,IAAM,oBAA0B,aACrC,eACO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,gBAAS,sBAAsB,EAAE,KACpD,gBAAS,eAAe,MAAa,WAAI,IAAI,MAAM,aAAa,CAAC,CAAC,CAC3E;AAAA,EACA,MAAM,SAAiB,eAAM,KAAK;AAAA,EAClC,IAAI,OAAM,WAAW;AAAA,IAAG,OAAO,OAAc,WAAI,IAAI,MAAM,WAAW,CAAC;AAAA,EACvE,OAAO,WAAW,EAAE,UAAU,OAAM,CAAC;AAAA,CACtC,CACH;;;AChDO,IAAM,iBAAiB,CAAC,UAC7B,MAAM,gBAAgB;AAQjB,SAAS,UAAU,CAAC,GAA0B,GAAmC;AAAA,EACtF,IAAI,EAAE,WAAW,EAAE;AAAA,IAAQ,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,CAAC,MAAM,UAAU;AAAA,IAC9B,MAAM,QAAQ,EAAE;AAAA,IAChB,IAAI,UAAU;AAAA,MAAW,OAAO;AAAA,IAChC,IAAI,KAAK,OAAO,MAAM,MAAM,KAAK,YAAY,MAAM;AAAA,MAAS,OAAO;AAAA,IACnE,KAAK,KAAK,UAAU,SAAS,MAAM,UAAU;AAAA,MAAK,OAAO;AAAA,IACzD,OAAO,IAAI,MAAM,CAAC,KAAK,WAAW,MAAM,SAAS;AAAA,IACjD,IAAI,GAAG,SAAS,GAAG;AAAA,MAAM,OAAO;AAAA,IAChC,IAAI,GAAG,SAAS;AAAA,MAAO,OAAO,GAAG,SAAS,SAAS,GAAG,kBAAkB,GAAG;AAAA,IAC3E,IAAI,GAAG,SAAS;AAAA,MAAQ,OAAO,GAAG,SAAS,UAAU,GAAG,SAAS,GAAG;AAAA,IACpE,OAAO;AAAA,GACR;AAAA;AASI,IAAM,SAAS,CAAC,WAA2D;AAAA,EAChF,OAAO,MAAM,IAAI,CAAC,UAAU,KAAK,KAAK,EAAE;AAC1C;;;AFkBO,IAAM,eAA4C,SACvD,2BACA;AAAA,EAQE,sBAAsB;AACxB,CACF;AAsBO,IAAM,WAAW,CACtB,QACA,OACA,YAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,eAAe,eAAe,KAAK;AAAA,EACzC,MAAM,OAAO,OAAc,mBAAW;AAAA,IACpC,KAAK,MACH,OAAO,GAAG,QAAQ,MAAM,IAAI,MAAM,YAAY;AAAA,MAC5C,YAAY,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,IACH,OAAO,CAAC,UAAU;AAAA,EACpB,CAAC,EAAE,KACM,gBACL,CAAC,UAAU,iBAAiB,eAC5B,MAAa,gBAAQ,SAAS,CAChC,GACO,aACT;AAAA,EACA,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAS,KAAK,SAAS,CAAC;AAAA,EAC9B,IAAI,MAAM,WAAW;AAAA,IAAG;AAAA,EACxB,MAAM,aAAqC;AAAA,IACzC,YAAY,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,EACF;AAAA,EACA,OAAO,UAAU,aAAa,QAAQ,UAAU;AAAA,CACjD;AAQI,IAAM,gBAAgB,CAC3B,QACA,MACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,eAAe,eAAe,IAAI;AAAA,EACxC,IAAI,WAAW,aAAa,WAAW,OAAO,OAAO,KAAK,KAAK;AAAA,IAAG,OAAO;AAAA,EACzE,OAAc,gBAAQ,MACpB,OAAO,GAAG,QAAQ,MAAM,OAAO,KAAK,YAAY;AAAA,IAC9C,YAAY,KAAK;AAAA,IACjB;AAAA,OACG,OAAO,KAAK,KAAK;AAAA,EACtB,CAAC,CACH;AAAA,EACA,OAAO,EAAE,YAAY,KAAK,YAAY,cAAc,OAAO,KAAK,MAAM;AAAA,CACvE;AASI,IAAM,aAAa,CACxB,QACA,QACA,cAEO,YAAI,UAAU,GAAG;AAAA,EACtB,OAAc,gBAAQ,MACpB,OAAO,GAAG,QAAQ,MAAM,OAAO,OAAO,YAAY;AAAA,IAChD,YAAY;AAAA,IACZ,cAAc,OAAO;AAAA,IACrB,OAAO,CAAC;AAAA,EACV,CAAC,CACH;AAAA,CACD;AAEI,IAAM,uBAAuB,MACzB,gBACP,cACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,aAAa,SAAS,GAAG;AAAA,IAc9B,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,EAAE,WAAW,KAAK;AAAA,IACxB,MAAa,WAAG,UAAU,GAAG,MAAM,UAAU;AAAA,MAC3C,MAAM,QAAQ,QAAQ;AAAA,MACtB,IAAI,UAAU;AAAA,QAAW;AAAA,MACzB,OAAO,OAAO,SAAS,QAAQ,OAAO,WAAW,SAAS;AAAA,KAC3D;AAAA,IACD,WAAkB,WAAG,GAAG,MAAM,aAAa,cAAc,QAAQ,MAAM,MAAM,CAAC;AAAA,IAC9E,QAAe,WAAG,GAAG,MAAM,aAAa,WAAW,QAAQ,QAAQ,KAAK,SAAS,CAAC;AAAA,EACpF,CAAC;AAAA,CACF,CACH;;AGhNF;AACA;AAIO,MAAM,kBAA2B,6BAA8B,EAAE,qBAAqB,EAAE;AAAC;AAEzF,IAAM,YAAY,MACjB,cAAO,WAAoB,qBAAW,CAAC,YAAY,CAAC,CAAC,EAAE,KACrD,eAAQ,qBAAqB,CAAC,GAC9B,oBAAa,iBAAiB,CACtC;;ACHF;AACA;AACA;AAEA,IAAM,cAAiC,CAAC,iBAAiB,2BAA2B;AAmB7E,SAAS,YAAY,CAC1B,MACA,OAC6C;AAAA,EAC7C,MAAM,QAAQ,MAAM,eAAe,SAAS;AAAA,EAC5C,MAAM,SAAS;AAAA,OACV;AAAA,IACH,MAAM,MAAM,QAAQ;AAAA,IACpB,sBAAsB,MAAM,wBAAwB;AAAA,IACpD,eAAe,KAAK,MAAM,eAAe,OAAO,CAAC,GAAG,KAAK,EAAE;AAAA,EAC7D;AAAA,EACA,OAAkB,oBAAQ,MAAM,MAAM,MAAe,EAAE,KACzC,kBAAM,IAAI,GACR,qBAAO,CACvB;AAAA;AASK,SAAS,WAAW,CACzB,MACA,OAC4C;AAAA,EAC5C,MAAM,SAAS,KAAK,OAAO,MAAM,OAAO,QAAQ,KAAK;AAAA,EACrD,OAAkB,oBAAQ,KAAK,MAAM,MAAe,EAAE,KACxC,kBAAM,IAAI,GACR,qBAAO,CACvB;AAAA;",
+  "debugId": "BAAC749CC302533C64756E2164756E21",
   "names": []
 }

package/dist/cloudflare/website.d.ts

@@ -0,0 +1,28 @@
+import * as Cloudflare from 'alchemy/Cloudflare';
+export interface AstroWebsiteProps {
+    readonly rootDir?: string;
+    readonly name?: string;
+    readonly sessionKVBindingName?: string | false;
+    readonly compatibility?: {
+        readonly flags?: readonly string[];
+        readonly date?: string;
+    };
+}
+export interface ViteWebsiteProps {
+    readonly rootDir?: string;
+    readonly name?: string;
+}
+/**
+ * `Cloudflare.Website.Astro` with house flags, no auto session KV, adopt+retain.
+ *
+ *     const site = yield* astroWebsite('subnetcalc', { rootDir });
+ */
+export declare function astroWebsite(name: string, props: AstroWebsiteProps): ReturnType<typeof Cloudflare.Website.Astro>;
+/**
+ * `Cloudflare.Website.Vite` — TanStack Start, SolidStart, static Vite.
+ * `nodejs_compat` is Alchemy's Vite default; we do not add process-v2 here.
+ *
+ *     const app = yield* viteWebsite('aimto', { rootDir: webRoot });
+ */
+export declare function viteWebsite(name: string, props?: ViteWebsiteProps): ReturnType<typeof Cloudflare.Website.Vite>;
+//# sourceMappingURL=website.d.ts.map

package/dist/cloudflare/website.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"website.d.ts","sourceRoot":"","sources":["../../src/cloudflare/website.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,UAAU,MAAM,oBAAoB,CAAC;AAKjD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACzF;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,iBAAiB,GACvB,UAAU,CAAC,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAY7C;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,gBAAgB,GACvB,UAAU,CAAC,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAM5C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo and Talos.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",

package/src/cloudflare/index.ts

@@ -8,3 +8,9 @@
 export type { R2LockRule } from './lock-rules.ts';
 export { R2BucketLock, type R2BucketLockProps } from './r2-bucket-lock.ts';
 export { providers } from './providers.ts';
+export {
+  astroWebsite,
+  viteWebsite,
+  type AstroWebsiteProps,
+  type ViteWebsiteProps,
+} from './website.ts';

package/src/cloudflare/website.ts

@@ -0,0 +1,75 @@
+/**
+ * House defaults on Alchemy's Website stacks — Astro and Vite, which is what we ship.
+ *
+ * ★ NOT Nextjs. The blog measured Website.Nextjs planning as **create** because it
+ *   hashes source; adopt is `Worker`, not Nextjs. Do not add a Nextjs helper until an
+ *   app actually deploys that way.
+ *
+ * ⛔ `disable_nodejs_process_v2` ON ASTRO IS LOAD-BEARING. Workerd process-v2 (compat
+ *   date 2025-09-15) makes every Astro page return `[object Object]`. Vite/TanStack
+ *   Start does not need that flag; it needs `nodejs_compat` (Alchemy already defaults
+ *   it on Vite).
+ *
+ * ⛔ Alchemy injects `@alchemy.run/frontend-frameworks/astro`. Do not add
+ *   `@astrojs/cloudflare` — that is the wrangler path.
+ *
+ * ★ Alchemy's Website props are an Effect-wrapped InputProps union. We do not re-export
+ *   that type — isolatedDeclarations cannot name it. Extra Alchemy fields still pass
+ *   through via the rest bag; the assertion is only at the call into Alchemy.
+ */
+import * as AdoptPolicy from 'alchemy/AdoptPolicy';
+import * as Cloudflare from 'alchemy/Cloudflare';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+
+const ASTRO_FLAGS: readonly string[] = ['nodejs_compat', 'disable_nodejs_process_v2'];
+
+export interface AstroWebsiteProps {
+  readonly rootDir?: string;
+  readonly name?: string;
+  readonly sessionKVBindingName?: string | false;
+  readonly compatibility?: { readonly flags?: readonly string[]; readonly date?: string };
+}
+
+export interface ViteWebsiteProps {
+  readonly rootDir?: string;
+  readonly name?: string;
+}
+
+/**
+ * `Cloudflare.Website.Astro` with house flags, no auto session KV, adopt+retain.
+ *
+ *     const site = yield* astroWebsite('subnetcalc', { rootDir });
+ */
+export function astroWebsite(
+  name: string,
+  props: AstroWebsiteProps,
+): ReturnType<typeof Cloudflare.Website.Astro> {
+  const flags = props.compatibility?.flags ?? ASTRO_FLAGS;
+  const merged = {
+    ...props,
+    name: props.name ?? name,
+    sessionKVBindingName: props.sessionKVBindingName ?? false,
+    compatibility: { ...props.compatibility, flags: [...flags] },
+  };
+  return Cloudflare.Website.Astro(name, merged as never).pipe(
+    AdoptPolicy.adopt(true),
+    RemovalPolicy.retain(),
+  );
+}
+
+/**
+ * `Cloudflare.Website.Vite` — TanStack Start, SolidStart, static Vite.
+ * `nodejs_compat` is Alchemy's Vite default; we do not add process-v2 here.
+ *
+ *     const app = yield* viteWebsite('aimto', { rootDir: webRoot });
+ */
+export function viteWebsite(
+  name: string,
+  props?: ViteWebsiteProps,
+): ReturnType<typeof Cloudflare.Website.Vite> {
+  const merged = { ...props, name: props?.name ?? name };
+  return Cloudflare.Website.Vite(name, merged as never).pipe(
+    AdoptPolicy.adopt(true),
+    RemovalPolicy.retain(),
+  );
+}