@samebase/alchemy-convex 0.15.0 → 0.16.0

package/lib/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { I as ManagementApiLive, M as installedCli, V as fromConfig, i as registerDevelopmentClient } from "./HubClient-C_nvjlvW.js";
+import { I as ManagementApiLive, M as installedCli, V as fromConfig, a as registerDevelopmentClient } from "./HubClient-BYBV7cF5.js";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import { parseArgs } from "node:util";

package/lib/index.d.ts

@@ -408,6 +408,8 @@ export declare class ProjectNotFound extends ProjectNotFound_base {
 }
 //#endregion
 //#region src/HubClient.d.ts
+/** The name of the project of the hub in each team. */
+export declare const HUB_PROJECT_NAME = "samebase";
 type HubDeploymentType = "production" | "development" | "preview";
 interface HubClientProps {
   /** The Convex team, a slug or an id, whose project `samebase` holds the hub. */
@@ -439,7 +441,7 @@ declare const HubClientFailed_base: Schema.Class<HubClientFailed, Schema.TaggedS
   readonly team: Schema.Union<readonly [Schema.String, Schema.Number]>;
   readonly reason: Schema.String;
 }>, import("effect/Cause").YieldableError>;
-/** The base of the team could not do the call. The reason is the Convex message: it holds no secret. */
+/** The hub of the team could not do the call. The reason is the Convex message: it holds no secret. */
 export declare class HubClientFailed extends HubClientFailed_base {
   get message(): string;
 }
@@ -494,27 +496,13 @@ export declare const withRunRecord: (output: unknown, record: RunRecord) => obje
 //#endregion
 //#region src/State.d.ts
 /** The name of the state project in each team. */
-export declare const STORE_PROJECT_NAME = "samebase";
-declare const OutdatedBase_base: Schema.Class<OutdatedBase, Schema.TaggedStruct<"OutdatedBase", {
-  readonly team: Schema.Union<readonly [Schema.String, Schema.Number]>;
-  readonly deployment: Schema.String;
-  readonly version: Schema.Number;
-}>, import("effect/Cause").YieldableError>;
-/**
- * The base app of the team serves an older store. Convex.state() never
- * pushes its store app over a base, because the push replaces every function
- * of the deployment and so erases the base app.
- */
-export declare class OutdatedBase extends OutdatedBase_base {
-  get message(): string;
-}
+export declare const STORE_PROJECT_NAME = "alchemy-state-store";
 /**
- * Alchemy state in the `samebase` project of `team`, with the team token
+ * Alchemy state in the `alchemy-state-store` project of `team`, with the team token
  * in CONVEX_ACCESS_TOKEN or the Convex CLI login. A team access token names
  * its team, so `team` is optional with one; the Convex CLI login needs the
  * slug or the id. The first use of the run finds or creates the project and
- * pushes the store app when the store is missing or an older seed. An older
- * base fails the run with {@link OutdatedBase}. `alchemy plan` on another
+ * pushes the store when it is missing or older. `alchemy plan` on another
  * stack never touches Convex.
  */
 export declare const state: (options?: {

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/Credentials.ts","../src/ManagementApi.ts","../src/Providers.ts","../src/Push.ts","../src/Deployment.ts","../src/Component.ts","../src/Project.ts","../src/HubClient.ts","../src/RunRecord.ts","../src/State.ts"],"mappings":";;;;;;;;;;;;;;;;UA6BiB;;WAEN,aAAa,SAAS;;WAEtB;;UAGM;;WAEN,aAAa,OAAO,OAAO;;WAE3B,gBAAgB,OAAO;;WAEvB,WAAW,OAAO,OAAO,SAAS;;;qBAGhC,oBAAoB;;qBAKpB;;qBAGA;;;;qBAOA,yBAAyB;;;;;;;;;qBAiCzB,kBAAiB,MAAM,MAAM;;qBA0B7B,aAAc;WAChB,cAAc,SAAS;WACvB,YAAY,SAAS;MAC5B,MAAM,MAAM;;;KC3GJ,mBAAmB,kBAAkB;KACrC,mBAAmB,kBAAkB;;UAGhC,YAAY;WAClB,OAAO;WACP;WACA,UAAU;;;;;;;;;;;;;qBAQR,uBAAuB;UAuBnB;;WAEN,UAAU,GACjB,mBACA,MAAM,QAAQ,qBAAqB,QAAQ,YAAY,QACpD,OAAO,OAAO,GAAG;;WAEb,cACP,mBACA,MAAM,QAAQ,qBAAqB,QAAQ,0BACxC,OAAO,aAAa;;WAEhB,oBAAoB,GAC3B,mBACA,6BACA,WAAW,SAAS,kBACpB,MAAM,QAAQ,qBAAqB,QAAQ,YAAY,QACpD,OAAO,OAAO,GAAG;;;;;;;;WAQb,gBACP,sCACG,OAAO,eAAe;;;;;;;;WAQlB,oBAAoB,mBAAmB,OAAO;;;;;WAK9C,YAAY,OAAO,SAAS,qBAAqB;;;qBAM/C,sBAAsB;;;;qBCzFtB,kBAAkB;;;;;;qBAOlB,YAAa,cAAa,MAAM,MAAM,iBAA2B,MAAA,MAAA,8CAAA,mCAAA,oDAAA;;;;KC8BlE,oBAAoB,SAAS;;;;;;KAO7B;;WAIG;;;;;;;;WAQA;;;;;;;WAOA;;;;;;qBAkCF,0BAA0B;MAIxB;;;;;;;qBAMF,0BAA0B;MAOxB;;;;;;;;;qBAMF,uBAAuB;MAMrB;;;;;;;qBAQF,2BAA2B;MAIzB;;;;;;;qBAMF,oCAAoC;MAIlC;;;;;;qBAMF,kCAAkC;MAIhC;;;qBAuCF,oBACX;EACG;EAAa;;;;UC3HR;;WAEC;aAAoB;;;;;;;;WAOpB;;;;;;WAMA,SAAS;;WAET,MAAM,SAAS,eAAe;;KAG7B,mBACP;;WAEU;MAEV;;WAEU;;;;;WAKA;;;UAIL;WACC;WACA,MAAM;;WAEN;;WAEA;;WAEA;;WAEA;;WAEA;;UAGM,6BAA6B;;WAEnC;;WAEA;;YAGC,aAAa,8BAEvB,iBACA,sBACA,kBACA;;KAQU,kBAAkB,+BAA8B,KACxD,UAAU,kBACR,WAAW;;;;;qBAWJ,wBAAwB;MAGtB;;;;;;;;;;;;qBAeF,cAAU,YACV,OAAS,oBAAe,OAAA,OAAA,mBAAA;;;;;;EAYvB,MAAA,YAAM;IAAc;IAAgB;QAAgB,OAAA,OAAA;;;;;;;;;;qBAMrD,iCAAiC;MAU/B;;;;;;qBAMF,qCAAqC;MAInC;;;;;;;;;qBAMF,4BAA4B;MAS1B;;;;;UC1OE;WACN;WACA;WACA;;;;;;;;;qBAUE,gBAAiB;EAC5B,YAAY;EACZ;EACA,WAAW;MACZ,OAAA,yBAAA;;;;KCWW,mBAAmB;KAEnB;;WAGG;;WAEA;;WAEA,mBAAmB;;WAEnB;;;WAIA;;WAEA;;UAGE;WACN;WACA;WACA;WACA;WACA;WACA;;YAGC,UAAU,2BAA2B,cAAc,0BAA0B;qBAC5E,2BAAO,cAAA;;;;;;;qBAGP,0BAA0B;MAIxB;;;;;;;;;;;;qBASF,gCAAgC;MAS9B;;;;;;;;qBAOF,yBAAyB;MAKvB;;;;;;qBAMF,+BAA+B;MAI7B;;;;;;;qBAMF,wBAAwB;MAItB;;;;KC/FH;UAEK;;WAEN;;WAEA;;WAEA;WACA,gBAAgB;;WAEhB;;WAEA;;UAGM;;WAEN;WACA;WACA,gBAAgB;;WAEhB;WACA;;WAEA,cAAc,SAAS;;YAGtB,YAAY,+BAEtB,gBACA,4BAEA;qBAEW,6BAAS,cAAA;;;;;;qBAGT,wBAAwB;MAItB;;;;;qBCvDF;;UAMI;WACN;;WAEA;;WAEA;;WAEA;;WAEA;;WAEA;;WAEA;WACA;;WAEA;;;;;qBAGE,uBAAuB;MAGrB;;;UAME;WACN;WACA,KAAK,SAAS;;;;;;;;qBAuIZ,YAAa,OAAO,mBAAiB,OAAO,OAAO,WAAW;;;;;;;qBAgB9D,gBAAiB,iBAAiB,QAAQ;;;;qBCrH1C;;;;;;;;;;;qBAwLA,qBAAqB;MAKnB;;;;;;;;;;;qBAqOF,QACX;WAAoB;MACnB,MAAM,MAAM,cAAc,oBAAoB"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/Credentials.ts","../src/ManagementApi.ts","../src/Providers.ts","../src/Push.ts","../src/Deployment.ts","../src/Component.ts","../src/Project.ts","../src/HubClient.ts","../src/RunRecord.ts","../src/State.ts"],"mappings":";;;;;;;;;;;;;;;;UA6BiB;;WAEN,aAAa,SAAS;;WAEtB;;UAGM;;WAEN,aAAa,OAAO,OAAO;;WAE3B,gBAAgB,OAAO;;WAEvB,WAAW,OAAO,OAAO,SAAS;;;qBAGhC,oBAAoB;;qBAKpB;;qBAGA;;;;qBAOA,yBAAyB;;;;;;;;;qBAiCzB,kBAAiB,MAAM,MAAM;;qBA0B7B,aAAc;WAChB,cAAc,SAAS;WACvB,YAAY,SAAS;MAC5B,MAAM,MAAM;;;KC3GJ,mBAAmB,kBAAkB;KACrC,mBAAmB,kBAAkB;;UAGhC,YAAY;WAClB,OAAO;WACP;WACA,UAAU;;;;;;;;;;;;;qBAQR,uBAAuB;UAuBnB;;WAEN,UAAU,GACjB,mBACA,MAAM,QAAQ,qBAAqB,QAAQ,YAAY,QACpD,OAAO,OAAO,GAAG;;WAEb,cACP,mBACA,MAAM,QAAQ,qBAAqB,QAAQ,0BACxC,OAAO,aAAa;;WAEhB,oBAAoB,GAC3B,mBACA,6BACA,WAAW,SAAS,kBACpB,MAAM,QAAQ,qBAAqB,QAAQ,YAAY,QACpD,OAAO,OAAO,GAAG;;;;;;;;WAQb,gBACP,sCACG,OAAO,eAAe;;;;;;;;WAQlB,oBAAoB,mBAAmB,OAAO;;;;;WAK9C,YAAY,OAAO,SAAS,qBAAqB;;;qBAM/C,sBAAsB;;;;qBCzFtB,kBAAkB;;;;;;qBAOlB,YAAa,cAAa,MAAM,MAAM,iBAA2B,MAAA,MAAA,8CAAA,mCAAA,oDAAA;;;;KC8BlE,oBAAoB,SAAS;;;;;;KAO7B;;WAIG;;;;;;;;WAQA;;;;;;;WAOA;;;;;;qBAkCF,0BAA0B;MAIxB;;;;;;;qBAMF,0BAA0B;MAOxB;;;;;;;;;qBAMF,uBAAuB;MAMrB;;;;;;;qBAQF,2BAA2B;MAIzB;;;;;;;qBAMF,oCAAoC;MAIlC;;;;;;qBAMF,kCAAkC;MAIhC;;;qBAuCF,oBACX;EACG;EAAa;;;;UC3HR;;WAEC;aAAoB;;;;;;;;WAOpB;;;;;;WAMA,SAAS;;WAET,MAAM,SAAS,eAAe;;KAG7B,mBACP;;WAEU;MAEV;;WAEU;;;;;WAKA;;;UAIL;WACC;WACA,MAAM;;WAEN;;WAEA;;WAEA;;WAEA;;WAEA;;UAGM,6BAA6B;;WAEnC;;WAEA;;YAGC,aAAa,8BAEvB,iBACA,sBACA,kBACA;;KAQU,kBAAkB,+BAA8B,KACxD,UAAU,kBACR,WAAW;;;;;qBAWJ,wBAAwB;MAGtB;;;;;;;;;;;;qBAeF,cAAU,YACV,OAAS,oBAAe,OAAA,OAAA,mBAAA;;;;;;EAYvB,MAAA,YAAM;IAAc;IAAgB;QAAgB,OAAA,OAAA;;;;;;;;;;qBAMrD,iCAAiC;MAU/B;;;;;;qBAMF,qCAAqC;MAInC;;;;;;;;;qBAMF,4BAA4B;MAS1B;;;;;UC1OE;WACN;WACA;WACA;;;;;;;;;qBAUE,gBAAiB;EAC5B,YAAY;EACZ;EACA,WAAW;MACZ,OAAA,yBAAA;;;;KCWW,mBAAmB;KAEnB;;WAGG;;WAEA;;WAEA,mBAAmB;;WAEnB;;;WAIA;;WAEA;;UAGE;WACN;WACA;WACA;WACA;WACA;WACA;;YAGC,UAAU,2BAA2B,cAAc,0BAA0B;qBAC5E,2BAAO,cAAA;;;;;;;qBAGP,0BAA0B;MAIxB;;;;;;;;;;;;qBASF,gCAAgC;MAS9B;;;;;;;;qBAOF,yBAAyB;MAKvB;;;;;;qBAMF,+BAA+B;MAI7B;;;;;;;qBAMF,wBAAwB;MAItB;;;;;qBC/FF;KAED;UAEK;;WAEN;;WAEA;;WAEA;WACA,gBAAgB;;WAEhB;;WAEA;;UAGM;;WAEN;WACA;WACA,gBAAgB;;WAEhB;WACA;;WAEA,cAAc,SAAS;;YAGtB,YAAY,+BAEtB,gBACA,4BAEA;qBAEW,6BAAS,cAAA;;;;;;qBAGT,wBAAwB;MAItB;;;;;qBCzDF;;UAMI;WACN;;WAEA;;WAEA;;WAEA;;WAEA;;WAEA;;WAEA;WACA;;WAEA;;;;;qBAGE,uBAAuB;MAGrB;;;UAME;WACN;WACA,KAAK,SAAS;;;;;;;;qBAuIZ,YAAa,OAAO,mBAAiB,OAAO,OAAO,WAAW;;;;;;;qBAgB9D,gBAAiB,iBAAiB,QAAQ;;;;qBCxH1C;;;;;;;;;qBAgXA,QACX;WAAoB;MACnB,MAAM,MAAM,cAAc,oBAAoB"}

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as PushTargetMismatch, B as DEPLOY_KEY_ENV, C as DeploymentProvider, D as ConvexAppNotFound, E as CodePushFailed, F as ManagementApi, H as fromValues, I as ManagementApiLive, L as ACCESS_TOKEN_ENV, N as parseDeployOutput, O as ConvexCliNotFound, P as ConvexApiError, R as Credentials, S as DeploymentIdentityChange, T as ProductionDeploymentNotFound, V as fromConfig, _ as ProjectProvider, a as OutdatedBase, b as AmbiguousDeployment, c as RUN_RECORD_KEY, d as withRunRecord, f as AmbiguousProject, g as ProjectNotFound, h as ProjectDeploymentChange, j as VariablesOwnedBySomeoneElse, k as EnvironmentNeedsDeployKey, l as RunRecordError, m as Project, n as HubClientFailed, o as STORE_PROJECT_NAME, p as CreatedProjectNotFound, r as HubClientProvider, s as state, t as HubClient, u as runRecord, v as ProjectTeamChange, w as DeploymentResource, x as Deployment, y as AbsoluteRootDir, z as CredentialsError } from "./HubClient-C_nvjlvW.js";
+import { A as PushTargetMismatch, B as DEPLOY_KEY_ENV, C as DeploymentProvider, D as ConvexAppNotFound, E as CodePushFailed, F as ManagementApi, H as fromValues, I as ManagementApiLive, L as ACCESS_TOKEN_ENV, N as parseDeployOutput, O as ConvexCliNotFound, P as ConvexApiError, R as Credentials, S as DeploymentIdentityChange, T as ProductionDeploymentNotFound, V as fromConfig, _ as ProjectProvider, b as AmbiguousDeployment, c as RUN_RECORD_KEY, d as withRunRecord, f as AmbiguousProject, g as ProjectNotFound, h as ProjectDeploymentChange, i as HubClientProvider, j as VariablesOwnedBySomeoneElse, k as EnvironmentNeedsDeployKey, l as RunRecordError, m as Project, n as HubClient, o as STORE_PROJECT_NAME, p as CreatedProjectNotFound, r as HubClientFailed, s as state, t as HUB_PROJECT_NAME, u as runRecord, v as ProjectTeamChange, w as DeploymentResource, x as Deployment, y as AbsoluteRootDir, z as CredentialsError } from "./HubClient-BYBV7cF5.js";
 import { toPath } from "alchemy/FQN";
 import { Stack } from "alchemy/Stack";
 import * as Effect from "effect/Effect";
@@ -43,6 +43,6 @@ const providers = (credentials = fromConfig()) => Layer.effect(Providers, Provid
 	HubClient
 ])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), DeploymentProvider(), HubClientProvider())), Layer.provide(ManagementApiLive()), Layer.provide(credentials), Layer.orDie);
 //#endregion
-export { ACCESS_TOKEN_ENV, AbsoluteRootDir, AmbiguousDeployment, AmbiguousProject, CodePushFailed, ConvexApiError, ConvexAppNotFound, ConvexCliNotFound, CreatedProjectNotFound, Credentials, CredentialsError, DEPLOY_KEY_ENV, Deployment, DeploymentIdentityChange, EnvironmentNeedsDeployKey, HubClient, HubClientFailed, ManagementApi, OutdatedBase, ProductionDeploymentNotFound, Project, ProjectDeploymentChange, ProjectNotFound, ProjectTeamChange, Providers, PushTargetMismatch, RUN_RECORD_KEY, RunRecordError, STORE_PROJECT_NAME, VariablesOwnedBySomeoneElse, bindComponent, fromConfig, fromValues, parseDeployOutput, providers, runRecord, state, withRunRecord };
+export { ACCESS_TOKEN_ENV, AbsoluteRootDir, AmbiguousDeployment, AmbiguousProject, CodePushFailed, ConvexApiError, ConvexAppNotFound, ConvexCliNotFound, CreatedProjectNotFound, Credentials, CredentialsError, DEPLOY_KEY_ENV, Deployment, DeploymentIdentityChange, EnvironmentNeedsDeployKey, HUB_PROJECT_NAME, HubClient, HubClientFailed, ManagementApi, ProductionDeploymentNotFound, Project, ProjectDeploymentChange, ProjectNotFound, ProjectTeamChange, Providers, PushTargetMismatch, RUN_RECORD_KEY, RunRecordError, STORE_PROJECT_NAME, VariablesOwnedBySomeoneElse, bindComponent, fromConfig, fromValues, parseDeployOutput, providers, runRecord, state, withRunRecord };
 
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@samebase/alchemy-convex",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "The Convex plane for Alchemy v2: projects, deployments, environment variables, and the push of the functions",
   "keywords": [
     "alchemy",
@@ -34,22 +34,6 @@
     ".": {
       "types": "./lib/index.d.ts",
       "import": "./lib/index.js"
-    },
-    "./state/convex.config": {
-      "types": "./src/store/component/convex.config.ts",
-      "default": "./src/store/component/convex.config.ts"
-    },
-    "./state/_generated/component.js": {
-      "types": "./src/store/component/_generated/component.ts",
-      "default": "./src/store/component/_generated/component.ts"
-    },
-    "./state/functions": {
-      "types": "./src/store/functions.ts",
-      "default": "./src/store/functions.ts"
-    },
-    "./state/auth.config": {
-      "types": "./src/store/authConfig.ts",
-      "default": "./src/store/authConfig.ts"
     }
   },
   "publishConfig": {

package/src/HubClient.ts

@@ -1,10 +1,9 @@
 // Convex.HubClient: one deployment of an app as a client of the identity hub
 // of its team.
 //
-// The hub is an app in the base of the team, the production deployment of the
-// project `samebase`, the project that holds the state of the team. It has
-// the internal functions of `@samebase/identity-broker` in its module
-// `identityBroker`. This resource finds the base by name and runs those
+// The hub is the production deployment of the project `samebase` of the team.
+// It has the internal functions of `@samebase/identity-broker` in its module
+// `identityBroker`. This resource finds the project by name and runs those
 // functions with a short-lived key, so a stack that has the Convex credential
 // of the team needs no other credential and no hub address. The hub answers
 // with its issuer and the client.
@@ -13,7 +12,7 @@
 // of it. A client belongs to one redirect URI: another URI is a new client. A
 // change of `app` updates the stored props and does not move the client: the
 // app is the identity of the users of the app, and it does not change. The
-// team does not change either: the state of a stack is in the base of its team.
+// team does not change either: the state of a stack is in its team.
 import { Resource } from "alchemy";
 import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
@@ -24,7 +23,10 @@ import { ManagementApi, type ManagementApiService } from "./ManagementApi.ts";
 import { findProjectByName, prodDeploymentOf } from "./Project.ts";
 import type { Providers } from "./Providers.ts";
 import { withPushKey } from "./Push.ts";
-import { type FunctionApi, makeFunctionApi, RUN_KEY_ACTIONS, STORE_PROJECT_NAME } from "./State.ts";
+import { type FunctionApi, makeFunctionApi, RUN_KEY_ACTIONS } from "./State.ts";
+
+/** The name of the project of the hub in each team. */
+export const HUB_PROJECT_NAME = "samebase";
 
 export type HubDeploymentType = "production" | "development" | "preview";
 
@@ -63,13 +65,13 @@ export type HubClient = Resource<
 >;
 export const HubClient = Resource<HubClient>("IdentityHub.Client");
 
-/** The base of the team could not do the call. The reason is the Convex message: it holds no secret. */
+/** The hub of the team could not do the call. The reason is the Convex message: it holds no secret. */
 export class HubClientFailed extends Schema.TaggedError<HubClientFailed>()("HubClientFailed", {
   team: Schema.Union([Schema.String, Schema.Number]),
   reason: Schema.String,
 }) {
   override get message() {
-    return `Convex.HubClient: the base of team ${this.team}: ${this.reason}.`;
+    return `Convex.HubClient: the hub of team ${this.team}: ${this.reason}.`;
   }
 }
 
@@ -80,26 +82,26 @@ const Registered = Schema.Struct({
   clientSecret: Schema.NonEmptyString,
 });
 
-/** Runs `use` with the function API of the base of `team`, with a key of this call only. */
-const withBase = <A, E, R>(
+/** Runs `use` with the function API of the hub of `team`, with a key of this call only. */
+const withHub = <A, E, R>(
   api: ManagementApiService,
   team: string | number,
   use: (functions: FunctionApi) => Effect.Effect<A, E, R>,
 ) =>
   Effect.gen(function* () {
     const teamId = yield* api.resolveTeamId(team);
-    const project = yield* findProjectByName(api, teamId, STORE_PROJECT_NAME);
+    const project = yield* findProjectByName(api, teamId, HUB_PROJECT_NAME);
     if (project === undefined) {
       return yield* new HubClientFailed({
         team,
-        reason: `no project ${STORE_PROJECT_NAME}, which holds the hub`,
+        reason: `no project ${HUB_PROJECT_NAME}, which holds the hub`,
       });
     }
     const deployment = yield* prodDeploymentOf(api, project.id);
     if (deployment === undefined) {
       return yield* new HubClientFailed({
         team,
-        reason: `project ${STORE_PROJECT_NAME} has no production deployment`,
+        reason: `project ${HUB_PROJECT_NAME} has no production deployment`,
       });
     }
     return yield* withPushKey(api, deployment.name, RUN_KEY_ACTIONS, (key) =>
@@ -128,7 +130,7 @@ const runHub = (
  * client on the hub, which signs nobody in.
  */
 export const registerHubClient = (api: ManagementApiService, props: HubClientProps) =>
-  withBase(api, props.team, (functions) =>
+  withHub(api, props.team, (functions) =>
     runHub(functions, props.team, "registerClient", {
       appId: props.app,
       redirectUri: props.redirectUri,
@@ -154,7 +156,7 @@ export const registerHubClient = (api: ManagementApiService, props: HubClientPro
   );
 
 const unregister = (api: ManagementApiService, team: string | number, clientId: string) =>
-  withBase(api, team, (functions) => runHub(functions, team, "deleteClient", { clientId }));
+  withHub(api, team, (functions) => runHub(functions, team, "deleteClient", { clientId }));
 
 /** True when the client in state serves the redirect URI and deployment type of `props`. */
 const registeredFor = (output: HubClientAttributes, props: HubClientProps) =>

package/src/State.ts

@@ -1,36 +1,33 @@
 // Alchemy state in Convex: `state: Convex.state({ team })` in `Alchemy.Stack`.
 //
-// One project for each Convex team, `samebase`, holds the state of
+// One project for each Convex team, `alchemy-state-store`, holds the state of
 // every stack and stage of the team in its production deployment: the
 // tables `resources (stack, stage, fqn, value)` and `outputs (stack, stage,
 // value)` of the alchemyState component (src/store/component), served by the
-// functions of src/store/functions.ts. Two apps serve them: the store app of
-// src/store/convex (a seed), which this provider pushes, and the base app of
-// the team (a base), which mounts the component next to its own components.
-// The store lives outside every resource that a stack manages, so a stack
-// can create and destroy its own project. See docs/design/convex-state.md.
+// functions of src/store/convex. The store lives
+// outside every resource that a stack manages, so a stack can create and
+// destroy its own project. See docs/design/convex-state.md.
 //
 // Bootstrap, on the first call of the run: the team token (CONVEX_ACCESS_TOKEN,
 // or the Convex CLI login) finds the project by name, or creates it; a deploy
 // key of its production deployment that can run internal queries and
 // mutations, and nothing else, is created for the run and deleted at its
-// end; the `state:version` query says the store version and the app that
-// serves it. Without one, or with an older seed, the installed Convex CLI
-// pushes src/store/convex to it, with a push key that is deleted after the
-// push. An older base fails the run: a push of the store app would erase the
-// base app. The raw state functions are internal; authenticated readers get
+// end; the `state:version` query says whether the deployment has the store
+// of this version. Without one, or with an older one, the installed Convex
+// CLI pushes src/store/convex to it, with a push key that is deleted after
+// the push. The raw state functions are internal; authenticated readers get
 // repository-scoped subscriptions with secret values removed. A key that stops working during a
 // long run (it expires after two hours) is replaced once per call.
 //
-// Two first runs of a team can both create a project named `samebase`.
+// Two first runs of a team can both create a project named `alchemy-state-store`.
 // The run whose project is not the oldest deletes its own, before it writes
 // anything, and uses the oldest: both runs end on one store.
 //
 // Samebase reads `stacks`, `getOutput`, `readStack`, and `reader:repository`
-// by name. STORE_VERSION is the wire contract: it rises only when a function
-// that a released client calls changes or goes away, and a client works only
-// with a store of its own version. An older seed is pushed over; an older base
-// and a newer store fail the run.
+// by name. The store and its readers are released and upgraded together:
+// STORE_VERSION rises with each change of a function, and a client works only
+// with a store of its own version. An older store is pushed over; a newer one
+// fails the run.
 //
 // The stage output that `setOutput` stores is the stack's output plus the
 // run record of src/RunRecord.ts under the key `samebase.run`: the
@@ -83,7 +80,7 @@ import { type RunRecord, runRecord, withRunRecord } from "./RunRecord.ts";
 import { STORE_VERSION } from "./store/convex/version.ts";
 
 /** The name of the state project in each team. */
-export const STORE_PROJECT_NAME = "samebase";
+export const STORE_PROJECT_NAME = "alchemy-state-store";
 
 /**
  * The actions of the key of one run: the internal queries and mutations of
@@ -244,39 +241,6 @@ const storeVersion = (api: FunctionApi) =>
       ),
     );
 
-/**
- * The app that serves the store. A store without `state:host` is a seed: it
- * was pushed before 0.14.0, and only the store app of this package served
- * those stores.
- */
-const storeHost = (api: FunctionApi) =>
-  api
-    .call("state:host", {})
-    .pipe(
-      Effect.flatMap((reply) =>
-        reply.status === "error" && MISSING_FUNCTION.test(reply.errorMessage)
-          ? Effect.succeed("seed" as const)
-          : valueOf(reply).pipe(
-              Effect.flatMap(decode(Schema.Literals(["seed", "base"]), "store host")),
-            ),
-      ),
-    );
-
-/**
- * The base app of the team serves an older store. Convex.state() never
- * pushes its store app over a base, because the push replaces every function
- * of the deployment and so erases the base app.
- */
-export class OutdatedBase extends Schema.TaggedError<OutdatedBase>()("OutdatedBase", {
-  team: Schema.Union([Schema.String, Schema.Number]),
-  deployment: Schema.String,
-  version: Schema.Number,
-}) {
-  override get message() {
-    return `The base of team ${this.team} (${this.deployment}) answers store version ${this.version}, and this package needs store version ${STORE_VERSION}. Convex.state does not push over a base. Upgrade the dependency @samebase/alchemy-convex of the base app to the version of this package, and push the base app.`;
-  }
-}
-
 /**
  * The functions directory of the store app, `src/store/convex` of this
  * package. This file is `src/State.ts` in a checkout and a chunk in `lib/`
@@ -288,7 +252,7 @@ export const storeDirectory = () =>
   join(dirname(fileURLToPath(import.meta.url)), "..", "src", "store", "convex");
 
 export interface StoreOptions {
-  /** Team slug or numeric team id of the `samebase` project, or undefined with a team access token, which names its team. */
+  /** Team slug or numeric team id of the `alchemy-state-store` project, or undefined with a team access token, which names its team. */
   readonly team: string | number | undefined;
   readonly api: ManagementApiService;
   readonly spawner: ChildProcessSpawner.ChildProcessSpawner["Service"];
@@ -365,9 +329,9 @@ const createStoreProject = (api: ManagementApiService, teamId: number, team: str
   });
 
 /**
- * The StateService over the `samebase` project of the team: found or
- * created, its store app pushed when the store is missing or an older seed,
- * and read and written with the keys of this run.
+ * The StateService over the `alchemy-state-store` project of the team: found or
+ * created, its store pushed when it is missing or older, and read and
+ * written with the keys of this run.
  */
 export const makeConvexState = (options: StoreOptions) =>
   Effect.gen(function* () {
@@ -415,38 +379,22 @@ export const makeConvexState = (options: StoreOptions) =>
         ),
     };
 
-    // The store app is pushed only over no store or an older seed. A base
-    // serves the same functions, and a push would erase the base app.
-    const needsPush = (found: number | undefined) =>
-      found === undefined
-        ? Effect.succeed(true)
-        : found < STORE_VERSION
-          ? storeHost(functions).pipe(Effect.map((host) => host === "seed"))
-          : Effect.succeed(false);
     let version = yield* storeVersion(functions);
-    if (yield* needsPush(version)) {
+    if (version === undefined || version < STORE_VERSION) {
       // Code without `state:version` is another app with the name of the store.
       if (version === undefined && deployment.lastDeployTime) {
         return yield* failure(
           `project ${STORE_PROJECT_NAME} (${project.id}) of team ${team} has code that is not the state store, and Convex.state does not push over it. Rename that project in the Convex dashboard.`,
         );
       }
-      // Another run can push a newer store, or the base app, in the meantime:
-      // read again right before the push. The push itself has no lock (see
-      // the design note).
+      // Another run can push a newer store in the meantime: read again right
+      // before the push. The push itself has no lock (see the design note).
       version = yield* storeVersion(functions);
-      if (yield* needsPush(version)) {
+      if (version === undefined || version < STORE_VERSION) {
         yield* pushStore(options, deployment);
         version = yield* storeVersion(functions);
       }
     }
-    if (
-      version !== undefined &&
-      version < STORE_VERSION &&
-      (yield* storeHost(functions)) === "base"
-    ) {
-      return yield* new OutdatedBase({ team, deployment: deployment.name, version });
-    }
     if (version !== STORE_VERSION) {
       return yield* failure(
         `${deployment.name} answers store version ${version ?? "none"}, and this package needs store version ${STORE_VERSION}.`,
@@ -493,12 +441,11 @@ export const makeConvexState = (options: StoreOptions) =>
   });
 
 /**
- * Alchemy state in the `samebase` project of `team`, with the team token
+ * Alchemy state in the `alchemy-state-store` project of `team`, with the team token
  * in CONVEX_ACCESS_TOKEN or the Convex CLI login. A team access token names
  * its team, so `team` is optional with one; the Convex CLI login needs the
  * slug or the id. The first use of the run finds or creates the project and
- * pushes the store app when the store is missing or an older seed. An older
- * base fails the run with {@link OutdatedBase}. `alchemy plan` on another
+ * pushes the store when it is missing or older. `alchemy plan` on another
  * stack never touches Convex.
  */
 export const state = (

package/src/index.ts

@@ -19,6 +19,7 @@ export {
   ProductionDeploymentNotFound,
 } from "./Deployment.ts";
 export {
+  HUB_PROJECT_NAME,
   HubClient,
   type HubClientAttributes,
   HubClientFailed,
@@ -45,7 +46,7 @@ export {
   runRecord,
   withRunRecord,
 } from "./RunRecord.ts";
-export { OutdatedBase, state, STORE_PROJECT_NAME } from "./State.ts";
+export { state, STORE_PROJECT_NAME } from "./State.ts";
 export {
   CodePushFailed,
   ConvexAppNotFound,

package/src/store/component/reader.ts

@@ -3,7 +3,7 @@
 // `ctx.auth`.
 import { v, type Infer } from "convex/values";
 import { query } from "./_generated/server.js";
-import { runRecord, validate } from "./runRecord.js";
+import { runRecord, validate } from "./runRecord.ts";
 
 const stage = v.object({
   name: v.string(),

package/src/store/component/schema.ts

@@ -1,6 +1,6 @@
 import { defineSchema, defineTable } from "convex/server";
 import { v } from "convex/values";
-import { runRecord } from "./runRecord.js";
+import { runRecord } from "./runRecord.ts";
 
 // `value` is the JSON text of Alchemy's encodeState(...): the same text that
 // Alchemy's local state writes to a file. A Convex object would reject keys

package/src/store/component/state.ts

@@ -8,7 +8,7 @@
 import { v, type Infer } from "convex/values";
 import type { MutationCtx, QueryCtx } from "./_generated/server.js";
 import { mutation, query } from "./_generated/server.js";
-import { runRecord } from "./runRecord.js";
+import { runRecord } from "./runRecord.ts";
 
 const stage = { stack: v.string(), stage: v.string() };
 const resource = { ...stage, fqn: v.string() };

package/src/store/convex/auth.config.ts

@@ -1,4 +1,14 @@
-import { authConfig } from "../authConfig.js";
+import type { AuthConfig } from "convex/server";
 import { env } from "./_generated/server.js";
 
-export default authConfig(env.CONVEX_CLOUD_URL);
+export default {
+  providers: [
+    {
+      type: "customJwt",
+      issuer: env.CONVEX_CLOUD_URL,
+      applicationID: `${env.CONVEX_CLOUD_URL}/alchemy-reader`,
+      jwks: `${env.CONVEX_CLOUD_URL}/.well-known/jwks.json`,
+      algorithm: "ES256",
+    },
+  ],
+} satisfies AuthConfig;

package/src/store/convex/convex.config.ts

@@ -1,5 +1,5 @@
 import { defineApp } from "convex/server";
-import alchemyState from "../component/convex.config.js";
+import alchemyState from "../component/convex.config.ts";
 
 const app = defineApp();
 app.use(alchemyState);

package/src/store/convex/reader.ts

@@ -1,5 +1,51 @@
-// The authenticated, redacted reads of the store app, from src/store/functions.ts.
-import { readerFunctions } from "../functions.js";
+// Authenticated reads stay in the app: `authorize` signs and `repository`
+// verifies with `ctx.auth`, which a component does not have. The rows and the
+// redaction are in the alchemyState component.
+import { v } from "convex/values";
+import { repositoryReply } from "../component/reader.ts";
 import { components } from "./_generated/api.js";
+import { env, internalMutation, query } from "./_generated/server.js";
 
-export const { authorize, repository } = readerFunctions(components.alchemyState);
+const repositoryName = /^[^/]+\/[^/]+$/;
+
+/** Only a deployment credential can exchange an approved repository for a read token. */
+export const authorize = internalMutation({
+  args: { repository: v.string(), subject: v.string() },
+  returns: v.object({ token: v.string() }),
+  handler: async (ctx, args) => {
+    if (!repositoryName.test(args.repository) || args.subject === "") {
+      throw new Error("A repository and subject are required.");
+    }
+    return {
+      token: await ctx.auth.signJwt({
+        expiresInSeconds: 300,
+        claims: {
+          sub: args.subject,
+          aud: `${env.CONVEX_CLOUD_URL}/alchemy-reader`,
+          repository: args.repository,
+          scope: "alchemy:read",
+        },
+      }),
+    };
+  },
+});
+
+/** A native subscription reads only the repository named in its verified capability. */
+export const repository = query({
+  args: {},
+  returns: repositoryReply,
+  handler: async (ctx) => {
+    const identity = await ctx.auth.getUserIdentity();
+    if (
+      identity === null ||
+      identity.scope !== "alchemy:read" ||
+      typeof identity.repository !== "string" ||
+      !repositoryName.test(identity.repository)
+    ) {
+      throw new Error("Alchemy repository read access is required.");
+    }
+    return await ctx.runQuery(components.alchemyState.reader.repository, {
+      repository: identity.repository,
+    });
+  },
+});