@samebase/alchemy-convex 0.5.0 → 0.6.1

package/lib/index.js

@@ -25,7 +25,9 @@ import { hashDirectory } from "alchemy/Command/Memo";
 import * as Clock from "effect/Clock";
 import * as ChildProcess from "effect/process/ChildProcess";
 import * as Stream from "effect/Stream";
-import { InMemoryService, STATE_STORE_VERSION, State, StateStoreError, encodeState, reviveState } from "alchemy/State";
+import { fileURLToPath } from "node:url";
+import * as Scope from "effect/Scope";
+import { STATE_STORE_VERSION, State, StateStoreError, encodeState, reviveState } from "alchemy/State";
 //#region src/Credentials.ts
 var Credentials = class extends Context.Service()("@samebase/alchemy-convex/Credentials") {};
 /** Environment variable for the access token, read by {@link fromConfig}. */
@@ -167,15 +169,54 @@ const TeamRow = Schema.Struct({
 	slug: Schema.String
 });
 const TeamRows = Schema.Array(TeamRow);
+/** The first page of GET /teams/{team_id}/projects: every row carries the slug of the team. */
+const ProjectSlugRows = Schema.Struct({ items: Schema.Array(Schema.Struct({ teamSlug: Schema.String })) });
+/** GET /token_details: the team of a team token, or the project of a project token. */
+const TokenDetails = Schema.Union([Schema.Struct({
+	type: Schema.Literal("teamToken"),
+	teamId: Schema.Number
+}), Schema.Struct({
+	type: Schema.Literal("projectToken"),
+	projectId: Schema.Number
+})]);
 /** The service for one way to get the bearer token. */
 const makeService = (credentials) => {
 	const client = Effect.cached(credentials.pipe(Effect.map((resolved) => createManagementClient(Redacted.value(resolved.accessToken))))).pipe(Effect.flatten);
 	const request = (operation, run) => client.pipe(Effect.flatMap((c) => settle(operation, () => run(c))));
 	const requestVoid = (operation, run) => client.pipe(Effect.flatMap((c) => settleVoid(operation, () => run(c))));
 	const deploymentRequest = (operation, deploymentUrlOrName, deployKey, run) => settle(operation, () => run(createDeploymentClient(deploymentUrlOrName, Redacted.value(deployKey))));
+	const tokenDetails = Effect.runSync(Effect.cached(request("get token details", (c) => c.GET("/token_details")).pipe(Effect.map((body) => Schema.decodeUnknownSync(TokenDetails)(body)), Effect.catchIf((error) => error.status === 403, () => Effect.succeed(void 0)))));
+	/** The slug of the team, from the first project of its listing, or undefined for a team without one. Read once. */
+	const teamSlug = (teamId) => request("list projects", (c) => c.GET("/teams/{team_id}/projects", { params: { path: { team_id: teamId } } })).pipe(Effect.map((body) => Schema.decodeUnknownSync(ProjectSlugRows)(body).items[0]?.teamSlug));
 	const resolveTeamId = (team) => Effect.gen(function* () {
 		if (typeof team === "number") return team;
-		if (/^\d+$/.test(team)) return Number(team);
+		if (team !== void 0 && /^\d+$/.test(team)) return Number(team);
+		const details = yield* tokenDetails;
+		if (details?.type === "teamToken") {
+			if (team === void 0) return details.teamId;
+			const slug = yield* teamSlug(details.teamId);
+			if (slug === void 0) return yield* new ConvexApiError({
+				operation: "resolve team",
+				status: 0,
+				message: `team "${team}" cannot be checked against the access token: team ${details.teamId} has no project yet. Set team to ${details.teamId}, or leave it out.`
+			});
+			if (slug !== team) return yield* new ConvexApiError({
+				operation: "resolve team",
+				status: 403,
+				message: `the access token belongs to team ${details.teamId} ("${slug}"), and team is "${team}". Use a token of "${team}", or set team to ${details.teamId}.`
+			});
+			return details.teamId;
+		}
+		if (details?.type === "projectToken") return yield* new ConvexApiError({
+			operation: "resolve team",
+			status: 403,
+			message: `the access token belongs to project ${details.projectId}, and a project token cannot create projects. Use a team access token.`
+		});
+		if (team === void 0) return yield* new ConvexApiError({
+			operation: "resolve team",
+			status: 0,
+			message: "set team to the slug or the id of the Convex team: this access token does not name a team."
+		});
 		const resolved = yield* credentials;
 		const match = (yield* Effect.tryPromise({
 			try: async () => {
@@ -227,7 +268,7 @@ const sourceOf = (source) => typeof source === "string" ? {
 };
 /** Lifetime of a push key. Long enough for a slow push with index backfills. */
 const PUSH_KEY_LIFETIME_MS = 72e5;
-/** The only actions a push key gets. */
+/** The only actions a key for `convex deploy` gets. */
 const PUSH_KEY_ACTIONS = [
 	"deployment:deploy",
 	"deployment:env:view",
@@ -329,7 +370,7 @@ const parseDeployOutput = (text) => {
 };
 /** The last non-empty lines of `text`, without escape codes and with every secret replaced. */
 const outputTail = (text, secrets) => secrets.reduce((redacted, secret) => redacted.split(secret).join("[REDACTED]"), stripVTControlCharacters(text)).split(/\r?\n|\r/).filter((line) => line.trim() !== "").slice(-20).join("\n");
-const valueOf = (value) => Redacted.isRedacted(value) ? Redacted.value(value) : value;
+const valueOf$1 = (value) => Redacted.isRedacted(value) ? Redacted.value(value) : value;
 /** The app directory: the nearest directory at or above the parent of `source` with a package.json. */
 const appDirectoryOf = (source) => Effect.tryPromise({
 	try: async () => {
@@ -397,7 +438,7 @@ const pushHash = (options) => Effect.gen(function* () {
 			lockfile: true
 		}
 	})));
-	const env = Object.entries(options.env).map(([name, value]) => [name, valueOf(value)]).sort(([a], [b]) => a < b ? -1 : 1);
+	const env = Object.entries(options.env).map(([name, value]) => [name, valueOf$1(value)]).sort(([a], [b]) => a < b ? -1 : 1);
 	return createHash("sha256").update(JSON.stringify({
 		files,
 		deployment: options.deployment,
@@ -424,29 +465,41 @@ const cliEnvironment = (home) => ({
 	XDG_CONFIG_HOME: home
 });
 /**
-* Creates a deploy key for one push, runs `use` with it, and deletes it
-* afterwards. Without a push command, the key can only deploy and read and
-* write variables. The delete is skipped for a key that is the OAuth credential.
-* A failed delete is logged: the key expires anyway.
+* A deploy key of `deployment` that expires after PUSH_KEY_LIFETIME_MS, with
+* only `allowedActions`, or every action when that is undefined. Delete it
+* with {@link deleteDeployKey} when the work is done.
 */
-const withPushKey = (api, deployment, source, use) => Effect.acquireUseRelease(Effect.gen(function* () {
+const createDeployKey = (api, deployment, name, allowedActions) => Effect.gen(function* () {
 	const now = yield* Clock.currentTimeMillis;
 	const created = yield* api.request("create deploy key", (client) => client.POST("/deployments/{deployment_name}/create_deploy_key", {
 		params: { path: { deployment_name: deployment } },
 		body: {
-			name: "alchemy-push",
-			...source === void 0 || sourceOf(source).command === void 0 ? { allowedActions: [...PUSH_KEY_ACTIONS] } : {},
+			name,
+			...allowedActions === void 0 ? {} : { allowedActions: [...allowedActions] },
 			expiresAt: now + PUSH_KEY_LIFETIME_MS
 		}
 	}));
 	return Redacted.make(Schema.decodeUnknownSync(CreatedDeployKey)(created).deployKey);
-}), use, (key) => Effect.gen(function* () {
+});
+/**
+* Deletes a key that {@link createDeployKey} made. The delete is skipped for
+* a key that is the OAuth credential. A failed delete is logged: the key
+* expires anyway.
+*/
+const deleteDeployKey = (api, deployment, key) => Effect.gen(function* () {
 	if (yield* api.isCredentialToken(Redacted.value(key))) return;
 	yield* absentAsUndefined(retryIdempotentWrite(api.requestVoid("delete deploy key", (client) => client.POST("/deployments/{deployment_name}/delete_deploy_key", {
 		params: { path: { deployment_name: deployment } },
 		body: { id: Redacted.value(key) }
 	}))));
-}).pipe(Effect.catch((error) => Effect.logWarning(`Convex.Deployment could not delete its push key on ${deployment} (${error.message}). The key expires on its own within ${PUSH_KEY_LIFETIME_MS / 6e4} minutes.`))));
+}).pipe(Effect.catch((error) => Effect.logWarning(`Convex.Deployment could not delete its key on ${deployment} (${error.message}). The key expires on its own within ${PUSH_KEY_LIFETIME_MS / 6e4} minutes.`)));
+/**
+* Creates a deploy key for one push, runs `use` with it, and deletes it
+* afterwards, also after a failure. `allowedActions` is PUSH_KEY_ACTIONS for
+* `convex deploy`, or undefined for a push command, which can do more than a
+* push, such as the uploads of convex-hosting through `convex run`.
+*/
+const withPushKey = (api, deployment, allowedActions, use) => Effect.acquireUseRelease(createDeployKey(api, deployment, "alchemy-push", allowedActions), use, (key) => deleteDeployKey(api, deployment, key));
 /** Every variable of the deployment with its value. */
 const listVariables = (url, key) => settle("list environment variables", () => createDeploymentClient(url, Redacted.value(key)).GET("/list_environment_variables")).pipe(Effect.map((body) => Schema.decodeUnknownSync(EnvironmentVariableList)(body).environmentVariables));
 /** One call that sets variables, or removes those whose value is null. */
@@ -487,15 +540,15 @@ const push = (spawner, key, options) => Effect.gen(function* () {
 	} : yield* retryIdempotentWrite(Effect.gen(function* () {
 		const current = yield* listVariables(options.url, key);
 		if (!options.adopt) {
-			const taken = env.filter(([name, value]) => !options.previousEnvNames.includes(name) && Object.hasOwn(current, name) && current[name] !== valueOf(value)).map(([name]) => name);
+			const taken = env.filter(([name, value]) => !options.previousEnvNames.includes(name) && Object.hasOwn(current, name) && current[name] !== valueOf$1(value)).map(([name]) => name);
 			if (taken.length > 0) return yield* new VariablesOwnedBySomeoneElse({
 				deployment: options.deployment,
 				names: taken
 			});
 		}
-		const changes = [...env.filter(([name, value]) => current[name] !== valueOf(value)).map(([name, value]) => ({
+		const changes = [...env.filter(([name, value]) => current[name] !== valueOf$1(value)).map(([name, value]) => ({
 			name,
-			value: valueOf(value)
+			value: valueOf$1(value)
 		})), ...removed.filter((name) => Object.hasOwn(current, name)).map((name) => ({
 			name,
 			value: null
@@ -934,7 +987,7 @@ const DeploymentProvider = () => Provider.effect(Deployment, Effect.gen(function
 			}) : access.kind === "previewKey" ? push(spawner, access.key, {
 				...options,
 				previewName: target.previewName
-			}) : withPushKey(access.api, target.name, news.source, (key) => push(spawner, key, {
+			}) : withPushKey(access.api, target.name, typeof news.source === "object" && news.source.command !== void 0 ? void 0 : PUSH_KEY_ACTIONS, (key) => push(spawner, key, {
 				...options,
 				previewName: void 0
 			}))).pipe(Effect.onError(() => created && access.kind !== "deployKey" ? absentAsUndefined(retryIdempotentWrite(access.api.requestVoid("delete deployment", (client) => client.POST("/deployments/{deployment_name}/delete", { params: { path: { deployment_name: target.name } } })))).pipe(Effect.catch((error) => Effect.logWarning(`Convex.Deployment could not delete ${target.name} after the failed push (${error.message}). The next run takes it over only with --adopt.`))) : Effect.void));
@@ -1042,7 +1095,9 @@ const DeploymentRow = Schema.Struct({
 	name: Schema.String,
 	deploymentType: Schema.String,
 	isDefault: Schema.Boolean,
-	deploymentUrl: Schema.String
+	deploymentUrl: Schema.String,
+	/** Absent or null until the first push. */
+	lastDeployTime: Schema.optionalKey(Schema.NullOr(Schema.Number))
 });
 const DeploymentRows = Schema.Array(DeploymentRow);
 /**
@@ -1068,10 +1123,71 @@ const checkCreateTimeProps = (projectId, olds, news) => {
 };
 /** True when `team`, a slug or a numeric id, names the team of the project. */
 const isTeamOf = (details, team) => typeof team === "number" || /^\d+$/.test(team) ? details.teamId === Number(team) : details.teamSlug === team;
+/** The row of the project's default production deployment, or undefined. */
+const prodDeploymentOf = (api, projectId) => api.request("list deployments", (client) => client.GET("/projects/{project_id}/list_deployments", { params: { path: { project_id: projectId } } })).pipe(Effect.map((rows) => Schema.decodeUnknownSync(DeploymentRows)(rows).find((row) => row.deploymentType === "prod" && row.isDefault)));
+/** GET /projects/{id}, or undefined after a 404. */
+const getProjectById = (api, projectId) => absentAsUndefined(api.request("get project", (client) => client.GET("/projects/{project_id}", { params: { path: { project_id: projectId } } }))).pipe(Effect.map((body) => body === void 0 ? void 0 : Schema.decodeUnknownSync(ProjectDetails)(body)));
+/**
+* Every project in the team with exactly this name, in the order of the
+* listing. Reads every page. `q` narrows the listing on the server, and the
+* exact match here decides. Pattern from Confect
+* `packages/alchemy/src/ConvexClient.ts` and `Project.ts`
+* (https://github.com/rjdellecese/confect, ISC license).
+*/
+const listProjectsByName = (api, teamId, name) => Effect.gen(function* () {
+	const matches = [];
+	const seenCursors = /* @__PURE__ */ new Set();
+	let cursor;
+	while (true) {
+		const body = yield* api.request("list projects", (client) => client.GET("/teams/{team_id}/projects", { params: {
+			path: { team_id: teamId },
+			query: {
+				q: name,
+				...cursor === void 0 ? {} : { cursor }
+			}
+		} }));
+		const page = Schema.decodeUnknownSync(ProjectPage)(body);
+		matches.push(...page.items.filter((row) => row.name === name));
+		if (!page.pagination.hasMore) break;
+		const next = page.pagination.nextCursor;
+		if (next === void 0 || next === null || seenCursors.has(next)) return yield* new ConvexApiError({
+			operation: "list projects",
+			status: 0,
+			code: "InvalidPagination",
+			message: `The project listing of team ${teamId} reports more pages but gives no new cursor. Convex.Project stops so that it does not miss a project named "${name}".`
+		});
+		seenCursors.add(next);
+		cursor = next;
+	}
+	return matches;
+});
+/** The one project in the team with exactly this name, or undefined. More than one is an error. */
+const findProjectByName = (api, teamId, name) => listProjectsByName(api, teamId, name).pipe(Effect.flatMap((matches) => matches.length > 1 ? new AmbiguousProject({
+	teamId,
+	name,
+	projectIds: matches.map((row) => row.id)
+}) : Effect.succeed(matches[0])));
+/**
+* POST /teams/{team_id}/create_project, then GET /projects/{id}. The identity
+* comes from the create response, never from a name lookup.
+*/
+const createProject = (api, teamId, props) => Effect.gen(function* () {
+	const created = yield* api.request("create project", (client) => client.POST("/teams/{team_id}/create_project", {
+		params: { path: { team_id: teamId } },
+		body: {
+			projectName: props.name,
+			deploymentType: props.deploymentType,
+			...props.deploymentRegion === void 0 ? {} : { deploymentRegion: props.deploymentRegion }
+		}
+	}));
+	const { projectId } = Schema.decodeUnknownSync(CreatedProject)(created);
+	const details = yield* getProjectById(api, projectId);
+	if (details === void 0) return yield* new CreatedProjectNotFound({ projectId });
+	return details;
+});
 const ProjectProvider = () => Provider.effect(Project, Effect.gen(function* () {
 	const api = yield* ManagementApi;
-	const prodDeployment = (projectId) => api.request("list deployments", (client) => client.GET("/projects/{project_id}/list_deployments", { params: { path: { project_id: projectId } } })).pipe(Effect.map((rows) => Schema.decodeUnknownSync(DeploymentRows)(rows).find((row) => row.deploymentType === "prod" && row.isDefault)));
-	const attributesOf = (details) => prodDeployment(details.id).pipe(Effect.map((prod) => ({
+	const attributesOf = (details) => prodDeploymentOf(api, details.id).pipe(Effect.map((prod) => ({
 		projectId: details.id,
 		slug: details.slug,
 		name: details.name,
@@ -1079,51 +1195,13 @@ const ProjectProvider = () => Provider.effect(Project, Effect.gen(function* () {
 		prodDeploymentName: prod?.name ?? details.prodDeploymentName ?? void 0,
 		prodDeploymentUrl: prod?.deploymentUrl
 	})));
-	const getById = (projectId) => absentAsUndefined(api.request("get project", (client) => client.GET("/projects/{project_id}", { params: { path: { project_id: projectId } } }))).pipe(Effect.map((body) => body === void 0 ? void 0 : Schema.decodeUnknownSync(ProjectDetails)(body)));
+	const getById = (projectId) => getProjectById(api, projectId);
 	/** The project with this slug in the team, or undefined. Official endpoint; the team can be a slug. */
 	const getBySlug = (team, slug) => absentAsUndefined(api.request("get project by slug", (client) => client.GET("/teams/{team_id_or_slug}/projects/{project_slug}", { params: { path: {
 		team_id_or_slug: String(team),
 		project_slug: slug
 	} } }))).pipe(Effect.map((body) => body === void 0 ? void 0 : Schema.decodeUnknownSync(ProjectDetails)(body)));
-	/**
-	* The one project in the team with exactly this name, or undefined.
-	* Reads every page. `q` narrows the listing on the server, and the
-	* exact match here decides. Pattern from Confect
-	* `packages/alchemy/src/ConvexClient.ts` and `Project.ts`
-	* (https://github.com/rjdellecese/confect, ISC license).
-	*/
-	const findByName = (teamId, name) => Effect.gen(function* () {
-		const matches = [];
-		const seenCursors = /* @__PURE__ */ new Set();
-		let cursor;
-		while (true) {
-			const body = yield* api.request("list projects", (client) => client.GET("/teams/{team_id}/projects", { params: {
-				path: { team_id: teamId },
-				query: {
-					q: name,
-					...cursor === void 0 ? {} : { cursor }
-				}
-			} }));
-			const page = Schema.decodeUnknownSync(ProjectPage)(body);
-			matches.push(...page.items.filter((row) => row.name === name));
-			if (!page.pagination.hasMore) break;
-			const next = page.pagination.nextCursor;
-			if (next === void 0 || next === null || seenCursors.has(next)) return yield* new ConvexApiError({
-				operation: "list projects",
-				status: 0,
-				code: "InvalidPagination",
-				message: `The project listing of team ${teamId} reports more pages but gives no new cursor. Convex.Project stops so that it does not miss a project named "${name}".`
-			});
-			seenCursors.add(next);
-			cursor = next;
-		}
-		if (matches.length > 1) return yield* new AmbiguousProject({
-			teamId,
-			name,
-			projectIds: matches.map((row) => row.id)
-		});
-		return matches[0];
-	});
+	const findByName = (teamId, name) => findProjectByName(api, teamId, name);
 	/**
 	* Brings an existing project to the desired name. The team cannot
 	* change, so a project in another team fails.
@@ -1229,17 +1307,11 @@ const ProjectProvider = () => Provider.effect(Project, Effect.gen(function* () {
 					return yield* converge(existing, teamId, news.name);
 				}
 			}
-			const created = yield* api.request("create project", (client) => client.POST("/teams/{team_id}/create_project", {
-				params: { path: { team_id: teamId } },
-				body: {
-					projectName: news.name,
-					deploymentType: news.deploymentType ?? "prod",
-					...news.deploymentRegion === void 0 ? {} : { deploymentRegion: news.deploymentRegion }
-				}
-			}));
-			const { projectId } = Schema.decodeUnknownSync(CreatedProject)(created);
-			const details = yield* getById(projectId);
-			if (details === void 0) return yield* new CreatedProjectNotFound({ projectId });
+			const details = yield* createProject(api, teamId, {
+				name: news.name,
+				deploymentType: news.deploymentType ?? "prod",
+				deploymentRegion: news.deploymentRegion
+			});
 			return yield* converge(details, teamId, news.name);
 		}),
 		delete: Effect.fn(function* ({ output }) {
@@ -1258,11 +1330,15 @@ var Providers = class extends Provider.ProviderCollection()("Convex") {};
 const providers = (credentials = fromConfig()) => Layer.effect(Providers, Provider.collection([Project, Deployment])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), DeploymentProvider())), Layer.provide(ManagementApiLive()), Layer.provide(credentials), Layer.orDie);
 //#endregion
 //#region src/State.ts
-/** Environment variable with the deploy key of the deployment that holds the state. */
-const STATE_DEPLOY_KEY_ENV = "CONVEX_STATE_DEPLOY_KEY";
-/** The component path of alchemyState in the app: its default name. */
-const COMPONENT_PATH = "alchemyState";
-/** The body of POST /api/function and /api/query, with HTTP 200 or 560 for a function error. */
+/** The name of the state project in each team. */
+const STORE_PROJECT_NAME = "alchemy-state";
+/**
+* The actions of the key of one run: the internal queries and mutations of
+* the store, nothing else. Measured: `deployment:data:view` and
+* `deployment:data:write` do not run an internal function.
+*/
+const RUN_KEY_ACTIONS = ["deployment:functions:runInternalQueries", "deployment:functions:runInternalMutations"];
+/** The body of POST /api/function, with HTTP 200 for a function error too. */
 const Reply = Schema.Union([Schema.Struct({
 	status: Schema.Literal("success"),
 	value: Schema.Unknown
@@ -1270,11 +1346,10 @@ const Reply = Schema.Union([Schema.Struct({
 	status: Schema.Literal("error"),
 	errorMessage: Schema.String
 })]);
-/** The value of `_system/frontend/components:list`: the root has path "", a removed mount is "unmounted". */
-const Components = Schema.Array(Schema.Struct({
-	path: Schema.String,
-	state: Schema.String
-}));
+/** The error reply of /api/function for a function that the deployment does not have (recorded). */
+const MISSING_FUNCTION = /Could not find function for '/;
+/** HTTP 401 or 403 from the function API: the key is gone or expired (recorded: 403 without a key). */
+const isUnauthorized = (error) => error.http?.status === 401 || error.http?.status === 403;
 const failure = (message) => new StateStoreError({ message: `Convex state: ${message}` });
 /** No reply, HTTP 429, or HTTP 5xx: a new attempt can succeed. Every call of the store is idempotent. */
 const isTransient = (error) => error.http !== void 0 && (error.http.status === void 0 || error.http.status === 429 || error.http.status >= 500);
@@ -1303,22 +1378,16 @@ const post = (url, headers, body) => Effect.tryPromise({
 	times: 5
 }));
 const decode = (schema, what) => (value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(() => failure(`bad ${what}`)));
-/**
-* The deployment URL of a deploy key. The Convex CLI makes the same unofficial
-* call for every deploy key (convex 1.46 `cli/lib/deploymentSelection.js`).
-*/
-const urlForKey = (key) => post("https://api.convex.dev/api/deployment/url_for_key", {}, { deployKey: Redacted.value(key) }).pipe(Effect.flatMap(decode(Schema.String, "deployment URL")));
-const makeFunctionApi = (url, key) => ({ call: (path, args, componentPath) => post(`${url}/api/${componentPath === void 0 ? "query" : "function"}`, { Authorization: `Convex ${Redacted.value(key)}` }, {
-	...componentPath === void 0 ? {} : { componentPath },
+const makeFunctionApi = (url, key) => ({ call: (path, args) => post(`${url}/api/function`, { Authorization: `Convex ${Redacted.value(key)}` }, {
 	path,
 	args,
 	format: "json"
-}).pipe(Effect.flatMap(decode(Reply, `reply of ${path}`)), Effect.flatMap((reply) => reply.status === "success" ? Effect.succeed(reply.value) : Effect.fail(failure(reply.errorMessage.trim())))) });
-/** The state of the alchemyState mount: "active", "unmounted" (its rows are kept), or undefined. */
-const mountOf = (api) => api.call("_system/frontend/components:list", {}).pipe(Effect.flatMap(decode(Components, "component list")), Effect.map((components) => components.find((c) => c.path === COMPONENT_PATH)?.state));
-/** The component functions with Alchemy's encoding: the JSON text of encodeState. */
+}).pipe(Effect.flatMap(decode(Reply, `reply of ${path}`))) });
+/** The value of a reply, or the Convex message, which names the function and the cause, such as a missing key action. */
+const valueOf = (reply) => reply.status === "success" ? Effect.succeed(reply.value) : Effect.fail(failure(reply.errorMessage.trim()));
+/** The functions of the store with Alchemy's encoding: the JSON text of encodeState. */
 const remoteOf = (api) => {
-	const run = (name, args) => api.call(`state:${name}`, args, COMPONENT_PATH);
+	const run = (name, args) => api.call(`state:${name}`, args).pipe(Effect.flatMap(valueOf));
 	const strings = (name, args) => run(name, args).pipe(Effect.flatMap(decode(Schema.Array(Schema.String), name)));
 	const optional = (name, args) => run(name, args).pipe(Effect.flatMap(decode(Schema.NullOr(Schema.String), name)));
 	const encode = (value) => JSON.stringify(encodeState(value));
@@ -1364,84 +1433,134 @@ const remoteOf = (api) => {
 		})
 	};
 };
-const unmounted = failure(`the ${COMPONENT_PATH} component of the deployment is unmounted. Its rows are kept: mount @samebase/alchemy-convex/convex.config in convex/convex.config.ts again.`);
+/** The version that the store answers, or undefined when the deployment has no `state:version`. */
+const storeVersion = (api) => api.call("state:version", {}).pipe(Effect.flatMap((reply) => reply.status === "error" && MISSING_FUNCTION.test(reply.errorMessage) ? Effect.succeed(void 0) : valueOf(reply).pipe(Effect.flatMap(decode(Schema.Number, "store version")))));
 /**
-* The StateService over `api`. Without an alchemyState component at
-* the start, the state of the run stays in memory until a write finds the
-* component active.
+* The functions directory of the store app, `src/store/convex` of this
+* package. This file is `src/State.ts` in a checkout and a chunk in `lib/`
+* in the installed package, which ships `src` too, so the directory is
+* `../src/store/convex` from either place.
 */
-const makeConvexState = (api) => Effect.gen(function* () {
-	const remote = remoteOf(api);
-	const mount = yield* mountOf(api);
-	if (mount === "unmounted") return yield* unmounted;
-	let pending = mount === void 0;
-	const rows = {};
-	const outputs = {};
-	const memory = yield* InMemoryService(rows, outputs);
-	/** Moves the memory to the component once it is active. Rows that the run did not read stop it. */
-	const flush = Effect.gen(function* () {
-		const now = yield* mountOf(api);
-		if (now === void 0) return;
-		if (now !== "active") return yield* unmounted;
-		const stages = [.../* @__PURE__ */ new Set([...Object.keys(rows), ...Object.keys(outputs)])].flatMap((stack) => [.../* @__PURE__ */ new Set([...Object.keys(rows[stack] ?? {}), ...Object.keys(outputs[stack] ?? {})])].map((stage) => ({
-			stack,
-			stage
-		})));
-		for (const { stack, stage } of stages) {
-			const found = yield* remote.list({
-				stack,
-				stage
-			});
-			if (found.length > 0) return yield* failure(`${stack}/${stage} has ${found.length} rows in the deployment that this run did not read, so the run wrote none. Run it again.`);
-		}
-		for (const { stack, stage } of stages) {
-			for (const [fqn, value] of Object.entries(rows[stack]?.[stage] ?? {})) yield* remote.set({
-				stack,
-				stage,
-				fqn,
-				value
-			});
-			const byStage = outputs[stack];
-			if (byStage !== void 0 && stage in byStage) yield* remote.setOutput({
-				stack,
-				stage,
-				value: byStage[stage]
-			});
-		}
-		pending = false;
+const storeDirectory = () => join(dirname(fileURLToPath(import.meta.url)), "..", "src", "store", "convex");
+/**
+* Pushes `store` to the production deployment of the state project with the
+* installed Convex CLI: no typecheck, no codegen, the key only in the
+* environment of the CLI.
+*/
+const pushStore = (options, deployment) => Effect.gen(function* () {
+	const cli = yield* installedCli(join(options.store, ".."));
+	yield* Effect.logInfo(`Convex state: pushing the store version 1 to ${deployment.name}`);
+	yield* withPushKey(options.api, deployment.name, PUSH_KEY_ACTIONS, (key) => push(options.spawner, key, {
+		deployment: deployment.name,
+		url: deployment.deploymentUrl,
+		source: {
+			path: options.store,
+			command: [
+				...cli,
+				"deploy",
+				"--typecheck",
+				"disable",
+				"--codegen",
+				"disable"
+			]
+		},
+		env: {},
+		previousEnvNames: [],
+		adopt: false,
+		previewName: void 0
+	}));
+});
+/**
+* Creates the state project of the team. Two first runs can both create one:
+* the run whose project is not the oldest deletes its own, which holds
+* nothing yet, and uses the oldest, so that every run ends on one store.
+*/
+const createStoreProject = (api, teamId, team) => Effect.gen(function* () {
+	yield* Effect.logInfo(`Convex state: creating the project ${STORE_PROJECT_NAME} in team ${team}`);
+	const created = yield* createProject(api, teamId, {
+		name: STORE_PROJECT_NAME,
+		deploymentType: "prod",
+		deploymentRegion: void 0
 	});
-	const read = (inMemory, inConvex) => Effect.suspend(() => pending ? inMemory : inConvex);
-	const write = (inMemory, inConvex, result) => Effect.suspend(() => pending ? Effect.tap(inMemory, () => flush) : Effect.as(inConvex, result));
+	const oldest = (yield* listProjectsByName(api, teamId, STORE_PROJECT_NAME)).reduce((a, b) => b.id < a.id ? b : a, created);
+	if (oldest.id === created.id) return created;
+	yield* Effect.logInfo(`Convex state: another run created ${STORE_PROJECT_NAME} ${oldest.id} first; project ${created.id} is deleted again.`);
+	yield* absentAsUndefined(retryIdempotentWrite(api.requestVoid("delete project", (client) => client.POST("/projects/{project_id}/delete", { params: { path: { project_id: created.id } } }))));
+	return oldest;
+});
+/**
+* The StateService over the `alchemy-state` project of the team: found or
+* created, its store pushed when it is missing or older, and read and
+* written with the keys of this run.
+*/
+const makeConvexState = (options) => Effect.gen(function* () {
+	const { api } = options;
+	const teamId = yield* api.resolveTeamId(options.team);
+	const team = options.team ?? teamId;
+	const project = (yield* findProjectByName(api, teamId, "alchemy-state")) ?? (yield* createStoreProject(api, teamId, team));
+	const deployment = yield* prodDeploymentOf(api, project.id);
+	if (deployment === void 0) return yield* new ProductionDeploymentNotFound({ projectId: project.id });
+	const keys = [];
+	yield* Scope.addFinalizer(options.scope, Effect.suspend(() => Effect.forEach(keys, (key) => deleteDeployKey(api, deployment.name, key), { discard: true })));
+	const mint = createDeployKey(api, deployment.name, "alchemy-state", RUN_KEY_ACTIONS).pipe(Effect.map((key) => {
+		keys.push(key);
+		return makeFunctionApi(deployment.deploymentUrl, key);
+	}), Effect.mapError((error) => failure(`no key for ${deployment.name}: ${error.message}`)));
+	let current = yield* mint;
+	const functions = { call: (path, args) => current.call(path, args).pipe(Effect.catchIf(isUnauthorized, () => mint.pipe(Effect.flatMap((next) => {
+		current = next;
+		return next.call(path, args);
+	})))) };
+	const version = yield* storeVersion(functions);
+	if (version === void 0 || version < 1) {
+		if (version === void 0 && deployment.lastDeployTime) return yield* failure(`project ${STORE_PROJECT_NAME} (${project.id}) of team ${team} has code that is not the state store, and Convex.state does not push over it. Rename that project in the Convex dashboard.`);
+		const now = yield* storeVersion(functions);
+		if (now === void 0 || now < 1) {
+			yield* pushStore(options, deployment);
+			const pushed = yield* storeVersion(functions);
+			if (pushed === void 0 || pushed < 1) return yield* failure(`${deployment.name} answers store version ${pushed ?? "none"} after the push of version 1.`);
+		}
+	} else if (version > 1) yield* Effect.logInfo(`Convex state: the store of team ${team} is version ${version}, newer than version 1 of this package, and it stays.`);
+	const remote = remoteOf(functions);
 	return {
 		id: "convex",
 		getVersion: () => Effect.succeed(STATE_STORE_VERSION),
-		listStacks: () => read(memory.listStacks(), remote.listStacks()),
-		listStages: (stack) => read(memory.listStages(stack), remote.listStages(stack)),
-		list: (request) => read(memory.list(request), remote.list(request)),
-		get: (request) => read(memory.get(request), remote.get(request)),
-		getReplacedResources: (request) => read(memory.getReplacedResources(request), remote.getReplacedResources(request)),
-		getOutput: (request) => read(memory.getOutput(request), remote.getOutput(request)),
-		set: (request) => write(memory.set(request), remote.set(request), request.value),
-		delete: (request) => write(memory.delete(request), remote.delete(request), void 0),
-		deleteStack: (request) => write(memory.deleteStack(request), remote.deleteStack(request), void 0),
-		setOutput: (request) => write(memory.setOutput(request), remote.setOutput(request), request.value).pipe(Effect.tap(() => pending ? Effect.fail(failure(`the deployment of ${STATE_DEPLOY_KEY_ENV} has no ${COMPONENT_PATH} component at the end of the run, so this run saved no state. Mount @samebase/alchemy-convex/convex.config in convex/convex.config.ts.`)) : Effect.void))
+		listStacks: remote.listStacks,
+		listStages: remote.listStages,
+		list: remote.list,
+		get: remote.get,
+		getReplacedResources: remote.getReplacedResources,
+		getOutput: remote.getOutput,
+		set: (request) => remote.set(request).pipe(Effect.as(request.value)),
+		delete: (request) => remote.delete(request).pipe(Effect.asVoid),
+		deleteStack: (request) => remote.deleteStack(request).pipe(Effect.asVoid),
+		setOutput: (request) => remote.setOutput(request).pipe(Effect.as(request.value))
 	};
 });
 /**
-* Alchemy state in the alchemyState component of the deployment that the
-* deploy key in CONVEX_STATE_DEPLOY_KEY names: the production deployment of
-* the project. The key needs the actions `deployment:data:view` and
-* `deployment:data:write`.
+* Alchemy state in the `alchemy-state` project of `team`, with the team token
+* in CONVEX_ACCESS_TOKEN or the Convex CLI login. A team access token names
+* its team, so `team` is optional with one; the Convex CLI login needs the
+* slug or the id. The first use of the run finds or creates the project and
+* pushes the store when it is missing or older. `alchemy plan` on another
+* stack never touches Convex.
 */
-const state = () => Layer.effect(State, Effect.gen(function* () {
+const state = (options = {}) => Layer.effect(State, Effect.gen(function* () {
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const scope = yield* Scope.Scope;
 	const context = yield* Effect.context();
 	return yield* Effect.cached(Effect.gen(function* () {
-		const key = yield* Config.Redacted(STATE_DEPLOY_KEY_ENV);
-		if (keyTargetOf(Redacted.value(key)).kind !== "deployment") return yield* failure(`${STATE_DEPLOY_KEY_ENV} must be the deploy key of one deployment, such as prod:<name>|..., not a preview deploy key.`);
-		return yield* makeConvexState(makeFunctionApi(yield* urlForKey(key), key));
+		const api = yield* ManagementApi.pipe(Effect.provide(ManagementApiLive().pipe(Layer.provide(fromConfig()))));
+		return yield* makeConvexState({
+			team: options.team,
+			api,
+			spawner,
+			scope,
+			store: storeDirectory()
+		});
 	}).pipe(Effect.provideContext(context), Effect.orDie));
 }));
 //#endregion
-export { ACCESS_TOKEN_ENV, AmbiguousDeployment, AmbiguousProject, CodePushFailed, ConvexApiError, ConvexAppNotFound, ConvexCliNotFound, CreatedProjectNotFound, Credentials, CredentialsError, DEPLOY_KEY_ENV, Deployment, DeploymentIdentityChange, EnvironmentNeedsDeployKey, ManagementApi, ProductionDeploymentNotFound, Project, ProjectDeploymentChange, ProjectNotFound, ProjectTeamChange, Providers, PushTargetMismatch, STATE_DEPLOY_KEY_ENV, VariablesOwnedBySomeoneElse, fromConfig, fromValues, parseDeployOutput, providers, state };
+export { ACCESS_TOKEN_ENV, AmbiguousDeployment, AmbiguousProject, CodePushFailed, ConvexApiError, ConvexAppNotFound, ConvexCliNotFound, CreatedProjectNotFound, Credentials, CredentialsError, DEPLOY_KEY_ENV, Deployment, DeploymentIdentityChange, EnvironmentNeedsDeployKey, ManagementApi, ProductionDeploymentNotFound, Project, ProjectDeploymentChange, ProjectNotFound, ProjectTeamChange, Providers, PushTargetMismatch, STORE_PROJECT_NAME, VariablesOwnedBySomeoneElse, fromConfig, fromValues, parseDeployOutput, providers, state };
 
 //# sourceMappingURL=index.js.map