alchemy 2.0.0-beta.10 → 2.0.0-beta.13

package/src/Cloudflare/SecretsStore/Secret.ts

@@ -0,0 +1,229 @@
+import * as secretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { SecretBinding } from "./SecretBinding.ts";
+export type StoreSecretProps = {
+  /**
+   * The Secrets Store that owns this secret.
+   */
+  store: {
+    storeId: string;
+    accountId: string;
+  };
+  /**
+   * The name of the secret within the store.
+   * If omitted, the resource's logical ID is used.
+   */
+  name?: string;
+  /**
+   * The secret value. Treated as redacted and never logged.
+   */
+  value: Redacted.Redacted<string>;
+  /**
+   * Services allowed to reference this secret.
+   * @default ["workers"]
+   */
+  scopes?: string[];
+  /**
+   * Optional free-form description.
+   */
+  comment?: string;
+};
+
+export type Secret = Resource<
+  "Cloudflare.SecretsStore.Secret",
+  StoreSecretProps,
+  {
+    secretId: string;
+    secretName: string;
+    storeId: string;
+    accountId: string;
+    status: "pending" | "active" | "deleted";
+    scopes: string[];
+    comment: string | undefined;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A single secret stored inside a Cloudflare Secrets Store.
+ *
+ * The secret value is treated as redacted and is only ever sent to
+ * Cloudflare at create time. Updating `scopes` or `comment` issues a
+ * PATCH; changing `value` or `name` replaces the secret.
+ *
+ * @section Creating a Secret
+ * @example Basic Secret
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore");
+ * const apiKey = yield* Cloudflare.StoreSecret("ApiKey", {
+ *   store,
+ *   value: Redacted.make(process.env.API_KEY!),
+ * });
+ * ```
+ *
+ * @section Binding to a Worker
+ * @example Reading a secret at runtime
+ * ```typescript
+ * const apiKey = yield* Cloudflare.StoreSecret.bind(ApiKey);
+ * // `apiKey` is itself an Effect that resolves to the secret value:
+ * const value = yield* apiKey;
+ * // Or call `.get()` explicitly:
+ * const value = yield* apiKey.get();
+ * ```
+ */
+export const Secret = Resource<Secret>("Cloudflare.SecretsStore.Secret")({
+  bind: SecretBinding.bind,
+});
+
+const resolveScopes = (scopes: string[] | undefined): string[] =>
+  scopes && scopes.length > 0 ? scopes : ["workers"];
+
+const resolveName = (id: string, name: string | undefined): string =>
+  name ?? id;
+
+export const StoreSecretProvider = () =>
+  Provider.effect(
+    Secret,
+    Effect.gen(function* () {
+      const createStoreSecret = yield* secretsStore.createStoreSecret;
+      const patchStoreSecret = yield* secretsStore.patchStoreSecret;
+      const deleteStoreSecret = yield* secretsStore.deleteStoreSecret;
+      const getStoreSecret = yield* secretsStore.getStoreSecret;
+      const listStoreSecrets = secretsStore.listStoreSecrets;
+
+      const arraysEqual = (a: string[], b: string[]) =>
+        a.length === b.length && a.every((v, i) => v === b[i]);
+
+      return {
+        stables: ["secretId", "secretName", "storeId", "accountId"],
+        diff: Effect.fn(function* ({ id, olds = {} as any, news, output }) {
+          if (!isResolved(news)) return undefined;
+          const oldStoreId = output?.storeId ?? olds.store?.storeId;
+          const newStoreId = news.store.storeId;
+          const oldName = output?.secretName ?? resolveName(id, olds.name);
+          const newName = resolveName(id, news.name);
+          if (oldStoreId !== newStoreId || oldName !== newName) {
+            return { action: "replace" } as const;
+          }
+          const oldValue = olds.value ? Redacted.value(olds.value) : undefined;
+          const newValue = Redacted.value(news.value);
+          if (oldValue !== newValue) {
+            return { action: "replace" } as const;
+          }
+        }),
+        create: Effect.fn(function* ({ id, news }) {
+          const name = resolveName(id, news.name);
+          const scopes = resolveScopes(news.scopes);
+          const response = yield* createStoreSecret({
+            accountId: news.store.accountId,
+            storeId: news.store.storeId,
+            body: [
+              {
+                name,
+                scopes,
+                value: Redacted.value(news.value),
+                comment: news.comment,
+              },
+            ],
+          });
+          const secret = response.result[0]!;
+          return {
+            secretId: secret.id,
+            secretName: secret.name,
+            storeId: secret.storeId,
+            accountId: news.store.accountId,
+            status: secret.status,
+            scopes,
+            comment: secret.comment ?? undefined,
+          };
+        }),
+        update: Effect.fn(function* ({ news, olds = {} as any, output }) {
+          const newScopes = resolveScopes(news.scopes);
+          const oldScopes = resolveScopes(olds.scopes);
+          const scopesChanged = !arraysEqual(newScopes, oldScopes);
+          const commentChanged = (olds.comment ?? undefined) !== news.comment;
+          if (!scopesChanged && !commentChanged) {
+            return output;
+          }
+          const patched = yield* patchStoreSecret({
+            accountId: output.accountId,
+            storeId: output.storeId,
+            secretId: output.secretId,
+            scopes: scopesChanged ? newScopes : undefined,
+            comment: commentChanged ? news.comment : undefined,
+          });
+          return {
+            ...output,
+            status: patched.status,
+            scopes: newScopes,
+            comment: patched.comment ?? undefined,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteStoreSecret({
+            accountId: output.accountId,
+            storeId: output.storeId,
+            secretId: output.secretId,
+          }).pipe(
+            Effect.catchTag("SecretNotFound", () => Effect.void),
+            Effect.catchTag("StoreNotFound", () => Effect.void),
+            Effect.catchTag("NotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          if (output?.secretId) {
+            return yield* getStoreSecret({
+              accountId: output.accountId,
+              storeId: output.storeId,
+              secretId: output.secretId,
+            }).pipe(
+              Effect.map((secret) => ({
+                secretId: secret.id,
+                secretName: secret.name,
+                storeId: secret.storeId,
+                accountId: output.accountId,
+                status: secret.status,
+                scopes: output.scopes,
+                comment: secret.comment ?? undefined,
+              })),
+              Effect.catchTag("SecretNotFound", () =>
+                Effect.succeed(undefined),
+              ),
+              Effect.catchTag("StoreNotFound", () => Effect.succeed(undefined)),
+            );
+          }
+          if (!olds?.store) return undefined;
+          const name = resolveName(id, olds.name);
+          const match = yield* listStoreSecrets
+            .items({
+              accountId: olds.store.accountId,
+              storeId: olds.store.storeId,
+            })
+            .pipe(
+              Stream.filter((s) => s.name === name),
+              Stream.runHead,
+              Effect.catchTag("StoreNotFound", () => Effect.succeedNone),
+              Effect.map(Option.getOrUndefined),
+            );
+          if (!match) return undefined;
+          return {
+            secretId: match.id,
+            secretName: match.name,
+            storeId: match.storeId,
+            accountId: olds.store.accountId,
+            status: match.status,
+            scopes: resolveScopes(olds.scopes),
+            comment: match.comment ?? undefined,
+          };
+        }),
+      };
+    }),
+  );

package/src/Cloudflare/SecretsStore/SecretBinding.ts

@@ -0,0 +1,107 @@
+import type * as runtime from "@cloudflare/workers-types";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import type { Secret } from "./Secret.ts";
+
+export class SecretError extends Data.TaggedError("SecretError")<{
+  message: string;
+  cause: Error;
+}> {}
+
+/**
+ * A bound secret. The client itself is an `Effect` that resolves to the
+ * secret's current value, so you can `yield* apiKey` directly. Use `.get()`
+ * for the same thing as a callable, or `.raw` for the underlying
+ * `SecretsStoreSecret` binding.
+ */
+export interface SecretClient extends Effect.Effect<
+  string,
+  SecretError,
+  WorkerEnvironment
+> {
+  /**
+   * Effect that resolves to the raw Cloudflare `SecretsStoreSecret` binding.
+   */
+  raw: Effect.Effect<runtime.SecretsStoreSecret, never, WorkerEnvironment>;
+  /**
+   * Read the current value of the secret.
+   */
+  get(): Effect.Effect<string, SecretError, WorkerEnvironment>;
+}
+
+export class SecretBinding extends Binding.Service<
+  SecretBinding,
+  (secret: Secret) => Effect.Effect<SecretClient>
+>()("Cloudflare.SecretsStore.Secret") {}
+
+export const SecretBindingLive = Layer.effect(
+  SecretBinding,
+  Effect.gen(function* () {
+    const bind = yield* SecretBindingPolicy;
+
+    return Effect.fn(function* (secret: Secret) {
+      yield* bind(secret);
+      const env = WorkerEnvironment.asEffect();
+      const raw = env.pipe(
+        Effect.map(
+          (env) =>
+            (env as Record<string, runtime.SecretsStoreSecret>)[
+              secret.LogicalId
+            ],
+        ),
+      );
+      const tryPromise = <T>(
+        fn: () => Promise<T>,
+      ): Effect.Effect<T, SecretError> =>
+        Effect.tryPromise({
+          try: fn,
+          catch: (error: any) =>
+            new SecretError({
+              message: error.message ?? "Unknown error",
+              cause: error,
+            }),
+        });
+
+      const getEffect: Effect.Effect<string, SecretError, WorkerEnvironment> =
+        raw.pipe(Effect.flatMap((raw) => tryPromise(() => raw.get())));
+
+      return Object.assign(
+        Effect.suspend(() => getEffect),
+        {
+          raw,
+          get: () => getEffect,
+        },
+      ) as SecretClient;
+    });
+  }),
+);
+
+export class SecretBindingPolicy extends Binding.Policy<
+  SecretBindingPolicy,
+  (secret: Secret) => Effect.Effect<void>
+>()("Cloudflare.SecretsStore.Secret") {}
+
+export const SecretBindingPolicyLive = SecretBindingPolicy.layer.succeed(
+  Effect.fn(function* (host: ResourceLike, secret: Secret) {
+    if (isWorker(host)) {
+      yield* host.bind`${secret}`({
+        bindings: [
+          {
+            type: "secrets_store_secret",
+            name: secret.LogicalId,
+            secretName: secret.secretName,
+            storeId: secret.storeId,
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        new Error(`SecretBinding does not support runtime '${host.Type}'`),
+      );
+    }
+  }),
+);

package/src/Cloudflare/SecretsStore/SecretsStore.ts

@@ -0,0 +1,106 @@
+import * as secretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as Effect from "effect/Effect";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+
+export type SecretsStore = Resource<
+  "Cloudflare.SecretsStore",
+  {},
+  {
+    storeId: string;
+    storeName: string;
+    accountId: string;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A Cloudflare Secrets Store, a per-account container for secrets that
+ * can be bound into Workers with full redaction and audit support.
+ *
+ * Cloudflare enforces a limit of **one Secrets Store per account**.
+ * Deleting a store changes its ID and permanently destroys all secrets
+ * inside it. Because of this, the provider always **adopts** an existing
+ * store rather than creating a new one, and **never deletes** the store
+ * on teardown. If no store exists yet, one is created, but once it
+ * exists it is treated as account-level infrastructure that outlives
+ * any single stack.
+ *
+ * @section Creating a Store
+ * @example Basic Secrets Store (adopts existing or creates one)
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore");
+ * ```
+ *
+ * @example Adopt a specific named store
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore", {
+ *   name: "production-secrets",
+ * });
+ * ```
+ */
+export const SecretsStore = Resource<SecretsStore>("Cloudflare.SecretsStore");
+
+export const SecretsStoreProvider = () =>
+  Provider.effect(
+    SecretsStore,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const createStore = yield* secretsStore.createStore;
+      const listStores = yield* secretsStore.listStores;
+
+      return {
+        stables: ["storeId", "storeName", "accountId"],
+        create: Effect.fn(function* () {
+          const stores = yield* listStores({ accountId });
+          if (stores.result.length > 0) {
+            // No name specified — adopt the first (and likely only) store.
+            const first = stores.result[0]!;
+            return {
+              storeId: first.id,
+              storeName: first.name,
+              accountId,
+            };
+          }
+
+          // No store exists yet — create one.
+          const response = yield* createStore({
+            accountId,
+            //`default_secrets_store` is the name cloudflare uses to create a secret store
+            body: [{ name: "default_secrets_store" }],
+          });
+          const store = response.result[0]!;
+          return {
+            storeId: store.id,
+            storeName: store.name,
+            accountId,
+          };
+        }),
+        update: Effect.fn(function* ({ output }) {
+          return output;
+        }),
+        delete: Effect.fn(function* () {
+          // Intentional no-op. Cloudflare only allows one Secrets Store per
+          // account and deleting it permanently destroys all secrets inside.
+          // The store is treated as shared, account-level infrastructure that
+          // should never be torn down by a single stack.
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.storeId) return undefined;
+          const stores = yield* listStores({
+            accountId: output.accountId,
+          });
+          const match = stores.result.find((s) => s.id === output.storeId);
+          if (!match) return undefined;
+          return {
+            storeId: match.id,
+            storeName: match.name,
+            accountId: output.accountId,
+          };
+        }),
+      };
+    }),
+  );

package/src/Cloudflare/SecretsStore/index.ts

@@ -0,0 +1,3 @@
+export * from "./Secret.ts";
+export * from "./SecretBinding.ts";
+export * from "./SecretsStore.ts";

package/src/Cloudflare/Workers/InferEnv.ts

@@ -22,6 +22,8 @@ type GetBindingType<T> = T extends Cloudflare.Assets
       ? R2Bucket
       : T extends Cloudflare.KVNamespace
         ? KVNamespace
-        : T extends Cloudflare.DurableObjectNamespaceLike
-          ? DurableObjectNamespace<Exclude<T["Shape"], undefined>>
-          : never;
+        : T extends Cloudflare.Queue
+          ? Queue<unknown>
+          : T extends Cloudflare.DurableObjectNamespaceLike
+            ? DurableObjectNamespace<Exclude<T["Shape"], undefined>>
+            : never;

package/src/Cloudflare/Workers/Worker.ts

@@ -16,6 +16,9 @@ import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import * as Socket from "effect/unstable/socket/Socket";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
 import type * as rolldown from "rolldown";
 import Sonda from "sonda/rolldown";
 import type * as vite from "vite";
@@ -42,12 +45,14 @@ import { Resource, type ResourceBinding } from "../../Resource.ts";
 import { Self } from "../../Self.ts";
 import * as Serverless from "../../Serverless/index.ts";
 import { Stack } from "../../Stack.ts";
-import { Account } from "../Account.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import { D1Database } from "../D1/D1Database.ts";
 import { fromCloudflareFetcher } from "../Fetcher.ts";
 import { CloudflareLogs } from "../Logs.ts";
 import type { Providers } from "../Providers.ts";
 import type { R2Bucket } from "../R2/R2Bucket.ts";
+import type { KVNamespace } from "../KV/KVNamespace.ts";
+import type { Queue as CloudflareQueue } from "../Queue/Queue.ts";
 import {
   isAssets,
   readAssets,
@@ -176,6 +181,8 @@ export type WorkerBindingResource =
   | Assets
   | R2Bucket
   | D1Database
+  | KVNamespace
+  | CloudflareQueue
   | DurableObjectNamespaceLike<any>;
 
 export type WorkerBindings = {
@@ -683,8 +690,20 @@ export const Worker: Platform<
                       ),
                     ),
                   }
-                : // TODO(sam): handle others
-                  undefined;
+                : binding.Type === "Cloudflare.KVNamespace"
+                  ? {
+                      type: "kv_namespace",
+                      name: bindingName,
+                      namespaceId: binding.namespaceId,
+                    }
+                  : binding.Type === "Cloudflare.Queue"
+                    ? {
+                        type: "queue",
+                        name: bindingName,
+                        queueName: binding.queueName,
+                      }
+                    : // TODO(sam): handle others
+                      undefined;
 
         if (bindingMeta) {
           yield* resource.bind`${bindingName}`({
@@ -912,7 +931,7 @@ export const WorkerProvider = () =>
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
 
-      const accountId = yield* Account;
+      const { accountId } = yield* CloudflareEnvironment;
       const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
       const stack = yield* Stack;
 
@@ -1171,13 +1190,15 @@ export const WorkerProvider = () =>
         Effect.gen(function* () {
           const main = yield* fs.realPath(props.main);
           const cwd = yield* findCwdForBundle(main);
+          const { compatibilityDate, compatibilityFlags } =
+            getCompatibility(props);
           const buildBundle = (plugins?: rolldown.RolldownPluginOption) =>
             Bundle.build(
               {
                 input: main,
                 cwd,
                 plugins: [
-                  cloudflareRolldown(getCompatibility(props)),
+                  cloudflareRolldown({ compatibilityDate, compatibilityFlags }),
                   plugins,
                   ...(props.build?.metafile ? [Sonda({ open: false })] : []),
                 ],
@@ -1332,11 +1353,13 @@ ${[
         }).pipe(Artifacts.cached("build"));
 
       const viteBuild = Effect.fnUntraced(function* (props: WorkerProps) {
-        const vite = yield* Effect.promise(() => import("vite"));
         let assetsDirectory: string | undefined;
         let serverBundle: vite.Rolldown.OutputBundle | undefined;
+        const { compatibilityDate, compatibilityFlags } =
+          getCompatibility(props);
 
         yield* Effect.promise(async () => {
+          const vite = await loadVite();
           const builder = await vite.createBuilder(
             {
               root: props.vite?.rootDir,
@@ -1356,7 +1379,10 @@ ${[
                 sharedConfigBuild: true,
               },
               plugins: [
-                cloudflareVite(getCompatibility(props)),
+                cloudflareVite({
+                  compatibilityDate,
+                  compatibilityFlags,
+                }),
                 {
                   name: "output:ssr",
                   applyToEnvironment(environment) {
@@ -2268,3 +2294,33 @@ const contentTypeFromExtension = (extension: string) => {
       return "application/octet-stream";
   }
 };
+
+type ViteModule = typeof import("vite");
+let _viteModule: ViteModule | null = null;
+
+/**
+ * Dynamically load Vite from the project root. Falls back to the bundled
+ * copy if the project doesn't have its own Vite installation.
+ */
+async function loadVite(): Promise<ViteModule> {
+  if (_viteModule) return _viteModule;
+
+  const projectRoot = process.cwd();
+  let vitePath: string;
+
+  try {
+    // Resolve "vite" from the project root, not from vinext's location
+    const require = createRequire(path.join(projectRoot, "package.json"));
+    vitePath = require.resolve("vite");
+  } catch {
+    // Fallback: use the Vite that ships with vinext (works for non-linked installs)
+    vitePath = "vite";
+  }
+
+  // On Windows, absolute paths must be file:// URLs for ESM import().
+  // The fallback ("vite") is a bare specifier and works as-is.
+  const viteUrl = vitePath === "vite" ? vitePath : pathToFileURL(vitePath).href;
+  const vite = (await import(/* @vite-ignore */ viteUrl)) as ViteModule;
+  _viteModule = vite;
+  return vite;
+}

package/src/Cloudflare/Workers/Workflow.ts

@@ -6,7 +6,7 @@ import type { PlatformServices } from "../../Platform.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import { effectClass, taggedFunction } from "../../Util/effect.ts";
-import { Account } from "../Account.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import { Worker, WorkerEnvironment, type WorkerServices } from "./Worker.ts";
 
 type WorkflowTypeId = "Cloudflare.Workflow";
@@ -83,8 +83,17 @@ export const sleepUntil = (
 
 /**
  * The services available inside a workflow run body.
+ *
+ * `WorkerEnvironment` is provided to the body at runtime by the workflow
+ * export wrapper (see `make(env)` below), so users can access env bindings
+ * from inside workflow steps via `yield* WorkerEnvironment` — the type must
+ * reflect that or `yield* WorkerEnvironment` fails to type-check inside a
+ * body even though it succeeds at runtime.
  */
-export type WorkflowRunServices = WorkflowEvent | WorkflowStep;
+export type WorkflowRunServices =
+  | WorkflowEvent
+  | WorkflowStep
+  | WorkerEnvironment;
 
 export type WorkflowServices = WorkerServices | PlatformServices;
 
@@ -323,13 +332,14 @@ export const Workflow: WorkflowClass = taggedFunction(WorkflowScope, ((
           yield* worker.export(name, {
             kind: "workflow",
             make: (env: unknown) =>
-              Effect.succeed(body).pipe(
-                Effect.provideContext(services),
-                Effect.provideService(
-                  WorkerEnvironment,
-                  env as Record<string, any>,
+              Effect.succeed(
+                body.pipe(
+                  Effect.provideService(
+                    WorkerEnvironment,
+                    env as Record<string, any>,
+                  ),
                 ),
-              ),
+              ).pipe(Effect.provideContext(services)),
           } satisfies WorkflowExport);
 
           return self;
@@ -370,7 +380,7 @@ export const WorkflowProvider = () =>
   Provider.effect(
     WorkflowResource,
     Effect.gen(function* () {
-      const accountId = yield* Account;
+      const { accountId } = yield* CloudflareEnvironment;
       const putWorkflow = yield* workflows.putWorkflow;
       const deleteWorkflow = yield* workflows.deleteWorkflow;
 

package/src/Cloudflare/index.ts

@@ -1,8 +1,10 @@
+export * from "./CloudflareEnvironment.ts";
 export * from "./Container/index.ts";
 export * from "./D1/index.ts";
 export * from "./KV/index.ts";
+export * from "./Queue/index.ts";
 export * from "./Providers.ts";
 export * from "./R2/index.ts";
-export * from "./StageConfig.ts";
+export * from "./SecretsStore/index.ts";
 export * from "./Website/index.ts";
 export * from "./Workers/index.ts";