alchemy 2.0.0-beta.13 → 2.0.0-beta.14

package/src/Cloudflare/StateStore/Store.ts

@@ -0,0 +1,288 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import type { ReplacedResourceState, ResourceState } from "alchemy/State";
+import { encodeState } from "alchemy/State";
+import * as Effect from "effect/Effect";
+import { pipe } from "effect/Function";
+import { EncryptionKey } from "./Token.ts";
+
+export default class Store extends Cloudflare.DurableObjectNamespace<Store>()(
+  "Store",
+  Effect.gen(function* () {
+    // Outer (class-level) phase — resolve the binding factory once.
+    // The actual secret read happens inside each DO instance below,
+    // since `SecretClient.get()` needs the per-instance worker env.
+    const encryptionSecret = yield* Cloudflare.Secret.bind(EncryptionKey);
+
+    return Effect.gen(function* () {
+      // Inner (per-instance) phase — set up storage and the AES key.
+      // The key is imported once per DO boot and reused thereafter.
+      const doState = yield* Cloudflare.DurableObjectState;
+      const storage = doState.storage;
+
+      const keyHex = yield* encryptionSecret.get().pipe(Effect.orDie);
+      const cryptoKey = yield* Effect.tryPromise(() =>
+        crypto.subtle.importKey(
+          "raw",
+          hexToBytes(keyHex),
+          { name: "AES-CTR" },
+          false,
+          ["encrypt", "decrypt"],
+        ),
+      ).pipe(Effect.orDie);
+
+      const encryptValue = (value: ResourceState) =>
+        Effect.tryPromise(async () => {
+          const plaintext = new TextEncoder().encode(
+            JSON.stringify(encodeState(value)),
+          );
+          const counter = crypto.getRandomValues(allocBytes(NONCE_BYTES));
+          const ct = new Uint8Array(
+            await crypto.subtle.encrypt(
+              { name: "AES-CTR", counter, length: 64 },
+              cryptoKey,
+              plaintext,
+            ),
+          );
+          // Frame as a single base64 string: nonce || ciphertext.
+          const framed = allocBytes(counter.byteLength + ct.byteLength);
+          framed.set(counter, 0);
+          framed.set(ct, counter.byteLength);
+          return toB64(framed);
+        }).pipe(Effect.orDie);
+
+      const decryptEntry = (entry: string) =>
+        Effect.tryPromise(async () => {
+          const framed = fromB64(entry);
+          const counter = framed.slice(0, NONCE_BYTES);
+          const ciphertext = framed.slice(NONCE_BYTES);
+          const pt = await crypto.subtle.decrypt(
+            { name: "AES-CTR", counter, length: 64 },
+            cryptoKey,
+            ciphertext,
+          );
+          return JSON.parse(new TextDecoder().decode(pt)) as ResourceState;
+        }).pipe(Effect.orDie);
+
+      return {
+        // -- Root DO methods -----------------------------------------
+
+        /**
+         * (Root DO only) List every stack name ever registered.
+         */
+        listStacks: Effect.fnUntraced(function* () {
+          const entries = yield* storage.list<number>({
+            prefix: STACK_INDEX_PREFIX,
+          });
+          const stacks: string[] = [];
+          for (const key of entries.keys()) {
+            stacks.push(key.slice(STACK_INDEX_PREFIX.length));
+          }
+          return stacks;
+        }),
+
+        /**
+         * (Root DO only) Register a stack name. Idempotent — safe to
+         * call on every `set` to the corresponding stack DO.
+         */
+        registerStack: ({ stack }: { stack: string }) =>
+          storage.put(`${STACK_INDEX_PREFIX}${stack}`, 1),
+
+        /**
+         * (Root DO only) Remove a stack name from the global index.
+         */
+        unregisterStack: ({ stack }: { stack: string }) =>
+          storage.delete(`${STACK_INDEX_PREFIX}${stack}`),
+
+        // -- Stack DO methods ----------------------------------------
+
+        /** (Stack DO only) List stages with at least one resource. */
+        listStages: () =>
+          storage
+            .list<string>({
+              prefix: RESOURCE_PREFIX,
+            })
+            .pipe(
+              Effect.map((entries) => {
+                const stages = new Set<string>();
+                for (const key of entries.keys()) {
+                  const parsed = parseResourceKey(key);
+                  if (parsed) stages.add(parsed.stage);
+                }
+                return [...stages];
+              }),
+            ),
+
+        /** (Stack DO only) List every resource FQN in a stage. */
+        listResources: ({ stage }: { stage: string }) =>
+          storage
+            .list<string>({
+              prefix: stagePrefix(stage),
+            })
+            .pipe(
+              Effect.map((entries) => {
+                const fqns: string[] = [];
+                for (const key of entries.keys()) {
+                  const parsed = parseResourceKey(key);
+                  if (parsed) fqns.push(parsed.fqn);
+                }
+                return fqns;
+              }),
+            ),
+
+        /**
+         * (Stack DO only) Get a resource by (stage, fqn). Returns
+         * null if missing.
+         */
+        get: ({ stage, fqn }: { stage: string; fqn: string }) =>
+          storage
+            .get<string>(resourceKey(stage, fqn))
+            .pipe(
+              Effect.flatMap((entry) =>
+                entry == null ? Effect.succeed(undefined) : decryptEntry(entry),
+              ),
+            ),
+
+        /**
+         * (Stack DO only) Persist a resource. Returns the stored
+         * value unchanged.
+         */
+        set: ({
+          stage,
+          fqn,
+          value,
+        }: {
+          stage: string;
+          fqn: string;
+          value: ResourceState;
+        }) =>
+          encryptValue(value).pipe(
+            Effect.flatMap((encrypted) =>
+              storage
+                .put<string>(resourceKey(stage, fqn), encrypted)
+                .pipe(Effect.asVoid),
+            ),
+            Effect.map(() => value),
+          ),
+
+        /**
+         * (Stack DO only) Delete a resource. Idempotent.
+         *
+         * Exposed as `remove` (not `delete`) because Cloudflare's
+         * Durable Object RPC stub reserves `delete` and refuses to
+         * proxy the call, surfacing as "RPC receiver does not
+         * implement the method 'delete'".
+         */
+        remove: ({ stage, fqn }: { stage: string; fqn: string }) =>
+          storage.delete(resourceKey(stage, fqn)),
+
+        /**
+         * (Stack DO only) Delete every resource in this stack, or every
+         * resource in a single stage when specified.
+         */
+        deleteStack: ({ stage }: { stage?: string } = {}) =>
+          stage === undefined
+            ? storage.deleteAll()
+            : storage
+                .list<string>({ prefix: stagePrefix(stage) })
+                .pipe(
+                  Effect.flatMap((entries) =>
+                    entries.size === 0
+                      ? Effect.void
+                      : storage.delete([...entries.keys()]).pipe(Effect.asVoid),
+                  ),
+                ),
+
+        /**
+         * (Stack DO only) Return every resource in a stage whose
+         * `status === "replaced"`. Each entry is decrypted so the
+         * `status` field can be inspected.
+         */
+        getReplacedResources: ({ stage }: { stage: string }) =>
+          pipe(
+            storage.list<string>({ prefix: stagePrefix(stage) }),
+            Effect.map((entries) =>
+              [...entries.values()].filter((e): e is string => !!e),
+            ),
+            Effect.flatMap(
+              Effect.forEach(decryptEntry, { concurrency: "unbounded" }),
+            ),
+            Effect.map((decoded) =>
+              decoded.filter(
+                (d): d is ReplacedResourceState => d?.status === "replaced",
+              ),
+            ),
+          ),
+      };
+    });
+  }),
+) {
+  /**
+   * Well-known DO name whose sole job is to track the set of stacks
+   * that have ever had resources written. `listStacks` queries it;
+   * every `set` asks it to register the stack (idempotent).
+   */
+  static readonly ROOT_DO_NAME = "__root__" as const;
+}
+
+/** NUL byte separator for composite keys. */
+const SEP = "\x00";
+
+/** Key prefix for resource entries in a stack DO. */
+const RESOURCE_PREFIX = `r${SEP}`;
+
+/** Key prefix for stack-index entries in the root DO. */
+const STACK_INDEX_PREFIX = "s:";
+
+/** AES-CTR counter block length. */
+const NONCE_BYTES = 16;
+
+/** Build the resource key inside a *stack DO*. */
+const resourceKey = (stage: string, fqn: string) =>
+  `${RESOURCE_PREFIX}${stage}${SEP}${fqn}`;
+
+/** Prefix matching every resource key inside a specific stage. */
+const stagePrefix = (stage: string) => `${RESOURCE_PREFIX}${stage}${SEP}`;
+
+/**
+ * Parse a resource key back into its (stage, fqn) tuple. Returns
+ * undefined for keys that do not match the expected shape.
+ */
+const parseResourceKey = (
+  key: string,
+): { stage: string; fqn: string } | undefined => {
+  if (!key.startsWith(RESOURCE_PREFIX)) return undefined;
+  const rest = key.slice(RESOURCE_PREFIX.length);
+  const sep = rest.indexOf(SEP);
+  if (sep < 0) return undefined;
+  return { stage: rest.slice(0, sep), fqn: rest.slice(sep + 1) };
+};
+
+/**
+ * Allocate a `Uint8Array` over a fresh `ArrayBuffer` (not shared) so
+ * the resulting buffer satisfies Web Crypto's `BufferSource` type
+ * constraint under strict DOM typings.
+ */
+const allocBytes = (size: number): Uint8Array<ArrayBuffer> =>
+  new Uint8Array(new ArrayBuffer(size));
+
+const toB64 = (bytes: Uint8Array): string => {
+  let s = "";
+  for (let i = 0; i < bytes.byteLength; i++)
+    s += String.fromCharCode(bytes[i]!);
+  return btoa(s);
+};
+
+const fromB64 = (s: string): Uint8Array<ArrayBuffer> => {
+  const bin = atob(s);
+  const bytes = allocBytes(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return bytes;
+};
+
+const hexToBytes = (hex: string): Uint8Array<ArrayBuffer> => {
+  const bytes = allocBytes(hex.length / 2);
+  for (let i = 0; i < bytes.length; i++) {
+    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+};

package/src/Cloudflare/StateStore/Token.ts

@@ -0,0 +1,62 @@
+import { Random } from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+/**
+ * The account-wide Secrets Store that backs every secret used by the
+ * state store worker. `SecretsStore` adopts the single store that
+ * already exists on the account, or creates one if none exists.
+ */
+export const Store = Cloudflare.SecretsStore("StateStoreSecrets");
+
+/**
+ * The randomly generated bearer token value. Generated once on create
+ * and persisted in alchemy state, so subsequent deploys keep the same
+ * value unless the resource is replaced.
+ */
+export const TokenValue = Random("StateStoreAuthTokenValue");
+
+/**
+ * The name of the secret in the Cloudflare Secrets Store that contains the bearer token.
+ */
+export const AuthTokenSecretName = "AlchemyStateStoreToken" as const;
+
+/**
+ * The bearer token used to authenticate every request to the state
+ * store worker. The value comes from {@link TokenValue} and lives in
+ * the account-wide Cloudflare Secrets Store so it can be bound into
+ * the worker without bundling the raw string.
+ */
+export const AuthToken = Effect.gen(function* () {
+  const store = yield* Store;
+  const random = yield* TokenValue;
+  return yield* Cloudflare.Secret(AuthTokenSecretName, {
+    store,
+    value: random.text,
+  });
+});
+
+/**
+ * A 32-byte (256-bit) random value, hex-encoded, that seeds the
+ * AES-CTR key used to encrypt resource state at rest. Generated once
+ * and persisted, so the ciphertext stored by the Durable Object can
+ * always be decrypted by subsequent worker boots.
+ */
+export const EncryptionKeyValue = Random("StateStoreEncryptionKeyValue", {
+  bytes: 32,
+});
+
+/**
+ * The encryption key secret. The raw hex-encoded bytes live inside
+ * Cloudflare's Secrets Store; the Durable Object binds to it at
+ * runtime to derive an AES-CTR `CryptoKey` via Web Crypto's
+ * `subtle.importKey`.
+ */
+export const EncryptionKey = Effect.gen(function* () {
+  const store = yield* Store;
+  const random = yield* EncryptionKeyValue;
+  return yield* Cloudflare.Secret("StateStoreEncryptionKey", {
+    store,
+    value: random.text,
+  });
+});

package/src/Cloudflare/StateStore/index.ts

@@ -0,0 +1 @@
+export { state } from "./State.ts";

package/src/Cloudflare/Workers/DurableObjectNamespace.ts

@@ -100,6 +100,7 @@ export type DurableObjectServices =
   | DurableObjectNamespace
   | DurableObjectState
   | WorkerServices
+  | WorkerEnvironment
   | PlatformServices;
 
 export interface DurableObjectNamespaceProps {
@@ -514,12 +515,6 @@ export const DurableObjectNamespace: DurableObjectNamespaceClass =
                     Effect.provideService(DurableObjectState, doState),
                     Effect.provideService(WorkerEnvironment, env),
                     Effect.map((methods: any) => {
-                      console.log(
-                        "[DurableObject] wrapping methods:",
-                        Object.keys(methods),
-                        "own:",
-                        Object.getOwnPropertyNames(methods),
-                      );
                       const wrapped: Record<string, unknown> = {};
                       for (const key of Object.getOwnPropertyNames(methods)) {
                         const value = methods[key];

package/src/Cloudflare/Workers/HttpServer.ts

@@ -14,7 +14,7 @@ import { isWorkerEvent, type WorkerServices } from "./Worker.ts";
 export type HttpEffect = Http.HttpEffect<WorkerServices>;
 
 export const workersHttpHandler = <Req = never>(
-  handler: Http.HttpEffect<Req>,
+  handler: Http.HttpEffect<Req> | Effect.Effect<Http.HttpEffect<Req>>,
 ) => {
   const safeHandler = Http.safeHttpEffect(handler);
   return (event: any) => {

package/src/Cloudflare/Workers/Worker.ts

@@ -48,11 +48,11 @@ import { Stack } from "../../Stack.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import { D1Database } from "../D1/D1Database.ts";
 import { fromCloudflareFetcher } from "../Fetcher.ts";
+import type { KVNamespace } from "../KV/KVNamespace.ts";
 import { CloudflareLogs } from "../Logs.ts";
 import type { Providers } from "../Providers.ts";
-import type { R2Bucket } from "../R2/R2Bucket.ts";
-import type { KVNamespace } from "../KV/KVNamespace.ts";
 import type { Queue as CloudflareQueue } from "../Queue/Queue.ts";
+import type { R2Bucket } from "../R2/R2Bucket.ts";
 import {
   isAssets,
   readAssets,
@@ -173,9 +173,9 @@ export interface WorkerExecutionContext extends Serverless.FunctionContext {
   export(name: string, value: any): Effect.Effect<void>;
 }
 
-export type WorkerServices = Worker | WorkerEnvironment | Request;
+export type WorkerServices = Worker | Request;
 
-export type WorkerShape = Main<WorkerServices>;
+export type WorkerShape = Main<WorkerServices | WorkerEnvironment>;
 
 export type WorkerBindingResource =
   | Assets
@@ -764,8 +764,9 @@ export const Worker: Platform<
           );
           return key;
         }),
-      serve: <Req = never>(handler: HttpEffect<Req>) =>
-        ctx.listen(workersHttpHandler(handler)),
+      serve: <Req = never>(
+        handler: HttpEffect<Req> | Effect.Effect<HttpEffect<Req>>,
+      ) => ctx.listen(workersHttpHandler(handler)),
       listen: ((
         handler:
           | Serverless.FunctionListener
@@ -1280,7 +1281,6 @@ const stack = Layer.succeed(
 
 const exportsEffect = tag.asEffect().pipe(
   Effect.flatMap(func => func.ExecutionContext.exports),
-  Effect.map(exports => exports),
   Effect.provide(
     layer.pipe(
       Layer.provideMerge(stack),

package/src/Cloudflare/index.ts

@@ -1,10 +1,12 @@
 export * from "./CloudflareEnvironment.ts";
 export * from "./Container/index.ts";
 export * from "./D1/index.ts";
+export * from "./EdgeSession.ts";
 export * from "./KV/index.ts";
-export * from "./Queue/index.ts";
 export * from "./Providers.ts";
+export * from "./Queue/index.ts";
 export * from "./R2/index.ts";
 export * from "./SecretsStore/index.ts";
+export * from "./StateStore/index.ts";
 export * from "./Website/index.ts";
 export * from "./Workers/index.ts";

package/src/Deploy.ts

@@ -0,0 +1,25 @@
+import * as Effect from "effect/Effect";
+import { AlchemyContext } from "./AlchemyContext.ts";
+import * as Apply from "./Apply.ts";
+import type { Input } from "./Input.ts";
+import * as Plan from "./Plan.ts";
+import { evalStack, type CompiledStack, type StackEffect } from "./Stack.ts";
+import { Stage } from "./Stage.ts";
+
+export const deploy = <A>({
+  stack,
+  stage,
+}: {
+  stack: StackEffect<CompiledStack<A>, Stage | AlchemyContext>;
+  stage: string;
+}) =>
+  evalStack(
+    stack,
+    (stack) =>
+      Effect.gen(function* () {
+        const plan = yield* Plan.make(stack);
+        const output = yield* Apply.apply(plan);
+        return output as Input.Resolve<A>;
+      }),
+    { stage },
+  );

package/src/Destroy.ts

@@ -1,16 +1,28 @@
-import * as Effect from "effect/Effect";
-import { apply } from "./Apply.ts";
-import { provideFreshArtifactStore } from "./Artifacts.ts";
+import { Effect } from "effect";
+import type { AlchemyContext } from "./AlchemyContext.ts";
+import * as Apply from "./Apply.ts";
 import * as Plan from "./Plan.ts";
-import { Stack } from "./Stack.ts";
+import type { CompiledStack, StackEffect } from "./Stack.ts";
+import { evalStack } from "./Stack.ts";
+import type { Stage } from "./Stage.ts";
 
-export const destroy = () =>
-  Stack.use((stack) =>
-    Plan.make({
-      name: stack.name,
-      stage: stack.stage,
-      resources: {},
-      bindings: {},
-      output: {},
-    }).pipe(Effect.flatMap(apply), provideFreshArtifactStore),
+export const destroy = ({
+  stack,
+  stage,
+}: {
+  stack: StackEffect<CompiledStack, Stage | AlchemyContext>;
+  stage: string;
+}) =>
+  evalStack(
+    stack,
+    (stack) =>
+      Plan.make({
+        ...stack,
+        // zero these out (destroy will treat all as orphans)
+        // TODO(sam): probably better to have Plan.destroy and Plan.update
+        resources: {},
+        bindings: {},
+        output: {},
+      }).pipe(Effect.flatMap(Apply.apply)),
+    { stage },
   );

package/src/Http.ts

@@ -25,7 +25,6 @@ export const serve = <Req = never>(
 ) =>
   Effect.serviceOption(HttpServer).pipe(
     Effect.map(Option.getOrUndefined),
-    Effect.tap((http) => Effect.logInfo("http", http)),
     Effect.flatMap((http) => (http ? http.serve(handler) : Effect.void)),
   );
 
@@ -45,22 +44,38 @@ export class HttpServer extends Context.Service<
   }
 >()("HttpServer") {}
 
-export const safeHttpEffect = <Req = never>(handler: HttpEffect<Req>) =>
-  Effect.catchCause(handler, (cause) => {
-    const message = Option.match(Cause.findErrorOption(cause), {
-      onNone: () => "Internal Server Error",
-      onSome: (error) => error.message ?? "Internal Server Error",
-    });
+export const safeHttpEffect = <Req = never>(
+  handler: HttpEffect<Req> | Effect.Effect<HttpEffect<Req>>,
+): Effect.Effect<
+  HttpServerResponse.HttpServerResponse,
+  never,
+  Req | HttpServerRequest | Scope
+> =>
+  Effect.catchCause(
+    handler.pipe(
+      // @ts-expect-error
+      Effect.flatMap((response) =>
+        HttpServerResponse.isHttpServerResponse(response)
+          ? Effect.succeed(response)
+          : response,
+      ),
+    ) as any as HttpEffect<Req>,
+    (cause) => {
+      const message = Option.match(Cause.findErrorOption(cause), {
+        onNone: () => "Internal Server Error",
+        onSome: (error) => error.message ?? "Internal Server Error",
+      });
 
-    return Effect.map(
-      Effect.all([Effect.logInfo(message), Effect.logInfo(cause)]),
-      () =>
-        HttpServerResponse.text(message, {
-          status: 500,
-          statusText: message,
-        }),
-    );
-  });
+      return Effect.map(
+        Effect.all([Effect.logError(message), Effect.logError(cause)]),
+        () =>
+          HttpServerResponse.text(message, {
+            status: 500,
+            statusText: message,
+          }),
+      );
+    },
+  );
 
 export const resolvePort = (options: { port?: number } | undefined) =>
   options?.port !== undefined

package/src/Output.ts

@@ -208,8 +208,6 @@ export const map: {
         new ApplyExpr(output as Expr<A, Req>, args[0]) as any
     : new ApplyExpr(args[0] as any, args[1])) as any;
 
-type _ = Parameters<typeof map>;
-
 //Output.ApplyExpr<any, any, ResourceLike, any>
 export const isApplyExpr = <In = any, Out = any, Req = any>(
   node: Output<Out, Req>,

package/src/Platform.ts

@@ -28,8 +28,14 @@ export interface PlatformProps {
   isExternal?: boolean;
 }
 
-export type Main<Services = never> = void | {
-  fetch: HttpEffect<Services | PlatformServices>;
+export type Main<InitServices = never> = void | {
+  fetch:
+    | HttpEffect<InitServices | PlatformServices>
+    | Effect.Effect<
+        HttpEffect<InitServices | PlatformServices>,
+        never,
+        InitServices | PlatformServices
+      >;
 };
 
 export type Rpc<Shape> = {

package/src/Provider.ts

@@ -381,7 +381,5 @@ export const tryFindProviderByType: {
       }
     }
   }
-
-  console.log(context.mapUnsafe.keys());
   return Option.none();
 }) as any;