alchemy 2.0.0-beta.13 → 2.0.0-beta.15

package/lib/Cloudflare/EdgeSession.d.ts

@@ -0,0 +1,53 @@
+import { Credentials } from "@distilled.cloud/cloudflare/Credentials";
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import { CloudflareEnvironment } from "./CloudflareEnvironment.ts";
+/**
+ * A "remote binding" as understood by the Cloudflare Workers
+ * edge-preview API. We reuse the distilled request schema so the
+ * shape tracks Cloudflare's surface.
+ */
+type EdgeMetadata = NonNullable<NonNullable<workers.CreateScriptEdgePreviewRequest["metadata"]>>;
+export type EdgeBinding = NonNullable<NonNullable<EdgeMetadata["bindings"]>>[number];
+declare const EdgeSessionError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "EdgeSessionError";
+} & Readonly<A>;
+export declare class EdgeSessionError extends EdgeSessionError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface EdgeSessionOptions {
+    /**
+     * Name used as the preview script identifier on Cloudflare's side.
+     * Shows up as the hostname: `{scriptName}.{subdomain}.workers.dev`.
+     */
+    readonly scriptName: string;
+    /** ES-module worker script(s). The first file is the entrypoint. */
+    readonly files: ReadonlyArray<File>;
+    /** Remote bindings attached to the preview worker. */
+    readonly bindings: ReadonlyArray<EdgeBinding>;
+    /** @default "2025-04-28" */
+    readonly compatibilityDate?: string;
+}
+/**
+ * Information needed to call a running edge-preview worker. Attach
+ * `headers` (including the `cf-workers-preview-token`) and fetch
+ * `url` or a path under it.
+ */
+export interface EdgeSessionHandle {
+    readonly url: string;
+    readonly headers: Record<string, string>;
+}
+/**
+ * Upload a short-lived preview worker to Cloudflare's edge and
+ * return its URL plus the headers needed to reach it.
+ *
+ * Preview workers are ephemeral: they live only while a client keeps
+ * sending requests with the returned preview token and expire soon
+ * after. Nothing is deployed or billed.
+ */
+export declare const createEdgeSession: (options: EdgeSessionOptions) => Effect.Effect<EdgeSessionHandle, EdgeSessionError, CloudflareEnvironment | HttpClient.HttpClient | Credentials>;
+export {};
+//# sourceMappingURL=EdgeSession.d.ts.map

package/lib/Cloudflare/EdgeSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EdgeSession.d.ts","sourceRoot":"","sources":["../../src/Cloudflare/EdgeSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AACtE,OAAO,KAAK,OAAO,MAAM,qCAAqC,CAAC;AAE/D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;;GAIG;AACH,KAAK,YAAY,GAAG,WAAW,CAC7B,WAAW,CAAC,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC,CAChE,CAAC;AACF,MAAM,MAAM,WAAW,GAAG,WAAW,CACnC,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CACtC,CAAC,MAAM,CAAC,CAAC;;;;AAEV,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAC9C,4BAA4B;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAsED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC5B,SAAS,kBAAkB,KAC1B,MAAM,CAAC,MAAM,CACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,GAAG,UAAU,CAAC,UAAU,GAAG,WAAW,CAcK,CAAC"}

package/lib/Cloudflare/EdgeSession.js

@@ -0,0 +1,78 @@
+import { Credentials } from "@distilled.cloud/cloudflare/Credentials";
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import { CloudflareEnvironment } from "./CloudflareEnvironment.js";
+export class EdgeSessionError extends Data.TaggedError("EdgeSessionError") {
+}
+const DEFAULT_COMPATIBILITY_DATE = "2025-04-28";
+const wrap = (effect, message) => effect.pipe(Effect.mapError((cause) => new EdgeSessionError({ message, cause })));
+/**
+ * Ask Cloudflare for a preview upload token. Some accounts return an
+ * `exchangeUrl` that must be GET'd to swap the session token for a
+ * short-lived upload token; when present we do the swap, falling back
+ * to the original if the exchange fails.
+ */
+const createUploadToken = Effect.gen(function* () {
+    const env = yield* CloudflareEnvironment;
+    const http = yield* HttpClient.HttpClient;
+    const createSubdomainEdgePreviewSession = yield* workers.createSubdomainEdgePreviewSession;
+    const { token, exchangeUrl } = yield* createSubdomainEdgePreviewSession({
+        accountId: env.accountId,
+    });
+    if (!exchangeUrl)
+        return token;
+    const json = yield* http.get(exchangeUrl).pipe(Effect.flatMap((r) => r.json), Effect.timeout(30_000), Effect.catch(() => Effect.succeed(null)));
+    if (typeof json === "object" &&
+        json !== null &&
+        "token" in json &&
+        typeof json.token === "string") {
+        return json.token;
+    }
+    return token;
+});
+const uploadScript = (options, uploadToken) => Effect.gen(function* () {
+    const env = yield* CloudflareEnvironment;
+    const createScriptEdgePreview = yield* workers.createScriptEdgePreview;
+    return yield* createScriptEdgePreview({
+        accountId: env.accountId,
+        scriptName: options.scriptName,
+        cfPreviewUploadConfigToken: uploadToken,
+        wranglerSessionConfig: { workersDev: true, minimalMode: true },
+        metadata: {
+            compatibilityDate: options.compatibilityDate ?? DEFAULT_COMPATIBILITY_DATE,
+            bindings: options.bindings,
+            mainModule: options.files[0].name,
+        },
+        // Distilled's generated schema expects a mutable array; our
+        // public surface keeps `readonly` so callers can pass a frozen
+        // tuple without a cast on their side.
+        files: options.files.slice(),
+    }).pipe(Effect.timeout(30_000));
+});
+const workerHost = (scriptName) => Effect.gen(function* () {
+    const env = yield* CloudflareEnvironment;
+    const getSubdomain = yield* workers.getSubdomain;
+    const { subdomain } = yield* getSubdomain({ accountId: env.accountId });
+    return `${scriptName}.${subdomain}.workers.dev`;
+});
+/**
+ * Upload a short-lived preview worker to Cloudflare's edge and
+ * return its URL plus the headers needed to reach it.
+ *
+ * Preview workers are ephemeral: they live only while a client keeps
+ * sending requests with the returned preview token and expire soon
+ * after. Nothing is deployed or billed.
+ */
+export const createEdgeSession = (options) => Effect.gen(function* () {
+    const [{ previewToken }, host] = yield* Effect.all([
+        createUploadToken.pipe(Effect.flatMap((t) => uploadScript(options, t))),
+        workerHost(options.scriptName),
+    ], { concurrency: "unbounded" });
+    return {
+        url: `https://${host}`,
+        headers: { "cf-workers-preview-token": previewToken },
+    };
+}).pipe((e) => wrap(e, "Failed to create edge preview session"));
+//# sourceMappingURL=EdgeSession.js.map

package/lib/Cloudflare/EdgeSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EdgeSession.js","sourceRoot":"","sources":["../../src/Cloudflare/EdgeSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AACtE,OAAO,KAAK,OAAO,MAAM,qCAAqC,CAAC;AAC/D,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAcnE,MAAM,OAAO,gBAAiB,SAAQ,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAGvE;CAAG;AA0BL,MAAM,0BAA0B,GAAG,YAAY,CAAC;AAEhD,MAAM,IAAI,GAAG,CAAU,MAA8B,EAAE,OAAe,EAAE,EAAE,CACxE,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CACrE,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC1C,MAAM,iCAAiC,GACrC,KAAK,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC;IACnD,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,iCAAiC,CAAC;QACtE,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAC7B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EACtB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAe,CAAC,CAAC,CACpD,CAAC;IACF,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,OAAO,IAAI,IAAI;QACf,OAAQ,IAAgC,CAAC,KAAK,KAAK,QAAQ,EAC3D,CAAC;QACD,OAAQ,IAA0B,CAAC,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,OAA2B,EAAE,WAAmB,EAAE,EAAE,CACxE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC;IACzC,MAAM,uBAAuB,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;IACvE,OAAO,KAAK,CAAC,CAAC,uBAAuB,CAAC;QACpC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,0BAA0B,EAAE,WAAW;QACvC,qBAAqB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;QAC9D,QAAQ,EAAE;YACR,iBAAiB,EACf,OAAO,CAAC,iBAAiB,IAAI,0BAA0B;YACzD,QAAQ,EAAE,OAAO,CAAC,QAAoC;YACtD,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI;SACnC;QACD,4DAA4D;QAC5D,+DAA+D;QAC/D,sCAAsC;QACtC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE;KAC7B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEL,MAAM,UAAU,GAAG,CAAC,UAAkB,EAAE,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC;IACzC,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACjD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IACxE,OAAO,GAAG,UAAU,IAAI,SAAS,cAAc,CAAC;AAClD,CAAC,CAAC,CAAC;AAEL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,OAA2B,EAK3B,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,CAAC,EAAE,YAAY,EAAE,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAChD;QACE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACvE,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC;KAC/B,EACD,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;IACF,OAAO;QACL,GAAG,EAAE,WAAW,IAAI,EAAE;QACtB,OAAO,EAAE,EAAE,0BAA0B,EAAE,YAAY,EAAE;KAC1B,CAAC;AAChC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,uCAAuC,CAAC,CAAC,CAAC"}

package/lib/Cloudflare/Providers.d.ts

@@ -12,5 +12,5 @@ export type ProviderRequirements = Layer.Services<ReturnType<typeof providers>>;
 /**
  * Cloudflare providers, bindings, and credentials for Worker-based stacks.
  */
-export declare const providers: () => Layer.Layer<Provider.Provider<Random> | Provider.Provider<Command> | Containers.Credentials | CloudflareEnvironment.CloudflareEnvironment | Providers, never, import("effect/Scope").Scope | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/HttpClient").HttpClient | import("../Auth/AuthProvider.ts").AuthProviders | import("../Config.ts").DotAlchemy | import("../Stage.ts").Stage | import("../Stack.ts").Stack>;
+export declare const providers: () => Layer.Layer<Provider.Provider<Random> | Provider.Provider<Command> | Containers.Credentials | CloudflareEnvironment.CloudflareEnvironment | Providers, never, import("../AlchemyContext.ts").AlchemyContext | import("effect/Path").Path | import("effect/FileSystem").FileSystem | import("effect/Scope").Scope | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("effect/unstable/http/HttpClient").HttpClient | import("../Auth/AuthProvider.ts").AuthProviders | import("../Stage.ts").Stage | import("../Stack.ts").Stack>;
 //# sourceMappingURL=Providers.d.ts.map

package/lib/Cloudflare/Providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../../src/Cloudflare/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAkB,MAAM,cAAc,CAAC;AAEtD,OAAO,KAAK,qBAAqB,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,UAAU,MAAM,sBAAsB,CAAC;AAUnD,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;;AAEtE,qBAAa,SAAU,SAAQ,cAE9B;CAAG;AAEJ,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,SAAS,8hBAqDnB,CAAC"}
+{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../../src/Cloudflare/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAkB,MAAM,cAAc,CAAC;AAGtD,OAAO,KAAK,qBAAqB,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,UAAU,MAAM,sBAAsB,CAAC;AAUnD,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;;AAEtE,qBAAa,SAAU,SAAQ,cAE9B;CAAG;AAEJ,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,SAAS,0iBAyDnB,CAAC"}

package/lib/Cloudflare/Providers.js

@@ -3,6 +3,7 @@ import { Command } from "../Build/Command.js";
 import * as Build from "../Build/index.js";
 import * as Provider from "../Provider.js";
 import { Random, RandomProvider } from "../Random.js";
+import * as ApiToken from "./ApiToken/index.js";
 import { CloudflareAuth } from "./Auth/AuthProvider.js";
 import * as CloudflareEnvironment from "./CloudflareEnvironment.js";
 import * as Containers from "./Container/index.js";
@@ -21,6 +22,8 @@ export class Providers extends Provider.ProviderCollection()("Cloudflare") {
  * Cloudflare providers, bindings, and credentials for Worker-based stacks.
  */
 export const providers = () => Layer.effect(Providers, Provider.collection([
+    ApiToken.AccountApiToken,
+    ApiToken.UserApiToken,
     Command,
     Containers.Container,
     D1.D1ConnectionPolicy,
@@ -40,5 +43,5 @@ export const providers = () => Layer.effect(Providers, Provider.collection([
     Workers.FetchPolicy,
     Workers.Worker,
     Workflows.WorkflowResource,
-])).pipe(Layer.provide(Layer.mergeAll(Containers.ContainerProvider(), D1.D1ConnectionPolicyLive, D1.DatabaseProvider(), KV.KVNamespaceBindingPolicyLive, KV.KVNamespaceProvider(), Queue.QueueBindingPolicyLive, Queue.QueueProvider(), Queue.QueueConsumerProvider(), R2.R2BucketBindingPolicyLive, R2.R2BucketProvider(), SecretsStore.SecretBindingPolicyLive, SecretsStore.SecretsStoreProvider(), SecretsStore.StoreSecretProvider(), Workers.BindWorkerPolicyLive, Workers.FetchPolicyLive, Workers.WorkerProvider(), Workflows.WorkflowProvider())), Layer.provideMerge(Layer.mergeAll(Build.CommandProvider(), RandomProvider())), Layer.provideMerge(Credentials.fromAuthProvider()), Layer.provideMerge(CloudflareEnvironment.fromProfile()), Layer.provideMerge(CloudflareAuth), Layer.orDie);
+])).pipe(Layer.provide(Layer.mergeAll(ApiToken.AccountApiTokenProvider(), ApiToken.UserApiTokenProvider(), Containers.ContainerProvider(), D1.D1ConnectionPolicyLive, D1.DatabaseProvider(), KV.KVNamespaceBindingPolicyLive, KV.KVNamespaceProvider(), Queue.QueueBindingPolicyLive, Queue.QueueProvider(), Queue.QueueConsumerProvider(), R2.R2BucketBindingPolicyLive, R2.R2BucketProvider(), SecretsStore.SecretBindingPolicyLive, SecretsStore.SecretsStoreProvider(), SecretsStore.StoreSecretProvider(), Workers.BindWorkerPolicyLive, Workers.FetchPolicyLive, Workers.WorkerProvider(), Workflows.WorkflowProvider())), Layer.provideMerge(Layer.mergeAll(Build.CommandProvider(), RandomProvider())), Layer.provideMerge(Credentials.fromAuthProvider()), Layer.provideMerge(CloudflareEnvironment.fromProfile()), Layer.provideMerge(CloudflareAuth), Layer.orDie);
 //# sourceMappingURL=Providers.js.map

package/lib/Cloudflare/Providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../../src/Cloudflare/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,qBAAqB,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,UAAU,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,KAAK,KAAK,MAAM,kBAAkB,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,KAAK,YAAY,MAAM,yBAAyB,CAAC;AACxD,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAC;AAC9C,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAEtE,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CACrE,YAAY,CACb;CAAG;AAIJ;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC;IAClB,OAAO;IACP,UAAU,CAAC,SAAS;IACpB,EAAE,CAAC,kBAAkB;IACrB,EAAE,CAAC,UAAU;IACb,EAAE,CAAC,WAAW;IACd,EAAE,CAAC,wBAAwB;IAC3B,KAAK,CAAC,KAAK;IACX,KAAK,CAAC,kBAAkB;IACxB,KAAK,CAAC,aAAa;IACnB,EAAE,CAAC,QAAQ;IACX,EAAE,CAAC,qBAAqB;IACxB,YAAY,CAAC,mBAAmB;IAChC,YAAY,CAAC,YAAY;IACzB,YAAY,CAAC,MAAM;IACnB,MAAM;IACN,OAAO,CAAC,gBAAgB;IACxB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,MAAM;IACd,SAAS,CAAC,gBAAgB;CAC3B,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,UAAU,CAAC,iBAAiB,EAAE,EAC9B,EAAE,CAAC,sBAAsB,EACzB,EAAE,CAAC,gBAAgB,EAAE,EACrB,EAAE,CAAC,4BAA4B,EAC/B,EAAE,CAAC,mBAAmB,EAAE,EACxB,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,aAAa,EAAE,EACrB,KAAK,CAAC,qBAAqB,EAAE,EAC7B,EAAE,CAAC,yBAAyB,EAC5B,EAAE,CAAC,gBAAgB,EAAE,EACrB,YAAY,CAAC,uBAAuB,EACpC,YAAY,CAAC,oBAAoB,EAAE,EACnC,YAAY,CAAC,mBAAmB,EAAE,EAClC,OAAO,CAAC,oBAAoB,EAC5B,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,cAAc,EAAE,EACxB,SAAS,CAAC,gBAAgB,EAAE,CAC7B,CACF,EACD,KAAK,CAAC,YAAY,CAChB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,cAAc,EAAE,CAAC,CAC1D,EACD,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,EAClD,KAAK,CAAC,YAAY,CAAC,qBAAqB,CAAC,WAAW,EAAE,CAAC,EACvD,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,EAClC,KAAK,CAAC,KAAK,CACZ,CAAC"}
+{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../../src/Cloudflare/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,qBAAqB,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,UAAU,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,KAAK,KAAK,MAAM,kBAAkB,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,KAAK,YAAY,MAAM,yBAAyB,CAAC;AACxD,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAC;AAC9C,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAEtE,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CACrE,YAAY,CACb;CAAG;AAIJ;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC;IAClB,QAAQ,CAAC,eAAe;IACxB,QAAQ,CAAC,YAAY;IACrB,OAAO;IACP,UAAU,CAAC,SAAS;IACpB,EAAE,CAAC,kBAAkB;IACrB,EAAE,CAAC,UAAU;IACb,EAAE,CAAC,WAAW;IACd,EAAE,CAAC,wBAAwB;IAC3B,KAAK,CAAC,KAAK;IACX,KAAK,CAAC,kBAAkB;IACxB,KAAK,CAAC,aAAa;IACnB,EAAE,CAAC,QAAQ;IACX,EAAE,CAAC,qBAAqB;IACxB,YAAY,CAAC,mBAAmB;IAChC,YAAY,CAAC,YAAY;IACzB,YAAY,CAAC,MAAM;IACnB,MAAM;IACN,OAAO,CAAC,gBAAgB;IACxB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,MAAM;IACd,SAAS,CAAC,gBAAgB;CAC3B,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,QAAQ,CAAC,uBAAuB,EAAE,EAClC,QAAQ,CAAC,oBAAoB,EAAE,EAC/B,UAAU,CAAC,iBAAiB,EAAE,EAC9B,EAAE,CAAC,sBAAsB,EACzB,EAAE,CAAC,gBAAgB,EAAE,EACrB,EAAE,CAAC,4BAA4B,EAC/B,EAAE,CAAC,mBAAmB,EAAE,EACxB,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,aAAa,EAAE,EACrB,KAAK,CAAC,qBAAqB,EAAE,EAC7B,EAAE,CAAC,yBAAyB,EAC5B,EAAE,CAAC,gBAAgB,EAAE,EACrB,YAAY,CAAC,uBAAuB,EACpC,YAAY,CAAC,oBAAoB,EAAE,EACnC,YAAY,CAAC,mBAAmB,EAAE,EAClC,OAAO,CAAC,oBAAoB,EAC5B,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,cAAc,EAAE,EACxB,SAAS,CAAC,gBAAgB,EAAE,CAC7B,CACF,EACD,KAAK,CAAC,YAAY,CAChB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,cAAc,EAAE,CAAC,CAC1D,EACD,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,EAClD,KAAK,CAAC,YAAY,CAAC,qBAAqB,CAAC,WAAW,EAAE,CAAC,EACvD,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,EAClC,KAAK,CAAC,KAAK,CACZ,CAAC"}

package/lib/Cloudflare/StateStore/Api.d.ts

@@ -0,0 +1,61 @@
+import * as Effect from "effect/Effect";
+export declare const STATE_STORE_SCRIPT_NAME: "alchemy-state-store";
+declare const _default: Effect.Effect<import("effect/Pipeable").Pipeable & import("../../Resource.ts").ResourceLike<"Cloudflare.Worker", import("../index.ts").WorkerProps<any, import("../index.ts").WorkerAssetsConfig | undefined>, {
+    workerId: string;
+    workerName: string;
+    logpush: boolean | undefined;
+    url: string | undefined;
+    tags: string[] | undefined;
+    durableObjectNamespaces: Record<string, string>;
+    accountId: string;
+    domains: {
+        hostname: string;
+        id: string;
+        zoneId: string;
+    }[];
+    hash?: {
+        assets: string | undefined;
+        bundle: string | undefined;
+        input: string | undefined;
+    };
+}, {
+    bindings?: import("../index.ts").WorkerBinding[];
+    containers?: {
+        className: string;
+    }[];
+}, import("../Providers.ts").Providers> & {
+    bind(sid: string, binding: import("../../Input.ts").Input<{
+        bindings?: import("../index.ts").WorkerBinding[];
+        containers?: {
+            className: string;
+        }[];
+    }>): Effect.Effect<void>;
+    bind(template: TemplateStringsArray, ...args: any[]): (binding: import("../../Input.ts").Input<{
+        bindings?: import("../index.ts").WorkerBinding[];
+        containers?: {
+            className: string;
+        }[];
+    }>) => Effect.Effect<void>;
+} & {
+    workerId: import("../../Output.ts").Output<string, never>;
+    workerName: import("../../Output.ts").Output<string, never>;
+    logpush: import("../../Output.ts").Output<boolean | undefined, never>;
+    url: import("../../Output.ts").Output<string | undefined, never>;
+    tags: import("../../Output.ts").Output<string[] | undefined, never>;
+    durableObjectNamespaces: import("../../Output.ts").Output<Record<string, string>, never>;
+    accountId: import("../../Output.ts").Output<string, never>;
+    domains: import("../../Output.ts").Output<{
+        hostname: string;
+        id: string;
+        zoneId: string;
+    }[], never>;
+    hash: import("../../Output.ts").Output<{
+        assets: string | undefined;
+        bundle: string | undefined;
+        input: string | undefined;
+    } | undefined, never>;
+} & import("../../Platform.ts").Rpc<{
+    fetch: Effect.Effect<Effect.Effect<import("effect/unstable/http/HttpServerResponse").HttpServerResponse, import("effect/unstable/http/HttpServerError").HttpServerError, import("effect/Scope").Scope | import("effect/unstable/http/HttpServerRequest").HttpServerRequest>, never, import("effect/FileSystem").FileSystem | import("effect/Scope").Scope | import("../index.ts").WorkerEnvironment>;
+}>, never, import("../Providers.ts").Providers>;
+export default _default;
+//# sourceMappingURL=Api.d.ts.map

package/lib/Cloudflare/StateStore/Api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Api.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/StateStore/Api.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAexC,eAAO,MAAM,uBAAuB,EAAG,qBAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEtE,wBA6GE"}

package/lib/Cloudflare/StateStore/Api.js

@@ -0,0 +1,103 @@
+import { BearerTokenValidator, StateApi, StateAuthLive, } from "alchemy/State/HttpStateApi";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as Etag from "effect/unstable/http/Etag";
+import * as HttpPlatform from "effect/unstable/http/HttpPlatform";
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import * as HttpApiError from "effect/unstable/httpapi/HttpApiError";
+import crypto from "node:crypto";
+import { SecretBindingLive } from "../SecretsStore/SecretBinding.js";
+import * as Secret from "../SecretsStore/Secret.js";
+import { Worker } from "../Workers/Worker.js";
+import Store from "./Store.js";
+import { AuthToken } from "./Token.js";
+export const STATE_STORE_SCRIPT_NAME = "alchemy-state-store";
+export default Worker("Api", {
+    name: STATE_STORE_SCRIPT_NAME,
+    main: import.meta.path,
+    url: true,
+    compatibility: {
+        flags: ["nodejs_compat"],
+        date: "2026-03-17",
+    },
+}, Effect.gen(function* () {
+    const secret = yield* Secret.Secret.bind(AuthToken);
+    const store = yield* Store;
+    const bearerTokenValidator = Layer.effect(BearerTokenValidator, secret.get().pipe(Effect.map((expected) => BearerTokenValidator.of({
+        validate: (token) => !!expected && timingSafeEqual(token, expected)
+            ? Effect.void
+            : Effect.fail(new HttpApiError.Unauthorized()),
+    })), Effect.orDie));
+    const stateApi = HttpApiBuilder.group(StateApi, "state", (handlers) => handlers
+        .handle("listStacks", () => store.getByName(Store.ROOT_DO_NAME).listStacks())
+        .handle("listStages", ({ params }) => store.getByName(params.stack).listStages())
+        .handle("listResources", ({ params }) => store.getByName(params.stack).listResources({ stage: params.stage }))
+        .handle("getState", ({ params }) => store
+        .getByName(params.stack)
+        .get({ stage: params.stage, fqn: decodeURIComponent(params.fqn) }))
+        .handle("setState", ({ params, payload }) => store
+        .getByName(params.stack)
+        .set({
+        stage: params.stage,
+        fqn: decodeURIComponent(params.fqn),
+        value: payload,
+    })
+        .pipe(Effect.tap(() => store
+        .getByName(Store.ROOT_DO_NAME)
+        .registerStack({ stack: params.stack }))))
+        .handle("deleteState", ({ params }) => 
+    // The DO method is `remove`, not `delete` — `delete` is
+    // reserved by Cloudflare's RPC stub proxy.
+    store
+        .getByName(params.stack)
+        .remove({
+        stage: params.stage,
+        fqn: decodeURIComponent(params.fqn),
+    })
+        .pipe(Effect.asVoid))
+        .handle("getReplacedResources", ({ params }) => store
+        .getByName(params.stack)
+        .getReplacedResources({ stage: params.stage }))
+        .handle("deleteStack", ({ params, query }) => store
+        .getByName(params.stack)
+        .deleteStack(query.stage === undefined ? {} : { stage: query.stage })
+        .pipe(Effect.flatMap(() => query.stage === undefined
+        ? store
+            .getByName(Store.ROOT_DO_NAME)
+            .unregisterStack({ stack: params.stack })
+        : Effect.void), Effect.asVoid)));
+    return {
+        fetch: HttpApiBuilder.layer(StateApi).pipe(Layer.provide(stateApi), Layer.provide(StateAuthLive), Layer.provide(bearerTokenValidator), 
+        // The state-store worker never serves files, so HttpPlatform's
+        // file-response surface is stubbed.
+        Layer.provide([Etag.layer, HttpPlatformStub, Path.layer]), HttpRouter.toHttpEffect),
+    };
+}).pipe(Effect.provide(Layer.mergeAll(SecretBindingLive))));
+/**
+ * Stub `HttpPlatform` for the worker. The state-store API never
+ * issues file responses, so both surface methods die if invoked. Lets
+ * us avoid pulling in a `FileSystem` dependency that workers don't
+ * have.
+ */
+const HttpPlatformStub = Layer.succeed(HttpPlatform.HttpPlatform, {
+    fileResponse: () => Effect.die("HttpPlatform.fileResponse not supported"),
+    fileWebResponse: () => Effect.die("HttpPlatform.fileWebResponse not supported"),
+});
+/**
+ * Timing-safe string comparison using the Workers runtime's built-in
+ * `crypto.subtle.timingSafeEqual`.
+ *
+ * @see https://developers.cloudflare.com/workers/examples/protect-against-timing-attacks/
+ */
+const timingSafeEqual = (a, b) => {
+    const encoder = new TextEncoder();
+    const aBytes = encoder.encode(a);
+    const bBytes = encoder.encode(b);
+    if (aBytes.byteLength !== bBytes.byteLength)
+        return false;
+    // @ts-expect-error - TODO(sam)
+    return crypto.subtle.timingSafeEqual(aBytes, bBytes);
+};
+//# sourceMappingURL=Api.js.map

package/lib/Cloudflare/StateStore/Api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Api.js","sourceRoot":"","sources":["../../../src/Cloudflare/StateStore/Api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,IAAI,MAAM,2BAA2B,CAAC;AAClD,OAAO,KAAK,YAAY,MAAM,mCAAmC,CAAC;AAClE,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,cAAc,MAAM,wCAAwC,CAAC;AACzE,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAC;AACrE,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAA8B,CAAC;AAEtE,eAAe,MAAM,CACnB,KAAK,EACL;IACE,IAAI,EAAE,uBAAuB;IAC7B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;IACtB,GAAG,EAAE,IAAI;IACT,aAAa,EAAE;QACb,KAAK,EAAE,CAAC,eAAe,CAAC;QACxB,IAAI,EAAE,YAAY;KACnB;CACF,EACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAE3B,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,CACvC,oBAAoB,EACpB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CACf,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtB,oBAAoB,CAAC,EAAE,CAAC;QACtB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,CAAC,CAAC,QAAQ,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC5C,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;KACnD,CAAC,CACH,EACD,MAAM,CAAC,KAAK,CACb,CACF,CAAC;IAEF,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACpE,QAAQ;SACL,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,CACzB,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CACjD;SACA,MAAM,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACnC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,CAC3C;SACA,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACtC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CACrE;SACA,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACjC,KAAK;SACF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;SACvB,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CACrE;SACA,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAC1C,KAAK;SACF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;SACvB,GAAG,CAAC;QACH,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,EAAE,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC;QACnC,KAAK,EAAE,OAAc;KACtB,CAAC;SACD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CACd,KAAK;SACF,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;SAC7B,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAC1C,CACF,CACJ;SACA,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;IACpC,wDAAwD;IACxD,2CAA2C;IAC3C,KAAK;SACF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;SACvB,MAAM,CAAC;QACN,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,EAAE,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC;KACpC,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CACvB;SACA,MAAM,CAAC,sBAAsB,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAC7C,KAAK;SACF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;SACvB,oBAAoB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CACjD;SACA,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAC3C,KAAK;SACF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;SACvB,WAAW,CACV,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACxD;SACA,IAAI,CACH,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAClB,KAAK,CAAC,KAAK,KAAK,SAAS;QACvB,CAAC,CAAC,KAAK;aACF,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;aAC7B,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,IAAI,CAChB,EACD,MAAM,CAAC,MAAM,CACd,CACJ,CACJ,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CACxC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvB,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAC5B,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACnC,+DAA+D;QAC/D,oCAAoC;QACpC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EACzD,UAAU,CAAC,YAAY,CACxB;KACF,CAAC;AACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAC3D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE;IAChE,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC;IACzE,eAAe,EAAE,GAAG,EAAE,CACpB,MAAM,CAAC,GAAG,CAAC,4CAA4C,CAAC;CAC3D,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IACxD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC1D,+BAA+B;IAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC,CAAC"}

package/lib/Cloudflare/StateStore/State.d.ts

@@ -0,0 +1,39 @@
+import * as SecretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as Config from "effect/Config";
+import { AuthError } from "../../Auth/AuthProvider.ts";
+import * as Cloudflare from "../../Cloudflare/Providers.ts";
+import * as CloudflareEnvironment from "../CloudflareEnvironment.ts";
+import { AlchemyContext } from "../../AlchemyContext.ts";
+import { State } from "../../State/State.ts";
+export declare const state: (props?: {
+    /**
+     * The name of the script to use for the state store.
+     * @default "alchemy-state-store"
+     */
+    workerName?: string;
+}) => Layer.Layer<State | Cloudflare.Credentials | CloudflareEnvironment.CloudflareEnvironment, never, AlchemyContext | import("effect/Path").Path | import("effect/FileSystem").FileSystem | HttpClient.HttpClient | import("../../Auth/AuthProvider.ts").AuthProviders | import("../../Cli/Cli.ts").Cli>;
+/**
+ * Log in to a Cloudflare-deployed HTTP state-store.
+ *
+ * 1. Find the single account-wide Secrets Store.
+ * 2. Upload a short-lived edge-preview worker that binds the
+ *    auth-token secret and returns its value.
+ * 3. Derive the state-store worker URL from
+ *    {@link STATE_STORE_SCRIPT_NAME} and the account's workers.dev
+ *    subdomain.
+ * 4. Persist `{ url, token }` under the `http-state-store`
+ *    credentials file.
+ *
+ * Requirements are covered by the Cloudflare provider stack —
+ * `CloudflareEnvironment`, `Credentials`, `HttpClient`, and
+ * `FileSystem`.
+ */
+export declare const loginWithCloudflare: () => Effect.Effect<{
+    url: string;
+    authToken: string;
+}, Config.ConfigError | AuthError | import("@distilled.cloud/cloudflare").Unauthorized | import("@distilled.cloud/cloudflare").TooManyRequests | import("@distilled.cloud/cloudflare").InternalServerError | import("@distilled.cloud/cloudflare").BadGateway | import("@distilled.cloud/cloudflare").ServiceUnavailable | import("@distilled.cloud/cloudflare").GatewayTimeout | import("@distilled.cloud/cloudflare").CloudflareHttpError | import("@distilled.cloud/cloudflare").CloudflareParseError | import("@distilled.cloud/cloudflare").UnknownCloudflareError | workers.InvalidRoute | SecretsStore.InvalidAccountId, import("effect/FileSystem").FileSystem | HttpClient.HttpClient | Cloudflare.Credentials | CloudflareEnvironment.CloudflareEnvironment>;
+//# sourceMappingURL=State.d.ts.map

package/lib/Cloudflare/StateStore/State.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"State.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/StateStore/State.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,YAAY,MAAM,2CAA2C,CAAC;AAC1E,OAAO,KAAK,OAAO,MAAM,qCAAqC,CAAC;AAE/D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAE9D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAGvD,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAO5D,OAAO,KAAK,qBAAqB,MAAM,6BAA6B,CAAC;AAGrE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,KAAK,EAAqB,MAAM,sBAAsB,CAAC;AAWhE,eAAO,MAAM,KAAK,GAAI,QAAQ;IAC5B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,ySAuGE,CAAC;AAoCJ;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB;;;suBA6D7B,CAAC"}

package/lib/Cloudflare/StateStore/State.js

@@ -0,0 +1,217 @@
+import * as SecretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as Output from "alchemy/Output";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as Config from "effect/Config";
+import { AuthError } from "../../Auth/AuthProvider.js";
+import { readCredentials, writeCredentials } from "../../Auth/Credentials.js";
+import { ALCHEMY_PROFILE } from "../../Auth/Profile.js";
+import * as Cloudflare from "../../Cloudflare/Providers.js";
+import { deploy } from "../../Deploy.js";
+import * as Alchemy from "../../Stack.js";
+import { makeHttpStateStore, } from "../../State/HttpStateStore.js";
+import * as CloudflareEnvironment from "../CloudflareEnvironment.js";
+import * as Credentials from "../Credentials.js";
+import { AlchemyContext } from "../../AlchemyContext.js";
+import { makeLocalState } from "../../State/LocalState.js";
+import { State } from "../../State/State.js";
+import { syncState } from "../../State/Sync.js";
+import * as Clank from "../../Util/Clank.js";
+import { CloudflareAuth } from "../Auth/AuthProvider.js";
+import { EdgeSessionError, createEdgeSession } from "../EdgeSession.js";
+import Api, { STATE_STORE_SCRIPT_NAME } from "./Api.js";
+import { AuthTokenSecretName, TokenValue } from "./Token.js";
+/** Filename used for stored credentials under the profile directory. */
+const CREDENTIALS_FILE = "cloudflare-state-store";
+export const state = (props) => Layer.effect(State, Effect.gen(function* () {
+    const isCI = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+    const alchemyContext = yield* AlchemyContext;
+    const profileName = yield* ALCHEMY_PROFILE;
+    const credentials = yield* readCredentials(profileName, CREDENTIALS_FILE);
+    const scriptName = props?.workerName ?? STATE_STORE_SCRIPT_NAME;
+    // TODO(sam): support upgrading state store, right now we only deploy once
+    if (credentials) {
+        // it's in the profile, let's go
+        const httpState = yield* makeHttpStateStore(credentials);
+        if (alchemyContext.updateStateStore) {
+            yield* deployStateStore(scriptName, httpState);
+        }
+        return httpState;
+    }
+    else {
+        // our profile does not contain a reference to the state store, let's try and resolve it
+        const { accountId } = yield* CloudflareEnvironment.CloudflareEnvironment;
+        const workerExists = yield* workers
+            .getScriptSetting({
+            accountId,
+            scriptName,
+        })
+            .pipe(Effect.map((setting) => setting !== undefined), Effect.catchTag("WorkerNotFound", () => Effect.succeed(false)));
+        if (workerExists) {
+            // it exists, so fetch the secret token
+            const credentials = yield* loginWithCloudflare();
+            if (!isCI) {
+                yield* writeCredentials(profileName, CREDENTIALS_FILE, credentials);
+            }
+            const httpState = yield* makeHttpStateStore(credentials);
+            if (alchemyContext.updateStateStore) {
+                yield* deployStateStore(scriptName, httpState);
+            }
+            return httpState;
+        }
+        else if (isCI) {
+            // TODO(sam): do we want to support bootstrapping the state store from CI?
+            // for now - just die here
+            return yield* Effect.die(new AuthError({
+                message: `State store not found for script ${scriptName}. Deploy the state store first.`,
+            }));
+        }
+        const shouldDeploy = yield* Clank.confirm({
+            message: "Cloudflare State Store not found. Do you want to deploy it?",
+        });
+        if (!shouldDeploy) {
+            return yield* Effect.die(new Clank.PromptCancelled());
+        }
+        const { url, authToken, localState } = yield* deployStateStore(scriptName);
+        const httpState = yield* makeHttpStateStore({ url, authToken });
+        yield* syncState(localState, httpState);
+        yield* writeCredentials(profileName, CREDENTIALS_FILE, {
+            url,
+            authToken,
+        });
+        yield* localState.deleteStack({
+            stack: "CloudflareStateStore",
+            stage: scriptName,
+        });
+        return httpState;
+    }
+}).pipe(Effect.orDie)).pipe(Layer.provideMerge(Credentials.fromAuthProvider()), Layer.provideMerge(CloudflareEnvironment.fromProfile()), Layer.provideMerge(CloudflareAuth), Layer.orDie);
+const deployStateStore = (scriptName, state) => Effect.gen(function* () {
+    const localState = state ?? (yield* makeLocalState());
+    // deploy it with local state (which we will then hoist into the Cloudflare state store)
+    const stateLayer = Layer.succeed(State, localState);
+    const { url, authToken } = yield* deploy({
+        // use the script name as the stage name (so the user can have multiple state stores)
+        stage: scriptName,
+        stack: Alchemy.Stack("CloudflareStateStore", {
+            providers: Cloudflare.providers(),
+            state: stateLayer,
+        }, Effect.gen(function* () {
+            const token = yield* TokenValue;
+            const api = yield* Api;
+            // Surface the bearer token so tests and clients can authenticate
+            // after deploy. The underlying value lives in the Cloudflare
+            // Secrets Store; this output carries the same generated string.
+            return {
+                url: api.url.as(),
+                authToken: token.text.pipe(Output.map(Redacted.value)),
+            };
+        })),
+    }).pipe(
+    // TODO(sam): we should not need to do this, but types do complain. fix deploy
+    Effect.provide(stateLayer));
+    return { url, authToken, localState };
+});
+/**
+ * Log in to a Cloudflare-deployed HTTP state-store.
+ *
+ * 1. Find the single account-wide Secrets Store.
+ * 2. Upload a short-lived edge-preview worker that binds the
+ *    auth-token secret and returns its value.
+ * 3. Derive the state-store worker URL from
+ *    {@link STATE_STORE_SCRIPT_NAME} and the account's workers.dev
+ *    subdomain.
+ * 4. Persist `{ url, token }` under the `http-state-store`
+ *    credentials file.
+ *
+ * Requirements are covered by the Cloudflare provider stack —
+ * `CloudflareEnvironment`, `Credentials`, `HttpClient`, and
+ * `FileSystem`.
+ */
+export const loginWithCloudflare = () => Effect.gen(function* () {
+    const isCI = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+    const profileName = yield* ALCHEMY_PROFILE;
+    const { accountId } = yield* CloudflareEnvironment.CloudflareEnvironment;
+    // 1. Locate the single Secrets Store on the account.
+    const stores = yield* SecretsStore.listStores({ accountId });
+    const store = stores.result[0];
+    if (!store) {
+        return yield* Effect.fail(new AuthError({
+            message: "No Secrets Store found on this account. Deploy the state store first.",
+        }));
+    }
+    // 2. Fetch the auth-token value via an edge-preview worker.
+    const authToken = yield* readSecretViaEdge(store.id, AuthTokenSecretName);
+    // 3. Derive the deployed worker URL.
+    const { subdomain } = yield* workers.getSubdomain({ accountId });
+    const url = `https://${STATE_STORE_SCRIPT_NAME}.${subdomain}.workers.dev`;
+    if (!isCI) {
+        // 4. Persist credentials. The profile entry is managed by
+        //    `loadOrConfigure` when this is invoked through `configure`.
+        yield* writeCredentials(profileName, CREDENTIALS_FILE, {
+            url,
+            authToken: authToken.trim(),
+        }).pipe(Effect.mapError((e) => new AuthError({ message: "Failed to write credentials", cause: e })));
+        yield* Clank.success(`HTTP state store credentials saved for '${profileName}'.`);
+        yield* Clank.info(`  url:     ${url}`);
+    }
+    return {
+        url,
+        authToken: authToken.trim(),
+    };
+}).pipe(Effect.catchTag("EdgeSessionError", (e) => Effect.fail(new AuthError({
+    message: `Edge-preview secret read failed: ${e.message}`,
+    cause: e.cause,
+}))));
+/** Preview script name used by the edge-probe worker. */
+const PROBE_SCRIPT_NAME = "alchemy-state-store-probe";
+/**
+ * Tiny ES-module worker that reads `env.SECRET.get()` and echoes it
+ * back. Uploaded as an ephemeral edge-preview, called once, then
+ * discarded — see {@link readSecretViaEdge}.
+ */
+const SECRET_PROBE_SOURCE = `export default {
+  async fetch(_request, env) {
+    try {
+      const value = await env.SECRET.get();
+      return new Response(value ?? "", { status: 200, headers: { "content-type": "text/plain" } });
+    } catch (e) {
+      return new Response("Error: " + (e && e.message ? e.message : String(e)), { status: 500 });
+    }
+  },
+};`;
+/**
+ * Upload a tiny edge-preview worker that binds the given Secrets
+ * Store secret, call it once, and return the decoded value. The
+ * Cloudflare REST API deliberately hides secret values; only worker
+ * bindings can resolve them, so this is the out-of-band path.
+ */
+const readSecretViaEdge = (storeId, secretName) => Effect.gen(function* () {
+    const http = yield* HttpClient.HttpClient;
+    const file = new File([SECRET_PROBE_SOURCE], "worker.js", {
+        type: "application/javascript+module",
+    });
+    const session = yield* createEdgeSession({
+        scriptName: PROBE_SCRIPT_NAME,
+        files: [file],
+        bindings: [
+            { type: "secrets_store_secret", name: "SECRET", secretName, storeId },
+        ],
+    });
+    const response = yield* http.get(session.url, {
+        headers: session.headers,
+    });
+    if (response.status !== 200) {
+        const body = yield* response.text.pipe(Effect.catch(() => Effect.succeed("")));
+        return yield* Effect.fail(new EdgeSessionError({
+            message: `Secret probe returned ${response.status}: ${body.slice(0, 200)}`,
+        }));
+    }
+    return yield* response.text;
+}).pipe(Effect.mapError((cause) => cause instanceof EdgeSessionError
+    ? cause
+    : new EdgeSessionError({ message: "Failed to read secret", cause })));
+//# sourceMappingURL=State.js.map