alchemy 2.0.0-beta.13 → 2.0.0-beta.15

package/src/Cloudflare/ApiToken/UserApiToken.ts

@@ -0,0 +1,168 @@
+import * as user from "@distilled.cloud/cloudflare/user";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  buildConditionPayload,
+  conditionFingerprint,
+  policyFingerprint,
+  resolvePolicies,
+  type BaseApiTokenProps,
+} from "./Common.ts";
+
+export type UserApiTokenProps = BaseApiTokenProps;
+
+export type UserApiToken = Resource<
+  "Cloudflare.UserApiToken",
+  UserApiTokenProps,
+  {
+    tokenId: string;
+    name: string;
+    status: "active" | "disabled" | "expired";
+    /**
+     * The plaintext token value. Cloudflare returns this only once, on
+     * creation, so we persist it here for downstream consumers.
+     */
+    value: Redacted.Redacted<string>;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A Cloudflare user-owned API token (`POST /user/tokens`).
+ *
+ * User-owned tokens are tied to the authenticated user's identity. They can
+ * be created by any authenticated user (including OAuth-derived sessions
+ * from `alchemy login`) without needing the account-level
+ * `API Tokens > Write` permission, but they are also revoked if the user
+ * leaves the account.
+ *
+ * For CI tokens, prefer {@link AccountApiToken} so the token survives
+ * personnel changes.
+ *
+ * Policy `resources` are passed through verbatim — no `accountId` rewriting
+ * is performed because user tokens aren't bound to a single account.
+ *
+ * @section Creating a Token
+ * @example A token bound to the authenticated user
+ * ```typescript
+ * const token = yield* Cloudflare.UserApiToken("personal-token", {
+ *   name: "my-personal-token",
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: ["Workers Scripts Read"],
+ *       resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+ *     },
+ *   ],
+ * });
+ * ```
+ */
+export const UserApiToken = Resource<UserApiToken>("Cloudflare.UserApiToken");
+
+type UserApiTokenAttributes = UserApiToken["Attributes"];
+
+const resolveName = (id: string, name: string | undefined) =>
+  Effect.gen(function* () {
+    return name ?? (yield* createPhysicalName({ id }));
+  });
+
+export const UserApiTokenProvider = () =>
+  Provider.effect(
+    UserApiToken,
+    Effect.gen(function* () {
+      const createToken = yield* user.createToken;
+      const updateToken = yield* user.updateToken;
+      const deleteToken = yield* user.deleteToken;
+      const getToken = yield* user.getToken;
+
+      const buildAttributes = (
+        tokenData: {
+          id?: string | null;
+          name?: string | null;
+          status?: "active" | "disabled" | "expired" | null;
+        },
+        value: Redacted.Redacted<string>,
+      ): UserApiTokenAttributes => ({
+        tokenId: tokenData.id ?? "",
+        name: tokenData.name ?? "",
+        status: tokenData.status ?? "active",
+        value,
+      });
+
+      return {
+        stables: ["tokenId"],
+        diff: Effect.fn(function* ({ id, olds, news, output }) {
+          if (!isResolved(news)) return undefined;
+          const oldName = output?.name ?? (yield* resolveName(id, olds?.name));
+          const newName = yield* resolveName(id, news.name);
+          const oldPolicyFp = policyFingerprint(
+            resolvePolicies(olds?.policies ?? [], undefined),
+          );
+          const newPolicyFp = policyFingerprint(
+            resolvePolicies(news.policies, undefined),
+          );
+          const oldCondFp = conditionFingerprint(olds?.condition);
+          const newCondFp = conditionFingerprint(news.condition);
+          if (
+            oldName !== newName ||
+            oldPolicyFp !== newPolicyFp ||
+            oldCondFp !== newCondFp ||
+            (olds?.expiresOn ?? undefined) !== (news.expiresOn ?? undefined) ||
+            (olds?.notBefore ?? undefined) !== (news.notBefore ?? undefined)
+          ) {
+            return { action: "update" } as const;
+          }
+        }),
+        create: Effect.fn(function* ({ id, news }) {
+          const name = yield* resolveName(id, news.name);
+          const policies = resolvePolicies(news.policies, undefined);
+          const result = yield* createToken({
+            name,
+            policies,
+            condition: buildConditionPayload(news.condition),
+            expiresOn: news.expiresOn,
+            notBefore: news.notBefore,
+          });
+          if (!result.value) {
+            return yield* Effect.die(
+              `Cloudflare did not return a value for token "${name}".`,
+            );
+          }
+          return buildAttributes(result, Redacted.make(result.value));
+        }),
+        update: Effect.fn(function* ({ id, news, output }) {
+          const name = yield* resolveName(id, news.name);
+          const policies = resolvePolicies(news.policies, undefined);
+          const result = yield* updateToken({
+            tokenId: output.tokenId,
+            name,
+            policies,
+            condition: buildConditionPayload(news.condition),
+            expiresOn: news.expiresOn,
+            notBefore: news.notBefore,
+          });
+          // Cloudflare doesn't return the value on update; preserve the
+          // value captured at creation.
+          return buildAttributes(result, output.value);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteToken({ tokenId: output.tokenId }).pipe(
+            Effect.catchTag("TokenNotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.tokenId) return undefined;
+          return yield* getToken({ tokenId: output.tokenId }).pipe(
+            Effect.map((token) => buildAttributes(token, output.value)),
+            Effect.catchTag("TokenNotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+      };
+    }),
+  );

package/src/Cloudflare/ApiToken/index.ts

@@ -0,0 +1,4 @@
+export * from "./AccountApiToken.ts";
+export * from "./Common.ts";
+export * from "./PermissionGroups.ts";
+export * from "./UserApiToken.ts";

package/src/Cloudflare/Auth/AuthProvider.ts

@@ -46,8 +46,8 @@ const options: Array<{
   },
   {
     value: "stored",
-    label: "Stored",
-    hint: "stored in ~/.alchemy/credentials",
+    label: "API Token or API Key",
+    hint: "enter credentials interactively, stored in ~/.alchemy/credentials",
   },
 ];
 

package/src/Cloudflare/Container/ContainerApplication.ts

@@ -5,6 +5,7 @@ import * as Option from "effect/Option";
 import * as Schedule from "effect/Schedule";
 import type * as rolldown from "rolldown";
 import { AdoptPolicy } from "../../AdoptPolicy.ts";
+import { AlchemyContext } from "../../AlchemyContext.ts";
 import * as Bundle from "../../Bundle/Bundle.ts";
 import {
   dockerBuild,
@@ -16,7 +17,6 @@ import {
   findCwdForBundle,
   getStableContextDir,
 } from "../../Bundle/TempRoot.ts";
-import { DotAlchemy } from "../../Config.ts";
 import { deepEqual, isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import {
@@ -359,7 +359,7 @@ export const ContainerProvider = () =>
       const adoptPolicy = yield* Effect.serviceOption(AdoptPolicy).pipe(
         Effect.map(Option.getOrElse(() => false)),
       );
-      const dotAlchemy = yield* DotAlchemy;
+      const { dotAlchemy } = yield* AlchemyContext;
       const fs = yield* FileSystem.FileSystem;
       const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
       const createContainerApplication =
@@ -498,6 +498,12 @@ export const ContainerProvider = () =>
                 ...external,
               ],
               platform: "node",
+              resolve: {
+                conditionNames:
+                  runtime === "bun"
+                    ? ["bun", "import", "module", "default"]
+                    : ["node", "import", "module", "default"],
+              },
               plugins,
               treeshake: true,
             },

package/src/Cloudflare/EdgeSession.ts

@@ -0,0 +1,144 @@
+import { Credentials } from "@distilled.cloud/cloudflare/Credentials";
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import { CloudflareEnvironment } from "./CloudflareEnvironment.ts";
+
+/**
+ * A "remote binding" as understood by the Cloudflare Workers
+ * edge-preview API. We reuse the distilled request schema so the
+ * shape tracks Cloudflare's surface.
+ */
+type EdgeMetadata = NonNullable<
+  NonNullable<workers.CreateScriptEdgePreviewRequest["metadata"]>
+>;
+export type EdgeBinding = NonNullable<
+  NonNullable<EdgeMetadata["bindings"]>
+>[number];
+
+export class EdgeSessionError extends Data.TaggedError("EdgeSessionError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+export interface EdgeSessionOptions {
+  /**
+   * Name used as the preview script identifier on Cloudflare's side.
+   * Shows up as the hostname: `{scriptName}.{subdomain}.workers.dev`.
+   */
+  readonly scriptName: string;
+  /** ES-module worker script(s). The first file is the entrypoint. */
+  readonly files: ReadonlyArray<File>;
+  /** Remote bindings attached to the preview worker. */
+  readonly bindings: ReadonlyArray<EdgeBinding>;
+  /** @default "2025-04-28" */
+  readonly compatibilityDate?: string;
+}
+
+/**
+ * Information needed to call a running edge-preview worker. Attach
+ * `headers` (including the `cf-workers-preview-token`) and fetch
+ * `url` or a path under it.
+ */
+export interface EdgeSessionHandle {
+  readonly url: string;
+  readonly headers: Record<string, string>;
+}
+
+const DEFAULT_COMPATIBILITY_DATE = "2025-04-28";
+
+const wrap = <A, E, R>(effect: Effect.Effect<A, E, R>, message: string) =>
+  effect.pipe(
+    Effect.mapError((cause) => new EdgeSessionError({ message, cause })),
+  );
+
+/**
+ * Ask Cloudflare for a preview upload token. Some accounts return an
+ * `exchangeUrl` that must be GET'd to swap the session token for a
+ * short-lived upload token; when present we do the swap, falling back
+ * to the original if the exchange fails.
+ */
+const createUploadToken = Effect.gen(function* () {
+  const env = yield* CloudflareEnvironment;
+  const http = yield* HttpClient.HttpClient;
+  const createSubdomainEdgePreviewSession =
+    yield* workers.createSubdomainEdgePreviewSession;
+  const { token, exchangeUrl } = yield* createSubdomainEdgePreviewSession({
+    accountId: env.accountId,
+  });
+  if (!exchangeUrl) return token;
+  const json = yield* http.get(exchangeUrl).pipe(
+    Effect.flatMap((r) => r.json),
+    Effect.timeout(30_000),
+    Effect.catch(() => Effect.succeed(null as unknown)),
+  );
+  if (
+    typeof json === "object" &&
+    json !== null &&
+    "token" in json &&
+    typeof (json as Record<string, unknown>).token === "string"
+  ) {
+    return (json as { token: string }).token;
+  }
+  return token;
+});
+
+const uploadScript = (options: EdgeSessionOptions, uploadToken: string) =>
+  Effect.gen(function* () {
+    const env = yield* CloudflareEnvironment;
+    const createScriptEdgePreview = yield* workers.createScriptEdgePreview;
+    return yield* createScriptEdgePreview({
+      accountId: env.accountId,
+      scriptName: options.scriptName,
+      cfPreviewUploadConfigToken: uploadToken,
+      wranglerSessionConfig: { workersDev: true, minimalMode: true },
+      metadata: {
+        compatibilityDate:
+          options.compatibilityDate ?? DEFAULT_COMPATIBILITY_DATE,
+        bindings: options.bindings as EdgeMetadata["bindings"],
+        mainModule: options.files[0]!.name,
+      },
+      // Distilled's generated schema expects a mutable array; our
+      // public surface keeps `readonly` so callers can pass a frozen
+      // tuple without a cast on their side.
+      files: options.files.slice(),
+    }).pipe(Effect.timeout(30_000));
+  });
+
+const workerHost = (scriptName: string) =>
+  Effect.gen(function* () {
+    const env = yield* CloudflareEnvironment;
+    const getSubdomain = yield* workers.getSubdomain;
+    const { subdomain } = yield* getSubdomain({ accountId: env.accountId });
+    return `${scriptName}.${subdomain}.workers.dev`;
+  });
+
+/**
+ * Upload a short-lived preview worker to Cloudflare's edge and
+ * return its URL plus the headers needed to reach it.
+ *
+ * Preview workers are ephemeral: they live only while a client keeps
+ * sending requests with the returned preview token and expire soon
+ * after. Nothing is deployed or billed.
+ */
+export const createEdgeSession = (
+  options: EdgeSessionOptions,
+): Effect.Effect<
+  EdgeSessionHandle,
+  EdgeSessionError,
+  CloudflareEnvironment | HttpClient.HttpClient | Credentials
+> =>
+  Effect.gen(function* () {
+    const [{ previewToken }, host] = yield* Effect.all(
+      [
+        createUploadToken.pipe(Effect.flatMap((t) => uploadScript(options, t))),
+        workerHost(options.scriptName),
+      ],
+      { concurrency: "unbounded" },
+    );
+    return {
+      url: `https://${host}`,
+      headers: { "cf-workers-preview-token": previewToken },
+    } satisfies EdgeSessionHandle;
+  }).pipe((e) => wrap(e, "Failed to create edge preview session"));

package/src/Cloudflare/Providers.ts

@@ -3,6 +3,7 @@ import { Command } from "../Build/Command.ts";
 import * as Build from "../Build/index.ts";
 import * as Provider from "../Provider.ts";
 import { Random, RandomProvider } from "../Random.ts";
+import * as ApiToken from "./ApiToken/index.ts";
 import { CloudflareAuth } from "./Auth/AuthProvider.ts";
 import * as CloudflareEnvironment from "./CloudflareEnvironment.ts";
 import * as Containers from "./Container/index.ts";
@@ -30,6 +31,8 @@ export const providers = () =>
   Layer.effect(
     Providers,
     Provider.collection([
+      ApiToken.AccountApiToken,
+      ApiToken.UserApiToken,
       Command,
       Containers.Container,
       D1.D1ConnectionPolicy,
@@ -53,6 +56,8 @@ export const providers = () =>
   ).pipe(
     Layer.provide(
       Layer.mergeAll(
+        ApiToken.AccountApiTokenProvider(),
+        ApiToken.UserApiTokenProvider(),
         Containers.ContainerProvider(),
         D1.D1ConnectionPolicyLive,
         D1.DatabaseProvider(),

package/src/Cloudflare/StateStore/Api.ts

@@ -0,0 +1,159 @@
+import {
+  BearerTokenValidator,
+  StateApi,
+  StateAuthLive,
+} from "alchemy/State/HttpStateApi";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as Etag from "effect/unstable/http/Etag";
+import * as HttpPlatform from "effect/unstable/http/HttpPlatform";
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import * as HttpApiError from "effect/unstable/httpapi/HttpApiError";
+import crypto from "node:crypto";
+import { SecretBindingLive } from "../SecretsStore/SecretBinding.ts";
+import * as Secret from "../SecretsStore/Secret.ts";
+import { Worker } from "../Workers/Worker.ts";
+import Store from "./Store.ts";
+import { AuthToken } from "./Token.ts";
+
+export const STATE_STORE_SCRIPT_NAME = "alchemy-state-store" as const;
+
+export default Worker(
+  "Api",
+  {
+    name: STATE_STORE_SCRIPT_NAME,
+    main: import.meta.path,
+    url: true,
+    compatibility: {
+      flags: ["nodejs_compat"],
+      date: "2026-03-17",
+    },
+  },
+  Effect.gen(function* () {
+    const secret = yield* Secret.Secret.bind(AuthToken);
+    const store = yield* Store;
+
+    const bearerTokenValidator = Layer.effect(
+      BearerTokenValidator,
+      secret.get().pipe(
+        Effect.map((expected) =>
+          BearerTokenValidator.of({
+            validate: (token) =>
+              !!expected && timingSafeEqual(token, expected)
+                ? Effect.void
+                : Effect.fail(new HttpApiError.Unauthorized()),
+          }),
+        ),
+        Effect.orDie,
+      ),
+    );
+
+    const stateApi = HttpApiBuilder.group(StateApi, "state", (handlers) =>
+      handlers
+        .handle("listStacks", () =>
+          store.getByName(Store.ROOT_DO_NAME).listStacks(),
+        )
+        .handle("listStages", ({ params }) =>
+          store.getByName(params.stack).listStages(),
+        )
+        .handle("listResources", ({ params }) =>
+          store.getByName(params.stack).listResources({ stage: params.stage }),
+        )
+        .handle("getState", ({ params }) =>
+          store
+            .getByName(params.stack)
+            .get({ stage: params.stage, fqn: decodeURIComponent(params.fqn) }),
+        )
+        .handle("setState", ({ params, payload }) =>
+          store
+            .getByName(params.stack)
+            .set({
+              stage: params.stage,
+              fqn: decodeURIComponent(params.fqn),
+              value: payload as any,
+            })
+            .pipe(
+              Effect.tap(() =>
+                store
+                  .getByName(Store.ROOT_DO_NAME)
+                  .registerStack({ stack: params.stack }),
+              ),
+            ),
+        )
+        .handle("deleteState", ({ params }) =>
+          // The DO method is `remove`, not `delete` — `delete` is
+          // reserved by Cloudflare's RPC stub proxy.
+          store
+            .getByName(params.stack)
+            .remove({
+              stage: params.stage,
+              fqn: decodeURIComponent(params.fqn),
+            })
+            .pipe(Effect.asVoid),
+        )
+        .handle("getReplacedResources", ({ params }) =>
+          store
+            .getByName(params.stack)
+            .getReplacedResources({ stage: params.stage }),
+        )
+        .handle("deleteStack", ({ params, query }) =>
+          store
+            .getByName(params.stack)
+            .deleteStack(
+              query.stage === undefined ? {} : { stage: query.stage },
+            )
+            .pipe(
+              Effect.flatMap(() =>
+                query.stage === undefined
+                  ? store
+                      .getByName(Store.ROOT_DO_NAME)
+                      .unregisterStack({ stack: params.stack })
+                  : Effect.void,
+              ),
+              Effect.asVoid,
+            ),
+        ),
+    );
+
+    return {
+      fetch: HttpApiBuilder.layer(StateApi).pipe(
+        Layer.provide(stateApi),
+        Layer.provide(StateAuthLive),
+        Layer.provide(bearerTokenValidator),
+        // The state-store worker never serves files, so HttpPlatform's
+        // file-response surface is stubbed.
+        Layer.provide([Etag.layer, HttpPlatformStub, Path.layer]),
+        HttpRouter.toHttpEffect,
+      ),
+    };
+  }).pipe(Effect.provide(Layer.mergeAll(SecretBindingLive))),
+);
+
+/**
+ * Stub `HttpPlatform` for the worker. The state-store API never
+ * issues file responses, so both surface methods die if invoked. Lets
+ * us avoid pulling in a `FileSystem` dependency that workers don't
+ * have.
+ */
+const HttpPlatformStub = Layer.succeed(HttpPlatform.HttpPlatform, {
+  fileResponse: () => Effect.die("HttpPlatform.fileResponse not supported"),
+  fileWebResponse: () =>
+    Effect.die("HttpPlatform.fileWebResponse not supported"),
+});
+
+/**
+ * Timing-safe string comparison using the Workers runtime's built-in
+ * `crypto.subtle.timingSafeEqual`.
+ *
+ * @see https://developers.cloudflare.com/workers/examples/protect-against-timing-attacks/
+ */
+const timingSafeEqual = (a: string, b: string): boolean => {
+  const encoder = new TextEncoder();
+  const aBytes = encoder.encode(a);
+  const bBytes = encoder.encode(b);
+  if (aBytes.byteLength !== bBytes.byteLength) return false;
+  // @ts-expect-error - TODO(sam)
+  return crypto.subtle.timingSafeEqual(aBytes, bBytes);
+};