alchemy 2.0.0-beta.13 → 2.0.0-beta.15

package/src/Cloudflare/StateStore/State.ts

@@ -0,0 +1,318 @@
+import * as SecretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as Output from "alchemy/Output";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+
+import * as Config from "effect/Config";
+import { AuthError } from "../../Auth/AuthProvider.ts";
+import { readCredentials, writeCredentials } from "../../Auth/Credentials.ts";
+import { ALCHEMY_PROFILE } from "../../Auth/Profile.ts";
+import * as Cloudflare from "../../Cloudflare/Providers.ts";
+import { deploy } from "../../Deploy.ts";
+import * as Alchemy from "../../Stack.ts";
+import {
+  makeHttpStateStore,
+  type HttpStateStoreProps,
+} from "../../State/HttpStateStore.ts";
+import * as CloudflareEnvironment from "../CloudflareEnvironment.ts";
+import * as Credentials from "../Credentials.ts";
+
+import { AlchemyContext } from "../../AlchemyContext.ts";
+import { makeLocalState } from "../../State/LocalState.ts";
+import { State, type StateService } from "../../State/State.ts";
+import { syncState } from "../../State/Sync.ts";
+import * as Clank from "../../Util/Clank.ts";
+import { CloudflareAuth } from "../Auth/AuthProvider.ts";
+import { EdgeSessionError, createEdgeSession } from "../EdgeSession.ts";
+import Api, { STATE_STORE_SCRIPT_NAME } from "./Api.ts";
+import { AuthTokenSecretName, TokenValue } from "./Token.ts";
+
+/** Filename used for stored credentials under the profile directory. */
+const CREDENTIALS_FILE = "cloudflare-state-store";
+
+export const state = (props?: {
+  /**
+   * The name of the script to use for the state store.
+   * @default "alchemy-state-store"
+   */
+  workerName?: string;
+}) =>
+  Layer.effect(
+    State,
+    Effect.gen(function* () {
+      const isCI = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+      const alchemyContext = yield* AlchemyContext;
+      const profileName = yield* ALCHEMY_PROFILE;
+      const credentials = yield* readCredentials<HttpStateStoreProps>(
+        profileName,
+        CREDENTIALS_FILE,
+      );
+
+      const scriptName = props?.workerName ?? STATE_STORE_SCRIPT_NAME;
+
+      // TODO(sam): support upgrading state store, right now we only deploy once
+      if (credentials) {
+        // it's in the profile, let's go
+        const httpState = yield* makeHttpStateStore(credentials);
+
+        if (alchemyContext.updateStateStore) {
+          yield* deployStateStore(scriptName, httpState);
+        }
+
+        return httpState;
+      } else {
+        // our profile does not contain a reference to the state store, let's try and resolve it
+        const { accountId } =
+          yield* CloudflareEnvironment.CloudflareEnvironment;
+        const workerExists = yield* workers
+          .getScriptSetting({
+            accountId,
+            scriptName,
+          })
+          .pipe(
+            Effect.map((setting) => setting !== undefined),
+            Effect.catchTag("WorkerNotFound", () => Effect.succeed(false)),
+          );
+
+        if (workerExists) {
+          // it exists, so fetch the secret token
+          const credentials = yield* loginWithCloudflare();
+          if (!isCI) {
+            yield* writeCredentials<HttpStateStoreProps>(
+              profileName,
+              CREDENTIALS_FILE,
+              credentials,
+            );
+          }
+          const httpState = yield* makeHttpStateStore(credentials);
+
+          if (alchemyContext.updateStateStore) {
+            yield* deployStateStore(scriptName, httpState);
+          }
+
+          return httpState;
+        } else if (isCI) {
+          // TODO(sam): do we want to support bootstrapping the state store from CI?
+          // for now - just die here
+          return yield* Effect.die(
+            new AuthError({
+              message: `State store not found for script ${scriptName}. Deploy the state store first.`,
+            }),
+          );
+        }
+
+        const shouldDeploy = yield* Clank.confirm({
+          message:
+            "Cloudflare State Store not found. Do you want to deploy it?",
+        });
+
+        if (!shouldDeploy) {
+          return yield* Effect.die(new Clank.PromptCancelled());
+        }
+
+        const { url, authToken, localState } =
+          yield* deployStateStore(scriptName);
+
+        const httpState = yield* makeHttpStateStore({ url, authToken });
+
+        yield* syncState(localState, httpState);
+
+        yield* writeCredentials<HttpStateStoreProps>(
+          profileName,
+          CREDENTIALS_FILE,
+          {
+            url,
+            authToken,
+          },
+        );
+
+        yield* localState.deleteStack({
+          stack: "CloudflareStateStore",
+          stage: scriptName,
+        });
+
+        return httpState;
+      }
+    }).pipe(Effect.orDie),
+  ).pipe(
+    Layer.provideMerge(Credentials.fromAuthProvider()),
+    Layer.provideMerge(CloudflareEnvironment.fromProfile()),
+    Layer.provideMerge(CloudflareAuth),
+    Layer.orDie,
+  );
+
+const deployStateStore = (scriptName: string, state?: StateService) =>
+  Effect.gen(function* () {
+    const localState = state ?? (yield* makeLocalState());
+    // deploy it with local state (which we will then hoist into the Cloudflare state store)
+    const stateLayer = Layer.succeed(State, localState);
+    const { url, authToken } = yield* deploy({
+      // use the script name as the stage name (so the user can have multiple state stores)
+      stage: scriptName,
+      stack: Alchemy.Stack(
+        "CloudflareStateStore",
+        {
+          providers: Cloudflare.providers(),
+          state: stateLayer,
+        },
+        Effect.gen(function* () {
+          const token = yield* TokenValue;
+          const api = yield* Api;
+
+          // Surface the bearer token so tests and clients can authenticate
+          // after deploy. The underlying value lives in the Cloudflare
+          // Secrets Store; this output carries the same generated string.
+          return {
+            url: api.url.as<string>(),
+            authToken: token.text.pipe(Output.map(Redacted.value)),
+          };
+        }),
+      ),
+    }).pipe(
+      // TODO(sam): we should not need to do this, but types do complain. fix deploy
+      Effect.provide(stateLayer),
+    );
+    return { url, authToken, localState };
+  });
+
+/**
+ * Log in to a Cloudflare-deployed HTTP state-store.
+ *
+ * 1. Find the single account-wide Secrets Store.
+ * 2. Upload a short-lived edge-preview worker that binds the
+ *    auth-token secret and returns its value.
+ * 3. Derive the state-store worker URL from
+ *    {@link STATE_STORE_SCRIPT_NAME} and the account's workers.dev
+ *    subdomain.
+ * 4. Persist `{ url, token }` under the `http-state-store`
+ *    credentials file.
+ *
+ * Requirements are covered by the Cloudflare provider stack —
+ * `CloudflareEnvironment`, `Credentials`, `HttpClient`, and
+ * `FileSystem`.
+ */
+export const loginWithCloudflare = () =>
+  Effect.gen(function* () {
+    const isCI = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+    const profileName = yield* ALCHEMY_PROFILE;
+    const { accountId } = yield* CloudflareEnvironment.CloudflareEnvironment;
+
+    // 1. Locate the single Secrets Store on the account.
+    const stores = yield* SecretsStore.listStores({ accountId });
+    const store = stores.result[0];
+    if (!store) {
+      return yield* Effect.fail(
+        new AuthError({
+          message:
+            "No Secrets Store found on this account. Deploy the state store first.",
+        }),
+      );
+    }
+
+    // 2. Fetch the auth-token value via an edge-preview worker.
+    const authToken = yield* readSecretViaEdge(store.id, AuthTokenSecretName);
+
+    // 3. Derive the deployed worker URL.
+    const { subdomain } = yield* workers.getSubdomain({ accountId });
+    const url = `https://${STATE_STORE_SCRIPT_NAME}.${subdomain}.workers.dev`;
+
+    if (!isCI) {
+      // 4. Persist credentials. The profile entry is managed by
+      //    `loadOrConfigure` when this is invoked through `configure`.
+      yield* writeCredentials<HttpStateStoreProps>(
+        profileName,
+        CREDENTIALS_FILE,
+        {
+          url,
+          authToken: authToken.trim(),
+        },
+      ).pipe(
+        Effect.mapError(
+          (e) =>
+            new AuthError({ message: "Failed to write credentials", cause: e }),
+        ),
+      );
+
+      yield* Clank.success(
+        `HTTP state store credentials saved for '${profileName}'.`,
+      );
+      yield* Clank.info(`  url:     ${url}`);
+    }
+
+    return {
+      url,
+      authToken: authToken.trim(),
+    };
+  }).pipe(
+    Effect.catchTag("EdgeSessionError", (e) =>
+      Effect.fail(
+        new AuthError({
+          message: `Edge-preview secret read failed: ${e.message}`,
+          cause: e.cause,
+        }),
+      ),
+    ),
+  );
+
+/** Preview script name used by the edge-probe worker. */
+const PROBE_SCRIPT_NAME = "alchemy-state-store-probe";
+
+/**
+ * Tiny ES-module worker that reads `env.SECRET.get()` and echoes it
+ * back. Uploaded as an ephemeral edge-preview, called once, then
+ * discarded — see {@link readSecretViaEdge}.
+ */
+const SECRET_PROBE_SOURCE = `export default {
+  async fetch(_request, env) {
+    try {
+      const value = await env.SECRET.get();
+      return new Response(value ?? "", { status: 200, headers: { "content-type": "text/plain" } });
+    } catch (e) {
+      return new Response("Error: " + (e && e.message ? e.message : String(e)), { status: 500 });
+    }
+  },
+};`;
+
+/**
+ * Upload a tiny edge-preview worker that binds the given Secrets
+ * Store secret, call it once, and return the decoded value. The
+ * Cloudflare REST API deliberately hides secret values; only worker
+ * bindings can resolve them, so this is the out-of-band path.
+ */
+const readSecretViaEdge = (storeId: string, secretName: string) =>
+  Effect.gen(function* () {
+    const http = yield* HttpClient.HttpClient;
+    const file = new File([SECRET_PROBE_SOURCE], "worker.js", {
+      type: "application/javascript+module",
+    });
+    const session = yield* createEdgeSession({
+      scriptName: PROBE_SCRIPT_NAME,
+      files: [file],
+      bindings: [
+        { type: "secrets_store_secret", name: "SECRET", secretName, storeId },
+      ],
+    });
+    const response = yield* http.get(session.url, {
+      headers: session.headers,
+    });
+    if (response.status !== 200) {
+      const body = yield* response.text.pipe(
+        Effect.catch(() => Effect.succeed("")),
+      );
+      return yield* Effect.fail(
+        new EdgeSessionError({
+          message: `Secret probe returned ${response.status}: ${body.slice(0, 200)}`,
+        }),
+      );
+    }
+    return yield* response.text;
+  }).pipe(
+    Effect.mapError((cause) =>
+      cause instanceof EdgeSessionError
+        ? cause
+        : new EdgeSessionError({ message: "Failed to read secret", cause }),
+    ),
+  );

package/src/Cloudflare/StateStore/Store.ts

@@ -0,0 +1,290 @@
+import type { ReplacedResourceState, ResourceState } from "alchemy/State";
+import { encodeState } from "alchemy/State";
+import * as Effect from "effect/Effect";
+import { pipe } from "effect/Function";
+import * as Secret from "../SecretsStore/Secret.ts";
+import { DurableObjectNamespace } from "../Workers/DurableObjectNamespace.ts";
+import { DurableObjectState } from "../Workers/DurableObjectState.ts";
+import { EncryptionKey } from "./Token.ts";
+
+export default class Store extends DurableObjectNamespace<Store>()(
+  "Store",
+  Effect.gen(function* () {
+    // Outer (class-level) phase — resolve the binding factory once.
+    // The actual secret read happens inside each DO instance below,
+    // since `SecretClient.get()` needs the per-instance worker env.
+    const encryptionSecret = yield* Secret.Secret.bind(EncryptionKey);
+
+    return Effect.gen(function* () {
+      // Inner (per-instance) phase — set up storage and the AES key.
+      // The key is imported once per DO boot and reused thereafter.
+      const doState = yield* DurableObjectState;
+      const storage = doState.storage;
+
+      const keyHex = yield* encryptionSecret.get().pipe(Effect.orDie);
+      const cryptoKey = yield* Effect.tryPromise(() =>
+        crypto.subtle.importKey(
+          "raw",
+          hexToBytes(keyHex),
+          { name: "AES-CTR" },
+          false,
+          ["encrypt", "decrypt"],
+        ),
+      ).pipe(Effect.orDie);
+
+      const encryptValue = (value: ResourceState) =>
+        Effect.tryPromise(async () => {
+          const plaintext = new TextEncoder().encode(
+            JSON.stringify(encodeState(value)),
+          );
+          const counter = crypto.getRandomValues(allocBytes(NONCE_BYTES));
+          const ct = new Uint8Array(
+            await crypto.subtle.encrypt(
+              { name: "AES-CTR", counter, length: 64 },
+              cryptoKey,
+              plaintext,
+            ),
+          );
+          // Frame as a single base64 string: nonce || ciphertext.
+          const framed = allocBytes(counter.byteLength + ct.byteLength);
+          framed.set(counter, 0);
+          framed.set(ct, counter.byteLength);
+          return toB64(framed);
+        }).pipe(Effect.orDie);
+
+      const decryptEntry = (entry: string) =>
+        Effect.tryPromise(async () => {
+          const framed = fromB64(entry);
+          const counter = framed.slice(0, NONCE_BYTES);
+          const ciphertext = framed.slice(NONCE_BYTES);
+          const pt = await crypto.subtle.decrypt(
+            { name: "AES-CTR", counter, length: 64 },
+            cryptoKey,
+            ciphertext,
+          );
+          return JSON.parse(new TextDecoder().decode(pt)) as ResourceState;
+        }).pipe(Effect.orDie);
+
+      return {
+        // -- Root DO methods -----------------------------------------
+
+        /**
+         * (Root DO only) List every stack name ever registered.
+         */
+        listStacks: Effect.fnUntraced(function* () {
+          const entries = yield* storage.list<number>({
+            prefix: STACK_INDEX_PREFIX,
+          });
+          const stacks: string[] = [];
+          for (const key of entries.keys()) {
+            stacks.push(key.slice(STACK_INDEX_PREFIX.length));
+          }
+          return stacks;
+        }),
+
+        /**
+         * (Root DO only) Register a stack name. Idempotent — safe to
+         * call on every `set` to the corresponding stack DO.
+         */
+        registerStack: ({ stack }: { stack: string }) =>
+          storage.put(`${STACK_INDEX_PREFIX}${stack}`, 1),
+
+        /**
+         * (Root DO only) Remove a stack name from the global index.
+         */
+        unregisterStack: ({ stack }: { stack: string }) =>
+          storage.delete(`${STACK_INDEX_PREFIX}${stack}`),
+
+        // -- Stack DO methods ----------------------------------------
+
+        /** (Stack DO only) List stages with at least one resource. */
+        listStages: () =>
+          storage
+            .list<string>({
+              prefix: RESOURCE_PREFIX,
+            })
+            .pipe(
+              Effect.map((entries) => {
+                const stages = new Set<string>();
+                for (const key of entries.keys()) {
+                  const parsed = parseResourceKey(key);
+                  if (parsed) stages.add(parsed.stage);
+                }
+                return [...stages];
+              }),
+            ),
+
+        /** (Stack DO only) List every resource FQN in a stage. */
+        listResources: ({ stage }: { stage: string }) =>
+          storage
+            .list<string>({
+              prefix: stagePrefix(stage),
+            })
+            .pipe(
+              Effect.map((entries) => {
+                const fqns: string[] = [];
+                for (const key of entries.keys()) {
+                  const parsed = parseResourceKey(key);
+                  if (parsed) fqns.push(parsed.fqn);
+                }
+                return fqns;
+              }),
+            ),
+
+        /**
+         * (Stack DO only) Get a resource by (stage, fqn). Returns
+         * null if missing.
+         */
+        get: ({ stage, fqn }: { stage: string; fqn: string }) =>
+          storage
+            .get<string>(resourceKey(stage, fqn))
+            .pipe(
+              Effect.flatMap((entry) =>
+                entry == null ? Effect.succeed(undefined) : decryptEntry(entry),
+              ),
+            ),
+
+        /**
+         * (Stack DO only) Persist a resource. Returns the stored
+         * value unchanged.
+         */
+        set: ({
+          stage,
+          fqn,
+          value,
+        }: {
+          stage: string;
+          fqn: string;
+          value: ResourceState;
+        }) =>
+          encryptValue(value).pipe(
+            Effect.flatMap((encrypted) =>
+              storage
+                .put<string>(resourceKey(stage, fqn), encrypted)
+                .pipe(Effect.asVoid),
+            ),
+            Effect.map(() => value),
+          ),
+
+        /**
+         * (Stack DO only) Delete a resource. Idempotent.
+         *
+         * Exposed as `remove` (not `delete`) because Cloudflare's
+         * Durable Object RPC stub reserves `delete` and refuses to
+         * proxy the call, surfacing as "RPC receiver does not
+         * implement the method 'delete'".
+         */
+        remove: ({ stage, fqn }: { stage: string; fqn: string }) =>
+          storage.delete(resourceKey(stage, fqn)),
+
+        /**
+         * (Stack DO only) Delete every resource in this stack, or every
+         * resource in a single stage when specified.
+         */
+        deleteStack: ({ stage }: { stage?: string } = {}) =>
+          stage === undefined
+            ? storage.deleteAll()
+            : storage
+                .list<string>({ prefix: stagePrefix(stage) })
+                .pipe(
+                  Effect.flatMap((entries) =>
+                    entries.size === 0
+                      ? Effect.void
+                      : storage.delete([...entries.keys()]).pipe(Effect.asVoid),
+                  ),
+                ),
+
+        /**
+         * (Stack DO only) Return every resource in a stage whose
+         * `status === "replaced"`. Each entry is decrypted so the
+         * `status` field can be inspected.
+         */
+        getReplacedResources: ({ stage }: { stage: string }) =>
+          pipe(
+            storage.list<string>({ prefix: stagePrefix(stage) }),
+            Effect.map((entries) =>
+              [...entries.values()].filter((e): e is string => !!e),
+            ),
+            Effect.flatMap(
+              Effect.forEach(decryptEntry, { concurrency: "unbounded" }),
+            ),
+            Effect.map((decoded) =>
+              decoded.filter(
+                (d): d is ReplacedResourceState => d?.status === "replaced",
+              ),
+            ),
+          ),
+      };
+    });
+  }),
+) {
+  /**
+   * Well-known DO name whose sole job is to track the set of stacks
+   * that have ever had resources written. `listStacks` queries it;
+   * every `set` asks it to register the stack (idempotent).
+   */
+  static readonly ROOT_DO_NAME = "__root__" as const;
+}
+
+/** NUL byte separator for composite keys. */
+const SEP = "\x00";
+
+/** Key prefix for resource entries in a stack DO. */
+const RESOURCE_PREFIX = `r${SEP}`;
+
+/** Key prefix for stack-index entries in the root DO. */
+const STACK_INDEX_PREFIX = "s:";
+
+/** AES-CTR counter block length. */
+const NONCE_BYTES = 16;
+
+/** Build the resource key inside a *stack DO*. */
+const resourceKey = (stage: string, fqn: string) =>
+  `${RESOURCE_PREFIX}${stage}${SEP}${fqn}`;
+
+/** Prefix matching every resource key inside a specific stage. */
+const stagePrefix = (stage: string) => `${RESOURCE_PREFIX}${stage}${SEP}`;
+
+/**
+ * Parse a resource key back into its (stage, fqn) tuple. Returns
+ * undefined for keys that do not match the expected shape.
+ */
+const parseResourceKey = (
+  key: string,
+): { stage: string; fqn: string } | undefined => {
+  if (!key.startsWith(RESOURCE_PREFIX)) return undefined;
+  const rest = key.slice(RESOURCE_PREFIX.length);
+  const sep = rest.indexOf(SEP);
+  if (sep < 0) return undefined;
+  return { stage: rest.slice(0, sep), fqn: rest.slice(sep + 1) };
+};
+
+/**
+ * Allocate a `Uint8Array` over a fresh `ArrayBuffer` (not shared) so
+ * the resulting buffer satisfies Web Crypto's `BufferSource` type
+ * constraint under strict DOM typings.
+ */
+const allocBytes = (size: number): Uint8Array<ArrayBuffer> =>
+  new Uint8Array(new ArrayBuffer(size));
+
+const toB64 = (bytes: Uint8Array): string => {
+  let s = "";
+  for (let i = 0; i < bytes.byteLength; i++)
+    s += String.fromCharCode(bytes[i]!);
+  return btoa(s);
+};
+
+const fromB64 = (s: string): Uint8Array<ArrayBuffer> => {
+  const bin = atob(s);
+  const bytes = allocBytes(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return bytes;
+};
+
+const hexToBytes = (hex: string): Uint8Array<ArrayBuffer> => {
+  const bytes = allocBytes(hex.length / 2);
+  for (let i = 0; i < bytes.length; i++) {
+    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+};

package/src/Cloudflare/StateStore/Token.ts

@@ -0,0 +1,68 @@
+import { Random } from "alchemy";
+import * as Effect from "effect/Effect";
+import * as Secret from "../SecretsStore/Secret.ts";
+import { SecretsStore } from "../SecretsStore/SecretsStore.ts";
+
+/**
+ * The account-wide Secrets Store that backs every secret used by the
+ * state store worker. `SecretsStore` adopts the single store that
+ * already exists on the account, or creates one if none exists.
+ */
+export const Store = SecretsStore("StateStoreSecrets");
+
+/**
+ * The randomly generated bearer token value. Generated once on create
+ * and persisted in alchemy state, so subsequent deploys keep the same
+ * value unless the resource is replaced.
+ */
+export const TokenValue = Random("StateStoreAuthTokenValue");
+
+/**
+ * The name of the secret in the Cloudflare Secrets Store that contains the bearer token.
+ */
+export const AuthTokenSecretName = "AlchemyStateStoreToken" as const;
+
+/**
+ * The bearer token used to authenticate every request to the state
+ * store worker. The value comes from {@link TokenValue} and lives in
+ * the account-wide Cloudflare Secrets Store so it can be bound into
+ * the worker without bundling the raw string.
+ */
+export const AuthToken = Effect.gen(function* () {
+  const store = yield* Store;
+  const random = yield* TokenValue;
+  return yield* Secret.Secret(AuthTokenSecretName, {
+    name: AuthTokenSecretName,
+    store,
+    value: random.text,
+  });
+});
+
+/**
+ * A 32-byte (256-bit) random value, hex-encoded, that seeds the
+ * AES-CTR key used to encrypt resource state at rest. Generated once
+ * and persisted, so the ciphertext stored by the Durable Object can
+ * always be decrypted by subsequent worker boots.
+ */
+export const EncryptionKeyValue = Random("StateStoreEncryptionKeyValue", {
+  bytes: 32,
+});
+
+export const EncryptionKeySecretName =
+  "AlchemyStateStoreEncryptionKey" as const;
+
+/**
+ * The encryption key secret. The raw hex-encoded bytes live inside
+ * Cloudflare's Secrets Store; the Durable Object binds to it at
+ * runtime to derive an AES-CTR `CryptoKey` via Web Crypto's
+ * `subtle.importKey`.
+ */
+export const EncryptionKey = Effect.gen(function* () {
+  const store = yield* Store;
+  const random = yield* EncryptionKeyValue;
+  return yield* Secret.Secret("StateStoreEncryptionKey", {
+    name: EncryptionKeySecretName,
+    store,
+    value: random.text,
+  });
+});

package/src/Cloudflare/StateStore/index.ts

@@ -0,0 +1 @@
+export { state } from "./State.ts";

package/src/Cloudflare/Workers/DurableObjectNamespace.ts

@@ -100,6 +100,7 @@ export type DurableObjectServices =
   | DurableObjectNamespace
   | DurableObjectState
   | WorkerServices
+  | WorkerEnvironment
   | PlatformServices;
 
 export interface DurableObjectNamespaceProps {
@@ -514,12 +515,6 @@ export const DurableObjectNamespace: DurableObjectNamespaceClass =
                     Effect.provideService(DurableObjectState, doState),
                     Effect.provideService(WorkerEnvironment, env),
                     Effect.map((methods: any) => {
-                      console.log(
-                        "[DurableObject] wrapping methods:",
-                        Object.keys(methods),
-                        "own:",
-                        Object.getOwnPropertyNames(methods),
-                      );
                       const wrapped: Record<string, unknown> = {};
                       for (const key of Object.getOwnPropertyNames(methods)) {
                         const value = methods[key];