alchemy 2.0.0-beta.23 → 2.0.0-beta.25

package/src/Cloudflare/Local/SidecarHandlers.ts

@@ -0,0 +1,182 @@
+import * as Server from "@distilled.cloud/cloudflare-runtime/Server";
+import type { WorkerModule } from "@distilled.cloud/cloudflare-runtime/WorkerModule";
+import * as Cause from "effect/Cause";
+import * as Deferred from "effect/Deferred";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Fiber from "effect/Fiber";
+import * as Hash from "effect/Hash";
+import * as Layer from "effect/Layer";
+import * as Result from "effect/Result";
+import * as Scope from "effect/Scope";
+import * as Stream from "effect/Stream";
+import * as Bundle from "../../Bundle/Bundle.ts";
+import { WorkerBundle } from "../Workers/WorkerBundle.ts";
+import { Sidecar, type ServeOptions } from "./Sidecar.ts";
+
+export const SidecarHandlers = Layer.effect(
+  Sidecar,
+  Effect.gen(function* () {
+    const bundle = yield* WorkerBundle;
+    const server = yield* Server.Server;
+
+    const rootScope = yield* Effect.scope;
+    const serverScopes = new Map<string, Scope.Closeable>();
+
+    const serveScoped = Effect.fnUntraced(function* (
+      worker: ServeOptions,
+      modules: WorkerModule[],
+    ) {
+      const scope = yield* Effect.flatMap(Effect.scope, Scope.fork);
+      const result = yield* server
+        .serve({
+          name: worker.id.toLowerCase(),
+          compatibilityDate: worker.compatibility.date,
+          compatibilityFlags: worker.compatibility.flags,
+          bindings: worker.bindings,
+          durableObjectNamespaces: worker.durableObjectNamespaces,
+          modules,
+        })
+        .pipe(Scope.provide(scope));
+      const previous = serverScopes.get(worker.name);
+      if (previous) {
+        yield* Effect.forkDetach(Scope.close(previous, Exit.void));
+      }
+      serverScopes.set(worker.name, scope);
+      return result;
+    });
+
+    const watchers = new Map<
+      string,
+      {
+        hash: number;
+        fiber: Fiber.Fiber<
+          Server.ServeResult,
+          Server.ServeError | Bundle.BundleError
+        >;
+        scope: Scope.Closeable;
+      }
+    >();
+
+    const serveFiber = Effect.fnUntraced(function* (worker: ServeOptions) {
+      const result = yield* Deferred.make<
+        Server.ServeResult,
+        Server.ServeError | Bundle.BundleError
+      >();
+      let start = Date.now();
+      yield* bundle.watch(worker).pipe(
+        Stream.mapEffect((event) =>
+          event._tag === "Error" && !Deferred.isDoneUnsafe(result)
+            ? Effect.fail(event.error)
+            : Effect.succeed(event),
+        ),
+        Stream.tap((event) => {
+          if (event._tag === "Start") {
+            start = Date.now();
+            if (Deferred.isDoneUnsafe(result)) {
+              return Effect.log(`[${worker.id}] Rebuilding`);
+            }
+          } else if (event._tag === "Error") {
+            return Effect.logError(`[${worker.id}] Bundle error`, event.error);
+          }
+          return Effect.void;
+        }),
+        Stream.filterMap((event) =>
+          event._tag === "Success"
+            ? Result.succeed(event.output)
+            : Result.failVoid,
+        ),
+        Stream.map(bundleOutputToWorkerModules),
+        Stream.mapEffect((modules) =>
+          serveScoped(worker, modules).pipe(
+            Effect.exit,
+            Effect.tap((exit) => {
+              const isDone = Deferred.isDoneUnsafe(result);
+              if (exit._tag === "Success") {
+                return Effect.log(
+                  `[${worker.id}] ${isDone ? "Updated" : "Started"} in ${Math.round(Date.now() - start)}ms`,
+                );
+              } else if (isDone) {
+                return Effect.logError(
+                  `[${worker.id}] Error`,
+                  Cause.squash(exit.cause),
+                );
+              }
+              return Effect.void;
+            }),
+            Effect.tap((exit) => Deferred.complete(result, exit)),
+          ),
+        ),
+        Stream.onExit((exit) =>
+          exit._tag === "Failure" && !Deferred.isDoneUnsafe(result)
+            ? Deferred.failCause(result, exit.cause)
+            : Effect.void,
+        ),
+        Stream.runDrain,
+        Effect.forkScoped,
+      );
+      return yield* Deferred.await(result);
+    });
+
+    return Sidecar.of({
+      serve: Effect.fn(function* (worker: ServeOptions) {
+        const hash = Hash.structure(worker);
+        const existing = watchers.get(worker.name);
+        if (existing) {
+          if (existing.hash === hash) {
+            yield* Effect.log(
+              `[${worker.id}] No changes, using existing watcher`,
+            );
+            return yield* Fiber.join(existing.fiber);
+          }
+          yield* Effect.log(
+            `[${worker.id}] Changes detected, interrupting existing watcher`,
+          );
+          yield* Fiber.interrupt(existing.fiber);
+          yield* Scope.close(existing.scope, Exit.void);
+          watchers.delete(worker.name);
+        }
+        const scope = yield* Scope.fork(rootScope);
+        const fiber = yield* serveFiber(worker).pipe(
+          Effect.forkDetach,
+          Scope.provide(scope),
+        );
+        watchers.set(worker.name, { hash, fiber, scope });
+        return yield* Fiber.join(fiber).pipe(
+          Effect.onExit((exit) =>
+            Effect.sync(() => {
+              if (exit._tag === "Failure") {
+                watchers.delete(worker.name);
+              }
+            }),
+          ),
+        );
+      }),
+      stop: Effect.fn(function* (name: string) {
+        const watcher = watchers.get(name);
+        if (watcher) {
+          yield* Fiber.interrupt(watcher.fiber);
+          yield* Scope.close(watcher.scope, Exit.void);
+          watchers.delete(name);
+        }
+      }),
+    });
+  }),
+);
+
+function bundleOutputToWorkerModules(
+  bundle: Bundle.BundleOutput,
+): WorkerModule[] {
+  const modules: WorkerModule[] = [];
+  for (const file of bundle.files) {
+    if (file.path.endsWith(".map") || file.content instanceof Uint8Array) {
+      continue;
+    }
+    modules.push({
+      name: file.path,
+      type: "ESModule",
+      content: file.content,
+    });
+  }
+  return modules;
+}

package/src/Cloudflare/Local/SidecarServer.ts

@@ -0,0 +1,57 @@
+import * as RuntimeServices from "@distilled.cloud/cloudflare-runtime/RuntimeServices";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as AlchemyContext from "../../AlchemyContext.ts";
+import { AuthProviders } from "../../Auth/AuthProvider.ts";
+import * as RpcServer from "../../Sidecar/RpcServer.ts";
+import {
+  httpServer,
+  PlatformServices,
+  runMain,
+} from "../../Util/PlatformServices.ts";
+import { CloudflareAuth } from "../Auth/AuthProvider.ts";
+import * as CloudflareEnvironment from "../CloudflareEnvironment.ts";
+import * as Credentials from "../Credentials.ts";
+import { Sidecar, SidecarSchema } from "./Sidecar.ts";
+import { SidecarHandlers } from "./SidecarHandlers.ts";
+
+const apiServices = Layer.merge(
+  Credentials.fromAuthProvider(),
+  CloudflareEnvironment.fromProfile(),
+).pipe(
+  Layer.provide(CloudflareAuth),
+  Layer.provide(Layer.succeed(AuthProviders, {})),
+);
+
+const runtimeServices = SidecarHandlers.pipe(
+  Layer.provide(
+    Layer.unwrap(
+      Effect.gen(function* () {
+        const { accountId } =
+          yield* CloudflareEnvironment.CloudflareEnvironment;
+        const { dotAlchemy } = yield* AlchemyContext.AlchemyContext;
+        const path = yield* Path.Path;
+        return RuntimeServices.layer({
+          accountId,
+          storage: path.join(dotAlchemy, "local"),
+        });
+      }),
+    ),
+  ),
+  Layer.provide(
+    Layer.mergeAll(apiServices, FetchHttpClient.layer, httpServer()),
+  ),
+);
+
+const services = Layer.provideMerge(
+  Layer.provideMerge(runtimeServices, RpcServer.layerServices(import.meta.url)),
+  PlatformServices,
+);
+
+RpcServer.makeRpcServer(Sidecar.asEffect(), SidecarSchema).pipe(
+  Effect.provide(services),
+  Effect.scoped,
+  runMain,
+);

package/src/Cloudflare/SecretsStore/Secret.ts

@@ -3,6 +3,7 @@ import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as Redacted from "effect/Redacted";
 import * as Stream from "effect/Stream";
+import { AdoptPolicy } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
@@ -122,7 +123,11 @@ export const StoreSecretProvider = () =>
         create: Effect.fn(function* ({ id, news }) {
           const name = resolveName(id, news.name);
           const scopes = resolveScopes(news.scopes);
-          const response = yield* createStoreSecret({
+          const adoptEnabled = yield* Effect.serviceOption(AdoptPolicy).pipe(
+            Effect.map(Option.getOrElse(() => false)),
+          );
+
+          const create = createStoreSecret({
             accountId: news.store.accountId,
             storeId: news.store.storeId,
             body: [
@@ -134,15 +139,81 @@ export const StoreSecretProvider = () =>
               },
             ],
           });
-          const secret = response.result[0]!;
+          // Only swallow the conflict when adoption is opted-in via
+          // `AdoptPolicy`; otherwise surface `SecretNameAlreadyExists`
+          // so the caller learns the secret already exists rather than
+          // silently taking ownership of someone else's secret.
+          const created = adoptEnabled
+            ? yield* create.pipe(
+                Effect.catchTag("SecretNameAlreadyExists", () =>
+                  Effect.succeed(undefined),
+                ),
+              )
+            : yield* create;
+
+          if (created) {
+            const secret = created.result[0]!;
+            return {
+              secretId: secret.id,
+              secretName: secret.name,
+              storeId: secret.storeId,
+              accountId: news.store.accountId,
+              status: secret.status,
+              scopes,
+              comment: secret.comment ?? undefined,
+            };
+          }
+
+          // Adopt-on-conflict path. A secret with this name already
+          // exists in Cloudflare — typically because a previous deploy
+          // partially failed (e.g. the secret was created server-side
+          // but the response was lost so local state never recorded
+          // it). We re-fetch the existing secret and reconcile
+          // scopes/comment. The value itself cannot be read back from
+          // the API and we trust that an identically-named secret in
+          // the same store reflects the same intent (this matches how
+          // SecretsStore itself adopts the account-wide store).
+          const existing = yield* listStoreSecrets
+            .items({
+              accountId: news.store.accountId,
+              storeId: news.store.storeId,
+            })
+            .pipe(
+              Stream.filter((s) => s.name === name),
+              Stream.runHead,
+              Effect.map(Option.getOrUndefined),
+            );
+
+          if (!existing) {
+            return yield* Effect.die(
+              new Error(
+                `Secret '${name}' reported as already existing in store ${news.store.storeId} but could not be found on lookup.`,
+              ),
+            );
+          }
+
+          // listStoreSecrets does not surface scopes, so we have no way
+          // to detect drift; reconcile to the requested scopes/comment
+          // unconditionally. PATCH is cheap and idempotent.
+          const patched = yield* patchStoreSecret({
+            accountId: news.store.accountId,
+            storeId: news.store.storeId,
+            secretId: existing.id,
+            scopes,
+            comment: news.comment,
+          }).pipe(
+            Effect.catchTag("SecretNotFound", () => Effect.succeed(undefined)),
+          );
+
           return {
-            secretId: secret.id,
-            secretName: secret.name,
-            storeId: secret.storeId,
+            secretId: existing.id,
+            secretName: existing.name,
+            storeId: existing.storeId,
             accountId: news.store.accountId,
-            status: secret.status,
+            status: patched?.status ?? existing.status,
             scopes,
-            comment: secret.comment ?? undefined,
+            comment:
+              patched?.comment ?? news.comment ?? existing.comment ?? undefined,
           };
         }),
         update: Effect.fn(function* ({ news, olds = {} as any, output }) {

package/src/Cloudflare/SecretsStore/SecretsStore.ts

@@ -1,5 +1,7 @@
 import * as secretsStore from "@distilled.cloud/cloudflare/secrets-store";
 import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { AdoptPolicy } from "../../AdoptPolicy.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
@@ -55,29 +57,62 @@ export const SecretsStoreProvider = () =>
       return {
         stables: ["storeId", "storeName", "accountId"],
         create: Effect.fn(function* () {
-          const stores = yield* listStores({ accountId });
-          if (stores.result.length > 0) {
-            // No name specified — adopt the first (and likely only) store.
-            const first = stores.result[0]!;
+          const adoptEnabled = yield* Effect.serviceOption(AdoptPolicy).pipe(
+            Effect.map(Option.getOrElse(() => false)),
+          );
+
+          const adoptExisting = Effect.gen(function* () {
+            const stores = yield* listStores({ accountId });
+            const first = stores.result[0];
+            if (!first) return undefined;
             return {
               storeId: first.id,
               storeName: first.name,
               accountId,
             };
+          });
+
+          // Cloudflare allows exactly one Secrets Store per account, so
+          // any account that's been touched before may already have one.
+          // Only adopt it if the caller opted in via `AdoptPolicy`,
+          // otherwise let `createStore` surface MaximumStoresExceeded.
+          if (adoptEnabled) {
+            const adopted = yield* adoptExisting;
+            if (adopted) return adopted;
           }
 
-          // No store exists yet — create one.
-          const response = yield* createStore({
+          const create = createStore({
             accountId,
             //`default_secrets_store` is the name cloudflare uses to create a secret store
             body: [{ name: "default_secrets_store" }],
           });
-          const store = response.result[0]!;
-          return {
-            storeId: store.id,
-            storeName: store.name,
-            accountId,
-          };
+          const response = adoptEnabled
+            ? yield* create.pipe(
+                // A concurrent process (or a previous partially-failed
+                // deploy) may have raced us between list and create.
+                Effect.catchTag("MaximumStoresExceeded", () =>
+                  Effect.succeed(undefined),
+                ),
+              )
+            : yield* create;
+
+          if (response) {
+            const store = response.result[0]!;
+            return {
+              storeId: store.id,
+              storeName: store.name,
+              accountId,
+            };
+          }
+
+          const recovered = yield* adoptExisting;
+          if (recovered) return recovered;
+
+          return yield* Effect.die(
+            new Error(
+              `Cloudflare reported MaximumStoresExceeded for account ${accountId} but no store could be listed.`,
+            ),
+          );
         }),
         update: Effect.fn(function* ({ output }) {
           return output;