alchemy 2.0.0-beta.3 → 2.0.0-beta.31

package/lib/Cloudflare/StateStore/Api.js

@@ -0,0 +1,236 @@
+import { BearerTokenValidator, StateApi, StateAuthLive, } from "../../State/HttpStateApi.js";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as Etag from "effect/unstable/http/Etag";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as HttpPlatform from "effect/unstable/http/HttpPlatform";
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import * as HttpApiError from "effect/unstable/httpapi/HttpApiError";
+import * as OtlpLogger from "effect/unstable/observability/OtlpLogger";
+import * as OtlpMetrics from "effect/unstable/observability/OtlpMetrics";
+import * as OtlpSerialization from "effect/unstable/observability/OtlpSerialization";
+import * as OtlpTracer from "effect/unstable/observability/OtlpTracer";
+import crypto from "node:crypto";
+import * as Secret from "../SecretsStore/Secret.js";
+import { SecretBindingLive } from "../SecretsStore/SecretBinding.js";
+import { Worker } from "../Workers/Worker.js";
+import Store from "./Store.js";
+import { AuthToken } from "./Token.js";
+export const STATE_STORE_SCRIPT_NAME = "alchemy-state-store";
+/**
+ * Version of the deployed Cloudflare State Store worker contract.
+ *
+ * Bump this whenever the wire format or runtime behaviour of the
+ * worker changes in a way that an older deployed copy can no longer
+ * satisfy. Clients query `/version` on the deployed worker and
+ * compare against this constant; a mismatch (or 404) triggers a
+ * forced redeploy via the bootstrap flow.
+ */
+export const STATE_STORE_VERSION = 2;
+/**
+ * Hard-coded OTLP/HTTP endpoints. Point at the public ingest relay
+ * defined in `stacks/otel.ts` (bound to `otel.alchemy.run`), which
+ * forwards to Axiom with the bearer token attached server-side. Hard-
+ * coded on purpose: the worker has no env-var plumbing and the relay
+ * is account-level infra that lives outside any single deploy.
+ */
+const OTEL_TRACES_URL = "https://otel.alchemy.run/v1/traces";
+const OTEL_METRICS_URL = "https://otel.alchemy.run/v1/metrics";
+const OTEL_LOGS_URL = "https://otel.alchemy.run/v1/logs";
+/**
+ * OTLP traces + metrics + logs Layer for the state-store worker.
+ * Mirrors the CLI's `TelemetryLive` so every signal the worker emits
+ * (`Effect.withSpan`, runtime metrics, `Effect.log*`) ships to the
+ * same Axiom datasets as deploy-time CLI signals. Resource attributes
+ * brand each signal with the worker's service name + contract version
+ * so they're easy to slice in Axiom.
+ */
+const otelResource = {
+    serviceName: STATE_STORE_SCRIPT_NAME,
+    serviceVersion: String(STATE_STORE_VERSION),
+    attributes: {
+        "alchemy.state_store.script_name": STATE_STORE_SCRIPT_NAME,
+        "alchemy.state_store.version": STATE_STORE_VERSION,
+    },
+};
+const TelemetryLive = Layer.mergeAll(OtlpTracer.layer({
+    url: OTEL_TRACES_URL,
+    resource: otelResource,
+    exportInterval: "1 second",
+}), OtlpMetrics.layer({
+    url: OTEL_METRICS_URL,
+    resource: otelResource,
+    exportInterval: "1 second",
+}), 
+// Replace (don't merge with) the default stdout logger so worker logs
+// ship to Axiom instead of just `wrangler tail`.
+OtlpLogger.layer({
+    url: OTEL_LOGS_URL,
+    resource: otelResource,
+    exportInterval: "1 second",
+    mergeWithExisting: false,
+})).pipe(Layer.provide(OtlpSerialization.layerJson), Layer.provide(FetchHttpClient.layer));
+/**
+ * Path on disk to *this* file, used as the worker's bundling entry.
+ *
+ * When running from source (e.g. dev / monorepo), `import.meta.url` points
+ * at `Api.ts` and we can use it directly. When the alchemy CLI is run from
+ * its published `bin/alchemy.js` bundle, this module is inlined into the
+ * CLI bundle and `import.meta.url` resolves to `bin/alchemy.js` — which
+ * has no `default` export and breaks the worker bundler with
+ * `[MISSING_EXPORT] "default" is not exported by "bin/alchemy.js"`.
+ *
+ * In the bundled case, fall back to the published source file shipped
+ * alongside the CLI under `../src/Cloudflare/StateStore/Api.ts`.
+ */
+export default Worker("Api", {
+    name: STATE_STORE_SCRIPT_NAME,
+    main: import.meta.filename,
+    url: true,
+    compatibility: {
+        flags: ["nodejs_compat"],
+        date: "2026-03-17",
+    },
+}, Effect.gen(function* () {
+    const secret = yield* Secret.Secret.bind(AuthToken);
+    const store = yield* Store;
+    const bearerTokenValidator = Layer.effect(BearerTokenValidator, secret.get().pipe(Effect.map((expected) => BearerTokenValidator.of({
+        validate: (token) => !!expected && timingSafeEqual(token, expected)
+            ? Effect.void
+            : Effect.fail(new HttpApiError.Unauthorized()),
+    })), Effect.orDie));
+    const versionApi = HttpApiBuilder.group(StateApi, "version", (handlers) => handlers.handle("getVersion", () => Effect.succeed({ version: STATE_STORE_VERSION }).pipe(Effect.withSpan("state_store.getVersion", {
+        attributes: { "alchemy.state_store.op": "getVersion" },
+    }))));
+    const stateApi = HttpApiBuilder.group(StateApi, "state", (handlers) => handlers
+        .handle("listStacks", () => store
+        .getByName(Store.ROOT_DO_NAME)
+        .listStacks()
+        .pipe(Effect.withSpan("state_store.listStacks", {
+        attributes: { "alchemy.state_store.op": "listStacks" },
+    })))
+        .handle("listStages", ({ params }) => store
+        .getByName(params.stack)
+        .listStages()
+        .pipe(Effect.withSpan("state_store.listStages", {
+        attributes: {
+            "alchemy.state_store.op": "listStages",
+            "alchemy.state_store.stack": params.stack,
+        },
+    })))
+        .handle("listResources", ({ params }) => store
+        .getByName(params.stack)
+        .listResources({ stage: params.stage })
+        .pipe(Effect.withSpan("state_store.listResources", {
+        attributes: {
+            "alchemy.state_store.op": "listResources",
+            "alchemy.state_store.stack": params.stack,
+            "alchemy.state_store.stage": params.stage,
+        },
+    })))
+        .handle("getState", ({ params }) => {
+        const fqn = decodeURIComponent(params.fqn);
+        return store
+            .getByName(params.stack)
+            .get({ stage: params.stage, fqn })
+            .pipe(Effect.withSpan("state_store.getState", {
+            attributes: {
+                "alchemy.state_store.op": "getState",
+                "alchemy.state_store.stack": params.stack,
+                "alchemy.state_store.stage": params.stage,
+                "alchemy.state_store.fqn": fqn,
+            },
+        }));
+    })
+        .handle("setState", ({ params, payload }) => {
+        const fqn = decodeURIComponent(params.fqn);
+        return store
+            .getByName(params.stack)
+            .set({ stage: params.stage, fqn, value: payload })
+            .pipe(Effect.tap(() => store
+            .getByName(Store.ROOT_DO_NAME)
+            .registerStack({ stack: params.stack })), Effect.withSpan("state_store.setState", {
+            attributes: {
+                "alchemy.state_store.op": "setState",
+                "alchemy.state_store.stack": params.stack,
+                "alchemy.state_store.stage": params.stage,
+                "alchemy.state_store.fqn": fqn,
+            },
+        }));
+    })
+        .handle("deleteState", ({ params }) => {
+        const fqn = decodeURIComponent(params.fqn);
+        // The DO method is `remove`, not `delete` — `delete` is
+        // reserved by Cloudflare's RPC stub proxy.
+        return store
+            .getByName(params.stack)
+            .remove({ stage: params.stage, fqn })
+            .pipe(Effect.asVoid, Effect.withSpan("state_store.deleteState", {
+            attributes: {
+                "alchemy.state_store.op": "deleteState",
+                "alchemy.state_store.stack": params.stack,
+                "alchemy.state_store.stage": params.stage,
+                "alchemy.state_store.fqn": fqn,
+            },
+        }));
+    })
+        .handle("getReplacedResources", ({ params }) => store
+        .getByName(params.stack)
+        .getReplacedResources({ stage: params.stage })
+        .pipe(Effect.withSpan("state_store.getReplacedResources", {
+        attributes: {
+            "alchemy.state_store.op": "getReplacedResources",
+            "alchemy.state_store.stack": params.stack,
+            "alchemy.state_store.stage": params.stage,
+        },
+    })))
+        .handle("deleteStack", ({ params, query }) => store
+        .getByName(params.stack)
+        .deleteStack(query.stage === undefined ? {} : { stage: query.stage })
+        .pipe(Effect.flatMap(() => query.stage === undefined
+        ? store
+            .getByName(Store.ROOT_DO_NAME)
+            .unregisterStack({ stack: params.stack })
+        : Effect.void), Effect.asVoid, Effect.withSpan("state_store.deleteStack", {
+        attributes: {
+            "alchemy.state_store.op": "deleteStack",
+            "alchemy.state_store.stack": params.stack,
+            "alchemy.state_store.stage": query.stage ?? "",
+            "alchemy.state_store.scope": query.stage === undefined ? "stack" : "stage",
+        },
+    }))));
+    return {
+        fetch: HttpApiBuilder.layer(StateApi).pipe(Layer.provide(stateApi), Layer.provide(versionApi), Layer.provide(StateAuthLive), Layer.provide(bearerTokenValidator), 
+        // The state-store worker never serves files, so HttpPlatform's
+        // file-response surface is stubbed.
+        Layer.provide([Etag.layer, HttpPlatformStub, Path.layer]), HttpRouter.toHttpEffect, Effect.provide(TelemetryLive)),
+    };
+}).pipe(Effect.provide(Layer.mergeAll(SecretBindingLive))));
+/**
+ * Stub `HttpPlatform` for the worker. The state-store API never
+ * issues file responses, so both surface methods die if invoked. Lets
+ * us avoid pulling in a `FileSystem` dependency that workers don't
+ * have.
+ */
+const HttpPlatformStub = Layer.succeed(HttpPlatform.HttpPlatform, {
+    fileResponse: () => Effect.die("HttpPlatform.fileResponse not supported"),
+    fileWebResponse: () => Effect.die("HttpPlatform.fileWebResponse not supported"),
+});
+/**
+ * Timing-safe string comparison using the Workers runtime's built-in
+ * `crypto.subtle.timingSafeEqual`.
+ *
+ * @see https://developers.cloudflare.com/workers/examples/protect-against-timing-attacks/
+ */
+const timingSafeEqual = (a, b) => {
+    const encoder = new TextEncoder();
+    const aBytes = encoder.encode(a);
+    const bBytes = encoder.encode(b);
+    if (aBytes.byteLength !== bBytes.byteLength)
+        return false;
+    // @ts-expect-error - TODO(sam)
+    return crypto.subtle.timingSafeEqual(aBytes, bBytes);
+};
+//# sourceMappingURL=Api.js.map

package/lib/Cloudflare/StateStore/Api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Api.js","sourceRoot":"","sources":["../../../src/Cloudflare/StateStore/Api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,aAAa,GACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,IAAI,MAAM,2BAA2B,CAAC;AAClD,OAAO,KAAK,eAAe,MAAM,sCAAsC,CAAC;AACxE,OAAO,KAAK,YAAY,MAAM,mCAAmC,CAAC;AAClE,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,cAAc,MAAM,wCAAwC,CAAC;AACzE,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAC;AACrE,OAAO,KAAK,UAAU,MAAM,0CAA0C,CAAC;AACvE,OAAO,KAAK,WAAW,MAAM,2CAA2C,CAAC;AACzE,OAAO,KAAK,iBAAiB,MAAM,iDAAiD,CAAC;AACrF,OAAO,KAAK,UAAU,MAAM,0CAA0C,CAAC;AACvE,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAA8B,CAAC;AAEtE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAU,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,oCAAoC,CAAC;AAC7D,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAC/D,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG;IACnB,WAAW,EAAE,uBAAuB;IACpC,cAAc,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC3C,UAAU,EAAE;QACV,iCAAiC,EAAE,uBAAuB;QAC1D,6BAA6B,EAAE,mBAAmB;KACnD;CACO,CAAC;AAEX,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAClC,UAAU,CAAC,KAAK,CAAC;IACf,GAAG,EAAE,eAAe;IACpB,QAAQ,EAAE,YAAY;IACtB,cAAc,EAAE,UAAU;CAC3B,CAAC,EACF,WAAW,CAAC,KAAK,CAAC;IAChB,GAAG,EAAE,gBAAgB;IACrB,QAAQ,EAAE,YAAY;IACtB,cAAc,EAAE,UAAU;CAC3B,CAAC;AACF,sEAAsE;AACtE,iDAAiD;AACjD,UAAU,CAAC,KAAK,CAAC;IACf,GAAG,EAAE,aAAa;IAClB,QAAQ,EAAE,YAAY;IACtB,cAAc,EAAE,UAAU;IAC1B,iBAAiB,EAAE,KAAK;CACzB,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAC1C,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CACrC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAe,MAAM,CACnB,KAAK,EACL;IACE,IAAI,EAAE,uBAAuB;IAC7B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;IAC1B,GAAG,EAAE,IAAI;IACT,aAAa,EAAE;QACb,KAAK,EAAE,CAAC,eAAe,CAAC;QACxB,IAAI,EAAE,YAAY;KACnB;CACF,EACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAE3B,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,CACvC,oBAAoB,EACpB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CACf,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtB,oBAAoB,CAAC,EAAE,CAAC;QACtB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,CAAC,CAAC,QAAQ,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC5C,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;KACnD,CAAC,CACH,EACD,MAAM,CAAC,KAAK,CACb,CACF,CAAC;IAEF,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CACxE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,CACjC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE;QACxC,UAAU,EAAE,EAAE,wBAAwB,EAAE,YAAY,EAAE;KACvD,CAAC,CACH,CACF,CACF,CAAC;IAEF,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACpE,QAAQ;SACL,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,CACzB,KAAK;SACF,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;SAC7B,UAAU,EAAE;SACZ,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE;QACxC,UAAU,EAAE,EAAE,wBAAwB,EAAE,YAAY,EAAE;KACvD,CAAC,CACH,CACJ;SACA,MAAM,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACnC,KAAK;SACF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;SACvB,UAAU,EAAE;SACZ,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE;QACxC,UAAU,EAAE;YACV,wBAAwB,EAAE,YAAY;YACtC,2BAA2B,EAAE,MAAM,CAAC,KAAK;SAC1C;KACF,CAAC,CACH,CACJ;SACA,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACtC,KAAK;SACF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;SACvB,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;SACtC,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE;QAC3C,UAAU,EAAE;YACV,wBAAwB,EAAE,eAAe;YACzC,2BAA2B,EAAE,MAAM,CAAC,KAAK;YACzC,2BAA2B,EAAE,MAAM,CAAC,KAAK;SAC1C;KACF,CAAC,CACH,CACJ;SACA,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACjC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,KAAK;aACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;aACvB,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;aACjC,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE;YACtC,UAAU,EAAE;gBACV,wBAAwB,EAAE,UAAU;gBACpC,2BAA2B,EAAE,MAAM,CAAC,KAAK;gBACzC,2BAA2B,EAAE,MAAM,CAAC,KAAK;gBACzC,yBAAyB,EAAE,GAAG;aAC/B;SACF,CAAC,CACH,CAAC;IACN,CAAC,CAAC;SACD,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,KAAK;aACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;aACvB,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAc,EAAE,CAAC;aACxD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CACd,KAAK;aACF,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;aAC7B,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAC1C,EACD,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE;YACtC,UAAU,EAAE;gBACV,wBAAwB,EAAE,UAAU;gBACpC,2BAA2B,EAAE,MAAM,CAAC,KAAK;gBACzC,2BAA2B,EAAE,MAAM,CAAC,KAAK;gBACzC,yBAAyB,EAAE,GAAG;aAC/B;SACF,CAAC,CACH,CAAC;IACN,CAAC,CAAC;SACD,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACpC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3C,wDAAwD;QACxD,2CAA2C;QAC3C,OAAO,KAAK;aACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;aACvB,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;aACpC,IAAI,CACH,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE;YACzC,UAAU,EAAE;gBACV,wBAAwB,EAAE,aAAa;gBACvC,2BAA2B,EAAE,MAAM,CAAC,KAAK;gBACzC,2BAA2B,EAAE,MAAM,CAAC,KAAK;gBACzC,yBAAyB,EAAE,GAAG;aAC/B;SACF,CAAC,CACH,CAAC;IACN,CAAC,CAAC;SACD,MAAM,CAAC,sBAAsB,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAC7C,KAAK;SACF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;SACvB,oBAAoB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;SAC7C,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,kCAAkC,EAAE;QAClD,UAAU,EAAE;YACV,wBAAwB,EAAE,sBAAsB;YAChD,2BAA2B,EAAE,MAAM,CAAC,KAAK;YACzC,2BAA2B,EAAE,MAAM,CAAC,KAAK;SAC1C;KACF,CAAC,CACH,CACJ;SACA,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAC3C,KAAK;SACF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;SACvB,WAAW,CACV,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACxD;SACA,IAAI,CACH,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAClB,KAAK,CAAC,KAAK,KAAK,SAAS;QACvB,CAAC,CAAC,KAAK;aACF,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;aAC7B,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,IAAI,CAChB,EACD,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE;QACzC,UAAU,EAAE;YACV,wBAAwB,EAAE,aAAa;YACvC,2BAA2B,EAAE,MAAM,CAAC,KAAK;YACzC,2BAA2B,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;YAC9C,2BAA2B,EACzB,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;SAChD;KACF,CAAC,CACH,CACJ,CACJ,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CACxC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvB,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EACzB,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAC5B,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACnC,+DAA+D;QAC/D,oCAAoC;QACpC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EACzD,UAAU,CAAC,YAAY,EACvB,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAC9B;KACF,CAAC;AACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAC3D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE;IAChE,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC;IACzE,eAAe,EAAE,GAAG,EAAE,CACpB,MAAM,CAAC,GAAG,CAAC,4CAA4C,CAAC;CAC3D,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IACxD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC1D,+BAA+B;IAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC,CAAC"}

package/lib/Cloudflare/StateStore/State.d.ts

@@ -0,0 +1,94 @@
+import * as SecretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as Effect from "effect/Effect";
+import * as Output from "../../Output.ts";
+import * as Layer from "effect/Layer";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as Config from "effect/Config";
+import { AuthError } from "../../Auth/AuthProvider.ts";
+import * as Cloudflare from "../../Cloudflare/Providers.ts";
+import * as CloudflareEnvironment from "../CloudflareEnvironment.ts";
+import { AlchemyContext } from "../../AlchemyContext.ts";
+import { State } from "../../State/State.ts";
+import * as Access from "../Access.ts";
+export interface BootstrapOptions {
+    /**
+     * The name of the script to use for the state store.
+     * @default "alchemy-state-store"
+     */
+    workerName?: string;
+    /**
+     * Re-run the deploy even if the worker already exists in Cloudflare.
+     *
+     * Without this flag, an already-deployed worker is **adopted**: the
+     * auth-token secret is re-fetched via an edge probe and the local
+     * credentials file is refreshed, but no new code is uploaded. With
+     * `force: true` the full deploy runs again, redeploying the worker
+     * code and reconciling every resource in place.
+     */
+    force?: boolean;
+}
+/**
+ * Manually bootstrap (or repair) the Cloudflare-hosted HTTP State
+ * Store. Used by `alchemy bootstrap cloudflare`.
+ *
+ * The flow mirrors what {@link state} does on first use, but is
+ * exposed as a standalone effect so users can trigger it (or recover
+ * from a partially-failed previous deploy) explicitly:
+ *
+ *   1. Resume any in-progress local `CloudflareStateStore` stack.
+ *   2. If the worker already exists in Cloudflare and `force` is not
+ *      set, adopt it: read the auth token via an edge-preview probe
+ *      and persist credentials.
+ *   3. Otherwise run the full deploy with adoption enabled, sync local
+ *      state into the deployed store, persist credentials, and delete
+ *      the local stack.
+ */
+export declare const bootstrap: (options?: BootstrapOptions) => Effect.Effect<void, AlchemyContext | import("effect/PlatformError").PlatformError | Config.ConfigError | AuthError | import("../../Stage.ts").Stage | import("../../State/State.ts").StateStoreError | Output.MissingSourceError | Output.InvalidReferenceError | Access.AccessError | import("@distilled.cloud/cloudflare").DefaultErrors | workers.InvalidRoute | SecretsStore.InvalidAccountId, AlchemyContext | import("effect/Path").Path | import("effect/FileSystem").FileSystem | HttpClient.HttpClient | import("../../index.ts").Cli | Access.Access | Cloudflare.Credentials | CloudflareEnvironment.CloudflareEnvironment>;
+export declare const state: (props?: {
+    /**
+     * The name of the script to use for the state store.
+     * @default "alchemy-state-store"
+     */
+    workerName?: string;
+    /**
+     * Suppress the per-deployment Cloudflare account hash on telemetry
+     * spans. Lets a caller opt out of having their state-store's
+     * accountId pseudonymously counted on the maintainer dashboard
+     * without disabling all telemetry.
+     *
+     * - `true`  — always opt out, regardless of env.
+     * - `false` — always opt in, regardless of env.
+     * - `undefined` (default) — fall back to the `NO_TRACK` env var
+     *   (`true`/`1` → opt out). Default-default is opt-in.
+     *
+     * Independent of the global telemetry kill-switch
+     * (`DO_NOT_TRACK` / `ALCHEMY_TELEMETRY_DISABLED`), which kills the
+     * entire OTLP exporter — `noTrack` here only suppresses the
+     * `alchemy.cloudflare.account_hash` attribute on state-store
+     * spans, leaving the rest of the telemetry intact.
+     * @default undefined
+     */
+    noTrack?: boolean;
+}) => Layer.Layer<State | Access.Access | Cloudflare.Credentials | CloudflareEnvironment.CloudflareEnvironment, never, AlchemyContext | import("effect/Path").Path | import("effect/FileSystem").FileSystem | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | HttpClient.HttpClient | import("../../index.ts").AuthProviders | import("../../index.ts").Cli>;
+/**
+ * Log in to a Cloudflare-deployed HTTP state-store.
+ *
+ * 1. Find the single account-wide Secrets Store.
+ * 2. Upload a short-lived edge-preview worker that binds the
+ *    auth-token secret and returns its value.
+ * 3. Derive the state-store worker URL from
+ *    {@link STATE_STORE_SCRIPT_NAME} and the account's workers.dev
+ *    subdomain.
+ * 4. Persist `{ url, token }` under the `http-state-store`
+ *    credentials file.
+ *
+ * Requirements are covered by the Cloudflare provider stack —
+ * `CloudflareEnvironment`, `Credentials`, `HttpClient`, and
+ * `FileSystem`.
+ */
+export declare const loginWithCloudflare: () => Effect.Effect<{
+    url: string;
+    authToken: string;
+}, Config.ConfigError | AuthError | import("@distilled.cloud/axiom").Unauthorized | import("@distilled.cloud/axiom").TooManyRequests | import("@distilled.cloud/axiom").InternalServerError | import("@distilled.cloud/axiom").BadGateway | import("@distilled.cloud/axiom").ServiceUnavailable | import("@distilled.cloud/axiom").GatewayTimeout | import("@distilled.cloud/cloudflare").CloudflareHttpError | import("@distilled.cloud/cloudflare").CloudflareParseError | import("@distilled.cloud/cloudflare").UnknownCloudflareError | workers.InvalidRoute | SecretsStore.InvalidAccountId, import("effect/FileSystem").FileSystem | HttpClient.HttpClient | Access.Access | Cloudflare.Credentials | CloudflareEnvironment.CloudflareEnvironment>;
+//# sourceMappingURL=State.d.ts.map

package/lib/Cloudflare/StateStore/State.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"State.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/StateStore/State.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,YAAY,MAAM,2CAA2C,CAAC;AAC1E,OAAO,KAAK,OAAO,MAAM,qCAAqC,CAAC;AAC/D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAK9D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAGvD,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAQ5D,OAAO,KAAK,qBAAqB,MAAM,6BAA6B,CAAC;AAGrE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,KAAK,EAAqB,MAAM,sBAAsB,CAAC;AAMhE,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAkDvC,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,GAAI,UAAS,gBAAqB,2mBA+ErD,CAAC;AAEJ,eAAO,MAAM,KAAK,GAAI,QAAQ;IAC5B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,uXAoJE,CAAC;AAyKJ;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB;;;wtBA+E7B,CAAC"}