alchemy 2.0.0-beta.3 → 2.0.0-beta.31

package/lib/Cloudflare/StateStore/State.js

@@ -0,0 +1,551 @@
+import * as SecretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as Effect from "effect/Effect";
+import * as Output from "../../Output.js";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
+import crypto from "node:crypto";
+import * as Config from "effect/Config";
+import { adopt } from "../../AdoptPolicy.js";
+import { AuthError } from "../../Auth/AuthProvider.js";
+import { readCredentials, writeCredentials } from "../../Auth/Credentials.js";
+import { ALCHEMY_PROFILE } from "../../Auth/Profile.js";
+import * as Cloudflare from "../../Cloudflare/Providers.js";
+import { deploy } from "../../Deploy.js";
+import * as Alchemy from "../../Stack.js";
+import { StateApi } from "../../State/HttpStateApi.js";
+import { makeHttpStateStore, } from "../../State/HttpStateStore.js";
+import * as CloudflareEnvironment from "../CloudflareEnvironment.js";
+import * as Credentials from "../Credentials.js";
+import { AlchemyContext } from "../../AlchemyContext.js";
+import { makeLocalState } from "../../State/LocalState.js";
+import { State } from "../../State/State.js";
+import { recordStateStoreInit, recordStateStoreOp, } from "../../Telemetry/Metrics.js";
+import * as Clank from "../../Util/Clank.js";
+import * as Access from "../Access.js";
+import { CloudflareAuth } from "../Auth/AuthProvider.js";
+import { EdgeSessionError, createEdgeSession } from "../EdgeSession.js";
+import Api, { STATE_STORE_SCRIPT_NAME, STATE_STORE_VERSION } from "./Api.js";
+import { AuthTokenSecretName, TokenValue } from "./Token.js";
+/** Filename used for stored credentials under the profile directory. */
+const CREDENTIALS_FILE = "cloudflare-state-store";
+/**
+ * SHA-256 hex digest of the Cloudflare account ID. Used as a stable
+ * pseudonymous identifier on telemetry spans so the dashboard can
+ * count distinct state-store deployments without leaking the raw
+ * accountId. Mirrors the `alchemy.git.origin_hash` pattern in
+ * `Telemetry/Attributes.ts`.
+ */
+const hashAccountId = (accountId) => Effect.sync(() => crypto.createHash("sha256").update(accountId).digest("hex"));
+/**
+ * Best-effort Cloudflare-account-hash annotation on the current span.
+ * Resolves the accountId from {@link CloudflareEnvironment} and
+ * attaches `alchemy.cloudflare.account_hash` to whichever span is
+ * active. Silently no-ops if the environment isn't resolvable so
+ * State-store layer construction still succeeds in degraded paths.
+ *
+ * `noTrack` controls whether the hash is attached:
+ *   - `true`  — never annotate (caller-level opt-out).
+ *   - `false` — always annotate, regardless of env.
+ *   - `undefined` — fall back to the `NO_TRACK` env var; default off.
+ */
+const annotateAccountHash = (noTrack) => Effect.gen(function* () {
+    if (noTrack === true)
+        return;
+    if (noTrack === undefined) {
+        const fromEnv = yield* Config.boolean("NO_TRACK").pipe(Config.withDefault(false));
+        if (fromEnv)
+            return;
+    }
+    const env = yield* Effect.serviceOption(CloudflareEnvironment.CloudflareEnvironment);
+    if (env._tag !== "Some")
+        return;
+    const hash = yield* hashAccountId(env.value.accountId);
+    yield* Effect.annotateCurrentSpan("alchemy.cloudflare.account_hash", hash);
+}).pipe(Effect.catch(() => Effect.void));
+/**
+ * Manually bootstrap (or repair) the Cloudflare-hosted HTTP State
+ * Store. Used by `alchemy bootstrap cloudflare`.
+ *
+ * The flow mirrors what {@link state} does on first use, but is
+ * exposed as a standalone effect so users can trigger it (or recover
+ * from a partially-failed previous deploy) explicitly:
+ *
+ *   1. Resume any in-progress local `CloudflareStateStore` stack.
+ *   2. If the worker already exists in Cloudflare and `force` is not
+ *      set, adopt it: read the auth token via an edge-preview probe
+ *      and persist credentials.
+ *   3. Otherwise run the full deploy with adoption enabled, sync local
+ *      state into the deployed store, persist credentials, and delete
+ *      the local stack.
+ */
+export const bootstrap = (options = {}) => Effect.gen(function* () {
+    const isCI = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+    const profileName = yield* ALCHEMY_PROFILE;
+    const scriptName = options.workerName ?? STATE_STORE_SCRIPT_NAME;
+    const force = options.force ?? false;
+    yield* Effect.annotateCurrentSpan({
+        "alchemy.state_store.script_name": scriptName,
+        "alchemy.state_store.profile": profileName,
+        "alchemy.state_store.force": force,
+        "alchemy.state_store.ci": isCI,
+    });
+    yield* annotateAccountHash();
+    const localState = yield* makeLocalState();
+    const hasLocalStack = yield* Effect.map(localState.listStages("CloudflareStateStore"), (stages) => stages.includes(scriptName));
+    if (hasLocalStack) {
+        yield* Clank.info(`Resuming Cloudflare State Store '${scriptName}' deployment...`);
+        yield* finishBootstrap({ scriptName, profileName, localState, isCI });
+        yield* Clank.success(`Cloudflare State Store '${scriptName}' is ready.`);
+        return;
+    }
+    const { accountId } = yield* CloudflareEnvironment.CloudflareEnvironment;
+    const workerExists = yield* workers
+        .getScriptSetting({ accountId, scriptName })
+        .pipe(Effect.map((setting) => setting !== undefined), Effect.catchTag("WorkerNotFound", () => Effect.succeed(false)));
+    if (workerExists && !force) {
+        yield* Clank.info(`Worker '${scriptName}' already exists; adopting and refreshing credentials. ` +
+            `Use --force to redeploy.`);
+        const credentials = yield* loginWithCloudflare();
+        if (!isCI) {
+            yield* writeCredentials(profileName, CREDENTIALS_FILE, credentials);
+        }
+        yield* redeployIfStale({
+            scriptName,
+            profileName,
+            localState,
+            isCI,
+            url: credentials.url,
+        });
+        yield* Clank.success(`Cloudflare State Store '${scriptName}' is ready.`);
+        return;
+    }
+    if (workerExists) {
+        yield* Clank.info(`Forcing redeploy of Cloudflare State Store '${scriptName}'...`);
+    }
+    else {
+        yield* Clank.info(`Deploying Cloudflare State Store '${scriptName}'...`);
+    }
+    yield* finishBootstrap({ scriptName, profileName, localState, isCI });
+    yield* Clank.success(`Cloudflare State Store '${scriptName}' is ready.`);
+}).pipe(Effect.withSpan("state_store.bootstrap", {
+    attributes: {
+        "alchemy.state_store.op": "bootstrap",
+        "alchemy.state_store.script_name": options.workerName ?? STATE_STORE_SCRIPT_NAME,
+    },
+}));
+export const state = (props) => Layer.effect(State, Effect.gen(function* () {
+    const isCI = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+    const alchemyContext = yield* AlchemyContext;
+    const profileName = yield* ALCHEMY_PROFILE;
+    const credentials = yield* readCredentials(profileName, CREDENTIALS_FILE);
+    const scriptName = props?.workerName ?? STATE_STORE_SCRIPT_NAME;
+    yield* Effect.annotateCurrentSpan({
+        "alchemy.state_store.script_name": scriptName,
+        "alchemy.state_store.profile": profileName,
+        "alchemy.state_store.ci": isCI,
+    });
+    yield* annotateAccountHash(props?.noTrack);
+    // The bootstrap of the Cloudflare State Store is only considered
+    // successful once two invariants hold:
+    //   1. the worker has been deployed and the credentials persisted
+    //   2. the local CloudflareStateStore stack has been synced into
+    //      the HTTP store and removed from disk
+    //
+    // If a previous run failed anywhere between deploying the worker
+    // and deleting the local stack (e.g. the worker got created but
+    // sync/credential-write/delete never ran) we will detect the
+    // leftover local stack here and resume the bootstrap. This loop
+    // re-runs deploy (idempotent over already-applied resources) and
+    // finishes the sync/credential/cleanup steps until both
+    // invariants are satisfied.
+    const localState = yield* makeLocalState();
+    const hasLocalStack = yield* Effect.map(localState.listStages("CloudflareStateStore"), (stages) => stages.includes(scriptName));
+    if (hasLocalStack) {
+        yield* Clank.info(`Resuming Cloudflare State Store '${scriptName}' deployment...`);
+        return yield* finishBootstrap({
+            scriptName,
+            profileName,
+            localState,
+            isCI,
+        });
+    }
+    if (credentials) {
+        // We have local credentials. Before trusting them, verify
+        // the deployed worker is on the version this CLI was built
+        // against. If it isn't, `redeployIfStale` runs the idempotent
+        // bootstrap flow and short-circuits with the freshly-deployed
+        // store.
+        const fresh = yield* redeployIfStale({
+            scriptName,
+            profileName,
+            localState,
+            isCI,
+            url: credentials.url,
+        });
+        if (fresh)
+            return fresh;
+        const httpState = yield* makeCloudflareStateStore(credentials);
+        if (alchemyContext.updateStateStore) {
+            yield* deployStateStore(scriptName, httpState);
+        }
+        return httpState;
+    }
+    // our profile does not contain a reference to the state store, let's try and resolve it
+    const { accountId } = yield* CloudflareEnvironment.CloudflareEnvironment;
+    const workerExists = yield* workers
+        .getScriptSetting({
+        accountId,
+        scriptName,
+    })
+        .pipe(Effect.map((setting) => setting !== undefined), Effect.catchTag("WorkerNotFound", () => Effect.succeed(false)));
+    if (workerExists) {
+        // it exists, so fetch the secret token
+        const credentials = yield* loginWithCloudflare();
+        if (!isCI) {
+            yield* writeCredentials(profileName, CREDENTIALS_FILE, credentials);
+        }
+        const fresh = yield* redeployIfStale({
+            scriptName,
+            profileName,
+            localState,
+            isCI,
+            url: credentials.url,
+        });
+        if (fresh)
+            return fresh;
+        const httpState = yield* makeCloudflareStateStore(credentials);
+        if (alchemyContext.updateStateStore) {
+            yield* deployStateStore(scriptName, httpState);
+        }
+        return httpState;
+    }
+    if (isCI) {
+        // TODO(sam): do we want to support bootstrapping the state store from CI?
+        // for now - just die here
+        return yield* Effect.die(new AuthError({
+            message: `State store not found for script ${scriptName}. Deploy the state store first.`,
+        }));
+    }
+    const shouldDeploy = yield* Clank.confirm({
+        message: "Cloudflare State Store not found. Do you want to deploy it?",
+    });
+    if (!shouldDeploy) {
+        return yield* Effect.die(new Clank.PromptCancelled());
+    }
+    return yield* finishBootstrap({
+        scriptName,
+        profileName,
+        localState,
+        isCI,
+    });
+}).pipe(recordStateStoreInit, Effect.orDie)).pipe(Layer.provideMerge(Credentials.fromAuthProvider()), Layer.provideMerge(CloudflareEnvironment.fromProfile()), Layer.provideMerge(CloudflareAuth), Layer.provideMerge(Access.AccessLive), Layer.orDie);
+const makeCloudflareStateStore = Effect.fnUntraced(function* ({ url, authToken, }) {
+    const access = yield* Access.Access;
+    const accessHeaders = yield* access.getAccessHeaders(new URL(url).host);
+    return yield* makeHttpStateStore({
+        url,
+        authToken,
+        transformClient: HttpClientRequest.setHeaders(accessHeaders),
+        id: "cloudflare-http",
+    });
+});
+/**
+ * Non-destructively copy every resource in the
+ * `CloudflareStateStore/<scriptName>` stack from `source` into
+ * `destination`, leaving every other stack in `destination` untouched.
+ *
+ * This intentionally does not delete anything from `destination`: at
+ * bootstrap time the destination is the user's live remote state
+ * store, and removing entries that happen to be missing locally would
+ * be catastrophic.
+ */
+const hoistBootstrapStack = Effect.fnUntraced(function* (source, destination, scriptName) {
+    const stack = "CloudflareStateStore";
+    const stage = scriptName;
+    const fqns = yield* source.list({ stack, stage });
+    yield* Effect.annotateCurrentSpan({
+        "alchemy.state_store.stack": stack,
+        "alchemy.state_store.stage": stage,
+        "alchemy.state_store.resources.count": fqns.length,
+    });
+    yield* Effect.forEach(fqns, Effect.fnUntraced(function* (fqn) {
+        const value = yield* source.get({ stack, stage, fqn });
+        if (value) {
+            yield* destination.set({ stack, stage, fqn, value });
+        }
+    }), { concurrency: "unbounded" });
+}, Effect.withSpan("state_store.hoist_bootstrap_stack"));
+/**
+ * Finish (or resume) the bootstrap of the Cloudflare State Store using
+ * the provided local state as the source of truth. This is idempotent
+ * and safe to re-run: any resources already applied during a previous
+ * partial run will be reconciled, the local stack will be synced into
+ * the deployed HTTP store, credentials persisted, and finally the
+ * local stack removed - which is what marks the bootstrap as complete.
+ */
+const finishBootstrap = ({ scriptName, profileName, localState, isCI, }) => Effect.gen(function* () {
+    yield* deployStateStore(scriptName, localState);
+    // Don't trust the `authToken` returned by `deploy(...)`: when
+    // adoption kicks in (the Secrets Store secret already existed),
+    // the locally-generated `Random` value won't match the value
+    // actually persisted in Cloudflare, and any HTTP call to the
+    // worker would 401. Re-read the live token from the deployed
+    // worker via the same edge-preview probe `loginWithCloudflare`
+    // uses, so the credentials we persist always reflect what is
+    // actually deployed. `loginWithCloudflare` also persists the
+    // credentials file (skipping the write in CI), so we don't need
+    // to do that explicitly here.
+    const { url, authToken } = yield* loginWithCloudflare();
+    const httpState = yield* makeCloudflareStateStore({ url, authToken });
+    // `profileName` is intentionally unused here — `loginWithCloudflare`
+    // resolves it itself. Reference it to keep the surrounding API
+    // explicit and to avoid an unused-parameter lint.
+    void profileName;
+    void isCI;
+    // Copy the freshly-deployed CloudflareStateStore stack into the
+    // remote store. We deliberately do NOT call `syncState` here:
+    // syncState is a *mirror* that deletes everything in the
+    // destination that is not in the source, which would wipe every
+    // user stack in the remote store on any subsequent bootstrap
+    // (resume / --force / partial-failure recovery), since by that
+    // point local state only contains the bootstrap stack itself.
+    yield* hoistBootstrapStack(localState, httpState, scriptName);
+    yield* localState.deleteStack({
+        stack: "CloudflareStateStore",
+        stage: scriptName,
+    });
+    return httpState;
+}).pipe(Effect.withSpan("state_store.finish_bootstrap", {
+    attributes: {
+        "alchemy.state_store.op": "finish_bootstrap",
+        "alchemy.state_store.script_name": scriptName,
+        "alchemy.state_store.profile": profileName,
+        "alchemy.state_store.ci": isCI,
+    },
+}));
+const deployStateStore = (scriptName, state) => Effect.gen(function* () {
+    yield* annotateAccountHash();
+    const localState = state ?? (yield* makeLocalState());
+    // deploy it with local state (which we will then hoist into the Cloudflare state store)
+    const stateLayer = Layer.succeed(State, localState);
+    const { url, authToken } = yield* deploy({
+        // use the script name as the stage name (so the user can have multiple state stores)
+        stage: scriptName,
+        stack: Alchemy.Stack("CloudflareStateStore", {
+            providers: Cloudflare.providers(),
+            state: stateLayer,
+        }, Effect.gen(function* () {
+            const token = yield* TokenValue;
+            const api = yield* Api;
+            // Surface the bearer token so tests and clients can authenticate
+            // after deploy. The underlying value lives in the Cloudflare
+            // Secrets Store; this output carries the same generated string.
+            return {
+                url: api.url.as(),
+                authToken: token.text.pipe(Output.map(Redacted.value)),
+            };
+        })),
+    }).pipe(
+    // The Cloudflare State Store is account-level infrastructure that
+    // outlives any single deploy: its underlying Secrets Store and
+    // auth-token secret may already exist from a previous (possibly
+    // partially-failed) bootstrap. Opt in to adoption so the
+    // resources reconcile in place instead of failing on conflict.
+    adopt(true), 
+    // TODO(sam): we should not need to do this, but types do complain. fix deploy
+    Effect.provide(stateLayer));
+    return { url, authToken, localState };
+}).pipe(Effect.withSpan("state_store.deploy", {
+    attributes: {
+        "alchemy.state_store.script_name": scriptName,
+        "alchemy.state_store.op": "deploy",
+    },
+}), recordStateStoreOp("deploy"));
+/**
+ * Log in to a Cloudflare-deployed HTTP state-store.
+ *
+ * 1. Find the single account-wide Secrets Store.
+ * 2. Upload a short-lived edge-preview worker that binds the
+ *    auth-token secret and returns its value.
+ * 3. Derive the state-store worker URL from
+ *    {@link STATE_STORE_SCRIPT_NAME} and the account's workers.dev
+ *    subdomain.
+ * 4. Persist `{ url, token }` under the `http-state-store`
+ *    credentials file.
+ *
+ * Requirements are covered by the Cloudflare provider stack —
+ * `CloudflareEnvironment`, `Credentials`, `HttpClient`, and
+ * `FileSystem`.
+ */
+export const loginWithCloudflare = () => Effect.gen(function* () {
+    const isCI = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+    const profileName = yield* ALCHEMY_PROFILE;
+    const { accountId } = yield* CloudflareEnvironment.CloudflareEnvironment;
+    // 1. Locate the single Secrets Store on the account.
+    const stores = yield* SecretsStore.listStores({ accountId });
+    const store = stores.result[0];
+    if (!store) {
+        return yield* Effect.fail(new AuthError({
+            message: "No Secrets Store found on this account. Deploy the state store first.",
+        }));
+    }
+    // 2. Fetch the auth-token value via an edge-preview worker.
+    //    We piggy-back on the already-deployed state-store script so the
+    //    `cf-workers-preview-token` header has a real workers.dev route to
+    //    swap onto. Uploading the probe under a brand-new script name fails
+    //    on accounts where that script has never been deployed (or where
+    //    workers.dev preview URLs are off by default — the post-2024
+    //    Cloudflare default for new accounts) because the host doesn't
+    //    resolve and Cloudflare's edge serves a 400 HTML error page
+    //    instead of routing to the preview.
+    const authToken = yield* readSecretViaEdge(STATE_STORE_SCRIPT_NAME, store.id, AuthTokenSecretName);
+    // 3. Derive the deployed worker URL.
+    const { subdomain } = yield* workers.getSubdomain({ accountId });
+    const url = `https://${STATE_STORE_SCRIPT_NAME}.${subdomain}.workers.dev`;
+    if (!isCI) {
+        // 4. Persist credentials. The profile entry is managed by
+        //    `loadOrConfigure` when this is invoked through `configure`.
+        yield* writeCredentials(profileName, CREDENTIALS_FILE, {
+            url,
+            authToken: authToken.trim(),
+        }).pipe(Effect.mapError((e) => new AuthError({ message: "Failed to write credentials", cause: e })));
+        yield* Clank.success(`HTTP state store credentials saved for '${profileName}'.`);
+        yield* Clank.info(`  url:     ${url}`);
+    }
+    return {
+        url,
+        authToken: authToken.trim(),
+    };
+}).pipe(Effect.catchTag("EdgeSessionError", (e) => Effect.fail(new AuthError({
+    message: `Edge-preview secret read failed: ${e.message}`,
+    cause: e.cause,
+}))), Effect.withSpan("state_store.login", {
+    attributes: {
+        "alchemy.state_store.op": "login",
+        "alchemy.state_store.script_name": STATE_STORE_SCRIPT_NAME,
+    },
+}));
+/**
+ * Run {@link finishBootstrap} iff the worker at `url` fails the
+ * version probe; otherwise resolve to `undefined`. Centralises the
+ * "is the deployed worker still compatible?" guard used by every
+ * code path that already has a presumably-valid worker URL.
+ */
+const redeployIfStale = ({ url, scriptName, profileName, localState, isCI, }) => Effect.gen(function* () {
+    if (yield* checkStateStoreVersion(url))
+        return undefined;
+    yield* Clank.info(`Cloudflare State Store '${scriptName}' is out of date; redeploying...`);
+    return yield* finishBootstrap({
+        scriptName,
+        profileName,
+        localState,
+        isCI,
+    });
+}).pipe(Effect.withSpan("state_store.redeploy_if_stale", {
+    attributes: {
+        "alchemy.state_store.op": "redeploy_if_stale",
+        "alchemy.state_store.script_name": scriptName,
+        "alchemy.state_store.url": url,
+    },
+}));
+/**
+ * Probe the deployed worker's `/version` endpoint and decide whether
+ * it satisfies the current {@link STATE_STORE_VERSION} contract.
+ *
+ * Reuses the same typed {@link StateApi} client the rest of the store
+ * speaks, just without the bearer-token transform — the `/version`
+ * route is intentionally unauthenticated so we can probe it before
+ * trusting any locally-cached credentials.
+ *
+ * Returns `true` only on a successful response carrying the matching
+ * version. Any failure (404 from a pre-`/version` deploy, transport
+ * error, schema mismatch, version mismatch) collapses to `false`,
+ * since the caller's response in every case is the same: fall
+ * through to the idempotent bootstrap flow.
+ */
+const checkStateStoreVersion = (url) => Effect.gen(function* () {
+    const client = yield* HttpApiClient.make(StateApi, { baseUrl: url });
+    const result = yield* client.version
+        .getVersion()
+        .pipe(Effect.catch(() => Effect.succeed(undefined)));
+    const matches = result?.version === STATE_STORE_VERSION;
+    yield* Effect.annotateCurrentSpan({
+        "alchemy.state_store.expected_version": STATE_STORE_VERSION,
+        "alchemy.state_store.observed_version": result?.version ?? -1,
+        "alchemy.state_store.version_match": matches,
+    });
+    return matches;
+}).pipe(Effect.withSpan("state_store.check_version", {
+    attributes: { "alchemy.state_store.op": "check_version" },
+}));
+/**
+ * Tiny ES-module worker that reads `env.SECRET.get()` and echoes it
+ * back. Uploaded as an ephemeral edge-preview, called once, then
+ * discarded — see {@link readSecretViaEdge}.
+ */
+const SECRET_PROBE_SOURCE = `export default {
+  async fetch(_request, env) {
+    try {
+      const value = await env.SECRET.get();
+      return new Response(value ?? "", { status: 200, headers: { "content-type": "text/plain" } });
+    } catch (e) {
+      return new Response("Error: " + (e && e.message ? e.message : String(e)), { status: 500 });
+    }
+  },
+};`;
+/**
+ * Upload an ephemeral edge-preview build of the given (already
+ * deployed) script that binds the requested Secrets Store secret,
+ * call it once with the preview token, and return the decoded value.
+ * The Cloudflare REST API deliberately hides secret values; only
+ * worker bindings can resolve them, so this is the out-of-band path.
+ *
+ * `scriptName` MUST be a script that is already deployed on the
+ * account with workers.dev enabled — the `cf-workers-preview-token`
+ * header swaps our probe code in for an existing route, it does not
+ * create one. Using an undeployed name (or a deployed script that
+ * doesn't have workers.dev enabled) makes the workers.dev edge serve
+ * a generic Cloudflare 400 HTML error page instead of routing to the
+ * preview. The state-store script itself satisfies both conditions.
+ */
+const readSecretViaEdge = (scriptName, storeId, secretName) => Effect.gen(function* () {
+    const http = yield* HttpClient.HttpClient;
+    const file = new File([SECRET_PROBE_SOURCE], "worker.js", {
+        type: "application/javascript+module",
+    });
+    const session = yield* createEdgeSession({
+        scriptName,
+        files: [file],
+        bindings: [
+            { type: "secrets_store_secret", name: "SECRET", secretName, storeId },
+        ],
+    });
+    const response = yield* http.get(session.url, {
+        headers: session.headers,
+    });
+    if (response.status !== 200) {
+        const body = yield* response.text.pipe(Effect.catch(() => Effect.succeed("")));
+        // TEMP(sam): dump the full body so we can capture the exact
+        // Cloudflare error page when the probe fails in the wild. Drop
+        // this once we've confirmed the routing fix covers all the
+        // observed failure modes.
+        yield* Effect.logWarning(`Secret probe failed (${response.status}) at ${session.url}\n${body}`);
+        return yield* Effect.fail(new EdgeSessionError({
+            message: `Secret probe returned ${response.status}: ${body.slice(0, 200)}`,
+        }));
+    }
+    return yield* response.text;
+}).pipe(Effect.mapError((cause) => cause instanceof EdgeSessionError
+    ? cause
+    : new EdgeSessionError({ message: "Failed to read secret", cause })), Effect.withSpan("state_store.read_secret_via_edge", {
+    attributes: {
+        "alchemy.state_store.op": "read_secret_via_edge",
+        "alchemy.state_store.script_name": scriptName,
+        "alchemy.state_store.secret_name": secretName,
+    },
+}));
+//# sourceMappingURL=State.js.map

package/lib/Cloudflare/StateStore/State.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"State.js","sourceRoot":"","sources":["../../../src/Cloudflare/StateStore/State.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,YAAY,MAAM,2CAA2C,CAAC;AAC1E,OAAO,KAAK,OAAO,MAAM,qCAAqC,CAAC;AAC/D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,iBAAiB,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,aAAa,MAAM,uCAAuC,CAAC;AACvE,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EACL,kBAAkB,GAEnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,qBAAqB,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,KAAK,EAAqB,MAAM,sBAAsB,CAAC;AAChE,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,KAAK,MAAM,qBAAqB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,GAAG,EAAE,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7D,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,CAAC,SAAiB,EAAE,EAAE,CAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CACf,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAC5D,CAAC;AAEJ;;;;;;;;;;;GAWG;AACH,MAAM,mBAAmB,GAAG,CAAC,OAAiB,EAAE,EAAE,CAChD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO;IAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAC1B,CAAC;QACF,IAAI,OAAO;YAAE,OAAO;IACtB,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CACrC,qBAAqB,CAAC,qBAAqB,CAC5C,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAC;AAC7E,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAoB3C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,UAA4B,EAAE,EAAE,EAAE,CAC1D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,uBAAuB,CAAC;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACrC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChC,iCAAiC,EAAE,UAAU;QAC7C,6BAA6B,EAAE,WAAW;QAC1C,2BAA2B,EAAE,KAAK;QAClC,wBAAwB,EAAE,IAAI;KAC/B,CAAC,CAAC;IACH,KAAK,CAAC,CAAC,mBAAmB,EAAE,CAAC;IAE7B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC;IAC3C,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACrC,UAAU,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAC7C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CACxC,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CACf,oCAAoC,UAAU,iBAAiB,CAChE,CAAC;QACF,KAAK,CAAC,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,2BAA2B,UAAU,aAAa,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC;IACzE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,OAAO;SAChC,gBAAgB,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;SAC3C,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,EAC9C,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAC/D,CAAC;IAEJ,IAAI,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CACf,WAAW,UAAU,yDAAyD;YAC5E,0BAA0B,CAC7B,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,mBAAmB,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,CAAC,gBAAgB,CACrB,WAAW,EACX,gBAAgB,EAChB,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,CAAC,eAAe,CAAC;YACrB,UAAU;YACV,WAAW;YACX,UAAU;YACV,IAAI;YACJ,GAAG,EAAE,WAAW,CAAC,GAAG;SACrB,CAAC,CAAC;QACH,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,2BAA2B,UAAU,aAAa,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CACf,+CAA+C,UAAU,MAAM,CAChE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,qCAAqC,UAAU,MAAM,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,2BAA2B,UAAU,aAAa,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE;IACvC,UAAU,EAAE;QACV,wBAAwB,EAAE,WAAW;QACrC,iCAAiC,EAC/B,OAAO,CAAC,UAAU,IAAI,uBAAuB;KAChD;CACF,CAAC,CACH,CAAC;AAEJ,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,KAyBrB,EAAE,EAAE,CACH,KAAK,CAAC,MAAM,CACV,KAAK,EACL,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IAC7C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAe,CACxC,WAAW,EACX,gBAAgB,CACjB,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,EAAE,UAAU,IAAI,uBAAuB,CAAC;IAChE,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChC,iCAAiC,EAAE,UAAU;QAC7C,6BAA6B,EAAE,WAAW;QAC1C,wBAAwB,EAAE,IAAI;KAC/B,CAAC,CAAC;IACH,KAAK,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE3C,iEAAiE;IACjE,uCAAuC;IACvC,kEAAkE;IAClE,iEAAiE;IACjE,4CAA4C;IAC5C,EAAE;IACF,iEAAiE;IACjE,gEAAgE;IAChE,6DAA6D;IAC7D,gEAAgE;IAChE,iEAAiE;IACjE,wDAAwD;IACxD,4BAA4B;IAC5B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC;IAE3C,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACrC,UAAU,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAC7C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CACxC,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CACf,oCAAoC,UAAU,iBAAiB,CAChE,CAAC;QACF,OAAO,KAAK,CAAC,CAAC,eAAe,CAAC;YAC5B,UAAU;YACV,WAAW;YACX,UAAU;YACV,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,0DAA0D;QAC1D,2DAA2D;QAC3D,8DAA8D;QAC9D,8DAA8D;QAC9D,SAAS;QACT,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;YACnC,UAAU;YACV,WAAW;YACX,UAAU;YACV,IAAI;YACJ,GAAG,EAAE,WAAW,CAAC,GAAG;SACrB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,wBAAwB,CAAC,WAAW,CAAC,CAAC;QAE/D,IAAI,cAAc,CAAC,gBAAgB,EAAE,CAAC;YACpC,KAAK,CAAC,CAAC,gBAAgB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACjD,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,wFAAwF;IACxF,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC;IACzE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,OAAO;SAChC,gBAAgB,CAAC;QAChB,SAAS;QACT,UAAU;KACX,CAAC;SACD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,EAC9C,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAC/D,CAAC;IAEJ,IAAI,YAAY,EAAE,CAAC;QACjB,uCAAuC;QACvC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,mBAAmB,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,CAAC,gBAAgB,CACrB,WAAW,EACX,gBAAgB,EAChB,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;YACnC,UAAU;YACV,WAAW;YACX,UAAU;YACV,IAAI;YACJ,GAAG,EAAE,WAAW,CAAC,GAAG;SACrB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,wBAAwB,CAAC,WAAW,CAAC,CAAC;QAE/D,IAAI,cAAc,CAAC,gBAAgB,EAAE,CAAC;YACpC,KAAK,CAAC,CAAC,gBAAgB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACjD,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,0EAA0E;QAC1E,0BAA0B;QAC1B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,IAAI,SAAS,CAAC;YACZ,OAAO,EAAE,oCAAoC,UAAU,iCAAiC;SACzF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QACxC,OAAO,EAAE,6DAA6D;KACvE,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,eAAe,CAAC;QAC5B,UAAU;QACV,WAAW;QACX,UAAU;QACV,IAAI;KACL,CAAC,CAAC;AACL,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,KAAK,CAAC,CAC5C,CAAC,IAAI,CACJ,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,EAClD,KAAK,CAAC,YAAY,CAAC,qBAAqB,CAAC,WAAW,EAAE,CAAC,EACvD,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,EAClC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,EACrC,KAAK,CAAC,KAAK,CACZ,CAAC;AAEJ,MAAM,wBAAwB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAC5D,GAAG,EACH,SAAS,GAIV;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IACpC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC;QAC/B,GAAG;QACH,SAAS;QACT,eAAe,EAAE,iBAAiB,CAAC,UAAU,CAAC,aAAa,CAAC;QAC5D,EAAE,EAAE,iBAAiB;KACtB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EACrD,MAAoB,EACpB,WAAyB,EACzB,UAAkB;IAElB,MAAM,KAAK,GAAG,sBAAsB,CAAC;IACrC,MAAM,KAAK,GAAG,UAAU,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChC,2BAA2B,EAAE,KAAK;QAClC,2BAA2B,EAAE,KAAK;QAClC,qCAAqC,EAAE,IAAI,CAAC,MAAM;KACnD,CAAC,CAAC;IACH,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,IAAI,EACJ,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,GAAG;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAC,EACF,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;AACJ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,CAAC,EACvB,UAAU,EACV,WAAW,EACX,UAAU,EACV,IAAI,GAML,EAAE,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAEhD,8DAA8D;IAC9D,gEAAgE;IAChE,6DAA6D;IAC7D,6DAA6D;IAC7D,6DAA6D;IAC7D,+DAA+D;IAC/D,6DAA6D;IAC7D,6DAA6D;IAC7D,gEAAgE;IAChE,8BAA8B;IAC9B,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,mBAAmB,EAAE,CAAC;IACxD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,wBAAwB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACtE,qEAAqE;IACrE,+DAA+D;IAC/D,kDAAkD;IAClD,KAAK,WAAW,CAAC;IACjB,KAAK,IAAI,CAAC;IAEV,gEAAgE;IAChE,8DAA8D;IAC9D,yDAAyD;IACzD,gEAAgE;IAChE,6DAA6D;IAC7D,+DAA+D;IAC/D,8DAA8D;IAC9D,KAAK,CAAC,CAAC,mBAAmB,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAE9D,KAAK,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC;QAC5B,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,UAAU;KAClB,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,8BAA8B,EAAE;IAC9C,UAAU,EAAE;QACV,wBAAwB,EAAE,kBAAkB;QAC5C,iCAAiC,EAAE,UAAU;QAC7C,6BAA6B,EAAE,WAAW;QAC1C,wBAAwB,EAAE,IAAI;KAC/B;CACF,CAAC,CACH,CAAC;AAEJ,MAAM,gBAAgB,GAAG,CAAC,UAAkB,EAAE,KAAoB,EAAE,EAAE,CACpE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,mBAAmB,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;IACtD,wFAAwF;IACxF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;QACvC,qFAAqF;QACrF,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,OAAO,CAAC,KAAK,CAClB,sBAAsB,EACtB;YACE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE;YACjC,KAAK,EAAE,UAAU;SAClB,EACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;YAChC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC;YAEvB,iEAAiE;YACjE,6DAA6D;YAC7D,gEAAgE;YAChE,OAAO;gBACL,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAU;gBACzB,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;aACvD,CAAC;QACJ,CAAC,CAAC,CACH;KACF,CAAC,CAAC,IAAI;IACL,kEAAkE;IAClE,+DAA+D;IAC/D,gEAAgE;IAChE,yDAAyD;IACzD,+DAA+D;IAC/D,KAAK,CAAC,IAAI,CAAC;IACX,8EAA8E;IAC9E,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACxC,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE;IACpC,UAAU,EAAE;QACV,iCAAiC,EAAE,UAAU;QAC7C,wBAAwB,EAAE,QAAQ;KACnC;CACF,CAAC,EACF,kBAAkB,CAAC,QAAQ,CAAC,CAC7B,CAAC;AAEJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,EAAE,CACtC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAC3C,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC;IAEzE,qDAAqD;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CAAC;YACZ,OAAO,EACL,uEAAuE;SAC1E,CAAC,CACH,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,qEAAqE;IACrE,iEAAiE;IACjE,mEAAmE;IACnE,gEAAgE;IAChE,wCAAwC;IACxC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,iBAAiB,CACxC,uBAAuB,EACvB,KAAK,CAAC,EAAE,EACR,mBAAmB,CACpB,CAAC;IAEF,qCAAqC;IACrC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,WAAW,uBAAuB,IAAI,SAAS,cAAc,CAAC;IAE1E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,0DAA0D;QAC1D,iEAAiE;QACjE,KAAK,CAAC,CAAC,gBAAgB,CACrB,WAAW,EACX,gBAAgB,EAChB;YACE,GAAG;YACH,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE;SAC5B,CACF,CAAC,IAAI,CACJ,MAAM,CAAC,QAAQ,CACb,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CACtE,CACF,CAAC;QAEF,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAClB,2CAA2C,WAAW,IAAI,CAC3D,CAAC;QACF,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,OAAO;QACL,GAAG;QACH,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE;KAC5B,CAAC;AACJ,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CACxC,MAAM,CAAC,IAAI,CACT,IAAI,SAAS,CAAC;IACZ,OAAO,EAAE,oCAAoC,CAAC,CAAC,OAAO,EAAE;IACxD,KAAK,EAAE,CAAC,CAAC,KAAK;CACf,CAAC,CACH,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE;IACnC,UAAU,EAAE;QACV,wBAAwB,EAAE,OAAO;QACjC,iCAAiC,EAAE,uBAAuB;KAC3D;CACF,CAAC,CACH,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,EACvB,GAAG,EACH,UAAU,EACV,WAAW,EACX,UAAU,EACV,IAAI,GAOL,EAAE,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,KAAK,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACzD,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CACf,2BAA2B,UAAU,kCAAkC,CACxE,CAAC;IACF,OAAO,KAAK,CAAC,CAAC,eAAe,CAAC;QAC5B,UAAU;QACV,WAAW;QACX,UAAU;QACV,IAAI;KACL,CAAC,CAAC;AACL,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,+BAA+B,EAAE;IAC/C,UAAU,EAAE;QACV,wBAAwB,EAAE,mBAAmB;QAC7C,iCAAiC,EAAE,UAAU;QAC7C,yBAAyB,EAAE,GAAG;KAC/B;CACF,CAAC,CACH,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,sBAAsB,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO;SACjC,UAAU,EAAE;SACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,KAAK,mBAAmB,CAAC;IACxD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChC,sCAAsC,EAAE,mBAAmB;QAC3D,sCAAsC,EAAE,MAAM,EAAE,OAAO,IAAI,CAAC,CAAC;QAC7D,mCAAmC,EAAE,OAAO;KAC7C,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE;IAC3C,UAAU,EAAE,EAAE,wBAAwB,EAAE,eAAe,EAAE;CAC1D,CAAC,CACH,CAAC;AAEJ;;;;GAIG;AACH,MAAM,mBAAmB,GAAG;;;;;;;;;GASzB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,iBAAiB,GAAG,CACxB,UAAkB,EAClB,OAAe,EACf,UAAkB,EAClB,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE;QACxD,IAAI,EAAE,+BAA+B;KACtC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;QACvC,UAAU;QACV,KAAK,EAAE,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE;YACR,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE;SACtE;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE;QAC5C,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CACpC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CACvC,CAAC;QACF,4DAA4D;QAC5D,+DAA+D;QAC/D,2DAA2D;QAC3D,0BAA0B;QAC1B,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CACtB,wBAAwB,QAAQ,CAAC,MAAM,QAAQ,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CACtE,CAAC;QACF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,gBAAgB,CAAC;YACnB,OAAO,EAAE,yBAAyB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAC3E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;AAC9B,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,KAAK,YAAY,gBAAgB;IAC/B,CAAC,CAAC,KAAK;IACP,CAAC,CAAC,IAAI,gBAAgB,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,CACtE,EACD,MAAM,CAAC,QAAQ,CAAC,kCAAkC,EAAE;IAClD,UAAU,EAAE;QACV,wBAAwB,EAAE,sBAAsB;QAChD,iCAAiC,EAAE,UAAU;QAC7C,iCAAiC,EAAE,UAAU;KAC9C;CACF,CAAC,CACH,CAAC"}

package/lib/Cloudflare/StateStore/Store.d.ts

@@ -0,0 +1,82 @@
+import * as Effect from "effect/Effect";
+import type { ReplacedResourceState, ResourceState } from "../../State/ResourceState.ts";
+import { DurableObjectNamespace } from "../Workers/DurableObjectNamespace.ts";
+declare const Store_base: Effect.Effect<DurableObjectNamespace<Store>, never, import("../index.ts").Worker | import("../index.ts").SecretBinding> & (new (_: never) => {
+    /**
+     * (Root DO only) List every stack name ever registered.
+     */
+    listStacks: () => Effect.Effect<string[], never, never>;
+    /**
+     * (Root DO only) Register a stack name. Idempotent — safe to
+     * call on every `set` to the corresponding stack DO.
+     */
+    registerStack: ({ stack }: {
+        stack: string;
+    }) => Effect.Effect<void, never, never>;
+    /**
+     * (Root DO only) Remove a stack name from the global index.
+     */
+    unregisterStack: ({ stack }: {
+        stack: string;
+    }) => Effect.Effect<boolean, never, never>;
+    /** (Stack DO only) List stages with at least one resource. */
+    listStages: () => Effect.Effect<string[], never, never>;
+    /** (Stack DO only) List every resource FQN in a stage. */
+    listResources: ({ stage }: {
+        stage: string;
+    }) => Effect.Effect<string[], never, never>;
+    /**
+     * (Stack DO only) Get a resource by (stage, fqn). Returns
+     * null if missing.
+     */
+    get: ({ stage, fqn }: {
+        stage: string;
+        fqn: string;
+    }) => Effect.Effect<ResourceState | undefined, never, never>;
+    /**
+     * (Stack DO only) Persist a resource. Returns the stored
+     * value unchanged.
+     */
+    set: ({ stage, fqn, value, }: {
+        stage: string;
+        fqn: string;
+        value: ResourceState;
+    }) => Effect.Effect<ResourceState, never, never>;
+    /**
+     * (Stack DO only) Delete a resource. Idempotent.
+     *
+     * Exposed as `remove` (not `delete`) because Cloudflare's
+     * Durable Object RPC stub reserves `delete` and refuses to
+     * proxy the call, surfacing as "RPC receiver does not
+     * implement the method 'delete'".
+     */
+    remove: ({ stage, fqn }: {
+        stage: string;
+        fqn: string;
+    }) => Effect.Effect<boolean, never, never>;
+    /**
+     * (Stack DO only) Delete every resource in this stack, or every
+     * resource in a single stage when specified.
+     */
+    deleteStack: ({ stage }?: {
+        stage?: string;
+    }) => Effect.Effect<void, never, never>;
+    /**
+     * (Stack DO only) Return every resource in a stage whose
+     * `status === "replaced"`. Each entry is decrypted so the
+     * `status` field can be inspected.
+     */
+    getReplacedResources: ({ stage }: {
+        stage: string;
+    }) => Effect.Effect<ReplacedResourceState[], never, never>;
+});
+export default class Store extends Store_base {
+    /**
+     * Well-known DO name whose sole job is to track the set of stacks
+     * that have ever had resources written. `listStacks` queries it;
+     * every `set` asks it to register the stack (idempotent).
+     */
+    static readonly ROOT_DO_NAME: "__root__";
+}
+export {};
+//# sourceMappingURL=Store.d.ts.map

package/lib/Cloudflare/StateStore/Store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Store.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/StateStore/Store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EACV,qBAAqB,EACrB,aAAa,EACd,MAAM,8BAA8B,CAAC;AAItC,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;;IAiEtE;;OAEG;;IAYH;;;OAGG;+BACwB;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE;IAG5C;;OAEG;iCAC0B;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE;IAK9C,8DAA8D;;IAiB9D,0DAA0D;+BAC/B;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE;IAgB5C;;;OAGG;0BACmB;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IASpD;;;OAGG;kCAKA;QACD,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,aAAa,CAAC;KACtB;IAUD;;;;;;;OAOG;6BACsB;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAGvD;;;OAGG;8BACsB;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAa3C;;;;OAIG;sCAC+B;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE;;AAhM3D,MAAM,CAAC,OAAO,OAAO,KAAM,SAAQ,UAkNlC;IACC;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAG,UAAU,CAAU;CACpD"}