alchemy 2.0.0-beta.35 → 2.0.0-beta.37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alchemy",
-  "version": "2.0.0-beta.35",
+  "version": "2.0.0-beta.37",
   "homepage": "https://alchemy.run",
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",
@@ -275,14 +275,14 @@
     "@ai-sdk/provider": "^3.0.8",
     "@aws-sdk/credential-providers": "^3.0.0",
     "@clack/prompts": "^0.11.0",
-    "@distilled.cloud/aws": "^0.19.0",
-    "@distilled.cloud/axiom": "^0.19.0",
-    "@distilled.cloud/cloudflare": "^0.19.0",
+    "@distilled.cloud/aws": "^0.19.1",
+    "@distilled.cloud/axiom": "^0.19.1",
+    "@distilled.cloud/cloudflare": "^0.19.1",
     "@distilled.cloud/cloudflare-rolldown-plugin": "0.3.0",
     "@distilled.cloud/cloudflare-runtime": "0.3.2",
     "@distilled.cloud/cloudflare-vite-plugin": "0.2.0",
-    "@distilled.cloud/core": "^0.19.0",
-    "@distilled.cloud/neon": "^0.19.0",
+    "@distilled.cloud/core": "^0.19.1",
+    "@distilled.cloud/neon": "^0.19.1",
     "pg": "^8.13.0",
     "@effect/vitest": ">=4.0.0-beta.60 || >=4.0.0",
     "@libsql/client": "^0.17.0",
@@ -291,7 +291,6 @@
     "@smithy/shared-ini-file-loader": "^4.3.4",
     "@smithy/types": "^4.8.1",
     "@types/aws-lambda": "^8.10.152",
-    "@types/libsodium-wrappers": "^0.8.2",
     "ai": "^6.0.62",
     "aws4fetch": "^1.0.20",
     "capnweb": "^0.6.1",
@@ -309,6 +308,7 @@
     "react": "^19.2.0",
     "rolldown": "1.0.0-rc.17",
     "sonda": "^0.11.1",
+    "undici": "^7.16.0",
     "web-tree-sitter": "0.25.10",
     "yaml": "^2.0.0"
   },

package/src/AWS/Lambda/Function.ts

@@ -10,6 +10,7 @@ import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import type * as rolldown from "rolldown";
@@ -368,7 +369,21 @@ export const Function: Platform<
       set: (id: string, output: Output.Output) =>
         Effect.sync(() => {
           const key = id.replaceAll(/[^a-zA-Z0-9]/g, "_");
-          env[key] = output.pipe(Output.map((value) => JSON.stringify(value)));
+          // Preserve `Redacted`-ness across the Output → Lambda env var
+          // round-trip. `JSON.stringify(Redacted)` would emit the literal
+          // string `"<redacted>"` and lose the value, so secrets are
+          // serialized with a `{_tag: "Redacted", value: ...}` marker
+          // that the runtime `get` path detects and rebuilds.
+          env[key] = output.pipe(
+            Output.map((value) =>
+              Redacted.isRedacted(value)
+                ? JSON.stringify({
+                    _tag: "Redacted",
+                    value: Redacted.value(value),
+                  })
+                : JSON.stringify(value),
+            ),
+          );
           return key;
         }),
       get: <T>(key: string) =>
@@ -377,7 +392,20 @@ export const Function: Platform<
           .pipe(
             Effect.flatMap((val) =>
               Effect.try({
-                try: () => JSON.parse(val) as T,
+                try: () => {
+                  const value = JSON.parse(val);
+                  if (
+                    value !== null &&
+                    typeof value === "object" &&
+                    (value as { _tag?: unknown })._tag === "Redacted" &&
+                    "value" in (value as object)
+                  ) {
+                    return Redacted.make(
+                      (value as { value: unknown }).value,
+                    ) as unknown as T;
+                  }
+                  return value as T;
+                },
                 catch: () => val, // assume it's just a string
               }),
             ),

package/src/Apply.ts

@@ -185,7 +185,14 @@ export const apply = <P extends Plan>(
     const outputs = Object.fromEntries(
       Object.entries(tracker).map(([fqn, t]) => [fqn, t.output]),
     );
-    return yield* Output.evaluate(plan.output, outputs);
+    const resolved = yield* Output.evaluate(plan.output, outputs);
+
+    // Persist the stack's evaluated outputs so cross-stack references
+    // (`yield* OtherStack` / `OtherStack.stage.<name>` / `Output.stackRef`)
+    // can read them back out of the state store.
+    yield* state.setOutput({ stack: stackName, stage, value: resolved });
+
+    return resolved;
   }).pipe(
     ensureArtifactStore,
     Effect.withSpan("apply", {

package/src/Cli/main.ts

@@ -8,9 +8,12 @@ import { AlchemyContextLive } from "alchemy/AlchemyContext";
 import { CredentialsStoreLive } from "alchemy/Auth/Credentials";
 import { ProfileLive } from "alchemy/Auth/Profile";
 import { TelemetryLive } from "alchemy/Telemetry/Layer";
+import { installLocalhostDns } from "alchemy/Util/LocalhostDns";
 import { PlatformServices } from "alchemy/Util/PlatformServices";
 import packageJson from "../../package.json" with { type: "json" };
 
+installLocalhostDns();
+
 import { checkLatestVersion } from "./checkVersion.ts";
 import { handleCancellation } from "./commands/_shared.ts";
 import { awsCommand } from "./commands/aws.ts";

package/src/Cloudflare/AnalyticsEngine/AnalyticsEngineDataset.ts

@@ -0,0 +1,82 @@
+import * as Effect from "effect/Effect";
+import { AnalyticsEngineDatasetBinding } from "./AnalyticsEngineDatasetBinding.ts";
+
+type AnalyticsEngineDatasetTypeId = typeof AnalyticsEngineDatasetTypeId;
+const AnalyticsEngineDatasetTypeId =
+  "Cloudflare.AnalyticsEngineDataset" as const;
+
+export type AnalyticsEngineDatasetProps = {
+  /**
+   * Dataset name. If omitted, the logical ID is used.
+   */
+  dataset?: string;
+};
+
+/**
+ * A Cloudflare Workers Analytics Engine dataset binding.
+ *
+ * Analytics Engine datasets are configured as Worker bindings. The binding
+ * exposes `writeDataPoint()` at runtime and does not require separate
+ * provisioning through the Cloudflare API.
+ *
+ * @resource
+ *
+ * @section Binding to a Worker
+ * @example Basic Analytics Engine binding
+ * ```typescript
+ * const Analytics = yield* Cloudflare.AnalyticsEngineDataset("Analytics", {
+ *   dataset: "app-events",
+ * });
+ *
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   bindings: { Analytics },
+ * });
+ * ```
+ *
+ * @example Effect-style worker
+ * ```typescript
+ * const analytics = yield* Cloudflare.AnalyticsEngineDataset.bind(Analytics);
+ * yield* analytics.writeDataPoint({ blobs: ["signup"] });
+ * ```
+ */
+export type AnalyticsEngineDataset = {
+  kind: AnalyticsEngineDatasetTypeId;
+  name: string;
+  dataset: string;
+};
+
+export const isAnalyticsEngineDataset = (
+  value: unknown,
+): value is AnalyticsEngineDataset =>
+  typeof value === "object" &&
+  value !== null &&
+  "kind" in value &&
+  (value as AnalyticsEngineDataset).kind === AnalyticsEngineDatasetTypeId;
+
+export const AnalyticsEngineDataset: {
+  (
+    name: string,
+    props?: AnalyticsEngineDatasetProps,
+  ): Effect.Effect<AnalyticsEngineDataset>;
+  /**
+   * Bind Analytics Engine to the surrounding Worker, returning an
+   * Effect-native client with access to the native Workers runtime binding.
+   */
+  bind: typeof AnalyticsEngineDatasetBinding.bind;
+} = Object.assign(
+  Effect.fnUntraced(function* (
+    name: string,
+    props?: AnalyticsEngineDatasetProps,
+  ) {
+    return {
+      kind: AnalyticsEngineDatasetTypeId,
+      name,
+      dataset: props?.dataset ?? name,
+    } satisfies AnalyticsEngineDataset;
+  }),
+  {
+    bind: (...args: Parameters<typeof AnalyticsEngineDatasetBinding.bind>) =>
+      AnalyticsEngineDatasetBinding.bind(...args),
+  },
+);

package/src/Cloudflare/AnalyticsEngine/AnalyticsEngineDatasetBinding.ts

@@ -0,0 +1,106 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import type { AnalyticsEngineDataset as AnalyticsEngineDatasetLike } from "./AnalyticsEngineDataset.ts";
+
+export interface AnalyticsEngineDataPoint {
+  indexes?: string[];
+  blobs?: string[];
+  doubles?: number[];
+}
+
+export interface RuntimeAnalyticsEngineDataset {
+  writeDataPoint(dataPoint: AnalyticsEngineDataPoint): void;
+}
+
+export class AnalyticsEngineDatasetError extends Data.TaggedError(
+  "AnalyticsEngineDatasetError",
+)<{
+  message: string;
+  cause: Error;
+}> {}
+
+export interface AnalyticsEngineDatasetClient {
+  raw: Effect.Effect<RuntimeAnalyticsEngineDataset, never, WorkerEnvironment>;
+  writeDataPoint(
+    dataPoint: AnalyticsEngineDataPoint,
+  ): Effect.Effect<void, AnalyticsEngineDatasetError, WorkerEnvironment>;
+}
+
+export class AnalyticsEngineDatasetBinding extends Binding.Service<
+  AnalyticsEngineDatasetBinding,
+  (
+    dataset: AnalyticsEngineDatasetLike,
+  ) => Effect.Effect<AnalyticsEngineDatasetClient>
+>()("Cloudflare.AnalyticsEngineDataset.Binding") {}
+
+export const AnalyticsEngineDatasetBindingLive = Layer.effect(
+  AnalyticsEngineDatasetBinding,
+  Effect.gen(function* () {
+    const bind = yield* AnalyticsEngineDatasetBindingPolicy;
+
+    return Effect.fnUntraced(function* (dataset: AnalyticsEngineDatasetLike) {
+      yield* bind(dataset);
+
+      const raw = WorkerEnvironment.asEffect().pipe(
+        Effect.map(
+          (env) =>
+            (env as Record<string, RuntimeAnalyticsEngineDataset>)[
+              dataset.name
+            ]!,
+        ),
+      );
+
+      return {
+        raw,
+        writeDataPoint: (dataPoint) =>
+          raw.pipe(
+            Effect.flatMap((raw) =>
+              Effect.try({
+                try: () => raw.writeDataPoint(dataPoint),
+                catch: (error: any) =>
+                  new AnalyticsEngineDatasetError({
+                    message: error?.message ?? "Unknown error",
+                    cause: error,
+                  }),
+              }),
+            ),
+          ),
+      } satisfies AnalyticsEngineDatasetClient;
+    });
+  }),
+);
+
+export class AnalyticsEngineDatasetBindingPolicy extends Binding.Policy<
+  AnalyticsEngineDatasetBindingPolicy,
+  (dataset: AnalyticsEngineDatasetLike) => Effect.Effect<void>
+>()("Cloudflare.AnalyticsEngineDataset.Binding") {}
+
+export const AnalyticsEngineDatasetBindingPolicyLive =
+  AnalyticsEngineDatasetBindingPolicy.layer.succeed(
+    Effect.fnUntraced(function* (
+      host: ResourceLike,
+      dataset: AnalyticsEngineDatasetLike,
+    ) {
+      if (isWorker(host)) {
+        yield* host.bind(dataset.name, {
+          bindings: [
+            {
+              type: "analytics_engine",
+              name: dataset.name,
+              dataset: dataset.dataset,
+            },
+          ],
+        });
+      } else {
+        return yield* Effect.die(
+          new Error(
+            `AnalyticsEngineDatasetBinding does not support runtime '${host.Type}'`,
+          ),
+        );
+      }
+    }),
+  );

package/src/Cloudflare/AnalyticsEngine/index.ts

@@ -0,0 +1,2 @@
+export * from "./AnalyticsEngineDataset.ts";
+export * from "./AnalyticsEngineDatasetBinding.ts";

package/src/Cloudflare/D1/D1Connection.ts

@@ -7,6 +7,86 @@ import { WorkerEnvironment } from "../Workers/Worker.ts";
 import type { D1Database } from "./D1Database.ts";
 import { DatabaseBinding } from "./D1DatabaseBinding.ts";
 
+/**
+ * Effect-native wrapper around a Cloudflare D1 prepared statement.
+ *
+ * Construction (`prepare`) and binding (`bind`) are synchronous —
+ * they're plan builders and don't touch D1. Only the executors
+ * (`all`, `first`, `run`, `raw`) round-trip to the database, and
+ * those return Effects so they participate in the Effect runtime.
+ */
+export class D1PreparedStatement {
+  /** @internal */
+  constructor(
+    private readonly query: string,
+    private readonly binds: ReadonlyArray<unknown>,
+    private readonly rawEff: Effect.Effect<runtime.D1Database>,
+  ) {}
+
+  /**
+   * Return a new prepared statement bound to `values`. Subsequent
+   * calls replace the previous binding, matching the underlying
+   * Cloudflare runtime semantics.
+   */
+  bind(...values: unknown[]): D1PreparedStatement {
+    return new D1PreparedStatement(this.query, values, this.rawEff);
+  }
+
+  /** Run the query and return all matching rows. */
+  all<T = unknown>(): Effect.Effect<runtime.D1Result<T>> {
+    return this.withRuntime((stmt) => stmt.all<T>());
+  }
+
+  /** Run the query and return the first row, or `null` if no rows. */
+  first<T = unknown>(): Effect.Effect<T | null>;
+  first<T = unknown>(column: string): Effect.Effect<T | null>;
+  first<T = unknown>(column?: string): Effect.Effect<T | null> {
+    return this.withRuntime((stmt) =>
+      column !== undefined ? stmt.first<T>(column) : stmt.first<T>(),
+    );
+  }
+
+  /** Run the query as a mutation; returns row metadata. */
+  run<T = unknown>(): Effect.Effect<runtime.D1Result<T>> {
+    return this.withRuntime((stmt) => stmt.run<T>());
+  }
+
+  /** Run the query and return rows as flat arrays. */
+  raw<T = unknown[]>(): Effect.Effect<T[]>;
+  raw<T = unknown[]>(options: {
+    columnNames: true;
+  }): Effect.Effect<[string[], ...T[]]>;
+  raw<T = unknown[]>(options?: {
+    columnNames: true;
+  }): Effect.Effect<T[] | [string[], ...T[]]> {
+    return this.withRuntime((stmt) =>
+      options
+        ? stmt.raw<T>(options)
+        : (stmt.raw<T>() as Promise<T[] | [string[], ...T[]]>),
+    );
+  }
+
+  /**
+   * Materialize the underlying Cloudflare prepared statement against
+   * a concrete D1 binding. Used by `D1ConnectionClient.batch` to
+   * collect statements for a single transactional call.
+   *
+   * @internal
+   */
+  _build(raw: runtime.D1Database): runtime.D1PreparedStatement {
+    const stmt = raw.prepare(this.query);
+    return this.binds.length > 0 ? stmt.bind(...this.binds) : stmt;
+  }
+
+  private withRuntime<A>(
+    fn: (stmt: runtime.D1PreparedStatement) => Promise<A>,
+  ): Effect.Effect<A> {
+    return Effect.flatMap(this.rawEff, (raw) =>
+      Effect.promise(() => fn(this._build(raw))),
+    );
+  }
+}
+
 export interface D1ConnectionClient {
   /**
    * An Effect that resolves to the raw underlying Cloudflare D1Database binding.
@@ -14,9 +94,11 @@ export interface D1ConnectionClient {
    */
   raw: Effect.Effect<runtime.D1Database>;
   /**
-   * Prepare a SQL query statement for later execution.
+   * Prepare a SQL statement. Returns synchronously — the network
+   * round-trip happens when you yield one of the statement's
+   * executors (`all`, `first`, `run`, `raw`).
    */
-  prepare: (query: string) => Effect.Effect<runtime.D1PreparedStatement>;
+  prepare: (query: string) => D1PreparedStatement;
   /**
    * Execute raw SQL without prepared statements.
    */
@@ -26,7 +108,7 @@ export interface D1ConnectionClient {
    * Statements execute sequentially and are rolled back on failure.
    */
   batch: <T = unknown>(
-    statements: runtime.D1PreparedStatement[],
+    statements: D1PreparedStatement[],
   ) => Effect.Effect<runtime.D1Result<T>[]>;
 }
 
@@ -42,22 +124,23 @@ export const D1ConnectionLive = Layer.effect(
 
     return Effect.fn(function* (database: D1Database) {
       yield* Policy(database);
-      const d1 = yield* Effect.serviceOption(WorkerEnvironment).pipe(
+      const rawEff = yield* Effect.serviceOption(WorkerEnvironment).pipe(
         Effect.map(Option.getOrUndefined),
         Effect.map((env) => env?.[database.LogicalId]! as runtime.D1Database),
         Effect.cached,
       );
 
       return {
-        raw: d1,
-        prepare: (query: string) =>
-          d1.pipe(Effect.map((d1) => d1.prepare(query))),
+        raw: rawEff,
+        prepare: (query: string) => new D1PreparedStatement(query, [], rawEff),
         exec: (query: string) =>
-          d1.pipe(Effect.flatMap((d1) => Effect.promise(() => d1.exec(query)))),
-        batch: <T = unknown>(statements: runtime.D1PreparedStatement[]) =>
-          d1.pipe(
-            Effect.flatMap((d1) =>
-              Effect.promise(() => d1.batch<T>(statements)),
+          Effect.flatMap(rawEff, (raw) =>
+            Effect.promise(() => raw.exec(query)),
+          ),
+        batch: <T = unknown>(statements: D1PreparedStatement[]) =>
+          Effect.flatMap(rawEff, (raw) =>
+            Effect.promise(() =>
+              raw.batch<T>(statements.map((s) => s._build(raw))),
             ),
           ),
       } satisfies D1ConnectionClient;

package/src/Cloudflare/Images/Images.ts

@@ -0,0 +1,121 @@
+import * as Effect from "effect/Effect";
+import { ImagesBinding } from "./ImagesBinding.ts";
+
+type ImagesTypeId = typeof ImagesTypeId;
+const ImagesTypeId = "Cloudflare.Images" as const;
+
+export type ImagesProps = {
+  /**
+   * Binding name used when `Cloudflare.Images.bind(images)` attaches Images
+   * from inside a Worker init phase. When Images is passed through
+   * `Worker({ bindings: { ... } })`, the object key remains the binding name.
+   *
+   * @default "IMAGES"
+   */
+  name?: string;
+};
+
+/**
+ * Marker for a Cloudflare Images binding.
+ *
+ * Images bindings are configured directly on Workers and do not have a
+ * standalone provisioning API. The Worker provider sees this object in
+ * `bindings: { ... }` and emits the corresponding `{ type: "images" }`
+ * metadata binding to the script.
+ */
+export type Images = {
+  kind: ImagesTypeId;
+  name: string;
+};
+
+export const isImages = (value: unknown): value is Images =>
+  typeof value === "object" &&
+  value !== null &&
+  "kind" in value &&
+  (value as Images).kind === ImagesTypeId;
+
+/**
+ * A Cloudflare Images binding for image transformation and manipulation inside
+ * Workers.
+ *
+ * The Effect-native interface (`Cloudflare.Images.bind(...)`) returns an
+ * `ImagesClient` whose methods take Effect `Stream.Stream<Uint8Array>`
+ * inputs and return `Effect`s — `info`, `input(...).transform(...)
+ * .draw(...).output(...)`. The runtime conversion to Cloudflare's
+ * `ReadableStream` is handled internally.
+ *
+ * @section Declaring Images
+ * @example
+ * ```typescript
+ * const Pipeline = yield* Cloudflare.Images({ name: "PIPELINE" });
+ * ```
+ *
+ * @section Effect-style Worker (recommended)
+ * @example Read image format and dimensions from the request body
+ * ```typescript
+ * import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+ *
+ * Cloudflare.Worker("ImageWorker", { main: import.meta.filename },
+ *   Effect.gen(function* () {
+ *     const pipeline = yield* Pipeline;
+ *     const images = yield* Cloudflare.Images.bind(pipeline);
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const request = yield* HttpServerRequest;
+ *         // request.stream is Stream.Stream<Uint8Array>
+ *         const info = yield* images.info(request.stream);
+ *         return yield* HttpServerResponse.json(info);
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(Cloudflare.ImagesBindingLive)),
+ * );
+ * ```
+ *
+ * @example Transform an image — chainable pipeline, single Effect at the end
+ * ```typescript
+ * const result = yield* (yield* images.input(request.stream))
+ *   .transform({ width: 128 })
+ *   .output({ format: "image/jpeg" });
+ *
+ * const response = yield* result.response;
+ * ```
+ *
+ * @section Binding to a Worker (declarative)
+ * @example
+ * ```typescript
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   bindings: { MEDIA: Pipeline },
+ * });
+ *
+ * export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+ * //   { MEDIA: ImagesBinding }
+ * ```
+ *
+ * Inside the Worker, the raw Cloudflare runtime binding is reachable via
+ * `client.raw` if you need to call `info()` / `input()` directly with
+ * `async`/`await`. The Effect-native interface is preferred — it returns
+ * tagged `ImagesError`s, threads `WorkerEnvironment`, and lets you stream
+ * Effect `Stream<Uint8Array>` sources without manual conversion.
+ *
+ * @see https://developers.cloudflare.com/images/transform-images/bindings/
+ */
+export const Images: {
+  (props?: ImagesProps): Effect.Effect<Images>;
+  /**
+   * Bind Cloudflare Images to the surrounding Worker, returning an
+   * Effect-native client with access to the native Workers runtime binding.
+   */
+  bind: typeof ImagesBinding.bind;
+} = Object.assign(
+  Effect.fn(function* (props?: ImagesProps) {
+    return {
+      kind: ImagesTypeId,
+      name: props?.name ?? "IMAGES",
+    } satisfies Images;
+  }),
+  {
+    bind: (...args: Parameters<typeof ImagesBinding.bind>) =>
+      ImagesBinding.bind(...args),
+  },
+);