alchemy 2.0.0-beta.36 → 2.0.0-beta.37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alchemy",
-  "version": "2.0.0-beta.36",
+  "version": "2.0.0-beta.37",
   "homepage": "https://alchemy.run",
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",
@@ -275,14 +275,14 @@
     "@ai-sdk/provider": "^3.0.8",
     "@aws-sdk/credential-providers": "^3.0.0",
     "@clack/prompts": "^0.11.0",
-    "@distilled.cloud/aws": "^0.19.0",
-    "@distilled.cloud/axiom": "^0.19.0",
-    "@distilled.cloud/cloudflare": "^0.19.0",
+    "@distilled.cloud/aws": "^0.19.1",
+    "@distilled.cloud/axiom": "^0.19.1",
+    "@distilled.cloud/cloudflare": "^0.19.1",
     "@distilled.cloud/cloudflare-rolldown-plugin": "0.3.0",
     "@distilled.cloud/cloudflare-runtime": "0.3.2",
     "@distilled.cloud/cloudflare-vite-plugin": "0.2.0",
-    "@distilled.cloud/core": "^0.19.0",
-    "@distilled.cloud/neon": "^0.19.0",
+    "@distilled.cloud/core": "^0.19.1",
+    "@distilled.cloud/neon": "^0.19.1",
     "pg": "^8.13.0",
     "@effect/vitest": ">=4.0.0-beta.60 || >=4.0.0",
     "@libsql/client": "^0.17.0",
@@ -291,7 +291,6 @@
     "@smithy/shared-ini-file-loader": "^4.3.4",
     "@smithy/types": "^4.8.1",
     "@types/aws-lambda": "^8.10.152",
-    "@types/libsodium-wrappers": "^0.8.2",
     "ai": "^6.0.62",
     "aws4fetch": "^1.0.20",
     "capnweb": "^0.6.1",

package/src/AWS/Lambda/Function.ts

@@ -10,6 +10,7 @@ import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import type * as rolldown from "rolldown";
@@ -368,7 +369,21 @@ export const Function: Platform<
       set: (id: string, output: Output.Output) =>
         Effect.sync(() => {
           const key = id.replaceAll(/[^a-zA-Z0-9]/g, "_");
-          env[key] = output.pipe(Output.map((value) => JSON.stringify(value)));
+          // Preserve `Redacted`-ness across the Output → Lambda env var
+          // round-trip. `JSON.stringify(Redacted)` would emit the literal
+          // string `"<redacted>"` and lose the value, so secrets are
+          // serialized with a `{_tag: "Redacted", value: ...}` marker
+          // that the runtime `get` path detects and rebuilds.
+          env[key] = output.pipe(
+            Output.map((value) =>
+              Redacted.isRedacted(value)
+                ? JSON.stringify({
+                    _tag: "Redacted",
+                    value: Redacted.value(value),
+                  })
+                : JSON.stringify(value),
+            ),
+          );
           return key;
         }),
       get: <T>(key: string) =>
@@ -377,7 +392,20 @@ export const Function: Platform<
           .pipe(
             Effect.flatMap((val) =>
               Effect.try({
-                try: () => JSON.parse(val) as T,
+                try: () => {
+                  const value = JSON.parse(val);
+                  if (
+                    value !== null &&
+                    typeof value === "object" &&
+                    (value as { _tag?: unknown })._tag === "Redacted" &&
+                    "value" in (value as object)
+                  ) {
+                    return Redacted.make(
+                      (value as { value: unknown }).value,
+                    ) as unknown as T;
+                  }
+                  return value as T;
+                },
                 catch: () => val, // assume it's just a string
               }),
             ),

package/src/Apply.ts

@@ -185,7 +185,14 @@ export const apply = <P extends Plan>(
     const outputs = Object.fromEntries(
       Object.entries(tracker).map(([fqn, t]) => [fqn, t.output]),
     );
-    return yield* Output.evaluate(plan.output, outputs);
+    const resolved = yield* Output.evaluate(plan.output, outputs);
+
+    // Persist the stack's evaluated outputs so cross-stack references
+    // (`yield* OtherStack` / `OtherStack.stage.<name>` / `Output.stackRef`)
+    // can read them back out of the state store.
+    yield* state.setOutput({ stack: stackName, stage, value: resolved });
+
+    return resolved;
   }).pipe(
     ensureArtifactStore,
     Effect.withSpan("apply", {

package/src/Cloudflare/AnalyticsEngine/AnalyticsEngineDataset.ts

@@ -0,0 +1,82 @@
+import * as Effect from "effect/Effect";
+import { AnalyticsEngineDatasetBinding } from "./AnalyticsEngineDatasetBinding.ts";
+
+type AnalyticsEngineDatasetTypeId = typeof AnalyticsEngineDatasetTypeId;
+const AnalyticsEngineDatasetTypeId =
+  "Cloudflare.AnalyticsEngineDataset" as const;
+
+export type AnalyticsEngineDatasetProps = {
+  /**
+   * Dataset name. If omitted, the logical ID is used.
+   */
+  dataset?: string;
+};
+
+/**
+ * A Cloudflare Workers Analytics Engine dataset binding.
+ *
+ * Analytics Engine datasets are configured as Worker bindings. The binding
+ * exposes `writeDataPoint()` at runtime and does not require separate
+ * provisioning through the Cloudflare API.
+ *
+ * @resource
+ *
+ * @section Binding to a Worker
+ * @example Basic Analytics Engine binding
+ * ```typescript
+ * const Analytics = yield* Cloudflare.AnalyticsEngineDataset("Analytics", {
+ *   dataset: "app-events",
+ * });
+ *
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   bindings: { Analytics },
+ * });
+ * ```
+ *
+ * @example Effect-style worker
+ * ```typescript
+ * const analytics = yield* Cloudflare.AnalyticsEngineDataset.bind(Analytics);
+ * yield* analytics.writeDataPoint({ blobs: ["signup"] });
+ * ```
+ */
+export type AnalyticsEngineDataset = {
+  kind: AnalyticsEngineDatasetTypeId;
+  name: string;
+  dataset: string;
+};
+
+export const isAnalyticsEngineDataset = (
+  value: unknown,
+): value is AnalyticsEngineDataset =>
+  typeof value === "object" &&
+  value !== null &&
+  "kind" in value &&
+  (value as AnalyticsEngineDataset).kind === AnalyticsEngineDatasetTypeId;
+
+export const AnalyticsEngineDataset: {
+  (
+    name: string,
+    props?: AnalyticsEngineDatasetProps,
+  ): Effect.Effect<AnalyticsEngineDataset>;
+  /**
+   * Bind Analytics Engine to the surrounding Worker, returning an
+   * Effect-native client with access to the native Workers runtime binding.
+   */
+  bind: typeof AnalyticsEngineDatasetBinding.bind;
+} = Object.assign(
+  Effect.fnUntraced(function* (
+    name: string,
+    props?: AnalyticsEngineDatasetProps,
+  ) {
+    return {
+      kind: AnalyticsEngineDatasetTypeId,
+      name,
+      dataset: props?.dataset ?? name,
+    } satisfies AnalyticsEngineDataset;
+  }),
+  {
+    bind: (...args: Parameters<typeof AnalyticsEngineDatasetBinding.bind>) =>
+      AnalyticsEngineDatasetBinding.bind(...args),
+  },
+);

package/src/Cloudflare/AnalyticsEngine/AnalyticsEngineDatasetBinding.ts

@@ -0,0 +1,106 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import type { AnalyticsEngineDataset as AnalyticsEngineDatasetLike } from "./AnalyticsEngineDataset.ts";
+
+export interface AnalyticsEngineDataPoint {
+  indexes?: string[];
+  blobs?: string[];
+  doubles?: number[];
+}
+
+export interface RuntimeAnalyticsEngineDataset {
+  writeDataPoint(dataPoint: AnalyticsEngineDataPoint): void;
+}
+
+export class AnalyticsEngineDatasetError extends Data.TaggedError(
+  "AnalyticsEngineDatasetError",
+)<{
+  message: string;
+  cause: Error;
+}> {}
+
+export interface AnalyticsEngineDatasetClient {
+  raw: Effect.Effect<RuntimeAnalyticsEngineDataset, never, WorkerEnvironment>;
+  writeDataPoint(
+    dataPoint: AnalyticsEngineDataPoint,
+  ): Effect.Effect<void, AnalyticsEngineDatasetError, WorkerEnvironment>;
+}
+
+export class AnalyticsEngineDatasetBinding extends Binding.Service<
+  AnalyticsEngineDatasetBinding,
+  (
+    dataset: AnalyticsEngineDatasetLike,
+  ) => Effect.Effect<AnalyticsEngineDatasetClient>
+>()("Cloudflare.AnalyticsEngineDataset.Binding") {}
+
+export const AnalyticsEngineDatasetBindingLive = Layer.effect(
+  AnalyticsEngineDatasetBinding,
+  Effect.gen(function* () {
+    const bind = yield* AnalyticsEngineDatasetBindingPolicy;
+
+    return Effect.fnUntraced(function* (dataset: AnalyticsEngineDatasetLike) {
+      yield* bind(dataset);
+
+      const raw = WorkerEnvironment.asEffect().pipe(
+        Effect.map(
+          (env) =>
+            (env as Record<string, RuntimeAnalyticsEngineDataset>)[
+              dataset.name
+            ]!,
+        ),
+      );
+
+      return {
+        raw,
+        writeDataPoint: (dataPoint) =>
+          raw.pipe(
+            Effect.flatMap((raw) =>
+              Effect.try({
+                try: () => raw.writeDataPoint(dataPoint),
+                catch: (error: any) =>
+                  new AnalyticsEngineDatasetError({
+                    message: error?.message ?? "Unknown error",
+                    cause: error,
+                  }),
+              }),
+            ),
+          ),
+      } satisfies AnalyticsEngineDatasetClient;
+    });
+  }),
+);
+
+export class AnalyticsEngineDatasetBindingPolicy extends Binding.Policy<
+  AnalyticsEngineDatasetBindingPolicy,
+  (dataset: AnalyticsEngineDatasetLike) => Effect.Effect<void>
+>()("Cloudflare.AnalyticsEngineDataset.Binding") {}
+
+export const AnalyticsEngineDatasetBindingPolicyLive =
+  AnalyticsEngineDatasetBindingPolicy.layer.succeed(
+    Effect.fnUntraced(function* (
+      host: ResourceLike,
+      dataset: AnalyticsEngineDatasetLike,
+    ) {
+      if (isWorker(host)) {
+        yield* host.bind(dataset.name, {
+          bindings: [
+            {
+              type: "analytics_engine",
+              name: dataset.name,
+              dataset: dataset.dataset,
+            },
+          ],
+        });
+      } else {
+        return yield* Effect.die(
+          new Error(
+            `AnalyticsEngineDatasetBinding does not support runtime '${host.Type}'`,
+          ),
+        );
+      }
+    }),
+  );

package/src/Cloudflare/AnalyticsEngine/index.ts

@@ -0,0 +1,2 @@
+export * from "./AnalyticsEngineDataset.ts";
+export * from "./AnalyticsEngineDatasetBinding.ts";

package/src/Cloudflare/D1/D1Connection.ts

@@ -7,6 +7,86 @@ import { WorkerEnvironment } from "../Workers/Worker.ts";
 import type { D1Database } from "./D1Database.ts";
 import { DatabaseBinding } from "./D1DatabaseBinding.ts";
 
+/**
+ * Effect-native wrapper around a Cloudflare D1 prepared statement.
+ *
+ * Construction (`prepare`) and binding (`bind`) are synchronous —
+ * they're plan builders and don't touch D1. Only the executors
+ * (`all`, `first`, `run`, `raw`) round-trip to the database, and
+ * those return Effects so they participate in the Effect runtime.
+ */
+export class D1PreparedStatement {
+  /** @internal */
+  constructor(
+    private readonly query: string,
+    private readonly binds: ReadonlyArray<unknown>,
+    private readonly rawEff: Effect.Effect<runtime.D1Database>,
+  ) {}
+
+  /**
+   * Return a new prepared statement bound to `values`. Subsequent
+   * calls replace the previous binding, matching the underlying
+   * Cloudflare runtime semantics.
+   */
+  bind(...values: unknown[]): D1PreparedStatement {
+    return new D1PreparedStatement(this.query, values, this.rawEff);
+  }
+
+  /** Run the query and return all matching rows. */
+  all<T = unknown>(): Effect.Effect<runtime.D1Result<T>> {
+    return this.withRuntime((stmt) => stmt.all<T>());
+  }
+
+  /** Run the query and return the first row, or `null` if no rows. */
+  first<T = unknown>(): Effect.Effect<T | null>;
+  first<T = unknown>(column: string): Effect.Effect<T | null>;
+  first<T = unknown>(column?: string): Effect.Effect<T | null> {
+    return this.withRuntime((stmt) =>
+      column !== undefined ? stmt.first<T>(column) : stmt.first<T>(),
+    );
+  }
+
+  /** Run the query as a mutation; returns row metadata. */
+  run<T = unknown>(): Effect.Effect<runtime.D1Result<T>> {
+    return this.withRuntime((stmt) => stmt.run<T>());
+  }
+
+  /** Run the query and return rows as flat arrays. */
+  raw<T = unknown[]>(): Effect.Effect<T[]>;
+  raw<T = unknown[]>(options: {
+    columnNames: true;
+  }): Effect.Effect<[string[], ...T[]]>;
+  raw<T = unknown[]>(options?: {
+    columnNames: true;
+  }): Effect.Effect<T[] | [string[], ...T[]]> {
+    return this.withRuntime((stmt) =>
+      options
+        ? stmt.raw<T>(options)
+        : (stmt.raw<T>() as Promise<T[] | [string[], ...T[]]>),
+    );
+  }
+
+  /**
+   * Materialize the underlying Cloudflare prepared statement against
+   * a concrete D1 binding. Used by `D1ConnectionClient.batch` to
+   * collect statements for a single transactional call.
+   *
+   * @internal
+   */
+  _build(raw: runtime.D1Database): runtime.D1PreparedStatement {
+    const stmt = raw.prepare(this.query);
+    return this.binds.length > 0 ? stmt.bind(...this.binds) : stmt;
+  }
+
+  private withRuntime<A>(
+    fn: (stmt: runtime.D1PreparedStatement) => Promise<A>,
+  ): Effect.Effect<A> {
+    return Effect.flatMap(this.rawEff, (raw) =>
+      Effect.promise(() => fn(this._build(raw))),
+    );
+  }
+}
+
 export interface D1ConnectionClient {
   /**
    * An Effect that resolves to the raw underlying Cloudflare D1Database binding.
@@ -14,9 +94,11 @@ export interface D1ConnectionClient {
    */
   raw: Effect.Effect<runtime.D1Database>;
   /**
-   * Prepare a SQL query statement for later execution.
+   * Prepare a SQL statement. Returns synchronously — the network
+   * round-trip happens when you yield one of the statement's
+   * executors (`all`, `first`, `run`, `raw`).
    */
-  prepare: (query: string) => Effect.Effect<runtime.D1PreparedStatement>;
+  prepare: (query: string) => D1PreparedStatement;
   /**
    * Execute raw SQL without prepared statements.
    */
@@ -26,7 +108,7 @@ export interface D1ConnectionClient {
    * Statements execute sequentially and are rolled back on failure.
    */
   batch: <T = unknown>(
-    statements: runtime.D1PreparedStatement[],
+    statements: D1PreparedStatement[],
   ) => Effect.Effect<runtime.D1Result<T>[]>;
 }
 
@@ -42,22 +124,23 @@ export const D1ConnectionLive = Layer.effect(
 
     return Effect.fn(function* (database: D1Database) {
       yield* Policy(database);
-      const d1 = yield* Effect.serviceOption(WorkerEnvironment).pipe(
+      const rawEff = yield* Effect.serviceOption(WorkerEnvironment).pipe(
         Effect.map(Option.getOrUndefined),
         Effect.map((env) => env?.[database.LogicalId]! as runtime.D1Database),
         Effect.cached,
       );
 
       return {
-        raw: d1,
-        prepare: (query: string) =>
-          d1.pipe(Effect.map((d1) => d1.prepare(query))),
+        raw: rawEff,
+        prepare: (query: string) => new D1PreparedStatement(query, [], rawEff),
         exec: (query: string) =>
-          d1.pipe(Effect.flatMap((d1) => Effect.promise(() => d1.exec(query)))),
-        batch: <T = unknown>(statements: runtime.D1PreparedStatement[]) =>
-          d1.pipe(
-            Effect.flatMap((d1) =>
-              Effect.promise(() => d1.batch<T>(statements)),
+          Effect.flatMap(rawEff, (raw) =>
+            Effect.promise(() => raw.exec(query)),
+          ),
+        batch: <T = unknown>(statements: D1PreparedStatement[]) =>
+          Effect.flatMap(rawEff, (raw) =>
+            Effect.promise(() =>
+              raw.batch<T>(statements.map((s) => s._build(raw))),
             ),
           ),
       } satisfies D1ConnectionClient;

package/src/Cloudflare/Local/SidecarHandlers.ts

@@ -169,7 +169,15 @@ function bundleOutputToWorkerModules(
 ): WorkerModule[] {
   const modules: WorkerModule[] = [];
   for (const file of bundle.files) {
-    if (file.path.endsWith(".map") || file.content instanceof Uint8Array) {
+    if (file.path.endsWith(".map")) {
+      continue;
+    }
+    if (file.content instanceof Uint8Array) {
+      modules.push({
+        name: file.path,
+        type: file.path.endsWith(".wasm") ? "Wasm" : "Data",
+        content: file.content,
+      });
       continue;
     }
     modules.push({

package/src/Cloudflare/Providers.ts

@@ -13,6 +13,7 @@ import { ProfileLive } from "../Auth/Profile.ts";
 import { Random, RandomProvider } from "../Random.ts";
 import * as Access from "./Access.ts";
 import * as AiGateway from "./AiGateway/index.ts";
+import * as AnalyticsEngine from "./AnalyticsEngine/index.ts";
 import * as ApiToken from "./ApiToken/index.ts";
 import * as Artifacts from "./Artifacts/index.ts";
 import { CloudflareAuth } from "./Auth/AuthProvider.ts";
@@ -50,6 +51,7 @@ export const providers = () =>
       ApiToken.UserApiToken,
       AiGateway.AiGateway,
       AiGateway.AiGatewayBindingPolicy,
+      AnalyticsEngine.AnalyticsEngineDatasetBindingPolicy,
       Artifacts.ArtifactsBindingPolicy,
       Command,
       Containers.Container,
@@ -73,6 +75,7 @@ export const providers = () =>
       VpcService.VpcService,
       Random,
       Workers.BindWorkerPolicy,
+      Workers.CronEventSourcePolicy,
       Workers.FetchPolicy,
       Workers.Worker,
       Workflows.WorkflowResource,
@@ -84,6 +87,7 @@ export const providers = () =>
         ApiToken.UserApiTokenProvider(),
         AiGateway.AiGatewayProvider(),
         AiGateway.AiGatewayBindingPolicyLive,
+        AnalyticsEngine.AnalyticsEngineDatasetBindingPolicyLive,
         Artifacts.ArtifactsBindingPolicyLive,
         Containers.ContainerProvider(),
         D1.D1ConnectionPolicyLive,
@@ -105,6 +109,7 @@ export const providers = () =>
         Tunnel.TunnelProvider(),
         VpcService.VpcServiceProvider(),
         Workers.BindWorkerPolicyLive,
+        Workers.CronEventSourcePolicyLive,
         Workers.FetchPolicyLive,
         Workers.WorkerProvider(),
         Workflows.WorkflowProvider(),

package/src/Cloudflare/R2/R2Bucket.ts

@@ -1,6 +1,7 @@
 import * as r2 from "@distilled.cloud/cloudflare/r2";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
 
 import { deepEqual, isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
@@ -355,6 +356,7 @@ export const R2BucketProvider = () =>
       const patchBucket = yield* r2.patchBucket;
       const deleteBucket = yield* r2.deleteBucket;
       const getBucket = yield* r2.getBucket;
+      const deleteObjects = yield* r2.deleteObjects;
       const listBucketDomainCustoms = yield* r2.listBucketDomainCustoms;
       const createBucketDomainCustom = yield* r2.createBucketDomainCustom;
       const updateBucketDomainCustom = yield* r2.updateBucketDomainCustom;
@@ -362,6 +364,34 @@ export const R2BucketProvider = () =>
       const getBucketLifecycle = yield* r2.getBucketLifecycle;
       const putBucketLifecycle = yield* r2.putBucketLifecycle;
 
+      const emptyBucket = (
+        bucketName: string,
+        jurisdiction: R2Bucket.Jurisdiction,
+      ) =>
+        r2.listObjects
+          .items({
+            accountId,
+            bucketName,
+            cfR2Jurisdiction: jurisdiction,
+            perPage: 1000,
+          })
+          .pipe(
+            Stream.filter(
+              (o): o is typeof o & { key: string } =>
+                typeof o.key === "string" && o.key !== "",
+            ),
+            Stream.map((o) => o.key),
+            Stream.runForEachArray((chunk) =>
+              deleteObjects({
+                accountId,
+                bucketName,
+                cfR2Jurisdiction: jurisdiction,
+                body: [...chunk],
+              }),
+            ),
+            Effect.catchTag("NoSuchBucket", () => Effect.void),
+          );
+
       const createBucketName = (id: string, name: string | undefined) =>
         Effect.gen(function* () {
           if (name) return name;
@@ -683,6 +713,7 @@ export const R2BucketProvider = () =>
               Effect.catchIf(isMissingCustomDomainOrBucket, () => Effect.void),
             );
           }
+          yield* emptyBucket(output.bucketName, output.jurisdiction);
           yield* deleteBucket({
             accountId: output.accountId,
             bucketName: output.bucketName,

package/src/Cloudflare/StateStore/Api.ts

@@ -29,7 +29,7 @@ export const STATE_STORE_SCRIPT_NAME = "alchemy-state-store" as const;
  * compare against this constant; a mismatch (or 404) triggers a
  * forced redeploy via the bootstrap flow.
  */
-export const STATE_STORE_VERSION = 3 as const;
+export const STATE_STORE_VERSION = 4 as const;
 
 /**
  * Hard-coded OTLP/HTTP endpoints. Point at the public ingest relay
@@ -245,6 +245,39 @@ export default Worker(
               }),
             ),
         )
+        .handle("getStackOutput", ({ params }) =>
+          store
+            .getByName(params.stack)
+            .getOutput({ stage: params.stage })
+            .pipe(
+              Effect.withSpan("state_store.getStackOutput", {
+                attributes: {
+                  "alchemy.state_store.op": "getStackOutput",
+                  "alchemy.state_store.stack": params.stack,
+                  "alchemy.state_store.stage": params.stage,
+                },
+              }),
+            ),
+        )
+        .handle("setStackOutput", ({ params, payload }) =>
+          store
+            .getByName(params.stack)
+            .setOutput({ stage: params.stage, value: payload as any })
+            .pipe(
+              Effect.tap(() =>
+                store
+                  .getByName(Store.ROOT_DO_NAME)
+                  .registerStack({ stack: params.stack }),
+              ),
+              Effect.withSpan("state_store.setStackOutput", {
+                attributes: {
+                  "alchemy.state_store.op": "setStackOutput",
+                  "alchemy.state_store.stack": params.stack,
+                  "alchemy.state_store.stage": params.stage,
+                },
+              }),
+            ),
+        )
         .handle("deleteStack", ({ params, query }) =>
           store
             .getByName(params.stack)

package/src/Cloudflare/StateStore/Store.ts

@@ -36,7 +36,7 @@ export default class Store extends DurableObjectNamespace<Store>()(
         ),
       ).pipe(Effect.orDie);
 
-      const encryptValue = (value: ResourceState) =>
+      const encryptValue = (value: unknown) =>
         Effect.tryPromise(async () => {
           const plaintext = new TextEncoder().encode(
             JSON.stringify(encodeState(value)),
@@ -188,15 +188,39 @@ export default class Store extends DurableObjectNamespace<Store>()(
         deleteStack: ({ stage }: { stage?: string } = {}) =>
           stage === undefined
             ? storage.deleteAll()
-            : storage
-                .list<string>({ prefix: stagePrefix(stage) })
-                .pipe(
-                  Effect.flatMap((entries) =>
-                    entries.size === 0
-                      ? Effect.void
-                      : storage.delete([...entries.keys()]).pipe(Effect.asVoid),
-                  ),
-                ),
+            : storage.list<string>({ prefix: stagePrefix(stage) }).pipe(
+                Effect.flatMap((entries) => {
+                  const keys = [...entries.keys(), stackOutputKey(stage)];
+                  return storage.delete(keys).pipe(Effect.asVoid);
+                }),
+              ),
+
+        /**
+         * (Stack DO only) Read the persisted stack output for `stage`.
+         * Returns `undefined` when the stage has not been deployed.
+         */
+        getOutput: ({ stage }: { stage: string }) =>
+          storage
+            .get<string>(stackOutputKey(stage))
+            .pipe(
+              Effect.flatMap((entry) =>
+                entry == null ? Effect.succeed(undefined) : decryptEntry(entry),
+              ),
+            ),
+
+        /**
+         * (Stack DO only) Persist the resolved stack output for
+         * `stage`. Returns the stored value unchanged.
+         */
+        setOutput: ({ stage, value }: { stage: string; value: any }) =>
+          encryptValue(value).pipe(
+            Effect.flatMap((encrypted) =>
+              storage
+                .put<string>(stackOutputKey(stage), encrypted)
+                .pipe(Effect.asVoid),
+            ),
+            Effect.map(() => value),
+          ),
 
         /**
          * (Stack DO only) Return every resource in a stage whose
@@ -236,6 +260,9 @@ const SEP = "\x00";
 /** Key prefix for resource entries in a stack DO. */
 const RESOURCE_PREFIX = `r${SEP}`;
 
+/** Key prefix for stack-output entries in a stack DO. */
+const STACK_OUTPUT_PREFIX = `o${SEP}`;
+
 /** Key prefix for stack-index entries in the root DO. */
 const STACK_INDEX_PREFIX = "s:";
 
@@ -249,6 +276,9 @@ const resourceKey = (stage: string, fqn: string) =>
 /** Prefix matching every resource key inside a specific stage. */
 const stagePrefix = (stage: string) => `${RESOURCE_PREFIX}${stage}${SEP}`;
 
+/** Build the stack-output key inside a *stack DO*. */
+const stackOutputKey = (stage: string) => `${STACK_OUTPUT_PREFIX}${stage}`;
+
 /**
  * Parse a resource key back into its (stage, fqn) tuple. Returns
  * undefined for keys that do not match the expected shape.