alchemy 2.0.0-beta.4 → 2.0.0-beta.41

package/lib/Cloudflare/SecretsStore/SecretsStore.js

@@ -0,0 +1,112 @@
+import * as secretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as Effect from "effect/Effect";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
+/**
+ * A Cloudflare Secrets Store, a per-account container for secrets that
+ * can be bound into Workers with full redaction and audit support.
+ *
+ * Cloudflare enforces a limit of **one Secrets Store per account**.
+ * Deleting a store changes its ID and permanently destroys all secrets
+ * inside it. Because of this, the provider always **adopts** an existing
+ * store rather than creating a new one, and **never deletes** the store
+ * on teardown. The `read` lifecycle reports the existing account store
+ * (if any) as plain attrs, so the engine silently adopts it on cold
+ * start and `create` is only ever invoked when no store exists yet.
+ * Once it exists it is treated as account-level infrastructure that
+ * outlives any single stack.
+ *
+ * @section Creating a Store
+ * @example Basic Secrets Store (adopts existing or creates one)
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore");
+ * ```
+ *
+ * @example Adopt a specific named store
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore", {
+ *   name: "production-secrets",
+ * });
+ * ```
+ */
+export const SecretsStore = Resource("Cloudflare.SecretsStore");
+export const SecretsStoreProvider = () => Provider.effect(SecretsStore, Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+    const createStore = yield* secretsStore.createStore;
+    const listStores = yield* secretsStore.listStores;
+    return {
+        stables: ["storeId", "storeName", "accountId"],
+        // The engine calls `read` whenever there's no prior state. Cloudflare
+        // allows exactly one Secrets Store per account, so any account that's
+        // ever provisioned one must reuse it. Returning the existing store as
+        // plain attrs makes the engine silently adopt it; `create` is only
+        // ever invoked when no store exists yet.
+        read: Effect.fn(function* ({ output }) {
+            const stores = yield* listStores({
+                accountId: output?.accountId ?? accountId,
+            });
+            const match = output?.storeId
+                ? stores.result.find((s) => s.id === output.storeId)
+                : stores.result[0];
+            if (!match)
+                return undefined;
+            return {
+                storeId: match.id,
+                storeName: match.name,
+                accountId: output?.accountId ?? accountId,
+            };
+        }),
+        reconcile: Effect.fn(function* ({ output }) {
+            const acct = output?.accountId ?? accountId;
+            // Observe — Cloudflare permits exactly one Secrets Store per
+            // account. List the account's stores; reuse the cached one if
+            // it still exists, otherwise reuse the first one.
+            const stores = yield* listStores({ accountId: acct });
+            const observed = output?.storeId
+                ? (stores.result.find((s) => s.id === output.storeId) ??
+                    stores.result[0])
+                : stores.result[0];
+            if (observed) {
+                return {
+                    storeId: observed.id,
+                    storeName: observed.name,
+                    accountId: acct,
+                };
+            }
+            // Ensure — no store yet. Create the default. Cloudflare reports
+            // a concurrent create as `MaximumStoresExceeded`; tolerate by
+            // re-listing and adopting the now-existing store.
+            const response = yield* createStore({
+                accountId: acct,
+                // `default_secrets_store` is the name Cloudflare uses for an
+                // account's default Secrets Store.
+                name: "default_secrets_store",
+            }).pipe(Effect.catchTag("MaximumStoresExceeded", () => Effect.succeed(undefined)));
+            if (response) {
+                return {
+                    storeId: response.id,
+                    storeName: response.name,
+                    accountId: acct,
+                };
+            }
+            const after = yield* listStores({ accountId: acct });
+            const first = after.result[0];
+            if (first) {
+                return {
+                    storeId: first.id,
+                    storeName: first.name,
+                    accountId: acct,
+                };
+            }
+            return yield* Effect.die(new Error(`Cloudflare reported MaximumStoresExceeded for account ${acct} but no store could be listed.`));
+        }),
+        delete: Effect.fn(function* () {
+            // Intentional no-op. Cloudflare only allows one Secrets Store per
+            // account and deleting it permanently destroys all secrets inside.
+            // The store is treated as shared, account-level infrastructure that
+            // should never be torn down by a single stack.
+        }),
+    };
+}));
+//# sourceMappingURL=SecretsStore.js.map

package/lib/Cloudflare/SecretsStore/SecretsStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsStore.js","sourceRoot":"","sources":["../../../src/Cloudflare/SecretsStore/SecretsStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,YAAY,MAAM,2CAA2C,CAAC;AAC1E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAepE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAe,yBAAyB,CAAC,CAAC;AAE9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,EAAE,CACvC,QAAQ,CAAC,MAAM,CACb,YAAY,EACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC;IACnD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC;IACpD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC;IAElD,OAAO;QACL,OAAO,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC;QAC9C,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,mEAAmE;QACnE,yCAAyC;QACzC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;gBAC/B,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,SAAS;aAC1C,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO;gBAC3B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,OAAO,CAAC;gBACpD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,OAAO;gBACL,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,SAAS;aAC1C,CAAC;QACJ,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACxC,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;YAE5C,6DAA6D;YAC7D,8DAA8D;YAC9D,kDAAkD;YAClD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,MAAM,EAAE,OAAO;gBAC9B,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,OAAO,CAAC;oBACnD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACnB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAErB,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,QAAQ,CAAC,EAAE;oBACpB,SAAS,EAAE,QAAQ,CAAC,IAAI;oBACxB,SAAS,EAAE,IAAI;iBAChB,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,8DAA8D;YAC9D,kDAAkD;YAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;gBAClC,SAAS,EAAE,IAAI;gBACf,6DAA6D;gBAC7D,mCAAmC;gBACnC,IAAI,EAAE,uBAAuB;aAC9B,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;YAEF,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,QAAQ,CAAC,EAAE;oBACpB,SAAS,EAAE,QAAQ,CAAC,IAAI;oBACxB,SAAS,EAAE,IAAI;iBAChB,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO;oBACL,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,SAAS,EAAE,KAAK,CAAC,IAAI;oBACrB,SAAS,EAAE,IAAI;iBAChB,CAAC;YACJ,CAAC;YAED,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,IAAI,KAAK,CACP,yDAAyD,IAAI,gCAAgC,CAC9F,CACF,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;YACzB,kEAAkE;YAClE,mEAAmE;YACnE,oEAAoE;YACpE,+CAA+C;QACjD,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Cloudflare/SecretsStore/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./Secret.ts";
+export * from "./SecretBinding.ts";
+export * from "./SecretsStore.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/Cloudflare/SecretsStore/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/SecretsStore/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC"}

package/lib/Cloudflare/SecretsStore/index.js

@@ -0,0 +1,4 @@
+export * from "./Secret.js";
+export * from "./SecretBinding.js";
+export * from "./SecretsStore.js";
+//# sourceMappingURL=index.js.map

package/lib/Cloudflare/SecretsStore/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/Cloudflare/SecretsStore/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC"}

package/lib/Cloudflare/StateStore/Api.d.ts

@@ -0,0 +1,107 @@
+import * as Effect from "effect/Effect";
+export declare const STATE_STORE_SCRIPT_NAME: "alchemy-state-store";
+/**
+ * Version of the deployed Cloudflare State Store worker contract.
+ *
+ * Bump this whenever the wire format or runtime behaviour of the
+ * worker changes in a way that an older deployed copy can no longer
+ * satisfy. Clients query `/version` on the deployed worker and
+ * compare against this constant; a mismatch (or 404) triggers a
+ * forced redeploy via the bootstrap flow.
+ */
+export declare const STATE_STORE_VERSION: 5;
+/**
+ * Hard-coded OTLP/HTTP endpoints. Point at the public ingest relay
+ * defined in `stacks/otel.ts` (bound to `otel.alchemy.run`), which
+ * forwards to Axiom with the bearer token attached server-side. Hard-
+ * coded on purpose: the worker has no env-var plumbing and the relay
+ * is account-level infra that lives outside any single deploy.
+ */
+/**
+ * OTLP traces + metrics + logs Layer for the state-store worker.
+ * Mirrors the CLI's `TelemetryLive` so every signal the worker emits
+ * (`Effect.withSpan`, runtime metrics, `Effect.log*`) ships to the
+ * same Axiom datasets as deploy-time CLI signals. Resource attributes
+ * brand each signal with the worker's service name + contract version
+ * so they're easy to slice in Axiom.
+ */
+/**
+ * Path on disk to *this* file, used as the worker's bundling entry.
+ *
+ * When running from source (e.g. dev / monorepo), `import.meta.url` points
+ * at `Api.ts` and we can use it directly. When the alchemy CLI is run from
+ * its published `bin/alchemy.js` bundle, this module is inlined into the
+ * CLI bundle and `import.meta.url` resolves to `bin/alchemy.js` — which
+ * has no `default` export and breaks the worker bundler with
+ * `[MISSING_EXPORT] "default" is not exported by "bin/alchemy.js"`.
+ *
+ * In the bundled case, fall back to the published source file shipped
+ * alongside the CLI under `../src/Cloudflare/StateStore/Api.ts`.
+ */
+declare const _default: Effect.Effect<import("effect/Pipeable").Pipeable & import("../../Resource.ts").ResourceLike<"Cloudflare.Worker", import("../index.ts").WorkerProps<any, import("../index.ts").WorkerEnv, import("../index.ts").WorkerAssetsConfig | undefined>, {
+    workerId: string;
+    workerName: string;
+    logpush: boolean | undefined;
+    url: string | undefined;
+    tags: string[] | undefined;
+    durableObjectNamespaces: Record<string, string>;
+    accountId: string;
+    domains: {
+        hostname: string;
+        id: string;
+        zoneId: string;
+    }[];
+    crons: string[];
+    hash?: {
+        assets: string | undefined;
+        bundle: string | undefined;
+        input: string | undefined;
+    };
+}, {
+    bindings?: import("../index.ts").WorkerBinding[];
+    containers?: {
+        className: string;
+    }[];
+    crons?: string[];
+    hyperdrives?: Record<string, Required<import("../index.ts").HyperdriveDevOrigin>>;
+}, import("../Providers.ts").Providers> & {
+    bind(sid: string, binding: import("../../Input.ts").Input<{
+        bindings?: import("../index.ts").WorkerBinding[];
+        containers?: {
+            className: string;
+        }[];
+        crons?: string[];
+        hyperdrives?: Record<string, Required<import("../index.ts").HyperdriveDevOrigin>>;
+    }>): Effect.Effect<void>;
+    bind(template: TemplateStringsArray, ...args: any[]): (binding: import("../../Input.ts").Input<{
+        bindings?: import("../index.ts").WorkerBinding[];
+        containers?: {
+            className: string;
+        }[];
+        crons?: string[];
+        hyperdrives?: Record<string, Required<import("../index.ts").HyperdriveDevOrigin>>;
+    }>) => Effect.Effect<void>;
+} & {
+    workerId: import("../../Output.ts").Output<string, never>;
+    workerName: import("../../Output.ts").Output<string, never>;
+    logpush: import("../../Output.ts").Output<boolean | undefined, never>;
+    url: import("../../Output.ts").Output<string | undefined, never>;
+    tags: import("../../Output.ts").Output<string[] | undefined, never>;
+    durableObjectNamespaces: import("../../Output.ts").Output<Record<string, string>, never>;
+    accountId: import("../../Output.ts").Output<string, never>;
+    domains: import("../../Output.ts").Output<{
+        hostname: string;
+        id: string;
+        zoneId: string;
+    }[], never>;
+    crons: import("../../Output.ts").Output<string[], never>;
+    hash: import("../../Output.ts").Output<{
+        assets: string | undefined;
+        bundle: string | undefined;
+        input: string | undefined;
+    } | undefined, never>;
+} & import("../../Rpc.ts").Rpc<{
+    fetch: Effect.Effect<Effect.Effect<import("effect/unstable/http/HttpServerResponse").HttpServerResponse, import("effect/unstable/http/HttpServerError").HttpServerError, import("effect/Scope").Scope | import("effect/unstable/http/HttpServerRequest").HttpServerRequest>, never, import("effect/Scope").Scope | import("effect/FileSystem").FileSystem | import("../index.ts").WorkerEnvironment>;
+}>, never, import("../Providers.ts").Providers>;
+export default _default;
+//# sourceMappingURL=Api.d.ts.map

package/lib/Cloudflare/StateStore/Api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Api.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/StateStore/Api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAoBxC,eAAO,MAAM,uBAAuB,EAAG,qBAA8B,CAAC;AAEtE;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAG,CAAU,CAAC;AAE9C;;;;;;GAMG;AAKH;;;;;;;GAOG;AAkCH;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACH,wBAgOE"}

package/lib/Cloudflare/StateStore/Api.js

@@ -0,0 +1,259 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as Etag from "effect/unstable/http/Etag";
+import * as HttpPlatform from "effect/unstable/http/HttpPlatform";
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import * as HttpApiError from "effect/unstable/httpapi/HttpApiError";
+import crypto from "node:crypto";
+import { BearerTokenValidator, StateApi, StateAuthLive, } from "../../State/HttpStateApi.js";
+import * as Secret from "../SecretsStore/Secret.js";
+import { SecretBindingLive } from "../SecretsStore/SecretBinding.js";
+import { Worker } from "../Workers/Worker.js";
+import Store from "./Store.js";
+import { AuthToken } from "./Token.js";
+export const STATE_STORE_SCRIPT_NAME = "alchemy-state-store";
+/**
+ * Version of the deployed Cloudflare State Store worker contract.
+ *
+ * Bump this whenever the wire format or runtime behaviour of the
+ * worker changes in a way that an older deployed copy can no longer
+ * satisfy. Clients query `/version` on the deployed worker and
+ * compare against this constant; a mismatch (or 404) triggers a
+ * forced redeploy via the bootstrap flow.
+ */
+export const STATE_STORE_VERSION = 5;
+/**
+ * Hard-coded OTLP/HTTP endpoints. Point at the public ingest relay
+ * defined in `stacks/otel.ts` (bound to `otel.alchemy.run`), which
+ * forwards to Axiom with the bearer token attached server-side. Hard-
+ * coded on purpose: the worker has no env-var plumbing and the relay
+ * is account-level infra that lives outside any single deploy.
+ */
+// const OTEL_TRACES_URL = "https://otel.alchemy.run/v1/traces";
+// const OTEL_METRICS_URL = "https://otel.alchemy.run/v1/metrics";
+// const OTEL_LOGS_URL = "https://otel.alchemy.run/v1/logs";
+/**
+ * OTLP traces + metrics + logs Layer for the state-store worker.
+ * Mirrors the CLI's `TelemetryLive` so every signal the worker emits
+ * (`Effect.withSpan`, runtime metrics, `Effect.log*`) ships to the
+ * same Axiom datasets as deploy-time CLI signals. Resource attributes
+ * brand each signal with the worker's service name + contract version
+ * so they're easy to slice in Axiom.
+ */
+// const otelResource = {
+//   serviceName: STATE_STORE_SCRIPT_NAME,
+//   serviceVersion: String(STATE_STORE_VERSION),
+//   attributes: {
+//     "alchemy.state_store.script_name": STATE_STORE_SCRIPT_NAME,
+//     "alchemy.state_store.version": STATE_STORE_VERSION,
+//   },
+// } as const;
+// const TelemetryLive = Layer.mergeAll(
+//   OtlpTracer.layer({
+//     url: OTEL_TRACES_URL,
+//     resource: otelResource,
+//     exportInterval: "1 second",
+//   }),
+//   OtlpMetrics.layer({
+//     url: OTEL_METRICS_URL,
+//     resource: otelResource,
+//     exportInterval: "1 second",
+//   }),
+//   // Replace (don't merge with) the default stdout logger so worker logs
+//   // ship to Axiom instead of just `wrangler tail`.
+//   OtlpLogger.layer({
+//     url: OTEL_LOGS_URL,
+//     resource: otelResource,
+//     exportInterval: "1 second",
+//     mergeWithExisting: false,
+//   }),
+// ).pipe(
+//   Layer.provide(OtlpSerialization.layerJson),
+//   Layer.provide(FetchHttpClient.layer),
+// );
+/**
+ * Path on disk to *this* file, used as the worker's bundling entry.
+ *
+ * When running from source (e.g. dev / monorepo), `import.meta.url` points
+ * at `Api.ts` and we can use it directly. When the alchemy CLI is run from
+ * its published `bin/alchemy.js` bundle, this module is inlined into the
+ * CLI bundle and `import.meta.url` resolves to `bin/alchemy.js` — which
+ * has no `default` export and breaks the worker bundler with
+ * `[MISSING_EXPORT] "default" is not exported by "bin/alchemy.js"`.
+ *
+ * In the bundled case, fall back to the published source file shipped
+ * alongside the CLI under `../src/Cloudflare/StateStore/Api.ts`.
+ */
+export default Worker("Api", {
+    name: STATE_STORE_SCRIPT_NAME,
+    main: import.meta.filename,
+    url: true,
+    compatibility: {
+        flags: ["nodejs_compat"],
+        date: "2026-03-17",
+    },
+}, Effect.gen(function* () {
+    const secret = yield* Secret.Secret.bind(AuthToken);
+    const store = yield* Store;
+    const bearerTokenValidator = Layer.effect(BearerTokenValidator, secret.get().pipe(Effect.map((expected) => BearerTokenValidator.of({
+        validate: (token) => !!expected && timingSafeEqual(token, expected)
+            ? Effect.void
+            : Effect.fail(new HttpApiError.Unauthorized()),
+    })), Effect.orDie));
+    const versionApi = HttpApiBuilder.group(StateApi, "version", (handlers) => handlers.handle("getVersion", () => Effect.succeed({ version: STATE_STORE_VERSION }).pipe(Effect.withSpan("state_store.getVersion", {
+        attributes: { "alchemy.state_store.op": "getVersion" },
+    }))));
+    const stateApi = HttpApiBuilder.group(StateApi, "state", (handlers) => handlers
+        .handle("listStacks", () => store
+        .getByName(Store.ROOT_DO_NAME)
+        .listStacks()
+        .pipe(Effect.withSpan("state_store.listStacks", {
+        attributes: { "alchemy.state_store.op": "listStacks" },
+    })))
+        .handle("listStages", ({ params }) => store
+        .getByName(params.stack)
+        .listStages()
+        .pipe(Effect.withSpan("state_store.listStages", {
+        attributes: {
+            "alchemy.state_store.op": "listStages",
+            "alchemy.state_store.stack": params.stack,
+        },
+    })))
+        .handle("listResources", ({ params }) => store
+        .getByName(params.stack)
+        .listResources({ stage: params.stage })
+        .pipe(Effect.withSpan("state_store.listResources", {
+        attributes: {
+            "alchemy.state_store.op": "listResources",
+            "alchemy.state_store.stack": params.stack,
+            "alchemy.state_store.stage": params.stage,
+        },
+    })))
+        .handle("getState", ({ params }) => {
+        const fqn = decodeURIComponent(params.fqn);
+        return store
+            .getByName(params.stack)
+            .get({ stage: params.stage, fqn })
+            .pipe(Effect.withSpan("state_store.getState", {
+            attributes: {
+                "alchemy.state_store.op": "getState",
+                "alchemy.state_store.stack": params.stack,
+                "alchemy.state_store.stage": params.stage,
+                "alchemy.state_store.fqn": fqn,
+            },
+        }));
+    })
+        .handle("setState", ({ params, payload }) => {
+        const fqn = decodeURIComponent(params.fqn);
+        return store
+            .getByName(params.stack)
+            .set({ stage: params.stage, fqn, value: payload })
+            .pipe(Effect.tap(() => store
+            .getByName(Store.ROOT_DO_NAME)
+            .registerStack({ stack: params.stack })), Effect.withSpan("state_store.setState", {
+            attributes: {
+                "alchemy.state_store.op": "setState",
+                "alchemy.state_store.stack": params.stack,
+                "alchemy.state_store.stage": params.stage,
+                "alchemy.state_store.fqn": fqn,
+            },
+        }));
+    })
+        .handle("deleteState", ({ params }) => {
+        const fqn = decodeURIComponent(params.fqn);
+        // The DO method is `remove`, not `delete` — `delete` is
+        // reserved by Cloudflare's RPC stub proxy.
+        return store
+            .getByName(params.stack)
+            .remove({ stage: params.stage, fqn })
+            .pipe(Effect.asVoid, Effect.withSpan("state_store.deleteState", {
+            attributes: {
+                "alchemy.state_store.op": "deleteState",
+                "alchemy.state_store.stack": params.stack,
+                "alchemy.state_store.stage": params.stage,
+                "alchemy.state_store.fqn": fqn,
+            },
+        }));
+    })
+        .handle("getReplacedResources", ({ params }) => store
+        .getByName(params.stack)
+        .getReplacedResources({ stage: params.stage })
+        .pipe(Effect.withSpan("state_store.getReplacedResources", {
+        attributes: {
+            "alchemy.state_store.op": "getReplacedResources",
+            "alchemy.state_store.stack": params.stack,
+            "alchemy.state_store.stage": params.stage,
+        },
+    })))
+        .handle("getStackOutput", ({ params }) => store
+        .getByName(params.stack)
+        .getOutput({ stage: params.stage })
+        .pipe(Effect.withSpan("state_store.getStackOutput", {
+        attributes: {
+            "alchemy.state_store.op": "getStackOutput",
+            "alchemy.state_store.stack": params.stack,
+            "alchemy.state_store.stage": params.stage,
+        },
+    })))
+        .handle("setStackOutput", ({ params, payload }) => store
+        .getByName(params.stack)
+        .setOutput({ stage: params.stage, value: payload })
+        .pipe(Effect.tap(() => store
+        .getByName(Store.ROOT_DO_NAME)
+        .registerStack({ stack: params.stack })), Effect.withSpan("state_store.setStackOutput", {
+        attributes: {
+            "alchemy.state_store.op": "setStackOutput",
+            "alchemy.state_store.stack": params.stack,
+            "alchemy.state_store.stage": params.stage,
+        },
+    })))
+        .handle("deleteStack", ({ params, query }) => store
+        .getByName(params.stack)
+        .deleteStack(query.stage === undefined ? {} : { stage: query.stage })
+        .pipe(Effect.flatMap(() => query.stage === undefined
+        ? store
+            .getByName(Store.ROOT_DO_NAME)
+            .unregisterStack({ stack: params.stack })
+        : Effect.void), Effect.asVoid, Effect.withSpan("state_store.deleteStack", {
+        attributes: {
+            "alchemy.state_store.op": "deleteStack",
+            "alchemy.state_store.stack": params.stack,
+            "alchemy.state_store.stage": query.stage ?? "",
+            "alchemy.state_store.scope": query.stage === undefined ? "stack" : "stage",
+        },
+    }))));
+    return {
+        fetch: HttpApiBuilder.layer(StateApi).pipe(Layer.provide(stateApi), Layer.provide(versionApi), Layer.provide(StateAuthLive), Layer.provide(bearerTokenValidator), 
+        // The state-store worker never serves files, so HttpPlatform's
+        // file-response surface is stubbed.
+        Layer.provide([Etag.layer, HttpPlatformStub, Path.layer]), HttpRouter.toHttpEffect),
+    };
+}).pipe(Effect.provide(Layer.mergeAll(SecretBindingLive))));
+/**
+ * Stub `HttpPlatform` for the worker. The state-store API never
+ * issues file responses, so both surface methods die if invoked. Lets
+ * us avoid pulling in a `FileSystem` dependency that workers don't
+ * have.
+ */
+const HttpPlatformStub = Layer.succeed(HttpPlatform.HttpPlatform, {
+    fileResponse: () => Effect.die("HttpPlatform.fileResponse not supported"),
+    fileWebResponse: () => Effect.die("HttpPlatform.fileWebResponse not supported"),
+});
+/**
+ * Timing-safe string comparison using the Workers runtime's built-in
+ * `crypto.subtle.timingSafeEqual`.
+ *
+ * @see https://developers.cloudflare.com/workers/examples/protect-against-timing-attacks/
+ */
+const timingSafeEqual = (a, b) => {
+    const encoder = new TextEncoder();
+    const aBytes = encoder.encode(a);
+    const bBytes = encoder.encode(b);
+    if (aBytes.byteLength !== bBytes.byteLength)
+        return false;
+    // @ts-expect-error - TODO(sam)
+    return crypto.subtle.timingSafeEqual(aBytes, bBytes);
+};
+//# sourceMappingURL=Api.js.map

package/lib/Cloudflare/StateStore/Api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Api.js","sourceRoot":"","sources":["../../../src/Cloudflare/StateStore/Api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,IAAI,MAAM,2BAA2B,CAAC;AAClD,OAAO,KAAK,YAAY,MAAM,mCAAmC,CAAC;AAClE,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,cAAc,MAAM,wCAAwC,CAAC;AACzE,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAC;AACrE,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,aAAa,GACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAA8B,CAAC;AAEtE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAU,CAAC;AAE9C;;;;;;GAMG;AACH,gEAAgE;AAChE,kEAAkE;AAClE,4DAA4D;AAE5D;;;;;;;GAOG;AACH,yBAAyB;AACzB,0CAA0C;AAC1C,iDAAiD;AACjD,kBAAkB;AAClB,kEAAkE;AAClE,0DAA0D;AAC1D,OAAO;AACP,cAAc;AAEd,wCAAwC;AACxC,uBAAuB;AACvB,4BAA4B;AAC5B,8BAA8B;AAC9B,kCAAkC;AAClC,QAAQ;AACR,wBAAwB;AACxB,6BAA6B;AAC7B,8BAA8B;AAC9B,kCAAkC;AAClC,QAAQ;AACR,2EAA2E;AAC3E,sDAAsD;AACtD,uBAAuB;AACvB,0BAA0B;AAC1B,8BAA8B;AAC9B,kCAAkC;AAClC,gCAAgC;AAChC,QAAQ;AACR,UAAU;AACV,gDAAgD;AAChD,0CAA0C;AAC1C,KAAK;AAEL;;;;;;;;;;;;GAYG;AACH,eAAe,MAAM,CACnB,KAAK,EACL;IACE,IAAI,EAAE,uBAAuB;IAC7B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;IAC1B,GAAG,EAAE,IAAI;IACT,aAAa,EAAE;QACb,KAAK,EAAE,CAAC,eAAe,CAAC;QACxB,IAAI,EAAE,YAAY;KACnB;CACF,EACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAE3B,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,CACvC,oBAAoB,EACpB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CACf,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtB,oBAAoB,CAAC,EAAE,CAAC;QACtB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,CAAC,CAAC,QAAQ,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC5C,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;KACnD,CAAC,CACH,EACD,MAAM,CAAC,KAAK,CACb,CACF,CAAC;IAEF,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CACxE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,CACjC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE;QACxC,UAAU,EAAE,EAAE,wBAAwB,EAAE,YAAY,EAAE;KACvD,CAAC,CACH,CACF,CACF,CAAC;IAEF,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACpE,QAAQ;SACL,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,CACzB,KAAK;SACF,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;SAC7B,UAAU,EAAE;SACZ,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE;QACxC,UAAU,EAAE,EAAE,wBAAwB,EAAE,YAAY,EAAE;KACvD,CAAC,CACH,CACJ;SACA,MAAM,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACnC,KAAK;SACF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;SACvB,UAAU,EAAE;SACZ,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE;QACxC,UAAU,EAAE;YACV,wBAAwB,EAAE,YAAY;YACtC,2BAA2B,EAAE,MAAM,CAAC,KAAK;SAC1C;KACF,CAAC,CACH,CACJ;SACA,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACtC,KAAK;SACF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;SACvB,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;SACtC,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE;QAC3C,UAAU,EAAE;YACV,wBAAwB,EAAE,eAAe;YACzC,2BAA2B,EAAE,MAAM,CAAC,KAAK;YACzC,2BAA2B,EAAE,MAAM,CAAC,KAAK;SAC1C;KACF,CAAC,CACH,CACJ;SACA,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACjC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,KAAK;aACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;aACvB,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;aACjC,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE;YACtC,UAAU,EAAE;gBACV,wBAAwB,EAAE,UAAU;gBACpC,2BAA2B,EAAE,MAAM,CAAC,KAAK;gBACzC,2BAA2B,EAAE,MAAM,CAAC,KAAK;gBACzC,yBAAyB,EAAE,GAAG;aAC/B;SACF,CAAC,CACH,CAAC;IACN,CAAC,CAAC;SACD,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,KAAK;aACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;aACvB,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAc,EAAE,CAAC;aACxD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CACd,KAAK;aACF,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;aAC7B,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAC1C,EACD,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE;YACtC,UAAU,EAAE;gBACV,wBAAwB,EAAE,UAAU;gBACpC,2BAA2B,EAAE,MAAM,CAAC,KAAK;gBACzC,2BAA2B,EAAE,MAAM,CAAC,KAAK;gBACzC,yBAAyB,EAAE,GAAG;aAC/B;SACF,CAAC,CACH,CAAC;IACN,CAAC,CAAC;SACD,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACpC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3C,wDAAwD;QACxD,2CAA2C;QAC3C,OAAO,KAAK;aACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;aACvB,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;aACpC,IAAI,CACH,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE;YACzC,UAAU,EAAE;gBACV,wBAAwB,EAAE,aAAa;gBACvC,2BAA2B,EAAE,MAAM,CAAC,KAAK;gBACzC,2BAA2B,EAAE,MAAM,CAAC,KAAK;gBACzC,yBAAyB,EAAE,GAAG;aAC/B;SACF,CAAC,CACH,CAAC;IACN,CAAC,CAAC;SACD,MAAM,CAAC,sBAAsB,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAC7C,KAAK;SACF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;SACvB,oBAAoB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;SAC7C,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,kCAAkC,EAAE;QAClD,UAAU,EAAE;YACV,wBAAwB,EAAE,sBAAsB;YAChD,2BAA2B,EAAE,MAAM,CAAC,KAAK;YACzC,2BAA2B,EAAE,MAAM,CAAC,KAAK;SAC1C;KACF,CAAC,CACH,CACJ;SACA,MAAM,CAAC,gBAAgB,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACvC,KAAK;SACF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;SACvB,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;SAClC,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,4BAA4B,EAAE;QAC5C,UAAU,EAAE;YACV,wBAAwB,EAAE,gBAAgB;YAC1C,2BAA2B,EAAE,MAAM,CAAC,KAAK;YACzC,2BAA2B,EAAE,MAAM,CAAC,KAAK;SAC1C;KACF,CAAC,CACH,CACJ;SACA,MAAM,CAAC,gBAAgB,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAChD,KAAK;SACF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;SACvB,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAc,EAAE,CAAC;SACzD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CACd,KAAK;SACF,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;SAC7B,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAC1C,EACD,MAAM,CAAC,QAAQ,CAAC,4BAA4B,EAAE;QAC5C,UAAU,EAAE;YACV,wBAAwB,EAAE,gBAAgB;YAC1C,2BAA2B,EAAE,MAAM,CAAC,KAAK;YACzC,2BAA2B,EAAE,MAAM,CAAC,KAAK;SAC1C;KACF,CAAC,CACH,CACJ;SACA,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAC3C,KAAK;SACF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;SACvB,WAAW,CACV,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACxD;SACA,IAAI,CACH,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAClB,KAAK,CAAC,KAAK,KAAK,SAAS;QACvB,CAAC,CAAC,KAAK;aACF,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;aAC7B,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,IAAI,CAChB,EACD,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE;QACzC,UAAU,EAAE;YACV,wBAAwB,EAAE,aAAa;YACvC,2BAA2B,EAAE,MAAM,CAAC,KAAK;YACzC,2BAA2B,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;YAC9C,2BAA2B,EACzB,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;SAChD;KACF,CAAC,CACH,CACJ,CACJ,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CACxC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvB,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EACzB,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAC5B,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACnC,+DAA+D;QAC/D,oCAAoC;QACpC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EACzD,UAAU,CAAC,YAAY,CAExB;KACF,CAAC;AACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAC3D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE;IAChE,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC;IACzE,eAAe,EAAE,GAAG,EAAE,CACpB,MAAM,CAAC,GAAG,CAAC,4CAA4C,CAAC;CAC3D,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IACxD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC1D,+BAA+B;IAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC,CAAC"}

package/lib/Cloudflare/StateStore/State.d.ts

@@ -0,0 +1,103 @@
+import * as SecretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as Output from "../../Output.ts";
+import * as Config from "effect/Config";
+import { AuthError } from "../../Auth/AuthProvider.ts";
+import { CredentialsStore } from "../../Auth/Credentials.ts";
+import * as Cloudflare from "../../Cloudflare/Providers.ts";
+import * as CloudflareEnvironment from "../CloudflareEnvironment.ts";
+import { AlchemyContext } from "../../AlchemyContext.ts";
+import { State } from "../../State/State.ts";
+import * as Access from "../Access.ts";
+export interface BootstrapOptions {
+    /**
+     * The name of the script to use for the state store.
+     * @default "alchemy-state-store"
+     */
+    workerName?: string;
+    /**
+     * Re-run the deploy even if the worker already exists in Cloudflare.
+     *
+     * Without this flag, an already-deployed worker is **adopted**: the
+     * auth-token secret is re-fetched via an edge probe and the local
+     * credentials file is refreshed, but no new code is uploaded. With
+     * `force: true` the full deploy runs again, redeploying the worker
+     * code and reconciling every resource in place.
+     */
+    force?: boolean;
+}
+/**
+ * Manually bootstrap (or repair) the Cloudflare-hosted HTTP State
+ * Store. Used by `alchemy bootstrap cloudflare`.
+ *
+ * The flow mirrors what {@link state} does on first use, but is
+ * exposed as a standalone effect so users can trigger it (or recover
+ * from a partially-failed previous deploy) explicitly:
+ *
+ *   1. Resume any in-progress local `CloudflareStateStore` stack.
+ *   2. If the worker already exists in Cloudflare and `force` is not
+ *      set, adopt it: read the auth token via an edge-preview probe
+ *      and persist credentials.
+ *   3. Otherwise run the full deploy with adoption enabled, sync local
+ *      state into the deployed store, persist credentials, and delete
+ *      the local stack.
+ */
+export declare const bootstrap: (options?: BootstrapOptions) => Effect.Effect<void, Config.ConfigError | AlchemyContext | import("effect/PlatformError").PlatformError | AuthError | import("../../State/State.ts").StateStoreError | Output.InvalidReferenceError | import("../../Stage.ts").Stage | Output.MissingSourceError | Access.AccessError | import("@distilled.cloud/cloudflare").DefaultErrors | workers.InvalidRoute | SecretsStore.InvalidAccountId | StateStoreVersionNotReady, import("effect/FileSystem").FileSystem | import("effect/Path").Path | HttpClient.HttpClient | AlchemyContext | CredentialsStore | import("../../index.ts").Cli | Access.Access | Cloudflare.Credentials | CloudflareEnvironment.CloudflareEnvironment>;
+export declare const state: () => Layer.Layer<import("../../Auth/Profile.ts").Profile | CredentialsStore | State | Access.Access | Cloudflare.Credentials | CloudflareEnvironment.CloudflareEnvironment, never, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("effect/FileSystem").FileSystem | import("effect/Path").Path | HttpClient.HttpClient | AlchemyContext | import("../../index.ts").AuthProviders | import("../../index.ts").Cli>;
+/**
+ * Log in to a Cloudflare-deployed HTTP state-store.
+ *
+ * 1. Find the single account-wide Secrets Store.
+ * 2. Upload a short-lived edge-preview worker that binds the
+ *    auth-token secret and returns its value.
+ * 3. Derive the state-store worker URL from
+ *    {@link STATE_STORE_SCRIPT_NAME} and the account's workers.dev
+ *    subdomain.
+ * 4. Persist `{ url, token }` under the `http-state-store`
+ *    credentials file.
+ *
+ * Requirements are covered by the Cloudflare provider stack —
+ * `CloudflareEnvironment`, `Credentials`, `HttpClient`, and
+ * `FileSystem`.
+ */
+export declare const loginWithCloudflare: () => Effect.Effect<{
+    url: string;
+    authToken: string;
+}, Config.ConfigError | AuthError | import("@distilled.cloud/axiom").Unauthorized | import("@distilled.cloud/axiom").TooManyRequests | import("@distilled.cloud/axiom").InternalServerError | import("@distilled.cloud/axiom").BadGateway | import("@distilled.cloud/axiom").ServiceUnavailable | import("@distilled.cloud/axiom").GatewayTimeout | import("@distilled.cloud/cloudflare").CloudflareHttpError | import("@distilled.cloud/cloudflare").CloudflareParseError | import("@distilled.cloud/cloudflare").InvalidRoute | import("@distilled.cloud/cloudflare").UnknownCloudflareError | workers.InvalidRoute | SecretsStore.InvalidAccountId, HttpClient.HttpClient | CredentialsStore | Access.Access | Cloudflare.Credentials | CloudflareEnvironment.CloudflareEnvironment>;
+/**
+ * Probe the deployed worker's `/version` endpoint and decide whether
+ * it satisfies the current {@link STATE_STORE_VERSION} contract.
+ *
+ * Reuses the same typed {@link StateApi} client the rest of the store
+ * speaks, just without the bearer-token transform — the `/version`
+ * route is intentionally unauthenticated so we can probe it before
+ * trusting any locally-cached credentials.
+ *
+ * Returns `true` only on a successful response carrying the matching
+ * version. Any failure (404 from a pre-`/version` deploy, transport
+ * error, schema mismatch, version mismatch) collapses to `false`,
+ * since the caller's response in every case is the same: fall
+ * through to the idempotent bootstrap flow.
+ */
+/**
+ * Block until the worker at `url` reports the {@link STATE_STORE_VERSION}
+ * this CLI was built against, with bounded exponential retry. Used
+ * post-deploy to wait out Cloudflare's edge cache so any subsequent
+ * read or write goes to the new worker.
+ *
+ * Failures (transport errors, 404 from a pre-`/version` build, schema
+ * mismatch, version mismatch) all collapse to "not ready yet" and are
+ * retried; once the budget is exhausted we surface a hard failure
+ * since continuing would talk to the wrong worker.
+ */
+declare class StateStoreVersionNotReady extends Error {
+    readonly expected: number;
+    readonly observed: number | undefined;
+    readonly _tag = "StateStoreVersionNotReady";
+    constructor(expected: number, observed: number | undefined);
+}
+export {};
+//# sourceMappingURL=State.d.ts.map

package/lib/Cloudflare/StateStore/State.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"State.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/StateStore/State.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,YAAY,MAAM,2CAA2C,CAAC;AAC1E,OAAO,KAAK,OAAO,MAAM,qCAAqC,CAAC;AAC/D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAI9D,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAC;AAE1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EACL,gBAAgB,EAEjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAQ5D,OAAO,KAAK,qBAAqB,MAAM,6BAA6B,CAAC;AAGrE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,KAAK,EAAqB,MAAM,sBAAsB,CAAC;AAMhE,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAkDvC,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,GAAI,UAAS,gBAAqB,0pBAgFrD,CAAC;AAEJ,eAAO,MAAM,KAAK,ubAyJf,CAAC;AAmLJ;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB;;;uvBAiF7B,CAAC;AA4CJ;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;GAUG;AACH,cAAM,yBAA0B,SAAQ,KAAK;IAGzC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS;IAHvC,QAAQ,CAAC,IAAI,+BAA+B;gBAEjC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS;CAMxC"}