alchemy 2.0.0-beta.43 → 2.0.0-beta.45

package/src/Cloudflare/SecretsStore/SecretBinding.ts

@@ -2,6 +2,7 @@ import type * as runtime from "@cloudflare/workers-types";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
 import * as Binding from "../../Binding.ts";
 import type { ResourceLike } from "../../Resource.ts";
 import type { RuntimeContext } from "../../RuntimeContext.ts";
@@ -20,7 +21,7 @@ export class SecretError extends Data.TaggedError("SecretError")<{
  * `SecretsStoreSecret` binding.
  */
 export interface SecretClient extends Effect.Effect<
-  string,
+  Redacted.Redacted<string>,
   SecretError,
   RuntimeContext
 > {
@@ -31,7 +32,7 @@ export interface SecretClient extends Effect.Effect<
   /**
    * Read the current value of the secret.
    */
-  get(): Effect.Effect<string, SecretError, RuntimeContext>;
+  get(): Effect.Effect<Redacted.Redacted<string>, SecretError, RuntimeContext>;
 }
 
 export class SecretBinding extends Binding.Service<
@@ -63,17 +64,16 @@ export const SecretBindingLive = Layer.effect(
             }),
         });
 
-      const getEffect: Effect.Effect<string, SecretError> = raw.pipe(
-        Effect.flatMap((raw) => tryPromise(() => raw.get())),
+      const getEffect = raw.pipe(
+        Effect.flatMap((raw) =>
+          tryPromise(() => raw.get().then(Redacted.make)),
+        ),
       );
 
-      return Object.assign(
-        Effect.suspend(() => getEffect),
-        {
-          raw,
-          get: () => getEffect,
-        },
-      ) as SecretClient;
+      return Object.assign(getEffect, {
+        raw,
+        get: () => getEffect,
+      });
     });
   }),
 );

package/src/Cloudflare/StateStore/Api.ts

@@ -1,3 +1,4 @@
+import { Redacted } from "effect";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Path from "effect/Path";
@@ -12,7 +13,7 @@ import {
   StateApi,
   StateAuthLive,
 } from "../../State/HttpStateApi.ts";
-import * as Secret from "../SecretsStore/Secret.ts";
+import { Secret } from "../SecretsStore/Secret.ts";
 import { SecretBindingLive } from "../SecretsStore/SecretBinding.ts";
 import { Worker } from "../Workers/Worker.ts";
 import Store from "./Store.ts";
@@ -29,7 +30,7 @@ export const STATE_STORE_SCRIPT_NAME = "alchemy-state-store" as const;
  * compare against this constant; a mismatch (or 404) triggers a
  * forced redeploy via the bootstrap flow.
  */
-export const STATE_STORE_VERSION = 5 as const;
+export const STATE_STORE_VERSION = 6 as const;
 
 /**
  * Hard-coded OTLP/HTTP endpoints. Point at the public ingest relay
@@ -108,22 +109,21 @@ export default Worker(
     },
   },
   Effect.gen(function* () {
-    const secret = yield* Secret.Secret.bind(AuthToken);
+    const remoteSecret = yield* Secret.bind(AuthToken);
     const store = yield* Store;
 
-    const bearerTokenValidator = Layer.effect(
+    const bearerTokenValidator = Layer.succeed(
       BearerTokenValidator,
-      secret.get().pipe(
-        Effect.map((expected) =>
-          BearerTokenValidator.of({
-            validate: (token) =>
-              !!expected && timingSafeEqual(token, expected)
-                ? Effect.void
-                : Effect.fail(new HttpApiError.Unauthorized()),
-          }),
-        ),
-        Effect.orDie,
-      ),
+      BearerTokenValidator.of({
+        // @ts-expect-error - TODO(sam): fix RuntimeContext color here
+        validate: Effect.fnUntraced(function* (token) {
+          const expected = yield* remoteSecret.get();
+          return !!expected &&
+            timingSafeEqual(token.trim(), Redacted.value(expected).trim())
+            ? yield* Effect.void
+            : yield* Effect.fail(new HttpApiError.Unauthorized());
+        }),
+      }),
     );
 
     const versionApi = HttpApiBuilder.group(StateApi, "version", (handlers) =>

package/src/Cloudflare/StateStore/State.ts

@@ -41,7 +41,7 @@ import * as Access from "../Access.ts";
 import { CloudflareAuth } from "../Auth/AuthProvider.ts";
 import { EdgeSessionError, createEdgeSession } from "../EdgeSession.ts";
 import Api, { STATE_STORE_SCRIPT_NAME, STATE_STORE_VERSION } from "./Api.ts";
-import { AuthTokenSecretName, TokenValue } from "./Token.ts";
+import { AuthToken, AuthTokenSecretName, TokenValue } from "./Token.ts";
 
 /** Filename used for stored credentials under the profile directory. */
 const CREDENTIALS_FILE = "cloudflare-state-store";
@@ -145,7 +145,13 @@ export const bootstrap = (options: BootstrapOptions = {}) =>
       yield* Clank.info(
         `Resuming Cloudflare State Store '${scriptName}' deployment...`,
       );
-      yield* finishBootstrap({ scriptName, profileName, localState, isCI });
+      yield* finishBootstrap({
+        scriptName,
+        profileName,
+        localState,
+        isCI,
+        force,
+      });
       yield* Clank.success(`Cloudflare State Store '${scriptName}' is ready.`);
       return;
     }
@@ -178,6 +184,7 @@ export const bootstrap = (options: BootstrapOptions = {}) =>
         localState,
         isCI,
         url: credentials.url,
+        force,
       });
       yield* Clank.success(`Cloudflare State Store '${scriptName}' is ready.`);
       return;
@@ -191,7 +198,13 @@ export const bootstrap = (options: BootstrapOptions = {}) =>
       yield* Clank.info(`Deploying Cloudflare State Store '${scriptName}'...`);
     }
 
-    yield* finishBootstrap({ scriptName, profileName, localState, isCI });
+    yield* finishBootstrap({
+      scriptName,
+      profileName,
+      localState,
+      isCI,
+      force,
+    });
     yield* Clank.success(`Cloudflare State Store '${scriptName}' is ready.`);
   }).pipe(
     Effect.withSpan("state_store.bootstrap", {
@@ -221,6 +234,7 @@ export const state = () =>
         "alchemy.state_store.script_name": scriptName,
         "alchemy.state_store.profile": profileName,
         "alchemy.state_store.ci": isCI,
+        "alchemy.state_store.force": false,
       });
       yield* annotateAccountHash(
         yield* Config.boolean("NO_TRACK").pipe(Config.withDefault(false)),
@@ -255,6 +269,7 @@ export const state = () =>
           profileName,
           localState,
           isCI,
+          force: false,
         });
       }
 
@@ -270,6 +285,7 @@ export const state = () =>
           localState,
           isCI,
           url: credentials.url,
+          force: false,
         });
         if (fresh) return fresh;
 
@@ -311,6 +327,7 @@ export const state = () =>
           localState,
           isCI,
           url: credentials.url,
+          force: false,
         });
         if (fresh) return fresh;
 
@@ -346,6 +363,7 @@ export const state = () =>
         profileName,
         localState,
         isCI,
+        force: false,
       });
     }).pipe(recordStateStoreInit, Effect.orDie),
   ).pipe(
@@ -423,14 +441,20 @@ const finishBootstrap = ({
   profileName,
   localState,
   isCI,
+  force,
 }: {
   scriptName: string;
   profileName: string;
   localState: StateService;
   isCI: boolean;
+  force: boolean;
 }) =>
   Effect.gen(function* () {
-    yield* deployStateStore(scriptName, localState);
+    const { authToken } = yield* deployStateStore(
+      scriptName,
+      localState,
+      force,
+    );
 
     // Don't trust the `authToken` returned by `deploy(...)`: when
     // adoption kicks in (the Secrets Store secret already existed),
@@ -442,7 +466,7 @@ const finishBootstrap = ({
     // actually deployed. `loginWithCloudflare` also persists the
     // credentials file (skipping the write in CI), so we don't need
     // to do that explicitly here.
-    const { url, authToken } = yield* loginWithCloudflare();
+    const { url } = yield* loginWithCloudflare();
     const httpState = yield* makeCloudflareStateStore({ url, authToken });
     // `profileName` is intentionally unused here — `loginWithCloudflare`
     // resolves it itself. Reference it to keep the surrounding API
@@ -476,7 +500,11 @@ const finishBootstrap = ({
     }),
   );
 
-const deployStateStore = (scriptName: string, state?: StateService) =>
+const deployStateStore = (
+  scriptName: string,
+  state?: StateService,
+  force?: boolean,
+) =>
   Effect.gen(function* () {
     yield* annotateAccountHash();
     const localState = state ?? (yield* makeLocalState());
@@ -485,6 +513,7 @@ const deployStateStore = (scriptName: string, state?: StateService) =>
     const { url, authToken } = yield* deploy({
       // use the script name as the stage name (so the user can have multiple state stores)
       stage: scriptName,
+      force,
       stack: Alchemy.Stack(
         "CloudflareStateStore",
         {
@@ -494,6 +523,7 @@ const deployStateStore = (scriptName: string, state?: StateService) =>
         Effect.gen(function* () {
           const token = yield* TokenValue;
           const api = yield* Api;
+          yield* AuthToken; // make sure it's in the Secrets Store
 
           // Surface the bearer token so tests and clients can authenticate
           // after deploy. The underlying value lives in the Cloudflare
@@ -514,6 +544,9 @@ const deployStateStore = (scriptName: string, state?: StateService) =>
       // TODO(sam): we should not need to do this, but types do complain. fix deploy
       Effect.provide(stateLayer),
     );
+
+    yield* writeCredentials(url, authToken);
+
     // Cloudflare's worker upload is eventually consistent: the deploy
     // call returns as soon as the script upload is accepted, but the
     // edge can keep serving the previous version for several seconds
@@ -582,6 +615,13 @@ export const loginWithCloudflare = () =>
       STATE_STORE_SCRIPT_NAME,
       store.id,
       AuthTokenSecretName,
+    ).pipe(
+      Effect.retry({
+        while: isWorkersPreviewConfigurationError,
+        schedule: Schedule.exponential(200).pipe(
+          Schedule.both(Schedule.recurs(15)),
+        ),
+      }),
     );
 
     // 3. Derive the deployed worker URL.
@@ -634,6 +674,25 @@ export const loginWithCloudflare = () =>
     }),
   );
 
+const writeCredentials = (url: string, authToken: string) =>
+  Effect.gen(function* () {
+    const profileName = yield* ALCHEMY_PROFILE;
+    const credStore = yield* CredentialsStore;
+    yield* credStore.write<HttpStateStoreCredentials>(
+      profileName,
+      CREDENTIALS_FILE,
+      {
+        url,
+        authToken,
+      },
+    );
+  });
+
+const isWorkersPreviewConfigurationError = (error: unknown) =>
+  error instanceof EdgeSessionError &&
+  (error.message.includes("Invalid Workers Preview configuration") ||
+    error.message.includes("Error 1031"));
+
 /**
  * Run {@link finishBootstrap} iff the worker at `url` fails the
  * version probe; otherwise resolve to `undefined`. Centralises the
@@ -646,12 +705,14 @@ const redeployIfStale = ({
   profileName,
   localState,
   isCI,
+  force,
 }: {
   url: string;
   scriptName: string;
   profileName: string;
   localState: StateService;
   isCI: boolean;
+  force: boolean;
 }) =>
   Effect.gen(function* () {
     const { matches, expected, observed } = yield* checkStateStoreVersion(url);
@@ -665,6 +726,7 @@ const redeployIfStale = ({
       profileName,
       localState,
       isCI,
+      force,
     });
   }).pipe(
     Effect.withSpan("state_store.redeploy_if_stale", {

package/src/Cloudflare/StateStore/Store.ts

@@ -1,11 +1,12 @@
 import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
 
+import { pipe } from "effect/Function";
 import type {
   ReplacedResourceState,
   ResourceState,
 } from "../../State/ResourceState.ts";
 import { encodeState } from "../../State/StateEncoding.ts";
-import { pipe } from "effect/Function";
 import * as Secret from "../SecretsStore/Secret.ts";
 import { DurableObjectNamespace } from "../Workers/DurableObjectNamespace.ts";
 import { DurableObjectState } from "../Workers/DurableObjectState.ts";
@@ -25,7 +26,9 @@ export default class Store extends DurableObjectNamespace<Store>()(
       const doState = yield* DurableObjectState;
       const storage = doState.storage;
 
-      const keyHex = yield* encryptionSecret.get().pipe(Effect.orDie);
+      const keyHex = yield* encryptionSecret
+        .get()
+        .pipe(Effect.map(Redacted.value), Effect.orDie);
       const cryptoKey = yield* Effect.tryPromise(() =>
         crypto.subtle.importKey(
           "raw",

package/src/Cloudflare/VpcService/VpcService.ts

@@ -77,7 +77,7 @@ export declare namespace VpcService {
 export type VpcServiceAttributes = {
   serviceId: string;
   serviceName: string;
-  serviceType: "http";
+  serviceType: "http" | "tcp";
   httpPort: number | undefined;
   httpsPort: number | undefined;
   host: VpcService.Host;
@@ -262,7 +262,7 @@ export const formatVpcService = (
   service: {
     serviceId?: string | null;
     name: string;
-    type: "http";
+    type: "http" | "tcp";
     createdAt?: string | null;
     updatedAt?: string | null;
     httpPort?: number | null;

package/src/Cloudflare/Website/StaticSite.ts

@@ -8,16 +8,12 @@ import {
   Worker,
   type WorkerAssetsConfig,
   type WorkerBindingProps,
-  type WorkerEnv,
   type WorkerProps,
 } from "../Workers/Worker.ts";
 
-export interface StaticSiteProps<
-  Bindings extends WorkerBindingProps = {},
-  Env extends WorkerEnv = WorkerEnv,
->
+export interface StaticSiteProps<Bindings extends WorkerBindingProps = {}>
   extends
-    Omit<WorkerProps<Bindings, Env, WorkerAssetsConfig>, "assets">,
+    Omit<WorkerProps<Bindings, WorkerAssetsConfig>, "assets" | "dev">,
     Omit<CommandProps, "env"> {
   /**
    * Optional configuration for static asset routing behavior.
@@ -120,13 +116,12 @@ export type StaticSite = ReturnType<typeof StaticSite>;
  */
 export const StaticSite = <
   const Bindings extends WorkerBindingProps = {},
-  const Env extends WorkerEnv = WorkerEnv,
   Req = never,
 >(
   id: string,
   propsEff:
-    | InputProps<StaticSiteProps<Bindings, Env>>
-    | Effect.Effect<InputProps<StaticSiteProps<Bindings, Env>>, never, Req>,
+    | InputProps<StaticSiteProps<Bindings>>
+    | Effect.Effect<InputProps<StaticSiteProps<Bindings>>, never, Req>,
 ) =>
   Effect.gen(function* () {
     const props = Effect.isEffect(propsEff)
@@ -154,7 +149,7 @@ export const StaticSite = <
       })),
     );
 
-    return yield* Worker<Bindings, Env, WorkerAssetsConfig, Req>(
+    return yield* Worker<Bindings, WorkerAssetsConfig, Req>(
       "Worker",
       Effect.map(props, (props) => ({
         ...props,
@@ -163,6 +158,9 @@ export const StaticSite = <
           hash: build.hash,
           config: props.assetsConfig,
         },
+        // Omit the dev command from WorkerProps since it's different from WorkerProps["dev"].
+        // TODO: we'll need to update this when we add local dev support for StaticSite.
+        dev: undefined,
       })),
     );
   }).pipe(Namespace.push(id));

package/src/Cloudflare/Website/Vite.ts

@@ -5,14 +5,12 @@ import {
   Worker,
   type WorkerAssetsConfig,
   type WorkerBindingProps,
-  type WorkerEnv,
   type WorkerProps,
 } from "../Workers/Worker.ts";
 
 export interface ViteProps<
   Bindings extends WorkerBindingProps = {},
-  Env extends WorkerEnv = {},
-> extends Omit<WorkerProps<Bindings, Env>, "vite" | "main"> {
+> extends Omit<WorkerProps<Bindings>, "vite" | "main"> {
   /**
    * Root directory passed to Vite's `root` option.
    * Defaults to the current working directory (`process.cwd()`).
@@ -111,15 +109,14 @@ export interface ViteProps<
  */
 export const Vite = <
   const Bindings extends WorkerBindingProps = {},
-  const Env extends WorkerEnv = {},
   Req = never,
 >(
   id: string,
   propsEff?:
-    | InputProps<ViteProps<Bindings, Env>>
-    | Effect.Effect<InputProps<ViteProps<Bindings, Env>>, never, Req>,
+    | InputProps<ViteProps<Bindings>>
+    | Effect.Effect<InputProps<ViteProps<Bindings>>, never, Req>,
 ) =>
-  Worker<Bindings, Env, WorkerAssetsConfig, Req>(
+  Worker<Bindings, WorkerAssetsConfig, Req>(
     id,
     Effect.map(
       Effect.isEffect(propsEff) ? propsEff : Effect.succeed(propsEff),

package/src/Cloudflare/Workers/Assets.ts

@@ -1,3 +1,4 @@
+import createIgnore from "@alchemy.run/node-utils/ignore";
 import * as workers from "@distilled.cloud/cloudflare/workers";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
@@ -6,7 +7,6 @@ import * as Path from "effect/Path";
 import type { PlatformError } from "effect/PlatformError";
 import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
 import { sha256, sha256Object } from "../../Util/index.ts";
-import createIgnore from "../../Util/ignore.ts";
 
 const MAX_ASSET_SIZE = 1024 * 1024 * 25; // 25MB
 const MAX_ASSET_COUNT = 20_000;

package/src/Cloudflare/Workers/DurableObjectBridge.ts

@@ -16,7 +16,7 @@ import {
   DurableObjectState,
   fromDurableObjectState,
 } from "./DurableObjectState.ts";
-import { makeRequestEffect } from "./HttpServer.ts";
+import { isScopeEjected, makeRequestEffect } from "./HttpServer.ts";
 import { fromWebSocket } from "./WebSocket.ts";
 import { getWorkerExport, handleRpcExit } from "./WorkerBridge.ts";
 
@@ -81,7 +81,6 @@ export const makeDurableObjectBridge =
 
         return new Proxy(this, {
           get: (target, prop) => {
-            console.log(target, prop, prop in target);
             const bind = (f: any) =>
               typeof f === "function" ? f.bind(target) : f;
             if (typeof prop !== "string") return bind((target as any)[prop]);
@@ -131,9 +130,12 @@ export const makeDurableObjectBridge =
                   : Promise.reject(Cause.squash(exit.cause))),
           )
           .finally(() =>
-            Scope.close(scope, Exit.void).pipe(Effect.runPromise, (promise) =>
-              this.#state.waitUntil(promise),
-            ),
+            isScopeEjected(scope)
+              ? undefined
+              : Scope.close(scope, Exit.void).pipe(
+                  Effect.runPromise,
+                  (promise) => this.ctx.waitUntil(promise),
+                ),
           );
       }