alchemy 2.0.0-beta.59 → 2.0.0-beta.60

package/src/AWS/S3/Bucket.ts

@@ -1312,7 +1312,9 @@ export const BucketProvider = () =>
         list: () =>
           Effect.gen(function* () {
             const { accountId, region } = yield* AWSEnvironment.current;
-            return yield* s3.listBuckets.pages({}).pipe(
+            // S3 only includes `BucketRegion` in the response when the request
+            // carries at least one parameter — hence the explicit MaxBuckets.
+            return yield* s3.listBuckets.pages({ MaxBuckets: 1000 }).pipe(
               Stream.runCollect,
               Effect.map((chunk) =>
                 Array.from(chunk).flatMap((page) =>
@@ -1320,15 +1322,21 @@ export const BucketProvider = () =>
                     .filter(
                       (b): b is s3.Bucket & { Name: string } => b.Name != null,
                     )
-                    .map((b) => ({
-                      bucketName: b.Name,
-                      bucketArn: `arn:aws:s3:::${b.Name}` as const,
-                      bucketDomainName: `${b.Name}.s3.amazonaws.com` as const,
-                      bucketRegionalDomainName:
-                        `${b.Name}.s3.${region}.amazonaws.com` as const,
-                      region,
-                      accountId,
-                    })),
+                    .map((b) => {
+                      // ListBuckets is global — record each bucket's actual
+                      // region so later operations (delete) can target it.
+                      const bucketRegion = (b.BucketRegion ??
+                        region) as RegionID;
+                      return {
+                        bucketName: b.Name,
+                        bucketArn: `arn:aws:s3:::${b.Name}` as const,
+                        bucketDomainName: `${b.Name}.s3.amazonaws.com` as const,
+                        bucketRegionalDomainName:
+                          `${b.Name}.s3.${bucketRegion}.amazonaws.com` as const,
+                        region: bucketRegion,
+                        accountId,
+                      };
+                    }),
                 ),
               ),
             );
@@ -1512,34 +1520,61 @@ export const BucketProvider = () =>
         }),
         delete: Effect.fn(function* ({ olds = {}, output, session }) {
           yield* Effect.logInfo(
-            `S3 Bucket delete: bucket=${output.bucketName} forceDestroy=${olds.forceDestroy ?? false}`,
+            `S3 Bucket delete: bucket=${output.bucketName} forceDestroy=${olds.forceDestroy ?? false} region=${output.region}`,
           );
-          // If forceDestroy is enabled, delete all objects first. The bucket
-          // may already be gone (deleted out-of-band, or a previous destroy
-          // partially succeeded) — treat NoSuchBucket as a no-op so the
-          // overall delete still converges.
-          if (olds.forceDestroy) {
-            yield* session.note(
-              `Force destroying bucket: ${output.bucketName} - deleting all objects...`,
-            );
-            yield* deleteAllObjects(output.bucketName).pipe(
-              Effect.catchTag("NoSuchBucket", () => Effect.void),
-            );
-          }
+          const run = Effect.gen(function* () {
+            // If forceDestroy is enabled, delete all objects first. The bucket
+            // may already be gone (deleted out-of-band, or a previous destroy
+            // partially succeeded) — treat NoSuchBucket as a no-op so the
+            // overall delete still converges.
+            if (olds.forceDestroy) {
+              yield* session.note(
+                `Force destroying bucket: ${output.bucketName} - deleting all objects...`,
+              );
+              yield* deleteAllObjects(output.bucketName).pipe(
+                Effect.catchTag("NoSuchBucket", () => Effect.void),
+              );
+            }
 
-          yield* s3
-            .deleteBucket({
-              Bucket: output.bucketName,
-            })
-            .pipe(
-              Effect.catchTag("NoSuchBucket", () => Effect.void),
-              Effect.retry({
-                while: (e) => e._tag === "BucketNotEmpty",
-                schedule: Schedule.exponential(100).pipe(
-                  Schedule.both(Schedule.recurs(5)),
-                ),
-              }),
-            );
+            yield* s3
+              .deleteBucket({
+                Bucket: output.bucketName,
+              })
+              .pipe(
+                Effect.catchTag("NoSuchBucket", () => Effect.void),
+                Effect.retry({
+                  while: (e) => e._tag === "BucketNotEmpty",
+                  schedule: Schedule.exponential(100).pipe(
+                    Schedule.both(Schedule.recurs(5)),
+                  ),
+                }),
+              );
+          });
+
+          // The bucket may live in a different region than the ambient client
+          // (list enumerates buckets from every region) — target the bucket's
+          // own region to avoid PermanentRedirect. If we still get redirected
+          // (e.g. a stale/missing region attribute), retry once in the region
+          // the redirect reports.
+          yield* (
+            output.region
+              ? run.pipe(
+                  Effect.provideService(Region, Effect.succeed(output.region)),
+                )
+              : run
+          ).pipe(
+            Effect.tapError(Effect.logInfo),
+            Effect.catchTag("PermanentRedirect", (e) =>
+              e.BucketRegion
+                ? run.pipe(
+                    Effect.provideService(
+                      Region,
+                      Effect.succeed(e.BucketRegion as RegionID),
+                    ),
+                  )
+                : Effect.fail(e),
+            ),
+          );
 
           yield* session.note(`Deleted bucket: ${output.bucketName}`);
         }),

package/src/AlchemyContext.ts

@@ -20,6 +20,13 @@ export class AlchemyContext extends EffectContext.Service<
      * overrides via the `adopt(enabled)` combinator still take precedence.
      */
     adopt: boolean;
+    /**
+     * When `true`, an out-of-date Cloudflare state store is upgraded
+     * automatically instead of prompting for confirmation (and the upgrade
+     * proceeds even in CI). The CLI's `--yes` flag flows in through this field.
+     * @default false
+     */
+    updateStateStore?: boolean;
   }
 >()("alchemy/Context") {}
 

package/src/Apply.ts

@@ -353,7 +353,9 @@ const executePlan = Effect.fn(function* (
     // Aggregate every collected lifecycle failure into a single parallel Cause
     // so the apply ends with one combined error containing every distinct
     // failure / defect that occurred across the concurrent fibers.
-    yield* Effect.failCause(failures.map((f) => f.cause).reduce(Cause.combine));
+    return yield* Effect.failCause(
+      failures.map((f) => f.cause).reduce(Cause.combine),
+    );
   }
 });
 
@@ -1605,7 +1607,7 @@ const collectGarbage = Effect.fn(function* (
                   stage,
                   fqn,
                 });
-                yield* report("deleted");
+                yield* report("retained");
                 return;
               }
               yield* commit<DeletingResourceState>({

package/src/Axiom/Chart.ts

@@ -64,8 +64,16 @@ export interface LogStreamChart extends BaseChart {
   readonly type: "LogStream";
 }
 
-export interface NoteChart extends BaseChart {
+/**
+ * A free-form markdown note. Unlike data charts, `Note` has no `query`
+ * or `name` — Axiom's payload is strictly `{ id, type, text, variant? }`.
+ */
+export interface NoteChart {
+  readonly id: string;
   readonly type: "Note";
+  /** Markdown body rendered in the note cell. */
+  readonly text: string;
+  readonly variant?: "default";
 }
 
 /**

package/src/Bundle/Bundle.ts

@@ -362,7 +362,7 @@ function builtInPlugins(
   ];
 }
 
-function bundleErrorFromUnknown(error: unknown): BundleError {
+export function bundleErrorFromUnknown(error: unknown): BundleError {
   const message = error instanceof Error ? error.message : String(error);
   return new BundleError({
     message,

package/src/Bundle/TempRoot.ts

@@ -2,9 +2,31 @@ import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 import * as crypto from "node:crypto";
+import { fileURLToPath } from "node:url";
 import { Stack } from "../Stack.ts";
 import { Stage } from "../Stage.ts";
 
+/**
+ * Resolve a bundle entrypoint (`main`) to a real filesystem path.
+ *
+ * `main` is user-supplied and is very commonly `import.meta.url` — a
+ * `file://` URL — which `FileSystem.realPath` cannot `lstat` directly
+ * (it would try to stat a literal `file:` path). Convert any `file://`
+ * URL to a path first, then resolve to the canonical real path.
+ */
+export const resolveMainPath = Effect.fn(function* (main: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const asPath = yield* Effect.sync(() => {
+    try {
+      return fileURLToPath(main);
+    } catch {
+      return main;
+    }
+  });
+  return path.resolve(yield* fs.realPath(asPath));
+});
+
 /**
  * Creates a unique bundle staging directory under the nearest package-local
  * `.alchemy/tmp` root. Each invocation gets its own directory (via a random

package/src/Bundle/Vite.ts

@@ -0,0 +1,204 @@
+import type { NonEmptyArray } from "effect/Array";
+import * as Cause from "effect/Cause";
+import * as Deferred from "effect/Deferred";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import type * as vite from "vite";
+import { sha256 } from "../Util/index.ts";
+import {
+  BundleError,
+  bundleErrorFromUnknown,
+  bundleOutputFromFiles,
+  type BundleFile,
+  type BundleOutput,
+} from "./Bundle.ts";
+
+export interface ViteBuildOutput {
+  readonly clientDirectory: string | undefined;
+  // This is emitted as an Effect instead of a value so we can process it in parallel with reading the client assets.
+  readonly serverBundle: Effect.Effect<BundleOutput | undefined, BundleError>;
+}
+
+// `@vitejs/plugin-rsc` writes these modules separately after build completes instead of emitting them as chunks.
+// So, we need to detect them and read them from the file system manually.
+const RSC_MANIFEST = {
+  "virtual:vite-rsc/assets-manifest": "__vite_rsc_assets_manifest.js",
+  "virtual:vite-rsc/environment-imports": "__vite_rsc_env_imports_manifest.js",
+} as const;
+type RscManifestId = keyof typeof RSC_MANIFEST;
+
+/**
+ * A Vite plugin that collects the output of the build and makes it available as an Effect.
+ * @param entryEnvironment - The environment to use as the entry point for the server bundle. Defaults to "ssr".
+ */
+export const viteBuildOutputPlugin = Effect.fn(function* ({
+  entryEnvironment = "ssr",
+}: {
+  entryEnvironment?: string;
+}) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  let clientDirectory: string | undefined;
+  let serverEntry: string | undefined;
+  const serverChunks = new Map<
+    string,
+    Effect.Effect<BundleFile, BundleError>
+  >();
+  const deferred = yield* Deferred.make<ViteBuildOutput, BundleError>();
+
+  const plugin: vite.Plugin = {
+    name: "alchemy:build-output",
+    sharedDuringBuild: true,
+    async writeBundle(_, bundle) {
+      if (this.environment.name === "client") {
+        clientDirectory = path.resolve(
+          this.environment.config.root,
+          this.environment.config.build.outDir,
+        );
+        return;
+      }
+      const files = Object.values(bundle);
+      if (this.environment.name === entryEnvironment) {
+        const entryChunk = files.find(
+          (file) => file.type === "chunk" && file.isEntry,
+        );
+        if (!entryChunk) {
+          throw new Error(
+            `Entry chunk not found for environment "${this.environment.name}"`,
+          );
+        }
+        serverEntry = fileName(entryChunk.fileName, this.environment);
+      }
+      await Promise.all(
+        files.map(async (file) => {
+          if (file.type === "chunk") {
+            file.imports
+              .filter(
+                (self): self is keyof typeof RSC_MANIFEST =>
+                  self in RSC_MANIFEST,
+              )
+              .forEach((id) => {
+                // Key by the environment-prefixed path, NOT the bare manifest
+                // filename. `@vitejs/plugin-rsc` emits a copy of the same-named
+                // manifest into every environment's outDir (e.g. both
+                // `dist/rsc/__vite_rsc_assets_manifest.js` and
+                // `dist/ssr/__vite_rsc_assets_manifest.js`), and each
+                // environment's chunks import their own copy via a relative
+                // specifier. Keying by the bare filename collapses them into a
+                // single entry, dropping every copy but the last — so the
+                // entry worker's `import "../__vite_rsc_assets_manifest.js"`
+                // resolves to a module that isn't in the bundle and the
+                // deployed Worker fails at startup.
+                serverChunks.set(
+                  fileName(RSC_MANIFEST[id], this.environment),
+                  readRscManifestChunk(id, this.environment),
+                );
+              });
+          }
+          const name = fileName(file.fileName, this.environment);
+          const content = file.type === "chunk" ? file.code : file.source;
+          serverChunks.set(
+            name,
+            sha256(content).pipe(
+              Effect.map((hash) => ({ path: name, content, hash })),
+            ),
+          );
+        }),
+      );
+    },
+    buildApp: {
+      order: "post",
+      async handler() {
+        Deferred.doneUnsafe(
+          deferred,
+          Effect.succeed({
+            clientDirectory,
+            serverBundle: makeServerBundle(),
+          }),
+        );
+      },
+    },
+  };
+
+  // The server bundle may include chunks from more than one Vite environment, so we need to prefix them with the environment-specific output directory.
+  // Flattening them doesn't work because of relative imports between environments.
+  //
+  // `build.outDir` can be resolved to an absolute path (e.g. `@vitejs/plugin-rsc`
+  // does this), which would leak the build machine's filesystem path into the
+  // worker module names and produce non-portable, leading-`/` specifiers that
+  // Cloudflare rejects. Normalize it back to a path relative to the project root
+  // so module names match the single-environment case (`dist/ssr/worker.js`).
+  const fileName = (name: string, environment: vite.Environment) => {
+    const outDir = environment.config.build.outDir;
+    const relativeOutDir = path.isAbsolute(outDir)
+      ? path.relative(environment.config.root, outDir)
+      : outDir;
+    return `${relativeOutDir}/${name}`;
+  };
+
+  // Manually read the RSC manifest chunk from the file system.
+  // This is only safe to run *after* the build has completed.
+  const readRscManifestChunk = (
+    id: RscManifestId,
+    environment: vite.Environment,
+  ) => {
+    const name = RSC_MANIFEST[id];
+    return fs
+      .readFile(
+        path.resolve(
+          environment.config.root,
+          environment.config.build.outDir,
+          name,
+        ),
+      )
+      .pipe(
+        Effect.flatMap((content) =>
+          sha256(content).pipe(
+            Effect.map(
+              (hash): BundleFile => ({
+                path: fileName(name, environment),
+                content,
+                hash,
+              }),
+            ),
+          ),
+        ),
+        Effect.mapError(bundleErrorFromUnknown),
+      );
+  };
+
+  const makeServerBundle = () => {
+    if (!serverEntry && !serverChunks.size) return Effect.undefined;
+    if (!serverEntry)
+      return Effect.die(new Cause.NoSuchElementError("Missing server entry"));
+    const filePaths = Array.from(serverChunks.keys()).sort((a, b) =>
+      a.localeCompare(b),
+    );
+    const server: NonEmptyArray<Effect.Effect<BundleFile, BundleError>> = [
+      getChunk(serverEntry),
+    ];
+    for (const filePath of filePaths) {
+      if (filePath === serverEntry) continue;
+      server.push(getChunk(filePath));
+    }
+    return Effect.all(server, { concurrency: "unbounded" }).pipe(
+      Effect.flatMap(bundleOutputFromFiles),
+    );
+  };
+
+  const getChunk = (path: string) => {
+    const chunk = serverChunks.get(path);
+    if (!chunk) {
+      return Effect.die(
+        new Cause.NoSuchElementError(`Chunk ${path} not found`),
+      );
+    }
+    return chunk;
+  };
+
+  return {
+    plugin,
+    output: Deferred.await(deferred),
+  };
+});

package/src/Bundle/index.ts

@@ -1,7 +1,6 @@
 export * from "./Bundle.ts";
 export * from "./BundleAnalyzerPlugin.ts";
 export * from "./InstalledPackages.ts";
-export * from "./Docker.ts";
 export * from "./PurePlugin.ts";
 export * from "./RawPlugin.ts";
 export * from "./TempRoot.ts";

package/src/Cli/Event.ts

@@ -10,6 +10,7 @@ export type ApplyStatus =
   | "updated"
   | "deleting"
   | "deleted"
+  | "retained"
   | "replacing"
   | "replaced"
   // Action lifecycle (see {@link Action})

package/src/Cli/LoggingCli.ts

@@ -35,6 +35,8 @@ const statusColor = (status: ApplyStatus): ((s: string) => string) => {
       return green;
     case "deleted":
       return dim;
+    case "retained":
+      return dim;
     case "fail":
       return red;
     case "attaching":
@@ -51,6 +53,7 @@ const isTerminal = (status: ApplyStatus): boolean =>
   status === "created" ||
   status === "updated" ||
   status === "deleted" ||
+  status === "retained" ||
   status === "replaced" ||
   status === "fail";
 

package/src/Cli/commands/_shared.ts

@@ -9,6 +9,7 @@ import * as S from "effect/Schema";
 import * as Argument from "effect/unstable/cli/Argument";
 import * as CliError from "effect/unstable/cli/CliError";
 import * as Flag from "effect/unstable/cli/Flag";
+import { pathToFileURL } from "node:url";
 
 import {
   type AuthProvider,
@@ -301,7 +302,12 @@ export const printProfile = Effect.fn(function* (
 
 export const importStack = Effect.fn(function* (main: string) {
   const path = yield* Path.Path;
-  const url = import.meta.resolve(path.resolve(main));
+  // Build a `file://` URL from the absolute path. `import.meta.resolve` expects a
+  // module specifier / URL, not a raw filesystem path: on Windows an absolute
+  // path like `D:\stack.ts` is not a valid specifier and fails to resolve, so the
+  // CLI cannot load the user's stack. `pathToFileURL` produces a valid URL on
+  // every platform.
+  const url = pathToFileURL(path.resolve(main)).href;
   const module = yield* Effect.promise(() => import(url));
   const stackEffect = module.default as ReturnType<
     ReturnType<typeof Stack.make>

package/src/Cli/commands/cloudflare.ts

@@ -20,7 +20,10 @@ import * as CloudflareEnvironment from "../../Cloudflare/CloudflareEnvironment.t
 import * as CloudflareCredentials from "../../Cloudflare/Credentials.ts";
 import { CloudflareLogs } from "../../Cloudflare/Logs.ts";
 import { STATE_STORE_SCRIPT_NAME } from "../../Cloudflare/StateStore/Api.ts";
-import { bootstrap as bootstrapCloudflare } from "../../Cloudflare/StateStore/State.ts";
+import {
+  bootstrap as bootstrapCloudflare,
+  teardownStateStore,
+} from "../../Cloudflare/StateStore/State.ts";
 import * as Clank from "../../Util/Clank.ts";
 import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
 import { fileLogger } from "../../Util/FileLogger.ts";
@@ -116,6 +119,33 @@ const bootstrapCommand = Command.make(
   ),
 );
 
+const teardownCommand = Command.make(
+  "teardown",
+  {
+    envFile,
+    profile,
+    workerName: cloudflareWorkerName,
+  },
+  instrumentCommand(
+    "cloudflare.teardown",
+    (a: { profile: string; workerName: string | undefined }) => ({
+      "alchemy.profile": a.profile,
+      "alchemy.worker_name": a.workerName ?? "",
+    }),
+  )(
+    Effect.fn(function* ({ envFile, profile, workerName }) {
+      const services = yield* cloudflareLayers(envFile, profile);
+      yield* teardownStateStore({
+        workerName,
+        profile,
+      }).pipe(Effect.provide(services));
+    }),
+  ),
+).pipe(
+  Command.withHidden,
+  Command.withDescription("Tear down the cloudflare state store"),
+);
+
 /**
  * A single resolved Cloudflare token policy in the shape expected by
  * `POST /user/tokens`.
@@ -606,5 +636,10 @@ const stateCommand = Command.make("state", {}).pipe(
 );
 
 export const cloudflareCommand = Command.make("cloudflare", {}).pipe(
-  Command.withSubcommands([bootstrapCommand, createTokenCommand, stateCommand]),
+  Command.withSubcommands([
+    bootstrapCommand,
+    teardownCommand,
+    createTokenCommand,
+    stateCommand,
+  ]),
 );

package/src/Cli/commands/deploy.ts

@@ -89,6 +89,9 @@ export const execStack = Effect.fn(function* ({
           ...ctx,
           dev,
           adopt,
+          // `--yes` also auto-accepts (and performs) an out-of-date state
+          // store upgrade, instead of prompting.
+          updateStateStore: yes,
         })),
       ),
     ),
@@ -174,7 +177,7 @@ export const execStack = Effect.fn(function* ({
         }
 
         if (dev) {
-          yield* Effect.never;
+          return yield* Effect.never;
         }
       }
     }).pipe(Effect.provide(stack.services));

package/src/Cli/tui/components/PlanProgress.tsx

@@ -270,8 +270,8 @@ export function PlanProgress(props: PlanProgressProps): JSX.Element {
           const icon = taskIcon(row.action, status, spinner);
           const label =
             row.action === "delete"
-              ? status === "deleted"
-                ? "deleted"
+              ? status === "deleted" || status === "retained"
+                ? status
                 : "drop"
               : status === "ran"
                 ? row.action === "noop"
@@ -365,6 +365,8 @@ function statusColor(
     case "deleting":
     case "deleted":
       return "red";
+    case "retained":
+      return "gray";
     case "running":
     case "ran":
       return "cyan";
@@ -386,7 +388,7 @@ function taskIcon(
   if (status === "fail") return "✗";
   if (status === "skipped") return "•";
   if (status === "ran") return action === "noop" ? "•" : "✓";
-  if (status === "deleted") return "✓";
+  if (status === "deleted" || status === "retained") return "✓";
   if (action === "delete") return "-";
   if (action === "noop") return "•";
   return "λ";

package/src/Cloudflare/AI/Gateway.ts

@@ -360,7 +360,7 @@ export const isAiGateway = (value: unknown): value is Gateway =>
  *
  * export default class Api extends Cloudflare.Worker<Api>()(
  *   "Api",
- *   { main: import.meta.filename },
+ *   { main: import.meta.url },
  *   Effect.gen(function* () {
  *     const aiGateway = yield* Cloudflare.AI.QueryGateway(Gateway);
  *

package/src/Cloudflare/AI/Search.ts

@@ -235,7 +235,7 @@ export type Search = SearchInstance & {
  *
  * export default class Api extends Cloudflare.Worker<Api>()(
  *   "api",
- *   { main: import.meta.filename },
+ *   { main: import.meta.url },
  *   Effect.gen(function* () {
  *     const bucket = yield* Cloudflare.R2.Bucket("docs");
  *     const aiSearch = yield* Cloudflare.AI.Search("docs-search", {

package/src/Cloudflare/AI/SearchInstance.ts

@@ -508,7 +508,7 @@ export type SearchInstance = Resource<
  *
  * export default class Api extends Cloudflare.Worker<Api>()(
  *   "api",
- *   { main: import.meta.filename },
+ *   { main: import.meta.url },
  *   Effect.gen(function* () {
  *     const bucket = yield* Cloudflare.R2.Bucket("docs", {});
  *     const instance = yield* Cloudflare.AI.SearchInstance("docs-search", {

package/src/Cloudflare/AI/SearchNamespace.ts

@@ -131,7 +131,7 @@ export type SearchNamespace = Resource<
  *
  * export default class Api extends Cloudflare.Worker<Api>()(
  *   "api",
- *   { main: import.meta.filename },
+ *   { main: import.meta.url },
  *   Effect.gen(function* () {
  *     const ns = yield* Cloudflare.AI.QuerySearchNamespace(Docs);
  *

package/src/Cloudflare/AI/SearchToken.ts

@@ -187,7 +187,12 @@ export const SearchTokenProvider = () =>
         name,
         cfApiId: news.cfApiId as string,
         cfApiKey: Redacted.value(news.cfApiKey as Redacted.Redacted<string>),
-        legacy: news.legacy,
+        // Cloudflare defaults an omitted `legacy` to `true`, and legacy
+        // (account-level instance) tokens cannot be managed via the per-token
+        // routes — GET/DELETE `/ai-search/tokens/{id}` return 401, so they can
+        // never be read or deleted, leaking on every teardown. Force
+        // non-legacy unless the caller explicitly opts in.
+        legacy: news.legacy ?? false,
       };
 
       if (!observed) {