alchemy 2.0.0-beta.61 → 2.0.0-beta.62

package/src/Cloudflare/Auth/AuthProvider.ts

@@ -21,6 +21,7 @@ import {
   retryOnce,
 } from "../../Auth/Env.ts";
 import * as Clank from "../../Util/Clank.ts";
+import { CREDENTIALS_FILE as STATE_STORE_CREDENTIALS_FILE } from "../StateStore/CredentialsFile.ts";
 import * as OAuthClient from "./OAuthClient.ts";
 
 const options: Array<{
@@ -343,10 +344,18 @@ export const CloudflareAuth = AuthProviderLayer<
 
     const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
       Effect.gen(function* () {
-        if (ctx.ci) {
-          return { method: "env" as const };
-        }
-        return yield* configureInteractive(profileName);
+        const config = ctx.ci
+          ? { method: "env" as const }
+          : yield* configureInteractive(profileName);
+        // Re-configuring auth may point this profile at a different
+        // Cloudflare account. The cached state-store credentials
+        // (`~/.alchemy/credentials/{profile}/cloudflare-state-store.json`)
+        // are minted per-account, so drop them here; the next deploy
+        // re-derives them against the freshly-configured account.
+        yield* store
+          .delete(profileName, STATE_STORE_CREDENTIALS_FILE)
+          .pipe(Effect.ignore);
+        return config;
       }).pipe(
         Effect.mapError(
           (e) =>
@@ -491,40 +500,50 @@ export const CloudflareAuth = AuthProviderLayer<
       );
 
     const logout = (profileName: string, config: CloudflareAuthConfig) =>
-      Match.value(config).pipe(
-        Match.when({ method: "env" }, () => Effect.void),
-        Match.when({ method: "stored" }, () =>
-          store
-            .delete(profileName, "cf-stored")
-            .pipe(
-              Effect.andThen(
-                Clank.success("Cloudflare: stored credentials removed"),
+      Match.value(config)
+        .pipe(
+          Match.when({ method: "env" }, () => Effect.void),
+          Match.when({ method: "stored" }, () =>
+            store
+              .delete(profileName, "cf-stored")
+              .pipe(
+                Effect.andThen(
+                  Clank.success("Cloudflare: stored credentials removed"),
+                ),
               ),
-            ),
-        ),
-        Match.when({ method: "oauth" }, () =>
-          store
-            .read<OAuthClient.OAuthCredentials>(profileName, "cf-oauth")
-            .pipe(
-              Effect.tap((creds) =>
-                creds?.type === "oauth"
-                  ? OAuthClient.revoke(creds).pipe(
-                      Effect.catchTag("OAuthError", (err) =>
-                        Clank.warn(
-                          `Cloudflare: could not revoke OAuth token: ${err.errorDescription}`,
+          ),
+          Match.when({ method: "oauth" }, () =>
+            store
+              .read<OAuthClient.OAuthCredentials>(profileName, "cf-oauth")
+              .pipe(
+                Effect.tap((creds) =>
+                  creds?.type === "oauth"
+                    ? OAuthClient.revoke(creds).pipe(
+                        Effect.catchTag("OAuthError", (err) =>
+                          Clank.warn(
+                            `Cloudflare: could not revoke OAuth token: ${err.errorDescription}`,
+                          ),
                         ),
-                      ),
-                    )
-                  : Effect.void,
-              ),
-              Effect.andThen(store.delete(profileName, "cf-oauth")),
-              Effect.andThen(
-                Clank.success("Cloudflare: OAuth credentials removed."),
+                      )
+                    : Effect.void,
+                ),
+                Effect.andThen(store.delete(profileName, "cf-oauth")),
+                Effect.andThen(
+                  Clank.success("Cloudflare: OAuth credentials removed."),
+                ),
               ),
-            ),
-        ),
-        Match.exhaustive,
-      );
+          ),
+          Match.exhaustive,
+        )
+        // The cached state-store credentials are derived from the account we
+        // just logged out of, so drop them regardless of auth method.
+        .pipe(
+          Effect.andThen(
+            store
+              .delete(profileName, STATE_STORE_CREDENTIALS_FILE)
+              .pipe(Effect.ignore),
+          ),
+        );
 
     const login = (profileName: string, config: CloudflareAuthConfig) =>
       Match.value(config)
@@ -619,9 +638,6 @@ export const CloudflareAuth = AuthProviderLayer<
             Match.exhaustive,
           );
         }),
-        Effect.catch((e) =>
-          Console.error(`  Failed to retrieve credentials: ${e}`),
-        ),
       );
 
     return {

package/src/Cloudflare/Auth/OAuthClient.ts

@@ -2,6 +2,7 @@ import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import crypto from "node:crypto";
 import http from "node:http";
+import { AUTH_ERROR_URL, AUTH_SUCCESS_URL } from "../../Auth/AuthProvider.ts";
 import {
   OAUTH_CLIENT_ID,
   OAUTH_ENDPOINTS,
@@ -224,7 +225,7 @@ function callbackPromise(
       const error = url.searchParams.get("error");
       const errorDescription = url.searchParams.get("error_description");
       if (error) {
-        res.writeHead(302, { Location: "https://alchemy.run/auth/error" });
+        res.writeHead(302, { Location: AUTH_ERROR_URL });
         res.end();
         cleanup();
         reject(
@@ -239,7 +240,7 @@ function callbackPromise(
       const code = url.searchParams.get("code");
       const state = url.searchParams.get("state");
       if (!code || !state) {
-        res.writeHead(302, { Location: "https://alchemy.run/auth/error" });
+        res.writeHead(302, { Location: AUTH_ERROR_URL });
         res.end();
         cleanup();
         reject(
@@ -252,7 +253,7 @@ function callbackPromise(
       }
 
       if (state !== authorization.state) {
-        res.writeHead(302, { Location: "https://alchemy.run/auth/error" });
+        res.writeHead(302, { Location: AUTH_ERROR_URL });
         res.end();
         cleanup();
         reject(
@@ -268,14 +269,12 @@ function callbackPromise(
         const credentials = await Effect.runPromise(
           exchange(code, authorization.verifier),
         );
-        res.writeHead(302, {
-          Location: "https://alchemy.run/auth/success",
-        });
+        res.writeHead(302, { Location: AUTH_SUCCESS_URL });
         res.end();
         cleanup();
         resolve(credentials);
       } catch (err) {
-        res.writeHead(302, { Location: "https://alchemy.run/auth/error" });
+        res.writeHead(302, { Location: AUTH_ERROR_URL });
         res.end();
         cleanup();
         reject(err);

package/src/Cloudflare/Cache/RegionalTieredCache.ts

@@ -114,10 +114,13 @@ const desiredValue = (props: RegionalTieredCacheProps): "on" | "off" =>
 // Cloudflare can transiently fail to authenticate a valid token, surfacing as
 // `Unauthorized`/`Forbidden`. Retry with exponential backoff capped at 5s,
 // bounded to ~8 attempts so a persistently-failing call still fails fast.
-const transientAuthRetrySchedule = Schedule.exponential("500 millis").pipe(
-  Schedule.either(Schedule.spaced("5 seconds")),
-  Schedule.both(Schedule.recurs(8)),
-);
+const transientAuthRetrySchedule = Schedule.max([
+  Schedule.min([
+    Schedule.exponential("500 millis"),
+    Schedule.spaced("5 seconds"),
+  ]),
+  Schedule.recurs(8),
+]);
 
 export const RegionalTieredCacheProvider = () =>
   Provider.succeed(RegionalTieredCache, {

package/src/Cloudflare/Containers/ContainerApplication.ts

@@ -1,5 +1,5 @@
-import type { ContainerImage } from "@distilled.cloud/cloudflare-runtime/Docker";
 import * as Containers from "@distilled.cloud/cloudflare/containers";
+import * as Redacted from "effect/Redacted";
 import * as ProviderLayer from "../../Local/ProviderLayer.ts";
 import {
   type Main,
@@ -610,7 +610,27 @@ export interface ContainerApplication<Shape = unknown> extends Resource<
 // imported by Worker.ts). The provider helpers that previously lived here
 // (resolveDurableObjectApplicationRecovery, the readiness schedule/retry, etc.)
 // were extracted to ContainerProvider.ts on this branch.
-export type DevContainerImage = ContainerImage;
+export type DevContainerImage =
+  | DevContainerImage.Build
+  | DevContainerImage.Pull
+  | DevContainerImage.Ref;
+
+export declare namespace DevContainerImage {
+  interface Base {
+    readonly env?: Record<string, string | Redacted.Redacted<string>>;
+  }
+  export interface Build extends Base {
+    readonly dockerfile: string;
+    readonly context?: string;
+    readonly buildArgs?: Record<string, string>;
+  }
+  export interface Pull extends Base {
+    readonly imageUri: string;
+  }
+  export interface Ref extends Base {
+    readonly tag: string;
+  }
+}
 
 export const ContainerProvider = () =>
   ProviderLayer.select({

package/src/Cloudflare/Containers/ContainerBundle.ts

@@ -1,16 +1,21 @@
 import * as Effect from "effect/Effect";
+import * as Path from "effect/Path";
 import * as Redacted from "effect/Redacted";
 import type * as rolldown from "rolldown";
+import { AlchemyContext } from "../../AlchemyContext.ts";
 import * as Bundle from "../../Bundle/Bundle.ts";
-import { findCwdForBundle, resolveMainPath } from "../../Bundle/TempRoot.ts";
+import {
+  findCwdForBundle,
+  getStableContextDir,
+  resolveMainPath,
+} from "../../Bundle/TempRoot.ts";
+import { Docker } from "../../Docker/Docker.ts";
 import * as Output from "../../Output.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import { Self } from "../../Self.ts";
 import { Stack } from "../../Stack.ts";
-import type {
-  ContainerApplication,
-  ContainerApplicationProps,
-} from "./ContainerApplication.ts";
+import { sha256Object } from "../../Util/sha256.ts";
+import type { ContainerApplicationProps } from "./ContainerApplication.ts";
 
 /**
  * Fold the runtime-context `env` map (populated by `Binding.Service`s and
@@ -36,35 +41,24 @@ import type {
  *
  * Explicit `props.environmentVariables` win on a name collision.
  */
-export const foldEnvIntoEnvironmentVariables = (
+export const makeContainerEnv = (
   props: ContainerApplicationProps,
-  accountId?: string,
-): ContainerApplication.EnvironmentVariable[] | undefined => {
-  const explicitNames = new Set(
-    (props.environmentVariables ?? []).map((e) => e.name),
-  );
-  const environmentVariables: ContainerApplication.EnvironmentVariable[] = [
-    ...(props.environmentVariables ?? []),
-    ...(accountId !== undefined &&
-    !explicitNames.has("ALCHEMY_CLOUDFLARE_ACCOUNT_ID")
-      ? [{ name: "ALCHEMY_CLOUDFLARE_ACCOUNT_ID", value: accountId }]
-      : []),
-    ...Object.entries(props.env ?? {})
-      .filter(
-        ([name, value]) =>
-          value !== undefined &&
-          !Output.isOutput(value) &&
-          !explicitNames.has(name) &&
-          name !== "ALCHEMY_CLOUDFLARE_ACCOUNT_ID",
-      )
-      .map(([name, value]) => ({
-        name,
-        value: Redacted.isRedacted(value)
-          ? Redacted.value(value as Redacted.Redacted<string>)
-          : (value as string),
-      })),
-  ];
-  return environmentVariables.length > 0 ? environmentVariables : undefined;
+  accountId: string,
+) => {
+  const env: Record<string, string | Redacted.Redacted<string>> = {};
+  for (const [name, value] of Object.entries(props.env ?? {})) {
+    if (Output.isOutput(value) || value === undefined) {
+      continue;
+    }
+    env[name] = value;
+  }
+  for (const value of props.environmentVariables ?? []) {
+    env[value.name] = value.value;
+  }
+  if (!env.ALCHEMY_CLOUDFLARE_ACCOUNT_ID) {
+    env.ALCHEMY_CLOUDFLARE_ACCOUNT_ID = accountId;
+  }
+  return env;
 };
 
 /**
@@ -290,3 +284,75 @@ await Effect.runPromise(serverEffect).catch((err) => {
 
   return { files, hash: bundleOutput.hash };
 });
+
+/**
+ * Bundle an Effect-native container `main` and materialize it (plus the
+ * generated Dockerfile) into a stable Docker build context directory, then
+ * return the paths + content hash of that context.
+ *
+ * This is the local-dev image shape (`ContainerImage.Build`) that
+ * `@distilled.cloud/cloudflare-runtime` consumes: it `docker build`s the
+ * `dockerfile` against the `context` directory. Shared between the local
+ * provider (which serves this context to the runtime as the `dev` image) and
+ * the live provider (which persists the same deterministic context path as
+ * `dev` so a subsequent `alchemy dev` run has an image to build even though the
+ * live deploy pushed to Cloudflare's registry instead).
+ *
+ * The context directory is deterministic for a given resource id, so live and
+ * local agree on the path. Callers that want to skip re-bundling on an
+ * unchanged resource should wrap this in {@link Artifacts.cached}.
+ */
+export const prepareContainerBuildContext = Effect.fn(function* (
+  id: string,
+  news: ContainerApplicationProps,
+) {
+  const { dotAlchemy } = yield* AlchemyContext;
+  const docker = yield* Docker;
+  const path = yield* Path.Path;
+
+  const main = news.main;
+  if (!main) {
+    return yield* Effect.die(
+      new Error("Container requires a `main` entrypoint."),
+    );
+  }
+  const runtime = news.runtime ?? "bun";
+  const context = yield* getStableContextDir(
+    process.cwd(),
+    dotAlchemy,
+    `${id}-container`,
+  );
+  const dockerfileContent = buildFinalDockerfile(
+    news.dockerfile,
+    runtime,
+    news.external,
+    news.autoInstallExternals,
+  );
+  const [bundle] = yield* Effect.all(
+    [
+      bundleContainerProgram({
+        id,
+        main,
+        runtime,
+        handler: news.handler,
+        isExternal: news.isExternal,
+        external: news.external,
+        outdir: context,
+      }),
+      docker.materialize({
+        context,
+        dockerfile: dockerfileContent,
+        files: [],
+      }),
+    ],
+    { concurrency: "unbounded" },
+  );
+  return {
+    context,
+    dockerfile: path.join(context, "Dockerfile"),
+    hash: yield* sha256Object({
+      bundle: bundle.hash,
+      dockerfileContent,
+    }),
+  };
+});

package/src/Cloudflare/Containers/ContainerProvider.ts

@@ -2,6 +2,7 @@ import * as Containers from "@distilled.cloud/cloudflare/containers";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
+import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
 import { Unowned } from "../../AdoptPolicy.ts";
 import { AlchemyContext } from "../../AlchemyContext.ts";
@@ -24,7 +25,7 @@ import {
   buildFinalDockerfile,
   bundleContainerProgram,
   createContainerApplicationName,
-  foldEnvIntoEnvironmentVariables,
+  makeContainerEnv,
 } from "./ContainerBundle.ts";
 import { ContainerPlatform } from "./ContainerPlatform.ts";
 
@@ -105,8 +106,8 @@ export const LiveContainerProvider = () =>
 
       const desiredConfiguration = (
         props: ContainerApplicationProps,
+        env: Record<string, string | Redacted.Redacted<string>>,
         imageRef: string,
-        accountId: string,
       ) =>
         normalizeNulls({
           image: imageRef,
@@ -127,10 +128,10 @@ export const LiveContainerProvider = () =>
           vcpu: props.vcpu,
           memory: props.memory,
           disk: props.disk,
-          environmentVariables: foldEnvIntoEnvironmentVariables(
-            props,
-            accountId,
-          ),
+          environmentVariables: Object.entries(env).map(([name, value]) => ({
+            name,
+            value: Redacted.isRedacted(value) ? Redacted.value(value) : value,
+          })),
           labels: props.labels,
           network: props.network,
           command: props.command,
@@ -165,6 +166,7 @@ export const LiveContainerProvider = () =>
       const computeImage = Effect.fn(function* (
         id: string,
         props: ContainerApplicationProps,
+        env: Record<string, string | Redacted.Redacted<string>>,
       ) {
         const { accountId } = yield* yield* CloudflareEnvironment;
         const name = yield* createApplicationName(id, props.name);
@@ -195,10 +197,26 @@ export const LiveContainerProvider = () =>
             bundleHash,
             dockerfile: finalDockerfile,
           })).slice(0, 16);
+          // The dev image is the deterministic build-context directory that
+          // `buildAndPushImage` materializes into (and that the local provider
+          // regenerates on the next `alchemy dev`). We persist the path here so
+          // a dev run after a live deploy has an image to `docker build` — the
+          // live deploy pushes to Cloudflare's registry, which the local
+          // `workerd` runtime can't pull. See `prepareContainerBuildContext`.
+          const contextDir = yield* getStableContextDir(
+            process.cwd(),
+            dotAlchemy,
+            `${id}-container`,
+          );
           return {
             build: { kind: "effectful" as const, files },
             imageRef: makeRef(imageHash),
             imageHash,
+            dev: {
+              context: path.relative(process.cwd(), contextDir),
+              dockerfile: "Dockerfile",
+              env,
+            },
           };
         }
 
@@ -212,6 +230,8 @@ export const LiveContainerProvider = () =>
             build: { kind: "remote" as const, image: props.image },
             imageRef: makeRef(imageHash),
             imageHash,
+            // The local runtime pulls this image directly (no build context).
+            dev: { imageUri: props.image, env },
           };
         }
 
@@ -230,6 +250,13 @@ export const LiveContainerProvider = () =>
           build: { kind: "external" as const, context, dockerfile },
           imageRef: makeRef(imageHash),
           imageHash,
+          // The local runtime builds the user's Dockerfile against the same
+          // (already real-path'd) context directory.
+          dev: {
+            context: path.relative(process.cwd(), context),
+            dockerfile: path.relative(context, dockerfile),
+            env,
+          },
         };
       });
 
@@ -531,8 +558,13 @@ export const LiveContainerProvider = () =>
         yield* Effect.logInfo(
           `Cloudflare Container update: preparing ${existing.applicationName}`,
         );
-        const { build, imageRef, imageHash } = yield* computeImage(id, news);
-        const configuration = desiredConfiguration(news, imageRef, accountId);
+        const env = makeContainerEnv(news, accountId);
+        const { build, imageRef, imageHash, dev } = yield* computeImage(
+          id,
+          news,
+          env,
+        );
+        const configuration = desiredConfiguration(news, env, imageRef);
 
         if (imageHash !== existing.hash?.image) {
           yield* buildAndPushImage(id, news, build, imageRef, session);
@@ -589,7 +621,7 @@ export const LiveContainerProvider = () =>
             rollout: news.rollout,
           });
         }
-        return { ...updated, configuration, hash: { image: imageHash } };
+        return { ...updated, configuration, hash: { image: imageHash }, dev };
       });
 
       const getDurableObjects = (
@@ -664,8 +696,12 @@ export const LiveContainerProvider = () =>
             return { action: "update", stables: ["accountId"] } as const;
           }
 
-          const { imageHash } = yield* computeImage(id, news);
-          if (imageHash !== output.hash?.image) {
+          const { imageHash, dev } = yield* computeImage(
+            id,
+            news,
+            makeContainerEnv(news, accountId),
+          );
+          if (imageHash !== output.hash?.image || !deepEqual(dev, output.dev)) {
             return { action: "update" } as const;
           }
         }),
@@ -676,8 +712,13 @@ export const LiveContainerProvider = () =>
           );
 
           const { accountId } = yield* yield* CloudflareEnvironment;
-          const { build, imageRef, imageHash } = yield* computeImage(id, news);
-          const configuration = desiredConfiguration(news, imageRef, accountId);
+          const env = makeContainerEnv(news, accountId);
+          const { build, imageRef, imageHash, dev } = yield* computeImage(
+            id,
+            news,
+            env,
+          );
+          const configuration = desiredConfiguration(news, env, imageRef);
           yield* buildAndPushImage(id, news, build, imageRef, session);
 
           // Precreate intentionally omits the Durable Object attachment so the
@@ -699,6 +740,7 @@ export const LiveContainerProvider = () =>
           return {
             ...("applicationId" in result ? result : toAttributes(result)),
             hash: { image: imageHash },
+            dev,
           };
         }),
         reconcile: Effect.fn(function* ({
@@ -714,8 +756,13 @@ export const LiveContainerProvider = () =>
           );
           const durableObjects = yield* getDurableObjects(bindings);
           const { accountId } = yield* yield* CloudflareEnvironment;
-          const { build, imageRef, imageHash } = yield* computeImage(id, news);
-          const configuration = desiredConfiguration(news, imageRef, accountId);
+          const env = makeContainerEnv(news, accountId);
+          const { build, imageRef, imageHash, dev } = yield* computeImage(
+            id,
+            news,
+            env,
+          );
+          const configuration = desiredConfiguration(news, env, imageRef);
 
           // Observe — re-fetch the cached application to confirm it still
           // exists. Cloudflare reports a deleted container application as
@@ -815,6 +862,7 @@ export const LiveContainerProvider = () =>
             return {
               ...("applicationId" in result ? result : toAttributes(result)),
               hash: { image: imageHash },
+              dev,
             };
           }
 
@@ -849,6 +897,7 @@ export const LiveContainerProvider = () =>
           return {
             ...("applicationId" in result ? result : toAttributes(result)),
             hash: { image: imageHash },
+            dev,
           };
         }),
         delete: Effect.fn(function* ({ output }) {
@@ -881,6 +930,10 @@ export const LiveContainerProvider = () =>
               return {
                 ...toAttributes(existing),
                 hash: output?.hash,
+                // The dev image is a local build-context reference that the
+                // API can't return — preserve the persisted one so a refresh
+                // doesn't wipe it (which would break a later `alchemy dev`).
+                dev: output?.dev,
               };
             });
 
@@ -902,6 +955,7 @@ export const LiveContainerProvider = () =>
               Effect.map((app) => ({
                 ...toAttributes(app),
                 hash: output.hash,
+                dev: output.dev,
               })),
               Effect.catchTag("ContainerApplicationNotFound", () =>
                 readByName(output.applicationName),
@@ -997,10 +1051,10 @@ const resolveDurableObjectApplicationRecovery = ({
 // uncapped `Schedule.exponential(150)` reaches a ~76s single delay by the 10th
 // retry (~150s total), which both blows test budgets and needlessly stalls the
 // update→create fallback when the target is genuinely gone.
-const containerApplicationReadinessSchedule = Schedule.exponential(150).pipe(
-  Schedule.either(Schedule.spaced("3 seconds")),
-  Schedule.both(Schedule.recurs(10)),
-);
+const containerApplicationReadinessSchedule = Schedule.max([
+  Schedule.min([Schedule.exponential(150), Schedule.spaced("3 seconds")]),
+  Schedule.recurs(10),
+]);
 
 const isContainerApplicationNotFound = (
   error: unknown,