alchemy 2.0.0-beta.61 → 2.0.0-beta.63

package/src/Cloudflare/Access/Application.ts

@@ -292,10 +292,13 @@ const retryTransientAccessError = <A, E extends { _tag: string }, R>(
     Effect.retry({
       while: (e) =>
         e._tag === "AccessReferenceNotFound" || e._tag === "Forbidden",
-      schedule: Schedule.exponential("1 second", 1.5).pipe(
-        Schedule.either(Schedule.spaced("5 seconds")),
-        Schedule.both(Schedule.recurs(12)),
-      ),
+      schedule: Schedule.max([
+        Schedule.min([
+          Schedule.exponential("1 second", 1.5),
+          Schedule.spaced("5 seconds"),
+        ]),
+        Schedule.recurs(12),
+      ]),
     }),
   );
 

package/src/Cloudflare/Alerting/Silence.ts

@@ -250,9 +250,10 @@ export const SilenceProvider = () =>
           ),
           Effect.retry({
             while: (e) => e._tag === "SilencePending",
-            schedule: Schedule.exponential("500 millis").pipe(
-              Schedule.both(Schedule.recurs(8)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential("500 millis"),
+              Schedule.recurs(8),
+            ]),
           }),
         );
         return toSilenceAttributes(observed, accountId);

package/src/Cloudflare/Alerting/Webhook.ts

@@ -211,9 +211,10 @@ export const NotificationWebhookProvider = () =>
           .pipe(
             Effect.retry({
               while: (e) => e._tag === "WebhookTestFailed",
-              schedule: Schedule.exponential("1 second").pipe(
-                Schedule.both(Schedule.recurs(5)),
-              ),
+              schedule: Schedule.max([
+                Schedule.exponential("1 second"),
+                Schedule.recurs(5),
+              ]),
             }),
           );
         if (!created.id) {
@@ -247,9 +248,10 @@ export const NotificationWebhookProvider = () =>
           .pipe(
             Effect.retry({
               while: (e) => e._tag === "WebhookTestFailed",
-              schedule: Schedule.exponential("1 second").pipe(
-                Schedule.both(Schedule.recurs(5)),
-              ),
+              schedule: Schedule.max([
+                Schedule.exponential("1 second"),
+                Schedule.recurs(5),
+              ]),
             }),
           );
         const fresh = yield* observeWebhook(accountId, observed.id);

package/src/Cloudflare/Auth/AuthProvider.ts

@@ -21,6 +21,7 @@ import {
   retryOnce,
 } from "../../Auth/Env.ts";
 import * as Clank from "../../Util/Clank.ts";
+import { CREDENTIALS_FILE as STATE_STORE_CREDENTIALS_FILE } from "../StateStore/CredentialsFile.ts";
 import * as OAuthClient from "./OAuthClient.ts";
 
 const options: Array<{
@@ -343,10 +344,18 @@ export const CloudflareAuth = AuthProviderLayer<
 
     const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
       Effect.gen(function* () {
-        if (ctx.ci) {
-          return { method: "env" as const };
-        }
-        return yield* configureInteractive(profileName);
+        const config = ctx.ci
+          ? { method: "env" as const }
+          : yield* configureInteractive(profileName);
+        // Re-configuring auth may point this profile at a different
+        // Cloudflare account. The cached state-store credentials
+        // (`~/.alchemy/credentials/{profile}/cloudflare-state-store.json`)
+        // are minted per-account, so drop them here; the next deploy
+        // re-derives them against the freshly-configured account.
+        yield* store
+          .delete(profileName, STATE_STORE_CREDENTIALS_FILE)
+          .pipe(Effect.ignore);
+        return config;
       }).pipe(
         Effect.mapError(
           (e) =>
@@ -407,7 +416,7 @@ export const CloudflareAuth = AuthProviderLayer<
                   ? Effect.fail(
                       new AuthError({
                         message:
-                          "Cloudflare stored credentials not found. Run: alchemy-effect login --configure",
+                          "Cloudflare stored credentials not found. Run: alchemy login --configure",
                       }),
                     )
                   : Effect.gen(function* () {
@@ -491,40 +500,50 @@ export const CloudflareAuth = AuthProviderLayer<
       );
 
     const logout = (profileName: string, config: CloudflareAuthConfig) =>
-      Match.value(config).pipe(
-        Match.when({ method: "env" }, () => Effect.void),
-        Match.when({ method: "stored" }, () =>
-          store
-            .delete(profileName, "cf-stored")
-            .pipe(
-              Effect.andThen(
-                Clank.success("Cloudflare: stored credentials removed"),
+      Match.value(config)
+        .pipe(
+          Match.when({ method: "env" }, () => Effect.void),
+          Match.when({ method: "stored" }, () =>
+            store
+              .delete(profileName, "cf-stored")
+              .pipe(
+                Effect.andThen(
+                  Clank.success("Cloudflare: stored credentials removed"),
+                ),
               ),
-            ),
-        ),
-        Match.when({ method: "oauth" }, () =>
-          store
-            .read<OAuthClient.OAuthCredentials>(profileName, "cf-oauth")
-            .pipe(
-              Effect.tap((creds) =>
-                creds?.type === "oauth"
-                  ? OAuthClient.revoke(creds).pipe(
-                      Effect.catchTag("OAuthError", (err) =>
-                        Clank.warn(
-                          `Cloudflare: could not revoke OAuth token: ${err.errorDescription}`,
+          ),
+          Match.when({ method: "oauth" }, () =>
+            store
+              .read<OAuthClient.OAuthCredentials>(profileName, "cf-oauth")
+              .pipe(
+                Effect.tap((creds) =>
+                  creds?.type === "oauth"
+                    ? OAuthClient.revoke(creds).pipe(
+                        Effect.catchTag("OAuthError", (err) =>
+                          Clank.warn(
+                            `Cloudflare: could not revoke OAuth token: ${err.errorDescription}`,
+                          ),
                         ),
-                      ),
-                    )
-                  : Effect.void,
-              ),
-              Effect.andThen(store.delete(profileName, "cf-oauth")),
-              Effect.andThen(
-                Clank.success("Cloudflare: OAuth credentials removed."),
+                      )
+                    : Effect.void,
+                ),
+                Effect.andThen(store.delete(profileName, "cf-oauth")),
+                Effect.andThen(
+                  Clank.success("Cloudflare: OAuth credentials removed."),
+                ),
               ),
-            ),
-        ),
-        Match.exhaustive,
-      );
+          ),
+          Match.exhaustive,
+        )
+        // The cached state-store credentials are derived from the account we
+        // just logged out of, so drop them regardless of auth method.
+        .pipe(
+          Effect.andThen(
+            store
+              .delete(profileName, STATE_STORE_CREDENTIALS_FILE)
+              .pipe(Effect.ignore),
+          ),
+        );
 
     const login = (profileName: string, config: CloudflareAuthConfig) =>
       Match.value(config)
@@ -619,9 +638,6 @@ export const CloudflareAuth = AuthProviderLayer<
             Match.exhaustive,
           );
         }),
-        Effect.catch((e) =>
-          Console.error(`  Failed to retrieve credentials: ${e}`),
-        ),
       );
 
     return {

package/src/Cloudflare/Auth/OAuthClient.ts

@@ -2,6 +2,7 @@ import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import crypto from "node:crypto";
 import http from "node:http";
+import { AUTH_ERROR_URL, AUTH_SUCCESS_URL } from "../../Auth/AuthProvider.ts";
 import {
   OAUTH_CLIENT_ID,
   OAUTH_ENDPOINTS,
@@ -224,7 +225,7 @@ function callbackPromise(
       const error = url.searchParams.get("error");
       const errorDescription = url.searchParams.get("error_description");
       if (error) {
-        res.writeHead(302, { Location: "https://alchemy.run/auth/error" });
+        res.writeHead(302, { Location: AUTH_ERROR_URL });
         res.end();
         cleanup();
         reject(
@@ -239,7 +240,7 @@ function callbackPromise(
       const code = url.searchParams.get("code");
       const state = url.searchParams.get("state");
       if (!code || !state) {
-        res.writeHead(302, { Location: "https://alchemy.run/auth/error" });
+        res.writeHead(302, { Location: AUTH_ERROR_URL });
         res.end();
         cleanup();
         reject(
@@ -252,7 +253,7 @@ function callbackPromise(
       }
 
       if (state !== authorization.state) {
-        res.writeHead(302, { Location: "https://alchemy.run/auth/error" });
+        res.writeHead(302, { Location: AUTH_ERROR_URL });
         res.end();
         cleanup();
         reject(
@@ -268,14 +269,12 @@ function callbackPromise(
         const credentials = await Effect.runPromise(
           exchange(code, authorization.verifier),
         );
-        res.writeHead(302, {
-          Location: "https://alchemy.run/auth/success",
-        });
+        res.writeHead(302, { Location: AUTH_SUCCESS_URL });
         res.end();
         cleanup();
         resolve(credentials);
       } catch (err) {
-        res.writeHead(302, { Location: "https://alchemy.run/auth/error" });
+        res.writeHead(302, { Location: AUTH_ERROR_URL });
         res.end();
         cleanup();
         reject(err);

package/src/Cloudflare/Cache/RegionalTieredCache.ts

@@ -114,10 +114,13 @@ const desiredValue = (props: RegionalTieredCacheProps): "on" | "off" =>
 // Cloudflare can transiently fail to authenticate a valid token, surfacing as
 // `Unauthorized`/`Forbidden`. Retry with exponential backoff capped at 5s,
 // bounded to ~8 attempts so a persistently-failing call still fails fast.
-const transientAuthRetrySchedule = Schedule.exponential("500 millis").pipe(
-  Schedule.either(Schedule.spaced("5 seconds")),
-  Schedule.both(Schedule.recurs(8)),
-);
+const transientAuthRetrySchedule = Schedule.max([
+  Schedule.min([
+    Schedule.exponential("500 millis"),
+    Schedule.spaced("5 seconds"),
+  ]),
+  Schedule.recurs(8),
+]);
 
 export const RegionalTieredCacheProvider = () =>
   Provider.succeed(RegionalTieredCache, {

package/src/Cloudflare/Containers/ContainerApplication.ts

@@ -1,5 +1,5 @@
-import type { ContainerImage } from "@distilled.cloud/cloudflare-runtime/Docker";
 import * as Containers from "@distilled.cloud/cloudflare/containers";
+import * as Redacted from "effect/Redacted";
 import * as ProviderLayer from "../../Local/ProviderLayer.ts";
 import {
   type Main,
@@ -610,7 +610,27 @@ export interface ContainerApplication<Shape = unknown> extends Resource<
 // imported by Worker.ts). The provider helpers that previously lived here
 // (resolveDurableObjectApplicationRecovery, the readiness schedule/retry, etc.)
 // were extracted to ContainerProvider.ts on this branch.
-export type DevContainerImage = ContainerImage;
+export type DevContainerImage =
+  | DevContainerImage.Build
+  | DevContainerImage.Pull
+  | DevContainerImage.Ref;
+
+export declare namespace DevContainerImage {
+  interface Base {
+    readonly env?: Record<string, string | Redacted.Redacted<string>>;
+  }
+  export interface Build extends Base {
+    readonly dockerfile: string;
+    readonly context?: string;
+    readonly buildArgs?: Record<string, string>;
+  }
+  export interface Pull extends Base {
+    readonly imageUri: string;
+  }
+  export interface Ref extends Base {
+    readonly tag: string;
+  }
+}
 
 export const ContainerProvider = () =>
   ProviderLayer.select({

package/src/Cloudflare/Containers/ContainerBundle.ts

@@ -1,16 +1,21 @@
 import * as Effect from "effect/Effect";
+import * as Path from "effect/Path";
 import * as Redacted from "effect/Redacted";
 import type * as rolldown from "rolldown";
+import { AlchemyContext } from "../../AlchemyContext.ts";
 import * as Bundle from "../../Bundle/Bundle.ts";
-import { findCwdForBundle, resolveMainPath } from "../../Bundle/TempRoot.ts";
+import {
+  findCwdForBundle,
+  getStableContextDir,
+  resolveMainPath,
+} from "../../Bundle/TempRoot.ts";
+import { Docker } from "../../Docker/Docker.ts";
 import * as Output from "../../Output.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import { Self } from "../../Self.ts";
 import { Stack } from "../../Stack.ts";
-import type {
-  ContainerApplication,
-  ContainerApplicationProps,
-} from "./ContainerApplication.ts";
+import { sha256Object } from "../../Util/sha256.ts";
+import type { ContainerApplicationProps } from "./ContainerApplication.ts";
 
 /**
  * Fold the runtime-context `env` map (populated by `Binding.Service`s and
@@ -36,35 +41,24 @@ import type {
  *
  * Explicit `props.environmentVariables` win on a name collision.
  */
-export const foldEnvIntoEnvironmentVariables = (
+export const makeContainerEnv = (
   props: ContainerApplicationProps,
-  accountId?: string,
-): ContainerApplication.EnvironmentVariable[] | undefined => {
-  const explicitNames = new Set(
-    (props.environmentVariables ?? []).map((e) => e.name),
-  );
-  const environmentVariables: ContainerApplication.EnvironmentVariable[] = [
-    ...(props.environmentVariables ?? []),
-    ...(accountId !== undefined &&
-    !explicitNames.has("ALCHEMY_CLOUDFLARE_ACCOUNT_ID")
-      ? [{ name: "ALCHEMY_CLOUDFLARE_ACCOUNT_ID", value: accountId }]
-      : []),
-    ...Object.entries(props.env ?? {})
-      .filter(
-        ([name, value]) =>
-          value !== undefined &&
-          !Output.isOutput(value) &&
-          !explicitNames.has(name) &&
-          name !== "ALCHEMY_CLOUDFLARE_ACCOUNT_ID",
-      )
-      .map(([name, value]) => ({
-        name,
-        value: Redacted.isRedacted(value)
-          ? Redacted.value(value as Redacted.Redacted<string>)
-          : (value as string),
-      })),
-  ];
-  return environmentVariables.length > 0 ? environmentVariables : undefined;
+  accountId: string,
+) => {
+  const env: Record<string, string | Redacted.Redacted<string>> = {};
+  for (const [name, value] of Object.entries(props.env ?? {})) {
+    if (Output.isOutput(value) || value === undefined) {
+      continue;
+    }
+    env[name] = value;
+  }
+  for (const value of props.environmentVariables ?? []) {
+    env[value.name] = value.value;
+  }
+  if (!env.ALCHEMY_CLOUDFLARE_ACCOUNT_ID) {
+    env.ALCHEMY_CLOUDFLARE_ACCOUNT_ID = accountId;
+  }
+  return env;
 };
 
 /**
@@ -205,8 +199,9 @@ const HttpServer = NodeHttpServer;
 `
 }
 import { Stack } from "alchemy/Stack";
-import { makeEntrypointLayer } from "alchemy/Runtime";
+import { makeEntrypointLayer, reifyBoundConfigProvider } from "alchemy/Runtime";
 import { CloudflareEnvironment } from "alchemy/Cloudflare";
+import * as ConfigProvider from "effect/ConfigProvider";
 import * as Effect from "effect/Effect";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import * as Layer from "effect/Layer";
@@ -255,6 +250,15 @@ const serverEffect = tag.pipe(
         )
       ),
       Layer.provideMerge(platform),
+      Layer.provideMerge(
+        Layer.succeed(
+          ConfigProvider.ConfigProvider,
+          // Auto-bound \`Config\` values arrive in the env as
+          // \`{"_tag":"Redacted","value":...}\` markers; reify them so a
+          // \`Config\` re-read inside a handler decodes the raw source value.
+          reifyBoundConfigProvider(ConfigProvider.fromEnv(), process.env)
+        )
+      ),
       Layer.provideMerge(
         Layer.succeed(
           MinimumLogLevel,
@@ -290,3 +294,75 @@ await Effect.runPromise(serverEffect).catch((err) => {
 
   return { files, hash: bundleOutput.hash };
 });
+
+/**
+ * Bundle an Effect-native container `main` and materialize it (plus the
+ * generated Dockerfile) into a stable Docker build context directory, then
+ * return the paths + content hash of that context.
+ *
+ * This is the local-dev image shape (`ContainerImage.Build`) that
+ * `@distilled.cloud/cloudflare-runtime` consumes: it `docker build`s the
+ * `dockerfile` against the `context` directory. Shared between the local
+ * provider (which serves this context to the runtime as the `dev` image) and
+ * the live provider (which persists the same deterministic context path as
+ * `dev` so a subsequent `alchemy dev` run has an image to build even though the
+ * live deploy pushed to Cloudflare's registry instead).
+ *
+ * The context directory is deterministic for a given resource id, so live and
+ * local agree on the path. Callers that want to skip re-bundling on an
+ * unchanged resource should wrap this in {@link Artifacts.cached}.
+ */
+export const prepareContainerBuildContext = Effect.fn(function* (
+  id: string,
+  news: ContainerApplicationProps,
+) {
+  const { dotAlchemy } = yield* AlchemyContext;
+  const docker = yield* Docker;
+  const path = yield* Path.Path;
+
+  const main = news.main;
+  if (!main) {
+    return yield* Effect.die(
+      new Error("Container requires a `main` entrypoint."),
+    );
+  }
+  const runtime = news.runtime ?? "bun";
+  const context = yield* getStableContextDir(
+    process.cwd(),
+    dotAlchemy,
+    `${id}-container`,
+  );
+  const dockerfileContent = buildFinalDockerfile(
+    news.dockerfile,
+    runtime,
+    news.external,
+    news.autoInstallExternals,
+  );
+  const [bundle] = yield* Effect.all(
+    [
+      bundleContainerProgram({
+        id,
+        main,
+        runtime,
+        handler: news.handler,
+        isExternal: news.isExternal,
+        external: news.external,
+        outdir: context,
+      }),
+      docker.materialize({
+        context,
+        dockerfile: dockerfileContent,
+        files: [],
+      }),
+    ],
+    { concurrency: "unbounded" },
+  );
+  return {
+    context,
+    dockerfile: path.join(context, "Dockerfile"),
+    hash: yield* sha256Object({
+      bundle: bundle.hash,
+      dockerfileContent,
+    }),
+  };
+});

package/src/Cloudflare/Containers/ContainerPlatform.ts

@@ -1,11 +1,13 @@
-import * as Config from "effect/Config";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
-import * as Redacted from "effect/Redacted";
 import { HttpServer, type HttpEffect } from "../../Http.ts";
 import * as Output from "../../Output.ts";
 import { Platform } from "../../Platform.ts";
 import { serveRpc, type Rpc } from "../../Rpc.ts";
+import {
+  packEnvValueKeepRedacted,
+  unpackEnvValue,
+} from "../../RuntimeContext.ts";
 import * as Server from "../../Server/index.ts";
 import type { Fetcher } from "../Fetcher.ts";
 import { fromCloudflareFetcher, toCloudflareFetcher } from "../Fetcher.ts";
@@ -69,60 +71,20 @@ export const ContainerPlatform: Platform<
         set: (bindingId: string, output: Output.Output) =>
           Effect.sync(() => {
             const key = bindingId.replaceAll(/[^a-zA-Z0-9]/g, "_");
-            // Preserve `Redacted`-ness across the Output → env → Cloudflare
-            // boundary so the provider can deploy secrets through the
+            // `packEnvValueKeepRedacted` keeps the Redacted wrapper on the
+            // outside so the provider can deploy secrets through the
             // Secrets Store (referenced via `secrets`) instead of leaking
-            // them as plain `environmentVariables`. The JSON payload carries
-            // a `{_tag: "Redacted", …}` marker so the runtime `get` accessor
-            // can rebuild the wrapper after Cloudflare hands the value back
-            // as a plain env-var string. Mirrors `makeWorkerRuntimeContext`.
-            env[key] = output.pipe(
-              Output.map((value) =>
-                Redacted.isRedacted(value)
-                  ? Redacted.make(
-                      JSON.stringify({
-                        _tag: "Redacted",
-                        value: Redacted.value(value),
-                      }),
-                    )
-                  : JSON.stringify(value),
-              ),
-            );
+            // them as plain `environmentVariables`, while the inner marker
+            // lets the runtime `get` accessor rebuild the wrapper after
+            // Cloudflare hands the value back as a plain env-var string.
+            // Mirrors `makeWorkerRuntimeContext`.
+            env[key] = output.pipe(Output.map(packEnvValueKeepRedacted));
             return key;
           }),
         get: <T>(key: string) =>
-          Config.string(key).pipe(
-            Effect.flatMap((value) =>
-              Effect.try({
-                try: () => {
-                  const parsed = JSON.parse(value) as T;
-                  // The `set` path serializes Redacted values as
-                  // `{_tag: "Redacted", value: ...}`. After JSON.parse the
-                  // result is a plain object — detect the marker shape and
-                  // rebuild the Redacted wrapper. Plain values pass through.
-                  if (
-                    typeof parsed === "object" &&
-                    parsed !== null &&
-                    (parsed as { _tag?: unknown })._tag === "Redacted" &&
-                    "value" in parsed
-                  ) {
-                    return Redacted.make(
-                      (parsed as { value: unknown }).value,
-                    ) as T;
-                  }
-                  return parsed;
-                },
-                catch: (error) => error as Error,
-              }),
-            ),
-            Effect.catch((cause) =>
-              Effect.die(
-                new Error(`Failed to get environment variable: ${key}`, {
-                  cause,
-                }),
-              ),
-            ),
-          ),
+          // Read straight from `process.env` — see `unpackEnvValue` for why
+          // this must never resolve through `Config.string`.
+          Effect.sync(() => unpackEnvValue<T>(process.env[key]) as T),
         run: ((effect: Effect.Effect<void, never, any>) =>
           Effect.sync(() => {
             runners.push(effect);