alchemy 2.0.0-beta.61 → 2.0.0-beta.63

package/src/Cloudflare/Containers/ContainerProvider.ts

@@ -2,6 +2,7 @@ import * as Containers from "@distilled.cloud/cloudflare/containers";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
+import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
 import { Unowned } from "../../AdoptPolicy.ts";
 import { AlchemyContext } from "../../AlchemyContext.ts";
@@ -24,7 +25,7 @@ import {
   buildFinalDockerfile,
   bundleContainerProgram,
   createContainerApplicationName,
-  foldEnvIntoEnvironmentVariables,
+  makeContainerEnv,
 } from "./ContainerBundle.ts";
 import { ContainerPlatform } from "./ContainerPlatform.ts";
 
@@ -105,8 +106,8 @@ export const LiveContainerProvider = () =>
 
       const desiredConfiguration = (
         props: ContainerApplicationProps,
+        env: Record<string, string | Redacted.Redacted<string>>,
         imageRef: string,
-        accountId: string,
       ) =>
         normalizeNulls({
           image: imageRef,
@@ -127,10 +128,10 @@ export const LiveContainerProvider = () =>
           vcpu: props.vcpu,
           memory: props.memory,
           disk: props.disk,
-          environmentVariables: foldEnvIntoEnvironmentVariables(
-            props,
-            accountId,
-          ),
+          environmentVariables: Object.entries(env).map(([name, value]) => ({
+            name,
+            value: Redacted.isRedacted(value) ? Redacted.value(value) : value,
+          })),
           labels: props.labels,
           network: props.network,
           command: props.command,
@@ -165,6 +166,7 @@ export const LiveContainerProvider = () =>
       const computeImage = Effect.fn(function* (
         id: string,
         props: ContainerApplicationProps,
+        env: Record<string, string | Redacted.Redacted<string>>,
       ) {
         const { accountId } = yield* yield* CloudflareEnvironment;
         const name = yield* createApplicationName(id, props.name);
@@ -195,10 +197,26 @@ export const LiveContainerProvider = () =>
             bundleHash,
             dockerfile: finalDockerfile,
           })).slice(0, 16);
+          // The dev image is the deterministic build-context directory that
+          // `buildAndPushImage` materializes into (and that the local provider
+          // regenerates on the next `alchemy dev`). We persist the path here so
+          // a dev run after a live deploy has an image to `docker build` — the
+          // live deploy pushes to Cloudflare's registry, which the local
+          // `workerd` runtime can't pull. See `prepareContainerBuildContext`.
+          const contextDir = yield* getStableContextDir(
+            process.cwd(),
+            dotAlchemy,
+            `${id}-container`,
+          );
           return {
             build: { kind: "effectful" as const, files },
             imageRef: makeRef(imageHash),
             imageHash,
+            dev: {
+              context: path.relative(process.cwd(), contextDir),
+              dockerfile: "Dockerfile",
+              env,
+            },
           };
         }
 
@@ -212,6 +230,8 @@ export const LiveContainerProvider = () =>
             build: { kind: "remote" as const, image: props.image },
             imageRef: makeRef(imageHash),
             imageHash,
+            // The local runtime pulls this image directly (no build context).
+            dev: { imageUri: props.image, env },
           };
         }
 
@@ -230,6 +250,13 @@ export const LiveContainerProvider = () =>
           build: { kind: "external" as const, context, dockerfile },
           imageRef: makeRef(imageHash),
           imageHash,
+          // The local runtime builds the user's Dockerfile against the same
+          // (already real-path'd) context directory.
+          dev: {
+            context: path.relative(process.cwd(), context),
+            dockerfile: path.relative(context, dockerfile),
+            env,
+          },
         };
       });
 
@@ -531,8 +558,13 @@ export const LiveContainerProvider = () =>
         yield* Effect.logInfo(
           `Cloudflare Container update: preparing ${existing.applicationName}`,
         );
-        const { build, imageRef, imageHash } = yield* computeImage(id, news);
-        const configuration = desiredConfiguration(news, imageRef, accountId);
+        const env = makeContainerEnv(news, accountId);
+        const { build, imageRef, imageHash, dev } = yield* computeImage(
+          id,
+          news,
+          env,
+        );
+        const configuration = desiredConfiguration(news, env, imageRef);
 
         if (imageHash !== existing.hash?.image) {
           yield* buildAndPushImage(id, news, build, imageRef, session);
@@ -589,7 +621,7 @@ export const LiveContainerProvider = () =>
             rollout: news.rollout,
           });
         }
-        return { ...updated, configuration, hash: { image: imageHash } };
+        return { ...updated, configuration, hash: { image: imageHash }, dev };
       });
 
       const getDurableObjects = (
@@ -664,8 +696,12 @@ export const LiveContainerProvider = () =>
             return { action: "update", stables: ["accountId"] } as const;
           }
 
-          const { imageHash } = yield* computeImage(id, news);
-          if (imageHash !== output.hash?.image) {
+          const { imageHash, dev } = yield* computeImage(
+            id,
+            news,
+            makeContainerEnv(news, accountId),
+          );
+          if (imageHash !== output.hash?.image || !deepEqual(dev, output.dev)) {
             return { action: "update" } as const;
           }
         }),
@@ -676,8 +712,13 @@ export const LiveContainerProvider = () =>
           );
 
           const { accountId } = yield* yield* CloudflareEnvironment;
-          const { build, imageRef, imageHash } = yield* computeImage(id, news);
-          const configuration = desiredConfiguration(news, imageRef, accountId);
+          const env = makeContainerEnv(news, accountId);
+          const { build, imageRef, imageHash, dev } = yield* computeImage(
+            id,
+            news,
+            env,
+          );
+          const configuration = desiredConfiguration(news, env, imageRef);
           yield* buildAndPushImage(id, news, build, imageRef, session);
 
           // Precreate intentionally omits the Durable Object attachment so the
@@ -699,6 +740,7 @@ export const LiveContainerProvider = () =>
           return {
             ...("applicationId" in result ? result : toAttributes(result)),
             hash: { image: imageHash },
+            dev,
           };
         }),
         reconcile: Effect.fn(function* ({
@@ -714,8 +756,13 @@ export const LiveContainerProvider = () =>
           );
           const durableObjects = yield* getDurableObjects(bindings);
           const { accountId } = yield* yield* CloudflareEnvironment;
-          const { build, imageRef, imageHash } = yield* computeImage(id, news);
-          const configuration = desiredConfiguration(news, imageRef, accountId);
+          const env = makeContainerEnv(news, accountId);
+          const { build, imageRef, imageHash, dev } = yield* computeImage(
+            id,
+            news,
+            env,
+          );
+          const configuration = desiredConfiguration(news, env, imageRef);
 
           // Observe — re-fetch the cached application to confirm it still
           // exists. Cloudflare reports a deleted container application as
@@ -815,6 +862,7 @@ export const LiveContainerProvider = () =>
             return {
               ...("applicationId" in result ? result : toAttributes(result)),
               hash: { image: imageHash },
+              dev,
             };
           }
 
@@ -849,6 +897,7 @@ export const LiveContainerProvider = () =>
           return {
             ...("applicationId" in result ? result : toAttributes(result)),
             hash: { image: imageHash },
+            dev,
           };
         }),
         delete: Effect.fn(function* ({ output }) {
@@ -881,6 +930,10 @@ export const LiveContainerProvider = () =>
               return {
                 ...toAttributes(existing),
                 hash: output?.hash,
+                // The dev image is a local build-context reference that the
+                // API can't return — preserve the persisted one so a refresh
+                // doesn't wipe it (which would break a later `alchemy dev`).
+                dev: output?.dev,
               };
             });
 
@@ -902,6 +955,7 @@ export const LiveContainerProvider = () =>
               Effect.map((app) => ({
                 ...toAttributes(app),
                 hash: output.hash,
+                dev: output.dev,
               })),
               Effect.catchTag("ContainerApplicationNotFound", () =>
                 readByName(output.applicationName),
@@ -997,10 +1051,10 @@ const resolveDurableObjectApplicationRecovery = ({
 // uncapped `Schedule.exponential(150)` reaches a ~76s single delay by the 10th
 // retry (~150s total), which both blows test budgets and needlessly stalls the
 // update→create fallback when the target is genuinely gone.
-const containerApplicationReadinessSchedule = Schedule.exponential(150).pipe(
-  Schedule.either(Schedule.spaced("3 seconds")),
-  Schedule.both(Schedule.recurs(10)),
-);
+const containerApplicationReadinessSchedule = Schedule.max([
+  Schedule.min([Schedule.exponential(150), Schedule.spaced("3 seconds")]),
+  Schedule.recurs(10),
+]);
 
 const isContainerApplicationNotFound = (
   error: unknown,

package/src/Cloudflare/Containers/LocalContainerProvider.ts

@@ -1,10 +1,10 @@
 import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
-import { AlchemyContext } from "../../AlchemyContext.ts";
+import * as Redacted from "effect/Redacted";
 import * as Artifacts from "../../Artifacts.ts";
-import { getStableContextDir } from "../../Bundle/TempRoot.ts";
+import { hashDirectory } from "../../Command/Memo.ts";
 import { isResolved } from "../../Diff.ts";
-import { Docker } from "../../Docker/Docker.ts";
 import * as RpcProvider from "../../Local/RpcProvider.ts";
 import { sha256Object } from "../../Util/sha256.ts";
 import { normalizeNulls } from "../../Util/stable.ts";
@@ -13,12 +13,12 @@ import { generateLocalId, LOCAL_ENTRY_URL } from "../LocalRuntime.ts";
 import type {
   ContainerApplication,
   ContainerApplicationProps,
+  DevContainerImage,
 } from "./ContainerApplication.ts";
 import {
-  buildFinalDockerfile,
-  bundleContainerProgram,
   createContainerApplicationName,
-  foldEnvIntoEnvironmentVariables,
+  makeContainerEnv,
+  prepareContainerBuildContext,
 } from "./ContainerBundle.ts";
 import { ContainerPlatform } from "./ContainerPlatform.ts";
 
@@ -26,9 +26,10 @@ import { ContainerPlatform } from "./ContainerPlatform.ts";
  * Local (dev) provider for Cloudflare Container applications.
  *
  * The Docker build/run is owned by `@distilled.cloud/cloudflare-runtime`; this
- * provider's only job is to bundle the container program once and materialize
- * it into a stable Docker build context, then surface that context as a
- * `dev: ContainerImage.Build` output so the runtime can `docker build` it.
+ * provider's only job is to resolve the `dev` image the runtime should use —
+ * a build context to `docker build` (Effect-native `main` or a user-supplied
+ * Dockerfile) or a remote image to `docker pull` — mirroring the three image
+ * variants of the live provider's `computeImage`.
  *
  * Everything else on the attributes is a placeholder: the real
  * `applicationId`/`configuration`/etc. only exist once the live provider
@@ -41,68 +42,72 @@ export const LocalContainerProvider = () =>
     ContainerPlatform,
     LOCAL_ENTRY_URL,
     Effect.gen(function* () {
-      const { dotAlchemy } = yield* AlchemyContext;
-      const docker = yield* Docker;
+      const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
 
-      // Bundle the container entrypoint and write it (plus the generated
-      // Dockerfile) into a stable build context directory. `Docker.build` in
-      // cloudflare-runtime reads `dockerfile` as a file path and uses
-      // `context` as the build context, so we point `dev` at both.
-      const prepareImage = Effect.fn(function* (
-        id: string,
-        news: ContainerApplicationProps,
-      ) {
-        const main = news.main;
-        if (!main) {
-          return yield* Effect.die(
-            new Error("Container requires a `main` entrypoint."),
-          );
-        }
-        const runtime = news.runtime ?? "bun";
-        const context = yield* getStableContextDir(
-          process.cwd(),
-          dotAlchemy,
-          `${id}-container`,
-        );
-        const dockerfileContent = buildFinalDockerfile(
-          news.dockerfile,
-          runtime,
-          news.external,
-          news.autoInstallExternals,
-        );
-        const [bundle] = yield* Effect.all(
-          [
-            bundleContainerProgram({
-              id,
-              main,
-              runtime,
-              handler: news.handler,
-              isExternal: news.isExternal,
-              external: news.external,
-              outdir: context,
-            }),
-            docker.materialize({
-              context: context,
+      // Resolve the `dev` image plus a content hash for change detection.
+      // Cached per run (`Artifacts.cached`, keyed by resource id) so repeated
+      // diffs/reconciles in a single dev session don't re-bundle or re-hash.
+      //
+      // IMPORTANT: the cached result must stay env-free. The cache is warmed
+      // by `precreate`, which runs against unresolved props — binding-derived
+      // env values (e.g. an ApiToken's value/accountId) are still unresolved
+      // `Output`s there and get skipped. Caching env here would freeze that
+      // incomplete env and start the container without its bindings;
+      // `makeAttributes` attaches the freshly-computed env instead.
+      const prepareImage = (id: string, news: ContainerApplicationProps) =>
+        Effect.gen(function* () {
+          // Variant 1 — Effect-native program. Bundle `main` and write it
+          // (plus the generated Dockerfile) into a stable build context
+          // directory. `Docker.build` in cloudflare-runtime reads `dockerfile`
+          // as a file path and uses `context` as the build context, so we
+          // point `dev` at both. The build-context materialization is shared
+          // with the live provider (see `prepareContainerBuildContext`).
+          if (news.main) {
+            const { context, dockerfile, hash } =
+              yield* prepareContainerBuildContext(id, news);
+            return {
+              dev: {
+                context: path.relative(process.cwd(), context),
+                dockerfile: path.relative(context, dockerfile),
+              } as DevContainerImage,
+              hash,
+            };
+          }
+
+          // Variant 2 — pre-built remote image. The runtime pulls it
+          // directly; there is nothing to build.
+          if (news.image) {
+            return {
+              dev: { imageUri: news.image } as DevContainerImage,
+              hash: yield* sha256Object({ image: news.image }),
+            };
+          }
+
+          // Variant 3 — user-supplied Dockerfile + build context directory.
+          // The runtime builds the user's Dockerfile against the (real-path'd)
+          // context, exactly like the live provider's `external` variant.
+          const context = yield* fs.realPath(news.context ?? ".");
+          const dockerfile = news.dockerfile
+            ? yield* fs.realPath(news.dockerfile)
+            : path.join(context, "Dockerfile");
+          const contextHash = yield* hashDirectory({ cwd: context });
+          const dockerfileContent = yield* fs.readFileString(dockerfile);
+          return {
+            dev: {
+              context: path.relative(process.cwd(), context),
+              dockerfile: path.relative(context, dockerfile),
+            } as DevContainerImage,
+            hash: yield* sha256Object({
+              contextHash,
               dockerfile: dockerfileContent,
-              files: [],
             }),
-          ],
-          { concurrency: "unbounded" },
-        );
-        return {
-          context,
-          dockerfile: path.join(context, "Dockerfile"),
-          hash: yield* sha256Object({
-            bundle: bundle.hash,
-            dockerfileContent,
-          }),
-        };
-      }, Artifacts.cached("container-image"));
+          };
+        }).pipe(Artifacts.cached(`container-image:${id}`));
 
       const placeholderConfiguration = (
         props: ContainerApplicationProps,
-        accountId: string,
+        env: Record<string, string | Redacted.Redacted<string>>,
       ) =>
         normalizeNulls({
           image: "local",
@@ -113,10 +118,10 @@ export const LocalContainerProvider = () =>
           vcpu: props.vcpu,
           memory: props.memory,
           disk: props.disk,
-          environmentVariables: foldEnvIntoEnvironmentVariables(
-            props,
-            accountId,
-          ),
+          environmentVariables: Object.entries(env).map(([name, value]) => ({
+            name,
+            value: Redacted.isRedacted(value) ? Redacted.value(value) : value,
+          })),
           labels: props.labels,
           network: props.network,
           command: props.command,
@@ -136,7 +141,8 @@ export const LocalContainerProvider = () =>
         output: ContainerApplication["Attributes"] | undefined;
       }) {
         const { accountId } = yield* yield* CloudflareEnvironment;
-        const { context, hash, dockerfile } = yield* prepareImage(id, news);
+        const env = makeContainerEnv(news, accountId);
+        const { dev, hash } = yield* prepareImage(id, news);
         return {
           applicationId: output?.applicationId ?? generateLocalId(),
           applicationName: yield* createContainerApplicationName(id, news.name),
@@ -146,11 +152,11 @@ export const LocalContainerProvider = () =>
           maxInstances: news.maxInstances ?? 1,
           constraints: news.constraints,
           affinities: news.affinities,
-          configuration: placeholderConfiguration(news, accountId),
+          configuration: placeholderConfiguration(news, env),
           durableObjects: undefined,
           createdAt: new Date().toISOString(),
           version: 1,
-          dev: { context, dockerfile },
+          dev: { ...dev, env },
           hash: { image: hash },
         } satisfies ContainerApplication["Attributes"];
       });
@@ -164,7 +170,7 @@ export const LocalContainerProvider = () =>
           if (!output) return { action: "update" };
           if (!isResolved(news)) return undefined;
           const input = yield* prepareImage(id, news);
-          return input.hash !== output.hash?.image
+          return input.hash !== output.hash?.image || !output.dev
             ? { action: "update" }
             : undefined;
         }),

package/src/Cloudflare/D1/QueryDatabaseHttpClient.ts

@@ -0,0 +1,176 @@
+import type * as runtime from "@cloudflare/workers-types";
+import * as d1 from "@distilled.cloud/cloudflare/d1";
+import * as Effect from "effect/Effect";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import type { Credentials } from "../Credentials.ts";
+import {
+  type QueryDatabaseClient,
+  PreparedStatement,
+} from "./QueryDatabase.ts";
+
+// Shared HTTP scaffolding for the D1 `QueryDatabase` binding. NOT re-exported
+// from `index.ts` — only the contract and the impl layers are public. A future
+// token-scoped `QueryDatabaseHttp` layer reuses this builder with an auth
+// minted from an `AccountApiToken`; `QueryDatabaseLocal` builds the auth from
+// the ambient current-credentials context.
+//
+// PreparedStatement (shared with QueryDatabaseBinding) drives a
+// `runtime.D1Database` whose executors return Promises. The shim below
+// implements the slice PreparedStatement uses (prepare/exec/batch + stmt
+// bind/all/first/run/raw) by running `d1.queryDatabase` over HTTP.
+
+/**
+ * Injectable auth shared by the Local (current-credentials) impl and a future
+ * Http (scoped-token) impl. `authorize` discharges the
+ * `Credentials | HttpClient` requirement of a distilled op; `accountId` is the
+ * Cloudflare account the ops run against.
+ */
+export interface D1Auth {
+  authorize: <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+  ) => Effect.Effect<A, E>;
+  accountId: string;
+}
+
+/**
+ * Build a {@link QueryDatabaseClient} over the D1 HTTP query API.
+ *
+ * `databaseId` is an Effect so the resolution stays deferred to each call —
+ * inside an Action it resolves through the apply-time RuntimeContext. The
+ * credentials are provided ONLY around the distilled op (via `auth.authorize`),
+ * never around the id accessor, matching the KV / Vectorize Local variants.
+ */
+export const makeHttpQueryDatabaseClient = (
+  auth: D1Auth,
+  databaseId: Effect.Effect<string>,
+): QueryDatabaseClient => {
+  const rawEff = Effect.map(databaseId, (id) => makeHttpD1Database(auth, id));
+
+  return {
+    raw: rawEff,
+    prepare: (query: string) => new PreparedStatement(query, [], rawEff),
+    exec: (query: string) =>
+      Effect.flatMap(rawEff, (raw) => Effect.promise(() => raw.exec(query))),
+    batch: <T = unknown>(statements: PreparedStatement[]) =>
+      Effect.flatMap(rawEff, (raw) =>
+        Effect.promise(() =>
+          raw.batch<T>(statements.map((s) => s._build(raw))),
+        ),
+      ),
+  } satisfies QueryDatabaseClient;
+};
+
+const runQuery = (
+  auth: D1Auth,
+  databaseId: string,
+  body:
+    | { sql: string; params?: unknown[] }
+    | { batch: { sql: string; params?: unknown[] }[] },
+): Promise<d1.QueryDatabaseResponse> =>
+  auth
+    .authorize(
+      d1.queryDatabase({
+        accountId: auth.accountId,
+        databaseId,
+        ...(body as any),
+      }),
+    )
+    .pipe(Effect.runPromise);
+
+const toResult = <T>(
+  r: d1.QueryDatabaseResponse["result"][number] | undefined,
+): runtime.D1Result<T> =>
+  ({
+    results: (r?.results ?? []) as T[],
+    success: r?.success ?? true,
+    meta: (r?.meta ?? {}) as any,
+  }) as runtime.D1Result<T>;
+
+/**
+ * Normalize a bound value the way the native D1 binding does before it reaches
+ * SQLite. Over the raw HTTP query API, unlike the Worker binding, values are
+ * bound verbatim — a JS `true` would arrive as the string `"true"`. Match the
+ * native semantics: booleans become integers (1/0) and binary becomes a byte
+ * array (BLOB). `null`, numbers, and strings pass through unchanged.
+ */
+const normalizeBind = (value: unknown): unknown => {
+  if (typeof value === "boolean") return value ? 1 : 0;
+  if (value instanceof ArrayBuffer) {
+    return Array.from(new Uint8Array(value));
+  }
+  if (ArrayBuffer.isView(value)) {
+    return Array.from(
+      new Uint8Array(value.buffer, value.byteOffset, value.byteLength),
+    );
+  }
+  return value;
+};
+
+const makeHttpD1Database = (
+  auth: D1Auth,
+  databaseId: string,
+): runtime.D1Database => {
+  const makeStatement = (
+    query: string,
+    binds: ReadonlyArray<unknown>,
+  ): runtime.D1PreparedStatement => {
+    const exec = async () => {
+      const res = await runQuery(auth, databaseId, {
+        sql: query,
+        params: binds.length ? binds.map(normalizeBind) : undefined,
+      });
+      return res.result[0];
+    };
+    return {
+      bind: (...values: unknown[]) => makeStatement(query, values),
+      first: (async (column?: string) => {
+        const first = (await exec())?.results?.[0] as
+          | Record<string, unknown>
+          | undefined;
+        if (first == null) return null;
+        return column !== undefined ? (first[column] ?? null) : first;
+      }) as runtime.D1PreparedStatement["first"],
+      all: (async () =>
+        toResult(await exec())) as runtime.D1PreparedStatement["all"],
+      run: (async () =>
+        toResult(await exec())) as runtime.D1PreparedStatement["run"],
+      raw: (async (options?: { columnNames?: boolean }) => {
+        const rows = ((await exec())?.results ?? []) as Record<
+          string,
+          unknown
+        >[];
+        const arrays = rows.map((row) => Object.values(row));
+        if (options?.columnNames && rows[0]) {
+          return [Object.keys(rows[0]), ...arrays];
+        }
+        return arrays;
+      }) as runtime.D1PreparedStatement["raw"],
+      // Carry query + params so `batch` can reconstruct the request.
+      __query: query,
+      __params: binds,
+    } as unknown as runtime.D1PreparedStatement;
+  };
+
+  return {
+    prepare: (query: string) => makeStatement(query, []),
+    exec: async (query: string) => {
+      const res = await runQuery(auth, databaseId, { sql: query });
+      const meta = res.result[res.result.length - 1]?.meta;
+      return {
+        count: res.result.length,
+        duration: meta?.duration ?? 0,
+      } as runtime.D1ExecResult;
+    },
+    batch: async <T = unknown>(statements: runtime.D1PreparedStatement[]) => {
+      const res = await runQuery(auth, databaseId, {
+        batch: statements.map((s) => ({
+          sql: (s as any).__query as string,
+          params: ((s as any).__params as unknown[]).length
+            ? ((s as any).__params as unknown[]).map(normalizeBind)
+            : undefined,
+        })),
+      });
+      return res.result.map((r) => toResult<T>(r));
+    },
+  } as unknown as runtime.D1Database;
+};