alchemy 2.0.0-beta.74 → 2.0.0-beta.76

package/src/Bundle/Bundle.ts

@@ -13,6 +13,32 @@ import {
 import { purePlugin, type PurePluginOptions } from "./PurePlugin.ts";
 import { rawPlugin } from "./RawPlugin.ts";
 
+/**
+ * `resolve.conditionNames` for a bundle that runs on bun / node.
+ *
+ * Rolldown's DEFAULT conditions are import-kind specific: `import` for
+ * `import` statements and `require` for `require()` calls. An explicit
+ * `conditionNames` list is applied as one set to BOTH kinds, and rolldown
+ * adds only the current kind on top. Listing `"import"` here therefore
+ * made every `require()` also match a package's `"import"` export — and
+ * `exports` maps are matched in the PACKAGE's key order, so for `pg-pool`
+ * (`{ import, require }`) a `require("pg-pool")` received the ESM namespace
+ * and `pg` died with `TypeError: The superclass is not a constructor`.
+ *
+ * So: never put `import` or `require` in these lists. Only the runtime
+ * condition and the kind-agnostic ones; rolldown supplies the kind.
+ */
+export const BUN_CONDITION_NAMES: readonly string[] = [
+  "bun",
+  "module",
+  "default",
+];
+export const NODE_CONDITION_NAMES: readonly string[] = [
+  "node",
+  "module",
+  "default",
+];
+
 /**
  * Rolldown is loaded lazily on first {@link build}/{@link watch} so that
  * merely importing alchemy — the CLI command tree, the Cloudflare provider
@@ -323,6 +349,13 @@ export const watch = (
 const ENTRY_PREFIX = "\0virtual:alchemy-entry:";
 // oxlint-disable-next-line no-control-regex
 const ENTRY_REGEX = /^\0virtual:alchemy-entry:/;
+/**
+ * Ids the `resolveId` hook looks at: the virtual entry ids themselves, plus
+ * bare package specifiers (not starting with `.`, `/` or `\0`) so an
+ * unresolvable import in a generated entry fails the build (below).
+ */
+// oxlint-disable-next-line no-control-regex
+const ENTRY_OR_BARE_REGEX = /^(?:\0virtual:alchemy-entry:|[^./\0])/;
 
 export const virtualEntryPlugin = Effect.gen(function* () {
   const path = yield* Path.Path;
@@ -358,9 +391,35 @@ export const virtualEntryPlugin = Effect.gen(function* () {
         },
       },
       resolveId: {
-        filter: { id: ENTRY_REGEX },
-        handler(id) {
-          return entries.has(id) ? { id } : null;
+        filter: { id: ENTRY_OR_BARE_REGEX },
+        async handler(id, importer) {
+          if (ENTRY_REGEX.test(id)) {
+            return entries.has(id) ? { id } : null;
+          }
+          // A bare import made BY a generated entry. Rolldown only WARNS on
+          // an unresolved import and leaves it external, which for a
+          // generated entry means the deployed process dies at boot with
+          // `Cannot find module` — the class of bug the shim design
+          // (alchemy/Runtime/Bootstrap/*) exists to prevent. Make it a build
+          // error with the cause spelled out instead. Externals resolve to
+          // `{ external: true }`, not null, so they pass through.
+          if (importer === undefined || !ENTRY_REGEX.test(importer)) {
+            return null;
+          }
+          const resolved = await this.resolve(id, importer, {
+            skipSelf: true,
+          });
+          if (resolved === null) {
+            const entry = entries.get(importer);
+            this.error(
+              new Error(
+                `The generated entry for ${entry} imports "${id}", which cannot be resolved from the project. ` +
+                  "A generated entry may only import `alchemy/*` (resolvable from any project that depends on alchemy) and the entry itself; " +
+                  "check that `alchemy` is installed in the project containing the entry.",
+              ),
+            );
+          }
+          return resolved;
         },
       },
       load: {

package/src/Cli/commands/deploy.ts

@@ -8,6 +8,7 @@ import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
 import * as Command from "effect/unstable/cli/Command";
 import * as Flag from "effect/unstable/cli/Flag";
+import * as GlobalFlag from "effect/unstable/cli/GlobalFlag";
 
 import { AdoptPolicy } from "../../AdoptPolicy.ts";
 import { AlchemyContext } from "../../AlchemyContext.ts";
@@ -18,6 +19,7 @@ import { withProfileOverride } from "../../Auth/Profile.ts";
 import * as CLI from "../../Cli/Cli.ts";
 import * as Plan from "../../Plan.ts";
 import { Stage } from "../../Stage.ts";
+import { isTelemetryDisabled } from "../../Telemetry/Attributes.ts";
 import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
 import { fileLogger } from "../../Util/FileLogger.ts";
 
@@ -81,6 +83,22 @@ const runStack = Effect.fn(function* ({
 }: ExecStackOptions) {
   const stackEffect = yield* importStack(main);
 
+  // `--log-level <x>` has to actually put log records on the user's
+  // terminal. With telemetry on (the default) `TelemetryLive` deliberately
+  // drops the console logger, so every record lands in `.alchemy/log/out`
+  // and nothing reaches stderr — which is how a stalled deploy produced ten
+  // minutes of `--log-level debug` and zero bytes of output (#1231). Re-add
+  // a console sink for that run only. With telemetry off the default
+  // console logger is still in the set, and adding a second would
+  // double-print every line.
+  const askedForLogs = Option.isSome(
+    Option.flatten(yield* Effect.serviceOption(GlobalFlag.LogLevel)),
+  );
+  const consoleSink =
+    askedForLogs && !(yield* isTelemetryDisabled)
+      ? [Logger.consolePretty()]
+      : [];
+
   const services = Layer.mergeAll(
     Layer.effect(
       AlchemyContext,
@@ -112,7 +130,9 @@ const runStack = Effect.fn(function* ({
     ConfigProvider.layer(
       withProfileOverride(yield* loadConfigProvider(envFile), profile),
     ),
-    Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
+    Logger.layer([fileLogger("out"), ...consoleSink], {
+      mergeWithExisting: true,
+    }),
     Layer.succeed(Stage, stage),
   );
 

package/src/Cli/commands/dev.ts

@@ -1,13 +1,14 @@
 import * as Floci from "@alchemy.run/floci";
 import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
 import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
 import * as Command from "effect/unstable/cli/Command";
 import * as ChildProcess from "effect/unstable/process/ChildProcess";
 import { fileURLToPath } from "node:url";
-import { transformTypesFlags } from "../../Util/Node.ts";
 import { SPAWNER_URL_ENV_KEY } from "../../Local/RpcProviderProxy.ts";
 import * as RpcSpawner from "../../Local/RpcSpawner.ts";
+import { transformTypesFlags } from "../../Util/Node.ts";
 import { envFile, force, profile, script, stage } from "./_shared.ts";
 import { ExecStackOptions } from "./deploy.ts";
 
@@ -18,10 +19,10 @@ import { ExecStackOptions } from "./deploy.ts";
  * reads its trusted certificates from `NODE_EXTRA_CA_CERTS` at runtime init, so
  * this must be present in the env of every spawned child (the exec worker, the
  * RPC sidecar, and the workerd instances they start). `ensureFloci` refreshes
- * the bundle at this stable path; never clobber a value the caller set.
+ * the bundle at this stable path (and sets the variable itself once written);
+ * never clobber a value the caller set, and don't point at a missing file —
+ * Node/Bun warn about it on every startup.
  */
-const NODE_EXTRA_CA_CERTS =
-  process.env.NODE_EXTRA_CA_CERTS ?? Floci.FLOCI_CA_PATH;
 
 export const devCommand = Command.make(
   "dev",
@@ -39,10 +40,14 @@ export const devCommand = Command.make(
         yes: true,
         dev: true,
       });
+
+      const fs = yield* FileSystem.FileSystem;
       // Set on THIS process too, so the RPC spawner's sidecars (and the workerd
       // they launch) inherit it — they are forked from here, not from the exec
       // child below.
-      process.env.NODE_EXTRA_CA_CERTS = NODE_EXTRA_CA_CERTS;
+      if (yield* fs.exists(Floci.FLOCI_CA_PATH)) {
+        process.env.NODE_EXTRA_CA_CERTS ??= Floci.FLOCI_CA_PATH;
+      }
       const spawner = yield* RpcSpawner.RpcSpawner;
       // We no longer force Bun in development because this prevents us from testing in Node.
       const command =
@@ -70,7 +75,9 @@ export const devCommand = Command.make(
         env: {
           ALCHEMY_EXEC_OPTIONS: JSON.stringify(options),
           ALCHEMY_DEV: "true",
-          NODE_EXTRA_CA_CERTS,
+          ...(process.env.NODE_EXTRA_CA_CERTS
+            ? { NODE_EXTRA_CA_CERTS: process.env.NODE_EXTRA_CA_CERTS }
+            : {}),
           [SPAWNER_URL_ENV_KEY]: spawner.url,
         },
         extendEnv: true,

package/src/Cloudflare/AI/SecuritySettings.ts

@@ -102,6 +102,7 @@ export const SecuritySettings = Resource<SecuritySettings>(
 
 export const SecuritySettingsProvider = () =>
   Provider.succeed(SecuritySettings, {
+    nuke: { singleton: true },
     stables: ["zoneId", "initialEnabled"],
 
     list: Effect.fn(function* () {

package/src/Cloudflare/Containers/ContainerApplication.ts

@@ -733,11 +733,13 @@ export interface ContainerApplication<Shape = unknown> extends Resource<
      */
     version: number;
     /**
-     * Internal cache of the built image hash, used to skip rebuilds when the
-     * bundled program and Dockerfile are unchanged.
+     * Internal hashes of the built image and desired application
+     * configuration, used to skip unchanged builds and updates.
      */
     hash?: {
       image: string;
+      digest?: string;
+      configuration?: string;
     };
     dev: DevContainerImage | undefined;
   },

package/src/Cloudflare/Containers/ContainerBundle.ts

@@ -13,7 +13,6 @@ import { Docker } from "../../Docker/Docker.ts";
 import { isInlineDockerfile } from "../../Docker/Dockerfile.ts";
 import * as Output from "../../Output.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
-import { Self } from "../../Self.ts";
 import { Stack } from "../../Stack.ts";
 import { sha256Object } from "../../Util/sha256.ts";
 import type { AnyContainerApplicationProps } from "./ContainerApplication.ts";
@@ -322,8 +321,8 @@ export const bundleContainerProgram = Effect.fn(function* ({
         resolve: {
           conditionNames:
             runtime === "bun"
-              ? ["bun", "import", "module", "default"]
-              : ["node", "import", "module", "default"],
+              ? [...Bundle.BUN_CONDITION_NAMES]
+              : [...Bundle.NODE_CONDITION_NAMES],
           ...build?.input?.resolve,
         },
         plugins: [build?.input?.plugins, plugins],
@@ -347,104 +346,17 @@ export const bundleContainerProgram = Effect.fn(function* ({
         realMain,
         virtualEntryPlugin(
           (importPath) => `
-${
-  runtime === "bun"
-    ? `
-import { BunServices } from "@effect/platform-bun";
-import { BunHttpServer } from "alchemy/Http";
-const HttpServer = BunHttpServer;
-`
-    : `
-import { NodeServices } from "@effect/platform-node";
-import { NodeHttpServer } from "alchemy/Http";
-const HttpServer = NodeHttpServer;
-`
-}
-import { Stack } from "alchemy/Stack";
-import { makeEntrypointLayer, reifyBoundConfigProvider } from "alchemy/Runtime";
-import { provideProcessTelemetry } from "alchemy/Telemetry";
-import { CloudflareEnvironment } from "alchemy/Cloudflare";
-import * as ConfigProvider from "effect/ConfigProvider";
-import * as Effect from "effect/Effect";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
-import * as Context from "effect/Context";
-import { MinimumLogLevel } from "effect/References";
-
+import { bootstrap } from ${JSON.stringify(
+            runtime === "bun"
+              ? "alchemy/Runtime/Bootstrap/CloudflareContainerBun"
+              : "alchemy/Runtime/Bootstrap/CloudflareContainerNode",
+          )};
 import ${handler === "default" ? "entrypoint" : `{ ${handler} as entrypoint }`} from ${JSON.stringify(importPath)};
 
-const tag = Context.Service("${Self.key}")
-const layer = makeEntrypointLayer(tag, entrypoint);
-
-const platform = Layer.mergeAll(
-  ${runtime === "bun" ? "BunServices.layer" : "NodeServices.layer"},
-  FetchHttpClient.layer,
-  // TODO(sam): wire this up to telemetry more directly
-  Logger.layer([Logger.consolePretty()]),
-);
-
-const stack = Layer.succeed(Stack, {
-  name: ${JSON.stringify(stack.name)},
-  stage: ${JSON.stringify(stack.stage)},
-  bindings: {},
-  resources: {}
-});
-
-const serverEffect = tag.pipe(
-  // Process-lifetime telemetry: built once into the root scope; exporters
-  // batch on their intervals and flush when the scope closes on graceful
-  // shutdown.
-  Effect.flatMap((func) =>
-    func.RuntimeContext.exports.pipe(
-      Effect.flatMap((exports) => exports.default),
-      provideProcessTelemetry(func.RuntimeContext),
-    ),
-  ),
-  Effect.provide(
-    layer.pipe(
-      Layer.provideMerge(stack),
-      Layer.provideMerge(HttpServer()),
-      // Capability bindings that talk to Cloudflare's HTTP API from inside the
-      // container (e.g. R2/KV/Queue \`*Http\` bindings) resolve their account via
-      // \`CloudflareEnvironment\` at runtime, exactly like the Worker bridge does
-      // (the service value is an \`Effect\` of the resolved credentials). The
-      // per-operation account/token are read from the container's env (the bound
-      // token outputs), so an absent account id here is harmless.
-      Layer.provideMerge(
-        Layer.succeed(
-          CloudflareEnvironment,
-          Effect.succeed({
-            account: process.env.ALCHEMY_CLOUDFLARE_ACCOUNT_ID,
-          }),
-        )
-      ),
-      Layer.provideMerge(platform),
-      Layer.provideMerge(
-        Layer.succeed(
-          ConfigProvider.ConfigProvider,
-          // Auto-bound \`Config\` values arrive in the env as
-          // \`{"_tag":"Redacted","value":...}\` markers; reify them so a
-          // \`Config\` re-read inside a handler decodes the raw source value.
-          reifyBoundConfigProvider(ConfigProvider.fromEnv(), process.env)
-        )
-      ),
-      Layer.provideMerge(
-        Layer.succeed(
-          MinimumLogLevel,
-          process.env.DEBUG ? "Debug" : "Info",
-        )
-      ),
-    )
-  ),
-  Effect.scoped
-);
-
-console.log("Container bootstrap starting...");
-await Effect.runPromise(serverEffect).catch((err) => {
-  console.error("Container bootstrap failed:", err);
-  process.exit(1);
-})`,
+await bootstrap(entrypoint, ${JSON.stringify({
+            stack: { name: stack.name, stage: stack.stage },
+          })});
+`,
         ),
       );
 

package/src/Cloudflare/Containers/ContainerPlatform.ts

@@ -21,6 +21,34 @@ import type {
   ContainerShape,
 } from "./ContainerApplication.ts";
 
+const toHttpUrl = (url: string) =>
+  url.startsWith("https:") ? `http:${url.slice("https:".length)}` : url;
+
+/**
+ * workerd container ports reject TLS outright ("Connecting to a container
+ * using HTTPS is not currently supported") — but the common proxy pattern
+ * forwards the incoming Worker request, whose production URL is `https://`,
+ * straight to the port. The hop into the container is already secure, so
+ * downgrade the scheme before forwarding, exactly like Cloudflare's own
+ * `@cloudflare/containers` `containerFetch` does
+ * (`request.url.replace("https:", "http:")`).
+ */
+const httpSchemePort = <
+  P extends {
+    fetch: (...args: any[]) => any;
+    connect: (...args: any[]) => any;
+  },
+>(
+  port: P,
+): P =>
+  ({
+    fetch: (input: RequestInfo | URL, init?: RequestInit) =>
+      input instanceof Request
+        ? port.fetch(toHttpUrl(input.url), input)
+        : port.fetch(toHttpUrl(String(input)), init),
+    connect: (address: any, options?: any) => port.connect(address, options),
+  }) as any as P;
+
 export const ContainerPlatform: Platform<
   ContainerApplication,
   ContainerServices,
@@ -135,7 +163,13 @@ export const ContainerPlatform: Platform<
       const className = namespace.name;
 
       yield* worker.bind`${container.LogicalId}`({
-        containers: [{ className, dev: container.dev }],
+        containers: [
+          {
+            className,
+            dev: container.dev,
+            hash: container.hash.pipe(Output.map((h) => h?.image)),
+          },
+        ],
       });
 
       // TODO(sam): register this in the Container Execution Context
@@ -151,7 +185,9 @@ export const ContainerPlatform: Platform<
             Effect.sync(() => state.container!.signal(signo)),
           getTcpPort: (port: number) =>
             Effect.sync(() =>
-              fromCloudflareFetcher(state.container!.getTcpPort(port)),
+              fromCloudflareFetcher(
+                httpSchemePort(state.container!.getTcpPort(port)),
+              ),
             ),
           setInactivityTimeout: (durationMs: number | bigint) =>
             Effect.promise(() =>