alchemy 2.0.0-beta.77 → 2.0.0-beta.78

package/src/AWS/S3/Bucket.ts

@@ -2,19 +2,19 @@ import { Region } from "@distilled.cloud/aws/Region";
 import type { BucketLocationConstraint } from "@distilled.cloud/aws/s3";
 import * as s3 from "@distilled.cloud/aws/s3";
 import * as Arr from "effect/Array";
+import * as Data from "effect/Data";
 import type * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Order from "effect/Order";
+import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
-import type { HttpClient } from "effect/unstable/http";
 import type { ScopedPlanStatusSession } from "../../Report.ts";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource, type ResourceBinding } from "../../Resource.ts";
 import { diffTags } from "../../Tags.ts";
-import type { Credentials } from "../Credentials.ts";
 import { AWSEnvironment, type AccountID } from "../Environment.ts";
 import { durationToDays } from "../IAM/common.ts";
 import type { PolicyStatement } from "../IAM/Policy.ts";
@@ -42,6 +42,15 @@ export interface BucketEncryption {
    * @default false
    */
   bucketKeyEnabled?: boolean;
+  /**
+   * Encryption types to block for new object writes. Currently supports SSE-C
+   * (server-side encryption with customer-provided keys).
+   * Omitted or `[]` blocks no encryption types and permits SSE-C, sending
+   * AWS's `NONE` value. Set to `["SSE-C"]` to block customer-provided keys.
+   * Removing this property resets the blocklist to its default.
+   * @default []
+   */
+  blockedEncryptionTypes?: "SSE-C"[];
 }
 
 /**
@@ -147,7 +156,9 @@ export interface BucketProps {
    */
   mfaDelete?: "Enabled" | "Disabled";
   /**
-   * Default server-side encryption for objects written to the bucket.
+   * Default server-side encryption for new objects. Omission restores AES256,
+   * no KMS key, bucket keys disabled, and no encryption types blocked.
+   * Existing objects are not re-encrypted. External changes are repaired on deploy.
    */
   encryption?: BucketEncryption;
   /**
@@ -336,6 +347,78 @@ export interface Bucket extends Resource<
  * });
  * ```
  *
+ * ### Default Bucket Encryption
+ * **Example:** Use the default encryption settings
+ * ```typescript
+ * const bucket = yield* S3.Bucket("my-bucket", {});
+ * ```
+ *
+ * The default is AES256 encryption with S3-managed keys, bucket keys disabled,
+ * and no encryption types blocked. Requests may explicitly supply their own
+ * encryption keys (SSE-C); permitting SSE-C does not change the default
+ * encryption used by requests without those keys.
+ *
+ * ### Blocking Customer-Provided Encryption Keys
+ * **Example:** Reject new SSE-C writes
+ * ```typescript
+ * const bucket = yield* S3.Bucket("my-bucket", {
+ *   encryption: {
+ *     sseAlgorithm: "AES256",
+ *     blockedEncryptionTypes: ["SSE-C"],
+ *   },
+ * });
+ * ```
+ *
+ * `blockedEncryptionTypes` lists encryption types to reject. This blocks new
+ * writes using customer-provided keys while retaining AES256 default encryption.
+ * Existing encrypted objects are unchanged.
+ *
+ * ### Resetting Encryption Restrictions
+ * **Example:** Remove the block to restore the default
+ * ```diff
+ * const bucket = yield* S3.Bucket("my-bucket", {
+ *   encryption: {
+ *     sseAlgorithm: "AES256",
+ * -    blockedEncryptionTypes: ["SSE-C"],
+ *   },
+ * });
+ * ```
+ *
+ * Redeploy the same logical resource after removing the property. Alchemy
+ * resets the blocklist to its default, `[]`, so SSE-C writes are permitted.
+ * It updates AWS rather than preserving the previously configured block.
+ *
+ * **Example:** Set the default blocklist explicitly
+ * ```typescript
+ * const bucket = yield* S3.Bucket("my-bucket", {
+ *   encryption: {
+ *     sseAlgorithm: "AES256",
+ *     blockedEncryptionTypes: [],
+ *   },
+ * });
+ * ```
+ *
+ * `[]` and omission have the same desired state: no encryption types blocked.
+ * The provider sends AWS's `NONE` value when it needs to reset a restriction.
+ * Redeploying unchanged code also repairs externally modified restrictions.
+ *
+ * ### Resetting All Encryption Settings
+ * **Example:** Remove the entire encryption configuration
+ * ```diff
+ * const bucket = yield* S3.Bucket("my-bucket", {
+ * -  encryption: {
+ * -    sseAlgorithm: "aws:kms",
+ * -    kmsMasterKeyId: "arn:aws:kms:us-west-2:123456789012:key/12345678-1234-1234-1234-123456789012",
+ * -    bucketKeyEnabled: true,
+ * -    blockedEncryptionTypes: ["SSE-C"],
+ * -  },
+ * });
+ * ```
+ *
+ * Omitting `encryption` resets every setting to the defaults: AES256, no custom
+ * KMS key, bucket keys disabled, and an empty blocklist. Previously configured
+ * KMS encryption is also reset; existing objects are not re-encrypted.
+ *
  * ### Runtime Operations
  * Bind S3 operations in the init phase and use them in runtime
  * handlers. Bindings inject the bucket name and grant scoped IAM
@@ -516,11 +599,15 @@ export const BucketProvider = () =>
         // For us-east-1, BucketAlreadyOwnedByYou is not thrown, so we need to
         // pre-emptively check if the bucket exists for idempotency
         if (region === "us-east-1") {
-          const exists = yield* s3.headBucket({ Bucket: bucketName }).pipe(
-            Effect.map(() => true),
-            Effect.catchTag("NotFound", () => Effect.succeed(false)),
-            Effect.catch(() => Effect.succeed(false)),
-          );
+          const exists = yield* s3
+            .getBucketLocation({
+              Bucket: bucketName,
+              ExpectedBucketOwner: accountId,
+            })
+            .pipe(
+              Effect.map(() => true),
+              Effect.catchTag("NoSuchBucket", () => Effect.succeed(false)),
+            );
 
           yield* Effect.logInfo(
             `S3 Bucket create: us-east-1 existence check for ${bucketName} -> ${exists}`,
@@ -569,10 +656,18 @@ export const BucketProvider = () =>
         }
 
         // Wait for bucket to exist (eventual consistency)
-        yield* Effect.retry(
-          s3.headBucket({ Bucket: bucketName }),
-          Schedule.max([Schedule.exponential(100), Schedule.recurs(10)]),
-        );
+        yield* s3
+          .getBucketLocation({
+            Bucket: bucketName,
+            ExpectedBucketOwner: accountId,
+          })
+          .pipe(
+            Effect.retry({
+              while: (error) => error._tag === "NoSuchBucket",
+              schedule: Schedule.exponential(100),
+              times: 8,
+            }),
+          );
         yield* Effect.logInfo(
           `S3 Bucket create: bucket is available ${bucketName}`,
         );
@@ -588,19 +683,12 @@ export const BucketProvider = () =>
         };
       });
 
-      const fetchBucketTags = (
-        bucketName: string,
-      ): Effect.Effect<
-        Record<string, string>,
-        never,
-        Credentials | HttpClient.HttpClient | Region
-      > =>
+      const fetchBucketTags = (bucketName: string) =>
         s3.getBucketTagging({ Bucket: bucketName }).pipe(
           Effect.map((r) =>
             Object.fromEntries((r.TagSet ?? []).map((t) => [t.Key!, t.Value!])),
           ),
           Effect.catchTag("NoSuchTagSet", () => Effect.succeed({})),
-          Effect.catch(() => Effect.succeed({})),
         );
 
       const syncBucketTags = Effect.fn(function* ({
@@ -833,49 +921,6 @@ export const BucketProvider = () =>
         yield* session.note(`Updated bucket versioning: ${bucketName}`);
       });
 
-      const syncBucketEncryption = Effect.fn(function* ({
-        bucketName,
-        encryption,
-        session,
-      }: {
-        bucketName: string;
-        encryption?: BucketEncryption;
-        session: ScopedPlanStatusSession;
-      }) {
-        if (encryption === undefined) return;
-        const desiredRule: s3.ServerSideEncryptionRule = {
-          ApplyServerSideEncryptionByDefault: {
-            SSEAlgorithm: encryption.sseAlgorithm,
-            KMSMasterKeyID: encryption.kmsMasterKeyId,
-          },
-          BucketKeyEnabled: encryption.bucketKeyEnabled ?? false,
-        };
-        const current = yield* s3
-          .getBucketEncryption({ Bucket: bucketName })
-          .pipe(
-            Effect.map((r) => r.ServerSideEncryptionConfiguration?.Rules?.[0]),
-            // Some partitions return 404 with no default config; treat any
-            // not-configured read as "no rule" so we converge by writing.
-            Effect.catch(() =>
-              Effect.succeed<s3.ServerSideEncryptionRule | undefined>(
-                undefined,
-              ),
-            ),
-          );
-        const canon = (r: s3.ServerSideEncryptionRule | undefined) =>
-          JSON.stringify({
-            alg: r?.ApplyServerSideEncryptionByDefault?.SSEAlgorithm ?? null,
-            key: r?.ApplyServerSideEncryptionByDefault?.KMSMasterKeyID ?? null,
-            bucketKey: r?.BucketKeyEnabled ?? false,
-          });
-        if (canon(current) === canon(desiredRule)) return;
-        yield* s3.putBucketEncryption({
-          Bucket: bucketName,
-          ServerSideEncryptionConfiguration: { Rules: [desiredRule] },
-        });
-        yield* session.note(`Updated bucket encryption: ${bucketName}`);
-      });
-
       const syncPublicAccessBlock = Effect.fn(function* ({
         bucketName,
         publicAccessBlock,
@@ -1333,10 +1378,10 @@ export const BucketProvider = () =>
 
       return {
         stables: ["bucketName", "bucketArn", "region", "accountId"],
-        // S3 bucket names are globally unique. `headBucket` succeeds only when
-        // the bucket exists in our account, so a successful response is itself
-        // proof of account-level ownership — there is no separate ownership
-        // signal to surface as `Unowned`.
+        // ListBuckets enumerates this account. Read verifies the same ownership
+        // with ExpectedBucketOwner; cross-account access alone is not ownership.
+        // GetBucketLocation needs configuration access, not HeadBucket's
+        // s3:ListBucket permission to enumerate the bucket's objects.
         list: () =>
           Effect.gen(function* () {
             const { accountId, region } = yield* AWSEnvironment.current;
@@ -1373,11 +1418,15 @@ export const BucketProvider = () =>
           const bucketName =
             output?.bucketName ?? (yield* createBucketName(id, olds ?? {}));
           const { accountId, region } = yield* AWSEnvironment.current;
-          const exists = yield* s3.headBucket({ Bucket: bucketName }).pipe(
-            Effect.map(() => true),
-            Effect.catchTag("NotFound", () => Effect.succeed(false)),
-            Effect.catch(() => Effect.succeed(false)),
-          );
+          const exists = yield* s3
+            .getBucketLocation({
+              Bucket: bucketName,
+              ExpectedBucketOwner: accountId,
+            })
+            .pipe(
+              Effect.map(() => true),
+              Effect.catchTag("NoSuchBucket", () => Effect.succeed(false)),
+            );
           if (!exists) return undefined;
           return {
             bucketName,
@@ -1389,7 +1438,7 @@ export const BucketProvider = () =>
             accountId,
           };
         }),
-        diff: Effect.fn(function* ({ id, news = {}, olds = {} }) {
+        diff: Effect.fn(function* ({ id, news = {}, olds = {}, output }) {
           if (!isResolved(news)) return undefined;
           const oldBucketName = yield* createBucketName(id, olds);
           const newBucketName = yield* createBucketName(id, news);
@@ -1412,6 +1461,19 @@ export const BucketProvider = () =>
             );
             return { action: "replace" } as const;
           }
+          if (output) {
+            const observed = yield* readBucketEncryption(
+              output.bucketName,
+            ).pipe(
+              Effect.catchTag("NoSuchBucket", () => Effect.succeed(undefined)),
+            );
+            if (
+              encryptionFingerprint(observed) !==
+              encryptionFingerprint(desiredEncryptionRule(news.encryption))
+            ) {
+              return { action: "update" } as const;
+            }
+          }
         }),
         precreate: (props) => ensureBucketExists(props),
         reconcile: Effect.fn(function* ({
@@ -1457,11 +1519,13 @@ export const BucketProvider = () =>
             session,
           });
 
-          yield* syncBucketEncryption({
-            bucketName: resolved.bucketName,
-            encryption: news.encryption,
-            session,
-          });
+          if (
+            yield* syncBucketEncryption(resolved.bucketName, news.encryption)
+          ) {
+            yield* session.note(
+              `Updated bucket encryption: ${resolved.bucketName}`,
+            );
+          }
 
           yield* syncBucketCors({
             bucketName: resolved.bucketName,
@@ -1553,10 +1617,10 @@ export const BucketProvider = () =>
           //   operator-confirmed account teardown. Nuke enumerates buckets
           //   straight from the cloud (its `olds` is Attributes, not Props),
           //   so `forceDestroy` is never present there. S3 ownership is
-          //   account-level (see `list`/`read`: buckets are globally unique
-          //   and only enumerable/headable in our own account; this provider
-          //   deliberately does not stamp alchemy tags on buckets), so every
-          //   bucket nuke hands us is one this account owns.
+          //   account-level: list enumerates this account and read verifies
+          //   ExpectedBucketOwner. This provider deliberately does not stamp
+          //   alchemy tags on buckets, so every bucket nuke hands us is one
+          //   this account owns.
           // A normal destroy without `forceDestroy` must NOT empty the
           // bucket — a non-empty bucket fails with BucketNotEmpty, which is
           // the data-protection behavior users rely on.
@@ -1648,3 +1712,77 @@ export const BucketProvider = () =>
       };
     }),
   );
+
+class BucketEncryptionNotConverged extends Data.TaggedError(
+  "BucketEncryptionNotConverged",
+)<{ bucket: string }> {}
+
+const desiredEncryptionRule = (
+  encryption?: BucketEncryption,
+): s3.ServerSideEncryptionRule => {
+  const algorithm = encryption?.sseAlgorithm ?? "AES256";
+  const blocked = encryption?.blockedEncryptionTypes ?? [];
+  return {
+    ApplyServerSideEncryptionByDefault: {
+      SSEAlgorithm: algorithm,
+      KMSMasterKeyID:
+        algorithm === "AES256" ? undefined : encryption?.kmsMasterKeyId,
+    },
+    BucketKeyEnabled: encryption?.bucketKeyEnabled ?? false,
+    BlockedEncryptionTypes: {
+      EncryptionType: blocked.length ? [...new Set(blocked)] : ["NONE"],
+    },
+  };
+};
+
+const encryptionFingerprint = (
+  rule: s3.ServerSideEncryptionRule | undefined,
+) => {
+  const key = rule?.ApplyServerSideEncryptionByDefault?.KMSMasterKeyID;
+  return JSON.stringify({
+    algorithm: rule?.ApplyServerSideEncryptionByDefault?.SSEAlgorithm ?? null,
+    key: (Redacted.isRedacted(key) ? Redacted.value(key) : key) ?? null,
+    bucketKey: rule?.BucketKeyEnabled ?? false,
+    blocked: [
+      ...new Set(
+        rule?.BlockedEncryptionTypes?.EncryptionType?.filter(
+          (type) => type !== "NONE",
+        ) ?? [],
+      ),
+    ].sort(),
+  });
+};
+
+const readBucketEncryption = (bucket: string) =>
+  s3
+    .getBucketEncryption({ Bucket: bucket })
+    .pipe(
+      Effect.map(
+        (result) => result.ServerSideEncryptionConfiguration?.Rules?.[0],
+      ),
+    );
+
+export const syncBucketEncryption = Effect.fn(function* (
+  bucket: string,
+  encryption?: BucketEncryption,
+) {
+  const desired = desiredEncryptionRule(encryption);
+  const matches = (rule: s3.ServerSideEncryptionRule | undefined) =>
+    encryptionFingerprint(rule) === encryptionFingerprint(desired);
+  if (matches(yield* readBucketEncryption(bucket))) return false;
+  yield* s3.putBucketEncryption({
+    Bucket: bucket,
+    ServerSideEncryptionConfiguration: { Rules: [desired] },
+  });
+  const observed = yield* readBucketEncryption(bucket).pipe(
+    Effect.repeat({
+      until: matches,
+      schedule: Schedule.spaced("1 second"),
+      times: 8,
+    }),
+  );
+  if (!matches(observed)) {
+    return yield* Effect.fail(new BucketEncryptionNotConverged({ bucket }));
+  }
+  return true;
+});

package/src/AWS/S3/PresignGetObject.ts

@@ -1,4 +1,4 @@
-import type { CredentialsError } from "@distilled.cloud/aws/Credentials";
+import type { PresignError } from "@distilled.cloud/aws/Presign";
 import type * as Effect from "effect/Effect";
 import * as Binding from "../../Binding.ts";
 import type { Bucket } from "./Bucket.ts";
@@ -53,9 +53,7 @@ export interface PresignGetObject extends Binding.Service<
   (
     bucket: Bucket,
   ) => Effect.Effect<
-    (
-      request: PresignGetObjectRequest,
-    ) => Effect.Effect<string, CredentialsError>
+    (request: PresignGetObjectRequest) => Effect.Effect<string, PresignError>
   >
 > {}
 

package/src/AWS/S3/PresignPutObject.ts

@@ -1,4 +1,4 @@
-import type { CredentialsError } from "@distilled.cloud/aws/Credentials";
+import type { PresignError } from "@distilled.cloud/aws/Presign";
 import type * as Effect from "effect/Effect";
 import * as Binding from "../../Binding.ts";
 import type { Bucket } from "./Bucket.ts";
@@ -54,9 +54,7 @@ export interface PresignPutObject extends Binding.Service<
   (
     bucket: Bucket,
   ) => Effect.Effect<
-    (
-      request: PresignPutObjectRequest,
-    ) => Effect.Effect<string, CredentialsError>
+    (request: PresignPutObjectRequest) => Effect.Effect<string, PresignError>
   >
 > {}
 

package/src/AWS/SNS/Subscription.ts

@@ -295,7 +295,13 @@ export const SubscriptionProvider = () =>
             topicArn: (output.topicArn ?? olds.topicArn) as string | undefined,
             protocol: output.protocol ?? olds.protocol,
             endpoint: (output.endpoint ?? olds.endpoint) as string | undefined,
-          })
+          }).pipe(
+            // The topic is already gone — SNS drops its subscriptions with
+            // it, so there is nothing left to unsubscribe.
+            Effect.catchTag("NotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          )
         : output.subscriptionArn;
 
       if (!subscriptionArn) {
@@ -366,14 +372,28 @@ const readSubscription = Effect.fn(function* ({
   protocol?: string;
   endpoint: string | undefined;
 }) {
-  const resolvedSubscriptionArn =
-    subscriptionArn && !isPendingConfirmation(subscriptionArn)
-      ? subscriptionArn
-      : yield* findSubscription({
-          topicArn,
-          protocol,
-          endpoint,
-        });
+  let resolvedSubscriptionArn: string | undefined;
+  if (subscriptionArn && !isPendingConfirmation(subscriptionArn)) {
+    resolvedSubscriptionArn = subscriptionArn;
+  } else {
+    // No concrete ARN to hydrate — list the topic's subscriptions and match
+    // by (protocol, endpoint). If the topic itself no longer exists (deleted
+    // out of band, or by an interrupted destroy that committed the topic's
+    // state row late) then the subscription is gone too: report "missing"
+    // rather than failing the read, so a subsequent destroy can proceed.
+    const found = yield* findSubscription({
+      topicArn,
+      protocol,
+      endpoint,
+    }).pipe(
+      Effect.map((arn) => ({ arn })),
+      Effect.catchTag("NotFoundException", () => Effect.succeed(undefined)),
+    );
+    if (found === undefined) {
+      return undefined;
+    }
+    resolvedSubscriptionArn = found.arn;
+  }
 
   if (!resolvedSubscriptionArn) {
     if (!topicArn || !protocol) {

package/src/AWS/StateStore/State.ts

@@ -25,7 +25,7 @@ import {
   Default as DefaultEnvironment,
 } from "../Environment.ts";
 import * as AwsRegion from "../Region.ts";
-import type { BucketEncryption } from "../S3/Bucket.ts";
+import { syncBucketEncryption, type BucketEncryption } from "../S3/Bucket.ts";
 
 /**
  * The bookkeeping object that stores a stack's resolved output. Lives
@@ -57,9 +57,12 @@ export interface S3StateOptions {
    */
   prefix?: string;
   /**
-   * Default encryption enforced on the state bucket.
+   * Default encryption enforced on every fresh state-service initialization.
+   * Omission restores AES256, no KMS key, bucket keys disabled, and no blocked
+   * encryption types. Set `blockedEncryptionTypes: ["SSE-C"]` to block
+   * customer-provided keys. Existing encrypted state objects are not rewritten.
    *
-   * @default `{ sseAlgorithm: "AES256" }`
+   * @default `{ sseAlgorithm: "AES256", bucketKeyEnabled: false, blockedEncryptionTypes: [] }`
    */
   encryption?: BucketEncryption;
 }
@@ -125,6 +128,23 @@ type S3Deps = Credentials | HttpClient | Region;
  * );
  * ```
  *
+ * ### Managing SSE-C Restrictions
+ * **Example:** Block customer-provided encryption keys on the state bucket
+ * ```typescript
+ * const stateStore = AWS.state({
+ *   encryption: {
+ *     sseAlgorithm: "AES256",
+ *     blockedEncryptionTypes: ["SSE-C"],
+ *   },
+ * });
+ * ```
+ *
+ * Omitted `blockedEncryptionTypes` is equivalent to `[]`: no encryption types
+ * are blocked, so SSE-C writes are permitted via AWS's `NONE` value. Removing
+ * an explicit block clears it. Omitting `encryption` restores AES256, no KMS
+ * key, disabled bucket keys, and no encryption restrictions. Existing objects
+ * are not rewritten.
+ *
  * @resource
  */
 export const state = (options: S3StateOptions = {}) =>
@@ -449,39 +469,7 @@ const ensureStateBucket = (
       });
     }
 
-    const desiredEncryption = options.encryption ?? {
-      sseAlgorithm: "AES256",
-    };
-    const observedEncryption = (yield* s3.getBucketEncryption({
-      Bucket: bucket,
-    })).ServerSideEncryptionConfiguration?.Rules?.[0];
-    const desiredEncryptionRule: s3.ServerSideEncryptionRule = {
-      ApplyServerSideEncryptionByDefault: {
-        SSEAlgorithm: desiredEncryption.sseAlgorithm,
-        KMSMasterKeyID: desiredEncryption.kmsMasterKeyId,
-      },
-      BucketKeyEnabled: desiredEncryption.bucketKeyEnabled ?? false,
-    };
-    const encryptionFingerprint = (
-      rule: s3.ServerSideEncryptionRule | undefined,
-    ) =>
-      JSON.stringify({
-        algorithm:
-          rule?.ApplyServerSideEncryptionByDefault?.SSEAlgorithm ?? null,
-        key: rule?.ApplyServerSideEncryptionByDefault?.KMSMasterKeyID ?? null,
-        bucketKey: rule?.BucketKeyEnabled ?? false,
-      });
-    if (
-      encryptionFingerprint(observedEncryption) !==
-      encryptionFingerprint(desiredEncryptionRule)
-    ) {
-      yield* s3.putBucketEncryption({
-        Bucket: bucket,
-        ServerSideEncryptionConfiguration: {
-          Rules: [desiredEncryptionRule],
-        },
-      });
-    }
+    yield* syncBucketEncryption(bucket, options.encryption);
 
     const desiredPublicAccess: s3.PublicAccessBlockConfiguration = {
       BlockPublicAcls: true,

package/src/AWS/Synthetics/Canary.ts

@@ -19,6 +19,7 @@ import {
   hasAlchemyTags,
 } from "../../Tags.ts";
 import { toWireDays, toWireSeconds } from "../../Util/Duration.ts";
+import { zipFiles } from "../../Util/zip.ts";
 import { sha256Object } from "../../Util/sha256.ts";
 import { AWSEnvironment } from "../Environment.ts";
 import type { Providers } from "../Providers.ts";
@@ -335,17 +336,9 @@ const buildCode = Effect.fn(function* (
   handler: string,
   runtimeVersion: string,
 ) {
-  const zip = new (yield* Effect.promise(() => import("jszip"))).default();
-  // constant date for a deterministic archive
-  const date = new Date("1980-01-01T00:00:00.000Z");
-  zip.file(scriptFilePath(runtimeVersion, handler), script, { date });
-  const buffer = yield* Effect.promise(() =>
-    zip.generateAsync({
-      type: "nodebuffer",
-      compression: "DEFLATE",
-      platform: "UNIX",
-    }),
-  );
+  const buffer = yield* zipFiles([
+    { path: scriptFilePath(runtimeVersion, handler), content: script },
+  ]);
   return {
     ZipFile: new Uint8Array(buffer),
     Handler: handler,

package/src/Alchemist/Entrypoint.ts

@@ -0,0 +1,33 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import { UserFacingError } from "../UserFacingError.ts";
+
+export class StackEntrypointError extends Data.TaggedError(
+  "StackEntrypointError",
+)<{ readonly message: string }> {
+  readonly [UserFacingError] = true;
+}
+
+export const DEFAULT_ENTRYPOINT = "alchemy.run.ts";
+
+/**
+ * The absolute path of the stack entrypoint, or the user-facing error for
+ * a missing one. Kept apart from `Session.ts` so the `alchemy dev`
+ * supervisor can check the entry before it starts an exec child, without
+ * loading the engine that module carries.
+ */
+export const resolveStackEntrypoint = Effect.fn(function* (main: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const absolutePath = path.resolve(main);
+  if (!(yield* fs.exists(absolutePath))) {
+    return yield* Effect.fail(
+      new StackEntrypointError({
+        message: `Stack entrypoint '${main}' does not exist in '${path.dirname(absolutePath)}'. Run this command from an Alchemy project or pass --config <path>.`,
+      }),
+    );
+  }
+  return absolutePath;
+});