alchemy 2.0.0-beta.77 → 2.0.0-beta.78

package/src/Util/proxy-chain.ts

@@ -122,6 +122,22 @@ const replayArg = (
 export const proxyChain = <T>(cached: Effect.Effect<T, any, any>): T =>
   chain(cached) as T;
 
+/**
+ * Property reads the Effect runtime uses as *brand probes* — `symbol` keys
+ * and `~effect/...` type-id strings (`~effect/Exit`, `~effect/Effect`, …).
+ * The fiber's generator runner distinguishes a yielded Effect from an Exit
+ * with `value[ExitTypeId] !== undefined` (effect ≥ 4.0.0-rc.113; earlier
+ * releases used `in`, which the `has` trap already answers). Recording such
+ * a read as a chain step would hand back a truthy proxy, so the runner
+ * would treat every chain as an already-settled Exit and resume the
+ * generator with `proxy.value` — another proxy — instead of running it.
+ * Brand probes therefore answer `undefined` when the underlying effect
+ * lacks the key; the `has` trap keeps `in`-based probes correct too.
+ */
+const isBrandProbe = (prop: PropertyKey): boolean =>
+  typeof prop === "symbol" ||
+  (typeof prop === "string" && prop.startsWith("~effect/"));
+
 const chain = (
   cached: Effect.Effect<unknown, any, any>,
   ops: ReadonlyArray<Op> = [],
@@ -136,6 +152,9 @@ const chain = (
       if (Reflect.has(effect, prop)) {
         return Reflect.get(effect, prop);
       }
+      if (isBrandProbe(prop)) {
+        return undefined;
+      }
       return chain(cached, [...ops, { kind: "get", prop }]);
     },
     has(target, prop) {

package/src/Util/zip.ts

@@ -1,5 +1,6 @@
 import * as Effect from "effect/Effect";
-import type JSZip from "jszip";
+import type { Zippable } from "fflate";
+import { Buffer } from "node:buffer";
 
 export interface ZipFile {
   path: string;
@@ -11,46 +12,15 @@ export interface ZipFile {
   mode?: number;
 }
 
-const archiveDate = new Date("1980-01-01T00:00:00.000Z");
-
-/**
- * Generate the archive bytes deterministically. Nested paths make JSZip
- * synthesize the intermediate folder entries, and those are stamped with
- * `new Date()` rather than the per-file date the entries were added with.
- * Left alone, two archives built from identical bytes seconds apart differ —
- * which reads downstream as a content change.
- */
-const generateDeterministic = (zip: JSZip) =>
-  Effect.gen(function* () {
-    yield* Effect.sync(() => {
-      for (const entry of Object.values(zip.files)) {
-        entry.date = archiveDate;
-      }
-    });
-    return yield* Effect.promise(() =>
-      zip.generateAsync({
-        type: "nodebuffer",
-        compression: "DEFLATE",
-        platform: "UNIX",
-      }),
-    );
-  });
+// ZIP timestamps use local calendar fields; local midnight keeps the encoded
+// date identical in every timezone, including those west of UTC.
+const archiveDate = new Date(1980, 0, 1);
 
 export const zipCode = Effect.fn(function* (
   content: string | Uint8Array<ArrayBufferLike>,
   files?: ReadonlyArray<ZipFile>,
 ) {
-  // Create a zip buffer in memory
-  const zip = new (yield* Effect.promise(() => import("jszip"))).default();
-  zip.file("index.mjs", content, { date: archiveDate });
-  for (const file of files ?? []) {
-    zip.file(file.path, file.content, {
-      date: archiveDate,
-      unixPermissions: file.mode,
-    });
-  }
-
-  return yield* generateDeterministic(zip);
+  return yield* zipFiles([{ path: "index.mjs", content }, ...(files ?? [])]);
 });
 
 /**
@@ -59,14 +29,15 @@ export const zipCode = Effect.fn(function* (
  * identical bytes.
  */
 export const zipFiles = Effect.fn(function* (files: ReadonlyArray<ZipFile>) {
-  // Create a zip buffer in memory
-  const zip = new (yield* Effect.promise(() => import("jszip"))).default();
-  for (const file of [...files].sort((a, b) => (a.path < b.path ? -1 : 1))) {
-    zip.file(file.path, file.content, {
-      date: archiveDate,
-      unixPermissions: file.mode,
-    });
+  const { zipSync, strToU8 } = yield* Effect.promise(() => import("fflate"));
+  const entries: Zippable = Object.create(null);
+  for (const file of [...files].sort((a, b) =>
+    a.path < b.path ? -1 : a.path > b.path ? 1 : 0,
+  )) {
+    entries[file.path] = [
+      typeof file.content === "string" ? strToU8(file.content) : file.content,
+      { attrs: (file.mode ?? 0o100644) << 16 },
+    ];
   }
-
-  return yield* generateDeterministic(zip);
+  return Buffer.from(zipSync(entries, { mtime: archiveDate, os: 3 }));
 });

package/src/Utils/ip-address.ts

@@ -0,0 +1,90 @@
+/**
+ * Canonicalizes an IPv4 or IPv6 CIDR to its network address.
+ * Invalid input is returned unchanged; this function is not a validator.
+ */
+export const canonicalCidr = (cidr: string | undefined): string | undefined => {
+  if (cidr === undefined) return undefined;
+  if (/\s/.test(cidr)) return cidr;
+  const [address, prefixText, extra] = cidr.split("/");
+  if (!address || prefixText === undefined || extra !== undefined) return cidr;
+  if (!/^\d+$/.test(prefixText)) return cidr;
+
+  const ipv6 = address.includes(":");
+  const width = ipv6 ? 128 : 32;
+  const prefix = Number(prefixText);
+  if (!Number.isInteger(prefix) || prefix > width) return cidr;
+  const value = ipv6 ? parseIpv6(address) : parseIpv4(address);
+  if (value === undefined) return cidr;
+
+  const hostBits = BigInt(width - prefix);
+  const network = (value >> hostBits) << hostBits;
+  return `${ipv6 ? formatIpv6(network) : formatIpv4(network)}/${prefix}`;
+};
+
+const parseIpv4 = (address: string): bigint | undefined => {
+  const octets = address.split(".");
+  if (
+    octets.length !== 4 ||
+    octets.some(
+      (octet) => !/^(0|[1-9]\d{0,2})$/.test(octet) || Number(octet) > 255,
+    )
+  )
+    return undefined;
+  return octets.reduce((value, octet) => (value << 8n) | BigInt(octet), 0n);
+};
+
+const parseIpv6 = (address: string): bigint | undefined => {
+  if (address.includes(".")) {
+    const lastColon = address.lastIndexOf(":");
+    const ipv4 = parseIpv4(address.slice(lastColon + 1));
+    if (ipv4 === undefined) return undefined;
+    address = `${address.slice(0, lastColon + 1)}${(ipv4 >> 16n).toString(16)}:${(ipv4 & 0xffffn).toString(16)}`;
+  }
+
+  const halves = address.split("::");
+  if (halves.length > 2) return undefined;
+  const left = halves[0] ? halves[0].split(":") : [];
+  const right = halves[1] ? halves[1].split(":") : [];
+  const count = left.length + right.length;
+  if (halves.length === 1 ? count !== 8 : count >= 8) return undefined;
+  if ([...left, ...right].some((word) => !/^[0-9a-f]{1,4}$/i.test(word))) {
+    return undefined;
+  }
+
+  // A double colon must replace at least one 16-bit word.
+  const words =
+    halves.length === 1
+      ? left
+      : [...left, ...Array<string>(8 - count).fill("0"), ...right];
+  return words.reduce(
+    (value, word) => (value << 16n) | BigInt(`0x${word}`),
+    0n,
+  );
+};
+
+const formatIpv4 = (address: bigint): string =>
+  [24n, 16n, 8n, 0n]
+    .map((shift) => Number((address >> shift) & 255n))
+    .join(".");
+
+const formatIpv6 = (address: bigint): string => {
+  const words = Array.from({ length: 8 }, (_, index) =>
+    ((address >> BigInt((7 - index) * 16)) & 0xffffn).toString(16),
+  );
+  let longestStart = -1;
+  let longestLength = 1;
+  for (let index = 0; index < words.length; index++) {
+    if (words[index] !== "0") continue;
+    let end = index + 1;
+    while (end < words.length && words[end] === "0") end++;
+    // Compress the first longest run; never compress a single zero word.
+    if (end - index > longestLength) {
+      longestStart = index;
+      longestLength = end - index;
+    }
+    index = end - 1;
+  }
+  return longestStart < 0
+    ? words.join(":")
+    : `${words.slice(0, longestStart).join(":")}::${words.slice(longestStart + longestLength).join(":")}`;
+};

package/src/Website/Server.ts

@@ -10,7 +10,7 @@ import * as LocalProvider from "../Local/LocalProvider.ts";
 import * as ProviderLayer from "../Local/ProviderLayer.ts";
 import * as Provider from "../Provider.ts";
 import { Resource } from "../Resource.ts";
-import { initialCwd } from "../Util/Node.ts";
+import { initialCwd, moduleExtension } from "../Util/Node.ts";
 import { sha256Object } from "../Util/sha256.ts";
 
 /**
@@ -398,10 +398,25 @@ export const ServerProviderLive = () =>
           const built = yield* runBuild(news);
           return yield* makeOutput(news, built);
         }),
-        delete: Effect.fn(function* ({ output }) {
+        delete: Effect.fn(function* ({ olds, output }) {
           if (output.distDir === undefined) return;
+          const root = path.resolve(initialCwd, olds.root ?? ".");
           const distDir = path.resolve(initialCwd, output.distDir);
-          if (!(yield* fs.exists(distDir))) return;
+          if (!(yield* fs.exists(root)) || !(yield* fs.exists(distDir))) return;
+          // Some frameworks (Next.js) serve from the project root itself.
+          // Only dedicated output directories inside that root are disposable.
+          // Canonical paths also protect roots reached through a symlink.
+          const relative = path.relative(
+            yield* fs.realPath(root),
+            yield* fs.realPath(distDir),
+          );
+          if (
+            relative === "" ||
+            relative === ".." ||
+            relative.startsWith(`..${path.sep}`) ||
+            path.isAbsolute(relative)
+          )
+            return;
           yield* fs.remove(distDir, { recursive: true });
         }),
       };
@@ -481,7 +496,7 @@ export const ServerProviderLocal = () =>
   LocalProvider.make(
     Server,
     import.meta.resolve(
-      import.meta.url.endsWith(".ts") ? "./ServerLocal.ts" : "./ServerLocal.js",
+      `./ServerLocal${moduleExtension(import.meta.url)}`,
       import.meta.url,
     ),
     Effect.gen(function* () {

package/src/Website/ServerLocal.ts

@@ -1,4 +1,8 @@
-import * as RpcServer from "../Local/RpcServer.ts";
+/**
+ * The `Website.Server` provider group served by the dev sidecar (see
+ * `Local/Sidecar.ts`), so a framework dev server outlives exec-child reloads.
+ */
+import type * as RpcServer from "../Local/RpcServer.ts";
 import { ServerProviderLocal } from "./Server.ts";
 
-ServerProviderLocal().pipe(RpcServer.launch);
+export default ServerProviderLocal() satisfies RpcServer.ProviderLayer;

package/src/index.ts

@@ -7,7 +7,6 @@ export {
 export * as AdoptPolicy from "./AdoptPolicy.ts";
 export * from "./AI/index.ts";
 export * from "./AlchemyContext.ts";
-export * as Alchemist from "./Alchemist/index.ts";
 export * from "./Apply.ts";
 export {
   Service as BindingService,

package/lib/AWS/Website/ServerLocal.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=ServerLocal.d.ts.map

package/lib/AWS/Website/ServerLocal.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ServerLocal.d.ts","sourceRoot":"","sources":["../../../src/AWS/Website/ServerLocal.ts"],"names":[],"mappings":""}

package/lib/AWS/Website/ServerLocal.js

@@ -1,4 +0,0 @@
-import * as RpcServer from "../../Local/RpcServer.js";
-import { ServerProviderLocal } from "../../Website/Server.js";
-ServerProviderLocal().pipe(RpcServer.launch);
-//# sourceMappingURL=ServerLocal.js.map

package/lib/AWS/Website/ServerLocal.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ServerLocal.js","sourceRoot":"","sources":["../../../src/AWS/Website/ServerLocal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,mBAAmB,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC"}

package/lib/Railway/RetryPolicy.d.ts

@@ -1,22 +0,0 @@
-import * as railway from "@distilled.cloud/railway";
-import * as Layer from "effect/Layer";
-/**
- * Railway-wide retry policy for every SDK call made by the providers.
- *
- * Railway's GraphQL gateway rate-limits aggressively under concurrency
- * (many resources reconciling at once) and usually omits `Retry-After`,
- * so the SDK's default policy — 8 attempts, ~20s of patience — gives up
- * while the throttling window is still open and a bare `TooManyRequests`
- * escapes the provider. Keep the default transient classification (which
- * includes throttling, server, network, and locked errors) but:
- *
- * - throttling errors poll SLOWLY (25s floor) so the rate window refills
- *   instead of being re-drained by the retries themselves, with ~30
- *   attempts (~12 minutes of patience for a suite-wide window);
- * - every other transient error keeps fast exponential backoff capped at
- *   15s per delay.
- */
-export declare const factory: railway.Retry.Factory;
-/** Provide the Railway retry policy to every operation below. */
-export declare const RailwayRetryPolicy: Layer.Layer<railway.Retry.Retry>;
-//# sourceMappingURL=RetryPolicy.d.ts.map

package/lib/Railway/RetryPolicy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"RetryPolicy.d.ts","sourceRoot":"","sources":["../../src/Railway/RetryPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC;AAGpD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAQtC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAqBnC,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CACnB,CAAC"}

package/lib/Railway/RetryPolicy.js

@@ -1,43 +0,0 @@
-import * as railway from "@distilled.cloud/railway";
-import * as Duration from "effect/Duration";
-import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Ref from "effect/Ref";
-import * as Schedule from "effect/Schedule";
-const isThrottled = (error) => error instanceof railway.TooManyRequests ||
-    error instanceof railway.RailwayRateLimited;
-/**
- * Railway-wide retry policy for every SDK call made by the providers.
- *
- * Railway's GraphQL gateway rate-limits aggressively under concurrency
- * (many resources reconciling at once) and usually omits `Retry-After`,
- * so the SDK's default policy — 8 attempts, ~20s of patience — gives up
- * while the throttling window is still open and a bare `TooManyRequests`
- * escapes the provider. Keep the default transient classification (which
- * includes throttling, server, network, and locked errors) but:
- *
- * - throttling errors poll SLOWLY (25s floor) so the rate window refills
- *   instead of being re-drained by the retries themselves, with ~30
- *   attempts (~12 minutes of patience for a suite-wide window);
- * - every other transient error keeps fast exponential backoff capped at
- *   15s per delay.
- */
-export const factory = (lastError) => {
-    const base = railway.Retry.makeDefault(lastError);
-    return {
-        while: base.while,
-        schedule: Schedule.max([
-            Schedule.exponential(500, 2).pipe(railway.Retry.capped(Duration.seconds(15)), Schedule.modifyDelay(({ duration }) => Effect.gen(function* () {
-                const error = yield* Ref.get(lastError);
-                return isThrottled(error) &&
-                    Duration.isLessThan(duration, Duration.seconds(25))
-                    ? Duration.seconds(25)
-                    : duration;
-            })), railway.Retry.jittered),
-            Schedule.recurs(30),
-        ]),
-    };
-};
-/** Provide the Railway retry policy to every operation below. */
-export const RailwayRetryPolicy = Layer.succeed(railway.Retry.Retry, factory);
-//# sourceMappingURL=RetryPolicy.js.map

package/lib/Railway/RetryPolicy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"RetryPolicy.js","sourceRoot":"","sources":["../../src/Railway/RetryPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC;AACpD,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,GAAG,MAAM,YAAY,CAAC;AAClC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,MAAM,WAAW,GAAG,CAAC,KAAc,EAAW,EAAE,CAC9C,KAAK,YAAY,OAAO,CAAC,eAAe;IACxC,KAAK,YAAY,OAAO,CAAC,kBAAkB,CAAC;AAE9C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,OAAO,GAA0B,CAAC,SAAS,EAAE,EAAE;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAClD,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC;YACrB,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAC/B,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAC1C,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CACpC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACxC,OAAO,WAAW,CAAC,KAAK,CAAC;oBACvB,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACnD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtB,CAAC,CAAC,QAAQ,CAAC;YACf,CAAC,CAAC,CACH,EACD,OAAO,CAAC,KAAK,CAAC,QAAQ,CACvB;YACD,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;SACpB,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AAEF,iEAAiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAC7B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC"}

package/src/AWS/Website/ServerLocal.ts

@@ -1,4 +0,0 @@
-import * as RpcServer from "../../Local/RpcServer.ts";
-import { ServerProviderLocal } from "../../Website/Server.ts";
-
-ServerProviderLocal().pipe(RpcServer.launch);

package/src/Railway/RetryPolicy.ts

@@ -1,53 +0,0 @@
-import * as railway from "@distilled.cloud/railway";
-import * as Duration from "effect/Duration";
-import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Ref from "effect/Ref";
-import * as Schedule from "effect/Schedule";
-
-const isThrottled = (error: unknown): boolean =>
-  error instanceof railway.TooManyRequests ||
-  error instanceof railway.RailwayRateLimited;
-
-/**
- * Railway-wide retry policy for every SDK call made by the providers.
- *
- * Railway's GraphQL gateway rate-limits aggressively under concurrency
- * (many resources reconciling at once) and usually omits `Retry-After`,
- * so the SDK's default policy — 8 attempts, ~20s of patience — gives up
- * while the throttling window is still open and a bare `TooManyRequests`
- * escapes the provider. Keep the default transient classification (which
- * includes throttling, server, network, and locked errors) but:
- *
- * - throttling errors poll SLOWLY (25s floor) so the rate window refills
- *   instead of being re-drained by the retries themselves, with ~30
- *   attempts (~12 minutes of patience for a suite-wide window);
- * - every other transient error keeps fast exponential backoff capped at
- *   15s per delay.
- */
-export const factory: railway.Retry.Factory = (lastError) => {
-  const base = railway.Retry.makeDefault(lastError);
-  return {
-    while: base.while,
-    schedule: Schedule.max([
-      Schedule.exponential(500, 2).pipe(
-        railway.Retry.capped(Duration.seconds(15)),
-        Schedule.modifyDelay(({ duration }) =>
-          Effect.gen(function* () {
-            const error = yield* Ref.get(lastError);
-            return isThrottled(error) &&
-              Duration.isLessThan(duration, Duration.seconds(25))
-              ? Duration.seconds(25)
-              : duration;
-          }),
-        ),
-        railway.Retry.jittered,
-      ),
-      Schedule.recurs(30),
-    ]),
-  };
-};
-
-/** Provide the Railway retry policy to every operation below. */
-export const RailwayRetryPolicy: Layer.Layer<railway.Retry.Retry> =
-  Layer.succeed(railway.Retry.Retry, factory);