alchemy 2.0.0-beta.test-export-fix-4 → 2.0.0-cli-bundle-fix.1

package/src/Cloudflare/StateStore/Store.ts

@@ -0,0 +1,288 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import type { ReplacedResourceState, ResourceState } from "alchemy/State";
+import { encodeState } from "alchemy/State";
+import * as Effect from "effect/Effect";
+import { pipe } from "effect/Function";
+import { EncryptionKey } from "./Token.ts";
+
+export default class Store extends Cloudflare.DurableObjectNamespace<Store>()(
+  "Store",
+  Effect.gen(function* () {
+    // Outer (class-level) phase — resolve the binding factory once.
+    // The actual secret read happens inside each DO instance below,
+    // since `SecretClient.get()` needs the per-instance worker env.
+    const encryptionSecret = yield* Cloudflare.Secret.bind(EncryptionKey);
+
+    return Effect.gen(function* () {
+      // Inner (per-instance) phase — set up storage and the AES key.
+      // The key is imported once per DO boot and reused thereafter.
+      const doState = yield* Cloudflare.DurableObjectState;
+      const storage = doState.storage;
+
+      const keyHex = yield* encryptionSecret.get().pipe(Effect.orDie);
+      const cryptoKey = yield* Effect.tryPromise(() =>
+        crypto.subtle.importKey(
+          "raw",
+          hexToBytes(keyHex),
+          { name: "AES-CTR" },
+          false,
+          ["encrypt", "decrypt"],
+        ),
+      ).pipe(Effect.orDie);
+
+      const encryptValue = (value: ResourceState) =>
+        Effect.tryPromise(async () => {
+          const plaintext = new TextEncoder().encode(
+            JSON.stringify(encodeState(value)),
+          );
+          const counter = crypto.getRandomValues(allocBytes(NONCE_BYTES));
+          const ct = new Uint8Array(
+            await crypto.subtle.encrypt(
+              { name: "AES-CTR", counter, length: 64 },
+              cryptoKey,
+              plaintext,
+            ),
+          );
+          // Frame as a single base64 string: nonce || ciphertext.
+          const framed = allocBytes(counter.byteLength + ct.byteLength);
+          framed.set(counter, 0);
+          framed.set(ct, counter.byteLength);
+          return toB64(framed);
+        }).pipe(Effect.orDie);
+
+      const decryptEntry = (entry: string) =>
+        Effect.tryPromise(async () => {
+          const framed = fromB64(entry);
+          const counter = framed.slice(0, NONCE_BYTES);
+          const ciphertext = framed.slice(NONCE_BYTES);
+          const pt = await crypto.subtle.decrypt(
+            { name: "AES-CTR", counter, length: 64 },
+            cryptoKey,
+            ciphertext,
+          );
+          return JSON.parse(new TextDecoder().decode(pt)) as ResourceState;
+        }).pipe(Effect.orDie);
+
+      return {
+        // -- Root DO methods -----------------------------------------
+
+        /**
+         * (Root DO only) List every stack name ever registered.
+         */
+        listStacks: Effect.fnUntraced(function* () {
+          const entries = yield* storage.list<number>({
+            prefix: STACK_INDEX_PREFIX,
+          });
+          const stacks: string[] = [];
+          for (const key of entries.keys()) {
+            stacks.push(key.slice(STACK_INDEX_PREFIX.length));
+          }
+          return stacks;
+        }),
+
+        /**
+         * (Root DO only) Register a stack name. Idempotent — safe to
+         * call on every `set` to the corresponding stack DO.
+         */
+        registerStack: ({ stack }: { stack: string }) =>
+          storage.put(`${STACK_INDEX_PREFIX}${stack}`, 1),
+
+        /**
+         * (Root DO only) Remove a stack name from the global index.
+         */
+        unregisterStack: ({ stack }: { stack: string }) =>
+          storage.delete(`${STACK_INDEX_PREFIX}${stack}`),
+
+        // -- Stack DO methods ----------------------------------------
+
+        /** (Stack DO only) List stages with at least one resource. */
+        listStages: () =>
+          storage
+            .list<string>({
+              prefix: RESOURCE_PREFIX,
+            })
+            .pipe(
+              Effect.map((entries) => {
+                const stages = new Set<string>();
+                for (const key of entries.keys()) {
+                  const parsed = parseResourceKey(key);
+                  if (parsed) stages.add(parsed.stage);
+                }
+                return [...stages];
+              }),
+            ),
+
+        /** (Stack DO only) List every resource FQN in a stage. */
+        listResources: ({ stage }: { stage: string }) =>
+          storage
+            .list<string>({
+              prefix: stagePrefix(stage),
+            })
+            .pipe(
+              Effect.map((entries) => {
+                const fqns: string[] = [];
+                for (const key of entries.keys()) {
+                  const parsed = parseResourceKey(key);
+                  if (parsed) fqns.push(parsed.fqn);
+                }
+                return fqns;
+              }),
+            ),
+
+        /**
+         * (Stack DO only) Get a resource by (stage, fqn). Returns
+         * null if missing.
+         */
+        get: ({ stage, fqn }: { stage: string; fqn: string }) =>
+          storage
+            .get<string>(resourceKey(stage, fqn))
+            .pipe(
+              Effect.flatMap((entry) =>
+                entry == null ? Effect.succeed(undefined) : decryptEntry(entry),
+              ),
+            ),
+
+        /**
+         * (Stack DO only) Persist a resource. Returns the stored
+         * value unchanged.
+         */
+        set: ({
+          stage,
+          fqn,
+          value,
+        }: {
+          stage: string;
+          fqn: string;
+          value: ResourceState;
+        }) =>
+          encryptValue(value).pipe(
+            Effect.flatMap((encrypted) =>
+              storage
+                .put<string>(resourceKey(stage, fqn), encrypted)
+                .pipe(Effect.asVoid),
+            ),
+            Effect.map(() => value),
+          ),
+
+        /**
+         * (Stack DO only) Delete a resource. Idempotent.
+         *
+         * Exposed as `remove` (not `delete`) because Cloudflare's
+         * Durable Object RPC stub reserves `delete` and refuses to
+         * proxy the call, surfacing as "RPC receiver does not
+         * implement the method 'delete'".
+         */
+        remove: ({ stage, fqn }: { stage: string; fqn: string }) =>
+          storage.delete(resourceKey(stage, fqn)),
+
+        /**
+         * (Stack DO only) Delete every resource in this stack, or every
+         * resource in a single stage when specified.
+         */
+        deleteStack: ({ stage }: { stage?: string } = {}) =>
+          stage === undefined
+            ? storage.deleteAll()
+            : storage
+                .list<string>({ prefix: stagePrefix(stage) })
+                .pipe(
+                  Effect.flatMap((entries) =>
+                    entries.size === 0
+                      ? Effect.void
+                      : storage.delete([...entries.keys()]).pipe(Effect.asVoid),
+                  ),
+                ),
+
+        /**
+         * (Stack DO only) Return every resource in a stage whose
+         * `status === "replaced"`. Each entry is decrypted so the
+         * `status` field can be inspected.
+         */
+        getReplacedResources: ({ stage }: { stage: string }) =>
+          pipe(
+            storage.list<string>({ prefix: stagePrefix(stage) }),
+            Effect.map((entries) =>
+              [...entries.values()].filter((e): e is string => !!e),
+            ),
+            Effect.flatMap(
+              Effect.forEach(decryptEntry, { concurrency: "unbounded" }),
+            ),
+            Effect.map((decoded) =>
+              decoded.filter(
+                (d): d is ReplacedResourceState => d?.status === "replaced",
+              ),
+            ),
+          ),
+      };
+    });
+  }),
+) {
+  /**
+   * Well-known DO name whose sole job is to track the set of stacks
+   * that have ever had resources written. `listStacks` queries it;
+   * every `set` asks it to register the stack (idempotent).
+   */
+  static readonly ROOT_DO_NAME = "__root__" as const;
+}
+
+/** NUL byte separator for composite keys. */
+const SEP = "\x00";
+
+/** Key prefix for resource entries in a stack DO. */
+const RESOURCE_PREFIX = `r${SEP}`;
+
+/** Key prefix for stack-index entries in the root DO. */
+const STACK_INDEX_PREFIX = "s:";
+
+/** AES-CTR counter block length. */
+const NONCE_BYTES = 16;
+
+/** Build the resource key inside a *stack DO*. */
+const resourceKey = (stage: string, fqn: string) =>
+  `${RESOURCE_PREFIX}${stage}${SEP}${fqn}`;
+
+/** Prefix matching every resource key inside a specific stage. */
+const stagePrefix = (stage: string) => `${RESOURCE_PREFIX}${stage}${SEP}`;
+
+/**
+ * Parse a resource key back into its (stage, fqn) tuple. Returns
+ * undefined for keys that do not match the expected shape.
+ */
+const parseResourceKey = (
+  key: string,
+): { stage: string; fqn: string } | undefined => {
+  if (!key.startsWith(RESOURCE_PREFIX)) return undefined;
+  const rest = key.slice(RESOURCE_PREFIX.length);
+  const sep = rest.indexOf(SEP);
+  if (sep < 0) return undefined;
+  return { stage: rest.slice(0, sep), fqn: rest.slice(sep + 1) };
+};
+
+/**
+ * Allocate a `Uint8Array` over a fresh `ArrayBuffer` (not shared) so
+ * the resulting buffer satisfies Web Crypto's `BufferSource` type
+ * constraint under strict DOM typings.
+ */
+const allocBytes = (size: number): Uint8Array<ArrayBuffer> =>
+  new Uint8Array(new ArrayBuffer(size));
+
+const toB64 = (bytes: Uint8Array): string => {
+  let s = "";
+  for (let i = 0; i < bytes.byteLength; i++)
+    s += String.fromCharCode(bytes[i]!);
+  return btoa(s);
+};
+
+const fromB64 = (s: string): Uint8Array<ArrayBuffer> => {
+  const bin = atob(s);
+  const bytes = allocBytes(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return bytes;
+};
+
+const hexToBytes = (hex: string): Uint8Array<ArrayBuffer> => {
+  const bytes = allocBytes(hex.length / 2);
+  for (let i = 0; i < bytes.length; i++) {
+    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+};

package/src/Cloudflare/StateStore/Token.ts

@@ -0,0 +1,62 @@
+import { Random } from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+/**
+ * The account-wide Secrets Store that backs every secret used by the
+ * state store worker. `SecretsStore` adopts the single store that
+ * already exists on the account, or creates one if none exists.
+ */
+export const Store = Cloudflare.SecretsStore("StateStoreSecrets");
+
+/**
+ * The randomly generated bearer token value. Generated once on create
+ * and persisted in alchemy state, so subsequent deploys keep the same
+ * value unless the resource is replaced.
+ */
+export const TokenValue = Random("StateStoreAuthTokenValue");
+
+/**
+ * The name of the secret in the Cloudflare Secrets Store that contains the bearer token.
+ */
+export const AuthTokenSecretName = "AlchemyStateStoreToken" as const;
+
+/**
+ * The bearer token used to authenticate every request to the state
+ * store worker. The value comes from {@link TokenValue} and lives in
+ * the account-wide Cloudflare Secrets Store so it can be bound into
+ * the worker without bundling the raw string.
+ */
+export const AuthToken = Effect.gen(function* () {
+  const store = yield* Store;
+  const random = yield* TokenValue;
+  return yield* Cloudflare.Secret(AuthTokenSecretName, {
+    store,
+    value: random.text,
+  });
+});
+
+/**
+ * A 32-byte (256-bit) random value, hex-encoded, that seeds the
+ * AES-CTR key used to encrypt resource state at rest. Generated once
+ * and persisted, so the ciphertext stored by the Durable Object can
+ * always be decrypted by subsequent worker boots.
+ */
+export const EncryptionKeyValue = Random("StateStoreEncryptionKeyValue", {
+  bytes: 32,
+});
+
+/**
+ * The encryption key secret. The raw hex-encoded bytes live inside
+ * Cloudflare's Secrets Store; the Durable Object binds to it at
+ * runtime to derive an AES-CTR `CryptoKey` via Web Crypto's
+ * `subtle.importKey`.
+ */
+export const EncryptionKey = Effect.gen(function* () {
+  const store = yield* Store;
+  const random = yield* EncryptionKeyValue;
+  return yield* Cloudflare.Secret("StateStoreEncryptionKey", {
+    store,
+    value: random.text,
+  });
+});

package/src/Cloudflare/StateStore/index.ts

@@ -0,0 +1 @@
+export { state } from "./State.ts";

package/src/Cloudflare/Website/StaticSite.ts

@@ -83,28 +83,41 @@ export type StaticSite = ReturnType<typeof StaticSite>;
  * });
  * ```
  */
-export const StaticSite = <const Bindings extends WorkerBindingProps = {}>(
+export const StaticSite = <
+  const Bindings extends WorkerBindingProps = {},
+  Req = never,
+>(
   id: string,
-  props: InputProps<StaticSiteProps<Bindings>>,
+  propsEff:
+    | InputProps<StaticSiteProps<Bindings>>
+    | Effect.Effect<InputProps<StaticSiteProps<Bindings>>, never, Req>,
 ) =>
   Effect.gen(function* () {
-    // TODO(sam): local dev/hmr support?
-    const build = yield* Command("Build", {
-      command: props.command,
-      cwd: props.cwd,
-      memo: props.memo,
-      outdir: props.outdir,
-      env: props.env,
-    });
+    const props = Effect.isEffect(propsEff)
+      ? propsEff
+      : Effect.succeed(propsEff);
 
-    const worker = yield* Worker<Bindings, WorkerAssetsConfig>("Worker", {
-      ...props,
-      assets: {
-        path: build.outdir,
-        hash: build.hash,
-        config: props.assetsConfig,
-      },
-    });
+    // TODO(sam): local dev/hmr support?
+    const build = yield* Command(
+      "Build",
+      Effect.map(props, (props) => ({
+        command: props.command,
+        cwd: props.cwd,
+        memo: props.memo,
+        outdir: props.outdir,
+        env: props.env,
+      })),
+    );
 
-    return worker;
+    return yield* Worker<Bindings, WorkerAssetsConfig, Req>(
+      "Worker",
+      Effect.map(props, (props) => ({
+        ...props,
+        assets: {
+          path: build.outdir,
+          hash: build.hash,
+          config: props.assetsConfig,
+        },
+      })),
+    );
   }).pipe(Namespace.push(id));

package/src/Cloudflare/Website/Vite.ts

@@ -1,3 +1,4 @@
+import * as Effect from "effect/Effect";
 import type { MemoOptions } from "../../Build/Memo.ts";
 import type { InputProps } from "../../Input.ts";
 import {
@@ -106,15 +107,26 @@ export interface ViteProps<
  * });
  * ```
  */
-export const Vite = <const Bindings extends WorkerBindingProps = {}>(
+export const Vite = <
+  const Bindings extends WorkerBindingProps = {},
+  Req = never,
+>(
   id: string,
-  props: InputProps<ViteProps<Bindings>> = {},
+  propsEff?:
+    | InputProps<ViteProps<Bindings>>
+    | Effect.Effect<InputProps<ViteProps<Bindings>>, never, Req>,
 ) =>
-  Worker<Bindings, WorkerAssetsConfig>(id, {
-    ...props,
-    main: undefined!,
-    vite: {
-      rootDir: props.rootDir,
-      memo: props.memo,
-    },
-  });
+  Worker<Bindings, WorkerAssetsConfig, Req>(
+    id,
+    Effect.map(
+      Effect.isEffect(propsEff) ? propsEff : Effect.succeed(propsEff),
+      (props) => ({
+        ...props,
+        main: undefined!,
+        vite: {
+          rootDir: props?.rootDir,
+          memo: props?.memo,
+        },
+      }),
+    ),
+  );

package/src/Cloudflare/Workers/DurableObjectNamespace.ts

@@ -100,6 +100,7 @@ export type DurableObjectServices =
   | DurableObjectNamespace
   | DurableObjectState
   | WorkerServices
+  | WorkerEnvironment
   | PlatformServices;
 
 export interface DurableObjectNamespaceProps {
@@ -514,12 +515,6 @@ export const DurableObjectNamespace: DurableObjectNamespaceClass =
                     Effect.provideService(DurableObjectState, doState),
                     Effect.provideService(WorkerEnvironment, env),
                     Effect.map((methods: any) => {
-                      console.log(
-                        "[DurableObject] wrapping methods:",
-                        Object.keys(methods),
-                        "own:",
-                        Object.getOwnPropertyNames(methods),
-                      );
                       const wrapped: Record<string, unknown> = {};
                       for (const key of Object.getOwnPropertyNames(methods)) {
                         const value = methods[key];

package/src/Cloudflare/Workers/HttpServer.ts

@@ -14,7 +14,7 @@ import { isWorkerEvent, type WorkerServices } from "./Worker.ts";
 export type HttpEffect = Http.HttpEffect<WorkerServices>;
 
 export const workersHttpHandler = <Req = never>(
-  handler: Http.HttpEffect<Req>,
+  handler: Http.HttpEffect<Req> | Effect.Effect<Http.HttpEffect<Req>>,
 ) => {
   const safeHandler = Http.safeHttpEffect(handler);
   return (event: any) => {

package/src/Cloudflare/Workers/InferEnv.ts

@@ -22,6 +22,8 @@ type GetBindingType<T> = T extends Cloudflare.Assets
       ? R2Bucket
       : T extends Cloudflare.KVNamespace
         ? KVNamespace
-        : T extends Cloudflare.DurableObjectNamespaceLike
-          ? DurableObjectNamespace<Exclude<T["Shape"], undefined>>
-          : never;
+        : T extends Cloudflare.Queue
+          ? Queue<unknown>
+          : T extends Cloudflare.DurableObjectNamespaceLike
+            ? DurableObjectNamespace<Exclude<T["Shape"], undefined>>
+            : never;