example(cloudflare-worker-auth): use the real @alchemy.run/pr-package library

examples/cloudflare-worker-auth/alchemy.run.ts

@@ -1,11 +1,11 @@
+import * as PrPackage from "@alchemy.run/pr-package";
 import * as Alchemy from "alchemy";
 import * as Cloudflare from "alchemy/Cloudflare";
 import * as Output from "alchemy/Output";
 import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
 
 import Api from "./src/Api.ts";
-import { AuthTokenValue } from "./src/AuthToken.ts";
 
 export default Alchemy.Stack(
   "CloudflareWorkerAuthExample",
@@ -14,7 +14,7 @@ export default Alchemy.Stack(
     state: Cloudflare.state(),
   },
   Effect.gen(function* () {
-    const authToken = yield* AuthTokenValue;
+    const authToken = yield* PrPackage.AuthTokenValue;
     const api = yield* Api;
 
     return {

examples/cloudflare-worker-auth/package.json

@@ -18,6 +18,7 @@
     "test": "bun test"
   },
   "dependencies": {
+    "@alchemy.run/pr-package": "workspace:*",
     "@cloudflare/workers-types": "catalog:",
     "@effect/platform-bun": "catalog:",
     "@effect/platform-node": "catalog:",

examples/cloudflare-worker-auth/src/Api.ts

@@ -1,54 +1,20 @@
+import * as PrPackage from "@alchemy.run/pr-package";
 import * as Cloudflare from "alchemy/Cloudflare";
-import * as Effect from "effect/Effect";
-import * as Redacted from "effect/Redacted";
-import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
-import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
-import { AuthToken } from "./AuthToken.ts";
 
 /**
- * A Worker with a single bearer-token protected route, mirroring the auth
- * check in `@alchemy.run/pr-package`.
+ * The real `@alchemy.run/pr-package` Worker. `PrPackage.handler` wires up the
+ * R2 bucket, KV tag index, Secrets Store bearer token, and the PackageStore
+ * Durable Object internally — this file is the Worker entry, so it must set
+ * `main: import.meta.filename`.
  *
- * `Cloudflare.Secret.bind(...)` resolves to `Redacted<string>`. The comparison
- * MUST unwrap it with `Redacted.value(expected)` — coercing a `Redacted` to a
- * string yields the literal `"<redacted>"`, so `Bearer ${expected}` would
- * compare against `"Bearer <redacted>"` and silently accept the wrong token.
- * See https://github.com/alchemy-run/alchemy-effect/pull/598.
+ * The handler's bearer-token check is the worker side of the bug fixed in
+ * https://github.com/alchemy-run/alchemy-effect/pull/598.
  */
 export default class Api extends Cloudflare.Worker<Api>()(
   "Api",
   {
     main: import.meta.filename,
+    url: true,
   },
-  Effect.gen(function* () {
-    const authToken = yield* Cloudflare.Secret.bind(AuthToken);
-
-    return {
-      fetch: Effect.gen(function* () {
-        const request = yield* HttpServerRequest;
-
-        if (request.url.startsWith("/protected")) {
-          const authHeader = request.headers.authorization;
-          const expected = yield* authToken;
-          if (
-            !authHeader ||
-            authHeader !== `Bearer ${Redacted.value(expected)}`
-          ) {
-            return HttpServerResponse.text("unauthorized", { status: 401 });
-          }
-          return HttpServerResponse.text("ok");
-        }
-
-        return HttpServerResponse.text("public");
-      }).pipe(
-        Effect.catchTag("SecretError", (err) =>
-          Effect.succeed(
-            HttpServerResponse.text(`failed to read secret: ${err.message}`, {
-              status: 500,
-            }),
-          ),
-        ),
-      ),
-    };
-  }).pipe(Effect.provide(Cloudflare.SecretBindingLive)),
+  PrPackage.handler(),
 ) {}