@homeflare/alchemy 0.27.1 → 0.27.3

package/README.md

@@ -4,8 +4,9 @@ Custom [Alchemy](https://alchemy.run) providers for gaps the vendor SDK leaves.
 
 ```sh
 bun add @homeflare/alchemy alchemy@2.0.0-beta.79 effect@4.0.0-rc.115 \
-        @effect/platform-node@4.0.0-rc.115 cloudflare@4.5.0 mime@4.1.0 \
-        @distilled.cloud/cloudflare@1.0.0-rc.12 @effect/sql-pg@4.0.0-rc.115
+        @effect/platform-node@4.0.0-rc.115 mime@4.1.0 \
+        @distilled.cloud/cloudflare@1.0.0-rc.12 @distilled.cloud/forgejo@1.0.0-rc.12 \
+        @effect/sql-pg@4.0.0-rc.115
 ```
 
 ⛔ **Every one of those is required, and you also need an `overrides` block** — see

package/dist/cloudflare/fake-r2-lock.d.ts

@@ -0,0 +1,53 @@
+/**
+ * A fake Cloudflare R2 bucket-lock API for r2-bucket-lock.test.ts — an in-memory `fetch` handed to
+ * Effect's real FetchHttpClient through its `Fetch` reference, so the tests exercise distilled's
+ * real path assembly, header encoding, envelope decoding and error matching. Same idiom as
+ * fake-mesh.ts, for the route `GET`/`PUT /accounts/<FAKE_ACCOUNT>/r2/buckets/<name>/lock`.
+ *
+ * ⛔ TEST-ONLY, AND NO NETWORK. No provider imports this file. The base URL is RFC 2606
+ *   `api.example.com`, and any request outside that route throws, so a mis-wired test fails
+ *   instead of reaching a real API.
+ * ★ `existingBuckets` MODELS THE VENDOR'S OWN DISTINCTION. A bucket not in the set answers
+ *   `NoSuchBucket` (code 10006) on both verbs, matching the 404 the doc comment in
+ *   r2-bucket-lock.ts measured. A bucket in the set with no rules answers `{}` on GET, matching
+ *   "never locked" — both collapse to "absent" in `readLock`, but the fake keeps them distinct so
+ *   a test can put a bucket in either state on purpose.
+ * ★ `onRoute` OVERRIDES ONE REQUEST. A test uses it to answer a request with an arbitrary
+ *   `Response` — a non-404 status carrying code 10006 (proves matching is by code, not status), or
+ *   a different tagged error entirely (`InvalidRoute`, code 7003) to prove it does NOT fall into
+ *   `readLock`'s `NoSuchBucket` catch.
+ */
+import { type Credentials } from '@distilled.cloud/cloudflare/Credentials';
+import * as Layer from 'effect/Layer';
+import type { R2LockRule } from './lock-rules.ts';
+export declare const FAKE_BASE = "https://api.example.com/client/v4";
+export declare const FAKE_ACCOUNT = "00000000000000000000000000000002";
+/** ⚠️ A placeholder, not a credential. */
+export declare const FAKE_API_TOKEN = "placeholder-api-token";
+export type Seen = {
+    readonly method: string;
+    readonly path: string;
+    readonly headers: Record<string, string>;
+    readonly body: unknown;
+};
+export declare const fakeFailure: (status: number, code: number, message: string) => Response;
+/** The response `NoSuchBucket` matches: code 10006, conventionally at 404. */
+export declare const noSuchBucket: (status?: number) => Response;
+export type FakeOptions = {
+    /** Buckets the account has. Any other name is `NoSuchBucket` on both GET and PUT. */
+    readonly existingBuckets?: readonly string[];
+    /** Override one request's response. `undefined` falls through to the default route. */
+    readonly onRoute?: (method: string, bucketName: string) => Response | undefined;
+};
+export declare const fakeR2Lock: (options?: FakeOptions) => {
+    existing: Set<string>;
+    fetch: typeof fetch;
+    locks: Map<string, readonly R2LockRule[]>;
+    seen: Seen[];
+};
+export type FakeR2Lock = ReturnType<typeof fakeR2Lock>;
+/** distilled Credentials + the real FetchHttpClient over the fake — `CloudflareOpContext`. */
+export declare const fakeR2LockLayer: (fake: FakeR2Lock, credentials?: Layer.Layer<Credentials>) => Layer.Layer<Credentials | import("effect/unstable/http/HttpClient").HttpClient, never, never>;
+/** The writes the fake saw, in order: `['PUT', 'GET', …]`. */
+export declare const writes: (fake: FakeR2Lock) => string[];
+//# sourceMappingURL=fake-r2-lock.d.ts.map

package/dist/cloudflare/fake-r2-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-r2-lock.d.ts","sourceRoot":"","sources":["../../src/cloudflare/fake-r2-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,KAAK,WAAW,EAAgB,MAAM,yCAAyC,CAAC;AACzF,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,eAAO,MAAM,SAAS,sCAAsC,CAAC;AAC7D,eAAO,MAAM,YAAY,qCAAqC,CAAC;AAC/D,0CAA0C;AAC1C,eAAO,MAAM,cAAc,0BAA0B,CAAC;AAEtD,MAAM,MAAM,IAAI,GAAG;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,CAAC;AAIF,eAAO,MAAM,WAAW,WAAY,MAAM,QAAQ,MAAM,WAAW,MAAM,aAItE,CAAC;AAEJ,8EAA8E;AAC9E,eAAO,MAAM,YAAY,+BAC2C,CAAC;AAErE,MAAM,MAAM,WAAW,GAAG;IACxB,qFAAqF;IACrF,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,uFAAuF;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,QAAQ,GAAG,SAAS,CAAC;CACjF,CAAC;AAEF,eAAO,MAAM,UAAU,aAAa,WAAW;;;;;CA4C9C,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAEvD,8FAA8F;AAC9F,eAAO,MAAM,eAAe,SACpB,UAAU,gBACH,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,kGASpC,CAAC;AAEJ,8DAA8D;AAC9D,eAAO,MAAM,MAAM,SAAU,UAAU,aAC2B,CAAC"}

package/dist/cloudflare/index.d.ts

@@ -1,11 +1,10 @@
 /**
  * Cloudflare providers for Alchemy — the gaps the vendor SDK leaves.
  *
- * ★ Built on vendor SDKs, not hand-rolled HTTP. `R2BucketLock` uses the official `cloudflare`
- *   SDK, which already has `r2.buckets.locks.update/get` over the documented endpoints.
- *   `MeshNode` uses `@distilled.cloud/cloudflare`, the SDK Alchemy's own Cloudflare providers
- *   use, because `cloudflare@4.5.0` cannot create an HA node (mesh-node-api.ts). Either way
- *   there is no path string this package invents.
+ * ★ Built on vendor SDKs, not hand-rolled HTTP. Both `R2BucketLock` and `MeshNode` call
+ *   `@distilled.cloud/cloudflare`, the SDK Alchemy's own Cloudflare providers use — R2BucketLock
+ *   over `/r2` (`getBucketLock`/`putBucketLock`), MeshNode over `/zero-trust`, because
+ *   `cloudflare@4.5.0` cannot create an HA node (mesh-node-api.ts). Neither invents a path string.
  */
 export type { R2LockRule } from './lock-rules.ts';
 export { R2BucketLock, type R2BucketLockProps } from './r2-bucket-lock.ts';

package/dist/cloudflare/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACnF,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACnF,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC"}

package/dist/cloudflare/index.js

@@ -2,32 +2,11 @@
 import { Unowned } from "alchemy/AdoptPolicy";
 import * as Provider from "alchemy/Provider";
 import { Resource } from "alchemy/Resource";
-import { NotFoundError } from "cloudflare";
-import * as Effect2 from "effect/Effect";
-
-// src/cloudflare/client.ts
-import Cloudflare from "cloudflare";
-import * as Config from "effect/Config";
+import { Credentials } from "@distilled.cloud/cloudflare/Credentials";
+import * as r2 from "@distilled.cloud/cloudflare/r2";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Redacted2 from "effect/Redacted";
-
-class CloudflareApi extends Context.Service()("homeflare/CloudflareApi") {
-}
-var makeClient = (options) => new Cloudflare({
-  apiToken: options.apiToken,
-  ...options.fetch === undefined ? {} : { fetch: options.fetch }
-});
-var MISSING_TOKEN = "CLOUDFLARE_API_TOKEN is not set. Mint a short-lived, scoped token and export it before " + "role named in estate.stack.ts; running `alchemy` directly skips that and there is no default.";
-var EMPTY_TOKEN = "CLOUDFLARE_API_TOKEN is set but EMPTY. That is a denied or missing OpenBao grant on the " + "stack’s role, not a rotated token — re-mint it rather than rotating anything at Cloudflare.";
-var CloudflareApiLive = Layer.effect(CloudflareApi, Effect.gen(function* () {
-  const token = yield* Config.Redacted("CLOUDFLARE_API_TOKEN").pipe(Effect.catchTag("ConfigError", () => Effect.die(new Error(MISSING_TOKEN))));
-  const value2 = Redacted2.value(token);
-  if (value2.length === 0)
-    return yield* Effect.die(new Error(EMPTY_TOKEN));
-  return makeClient({ apiToken: value2 });
-}));
+import * as HttpClient from "effect/unstable/http/HttpClient";
 
 // src/cloudflare/lock-rules.ts
 var jurisdictionOf = (props) => props.jurisdiction ?? "default";
@@ -60,15 +39,9 @@ var toBody = (rules) => ({
 var R2BucketLock = Resource("Cloudflare.R2BucketLock", {
   defaultRemovalPolicy: "retain"
 });
-var readLock = (client, props, written) => Effect2.gen(function* () {
+var readLock = (props, written) => Effect.gen(function* () {
   const jurisdiction = jurisdictionOf(props);
-  const live = yield* Effect2.tryPromise({
-    try: () => client.r2.buckets.locks.get(props.bucketName, {
-      account_id: props.accountId,
-      jurisdiction
-    }),
-    catch: (cause) => cause
-  }).pipe(Effect2.catchIf((cause) => cause instanceof NotFoundError, () => Effect2.succeed(undefined)), Effect2.orDie);
+  const live = yield* r2.getBucketLock({ accountId: props.accountId, bucketName: props.bucketName, jurisdiction }).pipe(Effect.catchTag("NoSuchBucket", () => Effect.succeed(undefined)), Effect.orDie);
   if (live === undefined)
     return;
   const rules = live.rules ?? [];
@@ -81,53 +54,56 @@ var readLock = (client, props, written) => Effect2.gen(function* () {
   };
   return written ? attributes : Unowned(attributes);
 });
-var reconcileLock = (client, news, output) => Effect2.gen(function* () {
+var reconcileLock = (news, output) => Effect.gen(function* () {
   const jurisdiction = jurisdictionOf(news);
   if (output !== undefined && rulesEqual(output.rules, news.rules))
     return output;
-  yield* Effect2.promise(() => client.r2.buckets.locks.update(news.bucketName, {
-    account_id: news.accountId,
+  yield* r2.putBucketLock({
+    accountId: news.accountId,
+    bucketName: news.bucketName,
     jurisdiction,
     ...toBody(news.rules)
-  }));
+  }).pipe(Effect.orDie);
   return { bucketName: news.bucketName, jurisdiction, rules: news.rules };
 });
-var deleteLock = (client, output, accountId) => Effect2.gen(function* () {
-  yield* Effect2.promise(() => client.r2.buckets.locks.update(output.bucketName, {
-    account_id: accountId,
+var deleteLock = (output, accountId) => Effect.gen(function* () {
+  yield* r2.putBucketLock({
+    accountId,
+    bucketName: output.bucketName,
     jurisdiction: output.jurisdiction,
     rules: []
-  }));
+  }).pipe(Effect.orDie);
 });
-var R2BucketLockProvider = () => Provider.effect(R2BucketLock, Effect2.gen(function* () {
-  const client = yield* CloudflareApi;
+var R2BucketLockProvider = () => Provider.effect(R2BucketLock, Effect.gen(function* () {
+  const services = Context.make(Credentials, yield* Credentials).pipe(Context.add(HttpClient.HttpClient, yield* HttpClient.HttpClient));
+  const run = (effect2) => Effect.provideContext(effect2, services);
   return R2BucketLock.Provider.of({
-    list: () => Effect2.succeed([]),
+    list: () => Effect.succeed([]),
     nuke: { singleton: true },
-    read: Effect2.fn(function* ({ olds, output }) {
+    read: Effect.fn(function* ({ olds, output }) {
       const props = olds ?? undefined;
       if (props === undefined)
         return;
-      return yield* readLock(client, props, output !== undefined);
+      return yield* run(readLock(props, output !== undefined));
     }),
-    reconcile: Effect2.fn(({ news, output }) => reconcileLock(client, news, output)),
-    delete: Effect2.fn(({ olds, output }) => deleteLock(client, output, olds.accountId))
+    reconcile: Effect.fn(({ news, output }) => run(reconcileLock(news, output))),
+    delete: Effect.fn(({ olds, output }) => run(deleteLock(output, olds.accountId)))
   });
 }));
 // src/cloudflare/mesh-node.ts
-import { Credentials } from "@distilled.cloud/cloudflare/Credentials";
-import * as Cloudflare2 from "alchemy/Cloudflare";
+import { Credentials as Credentials2 } from "@distilled.cloud/cloudflare/Credentials";
+import * as Cloudflare from "alchemy/Cloudflare";
 import { isResolved } from "alchemy/Diff";
 import * as Provider2 from "alchemy/Provider";
 import { Resource as Resource2 } from "alchemy/Resource";
 import * as Context2 from "effect/Context";
-import * as Effect5 from "effect/Effect";
-import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as Effect4 from "effect/Effect";
+import * as HttpClient3 from "effect/unstable/http/HttpClient";
 
 // src/cloudflare/mesh-node-api.ts
 import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
 import * as Data from "effect/Data";
-import * as Effect3 from "effect/Effect";
+import * as Effect2 from "effect/Effect";
 import * as Stream from "effect/Stream";
 
 class MeshNodeError extends Data.TaggedError("MeshNodeError") {
@@ -141,22 +117,22 @@ var observe = (raw) => {
   const status = typeof raw.status === "string" && STATUSES.includes(raw.status) ? raw.status : undefined;
   return { id: raw.id, name: raw.name ?? "", status };
 };
-var getNode = (accountId, nodeId) => zeroTrust.getTunnelWarpConnector({ accountId, tunnelId: nodeId }).pipe(Effect3.map(observe), Effect3.catchTag("TunnelNotFound", () => Effect3.succeed(undefined)));
-var findNodeByName = (accountId, name) => zeroTrust.listTunnelWarpConnectors.items({ accountId, name, isDeleted: false }).pipe(Stream.map(observe), Stream.filter((node) => node !== undefined && node.name === name), Stream.runCollect, Effect3.flatMap((chunk) => {
+var getNode = (accountId, nodeId) => zeroTrust.getTunnelWarpConnector({ accountId, tunnelId: nodeId }).pipe(Effect2.map(observe), Effect2.catchTag("TunnelNotFound", () => Effect2.succeed(undefined)));
+var findNodeByName = (accountId, name) => zeroTrust.listTunnelWarpConnectors.items({ accountId, name, isDeleted: false }).pipe(Stream.map(observe), Stream.filter((node) => node !== undefined && node.name === name), Stream.runCollect, Effect2.flatMap((chunk) => {
   const matches = Array.from(chunk);
   if (matches.length <= 1)
-    return Effect3.succeed(matches[0]);
+    return Effect2.succeed(matches[0]);
   const ids = matches.map((node) => node.id).join(", ");
-  return Effect3.fail(new MeshNodeError({
+  return Effect2.fail(new MeshNodeError({
     message: `Mesh node name "${name}" matches ${matches.length} live nodes (${ids}). Names are unique per account, so refusing to guess which one is meant.`
   }));
 }));
-var createNode = (accountId, name, ha) => zeroTrust.createTunnelWarpConnector({ accountId, name, ha }).pipe(Effect3.flatMap((raw) => {
+var createNode = (accountId, name, ha) => zeroTrust.createTunnelWarpConnector({ accountId, name, ha }).pipe(Effect2.flatMap((raw) => {
   const node = observe(raw);
-  return node === undefined ? Effect3.fail(new MeshNodeError({ message: `Creating Mesh node "${name}" returned no id.` })) : Effect3.succeed(node);
+  return node === undefined ? Effect2.fail(new MeshNodeError({ message: `Creating Mesh node "${name}" returned no id.` })) : Effect2.succeed(node);
 }));
-var renameNode = (accountId, nodeId, name) => zeroTrust.patchTunnelWarpConnector({ accountId, tunnelId: nodeId, name }).pipe(Effect3.map((raw) => observe(raw) ?? { id: nodeId, name, status: undefined }));
-var deleteNode = (accountId, nodeId) => zeroTrust.deleteTunnelWarpConnector({ accountId, tunnelId: nodeId }).pipe(Effect3.asVoid, Effect3.catchTag("TunnelNotFound", () => Effect3.void));
+var renameNode = (accountId, nodeId, name) => zeroTrust.patchTunnelWarpConnector({ accountId, tunnelId: nodeId, name }).pipe(Effect2.map((raw) => observe(raw) ?? { id: nodeId, name, status: undefined }));
+var deleteNode = (accountId, nodeId) => zeroTrust.deleteTunnelWarpConnector({ accountId, tunnelId: nodeId }).pipe(Effect2.asVoid, Effect2.catchTag("TunnelNotFound", () => Effect2.void));
 
 // src/cloudflare/mesh-node-form.ts
 var validateMeshNode = (props) => {
@@ -193,7 +169,7 @@ var diffMeshNode = (news, output, accountId) => {
 
 // src/cloudflare/mesh-node-lifecycle.ts
 import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
-import * as Effect4 from "effect/Effect";
+import * as Effect3 from "effect/Effect";
 var attributesOf = (node, accountId, ha) => ({
   id: node.id,
   accountId,
@@ -201,7 +177,7 @@ var attributesOf = (node, accountId, ha) => ({
   status: node.status,
   ha
 });
-var readMeshNode = (accountId, olds, output) => Effect4.gen(function* () {
+var readMeshNode = (accountId, olds, output) => Effect3.gen(function* () {
   const account = output?.accountId ?? accountId;
   if (output !== undefined) {
     const node = yield* getNode(account, output.id);
@@ -222,32 +198,32 @@ var REOWN = "drop this resource's state row (alchemy state rm, which leaves the
 var oldNodeHoldsName = (name, holder) => new MeshNodeError({
   message: `Mesh node "${name}" already exists (${holder}) and is not the node this resource tracks, ` + "so it is left alone: names are unique per account. If this deploy changed `ha` and kept " + "the name, it is this resource's old node, kept by MeshNode's default " + "RemovalPolicy.retain because HA cannot change in place. To replace it (a new id, token and " + "Mesh IP per replica), deploy once with .pipe(RemovalPolicy.destroy()), which deletes it " + `first, or delete it by hand. To keep it, reverting \`ha\` is not enough: ${REOWN}, with ` + "the original `ha`. Otherwise it is another node: do not delete it. Choose another name, " + `or, if it is meant to be this one, check its HA badge, then ${REOWN}.`
 });
-var raced = (accountId, name) => findNodeByName(accountId, name).pipe(Effect4.flatMap((holder) => Effect4.fail(holder === undefined ? nameTaken(name, "not a live Mesh node: another tunnel type, or a just-deleted node") : new MeshNodeError({
+var raced = (accountId, name) => findNodeByName(accountId, name).pipe(Effect3.flatMap((holder) => Effect3.fail(holder === undefined ? nameTaken(name, "not a live Mesh node: another tunnel type, or a just-deleted node") : new MeshNodeError({
   message: `Mesh node "${name}" (${holder.id}) appeared between this deploy's lookup and its ` + "create. The likeliest cause is this deploy itself: the SDK retries a create whose " + "response was lost. If so, check its HA badge matches the declared `ha`, then " + "adopt it: adopt(true) after a first create, but after a replace " + `${REOWN}, because adopt(true) alone does not act on a replace's row. ` + "Otherwise another creator raced this one."
 }))));
-var createFresh = (accountId, news) => Effect4.gen(function* () {
+var createFresh = (accountId, news) => Effect3.gen(function* () {
   const existing = yield* findNodeByName(accountId, news.name);
   if (existing !== undefined)
-    return yield* Effect4.fail(oldNodeHoldsName(news.name, existing.id));
-  const node = yield* createNode(accountId, news.name, news.ha).pipe(Effect4.catchTag("DuplicateTunnelName", () => raced(accountId, news.name)));
+    return yield* Effect3.fail(oldNodeHoldsName(news.name, existing.id));
+  const node = yield* createNode(accountId, news.name, news.ha).pipe(Effect3.catchTag("DuplicateTunnelName", () => raced(accountId, news.name)));
   return attributesOf(node, accountId, news.ha);
 });
-var reconcileMeshNode = (accountId, news, output) => Effect4.gen(function* () {
+var reconcileMeshNode = (accountId, news, output) => Effect3.gen(function* () {
   const invalid = validateMeshNode(news);
   if (invalid !== undefined)
-    return yield* Effect4.fail(invalid);
+    return yield* Effect3.fail(invalid);
   const owned = output !== undefined && output.accountId === accountId ? output : undefined;
   const live = owned === undefined ? undefined : yield* getNode(accountId, owned.id);
   if (owned === undefined || live === undefined)
     return yield* createFresh(accountId, news);
   if (owned.ha !== news.ha) {
-    return yield* Effect4.fail(new MeshNodeError({
+    return yield* Effect3.fail(new MeshNodeError({
       message: `MeshNode "${news.name}": \`ha\` is create-only (stored ${owned.ha}, declared ${news.ha}). Plan again so the change is a replace.`
     }));
   }
   if (live.name === news.name)
     return attributesOf(live, accountId, owned.ha);
-  const renamed = yield* renameNode(accountId, live.id, news.name).pipe(Effect4.catchTag("DuplicateTunnelName", () => Effect4.fail(nameTaken(news.name, "held by another tunnel"))));
+  const renamed = yield* renameNode(accountId, live.id, news.name).pipe(Effect3.catchTag("DuplicateTunnelName", () => Effect3.fail(nameTaken(news.name, "held by another tunnel"))));
   return attributesOf(renamed, accountId, owned.ha);
 });
 var deleteMeshNode = (output) => deleteNode(output.accountId, output.id);
@@ -256,80 +232,80 @@ var deleteMeshNode = (output) => deleteNode(output.accountId, output.id);
 var MeshNode = Resource2("Cloudflare.MeshNode", {
   defaultRemovalPolicy: "retain"
 });
-var accountId = Effect5.gen(function* () {
-  const resolved = yield* yield* Cloudflare2.CloudflareEnvironment;
+var accountId = Effect4.gen(function* () {
+  const resolved = yield* yield* Cloudflare.CloudflareEnvironment;
   return resolved.accountId;
 });
-var MeshNodeProvider = () => Provider2.effect(MeshNode, Effect5.gen(function* () {
-  const services = Context2.make(Cloudflare2.CloudflareEnvironment, yield* Cloudflare2.CloudflareEnvironment).pipe(Context2.add(Credentials, yield* Credentials), Context2.add(HttpClient.HttpClient, yield* HttpClient.HttpClient));
-  const run = (effect4) => Effect5.provideContext(effect4, services);
+var MeshNodeProvider = () => Provider2.effect(MeshNode, Effect4.gen(function* () {
+  const services = Context2.make(Cloudflare.CloudflareEnvironment, yield* Cloudflare.CloudflareEnvironment).pipe(Context2.add(Credentials2, yield* Credentials2), Context2.add(HttpClient3.HttpClient, yield* HttpClient3.HttpClient));
+  const run = (effect3) => Effect4.provideContext(effect3, services);
   return MeshNode.Provider.of({
     stables: ["id", "accountId", "ha"],
-    list: () => Effect5.succeed([]),
+    list: () => Effect4.succeed([]),
     nuke: { skip: true },
-    diff: ({ news, output }) => run(Effect5.gen(function* () {
+    diff: ({ news, output }) => run(Effect4.gen(function* () {
       const invalid = isResolved(news) ? validateMeshNode(news) : undefined;
       if (invalid !== undefined)
-        return yield* Effect5.fail(invalid);
+        return yield* Effect4.fail(invalid);
       return diffMeshNode(news, output, yield* accountId);
     })),
-    read: ({ olds, output }) => run(Effect5.flatMap(accountId, (account) => readMeshNode(account, olds, output))),
-    reconcile: ({ news, output }) => run(Effect5.flatMap(accountId, (account) => reconcileMeshNode(account, news, output))),
+    read: ({ olds, output }) => run(Effect4.flatMap(accountId, (account) => readMeshNode(account, olds, output))),
+    reconcile: ({ news, output }) => run(Effect4.flatMap(accountId, (account) => reconcileMeshNode(account, news, output))),
     delete: ({ output }) => run(deleteMeshNode(output))
   });
 }));
 // src/cloudflare/mesh-node-token.ts
-import { Credentials as Credentials2 } from "@distilled.cloud/cloudflare/Credentials";
+import { Credentials as Credentials3 } from "@distilled.cloud/cloudflare/Credentials";
 import * as zeroTrust2 from "@distilled.cloud/cloudflare/zero-trust";
-import * as Effect6 from "effect/Effect";
-import * as Redacted3 from "effect/Redacted";
-var refuseUnsafe = Effect6.gen(function* () {
+import * as Effect5 from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+var refuseUnsafe = Effect5.gen(function* () {
   if ((globalThis.process?.env?.["DISTILLED_DEBUG_HTTP"] ?? "") !== "") {
-    return yield* Effect6.fail(new MeshNodeError({
+    return yield* Effect5.fail(new MeshNodeError({
       message: "Refusing to fetch a Mesh node token while DISTILLED_DEBUG_HTTP is set: the SDK would print the token to stderr. Unset it and run again."
     }));
   }
-  const credentials = yield* yield* Credentials2;
+  const credentials = yield* yield* Credentials3;
   if (credentials.type === "apiKey") {
-    return yield* Effect6.fail(new MeshNodeError({
+    return yield* Effect5.fail(new MeshNodeError({
       message: 'Refusing the Global API Key for a Mesh node token. Mint a short-lived API token with "Cloudflare One Connectors Write" and pass it with fromApiToken.'
     }));
   }
-  if (credentials.type === "apiToken" && Redacted3.value(credentials.apiToken).length === 0) {
-    return yield* Effect6.fail(new MeshNodeError({
+  if (credentials.type === "apiToken" && Redacted.value(credentials.apiToken).length === 0) {
+    return yield* Effect5.fail(new MeshNodeError({
       message: "The Cloudflare API token is EMPTY. That is a missing or denied secrets grant, not a Cloudflare permission: re-mint the token before changing any grant."
     }));
   }
 });
 var resolveId = (ref) => {
   if (ref.id !== undefined)
-    return Effect6.succeed(ref.id);
+    return Effect5.succeed(ref.id);
   const name = ref.name;
-  return Effect6.flatMap(findNodeByName(ref.accountId, name), (node) => node === undefined ? Effect6.fail(new MeshNodeError({ message: `No live Mesh node named "${name}".` })) : Effect6.succeed(node.id));
+  return Effect5.flatMap(findNodeByName(ref.accountId, name), (node) => node === undefined ? Effect5.fail(new MeshNodeError({ message: `No live Mesh node named "${name}".` })) : Effect5.succeed(node.id));
 };
-var fetchMeshNodeToken = (ref) => Effect6.gen(function* () {
+var fetchMeshNodeToken = (ref) => Effect5.gen(function* () {
   yield* refuseUnsafe;
   const nodeId = yield* resolveId(ref);
-  const token = yield* zeroTrust2.getTunnelWarpConnectorToken({ accountId: ref.accountId, tunnelId: nodeId }).pipe(Effect6.catchTag("TunnelNotFound", () => Effect6.fail(new MeshNodeError({
+  const token = yield* zeroTrust2.getTunnelWarpConnectorToken({ accountId: ref.accountId, tunnelId: nodeId }).pipe(Effect5.catchTag("TunnelNotFound", () => Effect5.fail(new MeshNodeError({
     message: `Mesh node ${nodeId} does not exist in account ${ref.accountId}.`
-  }))), Effect6.catchTag("Forbidden", () => Effect6.fail(new MeshNodeError({
+  }))), Effect5.catchTag("Forbidden", () => Effect5.fail(new MeshNodeError({
     message: `Reading Mesh node ${nodeId}'s token was refused (403). The endpoint needs a Write permission such as "Cloudflare One Connectors Write", on a token scoped to account ${ref.accountId}.`
   }))));
   if (typeof token !== "string" || token.length === 0) {
-    return yield* Effect6.fail(new MeshNodeError({ message: `Mesh node ${nodeId} returned an empty token.` }));
+    return yield* Effect5.fail(new MeshNodeError({ message: `Mesh node ${nodeId} returned an empty token.` }));
   }
-  return Redacted3.make(token);
+  return Redacted.make(token);
 });
 // src/cloudflare/providers.ts
-import * as Cloudflare3 from "alchemy/Cloudflare";
+import * as Cloudflare2 from "alchemy/Cloudflare";
 import * as Provider3 from "alchemy/Provider";
-import * as Layer2 from "effect/Layer";
+import * as Layer from "effect/Layer";
 class Providers extends Provider3.ProviderCollection()("HomeflareCloudflare") {
 }
-var providers = () => Layer2.effect(Providers, Provider3.collection([R2BucketLock, MeshNode])).pipe(Layer2.provide(Layer2.mergeAll(R2BucketLockProvider(), MeshNodeProvider().pipe(Layer2.provide(Cloudflare3.CloudflareApiLive()), Layer2.orDie))), Layer2.provideMerge(CloudflareApiLive));
+var providers = () => Layer.effect(Providers, Provider3.collection([R2BucketLock, MeshNode])).pipe(Layer.provide(Layer.mergeAll(R2BucketLockProvider().pipe(Layer.provide(Cloudflare2.CloudflareApiLive()), Layer.orDie), MeshNodeProvider().pipe(Layer.provide(Cloudflare2.CloudflareApiLive()), Layer.orDie))));
 // src/cloudflare/website.ts
 import * as AdoptPolicy from "alchemy/AdoptPolicy";
-import * as Cloudflare4 from "alchemy/Cloudflare";
+import * as Cloudflare3 from "alchemy/Cloudflare";
 import * as RemovalPolicy from "alchemy/RemovalPolicy";
 var ASTRO_FLAGS = ["nodejs_compat", "disable_nodejs_process_v2"];
 function astroWebsite(name, props) {
@@ -340,11 +316,11 @@ function astroWebsite(name, props) {
     sessionKVBindingName: props.sessionKVBindingName ?? false,
     compatibility: { ...props.compatibility, flags: [...flags] }
   };
-  return Cloudflare4.Website.Astro(name, merged).pipe(AdoptPolicy.adopt(true), RemovalPolicy.retain());
+  return Cloudflare3.Website.Astro(name, merged).pipe(AdoptPolicy.adopt(true), RemovalPolicy.retain());
 }
 function viteWebsite(name, props) {
   const merged = { ...props, name: props?.name ?? name };
-  return Cloudflare4.Website.Vite(name, merged).pipe(AdoptPolicy.adopt(true), RemovalPolicy.retain());
+  return Cloudflare3.Website.Vite(name, merged).pipe(AdoptPolicy.adopt(true), RemovalPolicy.retain());
 }
 export {
   MeshNode,
@@ -357,5 +333,5 @@ export {
   viteWebsite
 };
 
-//# debugId=8A155CE09F54FFB164756E2164756E21
+//# debugId=AB671D282C098EA364756E2164756E21
 //# sourceMappingURL=index.js.map