alchemy 2.0.0-beta.14 → 2.0.0-beta.16

package/src/Cloudflare/ApiToken/UserApiToken.ts

@@ -0,0 +1,166 @@
+import * as user from "@distilled.cloud/cloudflare/user";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  buildConditionPayload,
+  conditionFingerprint,
+  policyFingerprint,
+  resolvePolicies,
+  type ApiTokenProps,
+} from "./Common.ts";
+
+export type UserApiToken = Resource<
+  "Cloudflare.UserApiToken",
+  ApiTokenProps,
+  {
+    tokenId: string;
+    name: string;
+    status: "active" | "disabled" | "expired";
+    /**
+     * The plaintext token value. Cloudflare returns this only once, on
+     * creation, so we persist it here for downstream consumers.
+     */
+    value: Redacted.Redacted<string>;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A Cloudflare user-owned API token (`POST /user/tokens`).
+ *
+ * User-owned tokens are tied to the authenticated user's identity. They can
+ * be created by any authenticated user (including OAuth-derived sessions
+ * from `alchemy login`) without needing the account-level
+ * `API Tokens > Write` permission, but they are also revoked if the user
+ * leaves the account.
+ *
+ * For CI tokens, prefer {@link AccountApiToken} so the token survives
+ * personnel changes.
+ *
+ * Policy `resources` are passed through verbatim — no `accountId` rewriting
+ * is performed because user tokens aren't bound to a single account.
+ *
+ * @section Creating a Token
+ * @example A token bound to the authenticated user
+ * ```typescript
+ * const token = yield* Cloudflare.UserApiToken("personal-token", {
+ *   name: "my-personal-token",
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: ["Workers Scripts Read"],
+ *       resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+ *     },
+ *   ],
+ * });
+ * ```
+ */
+export const UserApiToken = Resource<UserApiToken>("Cloudflare.UserApiToken");
+
+type UserApiTokenAttributes = UserApiToken["Attributes"];
+
+const resolveName = (id: string, name: string | undefined) =>
+  Effect.gen(function* () {
+    return name ?? (yield* createPhysicalName({ id }));
+  });
+
+export const UserApiTokenProvider = () =>
+  Provider.effect(
+    UserApiToken,
+    Effect.gen(function* () {
+      const createToken = yield* user.createToken;
+      const updateToken = yield* user.updateToken;
+      const deleteToken = yield* user.deleteToken;
+      const getToken = yield* user.getToken;
+
+      const buildAttributes = (
+        tokenData: {
+          id?: string | null;
+          name?: string | null;
+          status?: "active" | "disabled" | "expired" | null;
+        },
+        value: Redacted.Redacted<string>,
+      ): UserApiTokenAttributes => ({
+        tokenId: tokenData.id ?? "",
+        name: tokenData.name ?? "",
+        status: tokenData.status ?? "active",
+        value,
+      });
+
+      return {
+        stables: ["tokenId"],
+        diff: Effect.fn(function* ({ id, olds, news, output }) {
+          if (!isResolved(news)) return undefined;
+          const oldName = output?.name ?? (yield* resolveName(id, olds?.name));
+          const newName = yield* resolveName(id, news.name);
+          const oldPolicyFp = policyFingerprint(
+            resolvePolicies(olds?.policies ?? [], olds?.accountId),
+          );
+          const newPolicyFp = policyFingerprint(
+            resolvePolicies(news.policies, news.accountId),
+          );
+          const oldCondFp = conditionFingerprint(olds?.condition);
+          const newCondFp = conditionFingerprint(news.condition);
+          if (
+            oldName !== newName ||
+            oldPolicyFp !== newPolicyFp ||
+            oldCondFp !== newCondFp ||
+            (olds?.expiresOn ?? undefined) !== (news.expiresOn ?? undefined) ||
+            (olds?.notBefore ?? undefined) !== (news.notBefore ?? undefined)
+          ) {
+            return { action: "update" } as const;
+          }
+        }),
+        create: Effect.fn(function* ({ id, news }) {
+          const name = yield* resolveName(id, news.name);
+          const policies = resolvePolicies(news.policies, news.accountId);
+          const result = yield* createToken({
+            name,
+            policies,
+            condition: buildConditionPayload(news.condition),
+            expiresOn: news.expiresOn,
+            notBefore: news.notBefore,
+          });
+          if (!result.value) {
+            return yield* Effect.die(
+              `Cloudflare did not return a value for token "${name}".`,
+            );
+          }
+          return buildAttributes(result, Redacted.make(result.value));
+        }),
+        update: Effect.fn(function* ({ id, news, output }) {
+          const name = yield* resolveName(id, news.name);
+          const policies = resolvePolicies(news.policies, news.accountId);
+          const result = yield* updateToken({
+            tokenId: output.tokenId,
+            name,
+            policies,
+            condition: buildConditionPayload(news.condition),
+            expiresOn: news.expiresOn,
+            notBefore: news.notBefore,
+          });
+          // Cloudflare doesn't return the value on update; preserve the
+          // value captured at creation.
+          return buildAttributes(result, output.value);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteToken({ tokenId: output.tokenId }).pipe(
+            Effect.catchTag("TokenNotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.tokenId) return undefined;
+          return yield* getToken({ tokenId: output.tokenId }).pipe(
+            Effect.map((token) => buildAttributes(token, output.value)),
+            Effect.catchTag("TokenNotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+      };
+    }),
+  );

package/src/Cloudflare/ApiToken/index.ts

@@ -0,0 +1,4 @@
+export * from "./AccountApiToken.ts";
+export * from "./Common.ts";
+export * from "./PermissionGroups.ts";
+export * from "./UserApiToken.ts";

package/src/Cloudflare/Artifacts/Artifacts.ts

@@ -0,0 +1,139 @@
+import * as Effect from "effect/Effect";
+import { Stack } from "../../Stack.ts";
+import { Stage } from "../../Stage.ts";
+import { ArtifactsBinding } from "./ArtifactsBinding.ts";
+
+type ArtifactsTypeId = typeof ArtifactsTypeId;
+const ArtifactsTypeId = "Cloudflare.Artifacts" as const;
+
+/**
+ * Cloudflare validation: 3–63 chars, lowercase alphanumeric and hyphens, must
+ * start and end with a lowercase alphanumeric character.
+ */
+const ARTIFACTS_NAMESPACE_REGEX = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])?$/;
+
+export class InvalidArtifactsNamespaceError extends Error {
+  readonly _tag = "InvalidArtifactsNamespaceError" as const;
+  constructor(public readonly namespace: string) {
+    super(
+      `Invalid artifacts namespace name '${namespace}'. Must be 3-63 characters, start and end with a lowercase alphanumeric character, and contain only lowercase alphanumeric characters and hyphens.`,
+    );
+  }
+}
+
+export type ArtifactsProps = {
+  /**
+   * Cloudflare namespace name. Namespaces are implicit on Cloudflare — the
+   * first repo created against this name conjures the namespace.
+   *
+   * Must be 3–63 lowercase alphanumeric characters or hyphens, and must start
+   * and end with a lowercase alphanumeric character. If omitted, a unique
+   * physical name is generated from the resource's logical id, app, and stage.
+   */
+  namespace?: string;
+};
+
+/**
+ * Marker for a Cloudflare Artifacts namespace binding.
+ *
+ * Artifacts namespaces are implicit (created on first repo write) and require
+ * no deploy-time provisioning, so this is a pure binding marker rather than
+ * a full Resource. The Worker provider sees this object in `bindings: { ... }`
+ * and emits the corresponding `{ type: "artifacts", name, namespace }` binding
+ * to the script.
+ */
+export type Artifacts = {
+  kind: ArtifactsTypeId;
+  name: string;
+  namespace: string;
+};
+
+export const isArtifacts = (value: unknown): value is Artifacts =>
+  typeof value === "object" &&
+  value !== null &&
+  "kind" in value &&
+  (value as Artifacts).kind === ArtifactsTypeId;
+
+/**
+ * A Cloudflare Artifacts namespace — the top-level container for Git-compatible
+ * versioned repositories. See the
+ * {@link https://blog.cloudflare.com/artifacts-git-for-agents-beta/ | Artifacts launch post}
+ * and {@link https://developers.cloudflare.com/artifacts/concepts/namespaces/ | Namespaces docs}.
+ *
+ * Namespaces on Cloudflare are **implicit**: there is no `POST /namespaces`
+ * endpoint. The namespace is conjured the first time a repo is created against
+ * it (either via the REST API or the Worker binding). Because of that, the
+ * Alchemy "resource" is a thin binding marker — there is nothing to provision
+ * at deploy time. Repos themselves are typically created at runtime through
+ * the bound `Artifacts` API.
+ *
+ * @section Declaring a Namespace
+ * @example Default namespace (a unique physical name is generated)
+ * ```typescript
+ * const Repos = Cloudflare.Artifacts("Repos");
+ * ```
+ *
+ * @example Override the namespace name (must be lowercase, 3–63 chars)
+ * ```typescript
+ * const Repos = Cloudflare.Artifacts("Repos", { namespace: "starter-repos" });
+ * ```
+ *
+ * @section Binding to a Worker
+ * @example Wiring it into a Worker
+ * ```typescript
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   bindings: { Repos },
+ * });
+ *
+ * export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+ * //   { Repos: Artifacts }
+ * ```
+ *
+ * @example Async-style worker
+ * ```typescript
+ * export default {
+ *   async fetch(request: Request, env: WorkerEnv) {
+ *     const repo = await env.Repos.create("starter-repo");
+ *     return Response.json({ remote: repo.remote, token: repo.token });
+ *   },
+ * };
+ * ```
+ *
+ * @example Effect-style worker
+ * ```typescript
+ * const artifacts = yield* Cloudflare.Artifacts.bind(Repos);
+ * const repo = yield* artifacts.create("starter-repo", {
+ *   setDefaultBranch: "main",
+ * });
+ * ```
+ */
+export const Artifacts: {
+  (
+    name: string,
+    props?: ArtifactsProps,
+  ): Effect.Effect<Artifacts, never, Stack | Stage>;
+  /**
+   * Bind a Cloudflare Artifacts namespace to the surrounding Worker, returning
+   * an Effect-native client. See {@link ArtifactsBinding}.
+   */
+  bind: typeof ArtifactsBinding.bind;
+} = Object.assign(
+  Effect.fn(function* (name: string, props?: ArtifactsProps) {
+    const namespace = props?.namespace
+      ? props.namespace
+      : name.toLocaleLowerCase();
+    if (!ARTIFACTS_NAMESPACE_REGEX.test(namespace)) {
+      return yield* Effect.die(new InvalidArtifactsNamespaceError(namespace));
+    }
+    return {
+      kind: ArtifactsTypeId,
+      name,
+      namespace,
+    } satisfies Artifacts;
+  }),
+  {
+    bind: (...args: Parameters<typeof ArtifactsBinding.bind>) =>
+      ArtifactsBinding.bind(...args),
+  },
+);

package/src/Cloudflare/Artifacts/ArtifactsBinding.ts

@@ -0,0 +1,188 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import { type Artifacts as ArtifactsLike } from "./Artifacts.ts";
+
+export class ArtifactsError extends Data.TaggedError("ArtifactsError")<{
+  message: string;
+  cause: Error;
+}> {}
+
+export type Scope = "read" | "write";
+
+export type ArtifactsCreateOptions = {
+  readOnly?: boolean;
+  description?: string;
+  setDefaultBranch?: string;
+};
+
+export type ArtifactsImportOptions = {
+  source: { url: string; branch?: string; depth?: number };
+  target: {
+    name: string;
+    opts?: { description?: string; readOnly?: boolean };
+  };
+};
+
+export type ArtifactsListOptions = {
+  limit?: number;
+  cursor?: string;
+};
+
+export type ArtifactsForkOptions = {
+  description?: string;
+  readOnly?: boolean;
+  defaultBranchOnly?: boolean;
+};
+
+/**
+ * Effect-native handle to a single Artifacts repo. Wraps the runtime
+ * {@link ArtifactsRepo} so each method returns an Effect.
+ */
+export interface ArtifactsRepoClient {
+  /** Underlying Cloudflare runtime handle. */
+  raw: ArtifactsRepo;
+  createToken(
+    scope?: Scope,
+    ttl?: number,
+  ): Effect.Effect<ArtifactsCreateTokenResult, ArtifactsError>;
+  listTokens(): Effect.Effect<ArtifactsTokenListResult, ArtifactsError>;
+  revokeToken(tokenOrId: string): Effect.Effect<boolean, ArtifactsError>;
+  fork(
+    name: string,
+    opts?: ArtifactsForkOptions,
+  ): Effect.Effect<ArtifactsCreateRepoResult, ArtifactsError>;
+}
+
+/**
+ * Effect-native client for a Cloudflare Artifacts namespace binding.
+ *
+ * Wraps the runtime {@link Artifacts} binding so each method returns an
+ * Effect tagged with {@link ArtifactsError}. Use
+ * `Cloudflare.ArtifactsBinding.bind(Repos)` inside a Worker's init phase.
+ */
+export interface ArtifactsClient {
+  /** Effect resolving to the raw Cloudflare runtime binding. */
+  raw: Effect.Effect<Artifacts, never, WorkerEnvironment>;
+  create(
+    name: string,
+    opts?: ArtifactsCreateOptions,
+  ): Effect.Effect<
+    ArtifactsCreateRepoResult,
+    ArtifactsError,
+    WorkerEnvironment
+  >;
+  /** Look up an existing repo by name. Fails with `ArtifactsError` if missing. */
+  get(
+    name: string,
+  ): Effect.Effect<ArtifactsRepoClient, ArtifactsError, WorkerEnvironment>;
+  list(
+    opts?: ArtifactsListOptions,
+  ): Effect.Effect<ArtifactsRepoListResult, ArtifactsError, WorkerEnvironment>;
+  delete(
+    name: string,
+  ): Effect.Effect<boolean, ArtifactsError, WorkerEnvironment>;
+  import(
+    opts: ArtifactsImportOptions,
+  ): Effect.Effect<
+    ArtifactsCreateRepoResult,
+    ArtifactsError,
+    WorkerEnvironment
+  >;
+}
+
+export class ArtifactsBinding extends Binding.Service<
+  ArtifactsBinding,
+  (artifacts: ArtifactsLike) => Effect.Effect<ArtifactsClient>
+>()("Cloudflare.Artifacts.Binding") {}
+
+export const ArtifactsBindingLive = Layer.effect(
+  ArtifactsBinding,
+  Effect.gen(function* () {
+    const Policy = yield* ArtifactsBindingPolicy;
+
+    return Effect.fn(function* (artifacts: ArtifactsLike) {
+      yield* Policy(artifacts);
+      const env = WorkerEnvironment.asEffect();
+      const raw = env.pipe(
+        Effect.map(
+          (env) => (env as Record<string, Artifacts>)[artifacts.name]!,
+        ),
+      );
+
+      const use = <T>(
+        fn: (raw: Artifacts) => Promise<T>,
+      ): Effect.Effect<T, ArtifactsError, WorkerEnvironment> =>
+        raw.pipe(Effect.flatMap((raw) => tryPromise(() => fn(raw))));
+
+      return {
+        raw,
+        create: (name, opts) => use((raw) => raw.create(name, opts)),
+        get: (name) =>
+          use((raw) => raw.get(name)).pipe(
+            Effect.flatMap((repo) =>
+              repo == null
+                ? Effect.fail(
+                    new ArtifactsError({
+                      message: `Artifacts repo '${name}' not found`,
+                      cause: new Error("not_found"),
+                    }),
+                  )
+                : Effect.succeed(wrapRepo(repo as ArtifactsRepo)),
+            ),
+          ),
+        list: (opts) => use((raw) => raw.list(opts)),
+        delete: (name) => use((raw) => raw.delete(name)),
+        import: (opts) => use((raw) => raw.import(opts)),
+      } satisfies ArtifactsClient;
+    });
+  }),
+);
+
+export class ArtifactsBindingPolicy extends Binding.Policy<
+  ArtifactsBindingPolicy,
+  (artifacts: ArtifactsLike) => Effect.Effect<void>
+>()("Cloudflare.Artifacts.Binding") {}
+
+export const ArtifactsBindingPolicyLive = ArtifactsBindingPolicy.layer.succeed(
+  Effect.fn(function* (host: ResourceLike, artifacts: ArtifactsLike) {
+    if (isWorker(host)) {
+      yield* host.bind(artifacts.name, {
+        bindings: [
+          {
+            type: "artifacts",
+            name: artifacts.name,
+            namespace: artifacts.namespace,
+          } as any,
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        new Error(`ArtifactsBinding does not support runtime '${host.Type}'`),
+      );
+    }
+  }),
+);
+
+const tryPromise = <T>(
+  fn: () => Promise<T>,
+): Effect.Effect<T, ArtifactsError> =>
+  Effect.tryPromise({
+    try: fn,
+    catch: (error: any) =>
+      new ArtifactsError({
+        message: error?.message ?? "Unknown error",
+        cause: error,
+      }),
+  });
+
+const wrapRepo = (raw: ArtifactsRepo): ArtifactsRepoClient => ({
+  raw,
+  createToken: (scope, ttl) => tryPromise(() => raw.createToken(scope, ttl)),
+  listTokens: () => tryPromise(() => raw.listTokens()),
+  revokeToken: (tokenOrId) => tryPromise(() => raw.revokeToken(tokenOrId)),
+  fork: (name, opts) => tryPromise(() => raw.fork(name, opts)),
+});

package/src/Cloudflare/Artifacts/index.ts

@@ -0,0 +1,2 @@
+export * from "./Artifacts.ts";
+export * from "./ArtifactsBinding.ts";

package/src/Cloudflare/Auth/AuthProvider.ts

@@ -46,8 +46,8 @@ const options: Array<{
   },
   {
     value: "stored",
-    label: "Stored",
-    hint: "stored in ~/.alchemy/credentials",
+    label: "API Token or API Key",
+    hint: "enter credentials interactively, stored in ~/.alchemy/credentials",
   },
 ];
 

package/src/Cloudflare/Providers.ts

@@ -3,6 +3,8 @@ import { Command } from "../Build/Command.ts";
 import * as Build from "../Build/index.ts";
 import * as Provider from "../Provider.ts";
 import { Random, RandomProvider } from "../Random.ts";
+import * as ApiToken from "./ApiToken/index.ts";
+import * as Artifacts from "./Artifacts/index.ts";
 import { CloudflareAuth } from "./Auth/AuthProvider.ts";
 import * as CloudflareEnvironment from "./CloudflareEnvironment.ts";
 import * as Containers from "./Container/index.ts";
@@ -30,6 +32,9 @@ export const providers = () =>
   Layer.effect(
     Providers,
     Provider.collection([
+      ApiToken.AccountApiToken,
+      ApiToken.UserApiToken,
+      Artifacts.ArtifactsBindingPolicy,
       Command,
       Containers.Container,
       D1.D1ConnectionPolicy,
@@ -53,6 +58,9 @@ export const providers = () =>
   ).pipe(
     Layer.provide(
       Layer.mergeAll(
+        ApiToken.AccountApiTokenProvider(),
+        ApiToken.UserApiTokenProvider(),
+        Artifacts.ArtifactsBindingPolicyLive,
         Containers.ContainerProvider(),
         D1.D1ConnectionPolicyLive,
         D1.DatabaseProvider(),

package/src/Cloudflare/StateStore/Api.ts

@@ -1,4 +1,3 @@
-import * as Cloudflare from "alchemy/Cloudflare";
 import {
   BearerTokenValidator,
   StateApi,
@@ -13,12 +12,15 @@ import * as HttpRouter from "effect/unstable/http/HttpRouter";
 import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
 import * as HttpApiError from "effect/unstable/httpapi/HttpApiError";
 import crypto from "node:crypto";
+import { SecretBindingLive } from "../SecretsStore/SecretBinding.ts";
+import * as Secret from "../SecretsStore/Secret.ts";
+import { Worker } from "../Workers/Worker.ts";
 import Store from "./Store.ts";
 import { AuthToken } from "./Token.ts";
 
 export const STATE_STORE_SCRIPT_NAME = "alchemy-state-store" as const;
 
-export default Cloudflare.Worker(
+export default Worker(
   "Api",
   {
     name: STATE_STORE_SCRIPT_NAME,
@@ -30,7 +32,7 @@ export default Cloudflare.Worker(
     },
   },
   Effect.gen(function* () {
-    const secret = yield* Cloudflare.Secret.bind(AuthToken);
+    const secret = yield* Secret.Secret.bind(AuthToken);
     const store = yield* Store;
 
     const bearerTokenValidator = Layer.effect(
@@ -126,7 +128,7 @@ export default Cloudflare.Worker(
         HttpRouter.toHttpEffect,
       ),
     };
-  }).pipe(Effect.provide(Layer.mergeAll(Cloudflare.SecretBindingLive))),
+  }).pipe(Effect.provide(Layer.mergeAll(SecretBindingLive))),
 );
 
 /**

package/src/Cloudflare/StateStore/Store.ts

@@ -1,22 +1,24 @@
-import * as Cloudflare from "alchemy/Cloudflare";
 import type { ReplacedResourceState, ResourceState } from "alchemy/State";
 import { encodeState } from "alchemy/State";
 import * as Effect from "effect/Effect";
 import { pipe } from "effect/Function";
+import * as Secret from "../SecretsStore/Secret.ts";
+import { DurableObjectNamespace } from "../Workers/DurableObjectNamespace.ts";
+import { DurableObjectState } from "../Workers/DurableObjectState.ts";
 import { EncryptionKey } from "./Token.ts";
 
-export default class Store extends Cloudflare.DurableObjectNamespace<Store>()(
+export default class Store extends DurableObjectNamespace<Store>()(
   "Store",
   Effect.gen(function* () {
     // Outer (class-level) phase — resolve the binding factory once.
     // The actual secret read happens inside each DO instance below,
     // since `SecretClient.get()` needs the per-instance worker env.
-    const encryptionSecret = yield* Cloudflare.Secret.bind(EncryptionKey);
+    const encryptionSecret = yield* Secret.Secret.bind(EncryptionKey);
 
     return Effect.gen(function* () {
       // Inner (per-instance) phase — set up storage and the AES key.
       // The key is imported once per DO boot and reused thereafter.
-      const doState = yield* Cloudflare.DurableObjectState;
+      const doState = yield* DurableObjectState;
       const storage = doState.storage;
 
       const keyHex = yield* encryptionSecret.get().pipe(Effect.orDie);

package/src/Cloudflare/StateStore/Token.ts

@@ -1,13 +1,14 @@
 import { Random } from "alchemy";
-import * as Cloudflare from "alchemy/Cloudflare";
 import * as Effect from "effect/Effect";
+import * as Secret from "../SecretsStore/Secret.ts";
+import { SecretsStore } from "../SecretsStore/SecretsStore.ts";
 
 /**
  * The account-wide Secrets Store that backs every secret used by the
  * state store worker. `SecretsStore` adopts the single store that
  * already exists on the account, or creates one if none exists.
  */
-export const Store = Cloudflare.SecretsStore("StateStoreSecrets");
+export const Store = SecretsStore("StateStoreSecrets");
 
 /**
  * The randomly generated bearer token value. Generated once on create
@@ -30,7 +31,8 @@ export const AuthTokenSecretName = "AlchemyStateStoreToken" as const;
 export const AuthToken = Effect.gen(function* () {
   const store = yield* Store;
   const random = yield* TokenValue;
-  return yield* Cloudflare.Secret(AuthTokenSecretName, {
+  return yield* Secret.Secret(AuthTokenSecretName, {
+    name: AuthTokenSecretName,
     store,
     value: random.text,
   });
@@ -46,6 +48,9 @@ export const EncryptionKeyValue = Random("StateStoreEncryptionKeyValue", {
   bytes: 32,
 });
 
+export const EncryptionKeySecretName =
+  "AlchemyStateStoreEncryptionKey" as const;
+
 /**
  * The encryption key secret. The raw hex-encoded bytes live inside
  * Cloudflare's Secrets Store; the Durable Object binds to it at
@@ -55,7 +60,8 @@ export const EncryptionKeyValue = Random("StateStoreEncryptionKeyValue", {
 export const EncryptionKey = Effect.gen(function* () {
   const store = yield* Store;
   const random = yield* EncryptionKeyValue;
-  return yield* Cloudflare.Secret("StateStoreEncryptionKey", {
+  return yield* Secret.Secret("StateStoreEncryptionKey", {
+    name: EncryptionKeySecretName,
     store,
     value: random.text,
   });

package/src/Cloudflare/Workers/InferEnv.ts

@@ -1,5 +1,4 @@
 /// <reference types="@cloudflare/workers-types" />
-// import type * as cf from "@cloudflare/workers-types";
 
 import type * as Effect from "effect/Effect";
 import type { UnwrapEffect } from "../../Util/effect.ts";
@@ -24,6 +23,8 @@ type GetBindingType<T> = T extends Cloudflare.Assets
         ? KVNamespace
         : T extends Cloudflare.Queue
           ? Queue<unknown>
-          : T extends Cloudflare.DurableObjectNamespaceLike
-            ? DurableObjectNamespace<Exclude<T["Shape"], undefined>>
-            : never;
+          : T extends Cloudflare.Artifacts
+            ? Artifacts
+            : T extends Cloudflare.DurableObjectNamespaceLike
+              ? DurableObjectNamespace<Exclude<T["Shape"], undefined>>
+              : never;