alchemy 2.0.0-beta.28 → 2.0.0-beta.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alchemy",
-  "version": "2.0.0-beta.28",
+  "version": "2.0.0-beta.29",
   "homepage": "https://alchemy.run",
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",
@@ -261,7 +261,7 @@
     "@distilled.cloud/axiom": "^0.15.2",
     "@distilled.cloud/cloudflare": "^0.15.2",
     "@distilled.cloud/cloudflare-rolldown-plugin": "0.3.0",
-    "@distilled.cloud/cloudflare-runtime": "0.1.1",
+    "@distilled.cloud/cloudflare-runtime": "0.1.2",
     "@distilled.cloud/cloudflare-vite-plugin": "0.2.0",
     "@distilled.cloud/core": "^0.15.2",
     "@effect/vitest": ">=4.0.0-beta.58 || >=4.0.0",

package/src/AWS/IAM/SAMLProvider.ts

@@ -1,11 +1,12 @@
 import * as iam from "@distilled.cloud/aws/iam";
 import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
+import { AWSEnvironment } from "../Environment.ts";
 import { isResolved } from "../../Diff.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import type { Providers } from "../Providers.ts";
-import { diffTags } from "../../Tags.ts";
+import { createInternalTags, diffTags, hasTags } from "../../Tags.ts";
 import { toTagRecord, unwrapRedactedString } from "./common.ts";
 
 export interface SAMLProviderProps {
@@ -100,19 +101,44 @@ export const SAMLProviderProvider = () =>
         tags: toTagRecord(tags.Tags),
       };
     }),
-    create: Effect.fn(function* ({ news, session }) {
-      const response = yield* iam.createSAMLProvider({
-        Name: news.name,
-        SAMLMetadataDocument: news.samlMetadataDocument,
-        AssertionEncryptionMode: news.assertionEncryptionMode,
-        AddPrivateKey: news.addPrivateKey
-          ? unwrapRedactedString(news.addPrivateKey)
-          : undefined,
-        Tags: Object.entries(news.tags ?? {}).map(([Key, Value]) => ({
-          Key,
-          Value,
-        })),
-      });
+    create: Effect.fn(function* ({ id, news, session }) {
+      const internalTags = yield* createInternalTags(id);
+      const tags = {
+        ...internalTags,
+        ...news.tags,
+      };
+      const response = yield* iam
+        .createSAMLProvider({
+          Name: news.name,
+          SAMLMetadataDocument: news.samlMetadataDocument,
+          AssertionEncryptionMode: news.assertionEncryptionMode,
+          AddPrivateKey: news.addPrivateKey
+            ? unwrapRedactedString(news.addPrivateKey)
+            : undefined,
+          Tags: Object.entries(tags).map(([Key, Value]) => ({
+            Key,
+            Value,
+          })),
+        })
+        .pipe(
+          Effect.catchTag("EntityAlreadyExistsException", () =>
+            Effect.gen(function* () {
+              const accountId = (yield* AWSEnvironment).accountId;
+              const existingArn = `arn:aws:iam::${accountId}:saml-provider/${news.name}`;
+              const existingTags = yield* iam.listSAMLProviderTags({
+                SAMLProviderArn: existingArn,
+              });
+              if (!hasTags(internalTags, existingTags.Tags)) {
+                return yield* Effect.fail(
+                  new Error(
+                    `SAML provider '${news.name}' already exists and is not managed by alchemy`,
+                  ),
+                );
+              }
+              return { SAMLProviderArn: existingArn };
+            }),
+          ),
+        );
       const samlProviderArn = response.SAMLProviderArn ?? news.name;
       yield* session.note(samlProviderArn);
       return {
@@ -121,10 +147,10 @@ export const SAMLProviderProvider = () =>
         samlProviderUUID: undefined,
         samlMetadataDocument: news.samlMetadataDocument,
         assertionEncryptionMode: news.assertionEncryptionMode,
-        tags: news.tags ?? {},
+        tags,
       };
     }),
-    update: Effect.fn(function* ({ news, olds, output, session }) {
+    update: Effect.fn(function* ({ id, news, olds, output, session }) {
       yield* iam.updateSAMLProvider({
         SAMLProviderArn: output.samlProviderArn,
         SAMLMetadataDocument:
@@ -136,7 +162,10 @@ export const SAMLProviderProvider = () =>
           ? unwrapRedactedString(news.addPrivateKey)
           : undefined,
       });
-      const { removed, upsert } = diffTags(olds.tags ?? {}, news.tags ?? {});
+      const internalTags = yield* createInternalTags(id);
+      const oldTags = { ...internalTags, ...(olds.tags ?? {}) };
+      const newTags = { ...internalTags, ...(news.tags ?? {}) };
+      const { removed, upsert } = diffTags(oldTags, newTags);
       if (upsert.length > 0) {
         yield* iam.tagSAMLProvider({
           SAMLProviderArn: output.samlProviderArn,
@@ -156,7 +185,7 @@ export const SAMLProviderProvider = () =>
         samlProviderUUID: output.samlProviderUUID,
         samlMetadataDocument: news.samlMetadataDocument,
         assertionEncryptionMode: news.assertionEncryptionMode,
-        tags: news.tags ?? {},
+        tags: newTags,
       };
     }),
     delete: Effect.fn(function* ({ output }) {

package/src/Apply.ts

@@ -1,3 +1,4 @@
+import * as Cause from "effect/Cause";
 import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
@@ -246,6 +247,8 @@ const executePlan = Effect.fnUntraced(function* (
       { concurrency: "unbounded" },
     );
 
+  const failures: LifecycleFailure[] = [];
+
   yield* Effect.all(
     Object.entries(plan.resources).map(([fqn, node]) =>
       executeNode(
@@ -260,12 +263,30 @@ const executePlan = Effect.fnUntraced(function* (
         stage,
         getOutputs,
         waitForDeps,
+        failures,
+        plan.cycleMembers.has(fqn),
       ),
     ),
     { concurrency: "unbounded" },
   );
+
+  if (failures.length > 0) {
+    // Aggregate every collected lifecycle failure into a single parallel Cause
+    // so the apply ends with one combined error containing every distinct
+    // failure / defect that occurred across the concurrent fibers.
+    yield* Effect.failCause(
+      failures.map((f) => f.cause).reduce(Cause.combine),
+    );
+  }
 });
 
+interface LifecycleFailure {
+  fqn: string;
+  logicalId: string;
+  type: string;
+  cause: Cause.Cause<unknown>;
+}
+
 const executeNode = (
   fqn: string,
   node: Apply,
@@ -292,6 +313,8 @@ const executeNode = (
   stage: string,
   getOutputs: () => Record<string, any>,
   waitForDeps: (fqns: string[]) => Effect.Effect<void[], never, never>,
+  failures: LifecycleFailure[],
+  inCycle: boolean,
 ): Effect.Effect<void, never, never> =>
   Effect.gen(function* () {
     const logicalId = node.resource.LogicalId;
@@ -548,14 +571,26 @@ const executeNode = (
 
       // ── update ──
       if (node.action === "update") {
-        // Updates always begin by exposing the currently live output so downstream
-        // resources can continue to resolve references during the update pass.
-        yield* storeAndSignal({
-          output: node.state.attr,
-          props: node.state.props,
-          bindings: node.state.bindings ?? [],
-          instanceId,
-        });
+        // Cycle members publish their previous live attr *before* waiting on
+        // upstreams so the SCC can converge — peers in the cycle would
+        // otherwise deadlock waiting on each other. Phase 3 (`converge`)
+        // re-runs each peer's update against fresh outputs once everyone
+        // has settled.
+        //
+        // Linear (DAG) update nodes skip this entirely and simply wait for
+        // fresh upstream outputs, mirroring the create flow. This is the
+        // important property: a downstream of a non-cycle update never
+        // observes the upstream's stale attr, which prevents wasted/
+        // destructive intermediate updates (e.g. a Worker deploying with
+        // stale Build assets).
+        if (inCycle) {
+          yield* storeAndSignal({
+            output: node.state.attr,
+            props: node.state.props,
+            bindings: node.state.bindings ?? [],
+            instanceId,
+          });
+        }
 
         yield* waitForDeps(allUpstreamFqns());
         const outputs = getOutputs();
@@ -657,6 +692,10 @@ const executeNode = (
           bindings: bindingOutputs,
           instanceId,
         };
+        // Signal here for the linear (non-cycle) path. For in-cycle updates
+        // the deferred has already been resolved by the early `storeAndSignal`
+        // above and `signalReady` is a no-op the second time.
+        yield* signalReady;
 
         yield* markTerminal("updated");
         return;
@@ -830,6 +869,31 @@ const executeNode = (
       return yield* Effect.die(`Unknown action: ${node.action}`);
     });
   }).pipe(
+    Effect.catchCause((cause) =>
+      // Record the failure, propagate it to any downstream resources waiting on
+      // our Deferred (so their waitForDeps short-circuits instead of deadlocking),
+      // emit a "fail" status to the session, and resolve to void so Effect.all
+      // does not interrupt sibling fibers. The aggregated cause is raised at
+      // the end of executePlan.
+      Effect.gen(function* () {
+        failures.push({
+          fqn,
+          logicalId: node.resource.LogicalId,
+          type: node.resource.Type,
+          cause,
+        });
+        yield* Deferred.failCause(
+          ready[fqn],
+          cause as Cause.Cause<never>,
+        );
+        yield* session.emit({
+          kind: "status-change",
+          id: node.resource.LogicalId,
+          type: node.resource.Type,
+          status: "fail",
+        });
+      }),
+    ),
     Effect.withSpan("apply.resource", {
       attributes: {
         "alchemy.resource.fqn": fqn,

package/src/Cli/commands/bootstrap.ts

@@ -20,6 +20,7 @@ import * as AWSEnvironment from "../../AWS/Environment";
 import * as AWSRegion from "../../AWS/Region";
 import { AuthProviders } from "../../Auth/AuthProvider";
 import { withProfileOverride } from "../../Auth/Profile";
+import * as CloudflareAccess from "../../Cloudflare/Access.ts";
 import { CloudflareAuth } from "../../Cloudflare/Auth/AuthProvider";
 import * as CloudflareEnvironment from "../../Cloudflare/CloudflareEnvironment";
 import * as CloudflareCredentials from "../../Cloudflare/Credentials";
@@ -190,6 +191,7 @@ const bootstrapCloudflareCommand = Command.make(
         Layer.mergeAll(
           CloudflareCredentials.fromAuthProvider(),
           CloudflareEnvironment.fromProfile(),
+          CloudflareAccess.AccessLive,
         ),
         authLayer,
       );

package/src/Cloudflare/Access.ts

@@ -0,0 +1,110 @@
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+import { cachedFunction } from "../Util/cached-function.ts";
+
+export class AccessError extends Schema.TaggedErrorClass<AccessError>()(
+  "AccessError",
+  {
+    message: Schema.String,
+    cause: Schema.optional(Schema.Defect),
+  },
+) {}
+
+export class Access extends Context.Service<
+  Access,
+  {
+    readonly getAccessHeaders: (
+      domain: string,
+    ) => Effect.Effect<Record<string, string>, AccessError>;
+  }
+>()("alchemy/Cloudflare/Access") {}
+
+export const AccessLive = Layer.effect(
+  Access,
+  Effect.gen(function* () {
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const domainUsesAccess = yield* cachedFunction((domain: string) =>
+      Effect.promise((signal) =>
+        fetch(`https://${domain}`, { redirect: "manual", signal }),
+      ).pipe(
+        Effect.map(
+          (response) =>
+            response.status === 302 &&
+            (response.headers
+              .get("location")
+              ?.includes("cloudflareaccess.com") ??
+              false),
+        ),
+        Effect.timeout(1000),
+        Effect.catch(() => Effect.succeed(false)),
+      ),
+    );
+    const login = (domain: string) =>
+      ChildProcess.make("cloudflared", ["access", "login", domain]).pipe(
+        spawner.spawn,
+        Effect.flatMap((process) => Stream.runCollect(process.stdout)),
+        Effect.mapError(
+          (error) =>
+            new AccessError({
+              message:
+                `The domain "${domain}" uses Cloudflare Access, but \`cloudflared\` is not installed. ` +
+                `Please install it from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation.`,
+              cause: error,
+            }),
+        ),
+        Effect.flatMap((stdout) => {
+          const matches = stdout
+            .toString()
+            .match(/fetched your token:\n\n(.*)/m);
+          return matches && matches.length >= 2
+            ? Effect.succeed({ Cookie: `CF_Authorization=${matches[1]}` })
+            : Effect.fail(
+                new AccessError({
+                  message: "Failed to authenticate with Cloudflare Access",
+                }),
+              );
+        }),
+        Effect.scoped,
+      );
+
+    const getEnv = (name: string) =>
+      Config.string(name)
+        .asEffect()
+        .pipe(Effect.catchTag("ConfigError", () => Effect.succeed(undefined)));
+
+    return Access.of({
+      getAccessHeaders: Effect.fn(function* (domain) {
+        if (!(yield* domainUsesAccess(domain))) {
+          return {};
+        }
+        const clientId = yield* getEnv("CLOUDFLARE_ACCESS_CLIENT_ID");
+        const clientSecret = yield* getEnv("CLOUDFLARE_ACCESS_CLIENT_SECRET");
+        if (clientId && clientSecret) {
+          return {
+            "CF-Access-Client-Id": clientId,
+            "CF-Access-Client-Secret": clientSecret,
+          } as Record<string, string>;
+        }
+
+        if (clientId !== undefined || clientSecret !== undefined) {
+          yield* Effect.logWarning(
+            "Both CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET must be set to use Access Service Token authentication. " +
+              `Only ${
+                clientId !== undefined
+                  ? "CLOUDFLARE_ACCESS_CLIENT_ID"
+                  : "CLOUDFLARE_ACCESS_CLIENT_SECRET"
+              } was found.`,
+          );
+        }
+
+        return yield* login(domain);
+      }),
+    });
+  }),
+);