alchemy 2.0.0-beta.3 → 2.0.0-beta.31

package/lib/Cloudflare/SecretsStore/Secret.js

@@ -0,0 +1,216 @@
+import * as secretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+import { Unowned } from "../../AdoptPolicy.js";
+import { isResolved } from "../../Diff.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { SecretBinding } from "./SecretBinding.js";
+/**
+ * A single secret stored inside a Cloudflare Secrets Store.
+ *
+ * The secret value is treated as redacted and is only ever sent to
+ * Cloudflare at create time. Updating `scopes` or `comment` issues a
+ * PATCH; changing `value` or `name` replaces the secret.
+ *
+ * @section Creating a Secret
+ * @example Basic Secret
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore");
+ * const apiKey = yield* Cloudflare.StoreSecret("ApiKey", {
+ *   store,
+ *   value: Redacted.make(process.env.API_KEY!),
+ * });
+ * ```
+ *
+ * @section Binding to a Worker
+ * @example Reading a secret at runtime
+ * ```typescript
+ * const apiKey = yield* Cloudflare.StoreSecret.bind(ApiKey);
+ * // `apiKey` is itself an Effect that resolves to the secret value:
+ * const value = yield* apiKey;
+ * // Or call `.get()` explicitly:
+ * const value = yield* apiKey.get();
+ * ```
+ */
+export const Secret = Resource("Cloudflare.SecretsStore.Secret")({
+    bind: SecretBinding.bind,
+});
+const resolveScopes = (scopes) => scopes && scopes.length > 0 ? scopes : ["workers"];
+const resolveName = (id, name) => name ?? id;
+export const StoreSecretProvider = () => Provider.effect(Secret, Effect.gen(function* () {
+    const createStoreSecret = yield* secretsStore.createStoreSecret;
+    const patchStoreSecret = yield* secretsStore.patchStoreSecret;
+    const deleteStoreSecret = yield* secretsStore.deleteStoreSecret;
+    const getStoreSecret = yield* secretsStore.getStoreSecret;
+    const listStoreSecrets = secretsStore.listStoreSecrets;
+    const arraysEqual = (a, b) => a.length === b.length && a.every((v, i) => v === b[i]);
+    return {
+        stables: ["secretId", "secretName", "storeId", "accountId"],
+        diff: Effect.fn(function* ({ id, olds = {}, news, output }) {
+            if (!isResolved(news))
+                return undefined;
+            const oldStoreId = output?.storeId ?? olds.store?.storeId;
+            const newStoreId = news.store.storeId;
+            const oldName = output?.secretName ?? resolveName(id, olds.name);
+            const newName = resolveName(id, news.name);
+            if (oldStoreId !== newStoreId || oldName !== newName) {
+                return { action: "replace" };
+            }
+            const oldValue = olds.value ? Redacted.value(olds.value) : undefined;
+            const newValue = Redacted.value(news.value);
+            if (oldValue !== newValue) {
+                return { action: "replace" };
+            }
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output }) {
+            const name = resolveName(id, news.name);
+            const scopes = resolveScopes(news.scopes);
+            const accountId = news.store.accountId;
+            const storeId = news.store.storeId;
+            // Observe — re-fetch the cached secret; fall back to a name
+            // scan over the store so we recover from out-of-band deletes
+            // or partial state-persistence failures.
+            let observed;
+            if (output?.secretId) {
+                observed = yield* getStoreSecret({
+                    accountId: output.accountId,
+                    storeId: output.storeId,
+                    secretId: output.secretId,
+                }).pipe(Effect.catchTag("SecretNotFound", () => Effect.succeed(undefined)), Effect.catchTag("StoreNotFound", () => Effect.succeed(undefined)));
+            }
+            if (!observed) {
+                observed = yield* listStoreSecrets
+                    .items({ accountId, storeId })
+                    .pipe(Stream.filter((s) => s.name === name), Stream.runHead, Effect.catchTag("StoreNotFound", () => Effect.succeedNone), Effect.map(Option.getOrUndefined));
+            }
+            // Ensure — create if missing. Cloudflare reports a concurrent
+            // create as `SecretNameAlreadyExists`; tolerate by re-listing
+            // the store and adopting the secret with the same name. The
+            // value can't be read back from the API; we trust an
+            // identically-named secret reflects the same intent.
+            if (!observed) {
+                const created = yield* createStoreSecret({
+                    accountId,
+                    storeId,
+                    body: [
+                        {
+                            name,
+                            scopes,
+                            value: Redacted.value(news.value),
+                            comment: news.comment,
+                        },
+                    ],
+                }).pipe(Effect.catchTag("SecretNameAlreadyExists", () => Effect.succeed(undefined)));
+                if (created) {
+                    const secret = created.result[0];
+                    return {
+                        secretId: secret.id,
+                        secretName: secret.name,
+                        storeId: secret.storeId,
+                        accountId,
+                        status: secret.status,
+                        scopes,
+                        comment: secret.comment ?? undefined,
+                    };
+                }
+                const existing = yield* listStoreSecrets
+                    .items({ accountId, storeId })
+                    .pipe(Stream.filter((s) => s.name === name), Stream.runHead, Effect.map(Option.getOrUndefined));
+                if (!existing) {
+                    return yield* Effect.die(new Error(`Secret '${name}' reported as already existing in store ${storeId} but could not be found on lookup.`));
+                }
+                observed = existing;
+            }
+            // Sync — `listStoreSecrets` does not surface scopes, so we
+            // can't reliably diff them. Issue PATCH only when we have a
+            // record of prior props (`output`) and a difference is
+            // visible; otherwise issue an unconditional PATCH on the
+            // adoption / first-create path so scopes and comment converge.
+            const oldScopes = output ? resolveScopes(output.scopes) : undefined;
+            const scopesChanged = !oldScopes || !arraysEqual(scopes, oldScopes);
+            const commentChanged = !output ||
+                (output.comment ?? undefined) !== (news.comment ?? undefined);
+            if (scopesChanged || commentChanged) {
+                const patched = yield* patchStoreSecret({
+                    accountId,
+                    storeId,
+                    secretId: observed.id,
+                    scopes: scopesChanged ? scopes : undefined,
+                    comment: commentChanged ? news.comment : undefined,
+                }).pipe(Effect.catchTag("SecretNotFound", () => Effect.succeed(undefined)));
+                if (patched) {
+                    return {
+                        secretId: observed.id,
+                        secretName: observed.name,
+                        storeId: observed.storeId,
+                        accountId,
+                        status: patched.status,
+                        scopes,
+                        comment: patched.comment ?? undefined,
+                    };
+                }
+            }
+            return {
+                secretId: observed.id,
+                secretName: observed.name,
+                storeId: observed.storeId,
+                accountId,
+                status: observed.status,
+                scopes,
+                comment: news.comment ?? observed.comment ?? undefined,
+            };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* deleteStoreSecret({
+                accountId: output.accountId,
+                storeId: output.storeId,
+                secretId: output.secretId,
+            }).pipe(Effect.catchTag("SecretNotFound", () => Effect.void), Effect.catchTag("StoreNotFound", () => Effect.void), Effect.catchTag("NotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            if (output?.secretId) {
+                return yield* getStoreSecret({
+                    accountId: output.accountId,
+                    storeId: output.storeId,
+                    secretId: output.secretId,
+                }).pipe(Effect.map((secret) => ({
+                    secretId: secret.id,
+                    secretName: secret.name,
+                    storeId: secret.storeId,
+                    accountId: output.accountId,
+                    status: secret.status,
+                    scopes: output.scopes,
+                    comment: secret.comment ?? undefined,
+                })), Effect.catchTag("SecretNotFound", () => Effect.succeed(undefined)), Effect.catchTag("StoreNotFound", () => Effect.succeed(undefined)));
+            }
+            if (!olds?.store)
+                return undefined;
+            const name = resolveName(id, olds.name);
+            const match = yield* listStoreSecrets
+                .items({
+                accountId: olds.store.accountId,
+                storeId: olds.store.storeId,
+            })
+                .pipe(Stream.filter((s) => s.name === name), Stream.runHead, Effect.catchTag("StoreNotFound", () => Effect.succeedNone), Effect.map(Option.getOrUndefined));
+            if (!match)
+                return undefined;
+            // Secrets carry no ownership signal (Cloudflare doesn't expose
+            // tags on store secrets), so a name match is not proof we own
+            // it. Brand it `Unowned` so the engine surfaces
+            // `OwnedBySomeoneElse` unless the caller opted in via `--adopt`.
+            return Unowned({
+                secretId: match.id,
+                secretName: match.name,
+                storeId: match.storeId,
+                accountId: olds.store.accountId,
+                status: match.status,
+                scopes: resolveScopes(olds.scopes),
+                comment: match.comment ?? undefined,
+            });
+        }),
+    };
+}));
+//# sourceMappingURL=Secret.js.map

package/lib/Cloudflare/SecretsStore/Secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Secret.js","sourceRoot":"","sources":["../../../src/Cloudflare/SecretsStore/Secret.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,YAAY,MAAM,2CAA2C,CAAC;AAC1E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA6CnD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAS,gCAAgC,CAAC,CAAC;IACvE,IAAI,EAAE,aAAa,CAAC,IAAI;CACzB,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,MAA4B,EAAY,EAAE,CAC/D,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAErD,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAU,EAAE,CACnE,IAAI,IAAI,EAAE,CAAC;AAEb,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,EAAE,CACtC,QAAQ,CAAC,MAAM,CACb,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,iBAAiB,CAAC;IAChE,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,gBAAgB,CAAC;IAC9D,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,iBAAiB,CAAC;IAChE,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC;IAC1D,MAAM,gBAAgB,GAAG,YAAY,CAAC,gBAAgB,CAAC;IAEvD,MAAM,WAAW,GAAG,CAAC,CAAW,EAAE,CAAW,EAAE,EAAE,CAC/C,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzD,OAAO;QACL,OAAO,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,CAAC;QAC3D,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,GAAG,EAAS,EAAE,IAAI,EAAE,MAAM,EAAE;YAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,UAAU,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;YAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YACtC,MAAM,OAAO,GAAG,MAAM,EAAE,UAAU,IAAI,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,UAAU,KAAK,UAAU,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACrD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAClD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAEnC,4DAA4D;YAC5D,6DAA6D;YAC7D,yCAAyC;YACzC,IAAI,QAQS,CAAC;YACd,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;oBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CACrC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,EACD,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAClE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,KAAK,CAAC,CAAC,gBAAgB;qBAC/B,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;qBAC7B,IAAI,CACH,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EACrC,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAC1D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAClC,CAAC;YACN,CAAC;YAED,8DAA8D;YAC9D,8DAA8D;YAC9D,4DAA4D;YAC5D,qDAAqD;YACrD,qDAAqD;YACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;oBACvC,SAAS;oBACT,OAAO;oBACP,IAAI,EAAE;wBACJ;4BACE,IAAI;4BACJ,MAAM;4BACN,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;4BACjC,OAAO,EAAE,IAAI,CAAC,OAAO;yBACtB;qBACF;iBACF,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAC9C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;oBAClC,OAAO;wBACL,QAAQ,EAAE,MAAM,CAAC,EAAE;wBACnB,UAAU,EAAE,MAAM,CAAC,IAAI;wBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,SAAS;wBACT,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,MAAM;wBACN,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;qBACrC,CAAC;gBACJ,CAAC;gBACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,gBAAgB;qBACrC,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;qBAC7B,IAAI,CACH,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EACrC,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAClC,CAAC;gBACJ,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,IAAI,KAAK,CACP,WAAW,IAAI,2CAA2C,OAAO,oCAAoC,CACtG,CACF,CAAC;gBACJ,CAAC;gBACD,QAAQ,GAAG,QAAQ,CAAC;YACtB,CAAC;YAED,2DAA2D;YAC3D,4DAA4D;YAC5D,uDAAuD;YACvD,yDAAyD;YACzD,+DAA+D;YAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,MAAM,aAAa,GAAG,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACpE,MAAM,cAAc,GAClB,CAAC,MAAM;gBACP,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;YAChE,IAAI,aAAa,IAAI,cAAc,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;oBACtC,SAAS;oBACT,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,EAAE;oBACrB,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;oBAC1C,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;iBACnD,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CACrC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;wBACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;wBACrB,UAAU,EAAE,QAAQ,CAAC,IAAI;wBACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;wBACzB,SAAS;wBACT,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,MAAM;wBACN,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,SAAS;qBACtC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;gBACrB,UAAU,EAAE,QAAQ,CAAC,IAAI;gBACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,SAAS;gBACT,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,MAAM;gBACN,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,IAAI,SAAS;aACvD,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,iBAAiB,CAAC;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EACpD,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EACnD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/C,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC,CAAC,cAAc,CAAC;oBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;oBACtB,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;iBACrC,CAAC,CAAC,EACH,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CACrC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,EACD,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAClE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,KAAK;gBAAE,OAAO,SAAS,CAAC;YACnC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,gBAAgB;iBAClC,KAAK,CAAC;gBACL,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;gBAC/B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;aAC5B,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EACrC,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAC1D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAClC,CAAC;YACJ,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,+DAA+D;YAC/D,8DAA8D;YAC9D,gDAAgD;YAChD,iEAAiE;YACjE,OAAO,OAAO,CAAC;gBACb,QAAQ,EAAE,KAAK,CAAC,EAAE;gBAClB,UAAU,EAAE,KAAK,CAAC,IAAI;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;gBAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,SAAS;aACpC,CAAC,CAAC;QACL,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Cloudflare/SecretsStore/SecretBinding.d.ts

@@ -0,0 +1,42 @@
+import type * as runtime from "@cloudflare/workers-types";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { WorkerEnvironment } from "../Workers/Worker.ts";
+import type { Secret } from "./Secret.ts";
+declare const SecretError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "SecretError";
+} & Readonly<A>;
+export declare class SecretError extends SecretError_base<{
+    message: string;
+    cause: Error;
+}> {
+}
+/**
+ * A bound secret. The client itself is an `Effect` that resolves to the
+ * secret's current value, so you can `yield* apiKey` directly. Use `.get()`
+ * for the same thing as a callable, or `.raw` for the underlying
+ * `SecretsStoreSecret` binding.
+ */
+export interface SecretClient extends Effect.Effect<string, SecretError, WorkerEnvironment> {
+    /**
+     * Effect that resolves to the raw Cloudflare `SecretsStoreSecret` binding.
+     */
+    raw: Effect.Effect<runtime.SecretsStoreSecret, never, WorkerEnvironment>;
+    /**
+     * Read the current value of the secret.
+     */
+    get(): Effect.Effect<string, SecretError, WorkerEnvironment>;
+}
+declare const SecretBinding_base: Binding.Service<SecretBinding, "Cloudflare.SecretsStore.Secret", (secret: Secret) => Effect.Effect<SecretClient>> & {
+    bind: (secret: Secret) => Effect.Effect<any, any, any>;
+};
+export declare class SecretBinding extends SecretBinding_base {
+}
+export declare const SecretBindingLive: Layer.Layer<SecretBinding, never, import("../../RuntimeContext.ts").RuntimeContext<import("../../RuntimeContext.ts").BaseRuntimeContext> | SecretBindingPolicy>;
+declare const SecretBindingPolicy_base: Binding.Policy<SecretBindingPolicy, "Policy<Cloudflare.SecretsStore.Secret>", (secret: Secret) => Effect.Effect<void>>;
+export declare class SecretBindingPolicy extends SecretBindingPolicy_base {
+}
+export declare const SecretBindingPolicyLive: Layer.Layer<SecretBindingPolicy, never, never>;
+export {};
+//# sourceMappingURL=SecretBinding.d.ts.map

package/lib/Cloudflare/SecretsStore/SecretBinding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretBinding.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/SecretsStore/SecretBinding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,OAAO,MAAM,2BAA2B,CAAC;AAE1D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAY,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;;;;AAE1C,qBAAa,WAAY,SAAQ,iBAAgC;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;CACd,CAAC;CAAG;AAEL;;;;;GAKG;AACH,MAAM,WAAW,YAAa,SAAQ,MAAM,CAAC,MAAM,CACjD,MAAM,EACN,WAAW,EACX,iBAAiB,CAClB;IACC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACzE;;OAEG;IACH,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;CAC9D;4GAIU,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;;;AAFjD,qBAAa,aAAc,SAAQ,kBAGE;CAAG;AAExC,eAAO,MAAM,iBAAiB,iKAwC7B,CAAC;+HAIS,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;AAFzC,qBAAa,mBAAoB,SAAQ,wBAGJ;CAAG;AAExC,eAAO,MAAM,uBAAuB,gDAmBnC,CAAC"}

package/lib/Cloudflare/SecretsStore/SecretBinding.js

@@ -0,0 +1,49 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.js";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.js";
+export class SecretError extends Data.TaggedError("SecretError") {
+}
+export class SecretBinding extends Binding.Service()("Cloudflare.SecretsStore.Secret") {
+}
+export const SecretBindingLive = Layer.effect(SecretBinding, Effect.gen(function* () {
+    const bind = yield* SecretBindingPolicy;
+    return Effect.fn(function* (secret) {
+        yield* bind(secret);
+        const env = WorkerEnvironment.asEffect();
+        const raw = env.pipe(Effect.map((env) => env[secret.LogicalId]));
+        const tryPromise = (fn) => Effect.tryPromise({
+            try: fn,
+            catch: (error) => new SecretError({
+                message: error.message ?? "Unknown error",
+                cause: error,
+            }),
+        });
+        const getEffect = raw.pipe(Effect.flatMap((raw) => tryPromise(() => raw.get())));
+        return Object.assign(Effect.suspend(() => getEffect), {
+            raw,
+            get: () => getEffect,
+        });
+    });
+}));
+export class SecretBindingPolicy extends Binding.Policy()("Cloudflare.SecretsStore.Secret") {
+}
+export const SecretBindingPolicyLive = SecretBindingPolicy.layer.succeed(Effect.fn(function* (host, secret) {
+    if (isWorker(host)) {
+        yield* host.bind `${secret}`({
+            bindings: [
+                {
+                    type: "secrets_store_secret",
+                    name: secret.LogicalId,
+                    secretName: secret.secretName,
+                    storeId: secret.storeId,
+                },
+            ],
+        });
+    }
+    else {
+        return yield* Effect.die(new Error(`SecretBinding does not support runtime '${host.Type}'`));
+    }
+}));
+//# sourceMappingURL=SecretBinding.js.map

package/lib/Cloudflare/SecretsStore/SecretBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretBinding.js","sourceRoot":"","sources":["../../../src/Cloudflare/SecretsStore/SecretBinding.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAGnE,MAAM,OAAO,WAAY,SAAQ,IAAI,CAAC,WAAW,CAAC,aAAa,CAG7D;CAAG;AAuBL,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAG/C,CAAC,gCAAgC,CAAC;CAAG;AAExC,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC,MAAM,CAC3C,aAAa,EACb,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;IAExC,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAc;QACxC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAClB,MAAM,CAAC,GAAG,CACR,CAAC,GAAG,EAAE,EAAE,CACL,GAAkD,CACjD,MAAM,CAAC,SAAS,CACjB,CACJ,CACF,CAAC;QACF,MAAM,UAAU,GAAG,CACjB,EAAoB,EACW,EAAE,CACjC,MAAM,CAAC,UAAU,CAAC;YAChB,GAAG,EAAE,EAAE;YACP,KAAK,EAAE,CAAC,KAAU,EAAE,EAAE,CACpB,IAAI,WAAW,CAAC;gBACd,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,eAAe;gBACzC,KAAK,EAAE,KAAK;aACb,CAAC;SACL,CAAC,CAAC;QAEL,MAAM,SAAS,GACb,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAEjE,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAC/B;YACE,GAAG;YACH,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;SACrB,CACc,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEF,MAAM,OAAO,mBAAoB,SAAQ,OAAO,CAAC,MAAM,EAGpD,CAAC,gCAAgC,CAAC;CAAG;AAExC,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CACtE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAkB,EAAE,MAAc;IACrD,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA,GAAG,MAAM,EAAE,CAAC;YAC1B,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,sBAAsB;oBAC5B,IAAI,EAAE,MAAM,CAAC,SAAS;oBACtB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB;aACF;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,IAAI,GAAG,CAAC,CACnE,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CACH,CAAC"}

package/lib/Cloudflare/SecretsStore/SecretsStore.d.ts

@@ -0,0 +1,39 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+export type SecretsStore = Resource<"Cloudflare.SecretsStore", {}, {
+    storeId: string;
+    storeName: string;
+    accountId: string;
+}, never, Providers>;
+/**
+ * A Cloudflare Secrets Store, a per-account container for secrets that
+ * can be bound into Workers with full redaction and audit support.
+ *
+ * Cloudflare enforces a limit of **one Secrets Store per account**.
+ * Deleting a store changes its ID and permanently destroys all secrets
+ * inside it. Because of this, the provider always **adopts** an existing
+ * store rather than creating a new one, and **never deletes** the store
+ * on teardown. The `read` lifecycle reports the existing account store
+ * (if any) as plain attrs, so the engine silently adopts it on cold
+ * start and `create` is only ever invoked when no store exists yet.
+ * Once it exists it is treated as account-level infrastructure that
+ * outlives any single stack.
+ *
+ * @section Creating a Store
+ * @example Basic Secrets Store (adopts existing or creates one)
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore");
+ * ```
+ *
+ * @example Adopt a specific named store
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore", {
+ *   name: "production-secrets",
+ * });
+ * ```
+ */
+export declare const SecretsStore: import("../../Resource.ts").ResourceClass<SecretsStore>;
+export declare const SecretsStoreProvider: () => import("effect/Layer").Layer<Provider.Provider<SecretsStore>, never, import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/cloudflare").Credentials | CloudflareEnvironment>;
+//# sourceMappingURL=SecretsStore.d.ts.map

package/lib/Cloudflare/SecretsStore/SecretsStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsStore.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/SecretsStore/SecretsStore.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,MAAM,YAAY,GAAG,QAAQ,CACjC,yBAAyB,EACzB,EAAE,EACF;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,EACD,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,YAAY,yDAAoD,CAAC;AAE9E,eAAO,MAAM,oBAAoB,8MA+F9B,CAAC"}

package/lib/Cloudflare/SecretsStore/SecretsStore.js

@@ -0,0 +1,112 @@
+import * as secretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as Effect from "effect/Effect";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
+/**
+ * A Cloudflare Secrets Store, a per-account container for secrets that
+ * can be bound into Workers with full redaction and audit support.
+ *
+ * Cloudflare enforces a limit of **one Secrets Store per account**.
+ * Deleting a store changes its ID and permanently destroys all secrets
+ * inside it. Because of this, the provider always **adopts** an existing
+ * store rather than creating a new one, and **never deletes** the store
+ * on teardown. The `read` lifecycle reports the existing account store
+ * (if any) as plain attrs, so the engine silently adopts it on cold
+ * start and `create` is only ever invoked when no store exists yet.
+ * Once it exists it is treated as account-level infrastructure that
+ * outlives any single stack.
+ *
+ * @section Creating a Store
+ * @example Basic Secrets Store (adopts existing or creates one)
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore");
+ * ```
+ *
+ * @example Adopt a specific named store
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore", {
+ *   name: "production-secrets",
+ * });
+ * ```
+ */
+export const SecretsStore = Resource("Cloudflare.SecretsStore");
+export const SecretsStoreProvider = () => Provider.effect(SecretsStore, Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+    const createStore = yield* secretsStore.createStore;
+    const listStores = yield* secretsStore.listStores;
+    return {
+        stables: ["storeId", "storeName", "accountId"],
+        // The engine calls `read` whenever there's no prior state. Cloudflare
+        // allows exactly one Secrets Store per account, so any account that's
+        // ever provisioned one must reuse it. Returning the existing store as
+        // plain attrs makes the engine silently adopt it; `create` is only
+        // ever invoked when no store exists yet.
+        read: Effect.fn(function* ({ output }) {
+            const stores = yield* listStores({
+                accountId: output?.accountId ?? accountId,
+            });
+            const match = output?.storeId
+                ? stores.result.find((s) => s.id === output.storeId)
+                : stores.result[0];
+            if (!match)
+                return undefined;
+            return {
+                storeId: match.id,
+                storeName: match.name,
+                accountId: output?.accountId ?? accountId,
+            };
+        }),
+        reconcile: Effect.fn(function* ({ output }) {
+            const acct = output?.accountId ?? accountId;
+            // Observe — Cloudflare permits exactly one Secrets Store per
+            // account. List the account's stores; reuse the cached one if
+            // it still exists, otherwise reuse the first one.
+            const stores = yield* listStores({ accountId: acct });
+            const observed = output?.storeId
+                ? (stores.result.find((s) => s.id === output.storeId) ??
+                    stores.result[0])
+                : stores.result[0];
+            if (observed) {
+                return {
+                    storeId: observed.id,
+                    storeName: observed.name,
+                    accountId: acct,
+                };
+            }
+            // Ensure — no store yet. Create the default. Cloudflare reports
+            // a concurrent create as `MaximumStoresExceeded`; tolerate by
+            // re-listing and adopting the now-existing store.
+            const response = yield* createStore({
+                accountId: acct,
+                // `default_secrets_store` is the name Cloudflare uses for an
+                // account's default Secrets Store.
+                name: "default_secrets_store",
+            }).pipe(Effect.catchTag("MaximumStoresExceeded", () => Effect.succeed(undefined)));
+            if (response) {
+                return {
+                    storeId: response.id,
+                    storeName: response.name,
+                    accountId: acct,
+                };
+            }
+            const after = yield* listStores({ accountId: acct });
+            const first = after.result[0];
+            if (first) {
+                return {
+                    storeId: first.id,
+                    storeName: first.name,
+                    accountId: acct,
+                };
+            }
+            return yield* Effect.die(new Error(`Cloudflare reported MaximumStoresExceeded for account ${acct} but no store could be listed.`));
+        }),
+        delete: Effect.fn(function* () {
+            // Intentional no-op. Cloudflare only allows one Secrets Store per
+            // account and deleting it permanently destroys all secrets inside.
+            // The store is treated as shared, account-level infrastructure that
+            // should never be torn down by a single stack.
+        }),
+    };
+}));
+//# sourceMappingURL=SecretsStore.js.map

package/lib/Cloudflare/SecretsStore/SecretsStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsStore.js","sourceRoot":"","sources":["../../../src/Cloudflare/SecretsStore/SecretsStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,YAAY,MAAM,2CAA2C,CAAC;AAC1E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAepE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAe,yBAAyB,CAAC,CAAC;AAE9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,EAAE,CACvC,QAAQ,CAAC,MAAM,CACb,YAAY,EACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC;IACnD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC;IACpD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC;IAElD,OAAO;QACL,OAAO,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC;QAC9C,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,mEAAmE;QACnE,yCAAyC;QACzC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;gBAC/B,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,SAAS;aAC1C,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO;gBAC3B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,OAAO,CAAC;gBACpD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,OAAO;gBACL,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,SAAS;aAC1C,CAAC;QACJ,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACxC,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;YAE5C,6DAA6D;YAC7D,8DAA8D;YAC9D,kDAAkD;YAClD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,MAAM,EAAE,OAAO;gBAC9B,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,OAAO,CAAC;oBACnD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACnB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAErB,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,QAAQ,CAAC,EAAE;oBACpB,SAAS,EAAE,QAAQ,CAAC,IAAI;oBACxB,SAAS,EAAE,IAAI;iBAChB,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,8DAA8D;YAC9D,kDAAkD;YAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;gBAClC,SAAS,EAAE,IAAI;gBACf,6DAA6D;gBAC7D,mCAAmC;gBACnC,IAAI,EAAE,uBAAuB;aAC9B,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;YAEF,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,QAAQ,CAAC,EAAE;oBACpB,SAAS,EAAE,QAAQ,CAAC,IAAI;oBACxB,SAAS,EAAE,IAAI;iBAChB,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO;oBACL,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,SAAS,EAAE,KAAK,CAAC,IAAI;oBACrB,SAAS,EAAE,IAAI;iBAChB,CAAC;YACJ,CAAC;YAED,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,IAAI,KAAK,CACP,yDAAyD,IAAI,gCAAgC,CAC9F,CACF,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;YACzB,kEAAkE;YAClE,mEAAmE;YACnE,oEAAoE;YACpE,+CAA+C;QACjD,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Cloudflare/SecretsStore/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./Secret.ts";
+export * from "./SecretBinding.ts";
+export * from "./SecretsStore.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/Cloudflare/SecretsStore/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/SecretsStore/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC"}

package/lib/Cloudflare/SecretsStore/index.js

@@ -0,0 +1,4 @@
+export * from "./Secret.js";
+export * from "./SecretBinding.js";
+export * from "./SecretsStore.js";
+//# sourceMappingURL=index.js.map

package/lib/Cloudflare/SecretsStore/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/Cloudflare/SecretsStore/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC"}

package/lib/Cloudflare/StateStore/Api.d.ts

@@ -0,0 +1,87 @@
+import * as Effect from "effect/Effect";
+export declare const STATE_STORE_SCRIPT_NAME: "alchemy-state-store";
+/**
+ * Version of the deployed Cloudflare State Store worker contract.
+ *
+ * Bump this whenever the wire format or runtime behaviour of the
+ * worker changes in a way that an older deployed copy can no longer
+ * satisfy. Clients query `/version` on the deployed worker and
+ * compare against this constant; a mismatch (or 404) triggers a
+ * forced redeploy via the bootstrap flow.
+ */
+export declare const STATE_STORE_VERSION: 2;
+/**
+ * Path on disk to *this* file, used as the worker's bundling entry.
+ *
+ * When running from source (e.g. dev / monorepo), `import.meta.url` points
+ * at `Api.ts` and we can use it directly. When the alchemy CLI is run from
+ * its published `bin/alchemy.js` bundle, this module is inlined into the
+ * CLI bundle and `import.meta.url` resolves to `bin/alchemy.js` — which
+ * has no `default` export and breaks the worker bundler with
+ * `[MISSING_EXPORT] "default" is not exported by "bin/alchemy.js"`.
+ *
+ * In the bundled case, fall back to the published source file shipped
+ * alongside the CLI under `../src/Cloudflare/StateStore/Api.ts`.
+ */
+declare const _default: Effect.Effect<import("effect/Pipeable").Pipeable & import("../../Resource.ts").ResourceLike<"Cloudflare.Worker", import("../index.ts").WorkerProps<any, import("../index.ts").WorkerAssetsConfig | undefined>, {
+    workerId: string;
+    workerName: string;
+    logpush: boolean | undefined;
+    url: string | undefined;
+    tags: string[] | undefined;
+    durableObjectNamespaces: Record<string, string>;
+    accountId: string;
+    domains: {
+        hostname: string;
+        id: string;
+        zoneId: string;
+    }[];
+    hash?: {
+        assets: string | undefined;
+        bundle: string | undefined;
+        input: string | undefined;
+    };
+}, {
+    bindings?: import("../index.ts").WorkerBinding[];
+    containers?: {
+        className: string;
+    }[];
+    hyperdrives?: Record<string, Required<import("../index.ts").HyperdriveDevOrigin>>;
+}, import("../Providers.ts").Providers> & {
+    bind(sid: string, binding: import("../../Input.ts").Input<{
+        bindings?: import("../index.ts").WorkerBinding[];
+        containers?: {
+            className: string;
+        }[];
+        hyperdrives?: Record<string, Required<import("../index.ts").HyperdriveDevOrigin>>;
+    }>): Effect.Effect<void>;
+    bind(template: TemplateStringsArray, ...args: any[]): (binding: import("../../Input.ts").Input<{
+        bindings?: import("../index.ts").WorkerBinding[];
+        containers?: {
+            className: string;
+        }[];
+        hyperdrives?: Record<string, Required<import("../index.ts").HyperdriveDevOrigin>>;
+    }>) => Effect.Effect<void>;
+} & {
+    workerId: import("../../Output.ts").Output<string, never>;
+    workerName: import("../../Output.ts").Output<string, never>;
+    logpush: import("../../Output.ts").Output<boolean | undefined, never>;
+    url: import("../../Output.ts").Output<string | undefined, never>;
+    tags: import("../../Output.ts").Output<string[] | undefined, never>;
+    durableObjectNamespaces: import("../../Output.ts").Output<Record<string, string>, never>;
+    accountId: import("../../Output.ts").Output<string, never>;
+    domains: import("../../Output.ts").Output<{
+        hostname: string;
+        id: string;
+        zoneId: string;
+    }[], never>;
+    hash: import("../../Output.ts").Output<{
+        assets: string | undefined;
+        bundle: string | undefined;
+        input: string | undefined;
+    } | undefined, never>;
+} & import("../../Platform.ts").Rpc<{
+    fetch: Effect.Effect<Effect.Effect<import("effect/unstable/http/HttpServerResponse").HttpServerResponse, import("effect/unstable/http/HttpServerError").HttpServerError, import("effect/Scope").Scope | import("effect/unstable/http/HttpServerRequest").HttpServerRequest>, never, import("effect/FileSystem").FileSystem | import("effect/Scope").Scope | import("../index.ts").WorkerEnvironment>;
+}>, never, import("../Providers.ts").Providers>;
+export default _default;
+//# sourceMappingURL=Api.d.ts.map

package/lib/Cloudflare/StateStore/Api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Api.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/StateStore/Api.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAoBxC,eAAO,MAAM,uBAAuB,EAAG,qBAA8B,CAAC;AAEtE;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAG,CAAU,CAAC;AAsD9C;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACH,wBA+LE"}