alchemy 2.0.0-beta.30 → 2.0.0-beta.32

package/src/Cloudflare/SecretsStore/Secret.ts

@@ -3,7 +3,7 @@ import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as Redacted from "effect/Redacted";
 import * as Stream from "effect/Stream";
-import { AdoptPolicy } from "../../AdoptPolicy.ts";
+import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
@@ -120,122 +120,141 @@ export const StoreSecretProvider = () =>
             return { action: "replace" } as const;
           }
         }),
-        create: Effect.fn(function* ({ id, news }) {
+        reconcile: Effect.fn(function* ({ id, news, output }) {
           const name = resolveName(id, news.name);
           const scopes = resolveScopes(news.scopes);
-          const adoptEnabled = yield* Effect.serviceOption(AdoptPolicy).pipe(
-            Effect.map(Option.getOrElse(() => false)),
-          );
+          const accountId = news.store.accountId;
+          const storeId = news.store.storeId;
 
-          const create = createStoreSecret({
-            accountId: news.store.accountId,
-            storeId: news.store.storeId,
-            body: [
-              {
-                name,
-                scopes,
-                value: Redacted.value(news.value),
-                comment: news.comment,
-              },
-            ],
-          });
-          // Only swallow the conflict when adoption is opted-in via
-          // `AdoptPolicy`; otherwise surface `SecretNameAlreadyExists`
-          // so the caller learns the secret already exists rather than
-          // silently taking ownership of someone else's secret.
-          const created = adoptEnabled
-            ? yield* create.pipe(
-                Effect.catchTag("SecretNameAlreadyExists", () =>
-                  Effect.succeed(undefined),
-                ),
-              )
-            : yield* create;
-
-          if (created) {
-            const secret = created.result[0]!;
-            return {
-              secretId: secret.id,
-              secretName: secret.name,
-              storeId: secret.storeId,
-              accountId: news.store.accountId,
-              status: secret.status,
-              scopes,
-              comment: secret.comment ?? undefined,
-            };
+          // Observe — re-fetch the cached secret; fall back to a name
+          // scan over the store so we recover from out-of-band deletes
+          // or partial state-persistence failures.
+          let observed:
+            | {
+                id: string;
+                name: string;
+                storeId: string;
+                status: "pending" | "active" | "deleted";
+                comment?: string | null;
+              }
+            | undefined;
+          if (output?.secretId) {
+            observed = yield* getStoreSecret({
+              accountId: output.accountId,
+              storeId: output.storeId,
+              secretId: output.secretId,
+            }).pipe(
+              Effect.catchTag("SecretNotFound", () =>
+                Effect.succeed(undefined),
+              ),
+              Effect.catchTag("StoreNotFound", () => Effect.succeed(undefined)),
+            );
+          }
+          if (!observed) {
+            observed = yield* listStoreSecrets
+              .items({ accountId, storeId })
+              .pipe(
+                Stream.filter((s) => s.name === name),
+                Stream.runHead,
+                Effect.catchTag("StoreNotFound", () => Effect.succeedNone),
+                Effect.map(Option.getOrUndefined),
+              );
           }
 
-          // Adopt-on-conflict path. A secret with this name already
-          // exists in Cloudflare — typically because a previous deploy
-          // partially failed (e.g. the secret was created server-side
-          // but the response was lost so local state never recorded
-          // it). We re-fetch the existing secret and reconcile
-          // scopes/comment. The value itself cannot be read back from
-          // the API and we trust that an identically-named secret in
-          // the same store reflects the same intent (this matches how
-          // SecretsStore itself adopts the account-wide store).
-          const existing = yield* listStoreSecrets
-            .items({
-              accountId: news.store.accountId,
-              storeId: news.store.storeId,
-            })
-            .pipe(
-              Stream.filter((s) => s.name === name),
-              Stream.runHead,
-              Effect.map(Option.getOrUndefined),
+          // Ensure — create if missing. Cloudflare reports a concurrent
+          // create as `SecretNameAlreadyExists`; tolerate by re-listing
+          // the store and adopting the secret with the same name. The
+          // value can't be read back from the API; we trust an
+          // identically-named secret reflects the same intent.
+          if (!observed) {
+            const created = yield* createStoreSecret({
+              accountId,
+              storeId,
+              body: [
+                {
+                  name,
+                  scopes,
+                  value: Redacted.value(news.value),
+                  comment: news.comment,
+                },
+              ],
+            }).pipe(
+              Effect.catchTag("SecretNameAlreadyExists", () =>
+                Effect.succeed(undefined),
+              ),
             );
+            if (created) {
+              const secret = created.result[0]!;
+              return {
+                secretId: secret.id,
+                secretName: secret.name,
+                storeId: secret.storeId,
+                accountId,
+                status: secret.status,
+                scopes,
+                comment: secret.comment ?? undefined,
+              };
+            }
+            const existing = yield* listStoreSecrets
+              .items({ accountId, storeId })
+              .pipe(
+                Stream.filter((s) => s.name === name),
+                Stream.runHead,
+                Effect.map(Option.getOrUndefined),
+              );
+            if (!existing) {
+              return yield* Effect.die(
+                new Error(
+                  `Secret '${name}' reported as already existing in store ${storeId} but could not be found on lookup.`,
+                ),
+              );
+            }
+            observed = existing;
+          }
 
-          if (!existing) {
-            return yield* Effect.die(
-              new Error(
-                `Secret '${name}' reported as already existing in store ${news.store.storeId} but could not be found on lookup.`,
+          // Sync — `listStoreSecrets` does not surface scopes, so we
+          // can't reliably diff them. Issue PATCH only when we have a
+          // record of prior props (`output`) and a difference is
+          // visible; otherwise issue an unconditional PATCH on the
+          // adoption / first-create path so scopes and comment converge.
+          const oldScopes = output ? resolveScopes(output.scopes) : undefined;
+          const scopesChanged = !oldScopes || !arraysEqual(scopes, oldScopes);
+          const commentChanged =
+            !output ||
+            (output.comment ?? undefined) !== (news.comment ?? undefined);
+          if (scopesChanged || commentChanged) {
+            const patched = yield* patchStoreSecret({
+              accountId,
+              storeId,
+              secretId: observed.id,
+              scopes: scopesChanged ? scopes : undefined,
+              comment: commentChanged ? news.comment : undefined,
+            }).pipe(
+              Effect.catchTag("SecretNotFound", () =>
+                Effect.succeed(undefined),
               ),
             );
+            if (patched) {
+              return {
+                secretId: observed.id,
+                secretName: observed.name,
+                storeId: observed.storeId,
+                accountId,
+                status: patched.status,
+                scopes,
+                comment: patched.comment ?? undefined,
+              };
+            }
           }
 
-          // listStoreSecrets does not surface scopes, so we have no way
-          // to detect drift; reconcile to the requested scopes/comment
-          // unconditionally. PATCH is cheap and idempotent.
-          const patched = yield* patchStoreSecret({
-            accountId: news.store.accountId,
-            storeId: news.store.storeId,
-            secretId: existing.id,
-            scopes,
-            comment: news.comment,
-          }).pipe(
-            Effect.catchTag("SecretNotFound", () => Effect.succeed(undefined)),
-          );
-
           return {
-            secretId: existing.id,
-            secretName: existing.name,
-            storeId: existing.storeId,
-            accountId: news.store.accountId,
-            status: patched?.status ?? existing.status,
+            secretId: observed.id,
+            secretName: observed.name,
+            storeId: observed.storeId,
+            accountId,
+            status: observed.status,
             scopes,
-            comment:
-              patched?.comment ?? news.comment ?? existing.comment ?? undefined,
-          };
-        }),
-        update: Effect.fn(function* ({ news, olds = {} as any, output }) {
-          const newScopes = resolveScopes(news.scopes);
-          const oldScopes = resolveScopes(olds.scopes);
-          const scopesChanged = !arraysEqual(newScopes, oldScopes);
-          const commentChanged = (olds.comment ?? undefined) !== news.comment;
-          if (!scopesChanged && !commentChanged) {
-            return output;
-          }
-          const patched = yield* patchStoreSecret({
-            accountId: output.accountId,
-            storeId: output.storeId,
-            secretId: output.secretId,
-            scopes: scopesChanged ? newScopes : undefined,
-            comment: commentChanged ? news.comment : undefined,
-          });
-          return {
-            ...output,
-            status: patched.status,
-            scopes: newScopes,
-            comment: patched.comment ?? undefined,
+            comment: news.comment ?? observed.comment ?? undefined,
           };
         }),
         delete: Effect.fn(function* ({ output }) {
@@ -285,7 +304,11 @@ export const StoreSecretProvider = () =>
               Effect.map(Option.getOrUndefined),
             );
           if (!match) return undefined;
-          return {
+          // Secrets carry no ownership signal (Cloudflare doesn't expose
+          // tags on store secrets), so a name match is not proof we own
+          // it. Brand it `Unowned` so the engine surfaces
+          // `OwnedBySomeoneElse` unless the caller opted in via `--adopt`.
+          return Unowned({
             secretId: match.id,
             secretName: match.name,
             storeId: match.storeId,
@@ -293,7 +316,7 @@ export const StoreSecretProvider = () =>
             status: match.status,
             scopes: resolveScopes(olds.scopes),
             comment: match.comment ?? undefined,
-          };
+          });
         }),
       };
     }),

package/src/Cloudflare/SecretsStore/SecretsStore.ts

@@ -1,7 +1,5 @@
 import * as secretsStore from "@distilled.cloud/cloudflare/secrets-store";
 import * as Effect from "effect/Effect";
-import * as Option from "effect/Option";
-import { AdoptPolicy } from "../../AdoptPolicy.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
@@ -27,9 +25,11 @@ export type SecretsStore = Resource<
  * Deleting a store changes its ID and permanently destroys all secrets
  * inside it. Because of this, the provider always **adopts** an existing
  * store rather than creating a new one, and **never deletes** the store
- * on teardown. If no store exists yet, one is created, but once it
- * exists it is treated as account-level infrastructure that outlives
- * any single stack.
+ * on teardown. The `read` lifecycle reports the existing account store
+ * (if any) as plain attrs, so the engine silently adopts it on cold
+ * start and `create` is only ever invoked when no store exists yet.
+ * Once it exists it is treated as account-level infrastructure that
+ * outlives any single stack.
  *
  * @section Creating a Store
  * @example Basic Secrets Store (adopts existing or creates one)
@@ -56,86 +56,89 @@ export const SecretsStoreProvider = () =>
 
       return {
         stables: ["storeId", "storeName", "accountId"],
-        create: Effect.fn(function* () {
-          const adoptEnabled = yield* Effect.serviceOption(AdoptPolicy).pipe(
-            Effect.map(Option.getOrElse(() => false)),
-          );
+        // The engine calls `read` whenever there's no prior state. Cloudflare
+        // allows exactly one Secrets Store per account, so any account that's
+        // ever provisioned one must reuse it. Returning the existing store as
+        // plain attrs makes the engine silently adopt it; `create` is only
+        // ever invoked when no store exists yet.
+        read: Effect.fn(function* ({ output }) {
+          const stores = yield* listStores({
+            accountId: output?.accountId ?? accountId,
+          });
+          const match = output?.storeId
+            ? stores.result.find((s) => s.id === output.storeId)
+            : stores.result[0];
+          if (!match) return undefined;
+          return {
+            storeId: match.id,
+            storeName: match.name,
+            accountId: output?.accountId ?? accountId,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ output }) {
+          const acct = output?.accountId ?? accountId;
+
+          // Observe — Cloudflare permits exactly one Secrets Store per
+          // account. List the account's stores; reuse the cached one if
+          // it still exists, otherwise reuse the first one.
+          const stores = yield* listStores({ accountId: acct });
+          const observed = output?.storeId
+            ? (stores.result.find((s) => s.id === output.storeId) ??
+              stores.result[0])
+            : stores.result[0];
 
-          const adoptExisting = Effect.gen(function* () {
-            const stores = yield* listStores({ accountId });
-            const first = stores.result[0];
-            if (!first) return undefined;
+          if (observed) {
             return {
-              storeId: first.id,
-              storeName: first.name,
-              accountId,
+              storeId: observed.id,
+              storeName: observed.name,
+              accountId: acct,
             };
-          });
-
-          // Cloudflare allows exactly one Secrets Store per account, so
-          // any account that's been touched before may already have one.
-          // Only adopt it if the caller opted in via `AdoptPolicy`,
-          // otherwise let `createStore` surface MaximumStoresExceeded.
-          if (adoptEnabled) {
-            const adopted = yield* adoptExisting;
-            if (adopted) return adopted;
           }
 
-          const create = createStore({
-            accountId,
+          // Ensure — no store yet. Create the default. Cloudflare reports
+          // a concurrent create as `MaximumStoresExceeded`; tolerate by
+          // re-listing and adopting the now-existing store.
+          const response = yield* createStore({
+            accountId: acct,
             // `default_secrets_store` is the name Cloudflare uses for an
             // account's default Secrets Store.
             name: "default_secrets_store",
-          });
-          const response = adoptEnabled
-            ? yield* create.pipe(
-                // A concurrent process (or a previous partially-failed
-                // deploy) may have raced us between list and create.
-                Effect.catchTag("MaximumStoresExceeded", () =>
-                  Effect.succeed(undefined),
-                ),
-              )
-            : yield* create;
+          }).pipe(
+            Effect.catchTag("MaximumStoresExceeded", () =>
+              Effect.succeed(undefined),
+            ),
+          );
 
           if (response) {
             return {
               storeId: response.id,
               storeName: response.name,
-              accountId,
+              accountId: acct,
             };
           }
 
-          const recovered = yield* adoptExisting;
-          if (recovered) return recovered;
+          const after = yield* listStores({ accountId: acct });
+          const first = after.result[0];
+          if (first) {
+            return {
+              storeId: first.id,
+              storeName: first.name,
+              accountId: acct,
+            };
+          }
 
           return yield* Effect.die(
             new Error(
-              `Cloudflare reported MaximumStoresExceeded for account ${accountId} but no store could be listed.`,
+              `Cloudflare reported MaximumStoresExceeded for account ${acct} but no store could be listed.`,
             ),
           );
         }),
-        update: Effect.fn(function* ({ output }) {
-          return output;
-        }),
         delete: Effect.fn(function* () {
           // Intentional no-op. Cloudflare only allows one Secrets Store per
           // account and deleting it permanently destroys all secrets inside.
           // The store is treated as shared, account-level infrastructure that
           // should never be torn down by a single stack.
         }),
-        read: Effect.fn(function* ({ output }) {
-          if (!output?.storeId) return undefined;
-          const stores = yield* listStores({
-            accountId: output.accountId,
-          });
-          const match = stores.result.find((s) => s.id === output.storeId);
-          if (!match) return undefined;
-          return {
-            storeId: match.id,
-            storeName: match.name,
-            accountId: output.accountId,
-          };
-        }),
       };
     }),
   );