alchemy 2.0.0-beta.34 → 2.0.0-beta.35

package/src/Cloudflare/R2/R2Bucket.ts

@@ -1,16 +1,47 @@
 import * as r2 from "@distilled.cloud/cloudflare/r2";
 import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
 
-import { isResolved } from "../../Diff.ts";
+import { deepEqual, isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type * as Cloudflare from "../Providers.ts";
+import * as Zone from "../Zone.ts";
 import { R2BucketBinding } from "./R2BucketBinding.ts";
 
 export type R2BucketName = string;
 
+export type R2BucketCustomDomainZone = Zone.ZoneReference;
+
+export type R2BucketCustomDomain = {
+  /**
+   * Custom domain name to attach to the bucket.
+   */
+  name: string;
+  /**
+   * Zone that contains the custom domain. If omitted, the zone is inferred
+   * from `domain`. Pass a zone ID string, a hostname in the zone, or any object
+   * with a `zoneId` attribute such as `Cloudflare.Zone`.
+   */
+  zone?: R2BucketCustomDomainZone;
+  /**
+   * Whether public bucket access is enabled at this custom domain.
+   * @default true
+   */
+  enabled?: boolean;
+  /**
+   * Allowlist of TLS ciphers in BoringSSL format.
+   */
+  ciphers?: string[];
+  /**
+   * Minimum TLS version accepted by the custom domain.
+   * @default "1.0"
+   */
+  minTLS?: "1.0" | "1.1" | "1.2" | "1.3";
+};
+
 export type R2BucketProps = {
   /**
    * Name of the bucket. If omitted, a unique name will be generated.
@@ -31,6 +62,11 @@ export type R2BucketProps = {
    * Location hint for the bucket.
    */
   locationHint?: R2Bucket.Location;
+  /**
+   * Custom domains to attach to the bucket. Pass an empty array (or omit)
+   * to remove all custom domains.
+   */
+  domains?: R2BucketCustomDomain[];
 };
 
 export type R2Bucket = Resource<
@@ -42,6 +78,7 @@ export type R2Bucket = Resource<
     jurisdiction: R2Bucket.Jurisdiction;
     location: R2Bucket.Location | undefined;
     accountId: string;
+    domains: R2Bucket.CustomDomain[];
   },
   never,
   Cloudflare.Providers
@@ -89,6 +126,55 @@ export type R2Bucket = Resource<
  *   contentLength: Number(request.headers["content-length"] ?? 0),
  * });
  * ```
+ *
+ * @section Custom Domains
+ *
+ * Attach one or more custom domains to serve bucket objects from a hostname
+ * you control. The domain's zone must already exist in your Cloudflare
+ * account; the zone is inferred from the hostname when omitted, or you can
+ * pass a `Cloudflare.Zone` resource, a zone ID, or any hostname inside the
+ * zone via the `zone` field.
+ *
+ * @example Single custom domain
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2Bucket("MyBucket", {
+ *   domains: [{ name: "assets.example.com" }],
+ * });
+ * ```
+ *
+ * @example Multiple custom domains
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2Bucket("MyBucket", {
+ *   domains: [
+ *     { name: "assets.example.com" },
+ *     { name: "static.example.com" },
+ *   ],
+ * });
+ * ```
+ *
+ * @example Disable a custom domain without removing it
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2Bucket("MyBucket", {
+ *   domains: [{ name: "assets.example.com", enabled: false }],
+ * });
+ * ```
+ *
+ * @example Custom domain with explicit zone and TLS settings
+ * ```typescript
+ * const zone = yield* Cloudflare.Zone("ExampleZone", {
+ *   name: "example.com",
+ * });
+ *
+ * const bucket = yield* Cloudflare.R2Bucket("MyBucket", {
+ *   domains: [
+ *     {
+ *       name: "assets.example.com",
+ *       zone,
+ *       minTLS: "1.2",
+ *     },
+ *   ],
+ * });
+ * ```
  */
 export const R2Bucket = Resource<R2Bucket>("Cloudflare.R2Bucket")({
   bind: R2BucketBinding.bind,
@@ -98,6 +184,31 @@ export declare namespace R2Bucket {
   export type StorageClass = "Standard" | "InfrequentAccess";
   export type Jurisdiction = "default" | "eu" | "fedramp";
   export type Location = "apac" | "eeur" | "enam" | "weur" | "wnam" | "oc";
+  export type CustomDomain = {
+    domain: string;
+    zoneId: string | undefined;
+    enabled: boolean;
+    ciphers: string[] | undefined;
+    minTLS: "1.0" | "1.1" | "1.2" | "1.3" | undefined;
+    status:
+      | {
+          ownership:
+            | "pending"
+            | "active"
+            | "deactivated"
+            | "blocked"
+            | "error"
+            | "unknown";
+          ssl:
+            | "initializing"
+            | "pending"
+            | "active"
+            | "deactivated"
+            | "error"
+            | "unknown";
+        }
+      | undefined;
+  };
 }
 
 export const R2BucketProvider = () =>
@@ -109,6 +220,10 @@ export const R2BucketProvider = () =>
       const patchBucket = yield* r2.patchBucket;
       const deleteBucket = yield* r2.deleteBucket;
       const getBucket = yield* r2.getBucket;
+      const listBucketDomainCustoms = yield* r2.listBucketDomainCustoms;
+      const createBucketDomainCustom = yield* r2.createBucketDomainCustom;
+      const updateBucketDomainCustom = yield* r2.updateBucketDomainCustom;
+      const deleteBucketDomainCustom = yield* r2.deleteBucketDomainCustom;
 
       const createBucketName = (id: string, name: string | undefined) =>
         Effect.gen(function* () {
@@ -126,6 +241,148 @@ export const R2BucketProvider = () =>
         return location.toLowerCase() as R2Bucket.Location;
       };
 
+      const listCustomDomains = (
+        bucketName: string,
+        jurisdiction: R2Bucket.Jurisdiction,
+      ) =>
+        listBucketDomainCustoms({
+          accountId,
+          bucketName,
+          jurisdiction,
+        }).pipe(
+          Effect.retry({
+            while: isNoSuchBucket,
+            schedule: r2CustomDomainConsistencySchedule,
+          }),
+          Effect.map((response) =>
+            response.domains.map(toCustomDomainAttributes),
+          ),
+          Effect.catchTag("NoSuchBucket", () => Effect.succeed(undefined)),
+        );
+
+      const reconcileCustomDomains = (
+        bucketName: string,
+        jurisdiction: R2Bucket.Jurisdiction,
+        desired: R2BucketCustomDomain[],
+        previous: R2Bucket.CustomDomain[],
+      ) =>
+        Effect.gen(function* () {
+          const observed = yield* listCustomDomains(bucketName, jurisdiction);
+          if (!observed) {
+            return yield* Effect.fail(
+              new Error(
+                `Cannot reconcile custom domains for missing R2 bucket "${bucketName}"`,
+              ),
+            );
+          }
+          const observedByDomain = new Map(
+            observed.map((domain) => [domain.domain, domain]),
+          );
+          const desiredDomains = new Set(desired.map((domain) => domain.name));
+
+          // Remove domains that are no longer desired. Domains that keep the
+          // same hostname but move zones are intentionally skipped here and
+          // handled in the per-domain flow below.
+          yield* Effect.forEach(
+            previous,
+            (previousDomain) =>
+              desiredDomains.has(previousDomain.domain)
+                ? Effect.void
+                : deleteBucketDomainCustom({
+                    accountId,
+                    bucketName,
+                    domain: previousDomain.domain,
+                    jurisdiction,
+                  }).pipe(
+                    Effect.catchIf(
+                      isMissingCustomDomainOrBucket,
+                      () => Effect.void,
+                    ),
+                  ),
+            { concurrency: "unbounded" },
+          );
+
+          const applied = yield* Effect.forEach(
+            desired,
+            (domain) =>
+              Effect.gen(function* () {
+                const zoneId = yield* Zone.resolveZoneId({
+                  accountId,
+                  zone: domain.zone,
+                  hostname: domain.name,
+                });
+                const observedDomain = observedByDomain.get(domain.name);
+
+                if (
+                  observedDomain &&
+                  sameCustomDomainConfig(observedDomain, domain, zoneId)
+                ) {
+                  return observedDomain;
+                }
+
+                if (observedDomain && observedDomain.zoneId !== zoneId) {
+                  // Cloudflare does not mutate the zone for an existing custom
+                  // domain. This is not a duplicate of the stale-domain prune
+                  // above: the hostname is still desired, so that prune skips it
+                  // and this branch deletes only to recreate it in the new zone.
+                  yield* deleteBucketDomainCustom({
+                    accountId,
+                    bucketName,
+                    domain: domain.name,
+                    jurisdiction,
+                  }).pipe(
+                    Effect.catchIf(
+                      isMissingCustomDomainOrBucket,
+                      () => Effect.void,
+                    ),
+                  );
+                }
+
+                if (!observedDomain || observedDomain.zoneId !== zoneId) {
+                  const created = yield* createBucketDomainCustom({
+                    accountId,
+                    bucketName,
+                    jurisdiction,
+                    domain: domain.name,
+                    enabled: domain.enabled ?? true,
+                    zoneId,
+                    ciphers: domain.ciphers,
+                    minTLS: domain.minTLS,
+                  }).pipe(
+                    Effect.retry({
+                      while: isNoSuchBucket,
+                      schedule: r2CustomDomainConsistencySchedule,
+                    }),
+                  );
+                  return toCustomDomainAttributes({ ...created, zoneId });
+                }
+
+                const updated = yield* updateBucketDomainCustom({
+                  accountId,
+                  bucketName,
+                  domain: domain.name,
+                  jurisdiction,
+                  enabled: domain.enabled ?? true,
+                  ciphers: domain.ciphers,
+                  minTLS: domain.minTLS,
+                }).pipe(
+                  Effect.retry({
+                    while: isNoSuchBucket,
+                    schedule: r2CustomDomainConsistencySchedule,
+                  }),
+                );
+                return toCustomDomainAttributes({
+                  ...updated,
+                  enabled: updated.enabled ?? domain.enabled ?? true,
+                  zoneId,
+                });
+              }),
+            { concurrency: "unbounded" },
+          );
+
+          return applied.sort((a, b) => a.domain.localeCompare(b.domain));
+        });
+
       return {
         stables: ["bucketName", "accountId"],
         diff: Effect.fn(function* ({ id, olds = {}, news = {}, output }) {
@@ -152,6 +409,9 @@ export const R2BucketProvider = () =>
               stables: oldName === name ? ["bucketName"] : undefined,
             } as const;
           }
+          if (!deepEqual(olds.domains, news.domains)) {
+            return { action: "update" } as const;
+          }
         }),
         reconcile: Effect.fn(function* ({ id, news = {}, output }) {
           const name = yield* createBucketName(id, news.name);
@@ -206,15 +466,37 @@ export const R2BucketProvider = () =>
             });
           }
 
-          return {
+          const attrs = {
             bucketName: observed.name!,
             storageClass: observed.storageClass ?? "Standard",
             jurisdiction: observed.jurisdiction ?? "default",
             location: normalizeLocation(observed.location),
             accountId: acct,
           };
+
+          const domains = yield* reconcileCustomDomains(
+            attrs.bucketName,
+            attrs.jurisdiction,
+            news.domains ?? [],
+            output?.domains ?? [],
+          );
+
+          return {
+            ...attrs,
+            domains,
+          };
         }),
         delete: Effect.fn(function* ({ output }) {
+          for (const domain of output.domains ?? []) {
+            yield* deleteBucketDomainCustom({
+              accountId: output.accountId,
+              bucketName: output.bucketName,
+              domain: domain.domain,
+              jurisdiction: output.jurisdiction,
+            }).pipe(
+              Effect.catchIf(isMissingCustomDomainOrBucket, () => Effect.void),
+            );
+          }
           yield* deleteBucket({
             accountId: output.accountId,
             bucketName: output.bucketName,
@@ -236,6 +518,7 @@ export const R2BucketProvider = () =>
               jurisdiction: bucket.jurisdiction ?? "default",
               location: normalizeLocation(bucket.location),
               accountId: acct,
+              domains: output?.domains ?? [],
             })),
             Effect.catchTag("NoSuchBucket", () => Effect.succeed(undefined)),
           );
@@ -243,3 +526,55 @@ export const R2BucketProvider = () =>
       };
     }),
   );
+
+// R2 can make a newly-created bucket visible to `getBucket` before the custom
+// domain endpoints accept it. Retry only that narrow `NoSuchBucket` lag here;
+// not-found domains are still treated as terminal for idempotent deletes.
+const r2CustomDomainConsistencySchedule = Schedule.exponential(100).pipe(
+  Schedule.both(Schedule.recurs(5)),
+);
+
+type CustomDomainResponse = {
+  domain: string;
+  zoneId?: string | null;
+  enabled?: boolean | null;
+  ciphers?: string[] | null;
+  minTLS?: "1.0" | "1.1" | "1.2" | "1.3" | null;
+  status?: R2Bucket.CustomDomain["status"];
+};
+
+const toCustomDomainAttributes = (
+  domain: CustomDomainResponse,
+): R2Bucket.CustomDomain => ({
+  domain: domain.domain,
+  zoneId: domain.zoneId ?? undefined,
+  enabled: domain.enabled ?? true,
+  ciphers: domain.ciphers ?? undefined,
+  minTLS: domain.minTLS ?? undefined,
+  status: domain.status,
+});
+
+const sameCustomDomainConfig = (
+  observed: R2Bucket.CustomDomain | undefined,
+  desired: R2BucketCustomDomain,
+  zoneId: string,
+): boolean =>
+  observed !== undefined &&
+  observed.zoneId === zoneId &&
+  observed.enabled === (desired.enabled ?? true) &&
+  deepEqual(observed.ciphers, desired.ciphers) &&
+  observed.minTLS === desired.minTLS;
+
+const isMissingCustomDomainOrBucket = (error: unknown): boolean =>
+  typeof error === "object" &&
+  error !== null &&
+  (("status" in error && (error as { status: unknown }).status === 404) ||
+    ("_tag" in error &&
+      ((error as { _tag: unknown })._tag === "DomainNotFound" ||
+        (error as { _tag: unknown })._tag === "NoSuchBucket")));
+
+const isNoSuchBucket = (error: unknown): boolean =>
+  typeof error === "object" &&
+  error !== null &&
+  "_tag" in error &&
+  (error as { _tag: unknown })._tag === "NoSuchBucket";

package/src/Cloudflare/StateStore/State.ts

@@ -13,8 +13,11 @@ import * as Output from "../../Output.ts";
 import * as Config from "effect/Config";
 import { adopt } from "../../AdoptPolicy.ts";
 import { AuthError } from "../../Auth/AuthProvider.ts";
-import { readCredentials, writeCredentials } from "../../Auth/Credentials.ts";
-import { ALCHEMY_PROFILE } from "../../Auth/Profile.ts";
+import {
+  CredentialsStore,
+  CredentialsStoreLive,
+} from "../../Auth/Credentials.ts";
+import { ALCHEMY_PROFILE, ProfileLive } from "../../Auth/Profile.ts";
 import * as Cloudflare from "../../Cloudflare/Providers.ts";
 import { deploy } from "../../Deploy.ts";
 import * as Alchemy from "../../Stack.ts";
@@ -162,7 +165,8 @@ export const bootstrap = (options: BootstrapOptions = {}) =>
       );
       const credentials = yield* loginWithCloudflare();
       if (!isCI) {
-        yield* writeCredentials<HttpStateStoreCredentials>(
+        const store = yield* CredentialsStore;
+        yield* store.write<HttpStateStoreCredentials>(
           profileName,
           CREDENTIALS_FILE,
           credentials,
@@ -206,7 +210,8 @@ export const state = () =>
       const isCI = yield* Config.boolean("CI").pipe(Config.withDefault(false));
       const alchemyContext = yield* AlchemyContext;
       const profileName = yield* ALCHEMY_PROFILE;
-      const credentials = yield* readCredentials<HttpStateStoreCredentials>(
+      const store = yield* CredentialsStore;
+      const credentials = yield* store.read<HttpStateStoreCredentials>(
         profileName,
         CREDENTIALS_FILE,
       );
@@ -293,7 +298,7 @@ export const state = () =>
         // it exists, so fetch the secret token
         const credentials = yield* loginWithCloudflare();
         if (!isCI) {
-          yield* writeCredentials<HttpStateStoreCredentials>(
+          yield* store.write<HttpStateStoreCredentials>(
             profileName,
             CREDENTIALS_FILE,
             credentials,
@@ -348,6 +353,8 @@ export const state = () =>
     Layer.provideMerge(CloudflareEnvironment.fromProfile()),
     Layer.provideMerge(CloudflareAuth),
     Layer.provideMerge(Access.AccessLive),
+    Layer.provideMerge(ProfileLive),
+    Layer.provideMerge(CredentialsStoreLive),
     Layer.orDie,
   );
 
@@ -584,19 +591,21 @@ export const loginWithCloudflare = () =>
     if (!isCI) {
       // 4. Persist credentials. The profile entry is managed by
       //    `loadOrConfigure` when this is invoked through `configure`.
-      yield* writeCredentials<HttpStateStoreCredentials>(
-        profileName,
-        CREDENTIALS_FILE,
-        {
+      const credStore = yield* CredentialsStore;
+      yield* credStore
+        .write<HttpStateStoreCredentials>(profileName, CREDENTIALS_FILE, {
           url,
           authToken: authToken.trim(),
-        },
-      ).pipe(
-        Effect.mapError(
-          (e) =>
-            new AuthError({ message: "Failed to write credentials", cause: e }),
-        ),
-      );
+        })
+        .pipe(
+          Effect.mapError(
+            (e) =>
+              new AuthError({
+                message: "Failed to write credentials",
+                cause: e,
+              }),
+          ),
+        );
 
       yield* Clank.success(
         `HTTP state store credentials saved for '${profileName}'.`,

package/src/Cloudflare/Website/StaticSite.ts

@@ -1,4 +1,5 @@
 import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
 import { Command, type CommandProps } from "../../Build/Command.ts";
 import type { InputProps } from "../../Input.ts";
 import * as Namespace from "../../Namespace.ts";
@@ -135,7 +136,16 @@ export const StaticSite = <
         cwd: props.cwd,
         memo: props.memo,
         outdir: props.outdir,
-        env: props.env,
+        env: props.env
+          ? Object.fromEntries(
+              Object.entries(props.env).flatMap(([k, v]) => {
+                if (v === undefined) return [];
+                if (typeof v === "string" || Redacted.isRedacted(v))
+                  return [[k, v]];
+                return [[k, JSON.stringify(v)]];
+              }),
+            )
+          : undefined,
       })),
     );
 

package/src/Cloudflare/Workers/LocalWorkerProvider.ts

@@ -51,18 +51,25 @@ export const LocalWorkerProvider = () =>
           }
         }
         for (const [key, value] of Object.entries(props.env ?? {})) {
+          if (value === undefined) continue;
           if (Redacted.isRedacted(value)) {
             workerBindings.push({
               type: "secret_text",
               name: key,
               text: Redacted.value(value),
             });
-          } else {
+          } else if (typeof value === "string") {
             workerBindings.push({
               type: "plain_text",
               name: key,
               text: value,
             });
+          } else {
+            workerBindings.push({
+              type: "json",
+              name: key,
+              json: value,
+            });
           }
         }
         const result = yield* sidecar.serve({
@@ -88,6 +95,7 @@ export const LocalWorkerProvider = () =>
               sql: true,
             }),
           ),
+          userOptions: props.build,
         });
         return {
           workerId: name,