alchemy 2.0.0-beta.4 → 2.0.0-beta.41

package/lib/Cloudflare/R2/R2BucketBinding.js

@@ -0,0 +1,116 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as Binding from "../../Binding.js";
+import * as Output from "../../Output.js";
+import { getRawStream } from "../../Util/Stream.js";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.js";
+export class R2Error extends Data.TaggedError("R2Error") {
+}
+export class R2BucketBinding extends Binding.Service()("Cloudflare.R2Bucket") {
+}
+export const R2BucketBindingLive = Layer.effect(R2BucketBinding, Effect.gen(function* () {
+    const bind = yield* R2BucketBindingPolicy;
+    return Effect.fn(function* (bucket) {
+        yield* bind(bucket);
+        const env = WorkerEnvironment;
+        const raw = env.pipe(Effect.map((env) => env[bucket.LogicalId]));
+        const tryPromise = (fn) => Effect.tryPromise({
+            try: fn,
+            catch: (error) => new R2Error({
+                message: error.message ?? "Unknown error",
+                cause: error,
+            }),
+        });
+        const use = (fn) => raw.pipe(Effect.flatMap((raw) => tryPromise(() => fn(raw))));
+        const wrapR2Object = (object) => ({
+            ...object,
+            writeHttpMetadata: (headers) => Effect.sync(() => object.writeHttpMetadata(headers)),
+        });
+        const wrapR2ObjectBody = (object) => ({
+            ...wrapR2Object(object),
+            body: Stream.fromReadableStream({
+                evaluate: () => object.body,
+                onError: (error) => new R2Error({
+                    message: error.message ?? "Unknown error",
+                    cause: error,
+                }),
+            }),
+            bodyUsed: object.bodyUsed,
+            arrayBuffer: () => tryPromise(() => object.arrayBuffer()),
+            bytes: () => tryPromise(() => object.bytes()),
+            text: () => tryPromise(() => object.text()),
+            json: () => tryPromise(() => object.json()),
+            blob: () => tryPromise(() => object.blob()),
+        });
+        const wrapR2Objects = (objects) => ({
+            objects: objects.objects.map(wrapR2Object),
+            delimitedPrefixes: objects.delimitedPrefixes,
+            ...("cursor" in objects ? { cursor: objects.cursor } : {}),
+            ...("truncated" in objects ? { truncated: objects.truncated } : {}),
+        });
+        const wrapR2ObjectOrBody = (object) => object === null
+            ? object
+            : isR2ObjectBody(object)
+                ? wrapR2ObjectBody(object)
+                : wrapR2Object(object);
+        const wrapR2MultipartUpload = (upload) => ({
+            ...upload,
+            raw: upload,
+            uploadId: upload.uploadId,
+            abort: () => tryPromise(() => upload.abort()),
+            complete: (uploadedParts) => tryPromise(() => upload.complete(uploadedParts)).pipe(Effect.map(wrapR2Object)),
+            uploadPart: (partNumber, value, options) => tryPromise(() => upload.uploadPart(partNumber, Stream.isStream(value)
+                ? value.pipe(Stream.toReadableStream())
+                : value, options)),
+        });
+        const isR2ObjectBody = (object) => object !== null && typeof object === "object" && "body" in object;
+        return {
+            raw: raw,
+            head: (key) => use((raw) => raw.head(key)).pipe(Effect.map((object) => (object ? wrapR2Object(object) : object))),
+            get: (key, options) => use((raw) => raw.get(key, options)).pipe(Effect.map(wrapR2ObjectOrBody)),
+            // @ts-expect-error
+            put: (key, value, options) => use((raw) => {
+                if (Stream.isStream(value)) {
+                    const rawStream = getRawStream(value);
+                    if (rawStream) {
+                        return raw.put(key, rawStream, options);
+                    }
+                    else if (!options?.contentLength) {
+                        throw new Error("Content length is required");
+                    }
+                    // content length myst be known, so we pipe through fixed length stream
+                    // TODO(sam): is it more efficient to just assign the contentLength as a property?
+                    const readable = Stream.toReadableStream(value).pipeThrough(new FixedLengthStream(options.contentLength));
+                    return raw.put(key, readable);
+                }
+                return raw.put(key, value, options);
+            }).pipe(Effect.map(wrapR2ObjectOrBody)),
+            delete: (keys) => use((raw) => raw.delete(keys)),
+            list: (options) => use((raw) => raw.list(options)).pipe(Effect.map(wrapR2Objects)),
+            createMultipartUpload: (key, options) => use((raw) => raw.createMultipartUpload(key, options)).pipe(Effect.map(wrapR2MultipartUpload)),
+            resumeMultipartUpload: (key, uploadId) => raw.pipe(Effect.map((raw) => raw.resumeMultipartUpload(key, uploadId)), Effect.map(wrapR2MultipartUpload)),
+        };
+    });
+}));
+export class R2BucketBindingPolicy extends Binding.Policy()("Cloudflare.R2Bucket") {
+}
+export const R2BucketBindingPolicyLive = R2BucketBindingPolicy.layer.succeed(Effect.fnUntraced(function* (host, bucket) {
+    if (isWorker(host)) {
+        yield* host.bind `${bucket}`({
+            bindings: [
+                {
+                    type: "r2_bucket",
+                    name: bucket.LogicalId,
+                    bucketName: bucket.bucketName,
+                    jurisdiction: bucket.jurisdiction.pipe(Output.map((jurisdiction) => jurisdiction === "default" ? undefined : jurisdiction)),
+                },
+            ],
+        });
+    }
+    else {
+        return yield* Effect.die(new Error(`BucketBinding does not support runtime '${host.Type}'`));
+    }
+}));
+//# sourceMappingURL=R2BucketBinding.js.map

package/lib/Cloudflare/R2/R2BucketBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"R2BucketBinding.js","sourceRoot":"","sources":["../../../src/Cloudflare/R2/R2BucketBinding.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAqCnE,MAAM,OAAO,OAAQ,SAAQ,IAAI,CAAC,WAAW,CAAC,SAAS,CAGrD;CAAG;AAuFL,MAAM,OAAO,eAAgB,SAAQ,OAAO,CAAC,OAAO,EAGjD,CAAC,qBAAqB,CAAC;CAAG;AAE7B,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CAC7C,eAAe,EACf,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC;IAE1C,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAgB;QAC1C,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAClB,MAAM,CAAC,GAAG,CACR,CAAC,GAAG,EAAE,EAAE,CAAE,GAAwC,CAAC,MAAM,CAAC,SAAS,CAAC,CACrE,CACF,CAAC;QACF,MAAM,UAAU,GAAG,CAAI,EAAoB,EAA6B,EAAE,CACxE,MAAM,CAAC,UAAU,CAAC;YAChB,GAAG,EAAE,EAAE;YACP,KAAK,EAAE,CAAC,KAAU,EAAE,EAAE,CACpB,IAAI,OAAO,CAAC;gBACV,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,eAAe;gBACzC,KAAK,EAAE,KAAK;aACb,CAAC;SACL,CAAC,CAAC;QAEL,MAAM,GAAG,GAAG,CACV,EAAyC,EACK,EAAE,CAChD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE/D,MAAM,YAAY,GAAG,CAAC,MAAwB,EAAY,EAAE,CAAC,CAAC;YAC5D,GAAG,MAAM;YACT,iBAAiB,EAAE,CAAC,OAAgB,EAAE,EAAE,CACtC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;SACvD,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,CACvB,MAA4B,EACd,EAAE,CAAC,CAAC;YAClB,GAAG,YAAY,CAAC,MAAM,CAAC;YACvB,IAAI,EAAE,MAAM,CAAC,kBAAkB,CAAC;gBAC9B,QAAQ,EAAE,GAAG,EAAE,CACb,MAAM,CAAC,IAA0D;gBACnE,OAAO,EAAE,CAAC,KAAU,EAAE,EAAE,CACtB,IAAI,OAAO,CAAC;oBACV,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,eAAe;oBACzC,KAAK,EAAE,KAAK;iBACb,CAAC;aACL,CAAC;YACF,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACzD,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC7C,IAAI,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,EAAE,GAAM,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAK,CAAC;YACjD,IAAI,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC5C,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,CAAC,OAA0B,EAAa,EAAE,CAC9D,CAAC;YACC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;YAC1C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAc,CAAC;QAElB,MAAM,kBAAkB,GAAG,CACzB,MAAsD,EACtB,EAAE,CAClC,MAAM,KAAK,IAAI;YACb,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC;gBACtB,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAC1B,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAE7B,MAAM,qBAAqB,GAAG,CAC5B,MAAiC,EACd,EAAE,CAAC,CAAC;YACvB,GAAG,MAAM;YACT,GAAG,EAAE,MAAM;YACX,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC7C,QAAQ,EAAE,CAAC,aAA+B,EAAE,EAAE,CAC5C,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CACzB;YACH,UAAU,EAAE,CACV,UAAkB,EAClB,KAM6B,EAC7B,OAA6B,EAC7B,EAAE,CACF,UAAU,CAAC,GAAG,EAAE,CACd,MAAM,CAAC,UAAU,CACf,UAAU,EACV,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACpB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBACvC,CAAC,CAAE,KAAa,EAClB,OAAO,CACR,CACF;SACJ,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,CAAC,MAAW,EAAkC,EAAE,CACrE,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,MAAM,CAAC;QAEpE,OAAO;YACL,GAAG,EAAE,GAAG;YACR,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CACpB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACjE;YACH,GAAG,EAAE,CAAC,GAAW,EAAE,OAAsB,EAAE,EAAE,CAC3C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACtC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CACxB;YACV,mBAAmB;YACnB,GAAG,EAAE,CACH,GAAW,EACX,KAO6B,EAC7B,OAGC,EACD,EAAE,CACF,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACV,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC3B,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;oBACtC,IAAI,SAAS,EAAE,CAAC;wBACd,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,SAAgB,EAAE,OAAO,CAAC,CAAC;oBACjD,CAAC;yBAAM,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;wBACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBAChD,CAAC;oBACD,uEAAuE;oBACvE,kFAAkF;oBAClF,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,WAAW,CACzD,IAAI,iBAAiB,CAAC,OAAO,CAAC,aAAa,CAAC,CAC7C,CAAC;oBACF,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAe,CAAC,CAAC;gBACvC,CAAC;gBACD,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAY,EAAE,OAAO,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAQ;YAChD,MAAM,EAAE,CAAC,IAAuB,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnE,IAAI,EAAE,CAAC,OAAuB,EAAE,EAAE,CAChC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACjE,qBAAqB,EAAE,CAAC,GAAW,EAAE,OAA4B,EAAE,EAAE,CACnE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACxD,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAClC;YACH,qBAAqB,EAAE,CAAC,GAAW,EAAE,QAAgB,EAAE,EAAE,CACvD,GAAG,CAAC,IAAI,CACN,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAC7D,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAClC;SACuC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEF,MAAM,OAAO,qBAAsB,SAAQ,OAAO,CAAC,MAAM,EAGtD,CAAC,qBAAqB,CAAC;CAAG;AAE7B,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAC1E,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAkB,EAAE,MAAgB;IAC/D,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA,GAAG,MAAM,EAAE,CAAC;YAC1B,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,MAAM,CAAC,SAAS;oBACtB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CACpC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAC1B,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CACtD,CACF;iBACF;aACF;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,IAAI,GAAG,CAAC,CACnE,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CACH,CAAC"}

package/lib/Cloudflare/R2/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./R2Bucket.ts";
+export * from "./R2BucketBinding.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/Cloudflare/R2/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/R2/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC"}

package/lib/Cloudflare/R2/index.js

@@ -0,0 +1,3 @@
+export * from "./R2Bucket.js";
+export * from "./R2BucketBinding.js";
+//# sourceMappingURL=index.js.map

package/lib/Cloudflare/R2/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/Cloudflare/R2/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC"}

package/lib/Cloudflare/SecretsStore/Secret.d.ts

@@ -0,0 +1,74 @@
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { SecretBinding } from "./SecretBinding.ts";
+export type StoreSecretProps = {
+    /**
+     * The Secrets Store that owns this secret.
+     */
+    store: {
+        storeId: string;
+        accountId: string;
+    };
+    /**
+     * The name of the secret within the store.
+     * If omitted, the resource's logical ID is used.
+     */
+    name?: string;
+    /**
+     * The secret value. Treated as redacted and never logged.
+     */
+    value: Redacted.Redacted<string>;
+    /**
+     * Services allowed to reference this secret.
+     * @default ["workers"]
+     */
+    scopes?: string[];
+    /**
+     * Optional free-form description.
+     */
+    comment?: string;
+};
+export type Secret = Resource<"Cloudflare.SecretsStore.Secret", StoreSecretProps, {
+    secretId: string;
+    secretName: string;
+    storeId: string;
+    accountId: string;
+    status: "pending" | "active" | "deleted";
+    scopes: string[];
+    comment: string | undefined;
+}, never, Providers>;
+/**
+ * A single secret stored inside a Cloudflare Secrets Store.
+ *
+ * The secret value is treated as redacted and is only ever sent to
+ * Cloudflare at create time. Updating `scopes` or `comment` issues a
+ * PATCH; changing `value` or `name` replaces the secret.
+ *
+ * @section Creating a Secret
+ * @example Basic Secret
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore");
+ * const apiKey = yield* Cloudflare.StoreSecret("ApiKey", {
+ *   store,
+ *   value: Redacted.make(process.env.API_KEY!),
+ * });
+ * ```
+ *
+ * @section Binding to a Worker
+ * @example Reading a secret at runtime
+ * ```typescript
+ * const apiKey = yield* Cloudflare.StoreSecret.bind(ApiKey);
+ * // `apiKey` is itself an Effect that resolves to the secret value:
+ * const value = yield* apiKey;
+ * // Or call `.get()` explicitly:
+ * const value = yield* apiKey.get();
+ * ```
+ */
+export declare const Secret: import("../../Resource.ts").ResourceClassWithMethods<Secret, {
+    readonly bind: (<Req = never>(args_0: Secret | Effect.Effect<Secret, never, Req>) => Effect.Effect<import("./SecretBinding.ts").SecretClient, never, SecretBinding | Req>) & ((secret: Secret) => Effect.Effect<any, any, any>);
+}>;
+export declare const StoreSecretProvider: () => import("effect/Layer").Layer<Provider.Provider<Secret>, never, import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/cloudflare").Credentials>;
+//# sourceMappingURL=Secret.d.ts.map

package/lib/Cloudflare/SecretsStore/Secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Secret.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/SecretsStore/Secret.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAI5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;OAEG;IACH,KAAK,EAAE;QACL,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,QAAQ,CAC3B,gCAAgC,EAChC,gBAAgB,EAChB;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,EACD,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,MAAM;;EAEjB,CAAC;AAQH,eAAO,MAAM,mBAAmB,gLAsO7B,CAAC"}

package/lib/Cloudflare/SecretsStore/Secret.js

@@ -0,0 +1,216 @@
+import * as secretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+import { Unowned } from "../../AdoptPolicy.js";
+import { isResolved } from "../../Diff.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { SecretBinding } from "./SecretBinding.js";
+/**
+ * A single secret stored inside a Cloudflare Secrets Store.
+ *
+ * The secret value is treated as redacted and is only ever sent to
+ * Cloudflare at create time. Updating `scopes` or `comment` issues a
+ * PATCH; changing `value` or `name` replaces the secret.
+ *
+ * @section Creating a Secret
+ * @example Basic Secret
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore");
+ * const apiKey = yield* Cloudflare.StoreSecret("ApiKey", {
+ *   store,
+ *   value: Redacted.make(process.env.API_KEY!),
+ * });
+ * ```
+ *
+ * @section Binding to a Worker
+ * @example Reading a secret at runtime
+ * ```typescript
+ * const apiKey = yield* Cloudflare.StoreSecret.bind(ApiKey);
+ * // `apiKey` is itself an Effect that resolves to the secret value:
+ * const value = yield* apiKey;
+ * // Or call `.get()` explicitly:
+ * const value = yield* apiKey.get();
+ * ```
+ */
+export const Secret = Resource("Cloudflare.SecretsStore.Secret")({
+    bind: SecretBinding.bind,
+});
+const resolveScopes = (scopes) => scopes && scopes.length > 0 ? scopes : ["workers"];
+const resolveName = (id, name) => name ?? id;
+export const StoreSecretProvider = () => Provider.effect(Secret, Effect.gen(function* () {
+    const createStoreSecret = yield* secretsStore.createStoreSecret;
+    const patchStoreSecret = yield* secretsStore.patchStoreSecret;
+    const deleteStoreSecret = yield* secretsStore.deleteStoreSecret;
+    const getStoreSecret = yield* secretsStore.getStoreSecret;
+    const listStoreSecrets = secretsStore.listStoreSecrets;
+    const arraysEqual = (a, b) => a.length === b.length && a.every((v, i) => v === b[i]);
+    return {
+        stables: ["secretId", "secretName", "storeId", "accountId"],
+        diff: Effect.fn(function* ({ id, olds = {}, news, output }) {
+            if (!isResolved(news))
+                return undefined;
+            const oldStoreId = output?.storeId ?? olds.store?.storeId;
+            const newStoreId = news.store.storeId;
+            const oldName = output?.secretName ?? resolveName(id, olds.name);
+            const newName = resolveName(id, news.name);
+            if (oldStoreId !== newStoreId || oldName !== newName) {
+                return { action: "replace" };
+            }
+            const oldValue = olds.value ? Redacted.value(olds.value) : undefined;
+            const newValue = Redacted.value(news.value);
+            if (oldValue !== newValue) {
+                return { action: "replace" };
+            }
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output }) {
+            const name = resolveName(id, news.name);
+            const scopes = resolveScopes(news.scopes);
+            const accountId = news.store.accountId;
+            const storeId = news.store.storeId;
+            // Observe — re-fetch the cached secret; fall back to a name
+            // scan over the store so we recover from out-of-band deletes
+            // or partial state-persistence failures.
+            let observed;
+            if (output?.secretId) {
+                observed = yield* getStoreSecret({
+                    accountId: output.accountId,
+                    storeId: output.storeId,
+                    secretId: output.secretId,
+                }).pipe(Effect.catchTag("SecretNotFound", () => Effect.succeed(undefined)), Effect.catchTag("StoreNotFound", () => Effect.succeed(undefined)));
+            }
+            if (!observed) {
+                observed = yield* listStoreSecrets
+                    .items({ accountId, storeId })
+                    .pipe(Stream.filter((s) => s.name === name), Stream.runHead, Effect.catchTag("StoreNotFound", () => Effect.succeedNone), Effect.map(Option.getOrUndefined));
+            }
+            // Ensure — create if missing. Cloudflare reports a concurrent
+            // create as `SecretNameAlreadyExists`; tolerate by re-listing
+            // the store and adopting the secret with the same name. The
+            // value can't be read back from the API; we trust an
+            // identically-named secret reflects the same intent.
+            if (!observed) {
+                const created = yield* createStoreSecret({
+                    accountId,
+                    storeId,
+                    body: [
+                        {
+                            name,
+                            scopes,
+                            value: Redacted.value(news.value),
+                            comment: news.comment,
+                        },
+                    ],
+                }).pipe(Effect.catchTag("SecretNameAlreadyExists", () => Effect.succeed(undefined)));
+                if (created) {
+                    const secret = created.result[0];
+                    return {
+                        secretId: secret.id,
+                        secretName: secret.name,
+                        storeId: secret.storeId,
+                        accountId,
+                        status: secret.status,
+                        scopes,
+                        comment: secret.comment ?? undefined,
+                    };
+                }
+                const existing = yield* listStoreSecrets
+                    .items({ accountId, storeId })
+                    .pipe(Stream.filter((s) => s.name === name), Stream.runHead, Effect.map(Option.getOrUndefined));
+                if (!existing) {
+                    return yield* Effect.die(new Error(`Secret '${name}' reported as already existing in store ${storeId} but could not be found on lookup.`));
+                }
+                observed = existing;
+            }
+            // Sync — `listStoreSecrets` does not surface scopes, so we
+            // can't reliably diff them. Issue PATCH only when we have a
+            // record of prior props (`output`) and a difference is
+            // visible; otherwise issue an unconditional PATCH on the
+            // adoption / first-create path so scopes and comment converge.
+            const oldScopes = output ? resolveScopes(output.scopes) : undefined;
+            const scopesChanged = !oldScopes || !arraysEqual(scopes, oldScopes);
+            const commentChanged = !output ||
+                (output.comment ?? undefined) !== (news.comment ?? undefined);
+            if (scopesChanged || commentChanged) {
+                const patched = yield* patchStoreSecret({
+                    accountId,
+                    storeId,
+                    secretId: observed.id,
+                    scopes: scopesChanged ? scopes : undefined,
+                    comment: commentChanged ? news.comment : undefined,
+                }).pipe(Effect.catchTag("SecretNotFound", () => Effect.succeed(undefined)));
+                if (patched) {
+                    return {
+                        secretId: observed.id,
+                        secretName: observed.name,
+                        storeId: observed.storeId,
+                        accountId,
+                        status: patched.status,
+                        scopes,
+                        comment: patched.comment ?? undefined,
+                    };
+                }
+            }
+            return {
+                secretId: observed.id,
+                secretName: observed.name,
+                storeId: observed.storeId,
+                accountId,
+                status: observed.status,
+                scopes,
+                comment: news.comment ?? observed.comment ?? undefined,
+            };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* deleteStoreSecret({
+                accountId: output.accountId,
+                storeId: output.storeId,
+                secretId: output.secretId,
+            }).pipe(Effect.catchTag("SecretNotFound", () => Effect.void), Effect.catchTag("StoreNotFound", () => Effect.void), Effect.catchTag("NotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            if (output?.secretId) {
+                return yield* getStoreSecret({
+                    accountId: output.accountId,
+                    storeId: output.storeId,
+                    secretId: output.secretId,
+                }).pipe(Effect.map((secret) => ({
+                    secretId: secret.id,
+                    secretName: secret.name,
+                    storeId: secret.storeId,
+                    accountId: output.accountId,
+                    status: secret.status,
+                    scopes: output.scopes,
+                    comment: secret.comment ?? undefined,
+                })), Effect.catchTag("SecretNotFound", () => Effect.succeed(undefined)), Effect.catchTag("StoreNotFound", () => Effect.succeed(undefined)));
+            }
+            if (!olds?.store)
+                return undefined;
+            const name = resolveName(id, olds.name);
+            const match = yield* listStoreSecrets
+                .items({
+                accountId: olds.store.accountId,
+                storeId: olds.store.storeId,
+            })
+                .pipe(Stream.filter((s) => s.name === name), Stream.runHead, Effect.catchTag("StoreNotFound", () => Effect.succeedNone), Effect.map(Option.getOrUndefined));
+            if (!match)
+                return undefined;
+            // Secrets carry no ownership signal (Cloudflare doesn't expose
+            // tags on store secrets), so a name match is not proof we own
+            // it. Brand it `Unowned` so the engine surfaces
+            // `OwnedBySomeoneElse` unless the caller opted in via `--adopt`.
+            return Unowned({
+                secretId: match.id,
+                secretName: match.name,
+                storeId: match.storeId,
+                accountId: olds.store.accountId,
+                status: match.status,
+                scopes: resolveScopes(olds.scopes),
+                comment: match.comment ?? undefined,
+            });
+        }),
+    };
+}));
+//# sourceMappingURL=Secret.js.map

package/lib/Cloudflare/SecretsStore/Secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Secret.js","sourceRoot":"","sources":["../../../src/Cloudflare/SecretsStore/Secret.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,YAAY,MAAM,2CAA2C,CAAC;AAC1E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA6CnD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAS,gCAAgC,CAAC,CAAC;IACvE,IAAI,EAAE,aAAa,CAAC,IAAI;CACzB,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,MAA4B,EAAY,EAAE,CAC/D,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAErD,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAU,EAAE,CACnE,IAAI,IAAI,EAAE,CAAC;AAEb,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,EAAE,CACtC,QAAQ,CAAC,MAAM,CACb,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,iBAAiB,CAAC;IAChE,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,gBAAgB,CAAC;IAC9D,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,iBAAiB,CAAC;IAChE,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC;IAC1D,MAAM,gBAAgB,GAAG,YAAY,CAAC,gBAAgB,CAAC;IAEvD,MAAM,WAAW,GAAG,CAAC,CAAW,EAAE,CAAW,EAAE,EAAE,CAC/C,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzD,OAAO;QACL,OAAO,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,CAAC;QAC3D,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,GAAG,EAAS,EAAE,IAAI,EAAE,MAAM,EAAE;YAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,UAAU,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;YAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YACtC,MAAM,OAAO,GAAG,MAAM,EAAE,UAAU,IAAI,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,UAAU,KAAK,UAAU,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACrD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAClD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAEnC,4DAA4D;YAC5D,6DAA6D;YAC7D,yCAAyC;YACzC,IAAI,QAQS,CAAC;YACd,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;oBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CACrC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,EACD,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAClE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,KAAK,CAAC,CAAC,gBAAgB;qBAC/B,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;qBAC7B,IAAI,CACH,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EACrC,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAC1D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAClC,CAAC;YACN,CAAC;YAED,8DAA8D;YAC9D,8DAA8D;YAC9D,4DAA4D;YAC5D,qDAAqD;YACrD,qDAAqD;YACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;oBACvC,SAAS;oBACT,OAAO;oBACP,IAAI,EAAE;wBACJ;4BACE,IAAI;4BACJ,MAAM;4BACN,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;4BACjC,OAAO,EAAE,IAAI,CAAC,OAAO;yBACtB;qBACF;iBACF,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAC9C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;oBAClC,OAAO;wBACL,QAAQ,EAAE,MAAM,CAAC,EAAE;wBACnB,UAAU,EAAE,MAAM,CAAC,IAAI;wBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,SAAS;wBACT,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,MAAM;wBACN,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;qBACrC,CAAC;gBACJ,CAAC;gBACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,gBAAgB;qBACrC,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;qBAC7B,IAAI,CACH,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EACrC,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAClC,CAAC;gBACJ,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,IAAI,KAAK,CACP,WAAW,IAAI,2CAA2C,OAAO,oCAAoC,CACtG,CACF,CAAC;gBACJ,CAAC;gBACD,QAAQ,GAAG,QAAQ,CAAC;YACtB,CAAC;YAED,2DAA2D;YAC3D,4DAA4D;YAC5D,uDAAuD;YACvD,yDAAyD;YACzD,+DAA+D;YAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,MAAM,aAAa,GAAG,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACpE,MAAM,cAAc,GAClB,CAAC,MAAM;gBACP,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;YAChE,IAAI,aAAa,IAAI,cAAc,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;oBACtC,SAAS;oBACT,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,EAAE;oBACrB,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;oBAC1C,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;iBACnD,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CACrC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;wBACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;wBACrB,UAAU,EAAE,QAAQ,CAAC,IAAI;wBACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;wBACzB,SAAS;wBACT,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,MAAM;wBACN,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,SAAS;qBACtC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;gBACrB,UAAU,EAAE,QAAQ,CAAC,IAAI;gBACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,SAAS;gBACT,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,MAAM;gBACN,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,IAAI,SAAS;aACvD,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,iBAAiB,CAAC;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EACpD,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EACnD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/C,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC,CAAC,cAAc,CAAC;oBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;oBACtB,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;iBACrC,CAAC,CAAC,EACH,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CACrC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,EACD,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAClE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,KAAK;gBAAE,OAAO,SAAS,CAAC;YACnC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,gBAAgB;iBAClC,KAAK,CAAC;gBACL,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;gBAC/B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;aAC5B,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EACrC,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAC1D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAClC,CAAC;YACJ,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,+DAA+D;YAC/D,8DAA8D;YAC9D,gDAAgD;YAChD,iEAAiE;YACjE,OAAO,OAAO,CAAC;gBACb,QAAQ,EAAE,KAAK,CAAC,EAAE;gBAClB,UAAU,EAAE,KAAK,CAAC,IAAI;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;gBAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,SAAS;aACpC,CAAC,CAAC;QACL,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Cloudflare/SecretsStore/SecretBinding.d.ts

@@ -0,0 +1,42 @@
+import type * as runtime from "@cloudflare/workers-types";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { WorkerEnvironment } from "../Workers/Worker.ts";
+import type { Secret } from "./Secret.ts";
+declare const SecretError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "SecretError";
+} & Readonly<A>;
+export declare class SecretError extends SecretError_base<{
+    message: string;
+    cause: Error;
+}> {
+}
+/**
+ * A bound secret. The client itself is an `Effect` that resolves to the
+ * secret's current value, so you can `yield* apiKey` directly. Use `.get()`
+ * for the same thing as a callable, or `.raw` for the underlying
+ * `SecretsStoreSecret` binding.
+ */
+export interface SecretClient extends Effect.Effect<string, SecretError, WorkerEnvironment> {
+    /**
+     * Effect that resolves to the raw Cloudflare `SecretsStoreSecret` binding.
+     */
+    raw: Effect.Effect<runtime.SecretsStoreSecret, never, WorkerEnvironment>;
+    /**
+     * Read the current value of the secret.
+     */
+    get(): Effect.Effect<string, SecretError, WorkerEnvironment>;
+}
+declare const SecretBinding_base: Binding.Service<SecretBinding, "Cloudflare.SecretsStore.Secret", (secret: Secret) => Effect.Effect<SecretClient>> & {
+    bind: (secret: Secret) => Effect.Effect<any, any, any>;
+};
+export declare class SecretBinding extends SecretBinding_base {
+}
+export declare const SecretBindingLive: Layer.Layer<SecretBinding, never, import("../../RuntimeContext.ts").RuntimeContext<import("../../RuntimeContext.ts").BaseRuntimeContext> | SecretBindingPolicy>;
+declare const SecretBindingPolicy_base: Binding.Policy<SecretBindingPolicy, "Policy<Cloudflare.SecretsStore.Secret>", (secret: Secret) => Effect.Effect<void>>;
+export declare class SecretBindingPolicy extends SecretBindingPolicy_base {
+}
+export declare const SecretBindingPolicyLive: Layer.Layer<SecretBindingPolicy, never, never>;
+export {};
+//# sourceMappingURL=SecretBinding.d.ts.map

package/lib/Cloudflare/SecretsStore/SecretBinding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretBinding.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/SecretsStore/SecretBinding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,OAAO,MAAM,2BAA2B,CAAC;AAE1D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAY,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;;;;AAE1C,qBAAa,WAAY,SAAQ,iBAAgC;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;CACd,CAAC;CAAG;AAEL;;;;;GAKG;AACH,MAAM,WAAW,YAAa,SAAQ,MAAM,CAAC,MAAM,CACjD,MAAM,EACN,WAAW,EACX,iBAAiB,CAClB;IACC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACzE;;OAEG;IACH,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;CAC9D;4GAIU,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;;;AAFjD,qBAAa,aAAc,SAAQ,kBAGE;CAAG;AAExC,eAAO,MAAM,iBAAiB,iKAwC7B,CAAC;+HAIS,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;AAFzC,qBAAa,mBAAoB,SAAQ,wBAGJ;CAAG;AAExC,eAAO,MAAM,uBAAuB,gDAmBnC,CAAC"}

package/lib/Cloudflare/SecretsStore/SecretBinding.js

@@ -0,0 +1,49 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.js";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.js";
+export class SecretError extends Data.TaggedError("SecretError") {
+}
+export class SecretBinding extends Binding.Service()("Cloudflare.SecretsStore.Secret") {
+}
+export const SecretBindingLive = Layer.effect(SecretBinding, Effect.gen(function* () {
+    const bind = yield* SecretBindingPolicy;
+    return Effect.fn(function* (secret) {
+        yield* bind(secret);
+        const env = WorkerEnvironment;
+        const raw = env.pipe(Effect.map((env) => env[secret.LogicalId]));
+        const tryPromise = (fn) => Effect.tryPromise({
+            try: fn,
+            catch: (error) => new SecretError({
+                message: error.message ?? "Unknown error",
+                cause: error,
+            }),
+        });
+        const getEffect = raw.pipe(Effect.flatMap((raw) => tryPromise(() => raw.get())));
+        return Object.assign(Effect.suspend(() => getEffect), {
+            raw,
+            get: () => getEffect,
+        });
+    });
+}));
+export class SecretBindingPolicy extends Binding.Policy()("Cloudflare.SecretsStore.Secret") {
+}
+export const SecretBindingPolicyLive = SecretBindingPolicy.layer.succeed(Effect.fn(function* (host, secret) {
+    if (isWorker(host)) {
+        yield* host.bind `${secret}`({
+            bindings: [
+                {
+                    type: "secrets_store_secret",
+                    name: secret.LogicalId,
+                    secretName: secret.secretName,
+                    storeId: secret.storeId,
+                },
+            ],
+        });
+    }
+    else {
+        return yield* Effect.die(new Error(`SecretBinding does not support runtime '${host.Type}'`));
+    }
+}));
+//# sourceMappingURL=SecretBinding.js.map

package/lib/Cloudflare/SecretsStore/SecretBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretBinding.js","sourceRoot":"","sources":["../../../src/Cloudflare/SecretsStore/SecretBinding.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAGnE,MAAM,OAAO,WAAY,SAAQ,IAAI,CAAC,WAAW,CAAC,aAAa,CAG7D;CAAG;AAuBL,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAG/C,CAAC,gCAAgC,CAAC;CAAG;AAExC,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC,MAAM,CAC3C,aAAa,EACb,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;IAExC,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAc;QACxC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAClB,MAAM,CAAC,GAAG,CACR,CAAC,GAAG,EAAE,EAAE,CACL,GAAkD,CACjD,MAAM,CAAC,SAAS,CACjB,CACJ,CACF,CAAC;QACF,MAAM,UAAU,GAAG,CACjB,EAAoB,EACW,EAAE,CACjC,MAAM,CAAC,UAAU,CAAC;YAChB,GAAG,EAAE,EAAE;YACP,KAAK,EAAE,CAAC,KAAU,EAAE,EAAE,CACpB,IAAI,WAAW,CAAC;gBACd,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,eAAe;gBACzC,KAAK,EAAE,KAAK;aACb,CAAC;SACL,CAAC,CAAC;QAEL,MAAM,SAAS,GACb,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAEjE,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAC/B;YACE,GAAG;YACH,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;SACrB,CACc,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEF,MAAM,OAAO,mBAAoB,SAAQ,OAAO,CAAC,MAAM,EAGpD,CAAC,gCAAgC,CAAC;CAAG;AAExC,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CACtE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAkB,EAAE,MAAc;IACrD,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA,GAAG,MAAM,EAAE,CAAC;YAC1B,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,sBAAsB;oBAC5B,IAAI,EAAE,MAAM,CAAC,SAAS;oBACtB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB;aACF;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,IAAI,GAAG,CAAC,CACnE,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CACH,CAAC"}

package/lib/Cloudflare/SecretsStore/SecretsStore.d.ts

@@ -0,0 +1,39 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+export type SecretsStore = Resource<"Cloudflare.SecretsStore", {}, {
+    storeId: string;
+    storeName: string;
+    accountId: string;
+}, never, Providers>;
+/**
+ * A Cloudflare Secrets Store, a per-account container for secrets that
+ * can be bound into Workers with full redaction and audit support.
+ *
+ * Cloudflare enforces a limit of **one Secrets Store per account**.
+ * Deleting a store changes its ID and permanently destroys all secrets
+ * inside it. Because of this, the provider always **adopts** an existing
+ * store rather than creating a new one, and **never deletes** the store
+ * on teardown. The `read` lifecycle reports the existing account store
+ * (if any) as plain attrs, so the engine silently adopts it on cold
+ * start and `create` is only ever invoked when no store exists yet.
+ * Once it exists it is treated as account-level infrastructure that
+ * outlives any single stack.
+ *
+ * @section Creating a Store
+ * @example Basic Secrets Store (adopts existing or creates one)
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore");
+ * ```
+ *
+ * @example Adopt a specific named store
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore", {
+ *   name: "production-secrets",
+ * });
+ * ```
+ */
+export declare const SecretsStore: import("../../Resource.ts").ResourceClass<SecretsStore>;
+export declare const SecretsStoreProvider: () => import("effect/Layer").Layer<Provider.Provider<SecretsStore>, never, import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/cloudflare").Credentials | CloudflareEnvironment>;
+//# sourceMappingURL=SecretsStore.d.ts.map

package/lib/Cloudflare/SecretsStore/SecretsStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsStore.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/SecretsStore/SecretsStore.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,MAAM,YAAY,GAAG,QAAQ,CACjC,yBAAyB,EACzB,EAAE,EACF;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,EACD,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,YAAY,yDAAoD,CAAC;AAE9E,eAAO,MAAM,oBAAoB,8MA+F9B,CAAC"}