alchemy 2.0.0-beta.46 → 2.0.0-beta.48

package/src/Cloudflare/Images/Images.ts

@@ -1,32 +1,47 @@
-import * as Effect from "effect/Effect";
-import { ImagesBinding } from "./ImagesBinding.ts";
+import type * as Effect from "effect/Effect";
+import { SingleShotGen } from "effect/Utils";
+import { ImagesBinding, type ImagesClient } from "./ImagesBinding.ts";
 
 type ImagesTypeId = typeof ImagesTypeId;
 const ImagesTypeId = "Cloudflare.Images" as const;
 
 export type ImagesProps = {
   /**
-   * Binding name used when `Cloudflare.Images.bind(images)` attaches Images
-   * from inside a Worker init phase. When Images is passed through
-   * `Worker({ bindings: { ... } })`, the object key remains the binding name.
+   * Binding name used when `Images` is bound from inside a Worker init phase
+   * (`yield* Cloudflare.Images(...)`). When passed through
+   * `Worker({ env: { ... } })`, the object key remains the binding name.
    *
    * @default "IMAGES"
    */
   name?: string;
 };
 
+/**
+ * The Effect yielded when an `Images` marker is used inside a Worker init
+ * phase: it attaches the `images` binding to the surrounding Worker and
+ * resolves to the runtime {@link ImagesClient}.
+ */
+type BindEffect = Effect.Effect<ImagesClient, never, ImagesBinding>;
+
 /**
  * Marker for a Cloudflare Images binding.
  *
- * Images bindings are configured directly on Workers and do not have a
- * standalone provisioning API. The Worker provider sees this object in
- * `bindings: { ... }` and emits the corresponding `{ type: "images" }`
- * metadata binding to the script.
+ * It is a plain data structure (so it can be declared directly on a Worker's
+ * `env`) that is **also** yieldable inside an Effect-native Worker. Yielding it
+ * (`yield* Cloudflare.Images(...)`) attaches the binding to the surrounding
+ * Worker and returns the runtime {@link ImagesClient} — no separate `.bind(...)`
+ * step required.
+ *
+ * The divergence is achieved via `[Symbol.iterator]`: the object is not an
+ * `Effect` (so `InferEnv` resolves it to the native `ImagesBinding` in the
+ * `env` position), but it is iterable as one when `yield*`-ed.
  */
-export type Images = {
+export interface Images {
   kind: ImagesTypeId;
   name: string;
-};
+  asEffect(): BindEffect;
+  [Symbol.iterator](): SingleShotGen<BindEffect, ImagesClient>;
+}
 
 export const isImages = (value: unknown): value is Images =>
   typeof value === "object" &&
@@ -44,12 +59,6 @@ export const isImages = (value: unknown): value is Images =>
  * .draw(...).output(...)`. The runtime conversion to Cloudflare's
  * `ReadableStream` is handled internally.
  *
- * @section Declaring Images
- * @example
- * ```typescript
- * const Pipeline = yield* Cloudflare.Images({ name: "PIPELINE" });
- * ```
- *
  * @section Effect-style Worker (recommended)
  * @example Read image format and dimensions from the request body
  * ```typescript
@@ -57,8 +66,8 @@ export const isImages = (value: unknown): value is Images =>
  *
  * Cloudflare.Worker("ImageWorker", { main: import.meta.filename },
  *   Effect.gen(function* () {
- *     const pipeline = yield* Pipeline;
- *     const images = yield* Cloudflare.Images.bind(pipeline);
+ *     // Attaches the binding to this Worker AND returns the runtime client.
+ *     const images = yield* Cloudflare.Images({ name: "PIPELINE" });
  *     return {
  *       fetch: Effect.gen(function* () {
  *         const request = yield* HttpServerRequest;
@@ -85,7 +94,7 @@ export const isImages = (value: unknown): value is Images =>
  * ```typescript
  * export const Worker = Cloudflare.Worker("Worker", {
  *   main: "./src/worker.ts",
- *   bindings: { MEDIA: Pipeline },
+ *   env: { MEDIA: Cloudflare.Images({ name: "PIPELINE" }) },
  * });
  *
  * export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
@@ -101,19 +110,23 @@ export const isImages = (value: unknown): value is Images =>
  * @see https://developers.cloudflare.com/images/transform-images/bindings/
  */
 export const Images: {
-  (props?: ImagesProps): Effect.Effect<Images>;
+  (props?: ImagesProps): Images;
   /**
-   * Bind Cloudflare Images to the surrounding Worker, returning an
-   * Effect-native client with access to the native Workers runtime binding.
+   * Bind an existing `Images` marker to the surrounding Worker, returning the
+   * Effect-native client. Equivalent to `yield* images` — prefer yielding the
+   * marker directly.
    */
   bind: typeof ImagesBinding.bind;
 } = Object.assign(
-  Effect.fn(function* (props?: ImagesProps) {
-    return {
+  (props?: ImagesProps): Images => {
+    const self: Images = {
       kind: ImagesTypeId,
       name: props?.name ?? "IMAGES",
-    } satisfies Images;
-  }),
+      asEffect: () => ImagesBinding.bind(self),
+      [Symbol.iterator]: () => new SingleShotGen(ImagesBinding.bind(self)),
+    };
+    return self;
+  },
   {
     bind: (...args: Parameters<typeof ImagesBinding.bind>) =>
       ImagesBinding.bind(...args),

package/src/Cloudflare/Providers.ts

@@ -18,7 +18,7 @@ import * as AnalyticsEngine from "./AnalyticsEngine/index.ts";
 import * as ApiToken from "./ApiToken/index.ts";
 import * as Artifacts from "./Artifacts/index.ts";
 import { CloudflareAuth } from "./Auth/AuthProvider.ts";
-import * as BrowserRendering from "./BrowserRendering/index.ts";
+import * as Browser from "./Browser/index.ts";
 import * as CloudflareEnvironment from "./CloudflareEnvironment.ts";
 import * as Containers from "./Container/index.ts";
 import * as Credentials from "./Credentials.ts";
@@ -29,6 +29,7 @@ import * as Images from "./Images/index.ts";
 import * as KV from "./KV/index.ts";
 import * as Queue from "./Queue/index.ts";
 import * as R2 from "./R2/index.ts";
+import * as RateLimit from "./RateLimit/index.ts";
 import * as SecretsStore from "./SecretsStore/index.ts";
 import * as Tunnel from "./Tunnel/index.ts";
 import * as Vectorize from "./Vectorize/index.ts";
@@ -36,6 +37,7 @@ import * as VpcService from "./VpcService/index.ts";
 import * as Workers from "./Workers/index.ts";
 import * as Workflows from "./Workers/Workflow.ts";
 import * as Zaraz from "./Zaraz/index.ts";
+import * as Zone from "./Zone/index.ts";
 
 export { Credentials } from "@distilled.cloud/cloudflare/Credentials";
 
@@ -58,7 +60,7 @@ export const providers = () =>
       AiGateway.AiGatewayBindingPolicy,
       AnalyticsEngine.AnalyticsEngineDatasetBindingPolicy,
       Artifacts.ArtifactsBindingPolicy,
-      BrowserRendering.BrowserRenderingBindingPolicy,
+      Browser.BrowserBindingPolicy,
       Command,
       Containers.Container,
       D1.D1ConnectionPolicy,
@@ -78,10 +80,14 @@ export const providers = () =>
       Queue.QueueEventSourcePolicy,
       R2.R2Bucket,
       R2.R2BucketBindingPolicy,
+      RateLimit.RateLimitBindingPolicy,
       SecretsStore.SecretBindingPolicy,
       SecretsStore.SecretsStore,
       SecretsStore.Secret,
       Tunnel.Tunnel,
+      Tunnel.TunnelReadPolicy,
+      Tunnel.TunnelReadWritePolicy,
+      Tunnel.TunnelWritePolicy,
       Vectorize.VectorizeIndexBindingPolicy,
       Vectorize.VectorizeIndex,
       Vectorize.VectorizeMetadataIndex,
@@ -94,6 +100,7 @@ export const providers = () =>
       Workers.Worker,
       Workflows.WorkflowResource,
       Zaraz.ZarazConfig,
+      Zone.Zone,
     ]),
   ).pipe(
     Layer.provide(
@@ -104,7 +111,7 @@ export const providers = () =>
         AiGateway.AiGatewayBindingPolicyLive,
         AnalyticsEngine.AnalyticsEngineDatasetBindingPolicyLive,
         Artifacts.ArtifactsBindingPolicyLive,
-        BrowserRendering.BrowserRenderingBindingPolicyLive,
+        Browser.BrowserBindingPolicyLive,
         Containers.ContainerProvider(),
         D1.D1ConnectionPolicyLive,
         D1.DatabaseProvider(),
@@ -123,10 +130,14 @@ export const providers = () =>
         Queue.QueueConsumerProvider(),
         R2.R2BucketBindingPolicyLive,
         R2.R2BucketProvider(),
+        RateLimit.RateLimitBindingPolicyLive,
         SecretsStore.SecretBindingPolicyLive,
         SecretsStore.SecretsStoreProvider(),
         SecretsStore.StoreSecretProvider(),
         Tunnel.TunnelProvider(),
+        Tunnel.TunnelReadPolicyLive,
+        Tunnel.TunnelReadWritePolicyLive,
+        Tunnel.TunnelWritePolicyLive,
         Vectorize.VectorizeIndexBindingPolicyLive,
         Vectorize.VectorizeIndexProvider(),
         Vectorize.VectorizeMetadataIndexProvider(),
@@ -137,6 +148,7 @@ export const providers = () =>
         Workers.WorkerProvider(),
         Workflows.WorkflowProvider(),
         Zaraz.ZarazConfigProvider(),
+        Zone.ZoneProvider(),
       ),
     ),
     Layer.provideMerge(

package/src/Cloudflare/R2/R2Bucket.ts

@@ -9,7 +9,7 @@ import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type * as Cloudflare from "../Providers.ts";
-import * as Zone from "../Zone.ts";
+import * as Zone from "../Zone/index.ts";
 import { R2BucketBinding } from "./R2BucketBinding.ts";
 
 export const isR2Bucket = (value: unknown): value is R2Bucket =>
@@ -684,8 +684,11 @@ export const R2BucketProvider = () =>
 
           const attrs = {
             bucketName: observed.name!,
-            storageClass: observed.storageClass ?? "Standard",
-            jurisdiction: observed.jurisdiction ?? "default",
+            // Distilled widened generated string enums to open unions.
+            storageClass: (observed.storageClass ??
+              "Standard") as R2Bucket.StorageClass,
+            jurisdiction: (observed.jurisdiction ??
+              "default") as R2Bucket.Jurisdiction,
             location: normalizeLocation(observed.location),
             accountId: acct,
           };
@@ -738,8 +741,11 @@ export const R2BucketProvider = () =>
           }).pipe(
             Effect.map((bucket) => ({
               bucketName: bucket.name!,
-              storageClass: bucket.storageClass ?? "Standard",
-              jurisdiction: bucket.jurisdiction ?? "default",
+              // Distilled widened generated string enums to open unions.
+              storageClass: (bucket.storageClass ??
+                "Standard") as R2Bucket.StorageClass,
+              jurisdiction: (bucket.jurisdiction ??
+                "default") as R2Bucket.Jurisdiction,
               location: normalizeLocation(bucket.location),
               accountId: acct,
               domains: output?.domains ?? [],
@@ -760,13 +766,15 @@ const r2BucketEndpointConsistencySchedule = Schedule.exponential(100).pipe(
   Schedule.both(Schedule.recurs(5)),
 );
 
+// Distilled widened generated string enums to open unions (`string & {}`); the
+// API only ever returns the known variants, narrowed in `toCustomDomainAttributes`.
 type CustomDomainResponse = {
   domain: string;
   zoneId?: string | null;
   enabled?: boolean | null;
   ciphers?: string[] | null;
-  minTLS?: "1.0" | "1.1" | "1.2" | "1.3" | null;
-  status?: R2Bucket.CustomDomain["status"];
+  minTLS?: string | null;
+  status?: { ownership: string; ssl: string } | null;
 };
 
 const toCustomDomainAttributes = (
@@ -776,8 +784,8 @@ const toCustomDomainAttributes = (
   zoneId: domain.zoneId ?? undefined,
   enabled: domain.enabled ?? true,
   ciphers: domain.ciphers ?? undefined,
-  minTLS: domain.minTLS ?? undefined,
-  status: domain.status,
+  minTLS: (domain.minTLS ?? undefined) as R2Bucket.CustomDomain["minTLS"],
+  status: (domain.status ?? undefined) as R2Bucket.CustomDomain["status"],
 });
 
 const sameCustomDomainConfig = (

package/src/Cloudflare/RateLimit/RateLimit.ts

@@ -0,0 +1,160 @@
+import type * as Effect from "effect/Effect";
+import { SingleShotGen } from "effect/Utils";
+import { RateLimitBinding, type RateLimitClient } from "./RateLimitBinding.ts";
+
+type RateLimitTypeId = typeof RateLimitTypeId;
+const RateLimitTypeId = "Cloudflare.RateLimit" as const;
+
+export type RateLimitPeriod = 10 | 60;
+
+export type RateLimitProps = {
+  /**
+   * Binding name used when `RateLimit` is bound from inside a Worker init
+   * phase (`yield* Cloudflare.RateLimit(...)`). When passed through
+   * `Worker({ env: { ... } })`, the object key remains the binding name.
+   *
+   * @default "RATE_LIMIT"
+   */
+  name?: string;
+  /**
+   * Positive integer or string that uniquely identifies this rate limit
+   * configuration.
+   */
+  namespaceId: number | string;
+  /**
+   * Simple rate limiting configuration.
+   */
+  simple: {
+    /**
+     * The number of requests allowed within the period.
+     */
+    limit: number;
+    /**
+     * The period, in seconds, over which requests are counted.
+     */
+    period: RateLimitPeriod;
+  };
+};
+
+/**
+ * The Effect yielded when a `RateLimit` is used inside a Worker init phase:
+ * it attaches the `ratelimit` binding to the surrounding Worker and resolves
+ * to the runtime {@link RateLimitClient}.
+ */
+type BindEffect = Effect.Effect<RateLimitClient, never, RateLimitBinding>;
+
+/**
+ * A Cloudflare Rate Limit binding marker.
+ *
+ * It is a plain data structure (so it can be declared directly on a Worker's
+ * `env`) that is **also** yieldable inside an Effect-native Worker. Yielding it
+ * (`yield* Cloudflare.RateLimit(...)`) attaches the binding to the surrounding
+ * Worker and returns the runtime {@link RateLimitClient} — no separate
+ * `.bind(...)` step required.
+ *
+ * The divergence is achieved via `[Symbol.iterator]`: the object is not an
+ * `Effect` (so `InferEnv` resolves it to the native `cf.RateLimit` in the
+ * `env` position), but it is iterable as one when `yield*`-ed.
+ */
+export interface RateLimit {
+  kind: RateLimitTypeId;
+  name: string;
+  namespaceId: string;
+  simple: {
+    limit: number;
+    period: RateLimitPeriod;
+  };
+  asEffect(): BindEffect;
+  [Symbol.iterator](): SingleShotGen<BindEffect, RateLimitClient>;
+}
+
+export const isRateLimit = (value: unknown): value is RateLimit =>
+  typeof value === "object" &&
+  value !== null &&
+  "kind" in value &&
+  (value as RateLimit).kind === RateLimitTypeId;
+
+/**
+ * A Cloudflare Rate Limit binding for counting arbitrary keys inside Workers.
+ *
+ * Rate Limit bindings are configured directly on Workers and do not have a
+ * standalone provisioning API. The Worker provider sees this object in
+ * `env: { ... }` and emits the corresponding `{ type: "ratelimit" }` metadata
+ * binding to the script.
+ *
+ * @section Declaring on a Worker's env
+ * @example Async (non-Effect) Worker
+ * ```typescript
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   env: {
+ *     THROTTLE: Cloudflare.RateLimit({
+ *       namespaceId: 1001,
+ *       simple: { limit: 10, period: 60 },
+ *     }),
+ *   },
+ * });
+ *
+ * export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+ * //   { THROTTLE: RateLimit } — the native Cloudflare binding
+ *
+ * // worker.ts
+ * export default {
+ *   fetch: async (req: Request, env: WorkerEnv) => {
+ *     const { success } = await env.THROTTLE.limit({ key: "ip" });
+ *     return new Response(success ? "ok" : "rate limited");
+ *   },
+ * };
+ * ```
+ *
+ * @section Binding inside an Effect-native Worker
+ * @example yield* RateLimit does the binding
+ * ```typescript
+ * Cloudflare.Worker("Worker", { main: "./src/worker.ts" },
+ *   Effect.gen(function* () {
+ *     // Attaches the binding to this Worker AND returns the runtime client.
+ *     const throttle = yield* Cloudflare.RateLimit({
+ *       namespaceId: 1001,
+ *       simple: { limit: 10, period: 60 },
+ *     });
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const { success } = yield* throttle.limit({ key: "ip" });
+ *         return HttpServerResponse.text(success ? "ok" : "rate limited");
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(Cloudflare.RateLimitBindingLive)),
+ * );
+ * ```
+ *
+ * @see https://developers.cloudflare.com/workers/runtime-apis/bindings/rate-limit/
+ */
+export const RateLimit: {
+  (props: RateLimitProps): RateLimit;
+  /**
+   * Bind an existing `RateLimit` marker to the surrounding Worker, returning
+   * the runtime client. Equivalent to `yield* rateLimit` — prefer yielding the
+   * marker directly.
+   */
+  bind: typeof RateLimitBinding.bind;
+} = Object.assign(
+  (props: RateLimitProps): RateLimit => {
+    const self: RateLimit = {
+      kind: RateLimitTypeId,
+      name: props.name ?? "RATE_LIMIT",
+      namespaceId: String(props.namespaceId),
+      simple: {
+        limit: props.simple.limit,
+        period: props.simple.period,
+      },
+      asEffect: () => RateLimitBinding.bind(self),
+      [Symbol.iterator]: () => new SingleShotGen(RateLimitBinding.bind(self)),
+    };
+    return self;
+  },
+  {
+    bind: (...args: Parameters<typeof RateLimitBinding.bind>) =>
+      RateLimitBinding.bind(...args),
+  },
+);

package/src/Cloudflare/RateLimit/RateLimitBinding.ts

@@ -0,0 +1,90 @@
+/// <reference types="@cloudflare/workers-types" />
+
+import type * as cf from "@cloudflare/workers-types";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import { type RateLimit as RateLimitLike } from "./RateLimit.ts";
+
+export class RateLimitError extends Data.TaggedError("RateLimitError")<{
+  message: string;
+  cause: unknown;
+}> {}
+
+export interface RateLimitClient {
+  raw: Effect.Effect<cf.RateLimit, never, WorkerEnvironment>;
+  limit(
+    options: Parameters<cf.RateLimit["limit"]>[0],
+  ): Effect.Effect<
+    Awaited<ReturnType<cf.RateLimit["limit"]>>,
+    RateLimitError,
+    WorkerEnvironment
+  >;
+}
+
+export class RateLimitBinding extends Binding.Service<
+  RateLimitBinding,
+  (rateLimit: RateLimitLike) => Effect.Effect<RateLimitClient>
+>()("Cloudflare.RateLimit.Binding") {}
+
+export const RateLimitBindingLive = Layer.effect(
+  RateLimitBinding,
+  Effect.gen(function* () {
+    const Policy = yield* RateLimitBindingPolicy;
+
+    return Effect.fn(function* (rateLimit: RateLimitLike) {
+      yield* Policy(rateLimit);
+      const raw = WorkerEnvironment.useSync(
+        (env) => (env as Record<string, cf.RateLimit>)[rateLimit.name]!,
+      );
+      return {
+        raw,
+        limit: (options) =>
+          raw.pipe(
+            Effect.flatMap((binding) =>
+              Effect.tryPromise({
+                try: () => binding.limit(options),
+                catch: (error) =>
+                  new RateLimitError({
+                    message:
+                      error instanceof Error
+                        ? error.message
+                        : "Unknown RateLimit error",
+                    cause: error,
+                  }),
+              }),
+            ),
+          ),
+      } satisfies RateLimitClient;
+    });
+  }),
+);
+
+export class RateLimitBindingPolicy extends Binding.Policy<
+  RateLimitBindingPolicy,
+  (rateLimit: RateLimitLike) => Effect.Effect<void>
+>()("Cloudflare.RateLimit.Binding") {}
+
+export const RateLimitBindingPolicyLive = RateLimitBindingPolicy.layer.succeed(
+  Effect.fn(function* (host: ResourceLike, rateLimit: RateLimitLike) {
+    if (isWorker(host)) {
+      yield* host.bind(rateLimit.name, {
+        bindings: [
+          {
+            type: "ratelimit",
+            name: rateLimit.name,
+            namespaceId: rateLimit.namespaceId,
+            simple: rateLimit.simple,
+          } as any,
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        new Error(`RateLimitBinding does not support runtime '${host.Type}'`),
+      );
+    }
+  }),
+);

package/src/Cloudflare/RateLimit/index.ts

@@ -0,0 +1,2 @@
+export * from "./RateLimit.ts";
+export * from "./RateLimitBinding.ts";

package/src/Cloudflare/SecretsStore/Secret.ts

@@ -46,7 +46,7 @@ export type Secret = Resource<
     secretName: string;
     storeId: string;
     accountId: string;
-    status: "pending" | "active" | "deleted";
+    status: SecretStatus;
     scopes: string[];
     comment: string | undefined;
   },
@@ -54,6 +54,12 @@ export type Secret = Resource<
   Providers
 >;
 
+export type SecretStatus = "pending" | "active" | "deleted";
+
+// Distilled widened generated string enums to open unions (`string & {}`); the
+// API only ever returns the known variants, so narrow at the boundary.
+const asSecretStatus = (status: string): SecretStatus => status as SecretStatus;
+
 /**
  * A single secret stored inside a Cloudflare Secrets Store.
  *
@@ -132,7 +138,7 @@ export const StoreSecretProvider = () =>
                 id: string;
                 name: string;
                 storeId: string;
-                status: "pending" | "active" | "deleted";
+                status: string;
                 comment?: string | null;
               }
             | undefined;
@@ -188,7 +194,7 @@ export const StoreSecretProvider = () =>
                 secretName: secret.name,
                 storeId: secret.storeId,
                 accountId,
-                status: secret.status,
+                status: asSecretStatus(secret.status),
                 scopes,
                 comment: secret.comment ?? undefined,
               };
@@ -223,7 +229,7 @@ export const StoreSecretProvider = () =>
             secretName: observed.name,
             storeId: observed.storeId,
             accountId,
-            status: patched.status,
+            status: asSecretStatus(patched.status),
             scopes,
             comment: patched.comment ?? undefined,
           };
@@ -253,7 +259,7 @@ export const StoreSecretProvider = () =>
                 secretName: secret.name,
                 storeId: secret.storeId,
                 accountId: output.accountId,
-                status: secret.status,
+                status: asSecretStatus(secret.status),
                 scopes: output.scopes,
                 comment: secret.comment ?? undefined,
               })),
@@ -286,7 +292,7 @@ export const StoreSecretProvider = () =>
             secretName: match.name,
             storeId: match.storeId,
             accountId: olds.store.accountId,
-            status: match.status,
+            status: asSecretStatus(match.status),
             scopes: resolveScopes(olds.scopes),
             comment: match.comment ?? undefined,
           });