alchemy 2.0.0-beta.48 → 2.0.0-beta.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alchemy",
-  "version": "2.0.0-beta.48",
+  "version": "2.0.0-beta.49",
   "homepage": "https://alchemy.run",
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",
@@ -291,15 +291,15 @@
     "@alchemy.run/node-utils": "0.0.4",
     "@aws-sdk/credential-providers": "^3.0.0",
     "@clack/prompts": "^0.11.0",
-    "@distilled.cloud/aws": "^0.22.3",
-    "@distilled.cloud/axiom": "^0.22.3",
-    "@distilled.cloud/cloudflare": "^0.22.3",
+    "@distilled.cloud/aws": "^0.22.4",
+    "@distilled.cloud/axiom": "^0.22.4",
+    "@distilled.cloud/cloudflare": "^0.22.4",
     "@distilled.cloud/cloudflare-rolldown-plugin": "0.10.1",
     "@distilled.cloud/cloudflare-runtime": "0.10.1",
     "@distilled.cloud/cloudflare-vite-plugin": "0.10.1",
-    "@distilled.cloud/core": "^0.22.3",
-    "@distilled.cloud/neon": "^0.22.3",
-    "@distilled.cloud/planetscale": "^0.22.3",
+    "@distilled.cloud/core": "^0.22.4",
+    "@distilled.cloud/neon": "^0.22.4",
+    "@distilled.cloud/planetscale": "^0.22.4",
     "@effect/vitest": ">=4.0.0-beta.74 || >=4.0.0",
     "@libsql/client": "^0.17.0",
     "@octokit/rest": "^22.0.1",

package/src/AdoptPolicy.ts

@@ -139,7 +139,7 @@ export const adopt: {
   ): <A, E, R2 = never>(
     effect: Effect.Effect<A, E, R2>,
   ) => Effect.Effect<A, E, R1 | R2>;
-} = ((enabled: boolean | Effect.Effect<boolean, never, any>) =>
+} = ((enabled: boolean | Effect.Effect<boolean, never, any> = true) =>
   (eff: Effect.Effect<any, any, any>) =>
     eff.pipe(
       typeof enabled === "boolean"

package/src/Binding.ts

@@ -3,6 +3,7 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import { SingleShotGen } from "effect/Utils";
+import type { Input } from "./Input.ts";
 import * as Namespace from "./Namespace.ts";
 import { ALCHEMY_PHASE } from "./Phase.ts";
 import { tryFindProviderByType } from "./Provider.ts";
@@ -42,7 +43,10 @@ type BindParameters<
   Parameters extends any[],
   Req = never,
 > = Parameters extends [infer First, ...infer Rest]
-  ? [First | Effect.Effect<First, never, Req>, ...BindParameters<Rest, Req>]
+  ? [
+      Input<First> | Effect.Effect<First, never, Req>,
+      ...BindParameters<Rest, Req>,
+    ]
   : [];
 
 /**

package/src/Cloudflare/ApiToken/Common.ts

@@ -27,10 +27,20 @@ export type ApiTokenPermissionGroupRef =
   | PermissionGroupName
   | { id: string; meta?: { key?: string; value?: string } };
 
+/**
+ * Value of a resource entry in an {@link ApiTokenPolicy}. Usually `"*"`, but
+ * account-owned tokens must nest zone resources under the account resource —
+ * e.g. `{ "com.cloudflare.api.account.<id>": { "com.cloudflare.api.account.zone.*": "*" } }`
+ * — so a nested object is also allowed.
+ */
+export type ApiTokenResourceScope =
+  | string
+  | { [K in ApiTokenResourceKey]?: string };
+
 export interface ApiTokenPolicy {
   effect: "allow" | "deny";
   permissionGroups: ApiTokenPermissionGroupRef[];
-  resources: { [K in ApiTokenResourceKey]?: string };
+  resources: { [K in ApiTokenResourceKey]?: ApiTokenResourceScope };
 }
 
 export interface ApiTokenCondition {
@@ -116,8 +126,8 @@ export const resolvePermissionGroup = (ref: ApiTokenPermissionGroupRef) => {
 
 const resolveResources = (
   resources: ApiTokenPolicy["resources"],
-): Record<string, string> => {
-  const out: Record<string, string> = {};
+): Record<string, ApiTokenResourceScope> => {
+  const out: Record<string, ApiTokenResourceScope> = {};
   for (const [key, value] of Object.entries(resources)) {
     if (value === undefined) continue;
     out[key] = value;

package/src/Cloudflare/Dns/DnsBinding.ts

@@ -0,0 +1,123 @@
+import {
+  Credentials,
+  fromApiToken,
+} from "@distilled.cloud/cloudflare/Credentials";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import { type HttpClient } from "effect/unstable/http/HttpClient";
+import type * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { RuntimeContext } from "../../RuntimeContext.ts";
+import { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { ApiTokenPermissionGroupRef } from "../ApiToken/Common.ts";
+import type { Zone } from "../Zone/Zone.ts";
+
+/**
+ * Runtime accessor for a DNS binding's token, obtained by binding the
+ * {@link AccountApiToken}'s `value` output in the Worker's Init phase. Reads the
+ * value back from the Worker's environment at runtime. DNS record operations
+ * are zone-scoped (the `zoneId` is passed per call), so the account id is not
+ * needed at runtime.
+ */
+export interface DnsToken {
+  /** The token's plaintext value (injected as a `secret_text` binding). */
+  value: Effect.Effect<Redacted.Redacted<string>>;
+}
+
+/**
+ * Bind an {@link AccountApiToken}'s `value` output into the Worker (as a
+ * `secret_text` binding) and return the {@link DnsToken} accessor.
+ */
+export const bindDnsToken = (token: AccountApiToken) =>
+  Effect.gen(function* () {
+    const value = yield* token.value;
+    return { value } satisfies DnsToken;
+  });
+
+/**
+ * Resolve credentials from a bound token and provide them (plus the
+ * fetch-based HTTP client) to a raw SDK operation.
+ */
+export const authorizeDns =
+  (token: DnsToken) =>
+  <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient>,
+  ): Effect.Effect<A, E, RuntimeContext> =>
+    token.value.pipe(
+      Effect.flatMap((value) =>
+        eff.pipe(
+          Effect.provide(
+            fromApiToken({ apiToken: Redacted.value(value) }).pipe(
+              Layer.provideMerge(FetchHttpClient.layer),
+            ),
+          ),
+        ),
+      ),
+    );
+
+/**
+ * Shared runtime body for a DNS binding: create a token scoped to the requested
+ * zone, attach the (narrow) policy, bind the token's value and the zone's id
+ * into the Worker, then build the client. Pass the result to
+ * `Layer.effect(<Binding>, ...)`.
+ *
+ * The zone's `zoneId` is bound into the Worker at init time, so the resulting
+ * client closes over it and callers never pass it per request — the
+ * provisioned token only grants access to that one zone anyway.
+ */
+export const makeDnsClient = <C>(
+  Policy: Binding.Policy<
+    any,
+    any,
+    (token: AccountApiToken, zone: Zone) => Effect.Effect<void>
+  >,
+  tokenId: string,
+  makeClient: (token: DnsToken, zoneId: Effect.Effect<string>) => C,
+) =>
+  Effect.gen(function* () {
+    const Token = yield* AccountApiToken;
+    const attach = yield* Policy;
+
+    return Effect.fn(function* (zone: Zone) {
+      const token = yield* Token(tokenId);
+      yield* attach(token, zone);
+      const zoneId = yield* zone.zoneId;
+      return makeClient(yield* bindDnsToken(token), zoneId);
+    });
+  });
+
+/**
+ * Build the deploy-time policy layer for a DNS binding: attach an allow policy
+ * with the given permission groups, scoped to the requested zone
+ * (`com.cloudflare.api.account.zone.<zoneId>`).
+ */
+export const makeDnsPolicyLive = <Self, Id extends string>(
+  Policy: Binding.Policy<
+    Self,
+    Id,
+    (token: AccountApiToken, zone: Zone) => Effect.Effect<void>
+  >,
+  sid: string,
+  permissionGroups: ApiTokenPermissionGroupRef[],
+) =>
+  Policy.layer.succeed((_host, token, zone) =>
+    token.bind`${sid}(${zone})`({
+      policies: [
+        {
+          effect: "allow",
+          permissionGroups,
+          resources: zone.zoneId.pipe(
+            Output.flatMap(
+              (zoneId) =>
+                Output.interpolate`com.cloudflare.api.account.zone.${zoneId}`,
+            ),
+            Output.map((zoneId) => ({
+              [zoneId]: "*",
+            })),
+          ),
+        },
+      ],
+    }),
+  );

package/src/Cloudflare/Dns/DnsRead.ts

@@ -0,0 +1,129 @@
+import type {
+  GetRecordError,
+  GetRecordResponse,
+  ListRecordsError,
+  ListRecordsRequest,
+  ListRecordsResponse,
+} from "@distilled.cloud/cloudflare/dns";
+import * as dns from "@distilled.cloud/cloudflare/dns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import type { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { Zone } from "../Zone/Zone.ts";
+import {
+  authorizeDns,
+  type DnsToken,
+  makeDnsClient,
+  makeDnsPolicyLive,
+} from "./DnsBinding.ts";
+
+/** List-records request, minus the zone id (bound at `.bind(zone)` time). */
+export type ListRecordsRequestInput = Omit<ListRecordsRequest, "zoneId">;
+
+/**
+ * Read-only DNS record operations. Backed by the `DNS Read` permission group.
+ * The zone is fixed when the client is bound, so no `zoneId` is passed per call.
+ */
+export interface DnsReadClient {
+  /** Fetch a single DNS record by id. */
+  getDnsRecord(
+    dnsRecordId: string,
+  ): Effect.Effect<GetRecordResponse, GetRecordError, RuntimeContext>;
+  /** List the DNS records in the bound zone. */
+  listDnsRecords(
+    request?: ListRecordsRequestInput,
+  ): Effect.Effect<ListRecordsResponse, ListRecordsError, RuntimeContext>;
+}
+
+/** Build the read-only client over a bound token and zone id. */
+export const dnsReadClient = (
+  token: DnsToken,
+  zoneId: Effect.Effect<string>,
+): DnsReadClient => {
+  const authorize = authorizeDns(token);
+  return {
+    getDnsRecord: Effect.fn("Cloudflare.Dns.getDnsRecord")(
+      function* (dnsRecordId) {
+        return yield* authorize(
+          dns.getRecord({ zoneId: yield* zoneId, dnsRecordId }),
+        );
+      },
+    ),
+    listDnsRecords: Effect.fn("Cloudflare.Dns.listDnsRecords")(
+      function* (request) {
+        return yield* authorize(
+          dns.listRecords({ zoneId: yield* zoneId, ...request }),
+        );
+      },
+    ),
+  };
+};
+
+/**
+ * Binding that lets a Worker read Cloudflare DNS records at runtime.
+ *
+ * Creates a least-privilege {@link AccountApiToken} with only the `DNS Read`
+ * permission, scoped to the single zone passed to `bind`, and binds its value
+ * into the Worker so runtime code can authenticate.
+ *
+ * @binding
+ *
+ * @section Reading DNS records at runtime
+ * @example Read records from inside a Worker
+ * Bind the client in the Worker's Init phase and provide {@link DnsReadLive}.
+ * The zone is fixed by `.bind(zone)` — the provisioned token only grants
+ * access to that zone, so calls take no `zoneId`. Pass the {@link Zone}
+ * resource directly (it's an `Effect`), or `yield* Zone` for a resolved value.
+ * ```typescript
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Effect from "effect/Effect";
+ * import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+ *
+ * const Zone = Cloudflare.Zone("MyZone", { name: "example.com" });
+ *
+ * export class DnsReaderWorker extends Cloudflare.Worker<DnsReaderWorker>()(
+ *   "DnsReaderWorker",
+ *   { main: import.meta.filename },
+ *   Effect.gen(function* () {
+ *     // Init phase — bind the read client scoped to the zone.
+ *     const dns = yield* Cloudflare.DnsRead.bind(Zone);
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const { result } = yield* dns.listDnsRecords({ type: "A" });
+ *         const record = yield* dns.getDnsRecord(result[0].id);
+ *         return yield* HttpServerResponse.json({ id: record.id });
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(Cloudflare.DnsReadLive)),
+ * ) {}
+ * ```
+ */
+export class DnsRead extends Binding.Service<
+  DnsRead,
+  (zone: Zone) => Effect.Effect<DnsReadClient>
+>()("Cloudflare.DnsRead") {}
+
+/**
+ * Deploy-time policy for {@link DnsRead}. Attaches the `DNS Read` permission to
+ * the token via its binding contract.
+ */
+export class DnsReadPolicy extends Binding.Policy<
+  DnsReadPolicy,
+  (token: AccountApiToken, zone: Zone) => Effect.Effect<void>
+>()("Cloudflare.DnsRead") {}
+
+/** Runtime layer for {@link DnsRead}. */
+export const DnsReadLive = Layer.effect(
+  DnsRead,
+  makeDnsClient(DnsReadPolicy, "DnsReadToken", dnsReadClient),
+);
+
+/** Live deploy-time policy layer for {@link DnsReadPolicy}. */
+export const DnsReadPolicyLive = makeDnsPolicyLive(
+  DnsReadPolicy,
+  "Cloudflare.DnsRead",
+  ["DNS Read"],
+);

package/src/Cloudflare/Dns/DnsReadWrite.ts

@@ -0,0 +1,99 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { Zone } from "../Zone/Zone.ts";
+import {
+  type DnsToken,
+  makeDnsClient,
+  makeDnsPolicyLive,
+} from "./DnsBinding.ts";
+import { dnsReadClient, type DnsReadClient } from "./DnsRead.ts";
+import { dnsWriteClient, type DnsWriteClient } from "./DnsWrite.ts";
+
+/** Combined read + write DNS record operations. */
+export interface DnsReadWriteClient extends DnsReadClient, DnsWriteClient {}
+
+/** Build the combined read + write client over a bound token and zone id. */
+export const dnsReadWriteClient = (
+  token: DnsToken,
+  zoneId: Effect.Effect<string>,
+): DnsReadWriteClient => ({
+  ...dnsReadClient(token, zoneId),
+  ...dnsWriteClient(token, zoneId),
+});
+
+/**
+ * Binding that lets a Worker perform the full Cloudflare DNS record CRUD
+ * surface at runtime.
+ *
+ * Creates a least-privilege {@link AccountApiToken} with both the `DNS Read`
+ * and `DNS Write` permissions, scoped to the single zone passed to `bind`, and
+ * binds its value into the Worker so runtime code can authenticate.
+ *
+ * @binding
+ *
+ * @section Managing DNS records at runtime
+ * @example Full CRUD from inside a Worker
+ * Bind the client in the Worker's Init phase and provide
+ * {@link DnsReadWriteLive}. The zone is fixed by `.bind(zone)` — the
+ * provisioned token only grants access to that zone, so calls take no
+ * `zoneId`. Pass the {@link Zone} resource directly (it's an `Effect`), or
+ * `yield* Zone` for a resolved value.
+ * ```typescript
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Effect from "effect/Effect";
+ * import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+ *
+ * const Zone = Cloudflare.Zone("MyZone", { name: "example.com" });
+ *
+ * export class DnsWorker extends Cloudflare.Worker<DnsWorker>()(
+ *   "DnsWorker",
+ *   { main: import.meta.filename },
+ *   Effect.gen(function* () {
+ *     // Init phase — bind the full CRUD client scoped to the zone.
+ *     const dns = yield* Cloudflare.DnsReadWrite.bind(Zone);
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const { result } = yield* dns.createDnsRecord({
+ *           type: "A",
+ *           name: "app.example.com",
+ *           content: "192.0.2.1",
+ *           ttl: 1,
+ *         });
+ *         const record = yield* dns.getDnsRecord(result.id);
+ *         yield* dns.deleteDnsRecord(result.id);
+ *         return yield* HttpServerResponse.json({ id: record.id });
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(Cloudflare.DnsReadWriteLive)),
+ * ) {}
+ * ```
+ */
+export class DnsReadWrite extends Binding.Service<
+  DnsReadWrite,
+  (zone: Zone) => Effect.Effect<DnsReadWriteClient>
+>()("Cloudflare.DnsReadWrite") {}
+
+/**
+ * Deploy-time policy for {@link DnsReadWrite}. Attaches both the `DNS Read` and
+ * `DNS Write` permissions to the token via its binding contract.
+ */
+export class DnsReadWritePolicy extends Binding.Policy<
+  DnsReadWritePolicy,
+  (token: AccountApiToken, zone: Zone) => Effect.Effect<void>
+>()("Cloudflare.DnsReadWrite") {}
+
+/** Runtime layer for {@link DnsReadWrite}. */
+export const DnsReadWriteLive = Layer.effect(
+  DnsReadWrite,
+  makeDnsClient(DnsReadWritePolicy, "DnsReadWriteToken", dnsReadWriteClient),
+);
+
+/** Live deploy-time policy layer for {@link DnsReadWritePolicy}. */
+export const DnsReadWritePolicyLive = makeDnsPolicyLive(
+  DnsReadWritePolicy,
+  "Cloudflare.DnsReadWrite",
+  ["DNS Read", "DNS Write"],
+);

package/src/Cloudflare/Dns/DnsWrite.ts

@@ -0,0 +1,209 @@
+import type {
+  BatchRecordError,
+  BatchRecordRequest,
+  BatchRecordResponse,
+  CreateRecordError,
+  CreateRecordRequest,
+  CreateRecordResponse,
+  DeleteRecordError,
+  DeleteRecordResponse,
+  PatchRecordError,
+  PatchRecordRequest,
+  PatchRecordResponse,
+  UpdateRecordError,
+  UpdateRecordRequest,
+  UpdateRecordResponse,
+} from "@distilled.cloud/cloudflare/dns";
+import * as dns from "@distilled.cloud/cloudflare/dns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import type { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { Zone } from "../Zone/Zone.ts";
+import {
+  authorizeDns,
+  type DnsToken,
+  makeDnsClient,
+  makeDnsPolicyLive,
+} from "./DnsBinding.ts";
+
+/** Create-record request, minus the zone id (bound at `.bind(zone)` time). */
+export type CreateRecordRequestInput = Omit<CreateRecordRequest, "zoneId">;
+
+/** Update-record request, minus the zone id and record id. */
+export type UpdateRecordRequestInput = Omit<
+  UpdateRecordRequest,
+  "zoneId" | "dnsRecordId"
+>;
+
+/** Patch-record request, minus the zone id and record id. */
+export type PatchRecordRequestInput = Omit<
+  PatchRecordRequest,
+  "zoneId" | "dnsRecordId"
+>;
+
+/** Batch-records request, minus the zone id (bound at `.bind(zone)` time). */
+export type BatchRecordRequestInput = Omit<BatchRecordRequest, "zoneId">;
+
+/**
+ * Mutating DNS record operations. Backed by the `DNS Write` permission group.
+ * The zone is fixed when the client is bound, so no `zoneId` is passed per call.
+ */
+export interface DnsWriteClient {
+  /** Create a DNS record. */
+  createDnsRecord(
+    request: CreateRecordRequestInput,
+  ): Effect.Effect<CreateRecordResponse, CreateRecordError, RuntimeContext>;
+  /** Overwrite (PUT) a DNS record. */
+  updateDnsRecord(
+    dnsRecordId: string,
+    request: UpdateRecordRequestInput,
+  ): Effect.Effect<UpdateRecordResponse, UpdateRecordError, RuntimeContext>;
+  /** Partially update (PATCH) a DNS record. */
+  patchDnsRecord(
+    dnsRecordId: string,
+    request: PatchRecordRequestInput,
+  ): Effect.Effect<PatchRecordResponse, PatchRecordError, RuntimeContext>;
+  /** Delete a DNS record by id. */
+  deleteDnsRecord(
+    dnsRecordId: string,
+  ): Effect.Effect<DeleteRecordResponse, DeleteRecordError, RuntimeContext>;
+  /** Apply a batch of create / update / patch / delete operations atomically. */
+  batchDnsRecords(
+    request: BatchRecordRequestInput,
+  ): Effect.Effect<BatchRecordResponse, BatchRecordError, RuntimeContext>;
+}
+
+/** Build the write client over a bound token and zone id. */
+export const dnsWriteClient = (
+  token: DnsToken,
+  zoneId: Effect.Effect<string>,
+): DnsWriteClient => {
+  const authorize = authorizeDns(token);
+  return {
+    createDnsRecord: Effect.fn("Cloudflare.Dns.createDnsRecord")(
+      function* (request) {
+        return yield* authorize(
+          dns.createRecord({ zoneId: yield* zoneId, ...request }),
+        );
+      },
+    ),
+    updateDnsRecord: Effect.fn("Cloudflare.Dns.updateDnsRecord")(
+      function* (dnsRecordId, request) {
+        return yield* authorize(
+          dns.updateRecord({ zoneId: yield* zoneId, dnsRecordId, ...request }),
+        );
+      },
+    ),
+    patchDnsRecord: Effect.fn("Cloudflare.Dns.patchDnsRecord")(
+      function* (dnsRecordId, request) {
+        return yield* authorize(
+          dns.patchRecord({ zoneId: yield* zoneId, dnsRecordId, ...request }),
+        );
+      },
+    ),
+    deleteDnsRecord: Effect.fn("Cloudflare.Dns.deleteDnsRecord")(
+      function* (dnsRecordId) {
+        return yield* authorize(
+          dns.deleteRecord({ zoneId: yield* zoneId, dnsRecordId }),
+        );
+      },
+    ),
+    batchDnsRecords: Effect.fn("Cloudflare.Dns.batchDnsRecords")(
+      function* (request) {
+        return yield* authorize(
+          dns.batchRecord({ zoneId: yield* zoneId, ...request }),
+        );
+      },
+    ),
+  };
+};
+
+/**
+ * Binding that lets a Worker create, update, and delete Cloudflare DNS records
+ * at runtime.
+ *
+ * Creates a least-privilege {@link AccountApiToken} with only the `DNS Write`
+ * permission, scoped to the single zone passed to `bind`, and binds its value
+ * into the Worker so runtime code can authenticate.
+ *
+ * @binding
+ *
+ * @section Mutating DNS records at runtime
+ * @example Create, update, and delete records from inside a Worker
+ * Bind the client in the Worker's Init phase and provide {@link DnsWriteLive}.
+ * The zone is fixed by `.bind(zone)` — the provisioned token only grants
+ * access to that zone, so calls take no `zoneId`. Pass the {@link Zone}
+ * resource directly (it's an `Effect`), or `yield* Zone` for a resolved value.
+ * ```typescript
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Effect from "effect/Effect";
+ * import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+ *
+ * const Zone = Cloudflare.Zone("MyZone", { name: "example.com" });
+ *
+ * export class DnsWriterWorker extends Cloudflare.Worker<DnsWriterWorker>()(
+ *   "DnsWriterWorker",
+ *   { main: import.meta.filename },
+ *   Effect.gen(function* () {
+ *     // Init phase — bind the write client scoped to the zone.
+ *     const dns = yield* Cloudflare.DnsWrite.bind(Zone);
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const { result } = yield* dns.createDnsRecord({
+ *           type: "A",
+ *           name: "app.example.com",
+ *           content: "192.0.2.1",
+ *           ttl: 1,
+ *           proxied: true,
+ *         });
+ *         yield* dns.updateDnsRecord(result.id, {
+ *           type: "A",
+ *           name: "app.example.com",
+ *           content: "192.0.2.2",
+ *           ttl: 1,
+ *         });
+ *         yield* dns.deleteDnsRecord(result.id);
+ *         return yield* HttpServerResponse.json({ id: result.id });
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(Cloudflare.DnsWriteLive)),
+ * ) {}
+ * ```
+ *
+ * @example Apply a batch of changes atomically
+ * ```typescript
+ * yield* dns.batchDnsRecords({
+ *   posts: [{ type: "A", name: "a.example.com", content: "192.0.2.1", ttl: 1 }],
+ *   deletes: [{ id: oldRecordId }],
+ * });
+ * ```
+ */
+export class DnsWrite extends Binding.Service<
+  DnsWrite,
+  (zone: Zone) => Effect.Effect<DnsWriteClient>
+>()("Cloudflare.DnsWrite") {}
+
+/**
+ * Deploy-time policy for {@link DnsWrite}. Attaches the `DNS Write` permission
+ * to the token via its binding contract.
+ */
+export class DnsWritePolicy extends Binding.Policy<
+  DnsWritePolicy,
+  (token: AccountApiToken, zone: Zone) => Effect.Effect<void>
+>()("Cloudflare.DnsWrite") {}
+
+/** Runtime layer for {@link DnsWrite}. */
+export const DnsWriteLive = Layer.effect(
+  DnsWrite,
+  makeDnsClient(DnsWritePolicy, "DnsWriteToken", dnsWriteClient),
+);
+
+/** Live deploy-time policy layer for {@link DnsWritePolicy}. */
+export const DnsWritePolicyLive = makeDnsPolicyLive(
+  DnsWritePolicy,
+  "Cloudflare.DnsWrite",
+  ["DNS Write"],
+);

package/src/Cloudflare/Dns/index.ts

@@ -0,0 +1,4 @@
+export * from "./DnsBinding.ts";
+export * from "./DnsRead.ts";
+export * from "./DnsReadWrite.ts";
+export * from "./DnsWrite.ts";

package/src/Cloudflare/Providers.ts

@@ -23,6 +23,7 @@ import * as CloudflareEnvironment from "./CloudflareEnvironment.ts";
 import * as Containers from "./Container/index.ts";
 import * as Credentials from "./Credentials.ts";
 import * as D1 from "./D1/index.ts";
+import * as Dns from "./Dns/index.ts";
 import * as Email from "./Email/index.ts";
 import * as Hyperdrive from "./Hyperdrive/index.ts";
 import * as Images from "./Images/index.ts";
@@ -65,6 +66,9 @@ export const providers = () =>
       Containers.Container,
       D1.D1ConnectionPolicy,
       D1.D1Database,
+      Dns.DnsReadPolicy,
+      Dns.DnsReadWritePolicy,
+      Dns.DnsWritePolicy,
       Email.EmailAddress,
       Email.EmailRouting,
       Email.EmailRule,
@@ -115,6 +119,9 @@ export const providers = () =>
         Containers.ContainerProvider(),
         D1.D1ConnectionPolicyLive,
         D1.DatabaseProvider(),
+        Dns.DnsReadPolicyLive,
+        Dns.DnsReadWritePolicyLive,
+        Dns.DnsWritePolicyLive,
         Email.EmailAddressProvider(),
         Email.EmailRoutingProvider(),
         Email.EmailRuleProvider(),