alchemy 2.0.0-beta.52 → 2.0.0-beta.53

package/src/Cloudflare/Ruleset/Ruleset.ts

@@ -102,108 +102,86 @@ export type Ruleset = Resource<
  */
 export const Ruleset = Resource<Ruleset>("Cloudflare.Ruleset")({});
 
-const isNotFoundError = (error: unknown): boolean =>
-  typeof error === "object" &&
-  error !== null &&
-  (("status" in error && (error as { status: unknown }).status === 404) ||
-    ("_tag" in error && (error as { _tag: unknown })._tag === "NotFound"));
-
-// A `Zone` prop is resolved to its attributes before a lifecycle op runs, so
-// `zone.zoneId` is normally a plain string even though the `Zone` resource
-// type statically exposes it as an `Output`. During `diff` (plan time) the
-// zone can still be unresolved — e.g. when it's being created in the same
-// deploy — in which case `zoneId` is not yet a string. Callers must treat a
-// non-string result as "not resolved yet".
-const zoneIdOf = (zone: Zone): string | undefined => {
-  const zoneId = (zone as unknown as Partial<ZoneAttributes>).zoneId;
-  return typeof zoneId === "string" ? zoneId : undefined;
-};
-
 export const RulesetProvider = () =>
-  Provider.effect(
-    Ruleset,
-    Effect.gen(function* () {
-      const getPhas = yield* rulesets.getPhasForZone;
-      const putPhas = yield* rulesets.putPhasForZone;
-
-      const createRulesetName = (id: string, name: string | undefined) =>
-        Effect.gen(function* () {
-          return name ?? (yield* createPhysicalName({ id }));
-        });
+  Provider.succeed(Ruleset, {
+    stables: ["zoneId", "phase"],
+    diff: Effect.fn(function* ({ id, olds, news, output }) {
+      if (!isResolved(news)) return undefined;
+      const desiredZoneId = zoneIdOf(news.zone);
 
-      return {
-        stables: ["zoneId", "phase"],
-        diff: Effect.fn(function* ({ id, olds, news, output }) {
-          if (!isResolved(news)) return undefined;
-          const desiredZoneId = zoneIdOf(news.zone);
+      // The desired zone id may still be an unresolved Output (e.g. the
+      // zone is being created in the same deploy). Only make a zone-change
+      // replacement decision once we have a concrete id.
+      if (desiredZoneId !== undefined) {
+        if (output?.zoneId && desiredZoneId !== output.zoneId) {
+          return { action: "replace" } as const;
+        }
+        const oldZoneId = olds.zone ? zoneIdOf(olds.zone) : undefined;
+        if (oldZoneId !== undefined && oldZoneId !== desiredZoneId) {
+          return { action: "replace" } as const;
+        }
+      }
+      if (olds.phase !== news.phase) {
+        return { action: "replace" } as const;
+      }
 
-          // The desired zone id may still be an unresolved Output (e.g. the
-          // zone is being created in the same deploy). Only make a zone-change
-          // replacement decision once we have a concrete id.
-          if (desiredZoneId !== undefined) {
-            if (output?.zoneId && desiredZoneId !== output.zoneId) {
-              return { action: "replace" } as const;
-            }
-            const oldZoneId = olds.zone ? zoneIdOf(olds.zone) : undefined;
-            if (oldZoneId !== undefined && oldZoneId !== desiredZoneId) {
-              return { action: "replace" } as const;
-            }
-          }
-          if (olds.phase !== news.phase) {
-            return { action: "replace" } as const;
-          }
-
-          const oldName =
-            output?.name ?? (yield* createRulesetName(id, olds.name));
-          const name = yield* createRulesetName(id, news.name);
-          if (
-            oldName !== name ||
-            olds.description !== news.description ||
-            !deepEqual(olds.rules, news.rules)
-          ) {
-            return { action: "update" } as const;
-          }
-        }),
-        reconcile: Effect.fn(function* ({ id, news, output }) {
-          const zoneId = output?.zoneId ?? zoneIdOf(news.zone);
-          if (zoneId === undefined) {
-            return yield* Effect.fail(
-              new Error("Cloudflare Ruleset: zone id is not resolved"),
-            );
-          }
-          const name = yield* createRulesetName(id, news.name ?? output?.name);
-          const ruleset = yield* putPhas({
-            zoneId,
-            rulesetPhase: news.phase,
-            name,
-            description: news.description,
-            rules: news.rules,
-          });
-          return toRulesetAttributes(zoneId, ruleset);
-        }),
-        delete: Effect.fn(function* ({ olds, output }) {
-          yield* putPhas({
-            zoneId: output.zoneId,
-            rulesetPhase: olds.phase,
-            name: output.name,
-            description: output.description,
-            rules: [],
-          }).pipe(Effect.catchIf(isNotFoundError, () => Effect.void));
-        }),
-        read: Effect.fn(function* ({ olds, output }) {
-          const zoneId = output?.zoneId ?? zoneIdOf(olds.zone);
-          if (zoneId === undefined) return undefined;
-          return yield* getPhas({
-            zoneId,
-            rulesetPhase: output?.phase ?? olds.phase,
-          }).pipe(
-            Effect.map((ruleset) => toRulesetAttributes(zoneId, ruleset)),
-            Effect.catchIf(isNotFoundError, () => Effect.succeed(undefined)),
-          );
-        }),
-      };
+      const oldName = output?.name ?? (yield* createRulesetName(id, olds.name));
+      const name = yield* createRulesetName(id, news.name);
+      if (
+        oldName !== name ||
+        olds.description !== news.description ||
+        !deepEqual(olds.rules, news.rules)
+      ) {
+        return { action: "update" } as const;
+      }
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output }) {
+      const zoneId = output?.zoneId ?? zoneIdOf(news.zone);
+      if (zoneId === undefined) {
+        return yield* Effect.fail(
+          new Error("Cloudflare Ruleset: zone id is not resolved"),
+        );
+      }
+      const name = yield* createRulesetName(id, news.name ?? output?.name);
+      const ruleset = yield* rulesets.putPhasForZone({
+        zoneId,
+        rulesetPhase: news.phase,
+        name,
+        description: news.description,
+        rules: news.rules,
+      });
+      return toRulesetAttributes(zoneId, ruleset);
     }),
-  );
+    delete: Effect.fn(function* ({ olds, output }) {
+      yield* rulesets
+        .putPhasForZone({
+          zoneId: output.zoneId,
+          rulesetPhase: olds.phase,
+          name: output.name,
+          description: output.description,
+          rules: [],
+        })
+        .pipe(Effect.catchIf(isNotFoundError, () => Effect.void));
+    }),
+    read: Effect.fn(function* ({ olds, output }) {
+      const zoneId = output?.zoneId ?? zoneIdOf(olds.zone);
+      if (zoneId === undefined) return undefined;
+      return yield* rulesets
+        .getPhasForZone({
+          zoneId,
+          rulesetPhase: output?.phase ?? olds.phase,
+        })
+        .pipe(
+          Effect.map((ruleset) => toRulesetAttributes(zoneId, ruleset)),
+          Effect.catchIf(isNotFoundError, () => Effect.succeed(undefined)),
+        );
+    }),
+  });
+
+const createRulesetName = (id: string, name: string | undefined) =>
+  Effect.gen(function* () {
+    return name ?? (yield* createPhysicalName({ id }));
+  });
 
 export const toRulesetAttributes = (
   zoneId: string,
@@ -221,3 +199,20 @@ export const toRulesetAttributes = (
   lastUpdated: ruleset.lastUpdated,
   version: ruleset.version,
 });
+
+const isNotFoundError = (error: unknown): boolean =>
+  typeof error === "object" &&
+  error !== null &&
+  (("status" in error && (error as { status: unknown }).status === 404) ||
+    ("_tag" in error && (error as { _tag: unknown })._tag === "NotFound"));
+
+// A `Zone` prop is resolved to its attributes before a lifecycle op runs, so
+// `zone.zoneId` is normally a plain string even though the `Zone` resource
+// type statically exposes it as an `Output`. During `diff` (plan time) the
+// zone can still be unresolved — e.g. when it's being created in the same
+// deploy — in which case `zoneId` is not yet a string. Callers must treat a
+// non-string result as "not resolved yet".
+const zoneIdOf = (zone: Zone): string | undefined => {
+  const zoneId = (zone as unknown as Partial<ZoneAttributes>).zoneId;
+  return typeof zoneId === "string" ? zoneId : undefined;
+};

package/src/Cloudflare/SecretsStore/Secret.ts

@@ -95,212 +95,205 @@ export const Secret = Resource<Secret>("Cloudflare.SecretsStore.Secret")({
   bind: SecretBinding.bind,
 });
 
-const resolveScopes = (scopes: string[] | undefined): string[] =>
-  scopes && scopes.length > 0 ? scopes : ["workers"];
-
-const resolveName = (id: string, name: string | undefined): string =>
-  name ?? id;
-
 export const StoreSecretProvider = () =>
-  Provider.effect(
-    Secret,
-    Effect.gen(function* () {
-      const createStoreSecret = yield* secretsStore.createStoreSecret;
-      const patchStoreSecret = yield* secretsStore.patchStoreSecret;
-      const deleteStoreSecret = yield* secretsStore.deleteStoreSecret;
-      const getStoreSecret = yield* secretsStore.getStoreSecret;
-      const listStoreSecrets = secretsStore.listStoreSecrets;
-
-      return {
-        stables: ["secretId", "secretName", "storeId", "accountId"],
-        diff: Effect.fn(function* ({ id, olds = {} as any, news, output }) {
-          if (!isResolved(news)) return undefined;
-          const oldStoreId = output?.storeId ?? olds.store?.storeId;
-          const newStoreId = news.store.storeId;
-          const oldName = output?.secretName ?? resolveName(id, olds.name);
-          const newName = resolveName(id, news.name);
-          if (oldStoreId !== newStoreId || oldName !== newName) {
-            return { action: "replace" } as const;
-          }
-          const oldValue = olds.value ? Redacted.value(olds.value) : undefined;
-          const newValue = Redacted.value(news.value);
-          if (oldValue !== newValue) {
-            return { action: "update" } as const;
-          }
-        }),
-        reconcile: Effect.fn(function* ({ id, news, output }) {
-          const name = resolveName(id, news.name);
-          const scopes = resolveScopes(news.scopes);
-          const accountId = news.store.accountId;
-          const storeId = news.store.storeId;
-
-          // Observe — re-fetch the cached secret; fall back to a name
-          // scan over the store so we recover from out-of-band deletes
-          // or partial state-persistence failures.
-          let observed:
-            | {
-                id: string;
-                name: string;
-                storeId: string;
-                status: string;
-                comment?: string | null;
-              }
-            | undefined;
-          if (output?.secretId) {
-            observed = yield* getStoreSecret({
-              accountId: output.accountId,
-              storeId: output.storeId,
-              secretId: output.secretId,
-            }).pipe(
-              Effect.catchTag("SecretNotFound", () =>
-                Effect.succeed(undefined),
-              ),
-              Effect.catchTag("StoreNotFound", () => Effect.succeed(undefined)),
-            );
-          }
-          if (!observed) {
-            observed = yield* listStoreSecrets
-              .items({ accountId, storeId })
-              .pipe(
-                Stream.filter((s) => s.name === name),
-                Stream.runHead,
-                Effect.catchTag("StoreNotFound", () => Effect.succeedNone),
-                Effect.map(Option.getOrUndefined),
-              );
-          }
+  Provider.succeed(Secret, {
+    stables: ["secretId", "secretName", "storeId", "accountId"],
+    diff: Effect.fn(function* ({ id, olds = {} as any, news, output }) {
+      if (!isResolved(news)) return undefined;
+      const oldStoreId = output?.storeId ?? olds.store?.storeId;
+      const newStoreId = news.store.storeId;
+      const oldName = output?.secretName ?? resolveName(id, olds.name);
+      const newName = resolveName(id, news.name);
+      if (oldStoreId !== newStoreId || oldName !== newName) {
+        return { action: "replace" } as const;
+      }
+      const oldValue = olds.value ? Redacted.value(olds.value) : undefined;
+      const newValue = Redacted.value(news.value);
+      if (oldValue !== newValue) {
+        return { action: "update" } as const;
+      }
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output }) {
+      const name = resolveName(id, news.name);
+      const scopes = resolveScopes(news.scopes);
+      const accountId = news.store.accountId;
+      const storeId = news.store.storeId;
 
-          // Ensure — create if missing. Cloudflare reports a concurrent
-          // create as `SecretNameAlreadyExists`; tolerate by re-listing
-          // the store and adopting the secret with the same name. The
-          // value can't be read back from the API; we trust an
-          // identically-named secret reflects the same intent.
-          if (!observed) {
-            const created = yield* createStoreSecret({
-              accountId,
-              storeId,
-              body: [
-                {
-                  name,
-                  scopes,
-                  value: Redacted.value(news.value),
-                  comment: news.comment,
-                },
-              ],
-            }).pipe(
-              Effect.catchTag("SecretNameAlreadyExists", () =>
-                Effect.succeed(undefined),
-              ),
-            );
-            if (created) {
-              const secret = created.result[0]!;
-              return {
-                secretId: secret.id,
-                secretName: secret.name,
-                storeId: secret.storeId,
-                accountId,
-                status: asSecretStatus(secret.status),
-                scopes,
-                comment: secret.comment ?? undefined,
-              };
-            }
-            const existing = yield* listStoreSecrets
-              .items({ accountId, storeId })
-              .pipe(
-                Stream.filter((s) => s.name === name),
-                Stream.runHead,
-                Effect.map(Option.getOrUndefined),
-              );
-            if (!existing) {
-              return yield* Effect.die(
-                new Error(
-                  `Secret '${name}' reported as already existing in store ${storeId} but could not be found on lookup.`,
-                ),
-              );
-            }
-            observed = existing;
+      // Observe — re-fetch the cached secret; fall back to a name
+      // scan over the store so we recover from out-of-band deletes
+      // or partial state-persistence failures.
+      let observed:
+        | {
+            id: string;
+            name: string;
+            storeId: string;
+            status: string;
+            comment?: string | null;
           }
+        | undefined;
+      if (output?.secretId) {
+        observed = yield* secretsStore
+          .getStoreSecret({
+            accountId: output.accountId,
+            storeId: output.storeId,
+            secretId: output.secretId,
+          })
+          .pipe(
+            Effect.catchTag("SecretNotFound", () => Effect.succeed(undefined)),
+            Effect.catchTag("StoreNotFound", () => Effect.succeed(undefined)),
+          );
+      }
+      if (!observed) {
+        observed = yield* secretsStore.listStoreSecrets
+          .items({ accountId, storeId })
+          .pipe(
+            Stream.filter((s) => s.name === name),
+            Stream.runHead,
+            Effect.catchTag("StoreNotFound", () => Effect.succeedNone),
+            Effect.map(Option.getOrUndefined),
+          );
+      }
 
-          const patched = yield* patchStoreSecret({
+      // Ensure — create if missing. Cloudflare reports a concurrent
+      // create as `SecretNameAlreadyExists`; tolerate by re-listing
+      // the store and adopting the secret with the same name. The
+      // value can't be read back from the API; we trust an
+      // identically-named secret reflects the same intent.
+      if (!observed) {
+        const created = yield* secretsStore
+          .createStoreSecret({
             accountId,
             storeId,
-            secretId: observed.id,
-            scopes,
-            comment: news.comment,
-            value: Redacted.value(news.value),
-          });
+            body: [
+              {
+                name,
+                scopes,
+                value: Redacted.value(news.value),
+                comment: news.comment,
+              },
+            ],
+          })
+          .pipe(
+            Effect.catchTag("SecretNameAlreadyExists", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        if (created) {
+          const secret = created.result[0]!;
           return {
-            secretId: observed.id,
-            secretName: observed.name,
-            storeId: observed.storeId,
+            secretId: secret.id,
+            secretName: secret.name,
+            storeId: secret.storeId,
             accountId,
-            status: asSecretStatus(patched.status),
+            status: asSecretStatus(secret.status),
             scopes,
-            comment: patched.comment ?? undefined,
+            comment: secret.comment ?? undefined,
           };
-        }),
-        delete: Effect.fn(function* ({ output }) {
-          yield* deleteStoreSecret({
+        }
+        const existing = yield* secretsStore.listStoreSecrets
+          .items({ accountId, storeId })
+          .pipe(
+            Stream.filter((s) => s.name === name),
+            Stream.runHead,
+            Effect.map(Option.getOrUndefined),
+          );
+        if (!existing) {
+          return yield* Effect.die(
+            new Error(
+              `Secret '${name}' reported as already existing in store ${storeId} but could not be found on lookup.`,
+            ),
+          );
+        }
+        observed = existing;
+      }
+
+      const patched = yield* secretsStore.patchStoreSecret({
+        accountId,
+        storeId,
+        secretId: observed.id,
+        scopes,
+        comment: news.comment,
+        value: Redacted.value(news.value),
+      });
+      return {
+        secretId: observed.id,
+        secretName: observed.name,
+        storeId: observed.storeId,
+        accountId,
+        status: asSecretStatus(patched.status),
+        scopes,
+        comment: patched.comment ?? undefined,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* secretsStore
+        .deleteStoreSecret({
+          accountId: output.accountId,
+          storeId: output.storeId,
+          secretId: output.secretId,
+        })
+        .pipe(
+          Effect.tap(() => Effect.log(`deleted ${output.secretId}`)),
+          Effect.tapError(Console.log),
+          Effect.catchTag("SecretNotFound", () => Effect.void),
+          Effect.catchTag("StoreNotFound", () => Effect.void),
+          Effect.catchTag("NotFound", () => Effect.void),
+        );
+    }),
+    read: Effect.fn(function* ({ id, olds, output }) {
+      if (output?.secretId) {
+        return yield* secretsStore
+          .getStoreSecret({
             accountId: output.accountId,
             storeId: output.storeId,
             secretId: output.secretId,
-          }).pipe(
-            Effect.tap(() => Effect.log(`deleted ${output.secretId}`)),
-            Effect.tapError(Console.log),
-            Effect.catchTag("SecretNotFound", () => Effect.void),
-            Effect.catchTag("StoreNotFound", () => Effect.void),
-            Effect.catchTag("NotFound", () => Effect.void),
-          );
-        }),
-        read: Effect.fn(function* ({ id, olds, output }) {
-          if (output?.secretId) {
-            return yield* getStoreSecret({
+          })
+          .pipe(
+            Effect.map((secret) => ({
+              secretId: secret.id,
+              secretName: secret.name,
+              storeId: secret.storeId,
               accountId: output.accountId,
-              storeId: output.storeId,
-              secretId: output.secretId,
-            }).pipe(
-              Effect.map((secret) => ({
-                secretId: secret.id,
-                secretName: secret.name,
-                storeId: secret.storeId,
-                accountId: output.accountId,
-                status: asSecretStatus(secret.status),
-                scopes: output.scopes,
-                comment: secret.comment ?? undefined,
-              })),
-              Effect.catchTag("SecretNotFound", () =>
-                Effect.succeed(undefined),
-              ),
-              Effect.catchTag("StoreNotFound", () => Effect.succeed(undefined)),
-            );
-          }
-          if (!olds?.store) return undefined;
-          const name = resolveName(id, olds.name);
-          const match = yield* listStoreSecrets
-            .items({
-              accountId: olds.store.accountId,
-              storeId: olds.store.storeId,
-            })
-            .pipe(
-              Stream.filter((s) => s.name === name),
-              Stream.runHead,
-              Effect.catchTag("StoreNotFound", () => Effect.succeedNone),
-              Effect.map(Option.getOrUndefined),
-            );
-          if (!match) return undefined;
-          // Secrets carry no ownership signal (Cloudflare doesn't expose
-          // tags on store secrets), so a name match is not proof we own
-          // it. Brand it `Unowned` so the engine surfaces
-          // `OwnedBySomeoneElse` unless the caller opted in via `--adopt`.
-          return Unowned({
-            secretId: match.id,
-            secretName: match.name,
-            storeId: match.storeId,
-            accountId: olds.store.accountId,
-            status: asSecretStatus(match.status),
-            scopes: resolveScopes(olds.scopes),
-            comment: match.comment ?? undefined,
-          });
-        }),
-      };
+              status: asSecretStatus(secret.status),
+              scopes: output.scopes,
+              comment: secret.comment ?? undefined,
+            })),
+            Effect.catchTag("SecretNotFound", () => Effect.succeed(undefined)),
+            Effect.catchTag("StoreNotFound", () => Effect.succeed(undefined)),
+          );
+      }
+      if (!olds?.store) return undefined;
+      const name = resolveName(id, olds.name);
+      const match = yield* secretsStore.listStoreSecrets
+        .items({
+          accountId: olds.store.accountId,
+          storeId: olds.store.storeId,
+        })
+        .pipe(
+          Stream.filter((s) => s.name === name),
+          Stream.runHead,
+          Effect.catchTag("StoreNotFound", () => Effect.succeedNone),
+          Effect.map(Option.getOrUndefined),
+        );
+      if (!match) return undefined;
+      // Secrets carry no ownership signal (Cloudflare doesn't expose
+      // tags on store secrets), so a name match is not proof we own
+      // it. Brand it `Unowned` so the engine surfaces
+      // `OwnedBySomeoneElse` unless the caller opted in via `--adopt`.
+      return Unowned({
+        secretId: match.id,
+        secretName: match.name,
+        storeId: match.storeId,
+        accountId: olds.store.accountId,
+        status: asSecretStatus(match.status),
+        scopes: resolveScopes(olds.scopes),
+        comment: match.comment ?? undefined,
+      });
     }),
-  );
+  });
+
+const resolveScopes = (scopes: string[] | undefined): string[] =>
+  scopes && scopes.length > 0 ? scopes : ["workers"];
+
+const resolveName = (id: string, name: string | undefined): string =>
+  name ?? id;