alchemy 2.0.0-beta.52 → 2.0.0-beta.53

package/src/Cloudflare/SecretsStore/SecretsStore.ts

@@ -47,98 +47,93 @@ export type SecretsStore = Resource<
 export const SecretsStore = Resource<SecretsStore>("Cloudflare.SecretsStore");
 
 export const SecretsStoreProvider = () =>
-  Provider.effect(
-    SecretsStore,
-    Effect.gen(function* () {
-      const { accountId } = yield* CloudflareEnvironment;
-      const createStore = yield* secretsStore.createStore;
-      const listStores = yield* secretsStore.listStores;
-
+  Provider.succeed(SecretsStore, {
+    stables: ["storeId", "storeName", "accountId"],
+    // The engine calls `read` whenever there's no prior state. Cloudflare
+    // allows exactly one Secrets Store per account, so any account that's
+    // ever provisioned one must reuse it. Returning the existing store as
+    // plain attrs makes the engine silently adopt it; `create` is only
+    // ever invoked when no store exists yet.
+    read: Effect.fn(function* ({ output }) {
+      const { accountId } = yield* yield* CloudflareEnvironment;
+      const stores = yield* secretsStore.listStores({
+        accountId: output?.accountId ?? accountId,
+      });
+      const match = output?.storeId
+        ? stores.result.find((s) => s.id === output.storeId)
+        : stores.result[0];
+      if (!match) return undefined;
       return {
-        stables: ["storeId", "storeName", "accountId"],
-        // The engine calls `read` whenever there's no prior state. Cloudflare
-        // allows exactly one Secrets Store per account, so any account that's
-        // ever provisioned one must reuse it. Returning the existing store as
-        // plain attrs makes the engine silently adopt it; `create` is only
-        // ever invoked when no store exists yet.
-        read: Effect.fn(function* ({ output }) {
-          const stores = yield* listStores({
-            accountId: output?.accountId ?? accountId,
-          });
-          const match = output?.storeId
-            ? stores.result.find((s) => s.id === output.storeId)
-            : stores.result[0];
-          if (!match) return undefined;
-          return {
-            storeId: match.id,
-            storeName: match.name,
-            accountId: output?.accountId ?? accountId,
-          };
-        }),
-        reconcile: Effect.fn(function* ({ output }) {
-          const acct = output?.accountId ?? accountId;
+        storeId: match.id,
+        storeName: match.name,
+        accountId: output?.accountId ?? accountId,
+      };
+    }),
+    reconcile: Effect.fn(function* ({ output }) {
+      const { accountId } = yield* yield* CloudflareEnvironment;
+      const acct = output?.accountId ?? accountId;
 
-          // Observe — Cloudflare permits exactly one Secrets Store per
-          // account. List the account's stores; reuse the cached one if
-          // it still exists, otherwise reuse the first one.
-          const stores = yield* listStores({ accountId: acct });
-          const observed = output?.storeId
-            ? (stores.result.find((s) => s.id === output.storeId) ??
-              stores.result[0])
-            : stores.result[0];
+      // Observe — Cloudflare permits exactly one Secrets Store per
+      // account. List the account's stores; reuse the cached one if
+      // it still exists, otherwise reuse the first one.
+      const stores = yield* secretsStore.listStores({ accountId: acct });
+      const observed = output?.storeId
+        ? (stores.result.find((s) => s.id === output.storeId) ??
+          stores.result[0])
+        : stores.result[0];
 
-          if (observed) {
-            return {
-              storeId: observed.id,
-              storeName: observed.name,
-              accountId: acct,
-            };
-          }
+      if (observed) {
+        return {
+          storeId: observed.id,
+          storeName: observed.name,
+          accountId: acct,
+        };
+      }
 
-          // Ensure — no store yet. Create the default. Cloudflare reports
-          // a concurrent create as `MaximumStoresExceeded`; tolerate by
-          // re-listing and adopting the now-existing store.
-          const response = yield* createStore({
-            accountId: acct,
-            // `default_secrets_store` is the name Cloudflare uses for an
-            // account's default Secrets Store.
-            name: "default_secrets_store",
-          }).pipe(
-            Effect.catchTag("MaximumStoresExceeded", () =>
-              Effect.succeed(undefined),
-            ),
-          );
+      // Ensure — no store yet. Create the default. Cloudflare reports
+      // a concurrent create as `MaximumStoresExceeded`; tolerate by
+      // re-listing and adopting the now-existing store.
+      const response = yield* secretsStore
+        .createStore({
+          accountId: acct,
+          // `default_secrets_store` is the name Cloudflare uses for an
+          // account's default Secrets Store.
+          name: "default_secrets_store",
+        })
+        .pipe(
+          Effect.catchTag("MaximumStoresExceeded", () =>
+            Effect.succeed(undefined),
+          ),
+        );
 
-          if (response) {
-            return {
-              storeId: response.id,
-              storeName: response.name,
-              accountId: acct,
-            };
-          }
+      if (response) {
+        return {
+          storeId: response.id,
+          storeName: response.name,
+          accountId: acct,
+        };
+      }
 
-          const after = yield* listStores({ accountId: acct });
-          const first = after.result[0];
-          if (first) {
-            return {
-              storeId: first.id,
-              storeName: first.name,
-              accountId: acct,
-            };
-          }
+      const after = yield* secretsStore.listStores({ accountId: acct });
+      const first = after.result[0];
+      if (first) {
+        return {
+          storeId: first.id,
+          storeName: first.name,
+          accountId: acct,
+        };
+      }
 
-          return yield* Effect.die(
-            new Error(
-              `Cloudflare reported MaximumStoresExceeded for account ${acct} but no store could be listed.`,
-            ),
-          );
-        }),
-        delete: Effect.fn(function* () {
-          // Intentional no-op. Cloudflare only allows one Secrets Store per
-          // account and deleting it permanently destroys all secrets inside.
-          // The store is treated as shared, account-level infrastructure that
-          // should never be torn down by a single stack.
-        }),
-      };
+      return yield* Effect.die(
+        new Error(
+          `Cloudflare reported MaximumStoresExceeded for account ${acct} but no store could be listed.`,
+        ),
+      );
+    }),
+    delete: Effect.fn(function* () {
+      // Intentional no-op. Cloudflare only allows one Secrets Store per
+      // account and deleting it permanently destroys all secrets inside.
+      // The store is treated as shared, account-level infrastructure that
+      // should never be torn down by a single stack.
     }),
-  );
+  });

package/src/Cloudflare/StateStore/State.ts

@@ -517,7 +517,8 @@ export const loginWithCloudflare = (profileName: string, force: boolean) =>
   Effect.gen(function* () {
     const credStore = yield* CredentialsStore;
     const isCI = yield* CI;
-    const { accountId } = yield* CloudflareEnvironment.CloudflareEnvironment;
+    const { accountId } =
+      yield* yield* CloudflareEnvironment.CloudflareEnvironment;
 
     if (!force) {
       // try and read from the cached credentials first if not forcing (force will always refresh)
@@ -608,7 +609,8 @@ export const loginWithCloudflare = (profileName: string, force: boolean) =>
 const isStateStoreAvailable = (scriptName: string = "alchemy-state-store") =>
   Effect.gen(function* () {
     // otherwise, the remote one might exist
-    const { accountId } = yield* CloudflareEnvironment.CloudflareEnvironment;
+    const { accountId } =
+      yield* yield* CloudflareEnvironment.CloudflareEnvironment;
     return yield* workers.getScriptSetting({ accountId, scriptName }).pipe(
       Effect.map((setting) => setting !== undefined),
       Effect.catchTag("WorkerNotFound", () => Effect.succeed(false)),
@@ -861,6 +863,6 @@ const annotateAccountHash = (noTrack?: boolean) =>
       CloudflareEnvironment.CloudflareEnvironment,
     );
     if (env._tag !== "Some") return;
-    const hash = yield* hashAccountId(env.value.accountId);
+    const hash = yield* hashAccountId((yield* env.value).accountId);
     yield* Effect.annotateCurrentSpan("alchemy.cloudflare.account_hash", hash);
   }).pipe(Effect.catch(() => Effect.void));

package/src/Cloudflare/Tunnel/Tunnel.ts

@@ -151,180 +151,146 @@ export type Tunnel = Resource<
 export const Tunnel = Resource<Tunnel>("Cloudflare.Tunnel");
 
 export const TunnelProvider = () =>
-  Provider.effect(
-    Tunnel,
-    Effect.gen(function* () {
-      const { accountId } = yield* CloudflareEnvironment;
-      const createTunnel = yield* zeroTrust.createTunnelCloudflared;
-      const getTunnel = yield* zeroTrust.getTunnelCloudflared;
-      const deleteTunnel = yield* zeroTrust.deleteTunnelCloudflared;
-      const putConfiguration =
-        yield* zeroTrust.putTunnelCloudflaredConfiguration;
-      const getToken = yield* zeroTrust.getTunnelCloudflaredToken;
-      const listTunnels = zeroTrust.listTunnels;
-
-      const createTunnelName = (id: string, name: string | undefined) =>
-        Effect.gen(function* () {
-          if (name) return name;
-          return yield* createPhysicalName({ id });
-        });
+  Provider.succeed(Tunnel, {
+    stables: ["tunnelId", "accountTag", "accountId"],
+    diff: Effect.fn(function* ({ id, olds = {}, news, output }) {
+      const { accountId } = yield* yield* CloudflareEnvironment;
+      if (!isResolved(news)) return undefined;
+      if ((output?.accountId ?? accountId) !== accountId) {
+        return { action: "replace" } as const;
+      }
+      const name = yield* createTunnelName(id, news.name);
+      const oldName = output?.tunnelName
+        ? output.tunnelName
+        : yield* createTunnelName(id, olds.name);
+      if (name !== oldName) {
+        return { action: "replace" } as const;
+      }
+      const oldSecret = olds.tunnelSecret
+        ? Redacted.value(olds.tunnelSecret)
+        : undefined;
+      const newSecret = news.tunnelSecret
+        ? Redacted.value(news.tunnelSecret)
+        : undefined;
+      if (oldSecret !== newSecret) {
+        return { action: "replace" } as const;
+      }
+      if (
+        (olds.configSrc ?? "cloudflare") !== (news.configSrc ?? "cloudflare")
+      ) {
+        return { action: "replace" } as const;
+      }
+    }),
+    reconcile: Effect.fn(function* ({ id, news = {}, output }) {
+      const { accountId } = yield* yield* CloudflareEnvironment;
+      const name = yield* createTunnelName(id, news.name);
+      const configSrc = news.configSrc ?? output?.configSrc ?? "cloudflare";
+      const tunnelSecret = news.tunnelSecret
+        ? Redacted.value(news.tunnelSecret)
+        : undefined;
+      const acct = output?.accountId ?? accountId;
 
-      const writeConfiguration = (
-        tunnelId: string,
-        ingress: Tunnel.IngressRule[] | undefined,
-        originRequest: Tunnel.OriginRequestConfig | undefined,
-      ) =>
-        Effect.gen(function* () {
-          if (!ingress && !originRequest) return;
-          yield* putConfiguration({
-            accountId,
-            tunnelId,
-            config: { ingress, originRequest },
-          });
-        });
+      // Observe — re-fetch the cached tunnel; fall back to a name
+      // lookup so we recover from out-of-band deletes or partial
+      // state-persistence failures.
+      let observed:
+        | {
+            id?: string | null;
+            name?: string | null;
+            accountTag?: string | null;
+            createdAt?: string | null;
+            deletedAt?: string | null;
+          }
+        | undefined;
+      if (output?.tunnelId) {
+        observed = yield* zeroTrust
+          .getTunnelCloudflared({
+            accountId: acct,
+            tunnelId: output.tunnelId,
+          })
+          .pipe(Effect.catch(() => Effect.succeed(undefined)));
+      }
+      if (!observed) {
+        observed = yield* findTunnelByName(name);
+      }
 
-      const findTunnelByName = (name: string) =>
-        listTunnels
-          .items({
-            accountId,
+      // Ensure — create if missing. Cloudflare rejects a duplicate
+      // name with a generic error; tolerate by adopting the
+      // existing tunnel when the caller opted into adoption.
+      if (!observed || !observed.id) {
+        observed = yield* zeroTrust
+          .createTunnelCloudflared({
+            accountId: acct,
             name,
-            isDeleted: false,
-            tunTypes: ["cfd_tunnel"],
+            configSrc,
+            tunnelSecret,
           })
           .pipe(
-            Stream.filter((t) => t.name === name && !t.deletedAt),
-            Stream.runHead,
-            Effect.map(Option.getOrUndefined),
+            Effect.catch((err) =>
+              Effect.gen(function* () {
+                if (!news.adopt) return yield* Effect.fail(err);
+                const existing = yield* findTunnelByName(name);
+                if (!existing || !existing.id) {
+                  return yield* Effect.fail(err);
+                }
+                return existing;
+              }),
+            ),
           );
+      }
 
-      return {
-        stables: ["tunnelId", "accountTag", "accountId"],
-        diff: Effect.fn(function* ({ id, olds = {}, news, output }) {
-          if (!isResolved(news)) return undefined;
-          if ((output?.accountId ?? accountId) !== accountId) {
-            return { action: "replace" } as const;
-          }
-          const name = yield* createTunnelName(id, news.name);
-          const oldName = output?.tunnelName
-            ? output.tunnelName
-            : yield* createTunnelName(id, olds.name);
-          if (name !== oldName) {
-            return { action: "replace" } as const;
-          }
-          const oldSecret = olds.tunnelSecret
-            ? Redacted.value(olds.tunnelSecret)
-            : undefined;
-          const newSecret = news.tunnelSecret
-            ? Redacted.value(news.tunnelSecret)
-            : undefined;
-          if (oldSecret !== newSecret) {
-            return { action: "replace" } as const;
-          }
-          if (
-            (olds.configSrc ?? "cloudflare") !==
-            (news.configSrc ?? "cloudflare")
-          ) {
-            return { action: "replace" } as const;
-          }
-        }),
-        reconcile: Effect.fn(function* ({ id, news = {}, output }) {
-          const name = yield* createTunnelName(id, news.name);
-          const configSrc = news.configSrc ?? output?.configSrc ?? "cloudflare";
-          const tunnelSecret = news.tunnelSecret
-            ? Redacted.value(news.tunnelSecret)
-            : undefined;
-          const acct = output?.accountId ?? accountId;
-
-          // Observe — re-fetch the cached tunnel; fall back to a name
-          // lookup so we recover from out-of-band deletes or partial
-          // state-persistence failures.
-          let observed:
-            | {
-                id?: string | null;
-                name?: string | null;
-                accountTag?: string | null;
-                createdAt?: string | null;
-                deletedAt?: string | null;
-              }
-            | undefined;
-          if (output?.tunnelId) {
-            observed = yield* getTunnel({
-              accountId: acct,
-              tunnelId: output.tunnelId,
-            }).pipe(Effect.catch(() => Effect.succeed(undefined)));
-          }
-          if (!observed) {
-            observed = yield* findTunnelByName(name);
-          }
-
-          // Ensure — create if missing. Cloudflare rejects a duplicate
-          // name with a generic error; tolerate by adopting the
-          // existing tunnel when the caller opted into adoption.
-          if (!observed || !observed.id) {
-            observed = yield* createTunnel({
-              accountId: acct,
-              name,
-              configSrc,
-              tunnelSecret,
-            }).pipe(
-              Effect.catch((err) =>
-                Effect.gen(function* () {
-                  if (!news.adopt) return yield* Effect.fail(err);
-                  const existing = yield* findTunnelByName(name);
-                  if (!existing || !existing.id) {
-                    return yield* Effect.fail(err);
-                  }
-                  return existing;
-                }),
-              ),
-            );
-          }
-
-          // Sync — when the tunnel is managed in Cloudflare, push the
-          // desired ingress + originRequest configuration. The PUT is
-          // idempotent: equal payloads converge to the same state, so we
-          // always push to apply drift.
-          if (configSrc !== "local") {
-            yield* writeConfiguration(
-              observed.id!,
-              news.ingress,
-              news.originRequest,
-            );
-          }
+      // Sync — when the tunnel is managed in Cloudflare, push the
+      // desired ingress + originRequest configuration. The PUT is
+      // idempotent: equal payloads converge to the same state, so we
+      // always push to apply drift.
+      if (configSrc !== "local") {
+        yield* writeConfiguration(
+          observed.id!,
+          news.ingress,
+          news.originRequest,
+        );
+      }
 
-          const token = yield* getToken({
-            accountId: acct,
-            tunnelId: observed.id!,
-          });
+      const token = yield* zeroTrust.getTunnelCloudflaredToken({
+        accountId: acct,
+        tunnelId: observed.id!,
+      });
 
-          return {
-            tunnelId: observed.id!,
-            tunnelName: observed.name ?? name,
-            accountTag: observed.accountTag ?? undefined,
-            accountId: acct,
-            createdAt: observed.createdAt ?? undefined,
-            deletedAt: observed.deletedAt ?? undefined,
-            configSrc,
-            token: Redacted.make(token),
-          };
-        }),
-        delete: Effect.fn(function* ({ output }) {
-          yield* deleteTunnel({
+      return {
+        tunnelId: observed.id!,
+        tunnelName: observed.name ?? name,
+        accountTag: observed.accountTag ?? undefined,
+        accountId: acct,
+        createdAt: observed.createdAt ?? undefined,
+        deletedAt: observed.deletedAt ?? undefined,
+        configSrc,
+        token: Redacted.make(token),
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* zeroTrust
+        .deleteTunnelCloudflared({
+          accountId: output.accountId,
+          tunnelId: output.tunnelId,
+        })
+        .pipe(Effect.catch(() => Effect.void));
+    }),
+    read: Effect.fn(function* ({ id, output, olds }) {
+      const { accountId } = yield* yield* CloudflareEnvironment;
+      if (output?.tunnelId) {
+        return yield* zeroTrust
+          .getTunnelCloudflared({
             accountId: output.accountId,
             tunnelId: output.tunnelId,
-          }).pipe(Effect.catch(() => Effect.void));
-        }),
-        read: Effect.fn(function* ({ id, output, olds }) {
-          if (output?.tunnelId) {
-            return yield* getTunnel({
-              accountId: output.accountId,
-              tunnelId: output.tunnelId,
-            }).pipe(
-              Effect.flatMap((t) =>
-                getToken({
+          })
+          .pipe(
+            Effect.flatMap((t) =>
+              zeroTrust
+                .getTunnelCloudflaredToken({
                   accountId: output.accountId,
                   tunnelId: output.tunnelId,
-                }).pipe(
+                })
+                .pipe(
                   Effect.map((token) => ({
                     tunnelId: t.id ?? output.tunnelId,
                     tunnelName: t.name ?? output.tunnelName,
@@ -340,30 +306,65 @@ export const TunnelProvider = () =>
                     token: Redacted.make(token),
                   })),
                 ),
-              ),
-              Effect.catch(() => Effect.succeed(undefined)),
-            );
-          }
-          const name = yield* createTunnelName(id, olds?.name);
-          const existing = yield* findTunnelByName(name);
-          if (!existing || !existing.id) return undefined;
-          const token = yield* getToken({
-            accountId,
-            tunnelId: existing.id,
-          });
-          return {
-            tunnelId: existing.id,
-            tunnelName: existing.name ?? name,
-            accountTag: existing.accountTag ?? undefined,
-            accountId,
-            createdAt: existing.createdAt ?? undefined,
-            deletedAt: existing.deletedAt ?? undefined,
-            configSrc: ((
-              existing as { configSrc?: "cloudflare" | "local" | null }
-            ).configSrc ?? "cloudflare") as "cloudflare" | "local",
-            token: Redacted.make(token),
-          };
-        }),
+            ),
+            Effect.catch(() => Effect.succeed(undefined)),
+          );
+      }
+      const name = yield* createTunnelName(id, olds?.name);
+      const existing = yield* findTunnelByName(name);
+      if (!existing || !existing.id) return undefined;
+
+      const token = yield* zeroTrust.getTunnelCloudflaredToken({
+        accountId,
+        tunnelId: existing.id,
+      });
+      return {
+        tunnelId: existing.id,
+        tunnelName: existing.name ?? name,
+        accountTag: existing.accountTag ?? undefined,
+        accountId,
+        createdAt: existing.createdAt ?? undefined,
+        deletedAt: existing.deletedAt ?? undefined,
+        configSrc: ((existing as { configSrc?: "cloudflare" | "local" | null })
+          .configSrc ?? "cloudflare") as "cloudflare" | "local",
+        token: Redacted.make(token),
       };
     }),
-  );
+  });
+
+const createTunnelName = (id: string, name: string | undefined) =>
+  Effect.gen(function* () {
+    if (name) return name;
+    return yield* createPhysicalName({ id });
+  });
+
+const writeConfiguration = (
+  tunnelId: string,
+  ingress: Tunnel.IngressRule[] | undefined,
+  originRequest: Tunnel.OriginRequestConfig | undefined,
+) =>
+  Effect.gen(function* () {
+    if (!ingress && !originRequest) return;
+    const { accountId } = yield* yield* CloudflareEnvironment;
+    yield* zeroTrust.putTunnelCloudflaredConfiguration({
+      accountId,
+      tunnelId,
+      config: { ingress, originRequest },
+    });
+  });
+
+const findTunnelByName = Effect.fnUntraced(function* (name: string) {
+  const { accountId } = yield* yield* CloudflareEnvironment;
+  return yield* zeroTrust.listTunnels
+    .items({
+      accountId,
+      name,
+      isDeleted: false,
+      tunTypes: ["cfd_tunnel"],
+    })
+    .pipe(
+      Stream.filter((t) => t.name === name && !t.deletedAt),
+      Stream.runHead,
+      Effect.map(Option.getOrUndefined),
+    );
+});

package/src/Cloudflare/Tunnel/TunnelBinding.ts

@@ -68,7 +68,9 @@ export const makeTunnelClient = <C>(
   Policy: Binding.Policy<
     any,
     any,
-    (token: AccountApiToken) => Effect.Effect<void>
+    (
+      token: AccountApiToken,
+    ) => Effect.Effect<void, never, CloudflareEnvironment>
   >,
   makeClient: (token: TunnelToken) => C,
 ) =>
@@ -92,23 +94,28 @@ export const makeTunnelPolicyLive = <Self, Id extends string>(
   Policy: Binding.Policy<
     Self,
     Id,
-    (token: AccountApiToken) => Effect.Effect<void>
+    (
+      token: AccountApiToken,
+    ) => Effect.Effect<void, never, CloudflareEnvironment>
   >,
   sid: string,
   permissionGroups: ApiTokenPermissionGroupRef[],
 ) =>
-  Policy.layer.effect(
-    Effect.gen(function* () {
-      const { accountId } = yield* CloudflareEnvironment;
-      return (_host, token) =>
+  Policy.layer.succeed((_host, token) =>
+    CloudflareEnvironment.pipe(
+      Effect.flatMap((env) => env),
+      Effect.flatMap(({ accountId }) =>
         token.bind(sid, {
           policies: [
             {
               effect: "allow",
               permissionGroups,
-              resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+              resources: {
+                [`com.cloudflare.api.account.${accountId}`]: "*",
+              },
             },
           ],
-        });
-    }),
+        }),
+      ),
+    ),
   );