alchemy 2.0.0-beta.57 → 2.0.0-beta.58

package/src/Cloudflare/AiSearch/AiSearch.ts

@@ -1,9 +1,10 @@
-import * as Construct from "../../Construct.ts";
+import * as Effect from "effect/Effect";
 import type { Input, InputProps } from "../../Input.ts";
+import * as Namespace from "../../Namespace.ts";
 import { isResource } from "../../Resource.ts";
 import { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
-import type { R2Bucket } from "../R2/R2Bucket.ts";
+import type { R2Bucket } from "../R2/Bucket.ts";
 import {
   AiSearchInstance,
   type AiSearchInstanceProps,
@@ -293,103 +294,101 @@ export type AiSearch = AiSearchInstance & {
  *
  * @see https://developers.cloudflare.com/ai-search/
  */
-export const AiSearch = Construct.fn(function* (
-  id: string,
-  props: AiSearchProps,
-) {
-  const {
-    source,
-    prefix,
-    include,
-    exclude,
-    jurisdiction,
-    parse,
-    crawl,
-    store,
-    namespace,
-    ...shared
-  } = props;
+export const AiSearch = (id: string, props: AiSearchProps) =>
+  Effect.gen(function* () {
+    const {
+      source,
+      prefix,
+      include,
+      exclude,
+      jurisdiction,
+      parse,
+      crawl,
+      store,
+      namespace,
+      ...shared
+    } = props;
 
-  let tokenId = shared.tokenId;
-  let serviceToken: AiSearchToken | undefined;
-  let type: "r2" | "web-crawler";
-  let instanceSource: Input<string>;
-  let sourceParams: Input<AiSearchSourceParams> | undefined;
+    let tokenId = shared.tokenId;
+    let serviceToken: AiSearchToken | undefined;
+    let type: "r2" | "web-crawler";
+    let instanceSource: Input<string>;
+    let sourceParams: Input<AiSearchSourceParams> | undefined;
 
-  // Discriminate the data source on what `source` is: an R2Bucket (a resource)
-  // indexes a bucket and needs a service token to read it; a URL crawls a seed
-  // and doesn't.
-  if (isResource(source)) {
-    const bucket = source as R2Bucket;
-    type = "r2";
-    instanceSource = bucket.bucketName;
-    sourceParams = clean({
-      prefix,
-      includeItems: include,
-      excludeItems: exclude,
-      r2Jurisdiction: jurisdiction,
-    }) as Input<AiSearchSourceParams> | undefined;
+    // Discriminate the data source on what `source` is: an R2Bucket (a resource)
+    // indexes a bucket and needs a service token to read it; a URL crawls a seed
+    // and doesn't.
+    if (isResource(source)) {
+      const bucket = source as R2Bucket;
+      type = "r2";
+      instanceSource = bucket.bucketName;
+      sourceParams = clean({
+        prefix,
+        includeItems: include,
+        excludeItems: exclude,
+        r2Jurisdiction: jurisdiction,
+      }) as Input<AiSearchSourceParams> | undefined;
 
-    // Cloudflare requires a service token to read an R2 source and only
-    // auto-creates one via the dashboard/Wrangler — not on a programmatic
-    // API create. Mint one ourselves unless the caller passed a `tokenId`.
-    if (tokenId === undefined) {
-      const { accountId } = yield* yield* CloudflareEnvironment;
-      const apiToken = yield* AccountApiToken("ApiToken", {
-        policies: [
-          {
-            effect: "allow",
-            permissionGroups: ["AI Search Index Engine"],
-            resources: {
-              [`com.cloudflare.api.account.${accountId}`]: "*",
+      // Cloudflare requires a service token to read an R2 source and only
+      // auto-creates one via the dashboard/Wrangler — not on a programmatic
+      // API create. Mint one ourselves unless the caller passed a `tokenId`.
+      if (tokenId === undefined) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const apiToken = yield* AccountApiToken("ApiToken", {
+          policies: [
+            {
+              effect: "allow",
+              permissionGroups: ["AI Search Index Engine"],
+              resources: {
+                [`com.cloudflare.api.account.${accountId}`]: "*",
+              },
             },
-          },
-        ],
-      });
-      serviceToken = yield* AiSearchToken("Token", {
-        cfApiId: apiToken.tokenId,
-        cfApiKey: apiToken.value,
+          ],
+        });
+        serviceToken = yield* AiSearchToken("Token", {
+          cfApiId: apiToken.tokenId,
+          cfApiKey: apiToken.value,
+        });
+        tokenId = serviceToken.id;
+      }
+    } else {
+      type = "web-crawler";
+      instanceSource = source as Input<string>;
+
+      const { type: parseType, ...parseOptions } = parse ?? {};
+      const webCrawler = clean({
+        parseType,
+        parseOptions: clean(parseOptions),
+        crawlOptions: crawl ? clean(crawl) : undefined,
+        storeOptions: store
+          ? clean({
+              storageId: store.bucket.bucketName,
+              storageType: "r2" as const,
+              r2Jurisdiction: store.jurisdiction,
+            })
+          : undefined,
       });
-      tokenId = serviceToken.id;
+      sourceParams = webCrawler
+        ? ({ webCrawler } as Input<AiSearchSourceParams>)
+        : undefined;
     }
-  } else {
-    type = "web-crawler";
-    instanceSource = source as Input<string>;
 
-    const { type: parseType, ...parseOptions } = parse ?? {};
-    const webCrawler = clean({
-      parseType,
-      parseOptions: clean(parseOptions),
-      crawlOptions: crawl ? clean(crawl) : undefined,
-      storeOptions: store
-        ? clean({
-            storageId: store.bucket.bucketName,
-            storageType: "r2" as const,
-            r2Jurisdiction: store.jurisdiction,
-          })
-        : undefined,
+    const instance = yield* AiSearchInstance("Instance", {
+      ...shared,
+      // The instance is keyed by namespace name; pass the namespace's `name`
+      // output so the engine orders instance-after-namespace.
+      namespace: namespace?.name,
+      type,
+      source: instanceSource,
+      tokenId,
+      sourceParams,
     });
-    sourceParams = webCrawler
-      ? ({ webCrawler } as Input<AiSearchSourceParams>)
-      : undefined;
-  }
-
-  const instance = yield* AiSearchInstance("Instance", {
-    ...shared,
-    // The instance is keyed by namespace name; pass the namespace's `name`
-    // output so the engine orders instance-after-namespace.
-    namespace: namespace?.name,
-    type,
-    source: instanceSource,
-    tokenId,
-    sourceParams,
-  });
 
-  // Return the instance itself (augmented with the managed `serviceToken`)
-  // so an `AiSearch` is usable anywhere an `AiSearchInstance` is expected —
-  // `AiSearchInstance.bind(search)`, `env: { SEARCH: search }`, etc.
-  return Object.assign(instance, { serviceToken }) as AiSearch;
-});
+    // Return the instance itself (augmented with the managed `serviceToken`)
+    // so an `AiSearch` is usable anywhere an `AiSearchInstance` is expected —
+    // `AiSearchInstance.bind(search)`, `env: { SEARCH: search }`, etc.
+    return Object.assign(instance, { serviceToken }) as AiSearch;
+  }).pipe(Namespace.push(id));
 
 /** Drop `undefined` entries; return `undefined` when nothing is left. */
 const clean = <T extends Record<string, unknown>>(

package/src/Cloudflare/AiSearch/AiSearchBinding.ts

@@ -9,6 +9,7 @@ import type { RuntimeContext } from "../../RuntimeContext.ts";
 import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
 import type { AiSearchInstance } from "./AiSearchInstance.ts";
 import type { AiSearchNamespace } from "./AiSearchNamespace.ts";
+import type { Providers } from "../Providers.ts";
 
 /**
  * Error raised by AI Search runtime binding operations.
@@ -182,7 +183,8 @@ export const AiSearchInstanceBindingLive = Layer.effect(
  */
 export class AiSearchInstanceBindingPolicy extends Binding.Policy<
   AiSearchInstanceBindingPolicy,
-  (instance: AiSearchInstance) => Effect.Effect<void>
+  (instance: AiSearchInstance) => Effect.Effect<void>,
+  Providers
 >()("Cloudflare.AiSearch.InstanceBinding") {}
 
 /**
@@ -309,7 +311,8 @@ export const AiSearchNamespaceBindingLive = Layer.effect(
  */
 export class AiSearchNamespaceBindingPolicy extends Binding.Policy<
   AiSearchNamespaceBindingPolicy,
-  (namespace: AiSearchNamespace) => Effect.Effect<void>
+  (namespace: AiSearchNamespace) => Effect.Effect<void>,
+  Providers
 >()("Cloudflare.AiSearch.NamespaceBinding") {}
 
 /**

package/src/Cloudflare/AiSearch/AiSearchInstance.ts

@@ -802,27 +802,44 @@ export const AiSearchInstanceProvider = () =>
   });
 
 /**
- * On a greenfield create Cloudflare auto-provisions an R2 service token for
- * the instance to read its source bucket. That token is validated
- * eventually-consistently, so the create/update PUT can transiently reject
- * with `InvalidTokenCredentials` (code 7012, message
- * `ai_search_instance_invalid_token`) before the token has propagated. Ride
- * the blip out with a short, bounded retry; a genuinely invalid token still
- * fails once the retries are exhausted.
+ * Ride out the two eventual-consistency windows Cloudflare opens when an
+ * instance's source is (re)validated at create/update time:
+ *
+ *   - `InvalidTokenCredentials` (code 7012, message
+ *     `ai_search_instance_invalid_token`): on a greenfield create Cloudflare
+ *     auto-provisions an R2 service token for the instance to read its source
+ *     bucket, and validates it eventually-consistently.
+ *   - `MissingSitemap` (400, message `missing_sitemap`): a `web-crawler`
+ *     source is fetched synchronously at validation time. A freshly-deployed
+ *     seed (e.g. a brand-new `workers.dev` URL) is reachable from the test's
+ *     own vantage well before Cloudflare's crawler infrastructure can fetch
+ *     it, so the first validation can spuriously report no content.
+ *
+ * Both settle within a bounded window; a genuinely invalid token or
+ * unreachable/empty seed still fails once the retries are exhausted.
  */
 const retryTokenPropagation = <A, E extends { _tag: string }, R>(
   effect: Effect.Effect<A, E, R>,
 ) =>
   effect.pipe(
     Effect.retry({
-      while: (e) => e._tag === "InvalidTokenCredentials",
+      while: (e) =>
+        e._tag === "InvalidTokenCredentials" || e._tag === "MissingSitemap",
       // A full-body update PUT re-sends `source`, which makes Cloudflare
-      // re-validate the (write-only, auto-provisioned) R2 service token —
-      // opening a fresh propagation window each time. Gentle exponential
-      // growth keeps the per-attempt delay bounded (~17s max) while giving
-      // the token longer overall to settle (~70s across 10 attempts).
-      schedule: Schedule.exponential("1 second", 1.5),
-      times: 10,
+      // re-validate the (write-only, auto-provisioned) R2 service token and
+      // re-fetch a web-crawler seed — opening a fresh propagation window each
+      // time. The window stretches under full-suite parallel load (token
+      // propagation across the edge contends with every other test's calls),
+      // so the budget is generous (~2 min). Crucially the per-attempt delay is
+      // *capped* at 6s (`either` takes the min of the two schedules): an
+      // uncapped exponential balloons to ~38s gaps by attempt 10, so it polls
+      // sparsely and detects a settled token tens of seconds late. Capped
+      // polling detects within 6s of propagation completing while still
+      // covering a long total window.
+      schedule: Schedule.exponential("1 second", 1.5).pipe(
+        Schedule.either(Schedule.spaced("6 seconds")),
+      ),
+      times: 22,
     }),
   );
 

package/src/Cloudflare/AnalyticsEngine/AnalyticsEngineDataset.ts

@@ -65,10 +65,7 @@ export const AnalyticsEngineDataset: {
    */
   bind: typeof AnalyticsEngineDatasetBinding.bind;
 } = Object.assign(
-  Effect.fnUntraced(function* (
-    name: string,
-    props?: AnalyticsEngineDatasetProps,
-  ) {
+  Effect.fn(function* (name: string, props?: AnalyticsEngineDatasetProps) {
     return {
       kind: AnalyticsEngineDatasetTypeId,
       name,

package/src/Cloudflare/AnalyticsEngine/AnalyticsEngineDatasetBinding.ts

@@ -6,6 +6,7 @@ import type { ResourceLike } from "../../Resource.ts";
 import type { RuntimeContext } from "../../RuntimeContext.ts";
 import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
 import type { AnalyticsEngineDataset as AnalyticsEngineDatasetLike } from "./AnalyticsEngineDataset.ts";
+import type { Providers } from "../Providers.ts";
 
 export interface AnalyticsEngineDataPoint {
   indexes?: string[];
@@ -49,7 +50,7 @@ export const AnalyticsEngineDatasetBindingLive = Layer.effect(
     const bind = yield* AnalyticsEngineDatasetBindingPolicy;
     const env = yield* WorkerEnvironment;
 
-    return Effect.fnUntraced(function* (dataset: AnalyticsEngineDatasetLike) {
+    return Effect.fn(function* (dataset: AnalyticsEngineDatasetLike) {
       yield* bind(dataset);
 
       const raw = Effect.sync(
@@ -79,12 +80,13 @@ export const AnalyticsEngineDatasetBindingLive = Layer.effect(
 
 export class AnalyticsEngineDatasetBindingPolicy extends Binding.Policy<
   AnalyticsEngineDatasetBindingPolicy,
-  (dataset: AnalyticsEngineDatasetLike) => Effect.Effect<void>
+  (dataset: AnalyticsEngineDatasetLike) => Effect.Effect<void>,
+  Providers
 >()("Cloudflare.AnalyticsEngineDataset.Binding") {}
 
 export const AnalyticsEngineDatasetBindingPolicyLive =
   AnalyticsEngineDatasetBindingPolicy.layer.succeed(
-    Effect.fnUntraced(function* (
+    Effect.fn(function* (
       host: ResourceLike,
       dataset: AnalyticsEngineDatasetLike,
     ) {

package/src/Cloudflare/ApiShield/UserSchema.ts

@@ -262,6 +262,11 @@ export const ApiShieldUserSchemaProvider = () =>
             Effect.catchTag("Forbidden", () =>
               Effect.succeed([] as ApiShieldUserSchemaAttributes[]),
             ),
+            // A zone purged (deleted) out-of-band mid-enumeration — it was in
+            // the zone list but no longer exists; drop it.
+            Effect.catchTag("ZonePurged", () =>
+              Effect.succeed([] as ApiShieldUserSchemaAttributes[]),
+            ),
           ),
         { concurrency: 10 },
       );

package/src/Cloudflare/Artifacts/ArtifactsBinding.ts

@@ -6,6 +6,7 @@ import type { ResourceLike } from "../../Resource.ts";
 import type { RuntimeContext } from "../../RuntimeContext.ts";
 import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
 import { type Artifacts as ArtifactsLike } from "./Artifacts.ts";
+import type { Providers } from "../Providers.ts";
 
 export class ArtifactsError extends Data.TaggedError("ArtifactsError")<{
   message: string;
@@ -138,7 +139,8 @@ export const ArtifactsBindingLive = Layer.effect(
 
 export class ArtifactsBindingPolicy extends Binding.Policy<
   ArtifactsBindingPolicy,
-  (artifacts: ArtifactsLike) => Effect.Effect<void>
+  (artifacts: ArtifactsLike) => Effect.Effect<void>,
+  Providers
 >()("Cloudflare.Artifacts.Binding") {}
 
 export const ArtifactsBindingPolicyLive = ArtifactsBindingPolicy.layer.succeed(

package/src/Cloudflare/Auth/AuthProvider.ts

@@ -200,7 +200,7 @@ export const CloudflareAuth = AuthProviderLayer<
         return credentials;
       });
 
-    const loginStored = Effect.fnUntraced(function* (profileName: string) {
+    const loginStored = Effect.fn(function* (profileName: string) {
       const credentialType = yield* Clank.select({
         message: "Cloudflare credential type",
         options: [
@@ -263,7 +263,7 @@ export const CloudflareAuth = AuthProviderLayer<
       );
     });
 
-    const configureOAuth = Effect.fnUntraced(function* (profileName: string) {
+    const configureOAuth = Effect.fn(function* (profileName: string) {
       const scopes = yield* promptOAuthScopes();
 
       const oauthCreds = yield* oauthLogin(profileName, scopes);
@@ -323,7 +323,7 @@ export const CloudflareAuth = AuthProviderLayer<
       Match.value(config).pipe(
         Match.when(
           { method: "env" },
-          Effect.fnUntraced(function* () {
+          Effect.fn(function* () {
             const accountId = yield* getEnvRequired("CLOUDFLARE_ACCOUNT_ID");
             const apiToken = yield* getEnvRedacted("CLOUDFLARE_API_TOKEN");
             if (apiToken) {
@@ -664,6 +664,8 @@ export const ALL_SCOPES = {
     "See and change Cloudflare Workers KV Storage data such as keys and namespaces",
   "workers_observability:read":
     "Grants read access to Cloudflare Workers Observability",
+  "workers_observability:write":
+    "Grants read and write access to Cloudflare Workers Observability",
   "workers_observability_telemetry:write":
     "Grants write access to Cloudflare Workers Observability Telemetry API",
   "workers_routes:write":
@@ -694,6 +696,7 @@ export const DEFAULT_SCOPES = [
   "vectorize:write",
   "workers_kv:write",
   "workers_observability:read",
+  "workers_observability:write",
   "workers_observability_telemetry:write",
   "workers_routes:write",
   "workers_scripts:write",

package/src/Cloudflare/Browser/BrowserBinding.ts

@@ -8,6 +8,7 @@ import type { ResourceLike } from "../../Resource.ts";
 import type { RuntimeContext } from "../../RuntimeContext.ts";
 import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
 import type { Browser as BrowserLike } from "./Browser.ts";
+import type { Providers } from "../Providers.ts";
 
 export class BrowserError extends Data.TaggedError("BrowserError")<{
   message: string;
@@ -182,7 +183,8 @@ export const BrowserBindingLive = Layer.effect(
 
 export class BrowserBindingPolicy extends Binding.Policy<
   BrowserBindingPolicy,
-  (browser: BrowserLike) => Effect.Effect<void>
+  (browser: BrowserLike) => Effect.Effect<void>,
+  Providers
 >()("Cloudflare.Browser.Binding") {}
 
 export const BrowserBindingPolicyLive = BrowserBindingPolicy.layer.succeed(

package/src/Cloudflare/Cache/RegionalTieredCache.ts

@@ -1,6 +1,7 @@
 import * as cache from "@distilled.cloud/cloudflare/cache";
 import * as Effect from "effect/Effect";
 import * as Predicate from "effect/Predicate";
+import * as Schedule from "effect/Schedule";
 
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
@@ -114,6 +115,14 @@ export const isRegionalTieredCache = (
 const desiredValue = (props: RegionalTieredCacheProps): "on" | "off" =>
   (props.enabled ?? true) ? "on" : "off";
 
+// Cloudflare can transiently fail to authenticate a valid token, surfacing as
+// `Unauthorized`/`Forbidden`. Retry with exponential backoff capped at 5s,
+// bounded to ~8 attempts so a persistently-failing call still fails fast.
+const transientAuthRetrySchedule = Schedule.exponential("500 millis").pipe(
+  Schedule.either(Schedule.spaced("5 seconds")),
+  Schedule.both(Schedule.recurs(8)),
+);
+
 export const RegionalTieredCacheProvider = () =>
   Provider.succeed(RegionalTieredCache, {
     stables: ["zoneId", "initialValue"],
@@ -129,6 +138,15 @@ export const RegionalTieredCacheProvider = () =>
         allZones.map((zone) => zone.id),
         (zoneId) =>
           cache.getRegionalTieredCache({ zoneId }).pipe(
+            // Cloudflare intermittently rejects a *valid* token with
+            // `Unauthorized`/`Forbidden` (a transient edge auth failure).
+            // Retry with capped backoff rather than dropping the zone, so a
+            // genuinely accessible zone never falls out of the enumeration on
+            // a blip.
+            Effect.retry({
+              while: (e) => e._tag === "Unauthorized" || e._tag === "Forbidden",
+              schedule: transientAuthRetrySchedule,
+            }),
             Effect.map((observed) =>
               toAttributes(zoneId, observed, observed.value),
             ),

package/src/Cloudflare/ClientCertificate/ClientCertificate.ts

@@ -220,7 +220,7 @@ export const ClientCertificateProvider = () =>
               Effect.map((chunk) =>
                 Array.from(chunk).flatMap((page) =>
                   (page.result ?? [])
-                    .filter((cert) => cert.status !== "revoked")
+                    .filter((cert) => !isGone(cert.status))
                     .map(
                       (cert): ClientCertificateAttributes =>
                         toAttributes(cert, zone.id),
@@ -261,15 +261,15 @@ export const ClientCertificateProvider = () =>
       const zoneId = output?.zoneId ?? (olds?.zoneId as string | undefined);
       if (zoneId === undefined) return undefined;
 
-      // Owned path: refresh by our persisted certificate id. A revoked
-      // certificate stays listed on the zone forever — revocation is the
-      // delete semantic, so report it as gone.
+      // Owned path: refresh by our persisted certificate id. A revoked (or
+      // asynchronously revoking) certificate stays listed on the zone forever
+      // — revocation is the delete semantic, so report it as gone.
       if (output?.clientCertificateId) {
         const observed = yield* getCertificate(
           zoneId,
           output.clientCertificateId,
         );
-        if (observed && observed.status !== "revoked") {
+        if (observed && !isGone(observed.status)) {
           return toAttributes(observed, zoneId);
         }
         return undefined;
@@ -298,7 +298,7 @@ export const ClientCertificateProvider = () =>
       let observed = output?.clientCertificateId
         ? yield* getCertificate(zoneId, output.clientCertificateId)
         : undefined;
-      if (observed?.status === "revoked") observed = undefined;
+      if (observed && isGone(observed.status)) observed = undefined;
 
       // 2. Fall back to scanning the zone for a non-revoked certificate
       //    issued from the same CSR with the same validity. Matching on
@@ -336,11 +336,7 @@ export const ClientCertificateProvider = () =>
         output.zoneId,
         output.clientCertificateId,
       );
-      if (
-        !observed ||
-        observed.status === "revoked" ||
-        observed.status === "pending_revocation"
-      ) {
+      if (!observed || isGone(observed.status)) {
         return;
       }
       yield* clientCertificates
@@ -390,7 +386,7 @@ const findByCsr = (zoneId: string, csr: string, validityDays: number) =>
     .pipe(
       Stream.filter(
         (cert) =>
-          cert.status !== "revoked" &&
+          !isGone(cert.status) &&
           cert.validityDays === validityDays &&
           typeof cert.csr === "string" &&
           normalizePem(cert.csr) === normalizePem(csr),
@@ -400,6 +396,17 @@ const findByCsr = (zoneId: string, csr: string, validityDays: number) =>
       Effect.map((cert): ObservedCertificate | undefined => cert),
     );
 
+/**
+ * A certificate is "gone" once it is `revoked` or asynchronously transitioning
+ * to it (`pending_revocation`). Revocation is the delete semantic, and a
+ * revoking certificate can no longer serve mTLS — so it must never be adopted,
+ * reused, listed, or treated as live. Without this, a prior run's async revoke
+ * leaves a `pending_revocation` certificate that a fresh deploy would otherwise
+ * mistake for an existing live certificate matching the CSR.
+ */
+const isGone = (status: string | null | undefined): boolean =>
+  status === "revoked" || status === "pending_revocation";
+
 /** Normalize PEM content for comparison (CRLF + trailing-newline noise). */
 const normalizePem = (pem: string | undefined): string | undefined =>
   pem?.replace(/\r\n/g, "\n").trim();

package/src/Cloudflare/CloudflareEnvironment.ts

@@ -14,7 +14,9 @@ import {
 export class CloudflareEnvironment extends Context.Service<
   CloudflareEnvironment,
   Effect.Effect<CloudflareResolvedCredentials>
->()("Cloudflare::CloudflareEnvironment") {}
+>()("Cloudflare::CloudflareEnvironment") {
+  readonly kind = "Environment" as const;
+}
 
 const CLOUDFLARE_ACCOUNT_ID = Config.string("CLOUDFLARE_ACCOUNT_ID");