alchemy 2.0.0-beta.60 → 2.0.0-beta.61

package/src/Cloudflare/SecretsStore/Secret.ts

@@ -3,11 +3,12 @@ import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import * as Provider from "../../Provider.ts";
-import { Resource } from "../../Resource.ts";
+import { isResourceOfType, Resource } from "../../Resource.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Providers } from "../Providers.ts";
 
@@ -56,8 +57,7 @@ export type Secret = Resource<
 >;
 
 export const isSecret = (value: unknown): value is Secret =>
-  typeof value === "object" &&
-  (value as any)?.Type === "Cloudflare.SecretsStore.Secret";
+  isResourceOfType(value, "Cloudflare.SecretsStore.Secret");
 
 export type SecretStatus = "pending" | "active" | "deleted";
 
@@ -181,12 +181,21 @@ export const StoreSecretProvider = () =>
           );
         if (created) {
           const secret = created.result[0]!;
+          // Freshly created secrets report "pending" until Cloudflare
+          // activates them; a worker deploy that references a pending
+          // secret is rejected with "Secrets Store binding ... which
+          // were not found". Wait (bounded) for activation so
+          // downstream deploys in the same run see an active secret.
+          const status = yield* waitForSecretActive(
+            { accountId, storeId, secretId: secret.id },
+            asSecretStatus(secret.status),
+          );
           return {
             secretId: secret.id,
             secretName: secret.name,
             storeId: secret.storeId,
             accountId,
-            status: asSecretStatus(secret.status),
+            status,
             scopes,
             comment: secret.comment ?? undefined,
           };
@@ -216,12 +225,16 @@ export const StoreSecretProvider = () =>
         comment: news.comment,
         value: Redacted.value(news.value),
       });
+      const status = yield* waitForSecretActive(
+        { accountId, storeId, secretId: observed.id },
+        asSecretStatus(patched.status),
+      );
       return {
         secretId: observed.id,
         secretName: observed.name,
         storeId: observed.storeId,
         accountId,
-        status: asSecretStatus(patched.status),
+        status,
         scopes,
         comment: patched.comment ?? undefined,
       };
@@ -337,6 +350,34 @@ export const StoreSecretProvider = () =>
     }),
   });
 
+/**
+ * Poll a secret until Cloudflare reports it "active" (bounded at
+ * ~10s). Returns the last observed status rather than failing on
+ * timeout — consumers that bind the secret retry the
+ * `SecretsStoreBindingNotFound` deploy rejection themselves, so a
+ * slow activation degrades to a retried deploy instead of a hard
+ * error here.
+ */
+const waitForSecretActive = (
+  key: { accountId: string; storeId: string; secretId: string },
+  initialStatus: SecretStatus,
+) =>
+  initialStatus === "active"
+    ? Effect.succeed<SecretStatus>("active")
+    : secretsStore.getStoreSecret(key).pipe(
+        Effect.map((s) => asSecretStatus(s.status)),
+        Effect.repeat({
+          schedule: Schedule.spaced("500 millis"),
+          until: (status) => status === "active",
+          times: 20,
+        }),
+        // The secret was observed moments ago; a NotFound here is a
+        // read-replica lag blip, not a deletion. Report the last known
+        // status and let the deploy-side retry take over.
+        Effect.catchTag("SecretNotFound", () => Effect.succeed(initialStatus)),
+        Effect.catchTag("StoreNotFound", () => Effect.succeed(initialStatus)),
+      );
+
 const resolveScopes = (scopes: string[] | undefined): string[] =>
   scopes && scopes.length > 0 ? scopes : ["workers"];
 

package/src/Cloudflare/SecurityTxt/SecurityTxt.ts

@@ -150,7 +150,9 @@ export type SecurityTxt = Resource<TypeId, Props, Attributes, never, Providers>;
  *
  * @see https://developers.cloudflare.com/security-center/infrastructure/security-file/
  */
-export const SecurityTxt = Resource<SecurityTxt>(TypeId);
+export const SecurityTxt = Resource<SecurityTxt>(TypeId, {
+  aliases: ["Cloudflare.SecurityTxt"],
+});
 
 /**
  * Returns true if the given value is a SecurityTxt resource.

package/src/Cloudflare/StateStore/State.ts

@@ -15,11 +15,8 @@ import { isHttpClientError } from "effect/unstable/http/HttpClientError";
 import { adopt } from "../../AdoptPolicy.ts";
 import { AlchemyContext } from "../../AlchemyContext.ts";
 import { AuthError } from "../../Auth/AuthProvider.ts";
-import {
-  CredentialsStore,
-  CredentialsStoreLive,
-} from "../../Auth/Credentials.ts";
-import { ALCHEMY_PROFILE, ProfileLive } from "../../Auth/Profile.ts";
+import { CredentialsStore } from "../../Auth/Credentials.ts";
+import { ALCHEMY_PROFILE } from "../../Auth/Profile.ts";
 import * as Cloudflare from "../../Cloudflare/Providers.ts";
 import { deploy } from "../../Deploy.ts";
 import * as Output from "../../Output.ts";
@@ -39,9 +36,7 @@ import {
 } from "../../Telemetry/Metrics.ts";
 import * as Clank from "../../Util/Clank.ts";
 import * as Access from "../Access.ts";
-import { CloudflareAuth } from "../Auth/AuthProvider.ts";
 import * as CloudflareEnvironment from "../CloudflareEnvironment.ts";
-import * as Credentials from "../Credentials.ts";
 import { EdgeSessionError, createEdgeSession } from "../EdgeSession.ts";
 import Api, { STATE_STORE_SCRIPT_NAME, STATE_STORE_VERSION } from "./Api.ts";
 import {
@@ -217,12 +212,14 @@ export const state = () =>
       return yield* Effect.cached(init.pipe(Effect.provideContext(context)));
     }),
   ).pipe(
-    Layer.provideMerge(Credentials.fromAuthProvider()),
-    Layer.provideMerge(CloudflareEnvironment.fromProfile()),
-    Layer.provideMerge(CloudflareAuth),
-    Layer.provideMerge(Access.AccessLive),
-    Layer.provideMerge(ProfileLive),
-    Layer.provideMerge(CredentialsStoreLive),
+    // The Cloudflare API foundation shared with `providers()` —
+    // credentials, environment, auth/access, profile + credential
+    // store, and the same blanket retry policy. Without the retry
+    // policy the init-time subdomain/script/secrets probes run on the
+    // SDK default and give up early under Cloudflare rate limiting.
+    // `provide` (not `provideMerge`) so the distilled Retry tag stays
+    // out of this layer's public type.
+    Layer.provide(Cloudflare.CloudflareApiLive()),
     Layer.orDie,
   );
 
@@ -578,6 +575,34 @@ const deployWithLocalState = ({
     }),
   );
 
+/**
+ * Writes against a *just-deployed* state-store worker can fail
+ * transiently while Cloudflare propagates the script, its route, and
+ * its Secrets Store bindings to the edge:
+ *
+ * - 404 — the workers.dev route isn't serving the new script yet
+ * - 401 — the worker is up but its auth-token secret binding hasn't
+ *   propagated, so token validation reads a stale/absent value
+ * - 5xx — the Store DO dies while its encryption-key secret binding
+ *   is still propagating
+ * - transport errors (no response) — cold workers.dev host blips
+ *
+ * @internal exported for unit testing.
+ */
+export const isTransientBootstrapWriteError = (error: {
+  cause?: unknown;
+}): boolean => {
+  const cause = error.cause;
+  if (cause == null) return false;
+  const tag = (cause as { _tag?: unknown })._tag;
+  if (typeof tag === "string" && tag.startsWith("Unauthorized")) return true;
+  if (isHttpClientError(cause)) {
+    const status = cause.response?.status;
+    return status === undefined || status === 404 || status >= 500;
+  }
+  return false;
+};
+
 // check if there's a local stack that wasn't properly hoisted
 const hasLocalStack = (stage: string) =>
   Effect.gen(function* () {
@@ -637,11 +662,14 @@ const hoistBootstrapStack = Effect.fn(function* ({
           })
           .pipe(
             Effect.retry({
-              while: (error) =>
-                isHttpClientError(error.cause) &&
-                // worker can 404 for a bit on first deploy, retry these
-                error.cause.response?.status === 404,
-              schedule: Schedule.fixed(200),
+              while: isTransientBootstrapWriteError,
+              // Bounded at ~30s: the freshly deployed worker (and its
+              // Secrets Store bindings) can take a while to serve
+              // consistently; anything persisting past that is a real
+              // failure to surface, not to spin on.
+              schedule: Schedule.fixed(500).pipe(
+                Schedule.both(Schedule.recurs(60)),
+              ),
             }),
           );
       }
@@ -703,8 +731,13 @@ export const loginWithCloudflare = (profileName: string, force: boolean) =>
       AuthTokenSecretName,
     ).pipe(
       Effect.retry({
-        while: isWorkersPreviewConfigurationError,
+        while: (error) =>
+          isWorkersPreviewConfigurationError(error) ||
+          isTransientEdgeSessionError(error),
+        // Cap the exponential delay at 2s so 15 retries stay within
+        // ~30s instead of doubling unboundedly.
         schedule: Schedule.exponential(200).pipe(
+          Schedule.either(Schedule.spaced("2 seconds")),
           Schedule.both(Schedule.recurs(15)),
         ),
       }),
@@ -768,6 +801,10 @@ const isStateStoreAvailable = (scriptName: string = "alchemy-state-store") =>
       Effect.map((setting) => setting !== undefined),
       Effect.catchTag("WorkerNotFound", () => Effect.succeed(false)),
       Effect.catchTag("InvalidRoute", () => Effect.succeed(false)),
+      // A worker that exists but has no versions (a previous deploy was
+      // interrupted before any content upload) can't serve — treat it
+      // as absent so bootstrap redeploys it.
+      Effect.catchTag("WorkerHasNoVersions", () => Effect.succeed(false)),
     );
   });
 
@@ -831,11 +868,11 @@ const waitForStateStoreVersion = (url: string) =>
   }).pipe(
     Effect.retry({
       while: (error) => error instanceof StateStoreVersionNotReady,
-      // Edge propagation is usually sub-second; poll fast and cap the
-      // overall wait at ~10s so we fail loudly if something is really
-      // wrong rather than silently hanging.
-      schedule: Schedule.spaced("200 millis").pipe(
-        Schedule.both(Schedule.recurs(50)),
+      // Edge propagation is usually sub-second but production traces
+      // show redeploys occasionally serving the old version for well
+      // over 10s. Poll for ~30s before failing loudly.
+      schedule: Schedule.spaced("500 millis").pipe(
+        Schedule.both(Schedule.recurs(60)),
       ),
     }),
     Effect.withSpan("state_store.wait_for_version", {
@@ -1000,6 +1037,34 @@ const isWorkersPreviewConfigurationError = (error: unknown) =>
   (error.message.includes("Invalid Workers Preview configuration") ||
     error.message.includes("Error 1031"));
 
+/**
+ * Edge-preview reads are flaky in ways that clear up on their own:
+ * the workers.dev edge can serve a generic Cloudflare 400/502 HTML
+ * page while preview routing propagates ("Secret probe returned
+ * ..."), the session-create call can hit transient API blips, and the
+ * probe fetch can fail at the transport level ("fetch failed").
+ * Retry everything except causes that are clearly permanent
+ * (bad credentials, invalid routes).
+ *
+ * @internal exported for unit testing.
+ */
+export const isTransientEdgeSessionError = (error: unknown): boolean => {
+  if (!(error instanceof EdgeSessionError)) return false;
+  // Non-200 probe responses are edge-propagation flakes, not client bugs.
+  if (error.message.startsWith("Secret probe returned")) return true;
+  const tag = (error.cause as { _tag?: unknown } | undefined)?._tag;
+  if (
+    typeof tag === "string" &&
+    (tag.startsWith("Unauthorized") ||
+      tag === "Forbidden" ||
+      tag === "InvalidRoute" ||
+      tag === "AuthError")
+  ) {
+    return false;
+  }
+  return true;
+};
+
 /**
  * SHA-256 hex digest of the Cloudflare account ID. Used as a stable
  * pseudonymous identifier on telemetry spans so the dashboard can

package/src/Cloudflare/Tags/AccountResourceTags.ts

@@ -4,6 +4,7 @@ import * as Predicate from "effect/Predicate";
 import * as Stream from "effect/Stream";
 
 import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
 import type { Input } from "../../Input.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
@@ -208,11 +209,14 @@ export const AccountResourceTagsProvider = () =>
     read: Effect.fn(function* ({ output, olds }) {
       const { accountId } = yield* yield* CloudflareEnvironment;
       const acct = output?.accountId ?? accountId;
-      const resourceId =
-        output?.resourceId ?? (olds?.resourceId as string | undefined);
-      const resourceType = output?.resourceType ?? olds?.resourceType;
-      const workerId =
-        output?.workerId ?? (olds?.workerId as string | undefined);
+      // At plan time `olds` may still hold unresolved Output proxies (e.g.
+      // an adoption pre-check before the referenced resource deploys) —
+      // only fall back to them once resolved.
+      const resolvedOlds =
+        olds !== undefined && isResolved(olds) ? olds : undefined;
+      const resourceId = output?.resourceId ?? resolvedOlds?.resourceId;
+      const resourceType = output?.resourceType ?? resolvedOlds?.resourceType;
+      const workerId = output?.workerId ?? resolvedOlds?.workerId;
       if (!resourceId || !resourceType) return undefined;
 
       const observed = yield* resourceTagging.getAccountTag({

package/src/Cloudflare/Tunnel/Route.ts

@@ -114,7 +114,9 @@ export type Route = Resource<
  * });
  * ```
  */
-export const Route = Resource<Route>("Cloudflare.Tunnel.Route");
+export const Route = Resource<Route>("Cloudflare.Tunnel.Route", {
+  aliases: ["Cloudflare.TunnelRoute"],
+});
 
 export const RouteProvider = () =>
   Provider.succeed(Route, {

package/src/Cloudflare/Tunnel/Tunnel.ts

@@ -150,7 +150,9 @@ export type Tunnel = Resource<
  * };
  * ```
  */
-export const Tunnel = Resource<Tunnel>("Cloudflare.Tunnel.Tunnel");
+export const Tunnel = Resource<Tunnel>("Cloudflare.Tunnel.Tunnel", {
+  aliases: ["Cloudflare.Tunnel"],
+});
 
 export const TunnelProvider = () =>
   Provider.succeed(Tunnel, {

package/src/Cloudflare/UrlNormalization/UrlNormalization.ts

@@ -119,7 +119,9 @@ export type UrlNormalization = Resource<
  *
  * @see https://developers.cloudflare.com/rules/normalization/
  */
-export const UrlNormalization = Resource<UrlNormalization>(TypeId);
+export const UrlNormalization = Resource<UrlNormalization>(TypeId, {
+  aliases: ["Cloudflare.UrlNormalization"],
+});
 
 /**
  * Returns true if the given value is a UrlNormalization resource.

package/src/Cloudflare/Vectorize/VectorizeIndex.ts

@@ -1,12 +1,11 @@
 import * as vectorize from "@distilled.cloud/cloudflare/vectorize";
 import * as Effect from "effect/Effect";
-import * as Predicate from "effect/Predicate";
 import * as Stream from "effect/Stream";
 
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
-import { Resource } from "../../Resource.ts";
+import { isResourceOfType, Resource } from "../../Resource.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Providers } from "../Providers.ts";
 
@@ -137,7 +136,7 @@ export const Index = Resource<Index>(TypeId);
  * Returns true if the given value is a Vectorize Index resource.
  */
 export const isIndex = (value: unknown): value is Index =>
-  Predicate.hasProperty(value, "Type") && value.Type === TypeId;
+  isResourceOfType(value, TypeId);
 
 export const IndexProvider = () =>
   Provider.succeed(Index, {

package/src/Cloudflare/VpcService/VpcService.ts

@@ -122,6 +122,7 @@ export type VpcService = Resource<
  */
 export const VpcService = Resource<VpcService>(
   "Cloudflare.VpcService.VpcService",
+  { aliases: ["Cloudflare.VpcService"] },
 );
 
 const createServiceName = (id: string, name: string | undefined) =>

package/src/Cloudflare/WaitingRoom/WaitingRoom.ts

@@ -290,7 +290,9 @@ export type WaitingRoom = Resource<TypeId, Props, Attributes, never, Providers>;
  *
  * @see https://developers.cloudflare.com/waiting-room/
  */
-export const WaitingRoom = Resource<WaitingRoom>(TypeId);
+export const WaitingRoom = Resource<WaitingRoom>(TypeId, {
+  aliases: ["Cloudflare.WaitingRoom"],
+});
 
 /**
  * Returns true if the given value is a WaitingRoom resource.

package/src/Cloudflare/Web3/ContentList.ts

@@ -136,7 +136,9 @@ export type HostnameContentList = Resource<
  *
  * @see https://developers.cloudflare.com/web3/
  */
-export const HostnameContentList = Resource<HostnameContentList>(TypeId);
+export const HostnameContentList = Resource<HostnameContentList>(TypeId, {
+  aliases: ["Cloudflare.Web3HostnameContentList"],
+});
 
 /**
  * Returns true if the given value is a HostnameContentList resource.

package/src/Cloudflare/Web3/Hostname.ts

@@ -143,7 +143,9 @@ export type Hostname = Resource<
  *
  * @see https://developers.cloudflare.com/web3/
  */
-export const Hostname = Resource<Hostname>(TypeId);
+export const Hostname = Resource<Hostname>(TypeId, {
+  aliases: ["Cloudflare.Web3Hostname"],
+});
 
 /**
  * Returns true if the given value is a Hostname resource.

package/src/Cloudflare/Workers/Cache.ts

@@ -0,0 +1,102 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as Effect from "effect/Effect";
+import * as Namespace from "../../Namespace.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import {
+  Worker,
+  WorkerExecutionContext,
+  type CachePurgeError,
+} from "./Worker.ts";
+
+export interface CacheOptions {
+  /**
+   * Whether Workers Cache checks the cache before invoking the Worker.
+   * @default true
+   */
+  enabled?: boolean;
+  /**
+   * Share cached responses across Worker versions. By default the cache is
+   * scoped to a single version, so every deploy starts cold.
+   * @default false
+   */
+  crossVersionCache?: boolean;
+}
+
+/**
+ * Runtime client for Workers Cache, returned by `yield* Cloudflare.cache()`.
+ */
+export interface CacheClient {
+  /**
+   * Purge cached responses by `Cache-Tag`, path prefix, or everything.
+   */
+  purge(
+    options: cf.CachePurgeOptions,
+  ): Effect.Effect<cf.CachePurgeResult, CachePurgeError, RuntimeContext>;
+}
+
+/**
+ * Enable [Workers Cache](https://blog.cloudflare.com/workers-cache/) on the
+ * surrounding Worker and get the runtime cache client.
+ *
+ * Yielding `cache()` in an Effect-native Worker's init phase turns the cache
+ * on at deploy time (the equivalent of setting `cache: { enabled: true }` on
+ * the Worker's props) and returns a client whose `purge` drives the runtime
+ * `ctx.cache` API from your handlers.
+ *
+ * What gets cached is controlled by standard response headers —
+ * `Cache-Control` (including `stale-while-revalidate`), `Cache-Tag` for
+ * tag-based purging, and `Vary` for content negotiation.
+ *
+ * For async (non-Effect) Workers, set the `cache` prop on the Worker
+ * instead.
+ *
+ * @binding
+ * @product Workers
+ * @category Workers & Compute
+ * @example
+ * ```typescript
+ * Effect.gen(function* () {
+ *   // init: enable Workers Cache on this Worker
+ *   const { purge } = yield* Cloudflare.cache();
+ *
+ *   return {
+ *     fetch: Effect.gen(function* () {
+ *       const request = yield* HttpServerRequest;
+ *       if (request.url.startsWith("/invalidate")) {
+ *         yield* purge({ tags: ["products"] });
+ *         return HttpServerResponse.text("purged");
+ *       }
+ *       return HttpServerResponse.text("hello", {
+ *         headers: {
+ *           "Cache-Control": "public, max-age=300",
+ *           "Cache-Tag": "products",
+ *         },
+ *       });
+ *     }),
+ *   };
+ * })
+ * ```
+ */
+export const cache = (
+  options?: CacheOptions,
+): Effect.Effect<CacheClient, never, Worker | WorkerExecutionContext> =>
+  Effect.gen(function* () {
+    const host = yield* Worker;
+    const exec = yield* WorkerExecutionContext;
+    if (!globalThis.__ALCHEMY_RUNTIME__) {
+      yield* Namespace.push(
+        host.LogicalId,
+        host.bind("Cache", {
+          cache: {
+            enabled: options?.enabled ?? true,
+            crossVersionCache: options?.crossVersionCache,
+          },
+        }),
+      );
+    }
+    return {
+      // `exec` is the init-phase deferred context; purge resolves the live
+      // per-event context from the calling handler's fiber.
+      purge: (purgeOptions) => exec.cache.purge(purgeOptions),
+    };
+  });