alchemy 2.0.0-beta.60 → 2.0.0-beta.62

package/src/Cloudflare/AI/ProviderKey.ts

@@ -0,0 +1,161 @@
+import * as Effect from "effect/Effect";
+import type * as Redacted from "effect/Redacted";
+import type { InputProps } from "../../Input.ts";
+import * as Namespace from "../../Namespace.ts";
+import * as Output from "../../Output.ts";
+import { Secret } from "../SecretsStore/Secret.ts";
+import { GatewayProvider } from "./GatewayProvider.ts";
+
+export interface ProviderKeyProps {
+  /**
+   * The AI Gateway the provider key belongs to. The gateway must have its
+   * `storeId` set to a Secrets Store id — Cloudflare resolves the key inside
+   * that store. Changing the gateway triggers a replacement.
+   */
+  gatewayId: string;
+  /**
+   * The upstream provider the key authenticates against (e.g. `openai`,
+   * `anthropic`, `workers-ai`). Changing the provider triggers a
+   * replacement.
+   */
+  providerSlug: string;
+  /**
+   * The Secrets Store attached to the AI Gateway via `storeId`.
+   */
+  store: {
+    storeId: string;
+    accountId: string;
+  };
+  /**
+   * The provider API key. Stored in Cloudflare Secrets Store and never bound
+   * into the Worker runtime.
+   */
+  value: Redacted.Redacted<string>;
+  /**
+   * Alias distinguishing multiple keys for the same provider. Changing the
+   * alias renames the backing secret, replacing it and the provider config.
+   * @default "default"
+   */
+  alias?: string;
+  /**
+   * Optional free-form description on the Secrets Store secret.
+   */
+  comment?: string;
+  /**
+   * Whether this key is the gateway's default credential for the provider
+   * (used when a request does not name a specific key).
+   * @default false
+   */
+  defaultConfig?: boolean;
+  /**
+   * Maximum number of requests allowed per `rateLimitPeriod` through this
+   * key. Omit for no limit. Changing the limit triggers a replacement
+   * (Cloudflare exposes no update API for provider configs).
+   */
+  rateLimit?: number;
+  /**
+   * The rate limit window in seconds.
+   * @default 60
+   */
+  rateLimitPeriod?: number;
+}
+
+export type ProviderKey = {
+  /**
+   * The Secrets Store secret holding the provider API key, named
+   * `{gatewayId}_{providerSlug}_{alias}` and scoped to `ai_gateway`.
+   */
+  readonly secret: Secret;
+  /**
+   * The gateway's BYOK provider config referencing {@link secret}.
+   */
+  readonly gatewayProvider: GatewayProvider;
+};
+
+/**
+ * Declares a Cloudflare AI Gateway BYOK provider key.
+ *
+ * Cloudflare requires BYOK secrets to live in the gateway's attached Secrets
+ * Store, be scoped to `ai_gateway`, and use the exact
+ * `{gatewayId}_{providerSlug}_{alias}` name. This helper keeps that naming
+ * contract with the {@link GatewayProvider} declaration so app stacks do not
+ * have to wire the secret and provider config manually.
+ *
+ * The children are namespaced under the given id: a {@link Secret} (child
+ * `Secret`) holding the key, and a {@link GatewayProvider} (child `Provider`)
+ * referencing it. It returns `{ secret, gatewayProvider }` so either
+ * underlying resource stays addressable.
+ *
+ * Rotating `value` updates the secret in place. Changing `alias` (or
+ * `providerSlug`) renames the secret — a replacement — and cascades: the
+ * provider config is replaced and re-pointed at the new secret.
+ *
+ * @resource
+ * @product AI Gateway
+ * @category AI
+ * @section Bringing your own key
+ * @example Bring your own OpenAI key
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore.Store("Store");
+ *
+ * const gateway = yield* Cloudflare.AI.Gateway("Gateway", {
+ *   id: "my-gateway",
+ *   storeId: store.storeId,
+ * });
+ *
+ * const { secret, gatewayProvider } = yield* Cloudflare.AI.ProviderKey("OpenAiKey", {
+ *   store,
+ *   gatewayId: gateway.gatewayId,
+ *   providerSlug: "openai",
+ *   value: yield* Config.redacted("OPENAI_API_KEY"),
+ * });
+ * ```
+ *
+ * @example Multiple keys for one provider
+ * Distinguish keys for the same provider with an `alias` — each alias gets
+ * its own secret and provider config.
+ * ```typescript
+ * const production = yield* Cloudflare.AI.ProviderKey("OpenAiKey", {
+ *   store,
+ *   gatewayId: gateway.gatewayId,
+ *   providerSlug: "openai",
+ *   value: yield* Config.redacted("OPENAI_API_KEY"),
+ * });
+ *
+ * const evals = yield* Cloudflare.AI.ProviderKey("OpenAiEvalsKey", {
+ *   store,
+ *   gatewayId: gateway.gatewayId,
+ *   providerSlug: "openai",
+ *   alias: "evals",
+ *   value: yield* Config.redacted("OPENAI_EVALS_API_KEY"),
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/ai-gateway/configuration/bring-your-own-keys/
+ */
+export const ProviderKey = (id: string, props: InputProps<ProviderKeyProps>) =>
+  Effect.gen(function* () {
+    const alias = props.alias ?? "default";
+    const secret = yield* Secret("Secret", {
+      store: props.store,
+      name: Output.interpolate`${props.gatewayId}_${props.providerSlug}_${alias}`,
+      value: props.value,
+      scopes: ["ai_gateway"],
+      comment: props.comment,
+    });
+
+    const gatewayProvider = yield* GatewayProvider("Provider", {
+      gatewayId: props.gatewayId,
+      providerSlug: props.providerSlug,
+      alias,
+      secretId: secret.secretId,
+      defaultConfig: props.defaultConfig,
+      rateLimit: props.rateLimit,
+      rateLimitPeriod: props.rateLimitPeriod,
+    });
+
+    return {
+      secret,
+      gatewayProvider,
+    } satisfies ProviderKey;
+  }).pipe(Namespace.push(id));

package/src/Cloudflare/AI/SearchInstance.ts

@@ -1,13 +1,12 @@
 import * as aisearch from "@distilled.cloud/cloudflare/aisearch";
 import * as Effect from "effect/Effect";
-import * as Predicate from "effect/Predicate";
 import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 
 import { deepEqual, isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
-import { Resource } from "../../Resource.ts";
+import { isResourceOfType, Resource } from "../../Resource.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Providers } from "../Providers.ts";
 
@@ -557,13 +556,15 @@ export type SearchInstance = Resource<
  *
  * @see https://developers.cloudflare.com/ai-search/
  */
-export const SearchInstance = Resource<SearchInstance>(TypeId);
+export const SearchInstance = Resource<SearchInstance>(TypeId, {
+  aliases: ["Cloudflare.AiSearch.Instance"],
+});
 
 /**
  * Returns true if the given value is a SearchInstance resource.
  */
 export const isSearchInstance = (value: unknown): value is SearchInstance =>
-  Predicate.hasProperty(value, "Type") && value.Type === TypeId;
+  isResourceOfType(value, TypeId);
 
 export const SearchInstanceProvider = () =>
   Provider.succeed(SearchInstance, {
@@ -834,9 +835,10 @@ const retryTokenPropagation = <A, E extends { _tag: string }, R>(
       // sparsely and detects a settled token tens of seconds late. Capped
       // polling detects within 6s of propagation completing while still
       // covering a long total window.
-      schedule: Schedule.exponential("1 second", 1.5).pipe(
-        Schedule.either(Schedule.spaced("6 seconds")),
-      ),
+      schedule: Schedule.min([
+        Schedule.exponential("1 second", 1.5),
+        Schedule.spaced("6 seconds"),
+      ]),
       times: 22,
     }),
   );

package/src/Cloudflare/AI/SearchNamespace.ts

@@ -1,12 +1,11 @@
 import * as aisearch from "@distilled.cloud/cloudflare/aisearch";
 import * as Effect from "effect/Effect";
-import * as Predicate from "effect/Predicate";
 import * as Stream from "effect/Stream";
 
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
-import { Resource } from "../../Resource.ts";
+import { isResourceOfType, Resource } from "../../Resource.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Providers } from "../Providers.ts";
 
@@ -176,13 +175,15 @@ export type SearchNamespace = Resource<
  *
  * @see https://developers.cloudflare.com/ai-search/
  */
-export const SearchNamespace = Resource<SearchNamespace>(TypeId);
+export const SearchNamespace = Resource<SearchNamespace>(TypeId, {
+  aliases: ["Cloudflare.AiSearch.Namespace"],
+});
 
 /**
  * Returns true if the given value is a SearchNamespace resource.
  */
 export const isSearchNamespace = (value: unknown): value is SearchNamespace =>
-  Predicate.hasProperty(value, "Type") && value.Type === TypeId;
+  isResourceOfType(value, TypeId);
 
 export const SearchNamespaceProvider = () =>
   Provider.succeed(SearchNamespace, {

package/src/Cloudflare/AI/SearchToken.ts

@@ -139,7 +139,9 @@ export type SearchToken = Resource<
  *
  * @see https://developers.cloudflare.com/ai-search/
  */
-export const SearchToken = Resource<SearchToken>(TypeId);
+export const SearchToken = Resource<SearchToken>(TypeId, {
+  aliases: ["Cloudflare.AiSearch.Token"],
+});
 
 /**
  * Returns true if the given value is a SearchToken resource.

package/src/Cloudflare/AI/SecuritySettings.ts

@@ -94,6 +94,9 @@ export type SecuritySettings = Resource<
  */
 export const SecuritySettings = Resource<SecuritySettings>(
   AiSecuritySettingsTypeId,
+  {
+    aliases: ["Cloudflare.AiSecurity.Settings"],
+  },
 );
 
 export const SecuritySettingsProvider = () =>

package/src/Cloudflare/AI/index.ts

@@ -6,6 +6,7 @@ export * from "./Gateway.ts";
 export * from "./GatewayDynamicRouting.ts";
 export * from "./GatewayProvider.ts";
 export * from "./LanguageModel.ts";
+export * from "./ProviderKey.ts";
 export * from "./QueryGateway.ts";
 export * from "./QueryGatewayBinding.ts";
 export * from "./QuerySearch.ts";

package/src/Cloudflare/Access/Application.ts

@@ -292,10 +292,13 @@ const retryTransientAccessError = <A, E extends { _tag: string }, R>(
     Effect.retry({
       while: (e) =>
         e._tag === "AccessReferenceNotFound" || e._tag === "Forbidden",
-      schedule: Schedule.exponential("1 second", 1.5).pipe(
-        Schedule.either(Schedule.spaced("5 seconds")),
-        Schedule.both(Schedule.recurs(12)),
-      ),
+      schedule: Schedule.max([
+        Schedule.min([
+          Schedule.exponential("1 second", 1.5),
+          Schedule.spaced("5 seconds"),
+        ]),
+        Schedule.recurs(12),
+      ]),
     }),
   );
 

package/src/Cloudflare/Access/InfrastructureTarget.ts

@@ -178,7 +178,10 @@ export const InfrastructureTargetProvider = () =>
       // ownership markers, so gate adoption behind Unowned.
       const hostname = olds?.hostname ?? output?.hostname;
       if (!hostname) return undefined;
-      const desiredIp = olds ? resolvedIp(olds.ip) : output?.ip;
+      // `olds.ip` may be `undefined` when a `creating` row was persisted
+      // before upstream Outputs resolved — fall back to the output hint.
+      const desiredIp =
+        olds?.ip !== undefined ? resolvedIp(olds.ip) : output?.ip;
       const match = yield* findByIdentity(acct, hostname, desiredIp);
       if (match) return Unowned(toAttributes(match, acct));
       return undefined;

package/src/Cloudflare/Access/Organization.ts

@@ -188,6 +188,7 @@ export type Organization = Resource<
  */
 export const Organization = Resource<Organization>(
   "Cloudflare.Access.Organization",
+  { aliases: ["Cloudflare.AccessOrganization"] },
 );
 
 export const OrganizationProvider = () =>

package/src/Cloudflare/Access/Policy.ts

@@ -164,7 +164,9 @@ export type Policy = Resource<
  * });
  * ```
  */
-export const Policy = Resource<Policy>("Cloudflare.Access.Policy");
+export const Policy = Resource<Policy>("Cloudflare.Access.Policy", {
+  aliases: ["Cloudflare.AccessPolicy"],
+});
 
 export const PolicyProvider = () =>
   Provider.succeed(Policy, {

package/src/Cloudflare/Account/Account.ts

@@ -145,7 +145,9 @@ export type Account = Resource<
  *
  * @see https://developers.cloudflare.com/tenant/how-to/manage-accounts/
  */
-export const Account = Resource<Account>(TypeId);
+export const Account = Resource<Account>(TypeId, {
+  aliases: ["Cloudflare.Account"],
+});
 
 /**
  * Returns true if the given value is an Account resource.

package/src/Cloudflare/Alerting/Silence.ts

@@ -250,9 +250,10 @@ export const SilenceProvider = () =>
           ),
           Effect.retry({
             while: (e) => e._tag === "SilencePending",
-            schedule: Schedule.exponential("500 millis").pipe(
-              Schedule.both(Schedule.recurs(8)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential("500 millis"),
+              Schedule.recurs(8),
+            ]),
           }),
         );
         return toSilenceAttributes(observed, accountId);

package/src/Cloudflare/Alerting/Webhook.ts

@@ -211,9 +211,10 @@ export const NotificationWebhookProvider = () =>
           .pipe(
             Effect.retry({
               while: (e) => e._tag === "WebhookTestFailed",
-              schedule: Schedule.exponential("1 second").pipe(
-                Schedule.both(Schedule.recurs(5)),
-              ),
+              schedule: Schedule.max([
+                Schedule.exponential("1 second"),
+                Schedule.recurs(5),
+              ]),
             }),
           );
         if (!created.id) {
@@ -247,9 +248,10 @@ export const NotificationWebhookProvider = () =>
           .pipe(
             Effect.retry({
               while: (e) => e._tag === "WebhookTestFailed",
-              schedule: Schedule.exponential("1 second").pipe(
-                Schedule.both(Schedule.recurs(5)),
-              ),
+              schedule: Schedule.max([
+                Schedule.exponential("1 second"),
+                Schedule.recurs(5),
+              ]),
             }),
           );
         const fresh = yield* observeWebhook(accountId, observed.id);

package/src/Cloudflare/ApiToken/AccountApiToken.ts

@@ -116,6 +116,7 @@ export type AccountApiToken = Resource<
  */
 export const AccountApiToken = Resource<AccountApiToken>(
   "Cloudflare.ApiToken.AccountApiToken",
+  { aliases: ["Cloudflare.AccountApiToken"] },
 );
 
 type AccountApiTokenAttributes = AccountApiToken["Attributes"];

package/src/Cloudflare/ApiToken/UserApiToken.ts

@@ -104,6 +104,7 @@ export type UserApiToken = Resource<
  */
 export const UserApiToken = Resource<UserApiToken>(
   "Cloudflare.ApiToken.UserApiToken",
+  { aliases: ["Cloudflare.UserApiToken"] },
 );
 
 type UserApiTokenAttributes = UserApiToken["Attributes"];

package/src/Cloudflare/Auth/AuthProvider.ts

@@ -21,6 +21,7 @@ import {
   retryOnce,
 } from "../../Auth/Env.ts";
 import * as Clank from "../../Util/Clank.ts";
+import { CREDENTIALS_FILE as STATE_STORE_CREDENTIALS_FILE } from "../StateStore/CredentialsFile.ts";
 import * as OAuthClient from "./OAuthClient.ts";
 
 const options: Array<{
@@ -126,6 +127,43 @@ const selectAccount = (accessToken: string) =>
     }).pipe(retryOnce);
   }).pipe((e) => withOAuthCredentials(accessToken, e));
 
+/**
+ * Cloudflare account IDs are 32 lowercase hex characters. Placeholder
+ * values ("", "-", "dummy", …) end up interpolated into API paths and
+ * surface as baffling `InvalidRoute: Could not route to
+ * /accounts/<value>/...` errors, so reject them up front with an
+ * actionable message instead.
+ */
+const ACCOUNT_ID_PATTERN = /^[0-9a-f]{32}$/i;
+
+export const validateAccountId = (
+  accountId: string | undefined,
+  source: string,
+): Effect.Effect<string, AuthError> => {
+  const trimmed = accountId?.trim() ?? "";
+  if (trimmed.length === 0) {
+    return Effect.fail(
+      new AuthError({
+        message:
+          `Cloudflare account ID is missing (${source}). ` +
+          "Set CLOUDFLARE_ACCOUNT_ID or re-run 'alchemy login' and provide your account ID " +
+          "(found in the Cloudflare dashboard under Workers & Pages → Account details).",
+      }),
+    );
+  }
+  if (!ACCOUNT_ID_PATTERN.test(trimmed)) {
+    return Effect.fail(
+      new AuthError({
+        message:
+          `'${trimmed}' is not a valid Cloudflare account ID (${source}) — expected 32 hex characters. ` +
+          "Copy the account ID from the Cloudflare dashboard (Workers & Pages → Account details) " +
+          "into CLOUDFLARE_ACCOUNT_ID or re-run 'alchemy login'.",
+      }),
+    );
+  }
+  return Effect.succeed(trimmed.toLowerCase());
+};
+
 const promptAccountId = () =>
   getEnv("CLOUDFLARE_ACCOUNT_ID").pipe(
     Effect.flatMap((envAccountId) =>
@@ -133,6 +171,10 @@ const promptAccountId = () =>
         message: "Cloudflare Account ID (Enter to skip)",
         placeholder: envAccountId ?? "",
         defaultValue: envAccountId ?? "",
+        validate: (v) =>
+          v.trim().length === 0 || ACCOUNT_ID_PATTERN.test(v.trim())
+            ? undefined
+            : "Expected a 32-character hex account ID (Workers & Pages → Account details)",
       }).pipe(retryOnce),
     ),
   );
@@ -302,10 +344,18 @@ export const CloudflareAuth = AuthProviderLayer<
 
     const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
       Effect.gen(function* () {
-        if (ctx.ci) {
-          return { method: "env" as const };
-        }
-        return yield* configureInteractive(profileName);
+        const config = ctx.ci
+          ? { method: "env" as const }
+          : yield* configureInteractive(profileName);
+        // Re-configuring auth may point this profile at a different
+        // Cloudflare account. The cached state-store credentials
+        // (`~/.alchemy/credentials/{profile}/cloudflare-state-store.json`)
+        // are minted per-account, so drop them here; the next deploy
+        // re-derives them against the freshly-configured account.
+        yield* store
+          .delete(profileName, STATE_STORE_CREDENTIALS_FILE)
+          .pipe(Effect.ignore);
+        return config;
       }).pipe(
         Effect.mapError(
           (e) =>
@@ -324,7 +374,13 @@ export const CloudflareAuth = AuthProviderLayer<
         Match.when(
           { method: "env" },
           Effect.fn(function* () {
-            const accountId = yield* getEnvRequired("CLOUDFLARE_ACCOUNT_ID");
+            const accountId = yield* getEnvRequired(
+              "CLOUDFLARE_ACCOUNT_ID",
+            ).pipe(
+              Effect.flatMap((id) =>
+                validateAccountId(id, "from the CLOUDFLARE_ACCOUNT_ID env var"),
+              ),
+            );
             const apiToken = yield* getEnvRedacted("CLOUDFLARE_API_TOKEN");
             if (apiToken) {
               return {
@@ -363,29 +419,43 @@ export const CloudflareAuth = AuthProviderLayer<
                           "Cloudflare stored credentials not found. Run: alchemy-effect login --configure",
                       }),
                     )
-                  : Effect.succeed(
-                      Match.value(creds).pipe(
+                  : Effect.gen(function* () {
+                      // The account ID prompt is skippable, so stored
+                      // credentials may carry an empty accountId; fall
+                      // back to the env var before validating.
+                      const envAccountId = yield* getEnv(
+                        "CLOUDFLARE_ACCOUNT_ID",
+                      );
+                      const accountId = yield* validateAccountId(
+                        creds.accountId?.trim() || envAccountId,
+                        `stored for profile '${profileName}'`,
+                      );
+                      return Match.value(creds).pipe(
                         Match.when({ type: "apiToken" }, (c) => ({
                           type: "apiToken" as const,
                           apiToken: Redacted.make(c.apiToken),
-                          accountId: c.accountId,
+                          accountId,
                           source: { type: "stored" as const },
                         })),
                         Match.when({ type: "apiKey" }, (c) => ({
                           type: "apiKey" as const,
                           apiKey: Redacted.make(c.apiKey),
                           email: Redacted.make(c.email),
-                          accountId: c.accountId,
+                          accountId,
                           source: { type: "stored" as const },
                         })),
                         Match.exhaustive,
-                      ),
-                    ),
+                      );
+                    }),
               ),
             ),
         ),
         Match.when({ method: "oauth" }, (cfg) =>
           Effect.gen(function* () {
+            const accountId = yield* validateAccountId(
+              cfg.accountId,
+              `configured for profile '${profileName}'`,
+            );
             const creds = yield* store.read<OAuthClient.OAuthCredentials>(
               profileName,
               "cf-oauth",
@@ -421,7 +491,7 @@ export const CloudflareAuth = AuthProviderLayer<
               type: "oauth" as const,
               accessToken: Redacted.make(fresh.access),
               expires: fresh.expires,
-              accountId: cfg.accountId,
+              accountId,
               source: { type: "oauth" as const },
             };
           }),
@@ -430,40 +500,50 @@ export const CloudflareAuth = AuthProviderLayer<
       );
 
     const logout = (profileName: string, config: CloudflareAuthConfig) =>
-      Match.value(config).pipe(
-        Match.when({ method: "env" }, () => Effect.void),
-        Match.when({ method: "stored" }, () =>
-          store
-            .delete(profileName, "cf-stored")
-            .pipe(
-              Effect.andThen(
-                Clank.success("Cloudflare: stored credentials removed"),
+      Match.value(config)
+        .pipe(
+          Match.when({ method: "env" }, () => Effect.void),
+          Match.when({ method: "stored" }, () =>
+            store
+              .delete(profileName, "cf-stored")
+              .pipe(
+                Effect.andThen(
+                  Clank.success("Cloudflare: stored credentials removed"),
+                ),
               ),
-            ),
-        ),
-        Match.when({ method: "oauth" }, () =>
-          store
-            .read<OAuthClient.OAuthCredentials>(profileName, "cf-oauth")
-            .pipe(
-              Effect.tap((creds) =>
-                creds?.type === "oauth"
-                  ? OAuthClient.revoke(creds).pipe(
-                      Effect.catchTag("OAuthError", (err) =>
-                        Clank.warn(
-                          `Cloudflare: could not revoke OAuth token: ${err.errorDescription}`,
+          ),
+          Match.when({ method: "oauth" }, () =>
+            store
+              .read<OAuthClient.OAuthCredentials>(profileName, "cf-oauth")
+              .pipe(
+                Effect.tap((creds) =>
+                  creds?.type === "oauth"
+                    ? OAuthClient.revoke(creds).pipe(
+                        Effect.catchTag("OAuthError", (err) =>
+                          Clank.warn(
+                            `Cloudflare: could not revoke OAuth token: ${err.errorDescription}`,
+                          ),
                         ),
-                      ),
-                    )
-                  : Effect.void,
-              ),
-              Effect.andThen(store.delete(profileName, "cf-oauth")),
-              Effect.andThen(
-                Clank.success("Cloudflare: OAuth credentials removed."),
+                      )
+                    : Effect.void,
+                ),
+                Effect.andThen(store.delete(profileName, "cf-oauth")),
+                Effect.andThen(
+                  Clank.success("Cloudflare: OAuth credentials removed."),
+                ),
               ),
-            ),
-        ),
-        Match.exhaustive,
-      );
+          ),
+          Match.exhaustive,
+        )
+        // The cached state-store credentials are derived from the account we
+        // just logged out of, so drop them regardless of auth method.
+        .pipe(
+          Effect.andThen(
+            store
+              .delete(profileName, STATE_STORE_CREDENTIALS_FILE)
+              .pipe(Effect.ignore),
+          ),
+        );
 
     const login = (profileName: string, config: CloudflareAuthConfig) =>
       Match.value(config)
@@ -558,9 +638,6 @@ export const CloudflareAuth = AuthProviderLayer<
             Match.exhaustive,
           );
         }),
-        Effect.catch((e) =>
-          Console.error(`  Failed to retrieve credentials: ${e}`),
-        ),
       );
 
     return {