alchemy 2.0.0-beta.61 → 2.0.0-beta.63

package/src/Cloudflare/Images/Variant.ts

@@ -322,9 +322,10 @@ export const VariantProvider = () =>
       // Bounded — if it never clears we stop polling and proceed.
       yield* getVariant(output.accountId, output.variantName).pipe(
         Effect.repeat({
-          schedule: Schedule.exponential("500 millis").pipe(
-            Schedule.both(Schedule.recurs(12)),
-          ),
+          schedule: Schedule.max([
+            Schedule.exponential("500 millis"),
+            Schedule.recurs(12),
+          ]),
           until: (observed) => observed === undefined,
         }),
       );

package/src/Cloudflare/KV/NamespaceHttp.ts

@@ -1,9 +1,13 @@
 import * as Effect from "effect/Effect";
 import type * as Redacted from "effect/Redacted";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
 import { Self } from "../../Self.ts";
 import { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
 import type { PermissionGroupRef } from "../ApiToken/Common.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
+import { authorizeWith } from "../HttpClientUtils.ts";
 import type { Namespace } from "./Namespace.ts";
 import { NamespaceError } from "./NamespaceTypes.ts";
 
@@ -58,6 +62,25 @@ export interface HttpScope {
   namespaceId: string;
 }
 
+/**
+ * Injectable auth for the KV HTTP client builders. Both the scoped-token
+ * (`*Http`) and current-credentials (`*Local`) variants supply an `authorize`
+ * (which provides `Credentials` + `HttpClient` to a raw SDK op) and an
+ * `accountId`, so the client builders are agnostic to how creds are obtained.
+ */
+export interface KVAuth {
+  authorize: <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+  ) => Effect.Effect<A, E, RuntimeContext>;
+  accountId: Effect.Effect<string>;
+}
+
+/** Build a scoped-token {@link KVAuth} from a bound {@link HttpToken}. */
+export const makeKVAuth = (token: HttpToken): KVAuth => ({
+  authorize: authorizeWith(token),
+  accountId: token.accountId,
+});
+
 const KV_HTTP_PERMISSION_GROUPS: PermissionGroupRef[] = [
   "Workers KV Storage Read",
   "Workers KV Storage Write",
@@ -67,11 +90,11 @@ type PermissionGroup = (typeof KV_HTTP_PERMISSION_GROUPS)[number];
 
 /** Resolve the account and namespace id once per operation. */
 export const makeKVHttpScope = (
-  token: HttpToken,
+  auth: KVAuth,
   namespaceId: Effect.Effect<string>,
 ): Effect.Effect<HttpScope> =>
   Effect.gen(function* () {
-    const accountId = yield* token.accountId;
+    const accountId = yield* auth.accountId;
     const id = yield* namespaceId;
     return { accountId, namespaceId: id };
   });

package/src/Cloudflare/KV/NamespaceLocal.ts

@@ -0,0 +1,42 @@
+import * as Effect from "effect/Effect";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
+import type { Namespace } from "./Namespace.ts";
+import type { KVAuth } from "./NamespaceHttp.ts";
+
+/**
+ * Shared scaffolding for the `*Local` KV services.
+ *
+ * Instead of minting a scoped {@link AccountApiToken} (the `*Http` path) or
+ * resolving a native Worker binding (the `*Binding` path), it captures the
+ * ambient current-credentials context available during stack-eval and builds
+ * a {@link KVAuth} that provides those credentials directly to the KV HTTP
+ * ops. It then delegates to the same client builders the `*Http` variant uses.
+ *
+ * NOT exported from `index.ts` — this is internal scaffolding shared by the
+ * three access-level Local layers.
+ */
+export const makeLocalKVNamespaceBinding = <Client>(options: {
+  makeClient: (auth: KVAuth, namespaceId: Effect.Effect<string>) => Client;
+}) =>
+  Effect.gen(function* () {
+    // Account + credentials are ambient during stack-eval (the stack's
+    // providers layer). Capture the full context so KV HTTP ops can run with
+    // the current credentials — no `host.bind`, no minted token.
+    const { accountId } = yield* yield* CloudflareEnvironment;
+    const context = yield* Effect.context<
+      Credentials | HttpClient.HttpClient
+    >();
+
+    return Effect.fn(function* (namespace: Namespace) {
+      // Deferred accessor — resolves the namespaceId against the tracker at
+      // apply time (in an Action, that's the engine's resolve context).
+      const namespaceId = yield* namespace.namespaceId;
+      const auth: KVAuth = {
+        authorize: (eff) => eff.pipe(Effect.provideContext(context)),
+        accountId: Effect.succeed(accountId),
+      };
+      return options.makeClient(auth, namespaceId);
+    });
+  });

package/src/Cloudflare/KV/ReadNamespaceHttp.ts

@@ -1,12 +1,12 @@
 import * as kv from "@distilled.cloud/cloudflare/kv";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { authorizeWith } from "../HttpClientUtils.ts";
 import {
   makeHttpKVNamespaceBinding,
+  makeKVAuth,
   makeKVHttpScope,
   toKVNamespaceError,
-  type HttpToken,
+  type KVAuth,
 } from "./NamespaceHttp.ts";
 import { ReadNamespace, type ReadNamespaceClient } from "./ReadNamespace.ts";
 
@@ -21,17 +21,18 @@ export const ReadNamespaceHttp = Layer.effect(
   Effect.suspend(() =>
     makeHttpKVNamespaceBinding({
       permissionGroups: ["Workers KV Storage Read"],
-      makeClient: makeReadKVHttpClient,
+      makeClient: (token, namespaceId) =>
+        makeReadKVHttpClient(makeKVAuth(token), namespaceId),
     }),
   ),
 );
 
 export const makeReadKVHttpClient = (
-  token: HttpToken,
+  auth: KVAuth,
   namespaceId: Effect.Effect<string>,
 ): ReadNamespaceClient => {
-  const authorize = authorizeWith(token);
-  const scope = makeKVHttpScope(token, namespaceId);
+  const { authorize } = auth;
+  const scope = makeKVHttpScope(auth, namespaceId);
 
   const getOne = (key: string, type: string) =>
     scope.pipe(

package/src/Cloudflare/KV/ReadNamespaceLocal.ts

@@ -0,0 +1,35 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeLocalKVNamespaceBinding } from "./NamespaceLocal.ts";
+import { ReadNamespace } from "./ReadNamespace.ts";
+import { makeReadKVHttpClient } from "./ReadNamespaceHttp.ts";
+
+/**
+ * Local implementation of the {@link ReadNamespace} binding — reads KV values
+ * over the Cloudflare HTTP API using the **current credentials** instead of a
+ * native Worker binding (`ReadNamespaceBinding`) or a scoped API token
+ * (`ReadNamespaceHttp`).
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) so you can read
+ * from a namespace with the same `get`/`getWithMetadata`/`list` client you'd
+ * use inside a Worker:
+ *
+ * @example Reading a value from an Action
+ * ```typescript
+ * const Check = Alchemy.Action(
+ *   "Check",
+ *   Effect.gen(function* () {
+ *     const kv = yield* Cloudflare.KV.ReadNamespace(namespace);
+ *     return Effect.fn(function* () {
+ *       return yield* kv.get("my-key");
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.KV.ReadNamespaceLocal)),
+ * );
+ * ```
+ */
+export const ReadNamespaceLocal = Layer.effect(
+  ReadNamespace,
+  Effect.suspend(() =>
+    makeLocalKVNamespaceBinding({ makeClient: makeReadKVHttpClient }),
+  ),
+);

package/src/Cloudflare/KV/ReadWriteNamespaceHttp.ts

@@ -1,6 +1,10 @@
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { makeHttpKVNamespaceBinding, type HttpToken } from "./NamespaceHttp.ts";
+import {
+  makeHttpKVNamespaceBinding,
+  makeKVAuth,
+  type KVAuth,
+} from "./NamespaceHttp.ts";
 import { makeReadKVHttpClient } from "./ReadNamespaceHttp.ts";
 import {
   ReadWriteNamespace,
@@ -19,17 +23,18 @@ export const ReadWriteNamespaceHttp = Layer.effect(
   Effect.suspend(() =>
     makeHttpKVNamespaceBinding({
       permissionGroups: ["Workers KV Storage Read", "Workers KV Storage Write"],
-      makeClient: makeReadWriteKVHttpClient,
+      makeClient: (token, namespaceId) =>
+        makeReadWriteKVHttpClient(makeKVAuth(token), namespaceId),
     }),
   ),
 );
 
-/** Build the HTTP-backed read-write client over a bound token + namespace. */
+/** Build the HTTP-backed read-write client over an auth + namespace. */
 export const makeReadWriteKVHttpClient = (
-  token: HttpToken,
+  auth: KVAuth,
   namespaceId: Effect.Effect<string>,
 ): ReadWriteNamespaceClient =>
   ({
-    ...makeReadKVHttpClient(token, namespaceId),
-    ...makeWriteKVHttpClient(token, namespaceId),
+    ...makeReadKVHttpClient(auth, namespaceId),
+    ...makeWriteKVHttpClient(auth, namespaceId),
   }) as ReadWriteNamespaceClient;

package/src/Cloudflare/KV/ReadWriteNamespaceLocal.ts

@@ -0,0 +1,42 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeLocalKVNamespaceBinding } from "./NamespaceLocal.ts";
+import { ReadWriteNamespace } from "./ReadWriteNamespace.ts";
+import { makeReadWriteKVHttpClient } from "./ReadWriteNamespaceHttp.ts";
+
+/**
+ * Local implementation of the {@link ReadWriteNamespace} binding — reads and
+ * writes KV values over the Cloudflare HTTP API using the **current
+ * credentials** instead of a native Worker binding
+ * (`ReadWriteNamespaceBinding`) or a scoped API token
+ * (`ReadWriteNamespaceHttp`).
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) so you can talk
+ * to a namespace with the same `get`/`put`/`list`/`delete` client you'd use
+ * inside a Worker:
+ *
+ * @example Seeding a namespace from an Action
+ * ```typescript
+ * const Seed = Alchemy.Action(
+ *   "Seed",
+ *   Effect.gen(function* () {
+ *     const kv = yield* Cloudflare.KV.ReadWriteNamespace(namespace);
+ *     return Effect.fn(function* () {
+ *       yield* kv.put("greeting", "hello world");
+ *       return yield* kv.get("greeting");
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.KV.ReadWriteNamespaceLocal)),
+ * );
+ * ```
+ *
+ * The namespace id is resolved at apply time through the ambient
+ * {@link RuntimeContext} (in an Action, that's the resolve context the engine
+ * provides around the body), so `ReadWriteNamespace(namespace)` works even
+ * though the namespace is created in the same deploy.
+ */
+export const ReadWriteNamespaceLocal = Layer.effect(
+  ReadWriteNamespace,
+  Effect.suspend(() =>
+    makeLocalKVNamespaceBinding({ makeClient: makeReadWriteKVHttpClient }),
+  ),
+);

package/src/Cloudflare/KV/WriteNamespaceHttp.ts

@@ -1,12 +1,12 @@
 import * as kv from "@distilled.cloud/cloudflare/kv";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { authorizeWith } from "../HttpClientUtils.ts";
 import {
   makeHttpKVNamespaceBinding,
+  makeKVAuth,
   makeKVHttpScope,
   toKVNamespaceError,
-  type HttpToken,
+  type KVAuth,
 } from "./NamespaceHttp.ts";
 import { NamespaceError } from "./NamespaceTypes.ts";
 import { WriteNamespace, type WriteNamespaceClient } from "./WriteNamespace.ts";
@@ -22,17 +22,18 @@ export const WriteNamespaceHttp = Layer.effect(
   Effect.suspend(() =>
     makeHttpKVNamespaceBinding({
       permissionGroups: ["Workers KV Storage Write"],
-      makeClient: makeWriteKVHttpClient,
+      makeClient: (token, namespaceId) =>
+        makeWriteKVHttpClient(makeKVAuth(token), namespaceId),
     }),
   ),
 );
 
 export const makeWriteKVHttpClient = (
-  token: HttpToken,
+  auth: KVAuth,
   namespaceId: Effect.Effect<string>,
 ): WriteNamespaceClient => {
-  const authorize = authorizeWith(token);
-  const scope = makeKVHttpScope(token, namespaceId);
+  const { authorize } = auth;
+  const scope = makeKVHttpScope(auth, namespaceId);
 
   return {
     put: ((

package/src/Cloudflare/KV/WriteNamespaceLocal.ts

@@ -0,0 +1,35 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeLocalKVNamespaceBinding } from "./NamespaceLocal.ts";
+import { WriteNamespace } from "./WriteNamespace.ts";
+import { makeWriteKVHttpClient } from "./WriteNamespaceHttp.ts";
+
+/**
+ * Local implementation of the {@link WriteNamespace} binding — writes KV
+ * values over the Cloudflare HTTP API using the **current credentials**
+ * instead of a native Worker binding (`WriteNamespaceBinding`) or a scoped API
+ * token (`WriteNamespaceHttp`).
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) so you can write
+ * to a namespace with the same `put`/`delete` client you'd use inside a
+ * Worker:
+ *
+ * @example Writing a value from an Action
+ * ```typescript
+ * const Seed = Alchemy.Action(
+ *   "Seed",
+ *   Effect.gen(function* () {
+ *     const kv = yield* Cloudflare.KV.WriteNamespace(namespace);
+ *     return Effect.fn(function* () {
+ *       yield* kv.put("my-key", "hello world");
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.KV.WriteNamespaceLocal)),
+ * );
+ * ```
+ */
+export const WriteNamespaceLocal = Layer.effect(
+  WriteNamespace,
+  Effect.suspend(() =>
+    makeLocalKVNamespaceBinding({ makeClient: makeWriteKVHttpClient }),
+  ),
+);

package/src/Cloudflare/KV/index.ts

@@ -3,9 +3,12 @@ export * from "./NamespaceTypes.ts";
 export * from "./ReadNamespace.ts";
 export * from "./ReadNamespaceBinding.ts";
 export * from "./ReadNamespaceHttp.ts";
+export * from "./ReadNamespaceLocal.ts";
 export * from "./ReadWriteNamespace.ts";
 export * from "./ReadWriteNamespaceBinding.ts";
 export * from "./ReadWriteNamespaceHttp.ts";
+export * from "./ReadWriteNamespaceLocal.ts";
 export * from "./WriteNamespace.ts";
 export * from "./WriteNamespaceBinding.ts";
 export * from "./WriteNamespaceHttp.ts";
+export * from "./WriteNamespaceLocal.ts";

package/src/Cloudflare/LoadBalancer/Monitor.ts

@@ -286,9 +286,10 @@ export const MonitorProvider = () =>
         .pipe(
           Effect.retry({
             while: (e) => e._tag === "MonitorInUse",
-            schedule: Schedule.exponential("1 second").pipe(
-              Schedule.both(Schedule.recurs(6)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential("1 second"),
+              Schedule.recurs(6),
+            ]),
           }),
           Effect.catchTag("MonitorNotFound", () => Effect.void),
         );

package/src/Cloudflare/LoadBalancer/MonitorGroup.ts

@@ -220,9 +220,10 @@ export const MonitorGroupProvider = () =>
         .pipe(
           Effect.retry({
             while: (e) => e._tag === "MonitorGroupInUse",
-            schedule: Schedule.exponential("1 second").pipe(
-              Schedule.both(Schedule.recurs(6)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential("1 second"),
+              Schedule.recurs(6),
+            ]),
           }),
           Effect.catchTag("MonitorGroupNotFound", () => Effect.void),
         );

package/src/Cloudflare/LoadBalancer/Pool.ts

@@ -336,9 +336,10 @@ export const PoolProvider = () =>
         .pipe(
           Effect.retry({
             while: (e) => e._tag === "PoolInUse",
-            schedule: Schedule.exponential("1 second").pipe(
-              Schedule.both(Schedule.recurs(6)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential("1 second"),
+              Schedule.recurs(6),
+            ]),
           }),
           Effect.catchTag("PoolNotFound", () => Effect.void),
         );

package/src/Cloudflare/LocalRuntime.ts

@@ -32,6 +32,22 @@ export class LocalRuntimeState extends Context.Service<
       Consumer["Attributes"]["consumerId"],
       Consumer["Attributes"]
     >;
+    /**
+     * Restart hooks for locally running Workers, keyed by script name.
+     *
+     * A local workerd instance bakes its queue-consumer wiring in at start
+     * time (`runtime.start({ queueConsumers })`), but the `Consumer`
+     * resource that populates {@link queueConsumers} reconciles as a
+     * *sibling* of the Worker — the engine may start workerd before the
+     * consumer registers. Providers that mutate a worker's runtime wiring
+     * (e.g. `ConsumerProviderLocal`) invoke the script's hook after
+     * updating state so the running instance is reconfigured; the hook is
+     * a no-op until the worker has served at least once.
+     */
+    readonly workerRestarts: MutableHashMap.MutableHashMap<
+      string,
+      Effect.Effect<void>
+    >;
   }
 >()("alchemy/cloudflare/LocalRuntimeState") {}
 
@@ -40,6 +56,7 @@ const LocalRuntimeStateLive = Layer.succeed(
   LocalRuntimeState.of({
     queues: MutableHashMap.empty(),
     queueConsumers: MutableHashMap.empty(),
+    workerRestarts: MutableHashMap.empty(),
   }),
 );
 

package/src/Cloudflare/MagicNetworkMonitoring/Rule.ts

@@ -286,9 +286,10 @@ export const RuleProvider = () =>
             // config has propagated, so ride out that consistency window.
             Effect.retry({
               while: (e) => e._tag === "MnmConfigMissing",
-              schedule: Schedule.exponential("500 millis").pipe(
-                Schedule.both(Schedule.recurs(8)),
-              ),
+              schedule: Schedule.max([
+                Schedule.exponential("500 millis"),
+                Schedule.recurs(8),
+              ]),
             }),
             Effect.catchTag("DuplicateMnmRuleName", (error) =>
               findByName(accountId, name).pipe(

package/src/Cloudflare/Pipelines/Pipeline.ts

@@ -175,9 +175,10 @@ export const PipelineProvider = () =>
         // race an `PipelineAlreadyExists` against the dying pipeline.
         yield* getPipeline(accountId, observed.id).pipe(
           Effect.repeat({
-            schedule: Schedule.exponential("250 millis").pipe(
-              Schedule.both(Schedule.recurs(8)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential("250 millis"),
+              Schedule.recurs(8),
+            ]),
             until: (p) => p === undefined,
           }),
         );
@@ -196,9 +197,10 @@ export const PipelineProvider = () =>
           .pipe(
             Effect.retry({
               while: (e) => e._tag === "TableNotFound",
-              schedule: Schedule.exponential("500 millis").pipe(
-                Schedule.both(Schedule.recurs(6)),
-              ),
+              schedule: Schedule.max([
+                Schedule.exponential("500 millis"),
+                Schedule.recurs(6),
+              ]),
             }),
             Effect.catchTag("PipelineAlreadyExists", (error) =>
               findPipelineByName(accountId, name).pipe(

package/src/Cloudflare/Pipelines/Sink.ts

@@ -348,9 +348,10 @@ export const SinkProvider = () =>
         // race a `SinkAlreadyExists` against the dying sink.
         yield* getSink(accountId, observed.id).pipe(
           Effect.repeat({
-            schedule: Schedule.exponential("250 millis").pipe(
-              Schedule.both(Schedule.recurs(8)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential("250 millis"),
+              Schedule.recurs(8),
+            ]),
             until: (s) => s === undefined,
           }),
         );
@@ -458,9 +459,10 @@ const deleteSink = (accountId: string, sinkId: string) =>
   pipelines.deleteSink({ accountId, sinkId }).pipe(
     Effect.retry({
       while: (e) => e._tag === "SinkInUse",
-      schedule: Schedule.exponential("500 millis").pipe(
-        Schedule.both(Schedule.recurs(8)),
-      ),
+      schedule: Schedule.max([
+        Schedule.exponential("500 millis"),
+        Schedule.recurs(8),
+      ]),
     }),
     Effect.catchTag("SinkNotFound", () => Effect.void),
     Effect.catchTag("InvalidSinkId", () => Effect.void),

package/src/Cloudflare/Pipelines/Stream.ts

@@ -367,9 +367,10 @@ export const StreamProvider = () =>
         .pipe(
           Effect.retry({
             while: (e) => e._tag === "StreamInUse",
-            schedule: Schedule.exponential("500 millis").pipe(
-              Schedule.both(Schedule.recurs(8)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential("500 millis"),
+              Schedule.recurs(8),
+            ]),
           }),
           Effect.catchTag("StreamNotFound", () => Effect.void),
           Effect.catchTag("InvalidStreamId", () => Effect.void),

package/src/Cloudflare/Providers.ts

@@ -476,7 +476,7 @@ export const providers = () =>
         Devices.DeviceSettingsProvider(),
 
         // Split into nested groups: a single flat mergeAll with ~200
-        // arguments exceeds tsgo's variadic inference ceiling and
+        // arguments exceeds tsc's variadic inference ceiling and
         // silently drops the tail layers from the inferred union.
         Layer.mergeAll(
           Diagnostics.EndpointHealthcheckProvider(),
@@ -731,25 +731,27 @@ const cloudflareRetryFactory: Retry.Factory = (lastError) => {
   return {
     while: (error) =>
       defaults.while?.(error) === true || isMisleadinglyTaggedTransient(error),
-    schedule: pipe(
-      Schedule.exponential(Duration.millis(250), 2),
-      Schedule.modifyDelay(
-        Effect.fn(function* (duration) {
-          const error = yield* Ref.get(lastError);
-          // Throttling errors (429): honor a 500ms floor matching the
-          // distilled default.
-          const isThrottling =
-            (error as { _tag?: unknown })?._tag === "TooManyRequests";
-          if (isThrottling && Duration.toMillis(duration) < 500) {
-            return Duration.toMillis(Duration.millis(500));
-          }
-          return Duration.toMillis(duration);
-        }),
+    schedule: Schedule.max([
+      pipe(
+        Schedule.exponential(Duration.millis(250), 2),
+        Schedule.modifyDelay(
+          Effect.fn(function* ({ duration }) {
+            const error = yield* Ref.get(lastError);
+            // Throttling errors (429): honor a 500ms floor matching the
+            // distilled default.
+            const isThrottling =
+              (error as { _tag?: unknown })?._tag === "TooManyRequests";
+            if (isThrottling && Duration.toMillis(duration) < 500) {
+              return Duration.toMillis(Duration.millis(500));
+            }
+            return Duration.toMillis(duration);
+          }),
+        ),
+        Retry.capped(Duration.seconds(5)),
+        Retry.jittered,
       ),
-      Retry.capped(Duration.seconds(5)),
-      Retry.jittered,
-      Schedule.both(Schedule.recurs(8)),
-    ),
+      Schedule.recurs(8),
+    ]),
   };
 };