alchemy 2.0.0-beta.74 → 2.0.0-beta.76

package/src/Cloudflare/Containers/ContainerProvider.ts

@@ -3,13 +3,18 @@ import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
 import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
 import { Unowned } from "../../AdoptPolicy.ts";
 import { AlchemyContext } from "../../AlchemyContext.ts";
 import { getStableContextDir } from "../../Bundle/TempRoot.ts";
 import { hashDirectory } from "../../Command/Memo.ts";
 import { deepEqual, isResolved } from "../../Diff.ts";
 import { Docker } from "../../Docker/Docker.ts";
+import { repositoryFromImageRef } from "../../Docker/Registry.ts";
 import * as Provider from "../../Provider.ts";
 import { type ResourceBinding } from "../../Resource.ts";
 import { sha256Object } from "../../Util/sha256.ts";
@@ -90,6 +95,34 @@ const normalizePrepushedRef = (
     : `${registryId}/${accountId}/${rest}`;
 };
 
+const RegistryDigest = Schema.String.pipe(
+  Schema.check(Schema.isPattern(/^[a-z0-9]+:[a-f0-9]{64}$/i)),
+);
+const isRegistryDigest = Schema.is(RegistryDigest);
+
+class ContainerRegistryError extends Schema.TaggedError<ContainerRegistryError>()(
+  "ContainerRegistryError",
+  {
+    reason: Schema.Literals([
+      "CredentialsMissingUsername",
+      "ImageOutsideRegistry",
+      "InvalidImageReference",
+      "ManifestRequestFailed",
+      "InvalidManifestDigest",
+    ]),
+    message: Schema.String,
+    imageRef: Schema.optional(Schema.String),
+    cause: Schema.optional(Schema.Defect({ includeStack: true })),
+  },
+) {}
+
+const digestFromImageRef = (imageRef: string) => {
+  const separator = imageRef.lastIndexOf("@");
+  if (separator === -1) return undefined;
+  const digest = imageRef.slice(separator + 1);
+  return isRegistryDigest(digest) ? digest : undefined;
+};
+
 export const LiveContainerProvider = () =>
   Provider.effect(
     ContainerPlatform,
@@ -98,6 +131,7 @@ export const LiveContainerProvider = () =>
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
       const docker = yield* Docker;
+      const http = yield* HttpClient.HttpClient;
 
       const telemetry = yield* CloudflareLogs;
 
@@ -201,6 +235,136 @@ export const LiveContainerProvider = () =>
         constraints: props.constraints ?? {},
       });
 
+      const applicationConfigurationHash = Effect.fn(
+        "applicationConfigurationHash",
+      )(function* (
+        scaling: ReturnType<typeof scalingDefaults>,
+        affinities: ContainerApplication.Affinities | undefined,
+        configuration: ContainerApplication.Configuration,
+      ) {
+        return yield* sha256Object({
+          scaling,
+          affinities: normalizeNulls(affinities),
+          configuration,
+        });
+      });
+
+      const registryCredentials = Effect.fn("registryCredentials")(function* (
+        props: AnyContainerApplicationProps,
+        permissions: Array<"pull" | "push">,
+      ) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const registryId = props.registryId ?? "registry.cloudflare.com";
+        const credentials =
+          yield* Containers.createContainerRegistryCredentials({
+            accountId,
+            registryId,
+            permissions,
+            expirationMinutes: 60,
+          });
+        const username = credentials.username ?? credentials.user;
+        if (!username) {
+          return yield* new ContainerRegistryError({
+            reason: "CredentialsMissingUsername",
+            message: `Cloudflare registry ${registryId} did not return a username`,
+          });
+        }
+        return {
+          server: registryId,
+          username,
+          password: credentials.password,
+        };
+      });
+
+      const resolveRegistryDigest = Effect.fn("resolveRegistryDigest")(
+        function* (
+          imageRef: string,
+          credentials: {
+            server: string;
+            username: string;
+            password: string | Redacted.Redacted<string>;
+          },
+        ) {
+          const embeddedDigest = digestFromImageRef(imageRef);
+          if (embeddedDigest !== undefined) return embeddedDigest;
+
+          const registryHost = credentials.server
+            .replace(/^https?:\/\//, "")
+            .replace(/\/$/, "");
+          if (!imageRef.startsWith(`${registryHost}/`)) {
+            return yield* new ContainerRegistryError({
+              reason: "ImageOutsideRegistry",
+              message: `Cannot resolve an image outside registry ${registryHost}`,
+              imageRef,
+            });
+          }
+          const repositoryAndTag = imageRef.slice(registryHost.length + 1);
+          const tagSeparator = repositoryAndTag.lastIndexOf(":");
+          if (tagSeparator <= repositoryAndTag.lastIndexOf("/")) {
+            return yield* new ContainerRegistryError({
+              reason: "InvalidImageReference",
+              message: "Container image reference has no tag or digest",
+              imageRef,
+            });
+          }
+          const repository = repositoryAndTag.slice(0, tagSeparator);
+          const tag = repositoryAndTag.slice(tagSeparator + 1);
+          const manifestUrl = `https://${registryHost}/v2/${repository
+            .split("/")
+            .map(encodeURIComponent)
+            .join("/")}/manifests/${encodeURIComponent(tag)}`;
+          const request = HttpClientRequest.head(manifestUrl).pipe(
+            HttpClientRequest.basicAuth(
+              credentials.username,
+              credentials.password,
+            ),
+            HttpClientRequest.setHeader(
+              "Accept",
+              "application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json",
+            ),
+          );
+          const response = yield* http.execute(request).pipe(
+            Effect.flatMap(HttpClientResponse.filterStatusOk),
+            Effect.mapError(
+              (cause) =>
+                new ContainerRegistryError({
+                  reason: "ManifestRequestFailed",
+                  message: "Failed to resolve the container registry digest",
+                  imageRef,
+                  cause,
+                }),
+            ),
+          );
+          return yield* Schema.decodeUnknownEffect(RegistryDigest)(
+            response.headers["docker-content-digest"],
+          ).pipe(
+            Effect.mapError(
+              (cause) =>
+                new ContainerRegistryError({
+                  reason: "InvalidManifestDigest",
+                  message: "Registry response did not include a valid digest",
+                  imageRef,
+                  cause,
+                }),
+            ),
+          );
+        },
+      );
+
+      const resolvePublishedImageRef = Effect.fn("resolvePublishedImageRef")(
+        function* (props: AnyContainerApplicationProps, imageRef: string) {
+          let digest = digestFromImageRef(imageRef);
+          if (digest === undefined) {
+            const credentials = yield* registryCredentials(props, ["pull"]);
+            digest = yield* resolveRegistryDigest(imageRef, credentials);
+          }
+          return {
+            imageRef: `${repositoryFromImageRef(imageRef)}@${digest}`,
+            digest,
+          };
+        },
+      );
+
       const computeImage = Effect.fn(function* (
         id: string,
         props: AnyContainerApplicationProps,
@@ -355,14 +519,14 @@ export const LiveContainerProvider = () =>
         };
       });
 
-      const buildAndPushImage = Effect.fn(function* (
+      const buildAndPushImage = Effect.fn("buildAndPushImage")(function* (
         id: string,
         props: AnyContainerApplicationProps,
         build: ImageBuild,
         imageRef: string,
+        previousImageRef: string | undefined,
         session?: { note: (message: string) => Effect.Effect<void> },
       ) {
-        const { accountId } = yield* yield* CloudflareEnvironment;
         const platform = "linux/amd64";
 
         if (build.kind === "prepushed") {
@@ -371,7 +535,15 @@ export const LiveContainerProvider = () =>
           yield* Effect.logInfo(
             `Cloudflare Container image: using pre-pushed ${imageRef}`,
           );
-          return;
+          const published = yield* resolvePublishedImageRef(props, imageRef);
+          return {
+            ...published,
+            previousDigest:
+              previousImageRef === undefined
+                ? undefined
+                : (yield* resolvePublishedImageRef(props, previousImageRef))
+                    .digest,
+          };
         }
 
         if (build.kind === "remote") {
@@ -443,22 +615,7 @@ export const LiveContainerProvider = () =>
           yield* session.note(`Pushing container image ${imageRef}...`);
         }
 
-        const registryId = props.registryId ?? "registry.cloudflare.com";
-        const credentials =
-          yield* Containers.createContainerRegistryCredentials({
-            accountId,
-            registryId,
-            permissions: ["pull", "push"],
-            expirationMinutes: 60,
-          });
-        const username = credentials.username ?? (credentials as any).user;
-        if (!username) {
-          return yield* Effect.fail(
-            new Error(
-              "Cloudflare registry credentials did not include a username.",
-            ),
-          );
-        }
+        const credentials = yield* registryCredentials(props, ["pull", "push"]);
 
         // Cloudflare's container registry intermittently answers blob HEAD
         // probes with 500 under concurrent suite push load. Ride that out
@@ -473,9 +630,9 @@ export const LiveContainerProvider = () =>
           .push(
             imageRef,
             {
-              username,
+              username: credentials.username,
               password: credentials.password,
-              server: registryId,
+              server: credentials.server,
             },
             platform,
           )
@@ -495,6 +652,19 @@ export const LiveContainerProvider = () =>
               ]),
             }),
           );
+        // Resolve the pushed manifest digest from the registry itself rather
+        // than scraping `docker push` output: one mechanism for every image
+        // source (local build, remote re-push, pre-pushed tag), and the
+        // registry is authoritative for what the application will pull.
+        const digest = yield* resolveRegistryDigest(imageRef, credentials);
+        return {
+          imageRef: `${repositoryFromImageRef(imageRef)}@${digest}`,
+          digest,
+          previousDigest:
+            previousImageRef === undefined
+              ? undefined
+              : yield* resolveRegistryDigest(previousImageRef, credentials),
+        };
       });
 
       const maybeCreateRollout = Effect.fn(function* ({
@@ -705,10 +875,55 @@ export const LiveContainerProvider = () =>
           news,
           env,
         );
-        const configuration = desiredConfiguration(news, env, imageRef);
-
+        let deploymentImageRef = existing.configuration.image;
+        let imageDigest = existing.hash?.digest;
         if (imageHash !== existing.hash?.image) {
-          yield* buildAndPushImage(id, news, build, imageRef, session);
+          const published = yield* buildAndPushImage(
+            id,
+            news,
+            build,
+            imageRef,
+            existing.hash?.digest === undefined
+              ? existing.configuration.image
+              : undefined,
+            session,
+          );
+          const existingDigest =
+            existing.hash?.digest ?? published.previousDigest;
+          deploymentImageRef =
+            published.digest === existingDigest
+              ? existing.configuration.image
+              : published.imageRef;
+          imageDigest = published.digest;
+        }
+        const configuration = desiredConfiguration(
+          news,
+          env,
+          deploymentImageRef,
+        );
+        const scaling = scalingDefaults(news);
+        const configurationHash = yield* applicationConfigurationHash(
+          scaling,
+          news.affinities,
+          configuration,
+        );
+        if (existing.hash?.configuration === configurationHash) {
+          yield* Effect.logInfo(
+            `Cloudflare Container update: ${existing.applicationName} has no effective changes`,
+          );
+          yield* session.note(
+            `Container application ${existing.applicationName} is unchanged.`,
+          );
+          return {
+            ...existing,
+            configuration,
+            hash: {
+              image: imageHash,
+              digest: imageDigest,
+              configuration: configurationHash,
+            },
+            dev,
+          };
         }
 
         yield* session.note(
@@ -720,7 +935,7 @@ export const LiveContainerProvider = () =>
           Containers.updateContainerApplication({
             accountId,
             applicationId: existing.applicationId,
-            ...scalingDefaults(news),
+            ...scaling,
             affinities: news.affinities,
             configuration,
           }),
@@ -743,7 +958,7 @@ export const LiveContainerProvider = () =>
               return yield* Containers.createContainerApplication({
                 accountId,
                 name: existing.applicationName,
-                ...scalingDefaults(news),
+                ...scaling,
                 affinities: news.affinities,
                 configuration,
                 durableObjects,
@@ -762,7 +977,16 @@ export const LiveContainerProvider = () =>
             rollout: news.rollout,
           });
         }
-        return { ...updated, configuration, hash: { image: imageHash }, dev };
+        return {
+          ...updated,
+          configuration,
+          hash: {
+            image: imageHash,
+            digest: imageDigest,
+            configuration: configurationHash,
+          },
+          dev,
+        };
       });
 
       const getDurableObjects = (
@@ -862,8 +1086,24 @@ export const LiveContainerProvider = () =>
             news,
             env,
           );
-          const configuration = desiredConfiguration(news, env, imageRef);
-          yield* buildAndPushImage(id, news, build, imageRef, session);
+          const published = yield* buildAndPushImage(
+            id,
+            news,
+            build,
+            imageRef,
+            undefined,
+            session,
+          );
+          const configuration = desiredConfiguration(
+            news,
+            env,
+            published.imageRef,
+          );
+          const configurationHash = yield* applicationConfigurationHash(
+            scalingDefaults(news),
+            news.affinities,
+            configuration,
+          );
 
           // Precreate intentionally omits the Durable Object attachment so the
           // worker can bind to this application id and break the circular
@@ -887,7 +1127,11 @@ export const LiveContainerProvider = () =>
           });
           return {
             ...("applicationId" in result ? result : toAttributes(result)),
-            hash: { image: imageHash },
+            hash: {
+              image: imageHash,
+              digest: published.digest,
+              configuration: configurationHash,
+            },
             dev,
           };
         }),
@@ -914,7 +1158,6 @@ export const LiveContainerProvider = () =>
             news,
             env,
           );
-          const configuration = desiredConfiguration(news, env, imageRef);
 
           // Observe — re-fetch the cached application to confirm it still
           // exists. Cloudflare reports a deleted container application as
@@ -982,6 +1225,37 @@ export const LiveContainerProvider = () =>
                 });
               }
             }
+            let deploymentImageRef = existing.configuration.image;
+            let imageDigest = existing.hash?.digest;
+            if (imageHash !== existing.hash?.image) {
+              const published = yield* buildAndPushImage(
+                id,
+                news,
+                build,
+                imageRef,
+                existing.hash?.digest === undefined
+                  ? existing.configuration.image
+                  : undefined,
+                session,
+              );
+              const existingDigest =
+                existing.hash?.digest ?? published.previousDigest;
+              deploymentImageRef =
+                published.digest === existingDigest
+                  ? existing.configuration.image
+                  : published.imageRef;
+              imageDigest = published.digest;
+            }
+            const configuration = desiredConfiguration(
+              news,
+              env,
+              deploymentImageRef,
+            );
+            const configurationHash = yield* applicationConfigurationHash(
+              scalingDefaults(news),
+              news.affinities,
+              configuration,
+            );
             yield* Effect.logInfo(
               `Cloudflare Container reconcile: recreating ${name} to attach durable object binding`,
             );
@@ -1001,9 +1275,6 @@ export const LiveContainerProvider = () =>
             // doesn't re-adopt the just-deleted application and then try to
             // update a now-gone id (see `waitForApplicationDeleted`).
             yield* waitForApplicationDeleted(name, existing.applicationId);
-            if (imageHash !== existing.hash?.image) {
-              yield* buildAndPushImage(id, news, build, imageRef, session);
-            }
             const result = yield* createApplication({
               id,
               news,
@@ -1015,7 +1286,11 @@ export const LiveContainerProvider = () =>
             });
             return {
               ...("applicationId" in result ? result : toAttributes(result)),
-              hash: { image: imageHash },
+              hash: {
+                image: imageHash,
+                digest: imageDigest,
+                configuration: configurationHash,
+              },
               dev,
             };
           }
@@ -1040,7 +1315,24 @@ export const LiveContainerProvider = () =>
           // then create. `createApplication` itself tolerates concurrent
           // creates by adopting an existing application with the same
           // name or namespace.
-          yield* buildAndPushImage(id, news, build, imageRef, session);
+          const published = yield* buildAndPushImage(
+            id,
+            news,
+            build,
+            imageRef,
+            undefined,
+            session,
+          );
+          const configuration = desiredConfiguration(
+            news,
+            env,
+            published.imageRef,
+          );
+          const configurationHash = yield* applicationConfigurationHash(
+            scalingDefaults(news),
+            news.affinities,
+            configuration,
+          );
           const result = yield* createApplication({
             id,
             news,
@@ -1052,7 +1344,11 @@ export const LiveContainerProvider = () =>
           });
           return {
             ...("applicationId" in result ? result : toAttributes(result)),
-            hash: { image: imageHash },
+            hash: {
+              image: imageHash,
+              digest: published.digest,
+              configuration: configurationHash,
+            },
             dev,
           };
         }),

package/src/Cloudflare/Containers/LocalContainerProvider.ts

@@ -139,6 +139,42 @@ export const LocalContainerProvider = () =>
           };
         }).pipe(Artifacts.cached(`container-image:${id}`));
 
+      /**
+       * The props that decide what the dev IMAGE is, picked off the
+       * possibly-unresolved plan-time props — or `undefined` when any of
+       * them has not resolved yet. Everything else (env, instances, …) may
+       * still carry Outputs/Effects (the `.make` form's `exports` impl
+       * Effect never resolves at all) without disabling the content check.
+       */
+      const resolvedImageInputs = (
+        input: unknown,
+      ): AnyContainerApplicationProps | undefined => {
+        if (typeof input !== "object" || input === null) return undefined;
+        const news = input as AnyContainerApplicationProps;
+        const picked = {
+          main: news.main,
+          image: news.image,
+          dockerfile: news.dockerfile,
+          context: news.context,
+          runtime: news.runtime,
+          handler: news.handler,
+          isExternal: news.isExternal,
+          external: news.external,
+          build: news.build,
+          autoInstallExternals: news.autoInstallExternals,
+        };
+        if (!isResolved(picked)) return undefined;
+        if (
+          !picked.main &&
+          !picked.image &&
+          !picked.dockerfile &&
+          !picked.context
+        ) {
+          return undefined;
+        }
+        return picked as AnyContainerApplicationProps;
+      };
+
       const placeholderConfiguration = (
         props: AnyContainerApplicationProps,
         env: Record<string, string | Redacted.Redacted<string>>,
@@ -198,17 +234,32 @@ export const LocalContainerProvider = () =>
       });
 
       return {
-        // No HMR for containers (yet): bundle once on first reconcile, then
-        // treat the resource as a no-op so subsequent reconciles don't
-        // re-bundle on every change.
         stables: ["accountId", "applicationId"],
         diff: Effect.fn(function* ({ id, news, output }) {
           if (!output) return { action: "update" };
+          // A content-only edit (an imported module of `main`, a Dockerfile,
+          // a context file) changes no prop, so the engine's structural
+          // fallback would call it a noop and the image would never rebuild.
+          // Compare the recomputed image hash instead — and gate only on
+          // the IMAGE inputs being resolved, not the whole props bag: the
+          // platform `.make` form carries an `exports` impl Effect that is
+          // never "resolved", and requiring full resolution silently
+          // disabled this check for every effectful container.
+          const imageInputs = resolvedImageInputs(news);
+          if (imageInputs !== undefined) {
+            // Recompute fresh on every plan. `prepareImage` is memoized so
+            // a plan's diff→precreate→reconcile chain bundles once — but
+            // this provider runs in the RPC sidecar, whose `ArtifactStore`
+            // outlives every run, so without this eviction the FIRST run's
+            // hash would be compared forever.
+            yield* (yield* Artifacts.Artifacts).delete(`container-image:${id}`);
+            const input = yield* prepareImage(id, imageInputs);
+            if (input.hash !== output.hash?.image || !output.dev) {
+              return { action: "update" };
+            }
+          }
           if (!isResolved(news)) return undefined;
-          const input = yield* prepareImage(id, news);
-          return input.hash !== output.hash?.image || !output.dev
-            ? { action: "update" }
-            : undefined;
+          return !output.dev ? { action: "update" } : undefined;
         }),
         read: Effect.fn(function* ({ output }) {
           return output;

package/src/Cloudflare/Email/AllowPolicy.ts

@@ -172,9 +172,15 @@ export const AllowPolicyProvider = () =>
               ),
             ),
           ),
-          // Email Security is a paid add-on; accounts without the
-          // entitlement can't enumerate policies — treat as empty.
-          Effect.catchTag("EmailSecurityNotEntitled", () =>
+          // Email Security is a paid add-on gated by both account
+          // entitlement and token scope: an unentitled account answers
+          // `EmailSecurityNotEntitled`, while a credential lacking the
+          // Email Security scope (e.g. Cloudflare OAuth) answers a bare
+          // `Forbidden`. Neither can enumerate, so both mean "none
+          // visible" — matching `Domain.list()`. Returning `[]` is the
+          // safe direction for the callers of `list` (orphan detection
+          // never deletes what it cannot see).
+          Effect.catchTag(["EmailSecurityNotEntitled", "Forbidden"], () =>
             Effect.succeed([] as AllowPolicyAttributes[]),
           ),
         );