alchemy 2.0.0-beta.74 → 2.0.0-beta.76

package/src/Cloudflare/Email/CatchAll.ts

@@ -8,6 +8,7 @@ import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Providers } from "../Providers.ts";
 import { resolveZoneId, type Reference } from "../Zone/index.ts";
 import { listAllZones } from "../Zone/lookup.ts";
+import { retryWorkerScriptNotFound } from "./retry.ts";
 import type { Action } from "./Rule.ts";
 
 const CatchAllTypeId = "Cloudflare.Email.CatchAll" as const;
@@ -222,17 +223,19 @@ export const CatchAllProvider = () =>
       ) {
         return toAttributes(zoneId, observed, initial);
       }
-      const result = yield* emailRouting.putRuleCatchAll({
-        zoneId,
-        matchers: [{ type: "all" }],
-        actions: news.actions.map((a) =>
-          a.type === "drop"
-            ? { type: a.type }
-            : { type: a.type, value: a.value },
-        ),
-        enabled: desiredEnabled,
-        name: desiredName,
-      });
+      const result = yield* emailRouting
+        .putRuleCatchAll({
+          zoneId,
+          matchers: [{ type: "all" }],
+          actions: news.actions.map((a) =>
+            a.type === "drop"
+              ? { type: a.type }
+              : { type: a.type, value: a.value },
+          ),
+          enabled: desiredEnabled,
+          name: desiredName,
+        })
+        .pipe(retryWorkerScriptNotFound);
       return toAttributes(zoneId, result, initial);
     }),
 
@@ -266,19 +269,24 @@ export const CatchAllProvider = () =>
         })
         .pipe(
           Effect.catchTag("Forbidden", () => Effect.void),
-          // The original forward destination may have been unverified or
-          // removed since we captured it — fall back to the Cloudflare
-          // default (disabled, drop) rather than failing the destroy.
-          Effect.catchTag("DestinationNotVerified", () =>
-            emailRouting
-              .putRuleCatchAll({
-                zoneId,
-                matchers: [{ type: "all" }],
-                actions: [{ type: "drop" }],
-                enabled: false,
-                name: initialName,
-              })
-              .pipe(Effect.catchTag("Forbidden", () => Effect.void)),
+          // The captured action may name something that no longer exists:
+          // an unverified/removed destination address, or — after the
+          // Worker it pointed at was replaced or deleted — a missing
+          // script. Neither is retryable and neither should strand the
+          // destroy, so fall back to the Cloudflare default (disabled,
+          // drop) instead of failing.
+          Effect.catchTag(
+            ["DestinationNotVerified", "WorkerScriptNotFound"],
+            () =>
+              emailRouting
+                .putRuleCatchAll({
+                  zoneId,
+                  matchers: [{ type: "all" }],
+                  actions: [{ type: "drop" }],
+                  enabled: false,
+                  name: initialName,
+                })
+                .pipe(Effect.catchTag("Forbidden", () => Effect.void)),
           ),
         );
     }),

package/src/Cloudflare/Email/ImpersonationRegistryEntry.ts

@@ -142,7 +142,15 @@ export const ImpersonationRegistryEntryProvider = () =>
               ),
             ),
           ),
-          Effect.catchTag("EmailSecurityNotEntitled", () =>
+          // Email Security is a paid add-on gated by both account
+          // entitlement and token scope: an unentitled account answers
+          // `EmailSecurityNotEntitled`, while a credential lacking the
+          // Email Security scope (e.g. Cloudflare OAuth) answers a bare
+          // `Forbidden`. Neither can enumerate, so both mean "none
+          // visible" — matching `Domain.list()`. Returning `[]` is the
+          // safe direction for the callers of `list` (orphan detection
+          // never deletes what it cannot see).
+          Effect.catchTag(["EmailSecurityNotEntitled", "Forbidden"], () =>
             Effect.succeed([] as ImpersonationRegistryEntryAttributes[]),
           ),
         );

package/src/Cloudflare/Email/Rule.ts

@@ -8,6 +8,7 @@ import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Providers } from "../Providers.ts";
 import { resolveZoneId, type Reference } from "../Zone/index.ts";
 import { listAllZones } from "../Zone/lookup.ts";
+import { retryWorkerScriptNotFound } from "./retry.ts";
 
 export type Matcher =
   | { type: "all" }
@@ -174,16 +175,19 @@ export const RuleProvider = () =>
             ...body,
           })
           .pipe(
+            retryWorkerScriptNotFound,
             Effect.catch(() =>
               emailRouting
                 .createRule({ zoneId, ...body })
-                .pipe(Effect.map((r) => r)),
+                .pipe(retryWorkerScriptNotFound),
             ),
           );
         return normalize(result, zoneId);
       }
 
-      const result = yield* emailRouting.createRule({ zoneId, ...body });
+      const result = yield* emailRouting
+        .createRule({ zoneId, ...body })
+        .pipe(retryWorkerScriptNotFound);
       return normalize(result, zoneId);
     }),
     delete: Effect.fn(function* ({ output }) {

package/src/Cloudflare/Email/TrustedDomain.ts

@@ -138,7 +138,15 @@ export const TrustedDomainProvider = () =>
               ),
             ),
           ),
-          Effect.catchTag("EmailSecurityNotEntitled", () =>
+          // Email Security is a paid add-on gated by both account
+          // entitlement and token scope: an unentitled account answers
+          // `EmailSecurityNotEntitled`, while a credential lacking the
+          // Email Security scope (e.g. Cloudflare OAuth) answers a bare
+          // `Forbidden`. Neither can enumerate, so both mean "none
+          // visible" — matching `Domain.list()`. Returning `[]` is the
+          // safe direction for the callers of `list` (orphan detection
+          // never deletes what it cannot see).
+          Effect.catchTag(["EmailSecurityNotEntitled", "Forbidden"], () =>
             Effect.succeed([] as TrustedDomainAttributes[]),
           ),
         );

package/src/Cloudflare/Email/retry.ts

@@ -0,0 +1,29 @@
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+/**
+ * Ride out the window in which a Worker created earlier in the same apply is
+ * not yet visible to Email Routing's action validation.
+ *
+ * Cloudflare validates a `{ type: "worker", value: [scriptName] }` action
+ * while handling the create/update request and rejects it with
+ * `WorkerScriptNotFound` ("Workers Script Info not found") until the script
+ * propagates — typically within a few hundred milliseconds. The rejected call
+ * creates nothing, so a retry cannot produce a duplicate rule.
+ *
+ * Mirrors `Cloudflare/Fetcher`'s treatment of a freshly-deployed script:
+ * bounded exponential backoff (~25s total), then re-raise the original error
+ * unchanged so a genuinely missing Worker still fails and says so.
+ *
+ * @see https://github.com/alchemy-run/alchemy/issues/1348
+ */
+export const retryWorkerScriptNotFound = <A, E extends { _tag: string }, R>(
+  effect: Effect.Effect<A, E, R>,
+): Effect.Effect<A, E, R> =>
+  effect.pipe(
+    Effect.retry({
+      while: (error) => error._tag === "WorkerScriptNotFound",
+      schedule: Schedule.exponential("100 millis"),
+      times: 8,
+    }),
+  );

package/src/Cloudflare/R2/Bucket.ts

@@ -159,6 +159,18 @@ export type BucketProps = {
    * to remove all custom domains.
    */
   domains?: BucketCustomDomain[];
+  /**
+   * Whether the bucket is publicly readable at Cloudflare's managed
+   * `r2.dev` domain. Cloudflare's default is off; omit or pass `false`
+   * to disable it.
+   *
+   * Once enabled, the hostname is reported on `publicDomain`. This
+   * endpoint is rate-limited and intended for non-production use — use
+   * `domains` for production public access.
+   *
+   * @default false
+   */
+  publicAccess?: boolean;
   /**
    * Object lifecycle rules applied to the bucket. Pass an empty array (or
    * omit) to clear all lifecycle rules. See the Cloudflare R2 docs for
@@ -203,6 +215,12 @@ export type Bucket = Resource<
     domains: Bucket.CustomDomain[];
     lifecycleRules: Bucket.LifecycleRule[];
     cors: Bucket.CorsRule[];
+    /**
+     * Hostname of the bucket's Cloudflare-managed `r2.dev` domain.
+     * Set only while `publicAccess` is enabled; `undefined` when
+     * disabled (the domain still exists but serves 401).
+     */
+    publicDomain: string | undefined;
   },
   never,
   Cloudflare.Providers
@@ -299,6 +317,28 @@ export type Bucket = Resource<
  * });
  * ```
  *
+ * ### Public Development URL
+ *
+ * Enable Cloudflare's managed `r2.dev` domain so objects are publicly
+ * readable without attaching a custom domain. The hostname is reported
+ * on `publicDomain`. This endpoint is rate-limited and intended for
+ * non-production use — use `domains` for production public access.
+ *
+ * **Example:** Enable public access at r2.dev
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2.Bucket("MyBucket", {
+ *   publicAccess: true,
+ * });
+ * // objects are at https://${bucket.publicDomain}/<key>
+ * ```
+ *
+ * **Example:** Disable public access
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2.Bucket("MyBucket", {
+ *   publicAccess: false,
+ * });
+ * ```
+ *
  * ### Object Lifecycle Rules
  *
  * Configure lifecycle rules to automatically delete objects, abort
@@ -714,6 +754,77 @@ export const ProviderLive = () =>
           return applied.sort((a, b) => a.domain.localeCompare(b.domain));
         });
 
+      const listManagedDomain = Effect.fn(function* (
+        bucketName: string,
+        jurisdiction: Bucket.Jurisdiction,
+        options?: { retryMissing?: boolean },
+      ) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const fetch = r2.listBucketDomainManageds({
+          accountId,
+          bucketName,
+          jurisdiction,
+        });
+        return yield* (
+          options?.retryMissing === false
+            ? fetch
+            : fetch.pipe(
+                Effect.retry({
+                  while: (e) => e._tag === "NoSuchBucket",
+                  schedule: r2BucketEndpointConsistencySchedule,
+                }),
+              )
+        ).pipe(
+          // The hostname exists whether or not public access is on; a
+          // disabled domain serves 401, so only report it while enabled.
+          Effect.map((response) =>
+            response.enabled ? response.domain : undefined,
+          ),
+          Effect.catchTag("NoSuchBucket", () => Effect.succeed(undefined)),
+        );
+      });
+
+      const reconcileManagedDomain = (
+        bucketName: string,
+        jurisdiction: Bucket.Jurisdiction,
+        desired: boolean,
+      ) =>
+        Effect.gen(function* () {
+          const { accountId } = yield* yield* CloudflareEnvironment;
+          const observed = yield* r2
+            .listBucketDomainManageds({
+              accountId,
+              bucketName,
+              jurisdiction,
+            })
+            .pipe(
+              Effect.retry({
+                while: (e) => e._tag === "NoSuchBucket",
+                schedule: r2BucketEndpointConsistencySchedule,
+              }),
+            );
+
+          if (observed.enabled === desired) {
+            return desired ? observed.domain : undefined;
+          }
+
+          const updated = yield* r2
+            .putBucketDomainManaged({
+              accountId,
+              bucketName,
+              enabled: desired,
+              jurisdiction,
+            })
+            .pipe(
+              Effect.retry({
+                while: (e) => e._tag === "NoSuchBucket",
+                schedule: r2BucketEndpointConsistencySchedule,
+              }),
+            );
+
+          return updated.enabled ? updated.domain : undefined;
+        });
+
       // R2's `listBuckets` is not modelled as paginated by distilled and its
       // response omits a continuation cursor, so paginate exhaustively with the
       // `startAfter` query param: keep fetching full pages (capped at 1000)
@@ -907,47 +1018,51 @@ export const ProviderLive = () =>
               buckets,
               (bucket) =>
                 Effect.gen(function* () {
-                  // The three hydration reads are independent — issue them
+                  // The hydration reads are independent — issue them
                   // concurrently so each bucket costs one round-trip of wall
-                  // clock instead of three (a large leaked-bucket census can
+                  // clock instead of four (a large leaked-bucket census can
                   // otherwise blow the nuke scan's per-provider timeout).
-                  const [domains, lifecycleRules, cors] = yield* Effect.all(
-                    [
-                      listCustomDomains(bucket.name, bucket.jurisdiction, {
-                        retryMissing: false,
-                      }).pipe(Effect.map((d) => d ?? [])),
-                      r2
-                        .getBucketLifecycle({
-                          accountId,
-                          bucketName: bucket.name,
-                          jurisdiction: bucket.jurisdiction,
-                        })
-                        .pipe(
-                          Effect.map((observed) =>
-                            (observed.rules ?? []).map(toLifecycleRule),
+                  const [domains, lifecycleRules, cors, publicDomain] =
+                    yield* Effect.all(
+                      [
+                        listCustomDomains(bucket.name, bucket.jurisdiction, {
+                          retryMissing: false,
+                        }).pipe(Effect.map((d) => d ?? [])),
+                        r2
+                          .getBucketLifecycle({
+                            accountId,
+                            bucketName: bucket.name,
+                            jurisdiction: bucket.jurisdiction,
+                          })
+                          .pipe(
+                            Effect.map((observed) =>
+                              (observed.rules ?? []).map(toLifecycleRule),
+                            ),
+                            Effect.catchTag("NoSuchBucket", () =>
+                              Effect.succeed([] as Bucket.LifecycleRule[]),
+                            ),
                           ),
-                          Effect.catchTag("NoSuchBucket", () =>
-                            Effect.succeed([] as Bucket.LifecycleRule[]),
+                        r2
+                          .getBucketCors({
+                            accountId,
+                            bucketName: bucket.name,
+                            jurisdiction: bucket.jurisdiction,
+                          })
+                          .pipe(
+                            Effect.map((observed) =>
+                              (observed.rules ?? []).map(toCorsRule),
+                            ),
+                            Effect.catchTag(
+                              ["NoSuchBucket", "NoCorsConfiguration"],
+                              () => Effect.succeed([] as Bucket.CorsRule[]),
+                            ),
                           ),
-                        ),
-                      r2
-                        .getBucketCors({
-                          accountId,
-                          bucketName: bucket.name,
-                          jurisdiction: bucket.jurisdiction,
-                        })
-                        .pipe(
-                          Effect.map((observed) =>
-                            (observed.rules ?? []).map(toCorsRule),
-                          ),
-                          Effect.catchTag(
-                            ["NoSuchBucket", "NoCorsConfiguration"],
-                            () => Effect.succeed([] as Bucket.CorsRule[]),
-                          ),
-                        ),
-                    ] as const,
-                    { concurrency: 3 },
-                  );
+                        listManagedDomain(bucket.name, bucket.jurisdiction, {
+                          retryMissing: false,
+                        }),
+                      ] as const,
+                      { concurrency: 4 },
+                    );
                   return {
                     bucketName: bucket.name,
                     storageClass: bucket.storageClass,
@@ -957,6 +1072,7 @@ export const ProviderLive = () =>
                     domains,
                     lifecycleRules,
                     cors,
+                    publicDomain,
                   };
                 }).pipe(
                   // The custom-domain endpoint intermittently 500s ("Failed to
@@ -978,6 +1094,7 @@ export const ProviderLive = () =>
                       domains: [] as Bucket.CustomDomain[],
                       lifecycleRules: [] as Bucket.LifecycleRule[],
                       cors: [] as Bucket.CorsRule[],
+                      publicDomain: undefined,
                     }),
                   ),
                 ),
@@ -1025,6 +1142,9 @@ export const ProviderLive = () =>
           if (!deepEqual(olds.cors, news.cors)) {
             return { action: "update" } as const;
           }
+          if ((olds.publicAccess ?? false) !== (news.publicAccess ?? false)) {
+            return { action: "update" } as const;
+          }
         }),
         reconcile: Effect.fn(function* ({ id, news = {}, output }) {
           const { accountId } = yield* yield* CloudflareEnvironment;
@@ -1139,11 +1259,18 @@ export const ProviderLive = () =>
             news.cors ?? [],
           );
 
+          const publicDomain = yield* reconcileManagedDomain(
+            attrs.bucketName,
+            attrs.jurisdiction,
+            news.publicAccess ?? false,
+          );
+
           return {
             ...attrs,
             domains,
             lifecycleRules,
             cors,
+            publicDomain,
           };
         }),
         delete: Effect.fn(function* ({ olds = {}, output, force }) {
@@ -1213,6 +1340,7 @@ export const ProviderLive = () =>
                 domains: output?.domains ?? [],
                 lifecycleRules: output?.lifecycleRules ?? [],
                 cors: output?.cors ?? [],
+                publicDomain: output?.publicDomain,
               })),
               Effect.catchTag("NoSuchBucket", () => Effect.succeed(undefined)),
             );
@@ -1229,8 +1357,9 @@ export const ProviderLive = () =>
  * opaque id — the name IS the identity — so the `dev:` marker rides on the
  * name (a `:` can never appear in a real R2 bucket name).
  *
- * Custom domains, lifecycle rules, and CORS are deploy-side concerns with
- * no local behavior; the local attributes report them empty.
+ * Custom domains, lifecycle rules, CORS, and the managed r2.dev domain
+ * are deploy-side concerns with no local behavior; the local attributes
+ * report them empty.
  */
 export const ProviderLocal = () =>
   Provider.succeed(Bucket, {
@@ -1259,6 +1388,7 @@ export const ProviderLocal = () =>
         domains: [],
         lifecycleRules: [],
         cors: [],
+        publicDomain: undefined,
       };
     }),
     delete: Effect.fn(function* () {

package/src/Cloudflare/R2/DataCatalog.ts

@@ -295,6 +295,28 @@ export const DataCatalogProvider = () =>
           );
       }
 
+      // Sync credential before maintenance — Cloudflare rejects maintenance
+      // updates when the warehouse has no credential registered.
+      // The API exposes only present/absent, so `olds` serves as the rotation
+      // hint: re-push when the token value changed or no credential is
+      // registered (adoption re-pushes; idempotent).
+      let credentialStatus = (observed.credentialStatus ?? "absent") as
+        | "present"
+        | "absent";
+      if (news.token !== undefined) {
+        const rotated =
+          olds?.token === undefined ||
+          Redacted.value(olds.token) !== Redacted.value(news.token);
+        if (credentialStatus !== "present" || rotated) {
+          yield* rdc.createCredential({
+            accountId: acct,
+            bucketName,
+            token: Redacted.value(news.token),
+          });
+          credentialStatus = "present";
+        }
+      }
+
       // Sync maintenance — diff observed config against the fields the user
       // actually specified; skip the API entirely on a no-op.
       let maintenance = observed.maintenanceConfig ?? undefined;
@@ -329,26 +351,6 @@ export const DataCatalogProvider = () =>
         };
       }
 
-      // Sync credential — the API exposes only present/absent, so `olds`
-      // serves as the rotation hint: re-push when the token value changed
-      // or no credential is registered (adoption re-pushes; idempotent).
-      let credentialStatus = (observed.credentialStatus ?? "absent") as
-        | "present"
-        | "absent";
-      if (news.token !== undefined) {
-        const rotated =
-          olds?.token === undefined ||
-          Redacted.value(olds.token) !== Redacted.value(news.token);
-        if (credentialStatus !== "present" || rotated) {
-          yield* rdc.createCredential({
-            accountId: acct,
-            bucketName,
-            token: Redacted.value(news.token),
-          });
-          credentialStatus = "present";
-        }
-      }
-
       return toAttributes(
         { ...observed, status: "active", maintenanceConfig: maintenance },
         acct,