alchemy 2.0.0-beta.76 → 2.0.0-beta.77

package/src/Cloudflare/Auth/TokenPolicy.ts

@@ -0,0 +1,79 @@
+/**
+ * Cloudflare expresses an API token's grants as *policies*: one entry per
+ * resource scope, each listing the permission groups allowed on it. The
+ * catalog hands back a flat list of permission groups, so minting a token
+ * means bucketing those groups by the scope they belong to.
+ */
+
+/**
+ * One `{effect, permissionGroups, resources}` entry in a token's policy list.
+ * Mutable to match the shape Cloudflare's create-token request expects.
+ */
+export interface TokenPolicy {
+  effect: "allow";
+  permissionGroups: Array<{ id: string }>;
+  resources: Record<string, string>;
+}
+
+/** A permission group as returned by Cloudflare's token-permissions catalog. */
+export interface PermissionGroup {
+  readonly id: string;
+  readonly name: string;
+  readonly category?: string;
+  readonly scopes: ReadonlyArray<string>;
+  /** Whether this group's scope maps onto a policy we know how to express. */
+  readonly selectable: boolean;
+}
+
+/** Scopes we know how to turn into a policy; anything else is not offerable. */
+export const selectableScopes: ReadonlySet<string> = new Set([
+  "com.cloudflare.api.account",
+  "com.cloudflare.api.account.zone",
+  "com.cloudflare.api.user",
+  "com.cloudflare.edge.r2.bucket",
+]);
+
+/**
+ * Bucket permission groups by resource scope into Cloudflare's policy shape.
+ * Groups whose scope has no known bucket are dropped — they cannot be granted.
+ */
+export const tokenPolicies = (
+  accountIds: ReadonlyArray<string>,
+  userId: string,
+  groups: ReadonlyArray<PermissionGroup>,
+): TokenPolicy[] => {
+  const buckets: Record<string, TokenPolicy> = {
+    "com.cloudflare.api.account": {
+      effect: "allow",
+      permissionGroups: [],
+      resources: Object.fromEntries(
+        accountIds.map((id) => [`com.cloudflare.api.account.${id}`, "*"]),
+      ),
+    },
+    "com.cloudflare.api.account.zone": {
+      effect: "allow",
+      permissionGroups: [],
+      resources: { "com.cloudflare.api.account.zone.*": "*" },
+    },
+    "com.cloudflare.api.user": {
+      effect: "allow",
+      permissionGroups: [],
+      resources: { [`com.cloudflare.api.user.${userId}`]: "*" },
+    },
+    "com.cloudflare.edge.r2.bucket": {
+      effect: "allow",
+      permissionGroups: [],
+      resources: { "com.cloudflare.edge.r2.bucket.*": "*" },
+    },
+  };
+  const seen = new Set<string>();
+  for (const group of groups) {
+    const bucket = buckets[group.scopes[0]!];
+    if (bucket === undefined || seen.has(group.id)) continue;
+    seen.add(group.id);
+    bucket.permissionGroups.push({ id: group.id });
+  }
+  return Object.values(buckets).filter(
+    (policy) => policy.permissionGroups.length > 0,
+  );
+};

package/src/Cloudflare/CloudflareEnvironment.ts

@@ -3,13 +3,12 @@ import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
-import { getAuthProvider } from "../Auth/AuthProvider.ts";
-import { ALCHEMY_PROFILE, AlchemyProfile } from "../Auth/Profile.ts";
+import { resolveProviderConfig } from "../Auth/Resolve.ts";
 import {
   CLOUDFLARE_AUTH_PROVIDER_NAME,
   type CloudflareAuthConfig,
   type CloudflareResolvedCredentials,
-} from "./Auth/AuthProvider.ts";
+} from "./Auth/AuthConfig.ts";
 
 export class CloudflareEnvironment extends Context.Service<
   CloudflareEnvironment,
@@ -36,22 +35,13 @@ export const fromProfile = () =>
   Layer.effect(
     CloudflareEnvironment,
     Effect.gen(function* () {
-      const profile = yield* AlchemyProfile;
-      const auth = yield* getAuthProvider<
+      // In CI this resolves directly from environment variables. Otherwise it
+      // reads the persisted config under the canonical provider name and only
+      // configures/persists when no local config exists.
+      const { resolve } = yield* resolveProviderConfig<
         CloudflareAuthConfig,
         CloudflareResolvedCredentials
       >(CLOUDFLARE_AUTH_PROVIDER_NAME);
-      const profileName = yield* ALCHEMY_PROFILE;
-      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
-      // `loadOrConfigure` reads the persisted config under the canonical
-      // provider name (`Cloudflare`); only runs `configure` (and persists the
-      // result) if no stored config exists.
-      return yield* profile.loadOrConfigure(auth, profileName, { ci }).pipe(
-        Effect.flatMap((config) =>
-          auth.read(profileName, config as CloudflareAuthConfig),
-        ),
-        Effect.orDie,
-        Effect.cached,
-      );
+      return yield* resolve.pipe(Effect.orDie, Effect.cached);
     }),
   );

package/src/Cloudflare/Containers/Container.ts

@@ -82,7 +82,9 @@ export class ContainerCrashedError extends Data.TaggedError(
   readonly cause?: unknown;
 }> {}
 
-export interface ContainerStartupOptions extends cf.ContainerStartupOptions {}
+// Upstream changed ContainerStartupOptions to an intersection with an
+// image/containerSnapshot union, which an interface cannot extend.
+export type ContainerStartupOptions = cf.ContainerStartupOptions;
 
 import type {
   EffectfulContainerProps,
@@ -167,7 +169,7 @@ export type Container<Id extends string = string> = Named<Id> & {
  * runtime. Keeping them separate ensures the bundler only includes
  * the tiny class in the DO's output.
  *
- * See the [Platform concept](/infrastructure-as-effects/functions-and-servers)
+ * See the [Runtime concept](/infrastructure-as-effects/runtime)
  * page for how this fits into the async / effect / layer
  * progression.
  * ### Container Layer
@@ -358,16 +360,13 @@ export type Container<Id extends string = string> = Named<Id> & {
  * ```
  *
  * ### Bundling & Tree-shaking
- * `main` is bundled with rolldown at deploy time. Top-level calls in the
- * `effect`, `@effect/*`, `alchemy`, `@alchemy.run/*`, and
- * `@distilled.cloud/*` packages receive `#__PURE__` annotations by
- * default, so anything the container program doesn't use from those packages is
- * tree-shaken out of the bundle. Any other package — including your own
- * app — is left untouched unless you list it explicitly.
- *
- * **Example:** Treat additional packages as pure
- * Pass package names (or picomatch globs) via `build.pure.packages` to
- * annotate them in addition to the defaults.
+ * `main` is bundled with rolldown at deploy time. Unused code is
+ * tree-shaken. `effect`, alchemy, and `@distilled.cloud` are marked
+ * pure so unused parts prune more aggressively. Your app is not
+ * marked pure.
+ *
+ * **Example:** Mark additional packages as pure
+ * Only list packages with no top-level side effects.
  * ```typescript
  * {
  *   main: import.meta.url,
@@ -377,18 +376,7 @@ export type Container<Id extends string = string> = Named<Id> & {
  * }
  * ```
  *
- * Listing a package annotates calls whose result is bound (variable
- * initializers, exports) — safe anywhere. If a listed package also
- * declares `"sideEffects": false` (or `[]`) in its `package.json`, that
- * combination opts it into full annotation: top-level calls whose result
- * is discarded (e.g. `router.on("/path", handler)` registrations) are
- * also marked pure and deleted under minification when unused. Only list
- * a `sideEffects: false` package if its modules really are free of
- * meaningful top-level side effects. The `effect`, `alchemy`, and
- * `@distilled.cloud` defaults declare exactly that, on purpose — their
- * modules are designed to be fully tree-shakeable.
- *
- * **Example:** Disable pure annotations
+ * **Example:** Turn it off
  * ```typescript
  * {
  *   main: import.meta.url,

package/src/Cloudflare/Containers/ContainerApplication.ts

@@ -262,11 +262,10 @@ export interface EffectfulContainerProps extends ContainerApplicationPropsBase {
    */
   autoInstallExternals?: boolean;
   /**
-   * Bundler configuration for {@link main}: rolldown `input`/`output`
-   * overrides plus pure-annotation options (`pure`). `effect`, `@effect/*`,
-   * `alchemy`, `@alchemy.run/*`, and `@distilled.cloud/*` are annotated as
-   * pure by default so unused code from those packages is tree-shaken; list
-   * additional packages via `pure.packages`, or disable with `pure: false`.
+   * Bundler configuration for {@link main}. Unused code is tree-shaken.
+   * `effect`, alchemy, and `@distilled.cloud` are marked pure so unused
+   * parts prune more aggressively. List extra packages with
+   * `pure.packages`, or disable with `pure: false`.
    */
   build?: Bundle.BundleConfig;
 }
@@ -481,16 +480,13 @@ export type ContainerShape = Main<ContainerServices>;
  * bundled program is still layered on top.
  *
  * ### Bundling & Tree-shaking
- * `main` is bundled with rolldown at deploy time. Top-level calls in the
- * `effect`, `@effect/*`, `alchemy`, `@alchemy.run/*`, and
- * `@distilled.cloud/*` packages receive `#__PURE__` annotations by
- * default, so anything the container program doesn't use from those packages is
- * tree-shaken out of the bundle. Any other package — including your own
- * app — is left untouched unless you list it explicitly.
- *
- * **Example:** Treat additional packages as pure
- * Pass package names (or picomatch globs) via `build.pure.packages` to
- * annotate them in addition to the defaults.
+ * `main` is bundled with rolldown at deploy time. Unused code is
+ * tree-shaken. `effect`, alchemy, and `@distilled.cloud` are marked
+ * pure so unused parts prune more aggressively. Your app is not
+ * marked pure.
+ *
+ * **Example:** Mark additional packages as pure
+ * Only list packages with no top-level side effects.
  * ```typescript
  * {
  *   main: import.meta.url,
@@ -500,18 +496,7 @@ export type ContainerShape = Main<ContainerServices>;
  * }
  * ```
  *
- * Listing a package annotates calls whose result is bound (variable
- * initializers, exports) — safe anywhere. If a listed package also
- * declares `"sideEffects": false` (or `[]`) in its `package.json`, that
- * combination opts it into full annotation: top-level calls whose result
- * is discarded (e.g. `router.on("/path", handler)` registrations) are
- * also marked pure and deleted under minification when unused. Only list
- * a `sideEffects: false` package if its modules really are free of
- * meaningful top-level side effects. The `effect`, `alchemy`, and
- * `@distilled.cloud` defaults declare exactly that, on purpose — their
- * modules are designed to be fully tree-shakeable.
- *
- * **Example:** Disable pure annotations
+ * **Example:** Turn it off
  * ```typescript
  * {
  *   main: import.meta.url,

package/src/Cloudflare/Credentials.ts

@@ -6,19 +6,17 @@ import {
   type ResolvedCredentials,
 } from "@distilled.cloud/cloudflare/Credentials";
 import { ConfigError } from "@distilled.cloud/core/errors";
-import * as Config from "effect/Config";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Match from "effect/Match";
 import * as Redacted from "effect/Redacted";
-import * as Semaphore from "effect/Semaphore";
-import { getAuthProvider } from "../Auth/AuthProvider.ts";
-import { ALCHEMY_PROFILE, AlchemyProfile } from "../Auth/Profile.ts";
+import * as CredentialsCache from "../Auth/CredentialsCache.ts";
+import { resolveProviderConfig } from "../Auth/Resolve.ts";
 import {
   CLOUDFLARE_AUTH_PROVIDER_NAME,
   type CloudflareAuthConfig,
   type CloudflareResolvedCredentials,
-} from "./Auth/AuthProvider.ts";
+} from "./Auth/AuthConfig.ts";
 
 export { Credentials, fromEnv } from "@distilled.cloud/cloudflare/Credentials";
 
@@ -28,87 +26,35 @@ declare module "@distilled.cloud/cloudflare/Credentials" {
   }
 }
 
-/**
- * Refresh OAuth credentials this long before they actually expire so that
- * in-flight requests never race the expiry deadline.
- */
-const CREDENTIAL_REFRESH_WINDOW_MS = 5 * 60 * 1000;
-
-const getRefreshAt = (
-  credentials: ResolvedCredentials,
-  now: number,
-): number => {
-  if (credentials.type !== "oauth" || credentials.expiresAt === undefined) {
-    return Number.POSITIVE_INFINITY;
-  }
-  return credentials.expiresAt <= now + CREDENTIAL_REFRESH_WINDOW_MS
-    ? credentials.expiresAt
-    : credentials.expiresAt - CREDENTIAL_REFRESH_WINDOW_MS;
-};
-
 /**
  * Memoize a credentials-resolution effect until shortly before the resolved
- * credentials expire.
- *
- * The distilled HTTP client resolves the `Credentials` service's effect on
- * *every* request (`yield* config.credentials`), which is what allows OAuth
- * tokens to rotate mid-process — a dev session can outlive the ~1h access
- * token, so caching the first resolution forever leaves the process making
- * API calls with a dead token until restart. At the same time, resolution
- * acquires a cross-process file lock (`auth.read`), so resolving fresh on
- * every request would stampede that lock under high concurrency (e.g.
- * `unsafe nuke`).
- *
- * This cache serves both needs: callers get the cached credentials while
- * they are still valid, the resolver re-runs (refreshing + persisting the
- * token) once the refresh window is reached, and a mutex makes resolution
- * single-flight so concurrent callers share one lock acquisition.
+ * credentials expire — see {@link CredentialsCache.cacheUntilExpiry} for the
+ * caching rules. Non-OAuth credentials (API token / global key) never expire
+ * and cache forever.
  */
 export const cacheUntilExpiry = <E>(
   resolve: Effect.Effect<ResolvedCredentials, E>,
-  now: () => number = () => Date.now(),
-): Effect.Effect<ResolvedCredentials, E> => {
-  const mutex = Semaphore.makeUnsafe(1);
-  let cached:
-    | { credentials: ResolvedCredentials; refreshAt: number }
-    | undefined;
-  return Semaphore.withPermits(
-    mutex,
-    1,
-  )(
-    Effect.suspend(() => {
-      if (cached && now() < cached.refreshAt) {
-        return Effect.succeed(cached.credentials);
-      }
-      return Effect.map(resolve, (credentials) => {
-        cached = { credentials, refreshAt: getRefreshAt(credentials, now()) };
-        return credentials;
-      });
-    }),
+) =>
+  CredentialsCache.cacheUntilExpiry(resolve, (credentials) =>
+    credentials.type === "oauth" ? credentials.expiresAt : undefined,
   );
-};
 
 /**
  * Build a `Credentials` layer that resolves Cloudflare credentials via the
  * Alchemy AuthProvider using the configured profile (defaults to "default",
- * overridable with the `ALCHEMY_PROFILE` env/config value).
+ * selected by the current Alchemy profile).
  */
 export const fromAuthProvider = () =>
   Layer.effect(
     Credentials,
     Effect.gen(function* () {
-      const profile = yield* AlchemyProfile;
-      const auth = yield* getAuthProvider<
-        CloudflareAuthConfig,
-        CloudflareResolvedCredentials
-      >(CLOUDFLARE_AUTH_PROVIDER_NAME);
-      const profileName = yield* ALCHEMY_PROFILE;
-      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+      const { profileName, resolve: resolveAuth } =
+        yield* resolveProviderConfig<
+          CloudflareAuthConfig,
+          CloudflareResolvedCredentials
+        >(CLOUDFLARE_AUTH_PROVIDER_NAME);
 
-      const resolve = profile.loadOrConfigure(auth, profileName, { ci }).pipe(
-        Effect.flatMap((config) =>
-          auth.read(profileName, config as CloudflareAuthConfig),
-        ),
+      const resolve = resolveAuth.pipe(
         Effect.map((creds) =>
           Match.value(creds).pipe(
             Match.when({ type: "apiToken" }, (c) =>
@@ -134,7 +80,7 @@ export const fromAuthProvider = () =>
         Effect.mapError(
           (e) =>
             new ConfigError({
-              message: `Failed to resolve Cloudflare credentials for profile '${profileName}': ${(e as { message?: string }).message ?? String(e)}`,
+              message: `Failed to resolve Cloudflare credentials from ${profileName === undefined ? "the CI environment" : `profile '${profileName}'`}: ${(e as { message?: string }).message ?? String(e)}`,
             }),
         ),
       );
@@ -143,6 +89,6 @@ export const fromAuthProvider = () =>
       // re-run, so expiry-aware caching (instead of caching the first
       // resolution forever) is what keeps long-lived dev sessions
       // authenticated across the ~1h access-token lifetime.
-      return cacheUntilExpiry(resolve);
+      return yield* cacheUntilExpiry(resolve);
     }),
   );

package/src/Cloudflare/EdgeSession.ts

@@ -1,3 +1,4 @@
+import { DEFAULT_COMPATIBILITY_DATE } from "@alchemy.run/cloudflare-runtime/core/internal/constants";
 import { Credentials } from "@distilled.cloud/cloudflare/Credentials";
 import * as workers from "@distilled.cloud/cloudflare/workers";
 import * as Data from "effect/Data";
@@ -33,7 +34,7 @@ export interface EdgeSessionOptions {
   readonly files: ReadonlyArray<File>;
   /** Remote bindings attached to the preview worker. */
   readonly bindings: ReadonlyArray<EdgeBinding>;
-  /** @default "2025-04-28" */
+  /** @default "2026-08-31" */
   readonly compatibilityDate?: string;
 }
 
@@ -47,8 +48,6 @@ export interface EdgeSessionHandle {
   readonly headers: Record<string, string>;
 }
 
-const DEFAULT_COMPATIBILITY_DATE = "2025-04-28";
-
 const wrap = <A, E, R>(effect: Effect.Effect<A, E, R>, message: string) =>
   effect.pipe(
     Effect.mapError((cause) => new EdgeSessionError({ message, cause })),

package/src/Cloudflare/Logs.ts

@@ -6,6 +6,7 @@ import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import * as Socket from "effect/unstable/socket/Socket";
 import type { LogLine, LogsInput } from "../Provider.ts";
+import { profileCommandHint } from "../Util/interactive.ts";
 
 const DEFAULT_LOOKBACK_MS = 1 * 60 * 60 * 1000;
 
@@ -80,7 +81,7 @@ export const CloudflareLogs = Effect.gen(function* () {
 
   /**
    * The telemetry query needs the `workers_observability:read` OAuth scope.
-   * A token minted by an older `alchemy login` (before the scope joined the
+   * A token minted by an older login (before the scope joined the
    * defaults) keeps its original grants forever, so the query fails with a
    * bare `Unauthorized`/`Forbidden` even though a fresh login would work —
    * explain the fix instead of surfacing the raw tag.
@@ -90,15 +91,20 @@ export const CloudflareLogs = Effect.gen(function* () {
   ): Effect.Effect<A, workers.QueryObservabilityTelemetryError, R> =>
     effect.pipe(
       Effect.catchTag("Unauthorized", () =>
-        Effect.die(
-          new Error(
-            "Cloudflare rejected the observability telemetry query (Unauthorized). " +
-              'Your stored credentials are likely missing the "workers_observability:read" scope — ' +
-              "OAuth tokens keep the scopes they were minted with, so tokens from an older " +
-              "`alchemy login` won't have it. Run `alchemy login` again to mint a token with " +
-              "the current default scopes, or use an API token that grants Workers Observability read access.",
-          ),
-        ),
+        Effect.gen(function* () {
+          const command = yield* profileCommandHint(
+            "alchemy profile edit --reconfigure Cloudflare",
+          );
+          return yield* Effect.die(
+            new Error(
+              "Cloudflare rejected the observability telemetry query (Unauthorized). " +
+                'Your stored credentials are likely missing the "workers_observability:read" scope — ' +
+                "OAuth tokens keep the scopes they were minted with, so tokens minted by " +
+                `an older login won't have it. Run \`${command}\` to mint a token with ` +
+                "the current default scopes, or use an API token that grants Workers Observability read access.",
+            ),
+          );
+        }),
       ),
     );
 

package/src/Cloudflare/Pages/Project.ts

@@ -218,7 +218,7 @@ export type Project = Resource<
  * const project = yield* Cloudflare.Pages.Project("site", {
  *   deploymentConfigs: {
  *     production: {
- *       compatibilityDate: "2025-01-01",
+ *       compatibilityDate: "2026-08-31",
  *       envVars: {
  *         API_URL: { value: "https://api.example.com" },
  *         API_KEY: { type: "secret_text", value: apiKey },

package/src/Cloudflare/Providers.ts

@@ -1,7 +1,7 @@
 import { Retry } from "@distilled.cloud/cloudflare";
 import * as Layer from "effect/Layer";
 import { CredentialsStoreLive } from "../Auth/Credentials.ts";
-import { ProfileLive } from "../Auth/Profile.ts";
+import { ProfileStoreLive } from "../Auth/Profile.ts";
 import * as Command from "../Command/index.ts";
 import { DockerLive } from "../Docker/Docker.ts";
 import { KeyPair, KeyPairProvider } from "../KeyPair.ts";
@@ -716,7 +716,7 @@ export const CloudflareApiLive = () =>
     Layer.provideMerge(CloudflareEnvironment.fromProfile()),
     Layer.provideMerge(CloudflareAuth),
     Layer.provideMerge(Access.AccessLive),
-    Layer.provideMerge(ProfileLive),
+    Layer.provideMerge(ProfileStoreLive),
     Layer.provideMerge(CredentialsStoreLive),
     Layer.provideMerge(Layer.succeed(Retry.Retry, Retry.makeDefault)),
   );

package/src/Cloudflare/StateStore/Api.ts

@@ -1,3 +1,4 @@
+import { DEFAULT_COMPATIBILITY_DATE } from "@alchemy.run/cloudflare-runtime/core/internal/constants";
 import { Redacted } from "effect";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
@@ -105,8 +106,7 @@ export default Worker(
     main: import.meta.url,
     workersDev: true,
     compatibility: {
-      flags: ["nodejs_compat"],
-      date: "2026-03-17",
+      date: DEFAULT_COMPATIBILITY_DATE,
     },
   },
   Effect.gen(function* () {

package/src/Cloudflare/StateStore/CredentialsFile.ts

@@ -1,4 +1,4 @@
-import type { HttpStateStoreCredentials } from "../../State/HttpStateStore.ts";
+import * as Schema from "effect/Schema";
 
 /**
  * Filename (under `~/.alchemy/credentials/{profile}/`) used to cache the
@@ -6,7 +6,7 @@ import type { HttpStateStoreCredentials } from "../../State/HttpStateStore.ts";
  *
  * Kept in this leaf module (rather than `StateStore/State.ts`) so the
  * Cloudflare auth provider can invalidate the cache on
- * `login --configure` / `logout` without importing the heavy state-store
+ * `profile edit` / provider logout without importing the heavy state-store
  * module and creating an import cycle
  * (`StateStore/State.ts` -> `Providers.ts` -> `Auth/AuthProvider.ts`).
  */
@@ -15,7 +15,7 @@ export const CREDENTIALS_FILE = "cloudflare-state-store";
 /**
  * On-disk shape of the cached Cloudflare state-store credentials.
  *
- * Extends the generic {@link HttpStateStoreCredentials} (`{ url, authToken }`)
+ * Extends the generic `HttpStateStoreCredentials` (`{ url, authToken }`)
  * with the `accountId` the credentials were minted against. The `url` already
  * encodes the account (via the `*.workers.dev` subdomain), so a cache written
  * while logged into account A keeps pointing at account A's state store even
@@ -26,10 +26,15 @@ export const CREDENTIALS_FILE = "cloudflare-state-store";
  * still parse — they are treated as stale (see
  * {@link isStateStoreCredentialsStale}) and re-derived on next use.
  */
-export interface StoredStateStoreCredentials extends HttpStateStoreCredentials {
+export const StoredStateStoreCredentials = Schema.Struct({
+  url: Schema.String,
+  /** Bearer token used to authenticate every request. */
+  authToken: Schema.String,
   /** Cloudflare account ID the `url`/`authToken` were minted against. */
-  accountId?: string;
-}
+  accountId: Schema.optional(Schema.String),
+});
+export type StoredStateStoreCredentials =
+  typeof StoredStateStoreCredentials.Type;
 
 /**
  * `true` when cached state-store credentials must not be trusted for the