alchemy 2.0.0-beta.76 → 2.0.0-beta.78

package/src/Cloudflare/Auth/TokenPolicy.ts

@@ -0,0 +1,79 @@
+/**
+ * Cloudflare expresses an API token's grants as *policies*: one entry per
+ * resource scope, each listing the permission groups allowed on it. The
+ * catalog hands back a flat list of permission groups, so minting a token
+ * means bucketing those groups by the scope they belong to.
+ */
+
+/**
+ * One `{effect, permissionGroups, resources}` entry in a token's policy list.
+ * Mutable to match the shape Cloudflare's create-token request expects.
+ */
+export interface TokenPolicy {
+  effect: "allow";
+  permissionGroups: Array<{ id: string }>;
+  resources: Record<string, string>;
+}
+
+/** A permission group as returned by Cloudflare's token-permissions catalog. */
+export interface PermissionGroup {
+  readonly id: string;
+  readonly name: string;
+  readonly category?: string;
+  readonly scopes: ReadonlyArray<string>;
+  /** Whether this group's scope maps onto a policy we know how to express. */
+  readonly selectable: boolean;
+}
+
+/** Scopes we know how to turn into a policy; anything else is not offerable. */
+export const selectableScopes: ReadonlySet<string> = new Set([
+  "com.cloudflare.api.account",
+  "com.cloudflare.api.account.zone",
+  "com.cloudflare.api.user",
+  "com.cloudflare.edge.r2.bucket",
+]);
+
+/**
+ * Bucket permission groups by resource scope into Cloudflare's policy shape.
+ * Groups whose scope has no known bucket are dropped — they cannot be granted.
+ */
+export const tokenPolicies = (
+  accountIds: ReadonlyArray<string>,
+  userId: string,
+  groups: ReadonlyArray<PermissionGroup>,
+): TokenPolicy[] => {
+  const buckets: Record<string, TokenPolicy> = {
+    "com.cloudflare.api.account": {
+      effect: "allow",
+      permissionGroups: [],
+      resources: Object.fromEntries(
+        accountIds.map((id) => [`com.cloudflare.api.account.${id}`, "*"]),
+      ),
+    },
+    "com.cloudflare.api.account.zone": {
+      effect: "allow",
+      permissionGroups: [],
+      resources: { "com.cloudflare.api.account.zone.*": "*" },
+    },
+    "com.cloudflare.api.user": {
+      effect: "allow",
+      permissionGroups: [],
+      resources: { [`com.cloudflare.api.user.${userId}`]: "*" },
+    },
+    "com.cloudflare.edge.r2.bucket": {
+      effect: "allow",
+      permissionGroups: [],
+      resources: { "com.cloudflare.edge.r2.bucket.*": "*" },
+    },
+  };
+  const seen = new Set<string>();
+  for (const group of groups) {
+    const bucket = buckets[group.scopes[0]!];
+    if (bucket === undefined || seen.has(group.id)) continue;
+    seen.add(group.id);
+    bucket.permissionGroups.push({ id: group.id });
+  }
+  return Object.values(buckets).filter(
+    (policy) => policy.permissionGroups.length > 0,
+  );
+};

package/src/Cloudflare/Bridge.ts

@@ -1,4 +1,13 @@
+/**
+ * Runtime bridge factories and RPC helpers. This entry must not depend on
+ * resource providers or local development tooling, even through dynamic imports.
+ */
 export * from "./Fetcher.ts";
 export * from "./Workers/InferEnv.ts";
 export * from "./Workers/Rpc.ts";
 export * from "./Workers/RpcAsync.ts";
+
+// ── runtime bridge factories ──
+export { makeDurableObjectBridge } from "./Workers/DurableObjectBridge.ts";
+export { makeWorkerBridge } from "./Workers/WorkerBridge.ts";
+export { makeWorkflowBridge } from "./Workflows/WorkflowBridge.ts";

package/src/Cloudflare/CloudflareEnvironment.ts

@@ -1,24 +1,19 @@
 import * as Config from "effect/Config";
-import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
-import { getAuthProvider } from "../Auth/AuthProvider.ts";
-import { ALCHEMY_PROFILE, AlchemyProfile } from "../Auth/Profile.ts";
+import { resolveProviderConfig } from "../Auth/Resolve.ts";
 import {
   CLOUDFLARE_AUTH_PROVIDER_NAME,
   type CloudflareAuthConfig,
   type CloudflareResolvedCredentials,
-} from "./Auth/AuthProvider.ts";
+} from "./Auth/AuthConfig.ts";
 
-export class CloudflareEnvironment extends Context.Service<
-  CloudflareEnvironment,
-  Effect.Effect<CloudflareResolvedCredentials>
->()("Cloudflare::CloudflareEnvironment") {
-  readonly kind = "Environment" as const;
-}
+import { CloudflareEnvironment } from "./CloudflareEnvironmentService.ts";
 
-const CLOUDFLARE_ACCOUNT_ID = Config.string("CLOUDFLARE_ACCOUNT_ID");
+export { CloudflareEnvironment } from "./CloudflareEnvironmentService.ts";
+
+const CLOUDFLARE_ACCOUNT_ID = Config.String("CLOUDFLARE_ACCOUNT_ID");
 
 export const fromEnv = () =>
   Layer.effect(
@@ -36,22 +31,13 @@ export const fromProfile = () =>
   Layer.effect(
     CloudflareEnvironment,
     Effect.gen(function* () {
-      const profile = yield* AlchemyProfile;
-      const auth = yield* getAuthProvider<
+      // In CI this resolves directly from environment variables. Otherwise it
+      // reads the persisted config under the canonical provider name and only
+      // configures/persists when no local config exists.
+      const { resolve } = yield* resolveProviderConfig<
         CloudflareAuthConfig,
         CloudflareResolvedCredentials
       >(CLOUDFLARE_AUTH_PROVIDER_NAME);
-      const profileName = yield* ALCHEMY_PROFILE;
-      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
-      // `loadOrConfigure` reads the persisted config under the canonical
-      // provider name (`Cloudflare`); only runs `configure` (and persists the
-      // result) if no stored config exists.
-      return yield* profile.loadOrConfigure(auth, profileName, { ci }).pipe(
-        Effect.flatMap((config) =>
-          auth.read(profileName, config as CloudflareAuthConfig),
-        ),
-        Effect.orDie,
-        Effect.cached,
-      );
+      return yield* resolve.pipe(Effect.orDie, Effect.cached);
     }),
   );

package/src/Cloudflare/CloudflareEnvironmentService.ts

@@ -0,0 +1,10 @@
+import * as Context from "effect/Context";
+import type * as Effect from "effect/Effect";
+import type { CloudflareResolvedCredentials } from "./Auth/AuthConfig.ts";
+
+export class CloudflareEnvironment extends Context.Service<
+  CloudflareEnvironment,
+  Effect.Effect<CloudflareResolvedCredentials>
+>()("Cloudflare::CloudflareEnvironment") {
+  readonly kind = "Environment" as const;
+}

package/src/Cloudflare/Containers/Container.ts

@@ -82,7 +82,9 @@ export class ContainerCrashedError extends Data.TaggedError(
   readonly cause?: unknown;
 }> {}
 
-export interface ContainerStartupOptions extends cf.ContainerStartupOptions {}
+// Upstream changed ContainerStartupOptions to an intersection with an
+// image/containerSnapshot union, which an interface cannot extend.
+export type ContainerStartupOptions = cf.ContainerStartupOptions;
 
 import type {
   EffectfulContainerProps,
@@ -167,7 +169,7 @@ export type Container<Id extends string = string> = Named<Id> & {
  * runtime. Keeping them separate ensures the bundler only includes
  * the tiny class in the DO's output.
  *
- * See the [Platform concept](/infrastructure-as-effects/functions-and-servers)
+ * See the [Runtime concept](/infrastructure-as-effects/runtime)
  * page for how this fits into the async / effect / layer
  * progression.
  * ### Container Layer
@@ -358,16 +360,13 @@ export type Container<Id extends string = string> = Named<Id> & {
  * ```
  *
  * ### Bundling & Tree-shaking
- * `main` is bundled with rolldown at deploy time. Top-level calls in the
- * `effect`, `@effect/*`, `alchemy`, `@alchemy.run/*`, and
- * `@distilled.cloud/*` packages receive `#__PURE__` annotations by
- * default, so anything the container program doesn't use from those packages is
- * tree-shaken out of the bundle. Any other package — including your own
- * app — is left untouched unless you list it explicitly.
- *
- * **Example:** Treat additional packages as pure
- * Pass package names (or picomatch globs) via `build.pure.packages` to
- * annotate them in addition to the defaults.
+ * `main` is bundled with rolldown at deploy time. Unused code is
+ * tree-shaken. `effect`, alchemy, and `@distilled.cloud` are marked
+ * pure so unused parts prune more aggressively. Your app is not
+ * marked pure.
+ *
+ * **Example:** Mark additional packages as pure
+ * Only list packages with no top-level side effects.
  * ```typescript
  * {
  *   main: import.meta.url,
@@ -377,18 +376,7 @@ export type Container<Id extends string = string> = Named<Id> & {
  * }
  * ```
  *
- * Listing a package annotates calls whose result is bound (variable
- * initializers, exports) — safe anywhere. If a listed package also
- * declares `"sideEffects": false` (or `[]`) in its `package.json`, that
- * combination opts it into full annotation: top-level calls whose result
- * is discarded (e.g. `router.on("/path", handler)` registrations) are
- * also marked pure and deleted under minification when unused. Only list
- * a `sideEffects: false` package if its modules really are free of
- * meaningful top-level side effects. The `effect`, `alchemy`, and
- * `@distilled.cloud` defaults declare exactly that, on purpose — their
- * modules are designed to be fully tree-shakeable.
- *
- * **Example:** Disable pure annotations
+ * **Example:** Turn it off
  * ```typescript
  * {
  *   main: import.meta.url,

package/src/Cloudflare/Containers/ContainerApplication.ts

@@ -8,7 +8,7 @@ import {
   type PlatformServices,
 } from "../../Platform.ts";
 import { Resource } from "../../Resource.ts";
-import * as Server from "../../Server/index.ts";
+import type { ProcessServices } from "../../Server/Process.ts";
 import type { Providers } from "../Providers.ts";
 import type { InlineDockerfile } from "../../Docker/Dockerfile.ts";
 import { ContainerTypeId } from "./Container.ts";
@@ -108,7 +108,8 @@ export interface ContainerApplicationPropsBase extends PlatformProps {
   /**
    * Instance type for each deployment. Defaults to wrangler's `"lite"` tier
    * (1/16 vCPU, 256 MiB, 2 GB disk) when no explicit {@link vcpu}/{@link memory}/
-   * {@link disk} is set. (`"dev"` is wrangler's deprecated alias for `"lite"`.)
+   * {@link memoryMib}/{@link disk} is set. (`"dev"` is wrangler's deprecated
+   * alias for `"lite"`.)
    * @default "lite"
    */
   instanceType?: ContainerApplication.InstanceType;
@@ -132,6 +133,12 @@ export interface ContainerApplicationPropsBase extends PlatformProps {
    * Memory allocation override for each deployment.
    */
   memory?: string;
+  /**
+   * Memory allocation override for each deployment, in MiB.
+   * Custom sizing requires at least 1 {@link vcpu} and 3072 MiB of memory
+   * per vCPU for the first 4 vCPUs.
+   */
+  memoryMib?: number;
   /**
    * Disk allocation override for each deployment.
    */
@@ -262,11 +269,10 @@ export interface EffectfulContainerProps extends ContainerApplicationPropsBase {
    */
   autoInstallExternals?: boolean;
   /**
-   * Bundler configuration for {@link main}: rolldown `input`/`output`
-   * overrides plus pure-annotation options (`pure`). `effect`, `@effect/*`,
-   * `alchemy`, `@alchemy.run/*`, and `@distilled.cloud/*` are annotated as
-   * pure by default so unused code from those packages is tree-shaken; list
-   * additional packages via `pure.packages`, or disable with `pure: false`.
+   * Bundler configuration for {@link main}. Unused code is tree-shaken.
+   * `effect`, alchemy, and `@distilled.cloud` are marked pure so unused
+   * parts prune more aggressively. List extra packages with
+   * `pure.packages`, or disable with `pure: false`.
    */
   build?: Bundle.BundleConfig;
 }
@@ -345,7 +351,7 @@ export interface AnyContainerApplicationProps extends ContainerApplicationPropsB
 export type ContainerServices =
   | ContainerApplication
   | PlatformServices
-  | Server.ProcessServices;
+  | ProcessServices;
 
 export type ContainerShape = Main<ContainerServices>;
 
@@ -481,16 +487,13 @@ export type ContainerShape = Main<ContainerServices>;
  * bundled program is still layered on top.
  *
  * ### Bundling & Tree-shaking
- * `main` is bundled with rolldown at deploy time. Top-level calls in the
- * `effect`, `@effect/*`, `alchemy`, `@alchemy.run/*`, and
- * `@distilled.cloud/*` packages receive `#__PURE__` annotations by
- * default, so anything the container program doesn't use from those packages is
- * tree-shaken out of the bundle. Any other package — including your own
- * app — is left untouched unless you list it explicitly.
- *
- * **Example:** Treat additional packages as pure
- * Pass package names (or picomatch globs) via `build.pure.packages` to
- * annotate them in addition to the defaults.
+ * `main` is bundled with rolldown at deploy time. Unused code is
+ * tree-shaken. `effect`, alchemy, and `@distilled.cloud` are marked
+ * pure so unused parts prune more aggressively. Your app is not
+ * marked pure.
+ *
+ * **Example:** Mark additional packages as pure
+ * Only list packages with no top-level side effects.
  * ```typescript
  * {
  *   main: import.meta.url,
@@ -500,18 +503,7 @@ export type ContainerShape = Main<ContainerServices>;
  * }
  * ```
  *
- * Listing a package annotates calls whose result is bound (variable
- * initializers, exports) — safe anywhere. If a listed package also
- * declares `"sideEffects": false` (or `[]`) in its `package.json`, that
- * combination opts it into full annotation: top-level calls whose result
- * is discarded (e.g. `router.on("/path", handler)` registrations) are
- * also marked pure and deleted under minification when unused. Only list
- * a `sideEffects: false` package if its modules really are free of
- * meaningful top-level side effects. The `effect`, `alchemy`, and
- * `@distilled.cloud` defaults declare exactly that, on purpose — their
- * modules are designed to be fully tree-shakeable.
- *
- * **Example:** Disable pure annotations
+ * **Example:** Turn it off
  * ```typescript
  * {
  *   main: import.meta.url,

package/src/Cloudflare/Containers/ContainerPlatform.ts

@@ -8,7 +8,7 @@ import {
   packEnvValueKeepRedacted,
   unpackEnvValue,
 } from "../../RuntimeContext.ts";
-import * as Server from "../../Server/index.ts";
+import type { ProcessContext } from "../../Server/Process.ts";
 import type { Fetcher } from "../Fetcher.ts";
 import { fromCloudflareFetcher, toCloudflareFetcher } from "../Fetcher.ts";
 import { DurableObject } from "../Workers/DurableObject.ts";
@@ -53,12 +53,12 @@ export const ContainerPlatform: Platform<
   ContainerApplication,
   ContainerServices,
   ContainerShape,
-  Server.ProcessContext,
+  ProcessContext,
   Container
 > = Platform(
   "Cloudflare.Container",
   {
-    createRuntimeContext: (id: string): Server.ProcessContext => {
+    createRuntimeContext: (id: string): ProcessContext => {
       const runners: Effect.Effect<void, never, any>[] = [];
       const env: Record<string, any> = {};
 
@@ -111,12 +111,12 @@ export const ContainerPlatform: Platform<
           }),
         get: <T>(key: string) =>
           // Read straight from `process.env` — see `unpackEnvValue` for why
-          // this must never resolve through `Config.string`.
+          // this must never resolve through `Config.String`.
           Effect.sync(() => unpackEnvValue<T>(process.env[key]) as T),
         run: ((effect: Effect.Effect<void, never, any>) =>
           Effect.sync(() => {
             runners.push(effect);
-          })) as unknown as Server.ProcessContext["run"],
+          })) as unknown as ProcessContext["run"],
         serve,
         exports: Effect.sync(() => ({
           default: Effect.all(
@@ -136,7 +136,7 @@ export const ContainerPlatform: Platform<
             },
           ),
         })),
-      } as Server.ProcessContext;
+      } as ProcessContext;
     },
   },
   {