alchemy 2.0.0-beta.81 → 2.0.0-beta.83

package/src/Cloudflare/Access/Group.ts

@@ -233,7 +233,7 @@ export const GroupProvider = () =>
               Effect.gen(function* () {
                 const existing = yield* findGroupByName(acct, name);
                 if (existing && existing.id) return existing;
-                return yield* Effect.fail(err);
+                return yield* err;
               }),
             ),
           );
@@ -289,7 +289,7 @@ const findGroupByName = (acct: string, name: string) =>
     Stream.filter((g): g is ObservedGroup => g.name === name),
     Stream.runHead,
     Effect.map(Option.getOrUndefined),
-    Effect.catch(() => Effect.succeed(undefined)),
+    Effect.orElseSucceed(() => undefined),
   );
 
 type ObservedGroup = {

package/src/Cloudflare/Access/Policy.ts

@@ -6,6 +6,7 @@ import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
+import { stripNullFields } from "../../Util/data.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Providers } from "../Providers.ts";
 
@@ -140,6 +141,14 @@ export type PolicyDecision =
   // outside the closed set still narrow cleanly.
   | (string & {});
 
+export type PolicyApprovalGroup = NonNullable<
+  zeroTrust.CreateAccessPolicyRequest["approvalGroups"]
+>[number];
+export type PolicyConnectionRules = NonNullable<
+  zeroTrust.CreateAccessPolicyRequest["connectionRules"]
+>;
+export type PolicyMfaConfig = NonNullable<zeroTrust.CreateAccessPolicyRequest["mfaConfig"]>;
+
 export type PolicyProps = {
   /**
    * Display name for the policy. Treated as a stable identifier so the
@@ -189,6 +198,35 @@ export type PolicyProps = {
    * @default false
    */
   purposeJustificationRequired?: boolean;
+  /**
+   * Custom message shown on the purpose justification screen.
+   */
+  purposeJustificationPrompt?: string;
+  /**
+   * Administrators who can approve a temporary authentication request.
+   */
+  approvalGroups?: PolicyApprovalGroup[];
+  /**
+   * Serve applications in an isolated browser for users matching this
+   * policy. Requires Clientless Web Isolation on the account.
+   *
+   * @default false
+   */
+  isolationRequired?: boolean;
+  /**
+   * How users may connect to targets secured by an infrastructure
+   * application: allowed SSH usernames, RDP clipboard formats.
+   *
+   * @example
+   * ```ts
+   * connectionRules: { ssh: { usernames: ["root", "ubuntu"] } }
+   * ```
+   */
+  connectionRules?: PolicyConnectionRules;
+  /**
+   * Multi-factor authentication settings enforced by this policy.
+   */
+  mfaConfig?: PolicyMfaConfig;
   /**
    * Adopt an existing reusable policy with the same name when the engine has
    * no prior state for this logical id.
@@ -233,6 +271,11 @@ export type Policy = Resource<
  * A reusable, account-scoped Cloudflare Access policy. Distinct from the
  * inline policies attached directly to an `Application` — a reusable
  * policy can be referenced by multiple applications by id.
+ *
+ * Optional fields you leave out keep their live value on update, so adopting
+ * a policy never drops rules you did not declare. Pass `[]` or `false` to
+ * clear one.
+ *
  * ### Creating a Policy
  * **Example:** Allow a single email domain
  * ```typescript
@@ -263,6 +306,18 @@ export type Policy = Resource<
  * });
  * ```
  *
+ * ### Infrastructure access
+ * **Example:** Allow SSH as specific Unix users
+ * ```typescript
+ * const policy = yield* Cloudflare.Access.Policy("SshOps", {
+ *   decision: "allow",
+ *   include: [{ emailDomain: "example.com" }],
+ *   connectionRules: {
+ *     ssh: { usernames: ["root", "ubuntu"], allowEmailAlias: true },
+ *   },
+ * });
+ * ```
+ *
  * @resource
  * @product Access
  * @category Cloudflare One (Zero Trust)
@@ -303,19 +358,14 @@ export const PolicyProvider = () =>
       // Observe — prefer cached policyId, fall back to a name lookup so
       // we recover from out-of-band deletes and partial state-persistence
       // failures.
-      let observed: ObservedPolicy | undefined;
+      let observed: RawPolicy | undefined;
       if (output?.policyId) {
         observed = yield* zeroTrust
           .getAccessPolicy({
             accountId: acct,
             policyId: output.policyId,
           })
-          .pipe(
-            Effect.map(toObserved),
-            Effect.catch((): Effect.Effect<ObservedPolicy | undefined> =>
-              Effect.succeed(undefined),
-            ),
-          );
+          .pipe(Effect.orElseSucceed((): RawPolicy | undefined => undefined));
       }
       if (!observed) {
         observed = yield* findPolicyByName(acct, name);
@@ -326,44 +376,26 @@ export const PolicyProvider = () =>
       let ensured: ObservedPolicy;
       if (!observed || !observed.id) {
         ensured = yield* zeroTrust
-          .createAccessPolicy({
-            accountId: acct,
-            name,
-            decision: news.decision,
-            include: normalizePolicyRules(news.include),
-            exclude: normalizePolicyRules(news.exclude),
-            require: normalizePolicyRules(news.require),
-            sessionDuration: news.sessionDuration,
-            approvalRequired: news.approvalRequired,
-            purposeJustificationRequired: news.purposeJustificationRequired,
-          })
+          .createAccessPolicy({ accountId: acct, ...policyBody(name, news) })
           .pipe(
             Effect.map(toObserved),
             Effect.catch((err) =>
               Effect.gen(function* () {
                 const existing = yield* findPolicyByName(acct, name);
                 if (existing && existing.id) return existing;
-                return yield* Effect.fail(err);
+                return yield* err;
               }),
             ),
           );
       } else {
-        // Sync — Cloudflare PUTs the policy as a whole replacement, so a
-        // single update converges every mutable field. Always issuing the
-        // PUT keeps the resource convergent against drift; the API is
-        // idempotent for equal payloads.
+        // Sync — Cloudflare PUTs the policy as a whole replacement and
+        // resets every field the body omits, so undeclared optional fields
+        // are sent back with their live value.
         const prior = observed;
         const updated = yield* zeroTrust.updateAccessPolicy({
           accountId: acct,
           policyId: prior.id!,
-          name,
-          decision: news.decision,
-          include: normalizePolicyRules(news.include),
-          exclude: normalizePolicyRules(news.exclude),
-          require: normalizePolicyRules(news.require),
-          sessionDuration: news.sessionDuration,
-          approvalRequired: news.approvalRequired,
-          purposeJustificationRequired: news.purposeJustificationRequired,
+          ...withLiveFields(policyBody(name, news), prior),
         });
         ensured = {
           id: updated.id ?? prior.id,
@@ -431,11 +463,7 @@ export const PolicyProvider = () =>
             accountId: acct,
             policyId: output.policyId,
           })
-          .pipe(
-            Effect.catch((): Effect.Effect<ObservedPolicy | undefined> =>
-              Effect.succeed(undefined),
-            ),
-          );
+          .pipe(Effect.orElseSucceed((): ObservedPolicy | undefined => undefined));
         if (direct && direct.id) {
           return {
             policyId: direct.id,
@@ -461,6 +489,48 @@ export const PolicyProvider = () =>
     }),
   });
 
+const policyBody = (name: string, news: PolicyProps) => ({
+  name,
+  decision: news.decision,
+  include: normalizePolicyRules(news.include),
+  exclude: normalizePolicyRules(news.exclude),
+  require: normalizePolicyRules(news.require),
+  sessionDuration: news.sessionDuration,
+  approvalRequired: news.approvalRequired,
+  approvalGroups: news.approvalGroups,
+  isolationRequired: news.isolationRequired,
+  purposeJustificationRequired: news.purposeJustificationRequired,
+  purposeJustificationPrompt: news.purposeJustificationPrompt,
+  connectionRules: news.connectionRules,
+  mfaConfig: news.mfaConfig,
+});
+
+// Optional fields a whole-replacement PUT would reset when omitted.
+const PRESERVED_FIELDS = [
+  "exclude",
+  "require",
+  "sessionDuration",
+  "approvalRequired",
+  "approvalGroups",
+  "isolationRequired",
+  "purposeJustificationRequired",
+  "purposeJustificationPrompt",
+  "connectionRules",
+  "mfaConfig",
+] as const;
+
+const withLiveFields = (
+  body: ReturnType<typeof policyBody>,
+  live: RawPolicy,
+): ReturnType<typeof policyBody> => ({
+  ...body,
+  ...Object.fromEntries(
+    PRESERVED_FIELDS.flatMap((key) =>
+      body[key] === undefined && live[key] != null ? [[key, stripNullFields(live[key])]] : [],
+    ),
+  ),
+});
+
 const createPolicyName = (id: string, name: string | undefined) =>
   Effect.gen(function* () {
     if (name) return name;
@@ -472,7 +542,7 @@ const findPolicyByName = (acct: string, name: string) =>
     Stream.filter((p) => p.name === name),
     Stream.runHead,
     Effect.map(Option.getOrUndefined),
-    Effect.catch(() => Effect.succeed(undefined)),
+    Effect.orElseSucceed(() => undefined),
   );
 
 type ObservedPolicy = {
@@ -483,16 +553,16 @@ type ObservedPolicy = {
   updatedAt?: string | null;
 };
 
-// Distilled response shapes (Get / Create / Update) all carry the same set
-// of fields we care about, but typed wider than `ObservedPolicy`. Narrow at
-// the API boundary so the rest of the reconciler stays in our shape.
+// Distilled response shapes (Get / List / Create / Update) all carry the same
+// set of fields we care about, but typed wider than `ObservedPolicy`. Narrow
+// at the API boundary so the rest of the reconciler stays in our shape.
 type RawPolicy = {
   id?: string | null;
   name?: string | null;
   decision?: PolicyDecision | null | string;
   createdAt?: string | null;
   updatedAt?: string | null;
-};
+} & { [K in (typeof PRESERVED_FIELDS)[number]]?: unknown };
 
 const toObserved = (r: RawPolicy): ObservedPolicy => ({
   id: r.id,

package/src/Cloudflare/Access/ServiceToken.ts

@@ -240,7 +240,7 @@ export const ServiceTokenProvider = () =>
               Effect.gen(function* () {
                 const existing = yield* findTokenByName(acct, name);
                 if (existing && existing.id) return existing;
-                return yield* Effect.fail(err);
+                return yield* err;
               }),
             ),
           );
@@ -345,7 +345,7 @@ const findTokenByName = (acct: string, name: string) =>
     Stream.filter((t): t is ObservedToken => t.name === name),
     Stream.runHead,
     Effect.map(Option.getOrUndefined),
-    Effect.catch(() => Effect.succeed(undefined)),
+    Effect.orElseSucceed(() => undefined),
   );
 
 // Skip no-op PUTs while treating an unset prop as "keep whatever Cloudflare

package/src/Cloudflare/Access.ts

@@ -34,28 +34,27 @@ export const AccessLive = Layer.effect(
             (response.headers.get("location")?.includes("cloudflareaccess.com") ?? false),
         ),
         Effect.timeout(1000),
-        Effect.catch(() => Effect.succeed(false)),
+        Effect.orElseSucceed(() => false),
       ),
     );
     const login = (domain: string) =>
       ChildProcess.make("cloudflared", ["access", "login", domain]).pipe(
         spawner.spawn,
         Effect.flatMap((process) => Stream.runCollect(process.stdout)),
-        Effect.mapError(
-          (error) =>
-            new AccessError({
-              message:
-                `The domain "${domain}" uses Cloudflare Access, but \`cloudflared\` is not installed. ` +
-                `Please install it from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation.`,
-              cause: error,
-            }),
+        Effect.mapError((error) =>
+          AccessError.make({
+            message:
+              `The domain "${domain}" uses Cloudflare Access, but \`cloudflared\` is not installed. ` +
+              `Please install it from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation.`,
+            cause: error,
+          }),
         ),
         Effect.flatMap((stdout) => {
           const matches = stdout.toString().match(/fetched your token:\n\n(.*)/m);
           return matches && matches.length >= 2
             ? Effect.succeed({ Cookie: `CF_Authorization=${matches[1]}` })
             : Effect.fail(
-                new AccessError({
+                AccessError.make({
                   message: "Failed to authenticate with Cloudflare Access",
                 }),
               );

package/src/Cloudflare/Acm/TotalTls.ts

@@ -241,8 +241,10 @@ export const TotalTlsProvider = () =>
           certificateAuthority: initialCertificateAuthority,
         })
         .pipe(
-          Effect.catchTag("InvalidObjectIdentifier", () => Effect.void),
-          Effect.catchTag("NoStateChange", () => Effect.void),
+          Effect.catchTags({
+            InvalidObjectIdentifier: () => Effect.void,
+            NoStateChange: () => Effect.void,
+          }),
           // The zone lost its ACM entitlement since we configured it —
           // Cloudflare already refuses Total TLS writes, so there is
           // nothing left to restore.

package/src/Cloudflare/ApiShield/UserSchema.ts

@@ -241,10 +241,12 @@ export const UserSchemaProvider = () =>
             ),
             // Zones without the API Shield entitlement reject the listing
             // route; skip them rather than failing the whole enumeration.
-            Effect.catchTag("Forbidden", () => Effect.succeed([] as UserSchemaAttributes[])),
-            // A zone purged (deleted) out-of-band mid-enumeration — it was in
-            // the zone list but no longer exists; drop it.
-            Effect.catchTag("ZonePurged", () => Effect.succeed([] as UserSchemaAttributes[])),
+            Effect.catchTags({
+              Forbidden: () => Effect.succeed([] as UserSchemaAttributes[]),
+              // A zone purged (deleted) out-of-band mid-enumeration — it was in
+              // the zone list but no longer exists; drop it.
+              ZonePurged: () => Effect.succeed([] as UserSchemaAttributes[]),
+            }),
           ),
         { concurrency: 10 },
       );

package/src/Cloudflare/ApiToken/AccountApiToken.ts

@@ -17,6 +17,7 @@ import {
   type ApiTokenBinding,
   type Props,
 } from "./Common.ts";
+import { uniqueTokens } from "./internal.ts";
 
 export type AccountApiToken = Resource<
   "Cloudflare.ApiToken.AccountApiToken",
@@ -198,8 +199,10 @@ export const AccountApiTokenProvider = () =>
             })
             .pipe(
               Effect.map((token) => token),
-              Effect.catchTag("InvalidRoute", () => Effect.succeed(undefined)),
-              Effect.catchTag("TokenNotFound", () => Effect.succeed(undefined)),
+              Effect.catchTags({
+                InvalidRoute: () => Effect.succeed(undefined),
+                TokenNotFound: () => Effect.succeed(undefined),
+              }),
             )
         : undefined;
 
@@ -248,8 +251,10 @@ export const AccountApiTokenProvider = () =>
           // Already gone — Cloudflare may report this as either an
           // `InvalidRoute` (token-id no longer routable) or a generic
           // `TokenNotFound`. Either is fine; we just want the resource gone.
-          Effect.catchTag("InvalidRoute", () => Effect.void),
-          Effect.catchTag("TokenNotFound", () => Effect.void),
+          Effect.catchTags({
+            InvalidRoute: () => Effect.void,
+            TokenNotFound: () => Effect.void,
+          }),
           // Cloudflare-managed tokens (e.g. "Cloudflare Resource Tagging
           // System") can never be deleted (code 1001). We don't own them, so
           // treat the refusal as a no-op rather than a failure.
@@ -262,13 +267,18 @@ export const AccountApiTokenProvider = () =>
       // creation time. The list/get APIs never expose it, so we hydrate an
       // empty redacted placeholder — matching what `read` returns when it
       // re-observes a token whose value we no longer hold.
-      return yield* accounts.listTokens.pages({ accountId }).pipe(
+      //
+      // `GET /accounts/{id}/tokens` is offset-paginated over a name-sorted
+      // list, so any token created or deleted between page fetches (e.g. a
+      // concurrent deploy) shifts the window: tokens get listed twice or
+      // skipped. Request the API's maximum page size (1000) so a typical
+      // account is enumerated in one snapshot, and de-duplicate by id in
+      // case it still spans pages.
+      return yield* accounts.listTokens.pages({ accountId, perPage: 1000 }).pipe(
         Stream.runCollect,
         Effect.map((chunk) =>
-          Array.from(chunk).flatMap((page) =>
-            (page.result ?? []).map((token) =>
-              buildAttributes(token, Redacted.make(""), accountId),
-            ),
+          uniqueTokens(Array.from(chunk).flatMap((page) => page.result ?? [])).map((token) =>
+            buildAttributes(token, Redacted.make(""), accountId),
           ),
         ),
       );
@@ -282,8 +292,10 @@ export const AccountApiTokenProvider = () =>
         })
         .pipe(
           Effect.map((token) => buildAttributes(token, output.value, output.accountId)),
-          Effect.catchTag("InvalidRoute", () => Effect.succeed(undefined)),
-          Effect.catchTag("TokenNotFound", () => Effect.succeed(undefined)),
+          Effect.catchTags({
+            InvalidRoute: () => Effect.succeed(undefined),
+            TokenNotFound: () => Effect.succeed(undefined),
+          }),
         );
     }),
   });

package/src/Cloudflare/ApiToken/Common.ts

@@ -1,3 +1,4 @@
+import type { TokensCreateRequestPoliciesItemPermissionGroupsItemMeta } from "@distilled.cloud/cloudflare/accounts";
 import { PERMISSION_GROUPS_BY_NAME, type PermissionGroupName } from "./PermissionGroups.ts";
 
 /**
@@ -20,9 +21,13 @@ export type ResourceKey =
  * name (resolved against the static catalog) or an explicit `{ id }` for
  * names that aren't in the catalog or have multiple scopes.
  */
-export type PermissionGroupRef =
-  | PermissionGroupName
-  | { id: string; meta?: { key?: string; value?: string } };
+export type PermissionGroupRef = PermissionGroupName | { id: string; meta?: PermissionGroupMeta };
+
+/**
+ * Descriptive attributes of a permission group, as Cloudflare documents them
+ * on token policies. Optional; Cloudflare does not store them on the token.
+ */
+export type PermissionGroupMeta = TokensCreateRequestPoliciesItemPermissionGroupsItemMeta;
 
 /**
  * Value of a resource entry in an {@link Policy}. Usually `"*"`, but
@@ -97,7 +102,7 @@ export const collectPolicies = (
 
 export type ResolvedPolicy = {
   effect: "allow" | "deny";
-  permissionGroups: { id: string; meta?: { key?: string; value?: string } }[];
+  permissionGroups: { id: string; meta?: PermissionGroupMeta }[];
   resources: Record<string, ResourceScope>;
 };
 

package/src/Cloudflare/ApiToken/PermissionGroups.ts

@@ -1078,6 +1078,30 @@ export const PERMISSION_GROUPS = [
     description: "Grants write access to Intel API",
     scopes: ["com.cloudflare.api.account"],
   },
+  {
+    id: "9159aeca78b949818ec1556aa42ffd2e",
+    name: "K2 Config Read",
+    description: "Grants read access to K2 streams",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "0a50f569ebae4364a205dfc3137dbc5f",
+    name: "K2 Config Write",
+    description: "Grants write access to K2 streams",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "3a6cae593f454607a4db52e67a45b19f",
+    name: "K2 Consume",
+    description: "Grants access to manage subscriptions and consume records from K2 streams",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "47b72b140c694f90bfcd21b7da1e8a06",
+    name: "K2 Produce",
+    description: "Grants access to produce records to K2 streams",
+    scopes: ["com.cloudflare.api.account"],
+  },
   {
     id: "4657621393f94f83b8ef94adba382e48",
     name: "L4 DDoS Managed Ruleset Read",

package/src/Cloudflare/ApiToken/UserApiToken.ts

@@ -16,6 +16,7 @@ import {
   type ApiTokenBinding,
   type Props,
 } from "./Common.ts";
+import { uniqueTokens } from "./internal.ts";
 
 export type UserApiToken = Resource<
   "Cloudflare.ApiToken.UserApiToken",
@@ -200,11 +201,14 @@ export const UserApiTokenProvider = () =>
     // hydrate the read shape with an empty Redacted value, matching what
     // `read` produces when the secret was never captured.
     list: () =>
-      user.listTokens.pages({}).pipe(
+      // Offset-paginated over a name-sorted list: concurrent creates/deletes
+      // between page fetches duplicate or skip tokens. Use the API's maximum
+      // page size (1000) for a single-snapshot read and de-duplicate by id.
+      user.listTokens.pages({ perPage: 1000 }).pipe(
         Stream.runCollect,
         Effect.map((chunk) =>
-          Array.from(chunk).flatMap((page) =>
-            (page.result ?? []).map((token) => buildAttributes(token, Redacted.make(""))),
+          uniqueTokens(Array.from(chunk).flatMap((page) => page.result ?? [])).map((token) =>
+            buildAttributes(token, Redacted.make("")),
           ),
         ),
         // User-scoped tokens require user-level auth; an account-scoped token

package/src/Cloudflare/ApiToken/internal.ts

@@ -0,0 +1,11 @@
+// Offset pagination can return the same token on two pages when the list
+// shifts between fetches; keep the first occurrence of each id.
+export const uniqueTokens = <T extends { id?: string | null }>(tokens: ReadonlyArray<T>): T[] => {
+  const seen = new Set<string>();
+  return tokens.filter((token) => {
+    if (!token.id) return true;
+    if (seen.has(token.id)) return false;
+    seen.add(token.id);
+    return true;
+  });
+};

package/src/Cloudflare/Argo/SmartRouting.ts

@@ -121,8 +121,10 @@ export const SmartRoutingProvider = () =>
             // subscription reject every read with the typed entitlement
             // tag (code 1015); skip them. Zones deleted out-of-band
             // surface InvalidObjectIdentifier.
-            Effect.catchTag("NotAuthorized", () => Effect.succeed(undefined)),
-            Effect.catchTag("InvalidObjectIdentifier", () => Effect.succeed(undefined)),
+            Effect.catchTags({
+              NotAuthorized: () => Effect.succeed(undefined),
+              InvalidObjectIdentifier: () => Effect.succeed(undefined),
+            }),
           ),
         { concurrency: 10 },
       );
@@ -145,10 +147,12 @@ export const SmartRoutingProvider = () =>
       if (!zoneId) return undefined;
       const observed = yield* argo.getSmartRouting({ zoneId }).pipe(
         // Zone deleted out-of-band — the setting is gone with it.
-        Effect.catchTag("InvalidObjectIdentifier", () => Effect.succeed(undefined)),
-        // Argo subscription removed out-of-band — the setting is no
-        // longer visible or manageable on the zone.
-        Effect.catchTag("NotAuthorized", () => Effect.succeed(undefined)),
+        Effect.catchTags({
+          InvalidObjectIdentifier: () => Effect.succeed(undefined),
+          // Argo subscription removed out-of-band — the setting is no
+          // longer visible or manageable on the zone.
+          NotAuthorized: () => Effect.succeed(undefined),
+        }),
       );
       if (observed === undefined) return undefined;
       // The setting is a singleton that always exists with a Cloudflare
@@ -190,16 +194,20 @@ export const SmartRoutingProvider = () =>
       // Observe — if the zone is gone, or the Argo subscription was
       // removed out-of-band, the setting is no longer ours to restore.
       const observed = yield* argo.getSmartRouting({ zoneId }).pipe(
-        Effect.catchTag("InvalidObjectIdentifier", () => Effect.succeed(undefined)),
-        Effect.catchTag("NotAuthorized", () => Effect.succeed(undefined)),
+        Effect.catchTags({
+          InvalidObjectIdentifier: () => Effect.succeed(undefined),
+          NotAuthorized: () => Effect.succeed(undefined),
+        }),
       );
       if (observed === undefined) return;
       // Restore the pre-management value; skip the call when it already
       // matches (idempotent re-delete after a crashed run).
       if (toValue(observed.value) === initialValue) return;
       yield* argo.patchSmartRouting({ zoneId, value: initialValue }).pipe(
-        Effect.catchTag("InvalidObjectIdentifier", () => Effect.void),
-        Effect.catchTag("NotAuthorized", () => Effect.void),
+        Effect.catchTags({
+          InvalidObjectIdentifier: () => Effect.void,
+          NotAuthorized: () => Effect.void,
+        }),
       );
     }),
   });

package/src/Cloudflare/Artifacts/Namespace.ts

@@ -1,3 +1,4 @@
+import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import { Stack } from "../../Stack.ts";
 import { Stage } from "../../Stage.ts";
@@ -11,12 +12,11 @@ const NamespaceTypeId = "Cloudflare.Artifacts.Namespace" as const;
  */
 const ARTIFACTS_NAMESPACE_REGEX = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])?$/;
 
-export class InvalidNamespaceError extends Error {
-  readonly _tag = "InvalidNamespaceError" as const;
-  constructor(public readonly namespace: string) {
-    super(
-      `Invalid artifacts namespace name '${namespace}'. Must be 3-63 characters, start and end with a lowercase alphanumeric character, and contain only lowercase alphanumeric characters and hyphens.`,
-    );
+export class InvalidNamespaceError extends Data.TaggedError("InvalidNamespaceError")<{
+  readonly namespace: string;
+}> {
+  override get message() {
+    return `Invalid artifacts namespace name '${this.namespace}'. Must be 3-63 characters, start and end with a lowercase alphanumeric character, and contain only lowercase alphanumeric characters and hyphens.`;
   }
 }
 
@@ -124,7 +124,7 @@ export const Namespace: (
 ) {
   const namespace = props?.namespace ? props.namespace : name.toLocaleLowerCase();
   if (!ARTIFACTS_NAMESPACE_REGEX.test(namespace)) {
-    return yield* Effect.die(new InvalidNamespaceError(namespace));
+    return yield* Effect.die(new InvalidNamespaceError({ namespace }));
   }
   return {
     kind: NamespaceTypeId,