alchemy 2.0.0-beta.81 → 2.0.0-beta.83

package/src/Cloudflare/Containers/DurableObjectApplication.ts

@@ -0,0 +1,382 @@
+import * as Containers from "@distilled.cloud/cloudflare/containers";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../../Diff.ts";
+import * as ProviderLayer from "../../Local/ProviderLayer.ts";
+import * as Namespace from "../../Namespace.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource, type ResourceBinding } from "../../Resource.ts";
+import { normalizeNulls } from "../../Util/stable.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import { localAccountId } from "../LocalAccount.ts";
+import { generateLocalId, isLiveId } from "../LocalRuntime.ts";
+import type { Providers } from "../Providers.ts";
+import type { DurableObjectApplicationSettings } from "./ContainerApplication.ts";
+import { createContainerApplicationName } from "./ContainerBundle.ts";
+import {
+  ContainerConfigurationError,
+  durableObjectSettingsPatch,
+  mergeApplicationSettings,
+} from "./ContainerConfiguration.ts";
+
+export const DurableObjectApplicationTypeId = "Cloudflare.Containers.DurableObjectApplication";
+
+export interface DurableObjectApplicationProps {
+  /** The Durable Object class whose namespace the application serves. */
+  className: string;
+}
+
+/** What each bound Container contributes to its class's application. */
+export interface DurableObjectApplicationBinding {
+  /** The Durable Object namespace the application is attached to. */
+  durableObjects?: { namespaceId: string };
+  /** The bound Container and the application-wide settings it declares. */
+  container?: { id: string; settings: DurableObjectApplicationSettings };
+}
+
+/**
+ * INTERNAL — the one container application of a Durable Object class.
+ *
+ * Cloudflare allows exactly one container application per Durable Object
+ * namespace. Every `schedulingPolicy: "durable_object"` Container bound to a
+ * class declares this resource under the same logical id, so the engine
+ * registers it once; each Container then binds its application-wide settings
+ * onto it. The images themselves are Worker upload metadata, merged by the
+ * Worker.
+ *
+ * @internal
+ */
+export interface DurableObjectApplication extends Resource<
+  typeof DurableObjectApplicationTypeId,
+  DurableObjectApplicationProps,
+  {
+    /** The application id, which equals the Durable Object namespace id. Empty before creation. */
+    applicationId: string;
+    /** The generated application name. */
+    applicationName: string;
+    /** The Cloudflare account that owns the application. */
+    accountId: string;
+    /** The Durable Object class the application serves. */
+    className: string;
+    /** The Durable Object namespace attached to the application. */
+    durableObjects: { namespaceId: string } | undefined;
+    /** ISO-8601 creation time. Empty before creation. */
+    createdAt: string;
+    /** Application-wide container configuration (SSH and authorized keys). */
+    configuration: Containers.DurableObjectContainerConfiguration;
+    /** Application-wide logging. */
+    observability: Containers.ContainerApplicationObservability | undefined;
+    /** The merged settings last applied, used to reset settings a Container stops declaring. */
+    settings: DurableObjectApplicationSettings;
+  },
+  DurableObjectApplicationBinding,
+  Providers
+> {}
+
+export const DurableObjectApplication = Resource<DurableObjectApplication>(
+  DurableObjectApplicationTypeId,
+);
+
+/**
+ * Declare the container application of `className`, hosted by `worker`. Every
+ * Container bound to the class calls this; the engine dedupes the declaration
+ * by its fully qualified id, so all of them share one resource.
+ */
+export const declareDurableObjectApplication = (worker: { LogicalId: string }, className: string) =>
+  Namespace.push(
+    worker.LogicalId,
+    DurableObjectApplication(`${className}-Containers`, { className }),
+  );
+
+/**
+ * Right after a Worker upload creates a Durable Object namespace, the
+ * containers API can report the namespace missing for a few seconds before it
+ * sees it. Retry creates that attach to it, bounded at ~30s.
+ */
+export const retryNamespacePropagation = <A, E extends { readonly _tag: string }, R>(
+  effect: Effect.Effect<A, E, R>,
+) =>
+  effect.pipe(
+    Effect.tapError((error) =>
+      error._tag === "DurableObjectNamespaceNotFound"
+        ? Effect.logDebug("Cloudflare Container create: namespace not visible yet, retrying")
+        : Effect.void,
+    ),
+    Effect.retry({
+      while: (error) => error._tag === "DurableObjectNamespaceNotFound",
+      schedule: Schedule.spaced("2 seconds"),
+      times: 15,
+    }),
+  );
+
+/** Whether an application id names a created, live application (not a placeholder). */
+const isLiveApplication = (id: string | undefined): id is string => !!id && isLiveId(id);
+
+type Bindings = ReadonlyArray<ResourceBinding<DurableObjectApplicationBinding>>;
+
+/** The one namespace every bound Container attaches the application to. */
+const boundNamespace = (className: string, bindings: Bindings) => {
+  // A stale Worker namespace map can resolve a binding without an id; it
+  // does not request removing the live attachment.
+  const ids = [
+    ...new Set(
+      bindings.flatMap((b) =>
+        b.data.durableObjects?.namespaceId ? [b.data.durableObjects.namespaceId] : [],
+      ),
+    ),
+  ];
+  if (ids.length > 1) {
+    return Effect.fail(
+      new ContainerConfigurationError({
+        message: `The container application of Durable Object class '${className}' is bound to ${ids.length} namespaces (${ids.join(", ")}). A class has one namespace.`,
+      }),
+    );
+  }
+  return Effect.succeed(ids[0] === undefined ? undefined : { namespaceId: ids[0] });
+};
+
+const boundSettings = (className: string, bindings: Bindings) =>
+  mergeApplicationSettings(
+    className,
+    bindings.flatMap((b) => (b.data.container ? [b.data.container] : [])),
+  );
+
+/**
+ * Check the bound settings for conflicts at plan time. The namespace id in
+ * the same bindings resolves only after the Worker uploads, so check the
+ * settings contributions on their own once they are resolved.
+ */
+const planSettings = (className: string, newBindings: unknown) => {
+  const contributions = (Array.isArray(newBindings) ? newBindings : []).flatMap(
+    (binding: { data?: DurableObjectApplicationBinding }) =>
+      binding?.data?.container ? [binding.data.container] : [],
+  );
+  return isResolved(contributions)
+    ? Effect.asVoid(mergeApplicationSettings(className, contributions))
+    : Effect.void;
+};
+
+const placeholder = (
+  identity: Pick<
+    DurableObjectApplication["Attributes"],
+    "applicationId" | "applicationName" | "accountId" | "className" | "createdAt"
+  > &
+    Partial<DurableObjectApplication["Attributes"]>,
+): DurableObjectApplication["Attributes"] => ({
+  durableObjects: undefined,
+  configuration: {},
+  observability: undefined,
+  settings: {},
+  ...identity,
+});
+
+const toAttributes = (
+  application: Containers.GetContainerApplicationResponse,
+  className: string,
+  settings: DurableObjectApplicationSettings,
+): DurableObjectApplication["Attributes"] => ({
+  applicationId: application.id,
+  applicationName: application.name,
+  accountId: application.accountId,
+  className,
+  durableObjects: normalizeNulls(application.durableObjects) as { namespaceId: string } | undefined,
+  createdAt: application.createdAt,
+  configuration: normalizeNulls(
+    application.configuration,
+  ) as Containers.DurableObjectContainerConfiguration,
+  observability: normalizeNulls(application.observability ?? undefined),
+  settings,
+});
+
+export const LiveDurableObjectApplicationProvider = () =>
+  Provider.succeed(DurableObjectApplication, {
+    stables: ["accountId", "className"],
+    diff: Effect.fn(function* ({ news, output, newBindings }) {
+      if (!isResolved(news)) return undefined;
+      // Conflicting settings fail the plan, before anything is published.
+      yield* planSettings(news.className, newBindings);
+      if (!isResolved(newBindings)) return undefined;
+      const namespace = yield* boundNamespace(news.className, newBindings);
+      const deployed = output?.durableObjects?.namespaceId;
+      if (deployed !== undefined && namespace !== undefined && deployed !== namespace.namespaceId) {
+        return yield* new ContainerConfigurationError({
+          message: `The container application of Durable Object class '${news.className}' cannot move to another Durable Object namespace.`,
+        });
+      }
+      const { accountId } = yield* yield* CloudflareEnvironment;
+      if (
+        output !== undefined &&
+        isLiveApplication(output.applicationId) &&
+        output.accountId !== accountId
+      ) {
+        return yield* new ContainerConfigurationError({
+          message: `The container application of Durable Object class '${news.className}' cannot move to another account in place.`,
+        });
+      }
+      // Precreate only reserves a name; reconcile creates the application
+      // once the Worker has created its namespace.
+      if (!isLiveApplication(output?.applicationId)) {
+        return { action: "update", stables: ["accountId", "className"] } as const;
+      }
+      return undefined;
+    }),
+    precreate: Effect.fn(function* ({ id, news, bindings }) {
+      // A new application is never diffed; fail conflicting settings here,
+      // before the Worker is uploaded.
+      yield* planSettings(news.className, bindings);
+      const { accountId } = yield* yield* CloudflareEnvironment;
+      // The application needs the Worker's namespace id, which does not exist
+      // yet. Reserve the name so the Worker's upload can reference it.
+      return placeholder({
+        applicationId: "",
+        applicationName: yield* createContainerApplicationName(id, undefined),
+        accountId,
+        className: news.className,
+        createdAt: "",
+      });
+    }),
+    reconcile: Effect.fn(function* ({ id, news, bindings, output, session }) {
+      const { accountId } = yield* yield* CloudflareEnvironment;
+      const className = news.className;
+      // Prefer the deployed name: regenerating would target a different
+      // application if the generator's output for this id ever drifts.
+      const name =
+        output?.applicationName || (yield* createContainerApplicationName(id, undefined));
+      const durableObjects =
+        (yield* boundNamespace(className, bindings)) ??
+        (output?.durableObjects?.namespaceId ? output.durableObjects : undefined);
+      if (!durableObjects) {
+        return yield* new ContainerConfigurationError({
+          message: `The container application of Durable Object class '${className}' requires a resolved Durable Object namespace. Reconcile its Worker first.`,
+        });
+      }
+      const settings = yield* boundSettings(className, bindings);
+
+      // The application's id is the id of the namespace it serves.
+      const applicationId = durableObjects.namespaceId;
+      const getApplication = Containers.getContainerApplication({ accountId, applicationId });
+      const assertServesNamespace = (application: Containers.GetContainerApplicationResponse) =>
+        application.schedulingPolicy === "durable_object" &&
+        application.durableObjects?.namespaceId === applicationId
+          ? Effect.void
+          : Effect.fail(
+              new ContainerConfigurationError({
+                message: `The container application '${application.name}' of Durable Object namespace '${applicationId}' is not Durable Object-managed. Declare a new Durable Object class for Durable Object-managed Containers.`,
+              }),
+            );
+
+      // 1. Observe. The namespace belongs to this stack's Worker, so an
+      //    application already attached to it is this class's application.
+      let application = yield* getApplication.pipe(
+        Effect.catchTag("ContainerApplicationNotFound", () => Effect.succeed(undefined)),
+      );
+
+      // 2. Ensure
+      if (!application) {
+        yield* session.note(`Creating container application ${name}...`);
+        application = yield* retryNamespacePropagation(
+          Containers.createDurableObjectContainerApplication({
+            accountId,
+            name,
+            schedulingPolicy: "durable_object",
+            durableObjects,
+            configuration: {
+              ...(settings.ssh !== undefined ? { wranglerSsh: settings.ssh } : {}),
+              ...(settings.authorizedKeys !== undefined
+                ? { authorizedKeys: settings.authorizedKeys }
+                : {}),
+            },
+            observability: settings.observability,
+          }),
+        ).pipe(Effect.catchTag("DurableObjectAlreadyHasApplication", () => getApplication));
+      }
+      yield* assertServesNamespace(application);
+
+      // 3. Sync declared settings and reset settings no Container declares anymore.
+      const patch = durableObjectSettingsPatch(settings, output?.settings, application);
+      if (patch.configuration !== undefined || patch.observability !== undefined) {
+        application = yield* Containers.updateContainerApplication({
+          accountId,
+          applicationId,
+          ...patch,
+        });
+      }
+      return toAttributes(application, className, settings);
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      if (!isLiveApplication(output.applicationId)) return;
+      yield* Containers.deleteContainerApplication({
+        accountId: output.accountId,
+        applicationId: output.applicationId,
+      }).pipe(Effect.catchTag("ContainerApplicationNotFound", () => Effect.void));
+    }),
+    read: Effect.fn(function* ({ id, olds, output }) {
+      const { accountId } = yield* yield* CloudflareEnvironment;
+      const className = olds?.className ?? output?.className ?? "";
+      if (output !== undefined && isLiveApplication(output.applicationId)) {
+        return yield* Containers.getContainerApplication({
+          accountId: output.accountId,
+          applicationId: output.applicationId,
+        }).pipe(
+          Effect.map((application) => toAttributes(application, className, output.settings)),
+          Effect.catchTag("ContainerApplicationNotFound", () => Effect.succeed(undefined)),
+        );
+      }
+      // Generated names identify this instance, so a match is ours.
+      const name =
+        output?.applicationName || (yield* createContainerApplicationName(id, undefined));
+      const found = yield* Containers.listContainerApplications({ accountId }).pipe(
+        Effect.map((apps) =>
+          apps.find((app) => app.name === name && app.schedulingPolicy === "durable_object"),
+        ),
+      );
+      return found === undefined
+        ? undefined
+        : toAttributes(found, className, output?.settings ?? {});
+    }),
+  });
+
+/**
+ * Local (dev) provider: `alchemy dev` runs every image through workerd and
+ * Docker, so the application is a placeholder carrying a `dev:` id.
+ */
+export const LocalDurableObjectApplicationProvider = () =>
+  Provider.succeed(DurableObjectApplication, {
+    stables: ["accountId", "className"],
+    diff: Effect.fn(function* ({ news, newBindings }) {
+      if (!isResolved(news)) return undefined;
+      yield* planSettings(news.className, newBindings);
+      return undefined;
+    }),
+    precreate: Effect.fn(function* ({ id, news, bindings }) {
+      yield* planSettings(news.className, bindings);
+      return placeholder({
+        applicationId: generateLocalId(),
+        applicationName: yield* createContainerApplicationName(id, undefined),
+        accountId: yield* localAccountId,
+        className: news.className,
+        createdAt: new Date().toISOString(),
+      });
+    }),
+    reconcile: Effect.fn(function* ({ id, news, bindings, output }) {
+      return placeholder({
+        applicationId: output?.applicationId || generateLocalId(),
+        applicationName: yield* createContainerApplicationName(id, undefined),
+        accountId: yield* localAccountId,
+        className: news.className,
+        createdAt: output?.createdAt || new Date().toISOString(),
+        durableObjects: yield* boundNamespace(news.className, bindings),
+        settings: yield* boundSettings(news.className, bindings),
+      });
+    }),
+    delete: () => Effect.void,
+    read: Effect.fn(function* ({ output }) {
+      return output;
+    }),
+  });
+
+export const DurableObjectApplicationProvider = () =>
+  ProviderLayer.dual(DurableObjectApplication, {
+    live: () => LiveDurableObjectApplicationProvider(),
+    local: () => LocalDurableObjectApplicationProvider(),
+  });

package/src/Cloudflare/Containers/LocalContainerProvider.ts

@@ -24,6 +24,12 @@ import {
   prepareContainerBuildContext,
   validateContainerImageProps,
 } from "./ContainerBundle.ts";
+import {
+  durableObjectPlaceholder,
+  hasImageSource,
+  isDurableObjectContainer,
+  validateContainerConfiguration,
+} from "./ContainerConfiguration.ts";
 import { ContainerPlatform } from "./ContainerPlatform.ts";
 
 /**
@@ -143,6 +149,7 @@ export const LocalContainerProvider = () =>
         if (typeof input !== "object" || input === null) return undefined;
         const news = input as AnyContainerApplicationProps;
         const picked = {
+          schedulingPolicy: news.schedulingPolicy,
           main: news.main,
           image: news.image,
           dockerfile: news.dockerfile,
@@ -155,7 +162,13 @@ export const LocalContainerProvider = () =>
           autoInstallExternals: news.autoInstallExternals,
         };
         if (!isResolved(picked)) return undefined;
-        if (!picked.main && !picked.image && !picked.dockerfile && !picked.context) {
+        if (
+          picked.schedulingPolicy !== "durable_object" &&
+          !picked.main &&
+          !picked.image &&
+          !picked.dockerfile &&
+          !picked.context
+        ) {
           return undefined;
         }
         return picked as AnyContainerApplicationProps;
@@ -199,7 +212,27 @@ export const LocalContainerProvider = () =>
         bindings: ResourceBinding<ContainerApplication["Binding"]>[];
         output: ContainerApplication["Attributes"] | undefined;
       }) {
+        yield* validateContainerConfiguration(news, output?.schedulingPolicy);
         const accountId = yield* localAccountId;
+        if (isDurableObjectContainer(news)) {
+          const attributes = durableObjectPlaceholder({
+            applicationId: output?.applicationId ?? generateLocalId(),
+            applicationName: yield* createContainerApplicationName(id, undefined),
+            accountId,
+            createdAt: output?.createdAt ?? new Date().toISOString(),
+            observability: news.observability,
+          });
+          if (!hasImageSource(news)) return attributes;
+          const { dev, hash } = yield* prepareImage(id, news);
+          return {
+            ...attributes,
+            // workerd resolves each image by its key in the class's image
+            // map, so locally the image reference is the Container's id.
+            image: id,
+            dev,
+            hash: { image: hash },
+          } satisfies ContainerApplication["Attributes"];
+        }
         const env = makeContainerEnv(news, accountId, bindings);
         const { dev, hash } = yield* prepareImage(id, news);
         return {
@@ -223,6 +256,9 @@ export const LocalContainerProvider = () =>
       return {
         stables: ["accountId", "applicationId"],
         diff: Effect.fn(function* ({ id, news, output }) {
+          if (isResolved(news)) {
+            yield* validateContainerConfiguration(news, output?.schedulingPolicy);
+          }
           if (!output) return { action: "update" };
           // A content-only edit (an imported module of `main`, a Dockerfile,
           // a context file) changes no prop, so the engine's structural
@@ -234,6 +270,9 @@ export const LocalContainerProvider = () =>
           // disabled this check for every effectful container.
           const imageInputs = resolvedImageInputs(news);
           if (imageInputs !== undefined) {
+            if (isDurableObjectContainer(imageInputs) && !hasImageSource(imageInputs)) {
+              return output.image !== undefined ? { action: "update" } : undefined;
+            }
             // Recompute fresh on every plan. `prepareImage` is memoized so
             // a plan's diff→precreate→reconcile chain bundles once — but
             // this provider runs in the RPC sidecar, whose `ArtifactStore`

package/src/Cloudflare/Containers/index.ts

@@ -1,7 +1,33 @@
 export * from "./Container.ts";
 export * from "./ContainerApplication.ts";
 export * from "./ContainerBundle.ts";
-export * from "./ContainerPlatform.ts";
+export type {
+  ContainerClient,
+  ContainerExecOptions,
+  ContainerExecOutput,
+  ContainerInfo,
+  ContainerPort,
+  ContainerPortError,
+  ContainerProcess,
+  ContainerSnapshot,
+  ContainerSnapshotOptions,
+  ContainerStartError,
+  ReservedContainerKey,
+} from "./ContainerClient.ts";
+export {
+  ContainerApplicationSettingsConflict,
+  ContainerConfigurationError,
+  ContainerImagePreparationError,
+  DurableObjectContainerBindingError,
+  DurableObjectContainerConflict,
+  DurableObjectContainersOnEffectNativeClass,
+} from "./ContainerConfiguration.ts";
+export { ContainerPlatform } from "./ContainerPlatform.ts";
 export * from "./ContainerProvider.ts";
+export {
+  DurableObjectApplication,
+  DurableObjectApplicationProvider,
+  type DurableObjectApplicationBinding,
+  type DurableObjectApplicationProps,
+} from "./DurableObjectApplication.ts";
 export * from "./LocalContainerProvider.ts";
-export * from "./StartContainer.ts";

package/src/Cloudflare/ContentScanning/Expression.ts

@@ -125,9 +125,11 @@ export const ExpressionProvider = () =>
                 (page.result ?? []).map((expression) => toAttributes(zone.id, expression)),
               ),
             ),
-            Effect.catchTag("ContentScanningNotEnabled", () => Effect.succeed([])),
-            Effect.catchTag("Forbidden", () => Effect.succeed([])),
-            Effect.catchTag("InvalidRoute", () => Effect.succeed([])),
+            Effect.catchTags({
+              ContentScanningNotEnabled: () => Effect.succeed([]),
+              Forbidden: () => Effect.succeed([]),
+              InvalidRoute: () => Effect.succeed([]),
+            }),
           ),
         { concurrency: 10 },
       );
@@ -206,12 +208,10 @@ export const ExpressionProvider = () =>
         });
         observed = created.result.find((e) => e.payload === news.payload);
         if (!observed) {
-          return yield* Effect.fail(
-            new ExpressionCreateAnomaly({
-              zoneId,
-              payload: news.payload,
-            }),
-          );
+          return yield* new ExpressionCreateAnomaly({
+            zoneId,
+            payload: news.payload,
+          });
         }
       }
 
@@ -228,8 +228,10 @@ export const ExpressionProvider = () =>
       if (!expressions.some((e) => e.id === expressionId)) return;
       yield* contentScanning.deletePayload({ zoneId, expressionId }).pipe(
         // A concurrent disable between observe and delete is "gone".
-        Effect.catchTag("ContentScanningNotEnabled", () => Effect.void),
-        Effect.catchTag("InvalidRoute", () => Effect.void),
+        Effect.catchTags({
+          ContentScanningNotEnabled: () => Effect.void,
+          InvalidRoute: () => Effect.void,
+        }),
       );
     }),
   });
@@ -254,8 +256,10 @@ const listExpressions = (zoneId: string) =>
   contentScanning.listPayloads.items({ zoneId }).pipe(
     Stream.runCollect,
     Effect.map((chunk): readonly ObservedExpression[] | undefined => Array.from(chunk)),
-    Effect.catchTag("ContentScanningNotEnabled", () => Effect.succeed(undefined)),
-    Effect.catchTag("InvalidRoute", () => Effect.succeed(undefined)),
+    Effect.catchTags({
+      ContentScanningNotEnabled: () => Effect.succeed(undefined),
+      InvalidRoute: () => Effect.succeed(undefined),
+    }),
   );
 
 const toAttributes = (zoneId: string, expression: ObservedExpression): ExpressionAttributes => ({

package/src/Cloudflare/Credentials.ts

@@ -55,27 +55,24 @@ export const fromAuthProvider = () =>
         Effect.flatMap(({ resolve }) => resolve),
         Effect.map((creds) =>
           Match.value(creds).pipe(
-            Match.when({ type: "apiToken" }, (c) =>
-              apiTokenCredentials({ apiToken: Redacted.value(c.apiToken) }),
-            ),
+            Match.when({ type: "apiToken" }, (c) => apiTokenCredentials({ apiToken: c.apiToken })),
             Match.when({ type: "apiKey" }, (c) =>
               apiKeyCredentials({
-                apiKey: Redacted.value(c.apiKey),
+                apiKey: c.apiKey,
                 email: Redacted.value(c.email),
               }),
             ),
             Match.when({ type: "oauth" }, (c) =>
               oauthCredentials({
-                accessToken: Redacted.value(c.accessToken),
+                accessToken: c.accessToken,
                 expiresAt: c.expires,
               }),
             ),
             Match.exhaustive,
           ),
         ),
-        Effect.mapError(
-          (e) =>
-            new ConfigError({ message: `Failed to resolve Cloudflare credentials: ${e.message}` }),
+        Effect.mapError((e) =>
+          ConfigError.make({ message: `Failed to resolve Cloudflare credentials: ${e.message}` }),
         ),
         deferUntilFirstUse,
       );

package/src/Cloudflare/CustomHostname/CustomHostname.ts

@@ -305,8 +305,10 @@ export const CustomHostnameProvider = () =>
                 ),
               ),
             ),
-            Effect.catchTag("SaasQuotaNotAllocated", () => Effect.succeed([])),
-            Effect.catchTag("Forbidden", () => Effect.succeed([])),
+            Effect.catchTags({
+              SaasQuotaNotAllocated: () => Effect.succeed([]),
+              Forbidden: () => Effect.succeed([]),
+            }),
           ),
         { concurrency: 10 },
       );
@@ -363,9 +365,9 @@ export const CustomHostnameProvider = () =>
             Effect.catch((originalError) =>
               Effect.gen(function* () {
                 const existing = yield* findByHostname(zoneId, news.hostname).pipe(
-                  Effect.catch(() => Effect.succeed(undefined)),
+                  Effect.orElseSucceed(() => undefined),
                 );
-                if (!existing) return yield* Effect.fail(originalError);
+                if (!existing) return yield* originalError;
                 return existing;
               }),
             ),

package/src/Cloudflare/D1/Database.ts

@@ -41,6 +41,13 @@ export type CloneSource = Database | { databaseId: string } | { name: string };
 export type DatabaseProps = {
   /**
    * Name of the database. If omitted, a unique name will be generated.
+   *
+   * D1 names are unique per account. When an explicit name is kept across a
+   * replacement (e.g. `primaryLocationHint` or `jurisdiction` changes), the
+   * existing database and its data are deleted before the new one is created.
+   * Generated names get a new name on replacement, so the new database is
+   * created first.
+   *
    * @default ${app}-${stage}-${id}
    */
   name?: string;
@@ -284,7 +291,15 @@ export const ProviderLive = () =>
         (olds.primaryLocationHint !== news.primaryLocationHint &&
           news.primaryLocationHint !== undefined)
       ) {
-        return { action: "replace" } as const;
+        // D1 names are unique per account, so a replacement that keeps an
+        // explicit name cannot coexist with its predecessor: create-first
+        // would adopt the existing database by name and garbage collection
+        // would then delete it. Delete the old generation first instead.
+        // Generated names change with the new instance id, so they stay
+        // create-first.
+        return news.name !== undefined && news.name === oldName
+          ? ({ action: "replace", deleteFirst: true } as const)
+          : ({ action: "replace" } as const);
       }
       const oldReplicationMode =
         output?.readReplication?.mode ?? olds.readReplication?.mode ?? "disabled";

package/src/Cloudflare/D1/QueryDatabaseHttpClient.ts

@@ -50,8 +50,8 @@ export const makeHttpQueryDatabaseClient = (
  */
 export const makeQueryDatabaseClientFrom = (
   rawEff: Effect.Effect<runtime.D1Database>,
-): QueryDatabaseClient => {
-  return {
+): QueryDatabaseClient =>
+  ({
     raw: rawEff,
     prepare: (query: string) => new PreparedStatement(query, [], rawEff),
     exec: (query: string) => Effect.flatMap(rawEff, (raw) => Effect.promise(() => raw.exec(query))),
@@ -59,8 +59,7 @@ export const makeQueryDatabaseClientFrom = (
       Effect.flatMap(rawEff, (raw) =>
         Effect.promise(() => raw.batch<T>(statements.map((s) => s._build(raw)))),
       ),
-  } satisfies QueryDatabaseClient;
-};
+  }) satisfies QueryDatabaseClient;
 
 const runQuery = (
   auth: D1Auth,

package/src/Cloudflare/D1/QueryDatabaseLocal.ts

@@ -78,6 +78,7 @@ export const QueryDatabaseLocal = Layer.effect(
           // ambient stack-eval context captured above; `Context<never>`
           // can't prove that statically, so erase the leftover R.
           Effect.provideContext(ambient),
+          // oxlint-disable-next-line effecttsgo/unsafe-effect-type-assertion -- remaining requirements are satisfied by the captured ambient context
           (eff) => Effect.runPromise(eff as Effect.Effect<never, never>),
         ) as Promise<{
           result: Array<{ results?: unknown; success?: boolean | null; meta?: unknown }>;