alchemy 2.0.0-beta.81 → 2.0.0-beta.83

package/src/Cloudflare/StateStore/State.ts

@@ -2,6 +2,7 @@ import crypto from "node:crypto";
 import * as SecretsStore from "@distilled.cloud/cloudflare/secrets-store";
 import * as workers from "@distilled.cloud/cloudflare/workers";
 import * as Config from "effect/Config";
+import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as HttpApiClient from "effect/http-api/HttpApiClient";
 import * as HttpClient from "effect/http/HttpClient";
@@ -134,7 +135,7 @@ export const state = () =>
               return yield* upgrade;
             } else if (isCI) {
               return yield* Effect.die(
-                new AuthError({
+                AuthError.make({
                   message:
                     `Cloudflare State store is out of date ` +
                     `(expected v${expected}, observed v${observed ?? "unknown"}). ` +
@@ -167,7 +168,7 @@ export const state = () =>
               const credentials = yield* loginWithCloudflare(profileName, true);
               if (!(yield* checkHttpStateStoreAuth(credentials))) {
                 return yield* Effect.die(
-                  new AuthError({
+                  AuthError.make({
                     message: `Cloudflare State store authentication failed, after refreshing credentials.`,
                   }),
                 );
@@ -208,7 +209,7 @@ export const state = () =>
           return yield* bootstrap();
         } else if (isCI) {
           return yield* Effect.die(
-            new AuthError({
+            AuthError.make({
               message: `Cloudflare State store not found. Run 'alchemy provider cloudflare bootstrap --profile <your-ci-profile>' to deploy it first, or pass --yes.`,
             }),
           );
@@ -704,8 +705,13 @@ const hoistBootstrapStack = Effect.fn(function* ({
  * `CloudflareEnvironment`, `Credentials`, `HttpClient`, and
  * `FileSystem`.
  */
-export const loginWithCloudflare = (profileName: string, force: boolean) =>
-  Effect.gen(function* () {
+export const loginWithCloudflare = Effect.fn("state_store.login", {
+  attributes: {
+    "alchemy.state_store.op": "login",
+    "alchemy.state_store.script_name": STATE_STORE_SCRIPT_NAME,
+  },
+})(
+  function* (profileName: string, force: boolean) {
     const credStore = yield* CredentialsStore;
     const isCI = yield* CI;
     const { accountId } = yield* yield* CloudflareEnvironment.CloudflareEnvironment;
@@ -734,11 +740,9 @@ export const loginWithCloudflare = (profileName: string, force: boolean) =>
           .items({ accountId })
           .pipe(Stream.runHead, Effect.map(Option.getOrUndefined));
         if (!store) {
-          return yield* Effect.fail(
-            new AuthError({
-              message: "No Secrets Store found on this account. Deploy the state store first.",
-            }),
-          );
+          return yield* AuthError.make({
+            message: "No Secrets Store found on this account. Deploy the state store first.",
+          });
         }
 
         // 2. Fetch the auth-token from Secrets Store with a temporary edge-preview worker.
@@ -773,12 +777,11 @@ export const loginWithCloudflare = (profileName: string, force: boolean) =>
           yield* credStore
             .write(profileName, CREDENTIALS_FILE, StoredStateStoreCredentials, credentials)
             .pipe(
-              Effect.mapError(
-                (e) =>
-                  new AuthError({
-                    message: "Failed to write credentials",
-                    cause: e,
-                  }),
+              Effect.mapError((e) =>
+                AuthError.make({
+                  message: "Failed to write credentials",
+                  cause: e,
+                }),
               ),
             );
         }
@@ -788,22 +791,16 @@ export const loginWithCloudflare = (profileName: string, force: boolean) =>
     );
     if (!isCI) yield* interaction.output.info(`  url:     ${credentials.url}`);
     return credentials;
-  }).pipe(
-    Effect.catchTag("EdgeSessionError", (e) =>
-      Effect.fail(
-        new AuthError({
-          message: `Edge-preview secret read failed: ${e.message}`,
-          cause: e.cause,
-        }),
-      ),
+  },
+  Effect.catchTag("EdgeSessionError", (e) =>
+    Effect.fail(
+      AuthError.make({
+        message: `Edge-preview secret read failed: ${e.message}`,
+        cause: e.cause,
+      }),
     ),
-    Effect.withSpan("state_store.login", {
-      attributes: {
-        "alchemy.state_store.op": "login",
-        "alchemy.state_store.script_name": STATE_STORE_SCRIPT_NAME,
-      },
-    }),
-  );
+  ),
+);
 
 const isStateStoreAvailable = (scriptName: string = "alchemy-state-store") =>
   Effect.gen(function* () {
@@ -811,12 +808,14 @@ const isStateStoreAvailable = (scriptName: string = "alchemy-state-store") =>
     const { accountId } = yield* yield* CloudflareEnvironment.CloudflareEnvironment;
     return yield* workers.getScriptSetting({ accountId, scriptName }).pipe(
       Effect.map((setting) => setting !== undefined),
-      Effect.catchTag("WorkerNotFound", () => Effect.succeed(false)),
-      Effect.catchTag("InvalidRoute", () => Effect.succeed(false)),
-      // A worker that exists but has no versions (a previous deploy was
-      // interrupted before any content upload) can't serve — treat it
-      // as absent so bootstrap redeploys it.
-      Effect.catchTag("WorkerHasNoVersions", () => Effect.succeed(false)),
+      Effect.catchTags({
+        WorkerNotFound: () => Effect.succeed(false),
+        InvalidRoute: () => Effect.succeed(false),
+        // A worker that exists but has no versions (a previous deploy was
+        // interrupted before any content upload) can't serve — treat it
+        // as absent so bootstrap redeploys it.
+        WorkerHasNoVersions: () => Effect.succeed(false),
+      }),
     );
   });
 
@@ -831,7 +830,7 @@ const isStateStoreServing = (accountId: string) =>
       Effect.map(({ subdomain }) =>
         subdomain ? `https://${STATE_STORE_SCRIPT_NAME}.${subdomain}.workers.dev` : undefined,
       ),
-      Effect.catch(() => Effect.succeed(undefined)),
+      Effect.orElseSucceed(() => undefined),
     );
     if (url === undefined) return false;
     const { observed } = yield* checkStateStoreVersion(url);
@@ -855,15 +854,12 @@ const makeCloudflareStateStore = Effect.fn(function* ({
   });
 });
 
-class StateStoreVersionNotReady extends Error {
-  readonly _tag = "StateStoreVersionNotReady";
-  constructor(
-    readonly expected: number,
-    readonly observed: number | undefined,
-  ) {
-    super(
-      `Cloudflare State Store version not ready (expected v${expected}, observed v${observed ?? "unknown"}).`,
-    );
+export class StateStoreVersionNotReady extends Data.TaggedError("StateStoreVersionNotReady")<{
+  readonly expected: number;
+  readonly observed: number | undefined;
+}> {
+  override get message() {
+    return `Cloudflare State Store version not ready (expected v${this.expected}, observed v${this.observed ?? "unknown"}).`;
   }
 }
 
@@ -871,7 +867,7 @@ const waitForStateStoreVersion = (url: string) =>
   Effect.gen(function* () {
     const { matches, expected, observed } = yield* checkStateStoreVersion(url);
     if (!matches) {
-      return yield* Effect.fail(new StateStoreVersionNotReady(expected, observed));
+      return yield* new StateStoreVersionNotReady({ expected, observed });
     }
   }).pipe(
     Effect.retry({
@@ -890,51 +886,48 @@ const waitForStateStoreVersion = (url: string) =>
     }),
   );
 
-const checkStateStoreVersion = (url: string) =>
-  Effect.gen(function* () {
-    const client = yield* HttpApiClient.make(StateApi, { baseUrl: url });
-    const isAvailable = yield* Effect.cached(isStateStoreAvailable(STATE_STORE_SCRIPT_NAME));
-    // The /version route may 404 transiently after a fresh deploy
-    // while Cloudflare propagates the new script to the edge, and may
-    // also surface transport-level blips on cold workers.dev hosts.
-    // Retry the probe itself for ~10s before giving up — only after
-    // exhausting that budget do we collapse to `undefined` and let
-    // the caller treat it as a version mismatch.
-    const result = yield* client.version.getVersion().pipe(
-      Effect.catchTag("HttpClientError", (e) =>
-        // if we get a 404 here, it means we assumed the worker shoudl exist, but it does not
-        // we should do a check to see if it does
-        e.response?.status === 404
-          ? isAvailable.pipe(
-              Effect.flatMap((isAvailable) =>
-                // if the worker is available, then we should assume it was recently created and retry by propagating the error
-                // otherwise, return undefined (we don't know the version, there is no worker)
-                isAvailable ? Effect.fail(e) : Effect.succeed(undefined),
-              ),
-            )
-          : Effect.fail(e),
-      ),
-      Effect.retry({
-        schedule: Schedule.max([Schedule.spaced("250 millis"), Schedule.recurs(40)]),
-      }),
-      Effect.catch(() => Effect.succeed(undefined)),
-    );
-    const matches = result?.version === STATE_STORE_VERSION;
-    yield* Effect.annotateCurrentSpan({
-      "alchemy.state_store.expected_version": STATE_STORE_VERSION,
-      "alchemy.state_store.observed_version": result?.version ?? -1,
-      "alchemy.state_store.version_match": matches,
-    });
-    return {
-      matches,
-      expected: STATE_STORE_VERSION,
-      observed: result?.version,
-    };
-  }).pipe(
-    Effect.withSpan("state_store.check_version", {
-      attributes: { "alchemy.state_store.op": "check_version" },
+const checkStateStoreVersion = Effect.fn("state_store.check_version", {
+  attributes: { "alchemy.state_store.op": "check_version" },
+})(function* (url: string) {
+  const client = yield* HttpApiClient.make(StateApi, { baseUrl: url });
+  const isAvailable = yield* Effect.cached(isStateStoreAvailable(STATE_STORE_SCRIPT_NAME));
+  // The /version route may 404 transiently after a fresh deploy
+  // while Cloudflare propagates the new script to the edge, and may
+  // also surface transport-level blips on cold workers.dev hosts.
+  // Retry the probe itself for ~10s before giving up — only after
+  // exhausting that budget do we collapse to `undefined` and let
+  // the caller treat it as a version mismatch.
+  const result = yield* client.version.getVersion().pipe(
+    Effect.catchTag("HttpClientError", (e) =>
+      // if we get a 404 here, it means we assumed the worker shoudl exist, but it does not
+      // we should do a check to see if it does
+      e.response?.status === 404
+        ? isAvailable.pipe(
+            Effect.flatMap((isAvailable) =>
+              // if the worker is available, then we should assume it was recently created and retry by propagating the error
+              // otherwise, return undefined (we don't know the version, there is no worker)
+              isAvailable ? Effect.fail(e) : Effect.succeed(undefined),
+            ),
+          )
+        : Effect.fail(e),
+    ),
+    Effect.retry({
+      schedule: Schedule.max([Schedule.spaced("250 millis"), Schedule.recurs(40)]),
     }),
+    Effect.orElseSucceed(() => undefined),
   );
+  const matches = result?.version === STATE_STORE_VERSION;
+  yield* Effect.annotateCurrentSpan({
+    "alchemy.state_store.expected_version": STATE_STORE_VERSION,
+    "alchemy.state_store.observed_version": result?.version ?? -1,
+    "alchemy.state_store.version_match": matches,
+  });
+  return {
+    matches,
+    expected: STATE_STORE_VERSION,
+    observed: result?.version,
+  };
+});
 
 /**
  * Tiny ES-module worker that reads `env.SECRET.get()` and echoes it
@@ -982,7 +975,7 @@ const readSecretViaEdge = (scriptName: string, storeId: string, secretName: stri
       headers: session.headers,
     });
     if (response.status !== 200) {
-      const body = yield* response.text.pipe(Effect.catch(() => Effect.succeed("")));
+      const body = yield* response.text.pipe(Effect.orElseSucceed(() => ""));
       // TEMP(sam): dump the full body so we can capture the exact
       // Cloudflare error page when the probe fails in the wild. Drop
       // this once we've confirmed the routing fix covers all the
@@ -990,11 +983,9 @@ const readSecretViaEdge = (scriptName: string, storeId: string, secretName: stri
       yield* Effect.logWarning(
         `Secret probe failed (${response.status}) at ${session.url}\n${body}`,
       );
-      return yield* Effect.fail(
-        new EdgeSessionError({
-          message: `Secret probe returned ${response.status}: ${body.slice(0, 200)}`,
-        }),
-      );
+      return yield* new EdgeSessionError({
+        message: `Secret probe returned ${response.status}: ${body.slice(0, 200)}`,
+      });
     }
     return yield* response.text;
   }).pipe(
@@ -1090,4 +1081,4 @@ const annotateAccountHash = (noTrack?: boolean) =>
     if (env._tag !== "Some") return;
     const hash = yield* hashAccountId((yield* env.value).accountId);
     yield* Effect.annotateCurrentSpan("alchemy.cloudflare.account_hash", hash);
-  }).pipe(Effect.catch(() => Effect.void));
+  }).pipe(Effect.ignore);

package/src/Cloudflare/StateStore/Store.ts

@@ -19,13 +19,13 @@ export default class Store extends DurableObject<Store>()(
     const storage = state.storage;
 
     return Effect.gen(function* () {
-      const keyHex = yield* encryptionSecret.get().pipe(Effect.map(Redacted.value), Effect.orDie);
+      const keyHex = yield* encryptionSecret.get().pipe(Effect.map(Redacted.value));
       const cryptoKey = yield* Effect.tryPromise(() =>
         crypto.subtle.importKey("raw", Buffer.from(keyHex, "hex"), { name: "AES-CTR" }, false, [
           "encrypt",
           "decrypt",
         ]),
-      ).pipe(Effect.orDie);
+      );
 
       const encryptValue = (value: unknown) =>
         Effect.tryPromise(async () => {
@@ -220,7 +220,7 @@ export default class Store extends DurableObject<Store>()(
             ),
           ),
       };
-    });
+    }).pipe(Effect.orDie);
   }).pipe(Effect.provide(Secret.ReadSecretBinding)),
 ) {
   /**

package/src/Cloudflare/Stream/LiveInput.ts

@@ -191,10 +191,7 @@ export const LiveInputProvider = () =>
     // item into the same Attributes shape `read` produces.
     list: Effect.fn(function* () {
       const { accountId } = yield* yield* CloudflareEnvironment;
-      // Cloudflare returns this list either wrapped (`{ liveInputs: [...] }`)
-      // or as a bare `result` array depending on the account — handle both.
-      const response = yield* stream.listLiveInputs({ accountId });
-      const inputs = Array.isArray(response) ? response : (response.liveInputs ?? []);
+      const inputs = yield* stream.listLiveInputs({ accountId });
       return inputs
         .filter((li): li is typeof li & { uid: string } => li.uid !== null && li.uid !== undefined)
         .map((li) => toAttributes(li, accountId));

package/src/Cloudflare/Stream/LiveInputOutput.ts

@@ -218,10 +218,8 @@ export const LiveInputOutputProvider = () =>
       // Parent fan-out: outputs are sub-resources of a live input and
       // have no account-wide enumeration endpoint. Enumerate every live
       // input on the account, then list each input's outputs.
-      // Cloudflare returns this list either wrapped (`{ liveInputs: [...] }`)
-      // or as a bare `result` array depending on the account — handle both.
       const inputs = yield* stream.listLiveInputs({ accountId });
-      const liveInputIds = (Array.isArray(inputs) ? inputs : (inputs.liveInputs ?? []))
+      const liveInputIds = inputs
         .map((input) => input.uid)
         .filter((uid): uid is string => typeof uid === "string");
 

package/src/Cloudflare/Tunnel/Route.ts

@@ -187,9 +187,9 @@ export const RouteProvider = () =>
           .pipe(
             Effect.catch((err) =>
               Effect.gen(function* () {
-                if (!news.adopt) return yield* Effect.fail(err);
+                if (!news.adopt) return yield* err;
                 const existing = yield* observe(acct, network, virtualNetworkId, undefined);
-                if (!existing) return yield* Effect.fail(err);
+                if (!existing) return yield* err;
                 // Sentinel: undefined means "adoption path; use re-observed value".
                 return undefined;
               }),
@@ -253,7 +253,7 @@ export const RouteProvider = () =>
           // Idempotent delete: distilled doesn't tag NotFound on
           // teamnet/routes/{id}, so we swallow read-side failure
           // wholesale. A "delete a deleted route" is not an error.
-          Effect.catch(() => Effect.succeed(undefined)),
+          Effect.orElseSucceed(() => undefined),
         );
     }),
     list: Effect.fn(function* () {
@@ -337,7 +337,7 @@ const findRouteByNetwork = (
       // canonical `Tunnel.ts` template: swallow read-side
       // errors so observation falls through to "missing" and
       // the ensure step can recover.
-      Effect.catch(() => Effect.succeed(undefined)),
+      Effect.orElseSucceed(() => undefined),
     );
 
 const toObserved = (r: {
@@ -372,7 +372,7 @@ const observe = Effect.fn(function* (
     // error and fall through to the list scan.
     const raw = yield* zeroTrust
       .getNetworkRoute({ accountId: acct, routeId })
-      .pipe(Effect.catch(() => Effect.succeed(undefined)));
+      .pipe(Effect.orElseSucceed(() => undefined));
     const got = raw ? toObserved(raw) : undefined;
     if (got) return got;
   }

package/src/Cloudflare/Tunnel/Tunnel.ts

@@ -248,7 +248,7 @@ export const TunnelProvider = () =>
             accountId: acct,
             tunnelId: output.tunnelId,
           })
-          .pipe(Effect.catch(() => Effect.succeed(undefined)));
+          .pipe(Effect.orElseSucceed(() => undefined));
       }
       if (!observed) {
         observed = yield* findTunnelByName(name);
@@ -268,10 +268,10 @@ export const TunnelProvider = () =>
           .pipe(
             Effect.catch((err) =>
               Effect.gen(function* () {
-                if (!news.adopt) return yield* Effect.fail(err);
+                if (!news.adopt) return yield* err;
                 const existing = yield* findTunnelByName(name);
                 if (!existing || !existing.id) {
-                  return yield* Effect.fail(err);
+                  return yield* err;
                 }
                 return existing;
               }),
@@ -357,7 +357,7 @@ export const TunnelProvider = () =>
                   })),
                 ),
             ),
-            Effect.catch(() => Effect.succeed(undefined)),
+            Effect.orElseSucceed(() => undefined),
           );
       }
       const name = yield* createTunnelName(id, olds?.name);

package/src/Cloudflare/Tunnel/WarpConnector.ts

@@ -163,7 +163,7 @@ export const WarpConnectorProvider = () =>
         observed,
         (t) =>
           toAttributes(t, accountId).pipe(
-            Effect.map(Option.some),
+            Effect.asSome,
             Effect.catchTag("TunnelNotFound", () =>
               Effect.succeed(Option.none<WarpConnectorAttributes>()),
             ),

package/src/Cloudflare/VpcService/VpcService.ts

@@ -96,6 +96,10 @@ export type VpcService = Resource<
 /**
  * A Cloudflare VPC service that exposes a private host (IP or hostname)
  * reachable through a Cloudflare Tunnel for Workers VPC.
+ *
+ * `VpcService` creates HTTP services. For a TCP service — e.g. a private
+ * database that Hyperdrive connects to — use
+ * `Cloudflare.Connectivity.DirectoryService` with `type: "tcp"`.
  * ### Creating a VPC Service
  * **Example:** Hostname through a tunnel
  * ```typescript
@@ -198,7 +202,7 @@ export const VpcServiceProvider = () =>
             accountId: acct,
             serviceId: output.serviceId,
           })
-          .pipe(Effect.catch(() => Effect.succeed(undefined)));
+          .pipe(Effect.orElseSucceed(() => undefined));
       }
       if (!observed) {
         const match = yield* findServiceByName(name);
@@ -274,7 +278,7 @@ export const VpcServiceProvider = () =>
           })
           .pipe(
             Effect.map((s) => formatVpcService(s, output.accountId)),
-            Effect.catch(() => Effect.succeed(undefined)),
+            Effect.orElseSucceed(() => undefined),
           );
       }
       const name = yield* createServiceName(id, olds?.name);

package/src/Cloudflare/WaitingRoom/Settings.ts

@@ -125,8 +125,10 @@ export const SettingsProvider = () =>
             // Plan-gated or partial zones reject the route; a zone the token
             // still can't read (persistent 403) isn't ours to enumerate —
             // skip both rather than failing the whole listing.
-            Effect.catchTag("InvalidRoute", () => Effect.succeed(undefined)),
-            Effect.catchTag("Forbidden", () => Effect.succeed(undefined)),
+            Effect.catchTags({
+              InvalidRoute: () => Effect.succeed(undefined),
+              Forbidden: () => Effect.succeed(undefined),
+            }),
           ),
         { concurrency: 10 },
       );

package/src/Cloudflare/WaitingRoom/WaitingRoom.ts

@@ -377,9 +377,11 @@ export const WaitingRoomProvider = () =>
         })
         .pipe(
           // Already gone (code 1001) — deletion is idempotent.
-          Effect.catchTag("WaitingRoomNotFound", () => Effect.void),
-          // Zone deleted out-of-band — the room is gone with it.
-          Effect.catchTag("InvalidRoute", () => Effect.void),
+          Effect.catchTags({
+            WaitingRoomNotFound: () => Effect.void,
+            // Zone deleted out-of-band — the room is gone with it.
+            InvalidRoute: () => Effect.void,
+          }),
         );
     }),
 
@@ -401,8 +403,10 @@ export const WaitingRoomProvider = () =>
             ),
             // Plan-gated / partial-permission zones reject the route, and a
             // zone deleted out-of-band has no rooms; skip both.
-            Effect.catchTag("Forbidden", () => Effect.succeed([] as Attributes[])),
-            Effect.catchTag("InvalidRoute", () => Effect.succeed([] as Attributes[])),
+            Effect.catchTags({
+              Forbidden: () => Effect.succeed([] as Attributes[]),
+              InvalidRoute: () => Effect.succeed([] as Attributes[]),
+            }),
           ),
         { concurrency: 10 },
       );
@@ -420,8 +424,10 @@ type ObservedRoom = waitingRooms.GetWaitingRoomResponse;
 const getRoom = (zoneId: string, waitingRoomId: string) =>
   waitingRooms.getWaitingRoom({ zoneId, waitingRoomId }).pipe(
     Effect.map((room): ObservedRoom | undefined => room),
-    Effect.catchTag("WaitingRoomNotFound", () => Effect.succeed(undefined)),
-    Effect.catchTag("InvalidRoute", () => Effect.succeed(undefined)),
+    Effect.catchTags({
+      WaitingRoomNotFound: () => Effect.succeed(undefined),
+      InvalidRoute: () => Effect.succeed(undefined),
+    }),
   );
 
 /**

package/src/Cloudflare/Workers/AlarmCallback.ts

@@ -234,13 +234,10 @@ export const dispatchAlarmCallbacks = (state: cf.DurableObjectState, hasLegacyHa
         raw.sql.exec("SELECT id FROM alchemy_scheduled_events LIMIT 1").toArray(),
       );
       if (legacy.length > 0) {
-        return yield* Effect.fail(
-          new CallbackError({
-            callback: "scheduleEvent",
-            message:
-              "Pending legacy events require an alarm handler calling processScheduledEvents",
-          }),
-        );
+        return yield* new CallbackError({
+          callback: "scheduleEvent",
+          message: "Pending legacy events require an alarm handler calling processScheduledEvents",
+        });
       }
     }
     const now = yield* Clock.currentTimeMillis;
@@ -277,12 +274,10 @@ export const dispatchAlarmCallbacks = (state: cf.DurableObjectState, hasLegacyHa
       yield* storage.sync();
       const result = yield* Effect.gen(function* () {
         if (!callback) {
-          return yield* Effect.fail(
-            new CallbackError({
-              callback: job.callback,
-              message: "No handler is registered for a pending alarm",
-            }),
-          );
+          return yield* new CallbackError({
+            callback: job.callback,
+            message: "No handler is registered for a pending alarm",
+          });
         }
         const payload = yield* Effect.try({
           try: () => JSON.parse(job.payload),

package/src/Cloudflare/Workers/Assets.ts

@@ -1,4 +1,3 @@
-import createIgnore from "@alchemy.run/node-utils/ignore";
 import * as Retry from "@distilled.cloud/cloudflare/Retry";
 import * as workers from "@distilled.cloud/cloudflare/workers";
 import * as wfp from "@distilled.cloud/cloudflare/workers-for-platforms";
@@ -11,6 +10,7 @@ import * as Predicate from "effect/Predicate";
 import * as Schedule from "effect/Schedule";
 import * as Semaphore from "effect/Semaphore";
 import type { ScopedPlanStatusSession } from "../../Report.ts";
+import { listFileSystemDirectory, parseIgnoreRules, walkIgnoring } from "../../Util/Ignore.ts";
 import { sha256, sha256Object } from "../../Util/index.ts";
 import { initialCwd } from "../../Util/Node.ts";
 
@@ -228,11 +228,6 @@ const maybeReadString = Effect.fn(function* (file: string) {
   );
 });
 
-const createIgnoreMatcher = (patterns: string[]) => {
-  const matcher = createIgnore().add(patterns);
-  return (file: string) => matcher.ignores(file);
-};
-
 /**
  * Read the special `_headers` / `_redirects` files from an assets
  * directory. They are excluded from the upload manifest, but their raw
@@ -293,29 +288,39 @@ export const readAssets = Effect.fn(function* ({ directory, base, ...config }: A
   // `Command.Build` (relative to the initial cwd), and a live
   // `process.cwd()` read can race a concurrent tool's transient chdir.
   const resolvedDirectory = path.resolve(initialCwd, directory);
-  const [files, ignore, _headers, _redirects] = yield* Effect.all([
-    fs.readDirectory(resolvedDirectory, { recursive: true }),
+  const [ignore, _headers, _redirects] = yield* Effect.all([
     maybeReadString(path.join(resolvedDirectory, ".assetsignore")),
     maybeReadString(path.join(resolvedDirectory, "_headers")),
     maybeReadString(path.join(resolvedDirectory, "_redirects")),
   ]);
-  const ignores = createIgnoreMatcher([
-    ".assetsignore",
-    "_headers",
-    "_redirects",
-    ...(ignore
-      ?.split("\n")
-      .map((line) => line.trim())
-      .filter((line) => line.length > 0 && !line.startsWith("#")) ?? []),
-  ]);
+  // `.assetsignore` uses gitignore semantics (as in wrangler). Excluded
+  // directories are skipped without being read.
+  const files = yield* walkIgnoring({
+    list: yield* listFileSystemDirectory(resolvedDirectory),
+    rules: parseIgnoreRules(
+      [
+        ".assetsignore",
+        "_headers",
+        "_redirects",
+        ...(ignore
+          ?.split("\n")
+          .map((line) => line.trim())
+          .filter((line) => line.length > 0 && !line.startsWith("#")) ?? []),
+      ],
+      "gitignore",
+    ),
+  }).pipe(
+    // Symlinked files are uploaded by their target's content (stat follows
+    // links below); directories only contribute their files.
+    Effect.map((entries) =>
+      entries.flatMap((entry) => (entry.type === "Directory" ? [] : [entry.path])),
+    ),
+  );
   const manifest = new Map<string, { hash: string; size: number }>();
   let count = 0;
   yield* Effect.forEach(
     files,
     Effect.fn(function* (name) {
-      if (ignores(name)) {
-        return;
-      }
       const file = path.join(resolvedDirectory, name);
       const stat = yield* fs.stat(file);
       if (stat.type !== "File") {