alchemy 2.0.0-beta.43 → 2.0.0-beta.45

package/src/Cloudflare/Container/Container.ts

@@ -176,7 +176,7 @@ export type Container = {
  *
  *     return Effect.gen(function* () {
  *       // INNER (per-instance): start the container and expose RPC.
- *       const container = yield* Cloudflare.start(sandbox);
+ *       const container = yield* Cloudflare.start(sandbox, { enableInternet: true });
  *
  *       return {
  *         exec: (cmd: string) => container.exec(cmd),
@@ -200,7 +200,7 @@ export type Container = {
  *
  * // per-instance (inner Effect)
  * return Effect.gen(function* () {
- *   const container = yield* Cloudflare.start(sandbox);
+ *   const container = yield* Cloudflare.start(sandbox, { enableInternet: true });
  *
  *   return {
  *     exec: (cmd: string) => container.exec(cmd),
@@ -215,7 +215,7 @@ export type Container = {
  *
  * @example Fetching from a container port
  * ```typescript
- * const container = yield* Cloudflare.start(sandbox);
+ * const container = yield* Cloudflare.start(sandbox, { enableInternet: true });
  * const { fetch } = yield* container.getTcpPort(3000);
  *
  * const response = yield* fetch(

package/src/Cloudflare/Container/StartContainer.ts

@@ -9,10 +9,9 @@ import { type Fetcher } from "../Fetcher.ts";
 import { DurableObjectState } from "../Workers/DurableObjectState.ts";
 import {
   type Container,
-  type ContainerStartupOptions,
   ContainerError,
+  type ContainerStartupOptions,
 } from "./Container.ts";
-
 /**
  * Runs the Container in a Durable Object and monitors it, providing a durable fetch and RPC interface to it.
  */

package/src/Cloudflare/D1/D1Database.ts

@@ -5,12 +5,15 @@ import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
+import { listSqlFiles, readSqlFile } from "../../Sql/SqlFile.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Providers } from "../Providers.ts";
 import { cloneD1Database } from "./D1Clone.ts";
 import { importD1Database } from "./D1Import.ts";
 import { applyMigrations } from "./D1Migrations.ts";
-import { listSqlFiles, readSqlFile } from "../../Sql/SqlFile.ts";
+
+export const isD1Database = (value: unknown): value is D1Database =>
+  typeof value === "object" && (value as any)?.Type === "Cloudflare.D1Database";
 
 export type Jurisdiction = "default" | "eu" | "fedramp";
 export type PrimaryLocationHint =

package/src/Cloudflare/D1/D1DatabaseBinding.ts

@@ -13,7 +13,7 @@ export const DatabaseBinding = Effect.fn(function* (
         {
           type: "d1",
           name: database.LogicalId,
-          id: database.databaseId,
+          databaseId: database.databaseId,
         },
       ],
     });

package/src/Cloudflare/Fetcher.ts

@@ -133,10 +133,8 @@ export const toHttpClient = (fetcher: {
   ) => Effect.Effect<HttpServerResponse.HttpServerResponse, HttpServerError>;
 }) =>
   HttpClient.make((request) => {
-    console.log("toHttpClient: request", request.url);
     return fetcher.fetch(HttpServerRequest.fromClientRequest(request)).pipe(
       Effect.map((response) => {
-        console.log("toHttpClient: response", response);
         return HttpClientResponse.fromWeb(
           request,
           HttpServerResponse.toWeb(response),

package/src/Cloudflare/Hyperdrive/Hyperdrive.ts

@@ -1,5 +1,6 @@
 import * as hyperdrive from "@distilled.cloud/cloudflare/hyperdrive";
 import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
 import * as Redacted from "effect/Redacted";
 
 import { AlchemyContext } from "../../AlchemyContext.ts";
@@ -157,6 +158,10 @@ export const Hyperdrive = Resource<Hyperdrive>("Cloudflare.Hyperdrive")({
   bind: HyperdriveBinding.bind,
 });
 
+export const isHyperdrive = (value: unknown): value is Hyperdrive =>
+  Predicate.hasProperty(value, "Type") &&
+  value.Type === "Cloudflare.Hyperdrive";
+
 export const HyperdriveProvider = () =>
   Provider.effect(
     Hyperdrive,

package/src/Cloudflare/Hyperdrive/HyperdriveBinding.ts

@@ -2,7 +2,6 @@ import type * as runtime from "@cloudflare/workers-types";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
-import { AlchemyContext } from "../../AlchemyContext.ts";
 import * as Binding from "../../Binding.ts";
 import * as Output from "../../Output.ts";
 import type { ResourceLike } from "../../Resource.ts";
@@ -102,8 +101,6 @@ export class HyperdriveBindingPolicy extends Binding.Policy<
 
 export const HyperdriveBindingPolicyLive = HyperdriveBindingPolicy.layer.effect(
   Effect.gen(function* () {
-    const ctx = yield* AlchemyContext;
-
     return Effect.fn(function* (host: ResourceLike, hyperdrive: Hyperdrive) {
       if (!isWorker(host)) {
         return yield* Effect.die(
@@ -113,38 +110,6 @@ export const HyperdriveBindingPolicyLive = HyperdriveBindingPolicy.layer.effect(
         );
       }
 
-      const origin = Output.map(
-        Output.all(hyperdrive.dev, hyperdrive.origin, hyperdrive.mtls),
-        ([dev, origin, mtls]): Required<HyperdriveDevOrigin> => {
-          if (dev) {
-            return {
-              scheme: dev.scheme,
-              host: dev.host,
-              port: dev.port ?? defaultPort(dev.scheme),
-              user: dev.user,
-              database: dev.database,
-              password: dev.password,
-              sslmode: dev.sslmode ?? "prefer",
-            };
-          }
-          if ("accessClientId" in origin) {
-            throw new Error(
-              `Hyperdrive instance ${hyperdrive.LogicalId} has an origin that requires Cloudflare Access. This is not supported in development mode. ` +
-                "Select a different origin or set the `dev` property to an origin that does not require Cloudflare Access.",
-            );
-          }
-          return {
-            scheme: origin.scheme,
-            host: origin.host,
-            port: origin.port ?? defaultPort(origin.scheme),
-            user: origin.user,
-            database: origin.database,
-            password: origin.password,
-            sslmode: mtls?.sslmode ?? "require",
-          };
-        },
-      );
-
       yield* host.bind`${hyperdrive}`({
         bindings: [
           {
@@ -153,15 +118,48 @@ export const HyperdriveBindingPolicyLive = HyperdriveBindingPolicy.layer.effect(
             id: hyperdrive.hyperdriveId as unknown as string,
           },
         ],
-        hyperdrives: ctx.dev
-          ? (Output.map(
-              Output.all(hyperdrive.hyperdriveId, Output.asOutput(origin)),
-              ([id, origin]) => ({
-                [id]: origin,
-              }),
-            ) as unknown as Record<string, Required<HyperdriveDevOrigin>>)
-          : undefined,
+        hyperdrives: getHyperdriveDevOrigin(hyperdrive),
       });
     });
   }),
 );
+
+export const getHyperdriveDevOrigin = (hyperdrive: Hyperdrive) => {
+  const origin = Output.map(
+    Output.all(hyperdrive.dev, hyperdrive.origin, hyperdrive.mtls),
+    ([dev, origin, mtls]): Required<HyperdriveDevOrigin> => {
+      if (dev) {
+        return {
+          scheme: dev.scheme,
+          host: dev.host,
+          port: dev.port ?? defaultPort(dev.scheme),
+          user: dev.user,
+          database: dev.database,
+          password: dev.password,
+          sslmode: dev.sslmode ?? "prefer",
+        };
+      }
+      if ("accessClientId" in origin) {
+        throw new Error(
+          `Hyperdrive instance ${hyperdrive.LogicalId} has an origin that requires Cloudflare Access. This is not supported in development mode. ` +
+            "Select a different origin or set the `dev` property to an origin that does not require Cloudflare Access.",
+        );
+      }
+      return {
+        scheme: origin.scheme,
+        host: origin.host,
+        port: origin.port ?? defaultPort(origin.scheme),
+        user: origin.user,
+        database: origin.database,
+        password: origin.password,
+        sslmode: mtls?.sslmode ?? "require",
+      };
+    },
+  );
+  return Output.map(
+    Output.all(hyperdrive.hyperdriveId, Output.asOutput(origin)),
+    ([id, origin]) => ({
+      [id]: origin,
+    }),
+  ) as unknown as Record<string, Required<HyperdriveDevOrigin>>;
+};

package/src/Cloudflare/KV/KVNamespace.ts

@@ -10,6 +10,10 @@ import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Providers } from "../Providers.ts";
 import { KVNamespaceBinding } from "./KVNamespaceBinding.ts";
 
+export const isKVNamespace = (value: unknown): value is KVNamespace =>
+  typeof value === "object" &&
+  (value as any)?.Type === "Cloudflare.KVNamespace";
+
 export type KVNamespaceProps = {
   /**
    * A human-readable string name for the namespace.

package/src/Cloudflare/Local.ts

@@ -0,0 +1,23 @@
+import * as Layer from "effect/Layer";
+import * as RpcServer from "../Local/RpcServer.ts";
+import { CloudflareAuth } from "./Auth/AuthProvider.ts";
+import * as CloudflareEnvironment from "./CloudflareEnvironment.ts";
+import * as Credentials from "./Credentials.ts";
+import {
+  LocalWorkerProvider,
+  localRuntimeServices,
+} from "./Workers/LocalWorkerProvider.ts";
+
+const cloudflareServices = Layer.provide(
+  Layer.merge(
+    Credentials.fromAuthProvider(),
+    CloudflareEnvironment.fromProfile(),
+  ),
+  CloudflareAuth,
+);
+
+LocalWorkerProvider().pipe(
+  Layer.provide(localRuntimeServices()),
+  Layer.provide(cloudflareServices),
+  RpcServer.launch,
+);

package/src/Cloudflare/Providers.ts

@@ -5,11 +5,12 @@ import { pipe } from "effect/Function";
 import * as Layer from "effect/Layer";
 import * as Ref from "effect/Ref";
 import * as Schedule from "effect/Schedule";
+import { CredentialsStoreLive } from "../Auth/Credentials.ts";
+import { ProfileLive } from "../Auth/Profile.ts";
 import { Command } from "../Build/Command.ts";
 import * as Build from "../Build/index.ts";
+import { KeyPair, KeyPairProvider } from "../KeyPair.ts";
 import * as Provider from "../Provider.ts";
-import { CredentialsStoreLive } from "../Auth/Credentials.ts";
-import { ProfileLive } from "../Auth/Profile.ts";
 import { Random, RandomProvider } from "../Random.ts";
 import * as Access from "./Access.ts";
 import * as AiGateway from "./AiGateway/index.ts";
@@ -17,6 +18,7 @@ import * as AnalyticsEngine from "./AnalyticsEngine/index.ts";
 import * as ApiToken from "./ApiToken/index.ts";
 import * as Artifacts from "./Artifacts/index.ts";
 import { CloudflareAuth } from "./Auth/AuthProvider.ts";
+import * as BrowserRendering from "./BrowserRendering/index.ts";
 import * as CloudflareEnvironment from "./CloudflareEnvironment.ts";
 import * as Containers from "./Container/index.ts";
 import * as Credentials from "./Credentials.ts";
@@ -32,6 +34,7 @@ import * as Tunnel from "./Tunnel/index.ts";
 import * as VpcService from "./VpcService/index.ts";
 import * as Workers from "./Workers/index.ts";
 import * as Workflows from "./Workers/Workflow.ts";
+import * as Zaraz from "./Zaraz/index.ts";
 
 export { Credentials } from "@distilled.cloud/cloudflare/Credentials";
 
@@ -54,6 +57,7 @@ export const providers = () =>
       AiGateway.AiGatewayBindingPolicy,
       AnalyticsEngine.AnalyticsEngineDatasetBindingPolicy,
       Artifacts.ArtifactsBindingPolicy,
+      BrowserRendering.BrowserRenderingBindingPolicy,
       Command,
       Containers.Container,
       D1.D1ConnectionPolicy,
@@ -78,12 +82,14 @@ export const providers = () =>
       SecretsStore.Secret,
       Tunnel.Tunnel,
       VpcService.VpcService,
+      KeyPair,
       Random,
       Workers.BindWorkerPolicy,
       Workers.CronEventSourcePolicy,
       Workers.FetchPolicy,
       Workers.Worker,
       Workflows.WorkflowResource,
+      Zaraz.ZarazConfig,
     ]),
   ).pipe(
     Layer.provide(
@@ -94,6 +100,7 @@ export const providers = () =>
         AiGateway.AiGatewayBindingPolicyLive,
         AnalyticsEngine.AnalyticsEngineDatasetBindingPolicyLive,
         Artifacts.ArtifactsBindingPolicyLive,
+        BrowserRendering.BrowserRenderingBindingPolicyLive,
         Containers.ContainerProvider(),
         D1.D1ConnectionPolicyLive,
         D1.DatabaseProvider(),
@@ -122,10 +129,15 @@ export const providers = () =>
         Workers.FetchPolicyLive,
         Workers.WorkerProvider(),
         Workflows.WorkflowProvider(),
+        Zaraz.ZarazConfigProvider(),
       ),
     ),
     Layer.provideMerge(
-      Layer.mergeAll(Build.CommandProvider(), RandomProvider()),
+      Layer.mergeAll(
+        Build.CommandProvider(),
+        KeyPairProvider(),
+        RandomProvider(),
+      ),
     ),
     Layer.provideMerge(Credentials.fromAuthProvider()),
     Layer.provideMerge(CloudflareEnvironment.fromProfile()),
@@ -154,19 +166,6 @@ export const providers = () =>
     Layer.orDie,
   );
 
-const isMisleadinglyTaggedTransient = (error: unknown): boolean => {
-  if (!error || typeof error !== "object") return false;
-  const tag = (error as { _tag?: unknown })._tag;
-  const message = ((error as { message?: unknown }).message ?? "") as string;
-  // CF code 10001: "Method not allowed for token" is a real permission
-  // failure (NOT retryable), but the same code is also returned with
-  // message "internal error" during Cloudflare-side hiccups. The two
-  // messages are unambiguously distinct, so we can safely retry only
-  // the internal-error variant.
-  if (tag === "Forbidden" && /internal error/i.test(message)) return true;
-  return false;
-};
-
 const cloudflareRetryFactory: Retry.Factory = (lastError) => {
   const defaults = Retry.makeDefault(lastError);
   return {
@@ -193,3 +192,16 @@ const cloudflareRetryFactory: Retry.Factory = (lastError) => {
     ),
   };
 };
+
+const isMisleadinglyTaggedTransient = (error: unknown): boolean => {
+  if (!error || typeof error !== "object") return false;
+  const tag = (error as { _tag?: unknown })._tag;
+  const message = ((error as { message?: unknown }).message ?? "") as string;
+  // CF code 10001: "Method not allowed for token" is a real permission
+  // failure (NOT retryable), but the same code is also returned with
+  // message "internal error" during Cloudflare-side hiccups. The two
+  // messages are unambiguously distinct, so we can safely retry only
+  // the internal-error variant.
+  if (tag === "Forbidden" && /internal error/i.test(message)) return true;
+  return false;
+};

package/src/Cloudflare/Queue/Queue.ts

@@ -10,6 +10,9 @@ import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Providers } from "../Providers.ts";
 import { QueueBinding } from "./QueueBinding.ts";
 
+export const isQueue = (value: unknown): value is Queue =>
+  typeof value === "object" && (value as any)?.Type === "Cloudflare.Queue";
+
 export type QueueProps = {
   /**
    * Name of the queue. If omitted, a unique name will be generated.

package/src/Cloudflare/Queue/QueueConsumer.ts

@@ -1,4 +1,5 @@
 import * as queues from "@distilled.cloud/cloudflare/queues";
+import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as Schedule from "effect/Schedule";
@@ -118,11 +119,11 @@ type ObservedConsumer = {
 
 const toObserved = (c: {
   consumerId?: string | null;
-  script?: string | null;
+  scriptName?: string | null;
   type?: "worker" | "http_pull" | null;
 }): ObservedConsumer | undefined =>
   c.consumerId && c.type === "worker"
-    ? { consumerId: c.consumerId, script: c.script ?? undefined }
+    ? { consumerId: c.consumerId, script: c.scriptName ?? undefined }
     : undefined;
 
 export const QueueConsumerProvider = () =>
@@ -139,10 +140,7 @@ export const QueueConsumerProvider = () =>
       // first match in the paginated stream is the only one. Using
       // `.items` defeats single-page lookups that would otherwise
       // miss late-arriving consumers under eventual consistency.
-      const findWorkerConsumer = (
-        acct: string,
-        queueId: string,
-      ): Effect.Effect<ObservedConsumer | undefined, any, any> =>
+      const findWorkerConsumer = (acct: string, queueId: string) =>
         queues.listConsumers.items({ accountId: acct, queueId }).pipe(
           Stream.map(toObserved),
           Stream.filter((c): c is ObservedConsumer => c !== undefined),
@@ -367,6 +365,22 @@ export const QueueConsumerProvider = () =>
             }),
           );
 
+          yield* getConsumer({ accountId: acct, queueId, consumerId }).pipe(
+            Effect.tap(Console.log),
+            Effect.flatMap((fetched) =>
+              toObserved(fetched)?.script === news.scriptName
+                ? Effect.void
+                : Effect.fail("ScriptUnbound" as const),
+            ),
+            Effect.catchTag("ConsumerNotFound", () =>
+              Effect.fail("ScriptUnbound" as const),
+            ),
+            Effect.retry({
+              while: (e) => e === "ScriptUnbound",
+              schedule: queueHandlerReadinessSchedule,
+            }),
+          );
+
           return {
             consumerId,
             queueId,
@@ -418,8 +432,9 @@ export const QueueConsumerProvider = () =>
                 consumerId: fetched.consumerId!,
                 queueId: output.queueId,
                 scriptName:
-                  ("script" in fetched && typeof fetched.script === "string"
-                    ? fetched.script
+                  ("scriptName" in fetched &&
+                  typeof fetched.scriptName === "string"
+                    ? fetched.scriptName
                     : output.scriptName) ?? output.scriptName,
                 accountId: output.accountId,
               };

package/src/Cloudflare/Queue/QueueEventSource.ts

@@ -1,6 +1,7 @@
 import type * as cf from "@cloudflare/workers-types";
 import * as Cause from "effect/Cause";
 import * as Context from "effect/Context";
+import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Stream from "effect/Stream";
@@ -8,6 +9,7 @@ import * as Binding from "../../Binding.ts";
 import type { ResourceLike } from "../../Resource.ts";
 import { RuntimeContext } from "../../RuntimeContext.ts";
 import type { FunctionContext } from "../../Serverless/Function.ts";
+import * as DurationUtil from "../../Util/Duration.ts";
 import { isWorker, isWorkerEvent } from "../Workers/Worker.ts";
 import type { Queue } from "./Queue.ts";
 import { QueueConsumer } from "./QueueConsumer.ts";
@@ -25,14 +27,37 @@ export interface MessagesProps {
   maxConcurrency?: number;
   /** Maximum delivery attempts before dead-lettering. */
   maxRetries?: number;
-  /** Wait time, in ms, before flushing a partial batch. */
-  maxWaitTimeMs?: number;
-  /** Backoff, in seconds, applied to a retry. */
-  retryDelay?: number;
+  /**
+   * Wait time before flushing a partial batch. Rounded up to whole
+   * milliseconds when forwarded to Cloudflare.
+   */
+  maxWaitTime?: Duration.Input;
+  /**
+   * Backoff applied to a retry. Rounded up to whole seconds when
+   * forwarded to Cloudflare.
+   */
+  retryDelay?: Duration.Input;
   /** Optional dead-letter queue name. */
   deadLetterQueue?: string;
 }
 
+/**
+ * Convert a {@link MessagesProps} (with `Duration.Input` time fields)
+ * into the numeric settings shape Cloudflare's `QueueConsumer` API
+ * expects. `maxWaitTime` is rounded up to whole milliseconds and
+ * `retryDelay` to whole seconds.
+ *
+ * Exposed for testing and for callers that want to mirror the
+ * conversion when wiring `QueueConsumer` directly.
+ */
+export const toConsumerSettings = (props: MessagesProps) => ({
+  batchSize: props.batchSize,
+  maxConcurrency: props.maxConcurrency,
+  maxRetries: props.maxRetries,
+  maxWaitTimeMs: DurationUtil.toMillis(props.maxWaitTime),
+  retryDelay: DurationUtil.toSeconds(props.retryDelay),
+});
+
 /**
  * A single queue message handed to the subscribe handler. Mirrors
  * Cloudflare's runtime `Message<Body>` shape so per-message
@@ -63,12 +88,15 @@ export type QueueMessage<Body = unknown> = cf.Message<Body>;
  * @example
  * ```typescript
  * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Duration from "effect/Duration";
  * import * as Effect from "effect/Effect";
  * import * as Stream from "effect/Stream";
  *
  * yield* Cloudflare.messages<MyEvent>(queueResource, {
  *   batchSize: 25,
  *   maxRetries: 3,
+ *   maxWaitTime: "5 seconds",
+ *   retryDelay: Duration.seconds(30),
  * }).subscribe((stream) =>
  *   Stream.runForEach(stream, (msg) =>
  *     Effect.log(`event ${msg.body.id}`),
@@ -148,7 +176,7 @@ export const QueueEventSourcePolicyLive = QueueEventSourcePolicy.layer.succeed(
       yield* QueueConsumer(`${queue.LogicalId}Consumer`, {
         queueId: queue.queueId,
         scriptName: host.workerName,
-        settings: props,
+        settings: toConsumerSettings(props),
         deadLetterQueue: props.deadLetterQueue,
       });
     })) as unknown as (

package/src/Cloudflare/R2/R2Bucket.ts

@@ -12,6 +12,9 @@ import type * as Cloudflare from "../Providers.ts";
 import * as Zone from "../Zone.ts";
 import { R2BucketBinding } from "./R2BucketBinding.ts";
 
+export const isR2Bucket = (value: unknown): value is R2Bucket =>
+  typeof value === "object" && (value as any)?.Type === "Cloudflare.R2Bucket";
+
 export type R2BucketName = string;
 
 export type R2BucketCustomDomainZone = Zone.ZoneReference;
@@ -520,6 +523,10 @@ export const R2BucketProvider = () =>
                       while: isNoSuchBucket,
                       schedule: r2BucketEndpointConsistencySchedule,
                     }),
+                    Effect.retry({
+                      while: isDomainInUseConflict,
+                      schedule: r2CustomDomainConflictSchedule,
+                    }),
                   );
                   return toCustomDomainAttributes({ ...created, zoneId });
                 }
@@ -842,3 +849,22 @@ const isNoSuchBucket = (error: unknown): boolean =>
   error !== null &&
   "_tag" in error &&
   (error as { _tag: unknown })._tag === "NoSuchBucket";
+
+// Cloudflare keys a custom domain to a single bucket at the zone level. After a
+// domain is deleted, re-attaching the same hostname can transiently 409 with
+// "Domain already in use" until the prior association is fully released. Treat
+// that narrow conflict as eventual consistency and retry it on create.
+const isDomainInUseConflict = (error: unknown): boolean =>
+  typeof error === "object" &&
+  error !== null &&
+  "_tag" in error &&
+  (error as { _tag: unknown })._tag === "Conflict" &&
+  "message" in error &&
+  typeof (error as { message: unknown }).message === "string" &&
+  (error as { message: string }).message.toLowerCase().includes("in use");
+
+// Releasing a custom domain after delete can lag a few seconds, so give the
+// conflict a longer, bounded budget than the bucket-endpoint lag above.
+const r2CustomDomainConflictSchedule = Schedule.spaced("2 seconds").pipe(
+  Schedule.both(Schedule.recurs(8)),
+);

package/src/Cloudflare/SecretsStore/Secret.ts

@@ -1,4 +1,5 @@
 import * as secretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as Redacted from "effect/Redacted";
@@ -100,9 +101,6 @@ export const StoreSecretProvider = () =>
       const getStoreSecret = yield* secretsStore.getStoreSecret;
       const listStoreSecrets = secretsStore.listStoreSecrets;
 
-      const arraysEqual = (a: string[], b: string[]) =>
-        a.length === b.length && a.every((v, i) => v === b[i]);
-
       return {
         stables: ["secretId", "secretName", "storeId", "accountId"],
         diff: Effect.fn(function* ({ id, olds = {} as any, news, output }) {
@@ -117,7 +115,7 @@ export const StoreSecretProvider = () =>
           const oldValue = olds.value ? Redacted.value(olds.value) : undefined;
           const newValue = Redacted.value(news.value);
           if (oldValue !== newValue) {
-            return { action: "replace" } as const;
+            return { action: "update" } as const;
           }
         }),
         reconcile: Effect.fn(function* ({ id, news, output }) {
@@ -212,49 +210,22 @@ export const StoreSecretProvider = () =>
             observed = existing;
           }
 
-          // Sync — `listStoreSecrets` does not surface scopes, so we
-          // can't reliably diff them. Issue PATCH only when we have a
-          // record of prior props (`output`) and a difference is
-          // visible; otherwise issue an unconditional PATCH on the
-          // adoption / first-create path so scopes and comment converge.
-          const oldScopes = output ? resolveScopes(output.scopes) : undefined;
-          const scopesChanged = !oldScopes || !arraysEqual(scopes, oldScopes);
-          const commentChanged =
-            !output ||
-            (output.comment ?? undefined) !== (news.comment ?? undefined);
-          if (scopesChanged || commentChanged) {
-            const patched = yield* patchStoreSecret({
-              accountId,
-              storeId,
-              secretId: observed.id,
-              scopes: scopesChanged ? scopes : undefined,
-              comment: commentChanged ? news.comment : undefined,
-            }).pipe(
-              Effect.catchTag("SecretNotFound", () =>
-                Effect.succeed(undefined),
-              ),
-            );
-            if (patched) {
-              return {
-                secretId: observed.id,
-                secretName: observed.name,
-                storeId: observed.storeId,
-                accountId,
-                status: patched.status,
-                scopes,
-                comment: patched.comment ?? undefined,
-              };
-            }
-          }
-
+          const patched = yield* patchStoreSecret({
+            accountId,
+            storeId,
+            secretId: observed.id,
+            scopes,
+            comment: news.comment,
+            value: Redacted.value(news.value),
+          });
           return {
             secretId: observed.id,
             secretName: observed.name,
             storeId: observed.storeId,
             accountId,
-            status: observed.status,
+            status: patched.status,
             scopes,
-            comment: news.comment ?? observed.comment ?? undefined,
+            comment: patched.comment ?? undefined,
           };
         }),
         delete: Effect.fn(function* ({ output }) {
@@ -263,6 +234,8 @@ export const StoreSecretProvider = () =>
             storeId: output.storeId,
             secretId: output.secretId,
           }).pipe(
+            Effect.tap(() => Effect.log(`deleted ${output.secretId}`)),
+            Effect.tapError(Console.log),
             Effect.catchTag("SecretNotFound", () => Effect.void),
             Effect.catchTag("StoreNotFound", () => Effect.void),
             Effect.catchTag("NotFound", () => Effect.void),