alchemy 2.0.0-beta.44 → 2.0.0-beta.45

package/src/Cloudflare/Queue/QueueConsumer.ts

@@ -1,4 +1,5 @@
 import * as queues from "@distilled.cloud/cloudflare/queues";
+import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as Schedule from "effect/Schedule";
@@ -118,11 +119,11 @@ type ObservedConsumer = {
 
 const toObserved = (c: {
   consumerId?: string | null;
-  script?: string | null;
+  scriptName?: string | null;
   type?: "worker" | "http_pull" | null;
 }): ObservedConsumer | undefined =>
   c.consumerId && c.type === "worker"
-    ? { consumerId: c.consumerId, script: c.script ?? undefined }
+    ? { consumerId: c.consumerId, script: c.scriptName ?? undefined }
     : undefined;
 
 export const QueueConsumerProvider = () =>
@@ -139,10 +140,7 @@ export const QueueConsumerProvider = () =>
       // first match in the paginated stream is the only one. Using
       // `.items` defeats single-page lookups that would otherwise
       // miss late-arriving consumers under eventual consistency.
-      const findWorkerConsumer = (
-        acct: string,
-        queueId: string,
-      ): Effect.Effect<ObservedConsumer | undefined, any, any> =>
+      const findWorkerConsumer = (acct: string, queueId: string) =>
         queues.listConsumers.items({ accountId: acct, queueId }).pipe(
           Stream.map(toObserved),
           Stream.filter((c): c is ObservedConsumer => c !== undefined),
@@ -367,6 +365,22 @@ export const QueueConsumerProvider = () =>
             }),
           );
 
+          yield* getConsumer({ accountId: acct, queueId, consumerId }).pipe(
+            Effect.tap(Console.log),
+            Effect.flatMap((fetched) =>
+              toObserved(fetched)?.script === news.scriptName
+                ? Effect.void
+                : Effect.fail("ScriptUnbound" as const),
+            ),
+            Effect.catchTag("ConsumerNotFound", () =>
+              Effect.fail("ScriptUnbound" as const),
+            ),
+            Effect.retry({
+              while: (e) => e === "ScriptUnbound",
+              schedule: queueHandlerReadinessSchedule,
+            }),
+          );
+
           return {
             consumerId,
             queueId,
@@ -418,8 +432,9 @@ export const QueueConsumerProvider = () =>
                 consumerId: fetched.consumerId!,
                 queueId: output.queueId,
                 scriptName:
-                  ("script" in fetched && typeof fetched.script === "string"
-                    ? fetched.script
+                  ("scriptName" in fetched &&
+                  typeof fetched.scriptName === "string"
+                    ? fetched.scriptName
                     : output.scriptName) ?? output.scriptName,
                 accountId: output.accountId,
               };

package/src/Cloudflare/Queue/QueueEventSource.ts

@@ -1,6 +1,7 @@
 import type * as cf from "@cloudflare/workers-types";
 import * as Cause from "effect/Cause";
 import * as Context from "effect/Context";
+import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Stream from "effect/Stream";
@@ -8,6 +9,7 @@ import * as Binding from "../../Binding.ts";
 import type { ResourceLike } from "../../Resource.ts";
 import { RuntimeContext } from "../../RuntimeContext.ts";
 import type { FunctionContext } from "../../Serverless/Function.ts";
+import * as DurationUtil from "../../Util/Duration.ts";
 import { isWorker, isWorkerEvent } from "../Workers/Worker.ts";
 import type { Queue } from "./Queue.ts";
 import { QueueConsumer } from "./QueueConsumer.ts";
@@ -25,14 +27,37 @@ export interface MessagesProps {
   maxConcurrency?: number;
   /** Maximum delivery attempts before dead-lettering. */
   maxRetries?: number;
-  /** Wait time, in ms, before flushing a partial batch. */
-  maxWaitTimeMs?: number;
-  /** Backoff, in seconds, applied to a retry. */
-  retryDelay?: number;
+  /**
+   * Wait time before flushing a partial batch. Rounded up to whole
+   * milliseconds when forwarded to Cloudflare.
+   */
+  maxWaitTime?: Duration.Input;
+  /**
+   * Backoff applied to a retry. Rounded up to whole seconds when
+   * forwarded to Cloudflare.
+   */
+  retryDelay?: Duration.Input;
   /** Optional dead-letter queue name. */
   deadLetterQueue?: string;
 }
 
+/**
+ * Convert a {@link MessagesProps} (with `Duration.Input` time fields)
+ * into the numeric settings shape Cloudflare's `QueueConsumer` API
+ * expects. `maxWaitTime` is rounded up to whole milliseconds and
+ * `retryDelay` to whole seconds.
+ *
+ * Exposed for testing and for callers that want to mirror the
+ * conversion when wiring `QueueConsumer` directly.
+ */
+export const toConsumerSettings = (props: MessagesProps) => ({
+  batchSize: props.batchSize,
+  maxConcurrency: props.maxConcurrency,
+  maxRetries: props.maxRetries,
+  maxWaitTimeMs: DurationUtil.toMillis(props.maxWaitTime),
+  retryDelay: DurationUtil.toSeconds(props.retryDelay),
+});
+
 /**
  * A single queue message handed to the subscribe handler. Mirrors
  * Cloudflare's runtime `Message<Body>` shape so per-message
@@ -63,12 +88,15 @@ export type QueueMessage<Body = unknown> = cf.Message<Body>;
  * @example
  * ```typescript
  * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Duration from "effect/Duration";
  * import * as Effect from "effect/Effect";
  * import * as Stream from "effect/Stream";
  *
  * yield* Cloudflare.messages<MyEvent>(queueResource, {
  *   batchSize: 25,
  *   maxRetries: 3,
+ *   maxWaitTime: "5 seconds",
+ *   retryDelay: Duration.seconds(30),
  * }).subscribe((stream) =>
  *   Stream.runForEach(stream, (msg) =>
  *     Effect.log(`event ${msg.body.id}`),
@@ -148,7 +176,7 @@ export const QueueEventSourcePolicyLive = QueueEventSourcePolicy.layer.succeed(
       yield* QueueConsumer(`${queue.LogicalId}Consumer`, {
         queueId: queue.queueId,
         scriptName: host.workerName,
-        settings: props,
+        settings: toConsumerSettings(props),
         deadLetterQueue: props.deadLetterQueue,
       });
     })) as unknown as (

package/src/Cloudflare/R2/R2Bucket.ts

@@ -12,6 +12,9 @@ import type * as Cloudflare from "../Providers.ts";
 import * as Zone from "../Zone.ts";
 import { R2BucketBinding } from "./R2BucketBinding.ts";
 
+export const isR2Bucket = (value: unknown): value is R2Bucket =>
+  typeof value === "object" && (value as any)?.Type === "Cloudflare.R2Bucket";
+
 export type R2BucketName = string;
 
 export type R2BucketCustomDomainZone = Zone.ZoneReference;
@@ -520,6 +523,10 @@ export const R2BucketProvider = () =>
                       while: isNoSuchBucket,
                       schedule: r2BucketEndpointConsistencySchedule,
                     }),
+                    Effect.retry({
+                      while: isDomainInUseConflict,
+                      schedule: r2CustomDomainConflictSchedule,
+                    }),
                   );
                   return toCustomDomainAttributes({ ...created, zoneId });
                 }
@@ -842,3 +849,22 @@ const isNoSuchBucket = (error: unknown): boolean =>
   error !== null &&
   "_tag" in error &&
   (error as { _tag: unknown })._tag === "NoSuchBucket";
+
+// Cloudflare keys a custom domain to a single bucket at the zone level. After a
+// domain is deleted, re-attaching the same hostname can transiently 409 with
+// "Domain already in use" until the prior association is fully released. Treat
+// that narrow conflict as eventual consistency and retry it on create.
+const isDomainInUseConflict = (error: unknown): boolean =>
+  typeof error === "object" &&
+  error !== null &&
+  "_tag" in error &&
+  (error as { _tag: unknown })._tag === "Conflict" &&
+  "message" in error &&
+  typeof (error as { message: unknown }).message === "string" &&
+  (error as { message: string }).message.toLowerCase().includes("in use");
+
+// Releasing a custom domain after delete can lag a few seconds, so give the
+// conflict a longer, bounded budget than the bucket-endpoint lag above.
+const r2CustomDomainConflictSchedule = Schedule.spaced("2 seconds").pipe(
+  Schedule.both(Schedule.recurs(8)),
+);

package/src/Cloudflare/SecretsStore/Secret.ts

@@ -1,4 +1,5 @@
 import * as secretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as Redacted from "effect/Redacted";
@@ -100,9 +101,6 @@ export const StoreSecretProvider = () =>
       const getStoreSecret = yield* secretsStore.getStoreSecret;
       const listStoreSecrets = secretsStore.listStoreSecrets;
 
-      const arraysEqual = (a: string[], b: string[]) =>
-        a.length === b.length && a.every((v, i) => v === b[i]);
-
       return {
         stables: ["secretId", "secretName", "storeId", "accountId"],
         diff: Effect.fn(function* ({ id, olds = {} as any, news, output }) {
@@ -117,7 +115,7 @@ export const StoreSecretProvider = () =>
           const oldValue = olds.value ? Redacted.value(olds.value) : undefined;
           const newValue = Redacted.value(news.value);
           if (oldValue !== newValue) {
-            return { action: "replace" } as const;
+            return { action: "update" } as const;
           }
         }),
         reconcile: Effect.fn(function* ({ id, news, output }) {
@@ -212,49 +210,22 @@ export const StoreSecretProvider = () =>
             observed = existing;
           }
 
-          // Sync — `listStoreSecrets` does not surface scopes, so we
-          // can't reliably diff them. Issue PATCH only when we have a
-          // record of prior props (`output`) and a difference is
-          // visible; otherwise issue an unconditional PATCH on the
-          // adoption / first-create path so scopes and comment converge.
-          const oldScopes = output ? resolveScopes(output.scopes) : undefined;
-          const scopesChanged = !oldScopes || !arraysEqual(scopes, oldScopes);
-          const commentChanged =
-            !output ||
-            (output.comment ?? undefined) !== (news.comment ?? undefined);
-          if (scopesChanged || commentChanged) {
-            const patched = yield* patchStoreSecret({
-              accountId,
-              storeId,
-              secretId: observed.id,
-              scopes: scopesChanged ? scopes : undefined,
-              comment: commentChanged ? news.comment : undefined,
-            }).pipe(
-              Effect.catchTag("SecretNotFound", () =>
-                Effect.succeed(undefined),
-              ),
-            );
-            if (patched) {
-              return {
-                secretId: observed.id,
-                secretName: observed.name,
-                storeId: observed.storeId,
-                accountId,
-                status: patched.status,
-                scopes,
-                comment: patched.comment ?? undefined,
-              };
-            }
-          }
-
+          const patched = yield* patchStoreSecret({
+            accountId,
+            storeId,
+            secretId: observed.id,
+            scopes,
+            comment: news.comment,
+            value: Redacted.value(news.value),
+          });
           return {
             secretId: observed.id,
             secretName: observed.name,
             storeId: observed.storeId,
             accountId,
-            status: observed.status,
+            status: patched.status,
             scopes,
-            comment: news.comment ?? observed.comment ?? undefined,
+            comment: patched.comment ?? undefined,
           };
         }),
         delete: Effect.fn(function* ({ output }) {
@@ -263,6 +234,8 @@ export const StoreSecretProvider = () =>
             storeId: output.storeId,
             secretId: output.secretId,
           }).pipe(
+            Effect.tap(() => Effect.log(`deleted ${output.secretId}`)),
+            Effect.tapError(Console.log),
             Effect.catchTag("SecretNotFound", () => Effect.void),
             Effect.catchTag("StoreNotFound", () => Effect.void),
             Effect.catchTag("NotFound", () => Effect.void),

package/src/Cloudflare/SecretsStore/SecretBinding.ts

@@ -2,6 +2,7 @@ import type * as runtime from "@cloudflare/workers-types";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
 import * as Binding from "../../Binding.ts";
 import type { ResourceLike } from "../../Resource.ts";
 import type { RuntimeContext } from "../../RuntimeContext.ts";
@@ -20,7 +21,7 @@ export class SecretError extends Data.TaggedError("SecretError")<{
  * `SecretsStoreSecret` binding.
  */
 export interface SecretClient extends Effect.Effect<
-  string,
+  Redacted.Redacted<string>,
   SecretError,
   RuntimeContext
 > {
@@ -31,7 +32,7 @@ export interface SecretClient extends Effect.Effect<
   /**
    * Read the current value of the secret.
    */
-  get(): Effect.Effect<string, SecretError, RuntimeContext>;
+  get(): Effect.Effect<Redacted.Redacted<string>, SecretError, RuntimeContext>;
 }
 
 export class SecretBinding extends Binding.Service<
@@ -63,17 +64,16 @@ export const SecretBindingLive = Layer.effect(
             }),
         });
 
-      const getEffect: Effect.Effect<string, SecretError> = raw.pipe(
-        Effect.flatMap((raw) => tryPromise(() => raw.get())),
+      const getEffect = raw.pipe(
+        Effect.flatMap((raw) =>
+          tryPromise(() => raw.get().then(Redacted.make)),
+        ),
       );
 
-      return Object.assign(
-        Effect.suspend(() => getEffect),
-        {
-          raw,
-          get: () => getEffect,
-        },
-      ) as SecretClient;
+      return Object.assign(getEffect, {
+        raw,
+        get: () => getEffect,
+      });
     });
   }),
 );

package/src/Cloudflare/StateStore/Api.ts

@@ -1,3 +1,4 @@
+import { Redacted } from "effect";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Path from "effect/Path";
@@ -12,7 +13,7 @@ import {
   StateApi,
   StateAuthLive,
 } from "../../State/HttpStateApi.ts";
-import * as Secret from "../SecretsStore/Secret.ts";
+import { Secret } from "../SecretsStore/Secret.ts";
 import { SecretBindingLive } from "../SecretsStore/SecretBinding.ts";
 import { Worker } from "../Workers/Worker.ts";
 import Store from "./Store.ts";
@@ -29,7 +30,7 @@ export const STATE_STORE_SCRIPT_NAME = "alchemy-state-store" as const;
  * compare against this constant; a mismatch (or 404) triggers a
  * forced redeploy via the bootstrap flow.
  */
-export const STATE_STORE_VERSION = 5 as const;
+export const STATE_STORE_VERSION = 6 as const;
 
 /**
  * Hard-coded OTLP/HTTP endpoints. Point at the public ingest relay
@@ -108,22 +109,21 @@ export default Worker(
     },
   },
   Effect.gen(function* () {
-    const secret = yield* Secret.Secret.bind(AuthToken);
+    const remoteSecret = yield* Secret.bind(AuthToken);
     const store = yield* Store;
 
-    const bearerTokenValidator = Layer.effect(
+    const bearerTokenValidator = Layer.succeed(
       BearerTokenValidator,
-      secret.get().pipe(
-        Effect.map((expected) =>
-          BearerTokenValidator.of({
-            validate: (token) =>
-              !!expected && timingSafeEqual(token, expected)
-                ? Effect.void
-                : Effect.fail(new HttpApiError.Unauthorized()),
-          }),
-        ),
-        Effect.orDie,
-      ),
+      BearerTokenValidator.of({
+        // @ts-expect-error - TODO(sam): fix RuntimeContext color here
+        validate: Effect.fnUntraced(function* (token) {
+          const expected = yield* remoteSecret.get();
+          return !!expected &&
+            timingSafeEqual(token.trim(), Redacted.value(expected).trim())
+            ? yield* Effect.void
+            : yield* Effect.fail(new HttpApiError.Unauthorized());
+        }),
+      }),
     );
 
     const versionApi = HttpApiBuilder.group(StateApi, "version", (handlers) =>

package/src/Cloudflare/StateStore/State.ts

@@ -41,7 +41,7 @@ import * as Access from "../Access.ts";
 import { CloudflareAuth } from "../Auth/AuthProvider.ts";
 import { EdgeSessionError, createEdgeSession } from "../EdgeSession.ts";
 import Api, { STATE_STORE_SCRIPT_NAME, STATE_STORE_VERSION } from "./Api.ts";
-import { AuthTokenSecretName, TokenValue } from "./Token.ts";
+import { AuthToken, AuthTokenSecretName, TokenValue } from "./Token.ts";
 
 /** Filename used for stored credentials under the profile directory. */
 const CREDENTIALS_FILE = "cloudflare-state-store";
@@ -145,7 +145,13 @@ export const bootstrap = (options: BootstrapOptions = {}) =>
       yield* Clank.info(
         `Resuming Cloudflare State Store '${scriptName}' deployment...`,
       );
-      yield* finishBootstrap({ scriptName, profileName, localState, isCI });
+      yield* finishBootstrap({
+        scriptName,
+        profileName,
+        localState,
+        isCI,
+        force,
+      });
       yield* Clank.success(`Cloudflare State Store '${scriptName}' is ready.`);
       return;
     }
@@ -178,6 +184,7 @@ export const bootstrap = (options: BootstrapOptions = {}) =>
         localState,
         isCI,
         url: credentials.url,
+        force,
       });
       yield* Clank.success(`Cloudflare State Store '${scriptName}' is ready.`);
       return;
@@ -191,7 +198,13 @@ export const bootstrap = (options: BootstrapOptions = {}) =>
       yield* Clank.info(`Deploying Cloudflare State Store '${scriptName}'...`);
     }
 
-    yield* finishBootstrap({ scriptName, profileName, localState, isCI });
+    yield* finishBootstrap({
+      scriptName,
+      profileName,
+      localState,
+      isCI,
+      force,
+    });
     yield* Clank.success(`Cloudflare State Store '${scriptName}' is ready.`);
   }).pipe(
     Effect.withSpan("state_store.bootstrap", {
@@ -221,6 +234,7 @@ export const state = () =>
         "alchemy.state_store.script_name": scriptName,
         "alchemy.state_store.profile": profileName,
         "alchemy.state_store.ci": isCI,
+        "alchemy.state_store.force": false,
       });
       yield* annotateAccountHash(
         yield* Config.boolean("NO_TRACK").pipe(Config.withDefault(false)),
@@ -255,6 +269,7 @@ export const state = () =>
           profileName,
           localState,
           isCI,
+          force: false,
         });
       }
 
@@ -270,6 +285,7 @@ export const state = () =>
           localState,
           isCI,
           url: credentials.url,
+          force: false,
         });
         if (fresh) return fresh;
 
@@ -311,6 +327,7 @@ export const state = () =>
           localState,
           isCI,
           url: credentials.url,
+          force: false,
         });
         if (fresh) return fresh;
 
@@ -346,6 +363,7 @@ export const state = () =>
         profileName,
         localState,
         isCI,
+        force: false,
       });
     }).pipe(recordStateStoreInit, Effect.orDie),
   ).pipe(
@@ -423,14 +441,20 @@ const finishBootstrap = ({
   profileName,
   localState,
   isCI,
+  force,
 }: {
   scriptName: string;
   profileName: string;
   localState: StateService;
   isCI: boolean;
+  force: boolean;
 }) =>
   Effect.gen(function* () {
-    yield* deployStateStore(scriptName, localState);
+    const { authToken } = yield* deployStateStore(
+      scriptName,
+      localState,
+      force,
+    );
 
     // Don't trust the `authToken` returned by `deploy(...)`: when
     // adoption kicks in (the Secrets Store secret already existed),
@@ -442,7 +466,7 @@ const finishBootstrap = ({
     // actually deployed. `loginWithCloudflare` also persists the
     // credentials file (skipping the write in CI), so we don't need
     // to do that explicitly here.
-    const { url, authToken } = yield* loginWithCloudflare();
+    const { url } = yield* loginWithCloudflare();
     const httpState = yield* makeCloudflareStateStore({ url, authToken });
     // `profileName` is intentionally unused here — `loginWithCloudflare`
     // resolves it itself. Reference it to keep the surrounding API
@@ -476,7 +500,11 @@ const finishBootstrap = ({
     }),
   );
 
-const deployStateStore = (scriptName: string, state?: StateService) =>
+const deployStateStore = (
+  scriptName: string,
+  state?: StateService,
+  force?: boolean,
+) =>
   Effect.gen(function* () {
     yield* annotateAccountHash();
     const localState = state ?? (yield* makeLocalState());
@@ -485,6 +513,7 @@ const deployStateStore = (scriptName: string, state?: StateService) =>
     const { url, authToken } = yield* deploy({
       // use the script name as the stage name (so the user can have multiple state stores)
       stage: scriptName,
+      force,
       stack: Alchemy.Stack(
         "CloudflareStateStore",
         {
@@ -494,6 +523,7 @@ const deployStateStore = (scriptName: string, state?: StateService) =>
         Effect.gen(function* () {
           const token = yield* TokenValue;
           const api = yield* Api;
+          yield* AuthToken; // make sure it's in the Secrets Store
 
           // Surface the bearer token so tests and clients can authenticate
           // after deploy. The underlying value lives in the Cloudflare
@@ -514,6 +544,9 @@ const deployStateStore = (scriptName: string, state?: StateService) =>
       // TODO(sam): we should not need to do this, but types do complain. fix deploy
       Effect.provide(stateLayer),
     );
+
+    yield* writeCredentials(url, authToken);
+
     // Cloudflare's worker upload is eventually consistent: the deploy
     // call returns as soon as the script upload is accepted, but the
     // edge can keep serving the previous version for several seconds
@@ -582,6 +615,13 @@ export const loginWithCloudflare = () =>
       STATE_STORE_SCRIPT_NAME,
       store.id,
       AuthTokenSecretName,
+    ).pipe(
+      Effect.retry({
+        while: isWorkersPreviewConfigurationError,
+        schedule: Schedule.exponential(200).pipe(
+          Schedule.both(Schedule.recurs(15)),
+        ),
+      }),
     );
 
     // 3. Derive the deployed worker URL.
@@ -634,6 +674,25 @@ export const loginWithCloudflare = () =>
     }),
   );
 
+const writeCredentials = (url: string, authToken: string) =>
+  Effect.gen(function* () {
+    const profileName = yield* ALCHEMY_PROFILE;
+    const credStore = yield* CredentialsStore;
+    yield* credStore.write<HttpStateStoreCredentials>(
+      profileName,
+      CREDENTIALS_FILE,
+      {
+        url,
+        authToken,
+      },
+    );
+  });
+
+const isWorkersPreviewConfigurationError = (error: unknown) =>
+  error instanceof EdgeSessionError &&
+  (error.message.includes("Invalid Workers Preview configuration") ||
+    error.message.includes("Error 1031"));
+
 /**
  * Run {@link finishBootstrap} iff the worker at `url` fails the
  * version probe; otherwise resolve to `undefined`. Centralises the
@@ -646,12 +705,14 @@ const redeployIfStale = ({
   profileName,
   localState,
   isCI,
+  force,
 }: {
   url: string;
   scriptName: string;
   profileName: string;
   localState: StateService;
   isCI: boolean;
+  force: boolean;
 }) =>
   Effect.gen(function* () {
     const { matches, expected, observed } = yield* checkStateStoreVersion(url);
@@ -665,6 +726,7 @@ const redeployIfStale = ({
       profileName,
       localState,
       isCI,
+      force,
     });
   }).pipe(
     Effect.withSpan("state_store.redeploy_if_stale", {

package/src/Cloudflare/StateStore/Store.ts

@@ -1,11 +1,12 @@
 import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
 
+import { pipe } from "effect/Function";
 import type {
   ReplacedResourceState,
   ResourceState,
 } from "../../State/ResourceState.ts";
 import { encodeState } from "../../State/StateEncoding.ts";
-import { pipe } from "effect/Function";
 import * as Secret from "../SecretsStore/Secret.ts";
 import { DurableObjectNamespace } from "../Workers/DurableObjectNamespace.ts";
 import { DurableObjectState } from "../Workers/DurableObjectState.ts";
@@ -25,7 +26,9 @@ export default class Store extends DurableObjectNamespace<Store>()(
       const doState = yield* DurableObjectState;
       const storage = doState.storage;
 
-      const keyHex = yield* encryptionSecret.get().pipe(Effect.orDie);
+      const keyHex = yield* encryptionSecret
+        .get()
+        .pipe(Effect.map(Redacted.value), Effect.orDie);
       const cryptoKey = yield* Effect.tryPromise(() =>
         crypto.subtle.importKey(
           "raw",

package/src/Cloudflare/VpcService/VpcService.ts

@@ -77,7 +77,7 @@ export declare namespace VpcService {
 export type VpcServiceAttributes = {
   serviceId: string;
   serviceName: string;
-  serviceType: "http";
+  serviceType: "http" | "tcp";
   httpPort: number | undefined;
   httpsPort: number | undefined;
   host: VpcService.Host;
@@ -262,7 +262,7 @@ export const formatVpcService = (
   service: {
     serviceId?: string | null;
     name: string;
-    type: "http";
+    type: "http" | "tcp";
     createdAt?: string | null;
     updatedAt?: string | null;
     httpPort?: number | null;