alchemy 2.0.0-beta.50 → 2.0.0-beta.52

package/src/Cloudflare/Browser/BrowserBinding.ts

@@ -2,8 +2,10 @@ import type * as cf from "@cloudflare/workers-types";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
 import * as Binding from "../../Binding.ts";
 import type { ResourceLike } from "../../Resource.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
 import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
 import type { Browser as BrowserLike } from "./Browser.ts";
 
@@ -12,39 +14,143 @@ export class BrowserError extends Data.TaggedError("BrowserError")<{
   cause: unknown;
 }> {}
 
-export interface BrowserHandle {
-  close(): Promise<void>;
-}
+/** The `Response` type returned by the Cloudflare Browser Rendering binding. */
+type BrowserResponse = Awaited<ReturnType<cf.BrowserRun["fetch"]>>;
 
-export interface BrowserPuppeteer<Browser extends BrowserHandle> {
-  launch(binding: cf.Fetcher): Promise<Browser>;
-}
+/** An Effect produced by a {@link BrowserClient} operation. */
+type BrowserEffect<A> = Effect.Effect<A, BrowserError, RuntimeContext>;
+
+/** A byte stream produced by a binary {@link BrowserClient} action. */
+type BrowserByteStream = Stream.Stream<
+  Uint8Array,
+  BrowserError,
+  RuntimeContext
+>;
+
+// Quick action option types, re-exported so callers don't reach into the
+// `@cloudflare/workers-types` namespace directly.
+export type BrowserScreenshotOptions = cf.BrowserRunScreenshotOptions;
+export type BrowserPDFOptions = cf.BrowserRunPDFOptions;
+export type BrowserContentOptions = cf.BrowserRunContentOptions;
+export type BrowserScrapeOptions = cf.BrowserRunScrapeOptions;
+export type BrowserLinksOptions = cf.BrowserRunLinksOptions;
+export type BrowserSnapshotOptions = cf.BrowserRunSnapshotOptions;
+export type BrowserJsonOptions = cf.BrowserRunJsonOptions;
+export type BrowserMarkdownOptions = cf.BrowserRunMarkdownOptions;
+
+// Quick action success payloads.
+export type BrowserContentResult = cf.BrowserRunContentSuccessResponse;
+export type BrowserScrapeResult = cf.BrowserRunScrapeSuccessResponse;
+export type BrowserLinksResult = cf.BrowserRunLinksSuccessResponse;
+export type BrowserSnapshotResult = cf.BrowserRunSnapshotSuccessResponse;
+export type BrowserJsonResult = cf.BrowserRunJsonSuccessResponse;
+export type BrowserMarkdownResult = cf.BrowserRunMarkdownSuccessResponse;
+export type BrowserErrorResponse = cf.BrowserRunErrorResponse;
 
 /**
  * Effect-native client for a Cloudflare Browser Rendering binding.
  *
- * Browser Rendering's Workers binding is consumed by `@cloudflare/puppeteer`.
- * Alchemy keeps Puppeteer as a caller-provided dependency while wrapping
- * launch and cleanup in Effects.
+ * Mirrors the runtime {@link cf.BrowserRun} binding, translating its shapes
+ * into Effect-native ones: JSON quick actions resolve to their parsed success
+ * payload, and binary actions (`screenshot`, `pdf`) resolve to a `Stream` of
+ * the response bytes. Non-success responses fail with {@link BrowserError}, so
+ * callers never touch a `Promise` or `Response.json()` themselves. Use
+ * `Cloudflare.Browser.bind(browser)` (or `yield* Cloudflare.Browser(...)`)
+ * inside a Worker's init phase to obtain it.
+ *
+ * The {@link raw} accessor and {@link fetch} are the only promise-shaped
+ * escape hatches — they exist for libraries like `@cloudflare/puppeteer` that
+ * consume the binding directly.
  */
 export interface BrowserClient {
   /**
    * Effect resolving to the raw Cloudflare Browser Rendering runtime binding.
+   *
+   * Pass it to `@cloudflare/puppeteer`'s `puppeteer.launch(binding)` to drive a
+   * full browser session.
+   */
+  raw: Effect.Effect<cf.BrowserRun, never, RuntimeContext>;
+  /**
+   * Send a raw HTTP request to the Browser Run API and resolve to the raw
+   * `Response`. Used by libraries like `@cloudflare/puppeteer` to acquire and
+   * connect to a browser instance.
+   */
+  fetch(
+    ...args: Parameters<cf.BrowserRun["fetch"]>
+  ): BrowserEffect<BrowserResponse>;
+  /**
+   * Run a Browser Run quick action, resolving to the parsed success payload
+   * (or a byte `Stream` for binary actions). Mirrors
+   * `cf.BrowserRun["quickAction"]`; the {@link screenshot}, {@link pdf},
+   * {@link content}, {@link scrape}, {@link links}, {@link snapshot},
+   * {@link json}, and {@link markdown} methods are thin wrappers over the
+   * corresponding action.
+   */
+  quickAction(
+    action: "screenshot",
+    options: BrowserScreenshotOptions,
+  ): BrowserByteStream;
+  quickAction(action: "pdf", options: BrowserPDFOptions): BrowserByteStream;
+  quickAction(
+    action: "content",
+    options: BrowserContentOptions,
+  ): BrowserEffect<BrowserContentResult>;
+  quickAction(
+    action: "scrape",
+    options: BrowserScrapeOptions,
+  ): BrowserEffect<BrowserScrapeResult>;
+  quickAction(
+    action: "links",
+    options: BrowserLinksOptions,
+  ): BrowserEffect<BrowserLinksResult>;
+  quickAction(
+    action: "snapshot",
+    options: BrowserSnapshotOptions,
+  ): BrowserEffect<BrowserSnapshotResult>;
+  quickAction(
+    action: "json",
+    options: BrowserJsonOptions,
+  ): BrowserEffect<BrowserJsonResult>;
+  quickAction(
+    action: "markdown",
+    options: BrowserMarkdownOptions,
+  ): BrowserEffect<BrowserMarkdownResult>;
+  /**
+   * Take a screenshot of a web page, streaming the raw image bytes.
+   */
+  screenshot(options: BrowserScreenshotOptions): BrowserByteStream;
+  /**
+   * Generate a PDF of a web page, streaming the raw PDF bytes.
+   */
+  pdf(options: BrowserPDFOptions): BrowserByteStream;
+  /**
+   * Get the HTML content of a web page.
+   */
+  content(options: BrowserContentOptions): BrowserEffect<BrowserContentResult>;
+  /**
+   * Scrape elements from a web page by CSS selector.
+   */
+  scrape(options: BrowserScrapeOptions): BrowserEffect<BrowserScrapeResult>;
+  /**
+   * Extract all links from a web page.
+   */
+  links(options: BrowserLinksOptions): BrowserEffect<BrowserLinksResult>;
+  /**
+   * Get both the HTML content and a base64-encoded screenshot of a web page.
    */
-  raw: Effect.Effect<cf.Fetcher, never, WorkerEnvironment>;
+  snapshot(
+    options: BrowserSnapshotOptions,
+  ): BrowserEffect<BrowserSnapshotResult>;
   /**
-   * Launch a Browser Rendering session through `@cloudflare/puppeteer`.
+   * Extract structured JSON data from a web page using AI.
    */
-  launch<Browser extends BrowserHandle>(
-    puppeteer: BrowserPuppeteer<Browser>,
-  ): Effect.Effect<Browser, BrowserError, WorkerEnvironment>;
+  json(options: BrowserJsonOptions): BrowserEffect<BrowserJsonResult>;
   /**
-   * Launch a browser, run an Effect with it, and close it afterward.
+   * Convert a web page to Markdown.
    */
-  withBrowser<Browser extends BrowserHandle, A, E, R>(
-    puppeteer: BrowserPuppeteer<Browser>,
-    use: (browser: Browser) => Effect.Effect<A, E, R>,
-  ): Effect.Effect<A, BrowserError | E, WorkerEnvironment | R>;
+  markdown(
+    options: BrowserMarkdownOptions,
+  ): BrowserEffect<BrowserMarkdownResult>;
 }
 
 export class BrowserBinding extends Binding.Service<
@@ -56,14 +162,14 @@ export const BrowserBindingLive = Layer.effect(
   BrowserBinding,
   Effect.gen(function* () {
     const Policy = yield* BrowserBindingPolicy;
+    const env = yield* WorkerEnvironment;
 
     return Effect.fn(function* (browser: BrowserLike) {
       yield* Policy(browser);
-      // Cloudflare exposes Browser Rendering as a service-style binding for
-      // @cloudflare/puppeteer; workers-types has no narrower interface.
-      const raw = WorkerEnvironment.useSync(
-        (env) => (env as Record<string, cf.Fetcher>)[browser.name]!,
-      );
+      const raw: Effect.Effect<cf.BrowserRun, never, RuntimeContext> =
+        Effect.sync(
+          () => (env as Record<string, cf.BrowserRun>)[browser.name]!,
+        );
       return makeBrowserClient(raw);
     });
   }),
@@ -106,23 +212,89 @@ const tryPromise = <T>(fn: () => Promise<T>): Effect.Effect<T, BrowserError> =>
       }),
   });
 
+/** Actions whose successful response is raw binary rather than JSON. */
+const BINARY_ACTIONS = new Set(["screenshot", "pdf"]);
+
+/** Build a {@link BrowserError} from a non-success Browser Run response. */
+const failResponse = (
+  action: string,
+  response: BrowserResponse,
+): Effect.Effect<never, BrowserError> =>
+  tryPromise(() => response.text()).pipe(
+    Effect.flatMap((body) => {
+      let cause: unknown = body;
+      try {
+        cause = JSON.parse(body);
+      } catch {
+        // keep the raw text as the cause
+      }
+      const message =
+        (cause as cf.BrowserRunErrorResponse | undefined)?.errors?.[0]
+          ?.message ??
+        `Browser Rendering '${action}' failed with status ${response.status}`;
+      return Effect.fail(new BrowserError({ message, cause }));
+    }),
+  );
+
 /** @internal */
 export const makeBrowserClient = (
-  raw: Effect.Effect<cf.Fetcher, never, WorkerEnvironment>,
+  raw: Effect.Effect<cf.BrowserRun, never, RuntimeContext>,
 ): BrowserClient => {
-  const launch = <Browser extends BrowserHandle>(
-    puppeteer: BrowserPuppeteer<Browser>,
-  ) =>
+  const respond = (
+    action: string,
+    options: unknown,
+  ): Effect.Effect<BrowserResponse, BrowserError, RuntimeContext> =>
     raw.pipe(
-      Effect.flatMap((binding) => tryPromise(() => puppeteer.launch(binding))),
+      Effect.flatMap((binding) =>
+        tryPromise(() => binding.quickAction(action as any, options as any)),
+      ),
+      Effect.flatMap((response) =>
+        response.ok ? Effect.succeed(response) : failResponse(action, response),
+      ),
+    );
+
+  const jsonAction = <T>(action: string, options: unknown): BrowserEffect<T> =>
+    respond(action, options).pipe(
+      Effect.flatMap((response) =>
+        tryPromise(() => response.json() as Promise<T>),
+      ),
     );
 
+  const streamAction = (action: string, options: unknown): BrowserByteStream =>
+    respond(action, options).pipe(
+      Effect.map((response) =>
+        Stream.fromReadableStream({
+          evaluate: () =>
+            response.body as any as ReadableStream<Uint8Array<ArrayBufferLike>>,
+          onError: (cause) =>
+            new BrowserError({
+              message: `Browser Rendering '${action}' stream failed`,
+              cause,
+            }),
+        }),
+      ),
+      Stream.unwrap,
+    );
+
+  const quickAction = ((action: string, options: unknown) =>
+    BINARY_ACTIONS.has(action)
+      ? streamAction(action, options)
+      : jsonAction(action, options)) as BrowserClient["quickAction"];
+
   return {
     raw,
-    launch,
-    withBrowser: (puppeteer, use) =>
-      Effect.acquireUseRelease(launch(puppeteer), use, (browser) =>
-        tryPromise(() => browser.close()),
+    fetch: (...args) =>
+      raw.pipe(
+        Effect.flatMap((binding) => tryPromise(() => binding.fetch(...args))),
       ),
+    quickAction,
+    screenshot: (options) => streamAction("screenshot", options),
+    pdf: (options) => streamAction("pdf", options),
+    content: (options) => jsonAction("content", options),
+    scrape: (options) => jsonAction("scrape", options),
+    links: (options) => jsonAction("links", options),
+    snapshot: (options) => jsonAction("snapshot", options),
+    json: (options) => jsonAction("json", options),
+    markdown: (options) => jsonAction("markdown", options),
   } satisfies BrowserClient;
 };

package/src/Cloudflare/Browser/index.ts

@@ -6,6 +6,19 @@ export {
   BrowserBindingPolicyLive,
   BrowserError,
   type BrowserClient,
-  type BrowserHandle,
-  type BrowserPuppeteer,
+  type BrowserScreenshotOptions,
+  type BrowserPDFOptions,
+  type BrowserContentOptions,
+  type BrowserScrapeOptions,
+  type BrowserLinksOptions,
+  type BrowserSnapshotOptions,
+  type BrowserJsonOptions,
+  type BrowserMarkdownOptions,
+  type BrowserContentResult,
+  type BrowserScrapeResult,
+  type BrowserLinksResult,
+  type BrowserSnapshotResult,
+  type BrowserJsonResult,
+  type BrowserMarkdownResult,
+  type BrowserErrorResponse,
 } from "./BrowserBinding.ts";

package/src/Cloudflare/Container/ContainerBinding.ts

@@ -18,16 +18,11 @@ export const bindContainer = Effect.fnUntraced(function* <Shape, Req = never>(
 ) {
   const namespace = yield* DurableObjectNamespace;
 
-  const container =
-    "asEffect" in containerEff
-      ? yield* containerEff as any as Effect.Effect<
-          ContainerApplication & Rpc<Shape>
-        >
-      : Effect.isEffect(containerEff)
-        ? yield* containerEff as unknown as Effect.Effect<
-            ContainerApplication & Rpc<Shape>
-          >
-        : containerEff;
+  const container = Effect.isEffect(containerEff)
+    ? yield* containerEff as unknown as Effect.Effect<
+        ContainerApplication & Rpc<Shape>
+      >
+    : containerEff;
 
   yield* container.bind`${namespace}`({
     durableObjects: {

package/src/Cloudflare/Images/Images.ts

@@ -32,9 +32,10 @@ type BindEffect = Effect.Effect<ImagesClient, never, ImagesBinding>;
  * Worker and returns the runtime {@link ImagesClient} — no separate `.bind(...)`
  * step required.
  *
- * The divergence is achieved via `[Symbol.iterator]`: the object is not an
- * `Effect` (so `InferEnv` resolves it to the native `ImagesBinding` in the
- * `env` position), but it is iterable as one when `yield*`-ed.
+ * The divergence is achieved via `[Symbol.iterator]`: the object is
+ * deliberately not an `Effect` (so `InferEnv` and the Worker `env` resolver
+ * keep it as the native `ImagesBinding` rather than `yield*`-ing it), but it
+ * is iterable as one when `yield*`-ed.
  */
 export interface Images {
   kind: ImagesTypeId;

package/src/Cloudflare/Providers.ts

@@ -8,6 +8,7 @@ import * as Schedule from "effect/Schedule";
 import { CredentialsStoreLive } from "../Auth/Credentials.ts";
 import { ProfileLive } from "../Auth/Profile.ts";
 import { Command } from "../Build/Command.ts";
+import { DevServer, DevServerProvider } from "../Build/DevServer.ts";
 import * as Build from "../Build/index.ts";
 import { KeyPair, KeyPairProvider } from "../KeyPair.ts";
 import * as Provider from "../Provider.ts";
@@ -31,6 +32,7 @@ import * as KV from "./KV/index.ts";
 import * as Queue from "./Queue/index.ts";
 import * as R2 from "./R2/index.ts";
 import * as RateLimit from "./RateLimit/index.ts";
+import * as Ruleset from "./Ruleset/index.ts";
 import * as SecretsStore from "./SecretsStore/index.ts";
 import * as Tunnel from "./Tunnel/index.ts";
 import * as Vectorize from "./Vectorize/index.ts";
@@ -66,6 +68,7 @@ export const providers = () =>
       Containers.Container,
       D1.D1ConnectionPolicy,
       D1.D1Database,
+      DevServer,
       Dns.DnsReadPolicy,
       Dns.DnsReadWritePolicy,
       Dns.DnsWritePolicy,
@@ -85,6 +88,7 @@ export const providers = () =>
       R2.R2Bucket,
       R2.R2BucketBindingPolicy,
       RateLimit.RateLimitBindingPolicy,
+      Ruleset.Ruleset,
       SecretsStore.SecretBindingPolicy,
       SecretsStore.SecretsStore,
       SecretsStore.Secret,
@@ -101,6 +105,7 @@ export const providers = () =>
       Workers.BindWorkerPolicy,
       Workers.CronEventSourcePolicy,
       Workers.FetchPolicy,
+      Workers.VersionMetadataBindingPolicy,
       Workers.Worker,
       Workflows.WorkflowResource,
       Zaraz.ZarazConfig,
@@ -119,6 +124,7 @@ export const providers = () =>
         Containers.ContainerProvider(),
         D1.D1ConnectionPolicyLive,
         D1.DatabaseProvider(),
+        DevServerProvider(),
         Dns.DnsReadPolicyLive,
         Dns.DnsReadWritePolicyLive,
         Dns.DnsWritePolicyLive,
@@ -138,6 +144,7 @@ export const providers = () =>
         R2.R2BucketBindingPolicyLive,
         R2.R2BucketProvider(),
         RateLimit.RateLimitBindingPolicyLive,
+        Ruleset.RulesetProvider(),
         SecretsStore.SecretBindingPolicyLive,
         SecretsStore.SecretsStoreProvider(),
         SecretsStore.StoreSecretProvider(),
@@ -152,6 +159,7 @@ export const providers = () =>
         Workers.BindWorkerPolicyLive,
         Workers.CronEventSourcePolicyLive,
         Workers.FetchPolicyLive,
+        Workers.VersionMetadataBindingPolicyLive,
         Workers.WorkerProvider(),
         Workflows.WorkflowProvider(),
         Zaraz.ZarazConfigProvider(),

package/src/Cloudflare/RateLimit/RateLimit.ts

@@ -52,9 +52,10 @@ type BindEffect = Effect.Effect<RateLimitClient, never, RateLimitBinding>;
  * Worker and returns the runtime {@link RateLimitClient} — no separate
  * `.bind(...)` step required.
  *
- * The divergence is achieved via `[Symbol.iterator]`: the object is not an
- * `Effect` (so `InferEnv` resolves it to the native `cf.RateLimit` in the
- * `env` position), but it is iterable as one when `yield*`-ed.
+ * The divergence is achieved via `[Symbol.iterator]`: the object is
+ * deliberately not an `Effect` (so `InferEnv` and the Worker `env` resolver
+ * keep it as the native `cf.RateLimit` rather than `yield*`-ing it), but it is
+ * iterable as one when `yield*`-ed.
  */
 export interface RateLimit {
   kind: RateLimitTypeId;

package/src/Cloudflare/Ruleset/Ruleset.ts

@@ -0,0 +1,223 @@
+import * as rulesets from "@distilled.cloud/cloudflare/rulesets";
+import * as Effect from "effect/Effect";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { Zone, ZoneAttributes } from "../Zone/index.ts";
+
+export type RulesetPhase = rulesets.CreateRulesetForZoneRequest["phase"];
+export type RulesetRule = NonNullable<
+  rulesets.PutPhasForZoneRequest["rules"]
+>[number];
+export type RulesetOutputRule = Omit<
+  NonNullable<rulesets.GetPhasResponse["rules"]>[number],
+  "lastUpdated" | "version"
+>;
+
+export type RulesetProps = {
+  /**
+   * Zone to apply the ruleset to. Pass a `Cloudflare.Zone`.
+   */
+  zone: Zone;
+  /**
+   * Ruleset phase entrypoint to own.
+   */
+  phase: RulesetPhase;
+  /**
+   * Rules to apply to the phase entrypoint.
+   */
+  rules: RulesetRule[];
+  /**
+   * Human-readable name for the ruleset.
+   * @default ${app}-${stage}-${id}
+   */
+  name?: string;
+  /**
+   * Description for the ruleset.
+   */
+  description?: string;
+};
+
+export type RulesetKind =
+  | "managed"
+  | "custom"
+  | "root"
+  | "zone"
+  | (string & {});
+
+export type Ruleset = Resource<
+  "Cloudflare.Ruleset",
+  RulesetProps,
+  {
+    /** The unique ID of the ruleset (Cloudflare `id`). */
+    rulesetId: string;
+    /**
+     * Zone the ruleset phase entrypoint belongs to. Alchemy-flattened
+     * identifier — not part of Cloudflare's phase-entrypoint response.
+     */
+    zoneId: string;
+    /** The kind of the ruleset. */
+    kind: RulesetKind;
+    /** The human-readable name of the ruleset. */
+    name: string;
+    /** The phase of the ruleset. */
+    phase: RulesetPhase;
+    /** An informative description of the ruleset. */
+    description: string | undefined;
+    /** The list of rules in the ruleset. */
+    rules: RulesetOutputRule[];
+    /** The timestamp of when the ruleset was last modified. */
+    lastUpdated: string;
+    /** The version of the ruleset. */
+    version: string;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A Cloudflare Ruleset phase entrypoint for a zone.
+ *
+ * This resource owns the entire ruleset for a phase entrypoint. Rules managed
+ * elsewhere in the same phase can be overwritten on deploy.
+ *
+ * @section WAF Rules
+ * @example Block probes in the custom firewall phase
+ * ```typescript
+ * const zone = yield* Cloudflare.Zone("MyZone", { name: "example.com" });
+ * const waf = yield* Cloudflare.Ruleset("WafRules", {
+ *   zone,
+ *   phase: "http_request_firewall_custom",
+ *   rules: [
+ *     {
+ *       description: "Block exploit probes",
+ *       expression: `lower(http.request.uri.path) contains "/.env"`,
+ *       action: "block",
+ *     },
+ *   ],
+ * });
+ * ```
+ */
+export const Ruleset = Resource<Ruleset>("Cloudflare.Ruleset")({});
+
+const isNotFoundError = (error: unknown): boolean =>
+  typeof error === "object" &&
+  error !== null &&
+  (("status" in error && (error as { status: unknown }).status === 404) ||
+    ("_tag" in error && (error as { _tag: unknown })._tag === "NotFound"));
+
+// A `Zone` prop is resolved to its attributes before a lifecycle op runs, so
+// `zone.zoneId` is normally a plain string even though the `Zone` resource
+// type statically exposes it as an `Output`. During `diff` (plan time) the
+// zone can still be unresolved — e.g. when it's being created in the same
+// deploy — in which case `zoneId` is not yet a string. Callers must treat a
+// non-string result as "not resolved yet".
+const zoneIdOf = (zone: Zone): string | undefined => {
+  const zoneId = (zone as unknown as Partial<ZoneAttributes>).zoneId;
+  return typeof zoneId === "string" ? zoneId : undefined;
+};
+
+export const RulesetProvider = () =>
+  Provider.effect(
+    Ruleset,
+    Effect.gen(function* () {
+      const getPhas = yield* rulesets.getPhasForZone;
+      const putPhas = yield* rulesets.putPhasForZone;
+
+      const createRulesetName = (id: string, name: string | undefined) =>
+        Effect.gen(function* () {
+          return name ?? (yield* createPhysicalName({ id }));
+        });
+
+      return {
+        stables: ["zoneId", "phase"],
+        diff: Effect.fn(function* ({ id, olds, news, output }) {
+          if (!isResolved(news)) return undefined;
+          const desiredZoneId = zoneIdOf(news.zone);
+
+          // The desired zone id may still be an unresolved Output (e.g. the
+          // zone is being created in the same deploy). Only make a zone-change
+          // replacement decision once we have a concrete id.
+          if (desiredZoneId !== undefined) {
+            if (output?.zoneId && desiredZoneId !== output.zoneId) {
+              return { action: "replace" } as const;
+            }
+            const oldZoneId = olds.zone ? zoneIdOf(olds.zone) : undefined;
+            if (oldZoneId !== undefined && oldZoneId !== desiredZoneId) {
+              return { action: "replace" } as const;
+            }
+          }
+          if (olds.phase !== news.phase) {
+            return { action: "replace" } as const;
+          }
+
+          const oldName =
+            output?.name ?? (yield* createRulesetName(id, olds.name));
+          const name = yield* createRulesetName(id, news.name);
+          if (
+            oldName !== name ||
+            olds.description !== news.description ||
+            !deepEqual(olds.rules, news.rules)
+          ) {
+            return { action: "update" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output }) {
+          const zoneId = output?.zoneId ?? zoneIdOf(news.zone);
+          if (zoneId === undefined) {
+            return yield* Effect.fail(
+              new Error("Cloudflare Ruleset: zone id is not resolved"),
+            );
+          }
+          const name = yield* createRulesetName(id, news.name ?? output?.name);
+          const ruleset = yield* putPhas({
+            zoneId,
+            rulesetPhase: news.phase,
+            name,
+            description: news.description,
+            rules: news.rules,
+          });
+          return toRulesetAttributes(zoneId, ruleset);
+        }),
+        delete: Effect.fn(function* ({ olds, output }) {
+          yield* putPhas({
+            zoneId: output.zoneId,
+            rulesetPhase: olds.phase,
+            name: output.name,
+            description: output.description,
+            rules: [],
+          }).pipe(Effect.catchIf(isNotFoundError, () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+          const zoneId = output?.zoneId ?? zoneIdOf(olds.zone);
+          if (zoneId === undefined) return undefined;
+          return yield* getPhas({
+            zoneId,
+            rulesetPhase: output?.phase ?? olds.phase,
+          }).pipe(
+            Effect.map((ruleset) => toRulesetAttributes(zoneId, ruleset)),
+            Effect.catchIf(isNotFoundError, () => Effect.succeed(undefined)),
+          );
+        }),
+      };
+    }),
+  );
+
+export const toRulesetAttributes = (
+  zoneId: string,
+  ruleset: rulesets.GetPhasResponse | rulesets.PutPhasResponse,
+): Ruleset["Attributes"] => ({
+  rulesetId: ruleset.id,
+  zoneId,
+  kind: ruleset.kind,
+  name: ruleset.name,
+  phase: ruleset.phase,
+  description: ruleset.description ?? undefined,
+  rules: (ruleset.rules ?? []).map(
+    ({ lastUpdated: _lastUpdated, version: _version, ...rule }) => rule,
+  ),
+  lastUpdated: ruleset.lastUpdated,
+  version: ruleset.version,
+});

package/src/Cloudflare/Ruleset/index.ts

@@ -0,0 +1 @@
+export * from "./Ruleset.ts";

package/src/Cloudflare/SecretsStore/Secret.ts

@@ -54,6 +54,10 @@ export type Secret = Resource<
   Providers
 >;
 
+export const isSecret = (value: unknown): value is Secret =>
+  typeof value === "object" &&
+  (value as any)?.Type === "Cloudflare.SecretsStore.Secret";
+
 export type SecretStatus = "pending" | "active" | "deleted";
 
 // Distilled widened generated string enums to open unions (`string & {}`); the