alchemy 2.0.0-beta.57 → 2.0.0-beta.58

package/src/Cloudflare/R2/BucketWriteHttp.ts

@@ -0,0 +1,144 @@
+import * as r2 from "@distilled.cloud/cloudflare/r2";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import { authorizeWith } from "../HttpClientUtils.ts";
+import {
+  baseObject,
+  makeHttpBucketBinding,
+  makeR2HttpScope,
+  readHttpMetadata,
+  toBody,
+  toR2Error,
+  type R2HttpToken,
+} from "./BucketHttp.ts";
+import { R2Error, type R2PutOptions } from "./BucketTypes.ts";
+import { BucketWrite, type WriteBucketClient } from "./BucketWrite.ts";
+
+/**
+ * HTTP-backed implementation of the {@link BucketWrite} service.
+ *
+ * It creates a scoped {@link AccountApiToken} with the `Workers R2 Storage Read` and `Workers R2 Storage Write` permissions.
+ */
+export const WriteBucketHttp = Layer.effect(
+  BucketWrite,
+  Effect.suspend(() =>
+    makeHttpBucketBinding({
+      permissionGroups: ["Workers R2 Storage Write"],
+      makeClient: makeWriteR2HttpClient,
+    }),
+  ),
+);
+
+/** Build the write half of the HTTP-backed {@link ReadWrite} client. */
+export const makeWriteR2HttpClient = (
+  token: R2HttpToken,
+  bucketName: Effect.Effect<string>,
+  jurisdiction: Effect.Effect<string>,
+): WriteBucketClient => {
+  const authorize = authorizeWith(token);
+  const scope = makeR2HttpScope(token, bucketName, jurisdiction);
+
+  return {
+    put: ((
+      key: string,
+      value:
+        | ReadableStream
+        | ArrayBuffer
+        | ArrayBufferView
+        | string
+        | null
+        | Blob
+        | Stream.Stream<Uint8Array, unknown>,
+      options?: R2PutOptions,
+    ) =>
+      scope.pipe(
+        Effect.flatMap(({ accountId, bucketName, cfR2Jurisdiction }) =>
+          toBody(value).pipe(
+            Effect.flatMap(({ body, contentLength }) => {
+              const meta = readHttpMetadata(options);
+              return authorize(
+                r2.putObject({
+                  accountId,
+                  bucketName,
+                  objectName: key,
+                  cfR2Jurisdiction,
+                  body,
+                  contentType: meta?.contentType,
+                  contentEncoding: meta?.contentEncoding,
+                  contentDisposition: meta?.contentDisposition,
+                  contentLanguage: meta?.contentLanguage,
+                  cacheControl: meta?.cacheControl,
+                  contentLength:
+                    options?.contentLength != null
+                      ? String(options.contentLength)
+                      : contentLength != null
+                        ? String(contentLength)
+                        : undefined,
+                  cfR2StorageClass: (
+                    options as { storageClass?: string } | undefined
+                  )?.storageClass,
+                }),
+              ).pipe(
+                Effect.map(() =>
+                  baseObject(key, meta ?? {}, {
+                    size: contentLength,
+                    customMetadata: (
+                      options as
+                        | { customMetadata?: Record<string, string> }
+                        | undefined
+                    )?.customMetadata,
+                    storageClass: (
+                      options as { storageClass?: string } | undefined
+                    )?.storageClass,
+                    uploaded: new Date(),
+                  }),
+                ),
+              );
+            }),
+          ),
+        ),
+        Effect.mapError(toR2Error),
+      )) as any,
+    delete: (keys: string | string[]) =>
+      scope.pipe(
+        Effect.flatMap(({ accountId, bucketName, cfR2Jurisdiction }) =>
+          Array.isArray(keys)
+            ? authorize(
+                r2.deleteObjects({
+                  accountId,
+                  bucketName,
+                  cfR2Jurisdiction,
+                  body: keys,
+                }),
+              )
+            : authorize(
+                r2.deleteObject({
+                  accountId,
+                  bucketName,
+                  objectName: keys,
+                  cfR2Jurisdiction,
+                }),
+              ),
+        ),
+        Effect.mapError(toR2Error),
+        Effect.asVoid,
+      ),
+    createMultipartUpload: () =>
+      Effect.die(
+        new R2Error({
+          message:
+            "R2BucketBindingHttp does not support multipart uploads over the HTTP API.",
+          cause: new Error("unsupported"),
+        }),
+      ),
+    resumeMultipartUpload: () =>
+      Effect.die(
+        new R2Error({
+          message:
+            "R2BucketBindingHttp does not support multipart uploads over the HTTP API.",
+          cause: new Error("unsupported"),
+        }),
+      ),
+  };
+};

package/src/Cloudflare/R2/index.ts

@@ -1,4 +1,12 @@
+export * from "./Bucket.ts";
 export * from "./BucketEventNotification.ts";
+export * from "./BucketRead.ts";
+export * from "./BucketReadBinding.ts";
+export * from "./BucketReadHttp.ts";
+export * from "./BucketReadWrite.ts";
+export * from "./BucketReadWriteBinding.ts";
+export * from "./BucketReadWriteHttp.ts";
 export * from "./BucketSippy.ts";
-export * from "./R2Bucket.ts";
-export * from "./R2BucketBinding.ts";
+export * from "./BucketWrite.ts";
+export * from "./BucketWriteBinding.ts";
+export * from "./BucketWriteHttp.ts";

package/src/Cloudflare/RateLimit/RateLimitBinding.ts

@@ -8,6 +8,7 @@ import * as Binding from "../../Binding.ts";
 import type { ResourceLike } from "../../Resource.ts";
 import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
 import { type RateLimit as RateLimitLike } from "./RateLimit.ts";
+import type { Providers } from "../Providers.ts";
 
 export class RateLimitError extends Data.TaggedError("RateLimitError")<{
   message: string;
@@ -70,7 +71,8 @@ export const RateLimitBindingLive = Layer.effect(
 
 export class RateLimitBindingPolicy extends Binding.Policy<
   RateLimitBindingPolicy,
-  (rateLimit: RateLimitLike) => Effect.Effect<void>
+  (rateLimit: RateLimitLike) => Effect.Effect<void>,
+  Providers
 >()("Cloudflare.RateLimit.Binding") {}
 
 export const RateLimitBindingPolicyLive = RateLimitBindingPolicy.layer.succeed(

package/src/Cloudflare/SecretsStore/SecretBinding.ts

@@ -8,6 +8,7 @@ import type { ResourceLike } from "../../Resource.ts";
 import type { RuntimeContext } from "../../RuntimeContext.ts";
 import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
 import type { Secret } from "./Secret.ts";
+import type { Providers } from "../Providers.ts";
 
 export class SecretError extends Data.TaggedError("SecretError")<{
   message: string;
@@ -85,7 +86,8 @@ export const SecretBindingLive = Layer.effect(
 
 export class SecretBindingPolicy extends Binding.Policy<
   SecretBindingPolicy,
-  (secret: Secret) => Effect.Effect<void>
+  (secret: Secret) => Effect.Effect<void>,
+  Providers
 >()("Cloudflare.SecretsStore.Secret") {}
 
 export const SecretBindingPolicyLive = SecretBindingPolicy.layer.succeed(

package/src/Cloudflare/StateStore/Api.ts

@@ -116,7 +116,7 @@ export default Worker(
       BearerTokenValidator,
       BearerTokenValidator.of({
         // @ts-expect-error - TODO(sam): fix RuntimeContext color here
-        validate: Effect.fnUntraced(function* (token) {
+        validate: Effect.fn(function* (token) {
           const expected = yield* remoteSecret.get();
           return !!expected &&
             timingSafeEqual(token.trim(), Redacted.value(expected).trim())

package/src/Cloudflare/StateStore/State.ts

@@ -21,6 +21,7 @@ import { ALCHEMY_PROFILE, ProfileLive } from "../../Auth/Profile.ts";
 import * as Cloudflare from "../../Cloudflare/Providers.ts";
 import { deploy } from "../../Deploy.ts";
 import * as Output from "../../Output.ts";
+import { RandomProvider } from "../../Random.ts";
 import * as Alchemy from "../../Stack.ts";
 import { StateApi } from "../../State/HttpStateApi.ts";
 import {
@@ -325,7 +326,7 @@ const deployStateStore = ({
       stack: Alchemy.Stack(
         "CloudflareStateStore",
         {
-          providers: Cloudflare.providers(),
+          providers: Layer.mergeAll(Cloudflare.providers(), RandomProvider()),
           state: stateLayer,
         },
         Effect.gen(function* () {
@@ -446,7 +447,7 @@ const hasLocalStack = (stage: string) =>
  * store, and removing entries that happen to be missing locally would
  * be catastrophic.
  */
-const hoistBootstrapStack = Effect.fnUntraced(function* ({
+const hoistBootstrapStack = Effect.fn(function* ({
   source,
   destination,
 }: {
@@ -468,7 +469,7 @@ const hoistBootstrapStack = Effect.fnUntraced(function* ({
   });
   yield* Effect.forEach(
     fqns,
-    Effect.fnUntraced(function* (fqn) {
+    Effect.fn(function* (fqn) {
       const value = yield* source.state.get({
         stack,
         stage: source.stage,
@@ -614,10 +615,11 @@ const isStateStoreAvailable = (scriptName: string = "alchemy-state-store") =>
     return yield* workers.getScriptSetting({ accountId, scriptName }).pipe(
       Effect.map((setting) => setting !== undefined),
       Effect.catchTag("WorkerNotFound", () => Effect.succeed(false)),
+      Effect.catchTag("InvalidRoute", () => Effect.succeed(false)),
     );
   });
 
-const makeCloudflareStateStore = Effect.fnUntraced(function* ({
+const makeCloudflareStateStore = Effect.fn(function* ({
   url,
   authToken,
 }: {

package/src/Cloudflare/StateStore/Store.ts

@@ -7,7 +7,7 @@ import type {
   ResourceState,
 } from "../../State/ResourceState.ts";
 import { encodeState } from "../../State/StateEncoding.ts";
-import * as Secret from "../SecretsStore/Secret.ts";
+import * as Secret from "../SecretsStore/index.ts";
 import { DurableObjectNamespace } from "../Workers/DurableObjectNamespace.ts";
 import { DurableObjectState } from "../Workers/DurableObjectState.ts";
 import { EncryptionKey } from "./Token.ts";
@@ -19,13 +19,10 @@ export default class Store extends DurableObjectNamespace<Store>()(
     // The actual secret read happens inside each DO instance below,
     // since `SecretClient.get()` needs the per-instance worker env.
     const encryptionSecret = yield* Secret.Secret.bind(EncryptionKey);
+    const state = yield* DurableObjectState;
+    const storage = state.storage;
 
     return Effect.gen(function* () {
-      // Inner (per-instance) phase — set up storage and the AES key.
-      // The key is imported once per DO boot and reused thereafter.
-      const doState = yield* DurableObjectState;
-      const storage = doState.storage;
-
       const keyHex = yield* encryptionSecret
         .get()
         .pipe(Effect.map(Redacted.value), Effect.orDie);
@@ -87,7 +84,7 @@ export default class Store extends DurableObjectNamespace<Store>()(
         /**
          * (Root DO only) List every stack name ever registered.
          */
-        listStacks: Effect.fnUntraced(function* () {
+        listStacks: Effect.fn(function* () {
           const entries = yield* storage.list<number>({
             prefix: STACK_INDEX_PREFIX,
           });
@@ -256,7 +253,7 @@ export default class Store extends DurableObjectNamespace<Store>()(
           ),
       };
     });
-  }),
+  }).pipe(Effect.provide(Secret.SecretBindingLive)),
 ) {
   /**
    * Well-known DO name whose sole job is to track the set of stacks

package/src/Cloudflare/Tunnel/Tunnel.ts

@@ -401,7 +401,7 @@ const writeConfiguration = (
     });
   });
 
-const findTunnelByName = Effect.fnUntraced(function* (name: string) {
+const findTunnelByName = Effect.fn(function* (name: string) {
   const { accountId } = yield* yield* CloudflareEnvironment;
   return yield* zeroTrust.listTunnels
     .items({

package/src/Cloudflare/Tunnel/TunnelBinding.ts

@@ -1,14 +1,6 @@
-import {
-  Credentials,
-  fromApiToken,
-} from "@distilled.cloud/cloudflare/Credentials";
 import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Redacted from "effect/Redacted";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import type { HttpClient } from "effect/unstable/http/HttpClient";
+import type * as Redacted from "effect/Redacted";
 import type * as Binding from "../../Binding.ts";
-import { RuntimeContext } from "../../RuntimeContext.ts";
 import { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
 import type { ApiTokenPermissionGroupRef } from "../ApiToken/Common.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
@@ -38,27 +30,6 @@ export const bindTunnelToken = (token: AccountApiToken) =>
     return { value, accountId } satisfies TunnelToken;
   });
 
-/**
- * Resolve credentials from a bound token and provide them (plus the
- * fetch-based HTTP client) to a raw SDK operation.
- */
-export const authorizeWith =
-  (token: TunnelToken) =>
-  <A, E>(
-    eff: Effect.Effect<A, E, Credentials | HttpClient>,
-  ): Effect.Effect<A, E, RuntimeContext> =>
-    token.value.pipe(
-      Effect.flatMap((value) =>
-        eff.pipe(
-          Effect.provide(
-            fromApiToken({ apiToken: Redacted.value(value) }).pipe(
-              Layer.provideMerge(FetchHttpClient.layer),
-            ),
-          ),
-        ),
-      ),
-    );
-
 /**
  * Shared runtime body for a tunnel binding: create a scoped token, attach the
  * (narrow) policy, bind the token's outputs into the Worker, then build the

package/src/Cloudflare/Tunnel/TunnelRead.ts

@@ -18,11 +18,12 @@ import type { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
 import type { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Worker } from "../Workers/Worker.ts";
 import {
-  authorizeWith,
   makeTunnelClient,
   makeTunnelPolicyLive,
   type TunnelToken,
 } from "./TunnelBinding.ts";
+import { authorizeWith } from "../HttpClientUtils.ts";
+import type { Providers } from "../Providers.ts";
 
 /** List-tunnels request, minus the account id (supplied by the binding). */
 export type ListTunnelsRequest = Omit<
@@ -154,7 +155,8 @@ export class TunnelRead extends Binding.Service<
  */
 export class TunnelReadPolicy extends Binding.Policy<
   TunnelReadPolicy,
-  (token: AccountApiToken) => Effect.Effect<void, never, CloudflareEnvironment>
+  (token: AccountApiToken) => Effect.Effect<void, never, CloudflareEnvironment>,
+  Providers
 >()("Cloudflare.TunnelRead") {}
 
 /** Runtime layer for {@link TunnelRead}. */

package/src/Cloudflare/Tunnel/TunnelReadWrite.ts

@@ -11,6 +11,7 @@ import {
 } from "./TunnelBinding.ts";
 import { readClient, type TunnelReadClient } from "./TunnelRead.ts";
 import { writeClient, type TunnelWriteClient } from "./TunnelWrite.ts";
+import type { Providers } from "../Providers.ts";
 
 /** Combined read + write tunnel operations. */
 export interface TunnelReadWriteClient
@@ -78,7 +79,8 @@ export class TunnelReadWrite extends Binding.Service<
  */
 export class TunnelReadWritePolicy extends Binding.Policy<
   TunnelReadWritePolicy,
-  (token: AccountApiToken) => Effect.Effect<void, never, CloudflareEnvironment>
+  (token: AccountApiToken) => Effect.Effect<void, never, CloudflareEnvironment>,
+  Providers
 >()("Cloudflare.TunnelReadWrite") {}
 
 /** Runtime layer for {@link TunnelReadWrite}. */

package/src/Cloudflare/Tunnel/TunnelWrite.ts

@@ -20,11 +20,12 @@ import type { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
 import type { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Worker } from "../Workers/Worker.ts";
 import {
-  authorizeWith,
   makeTunnelClient,
   makeTunnelPolicyLive,
   type TunnelToken,
 } from "./TunnelBinding.ts";
+import { authorizeWith } from "../HttpClientUtils.ts";
+import type { Providers } from "../Providers.ts";
 
 /** Create-tunnel request, minus the account id (supplied by the binding). */
 export type CreateTunnelRequest = Omit<
@@ -180,7 +181,8 @@ export class TunnelWrite extends Binding.Service<
  */
 export class TunnelWritePolicy extends Binding.Policy<
   TunnelWritePolicy,
-  (token: AccountApiToken) => Effect.Effect<void, never, CloudflareEnvironment>
+  (token: AccountApiToken) => Effect.Effect<void, never, CloudflareEnvironment>,
+  Providers
 >()("Cloudflare.TunnelWrite") {}
 
 /** Runtime layer for {@link TunnelWrite}. */

package/src/Cloudflare/Tunnel/WarpConnector.ts

@@ -271,7 +271,7 @@ const resolveName = (id: string, name: string | undefined) =>
     return yield* createPhysicalName({ id, lowercase: true });
   });
 
-const toAttributes = Effect.fnUntraced(function* (
+const toAttributes = Effect.fn(function* (
   tunnel: ObservedConnector,
   accountId: string,
 ) {

package/src/Cloudflare/UrlNormalization/UrlNormalization.ts

@@ -1,6 +1,7 @@
 import * as urlNormalization from "@distilled.cloud/cloudflare/url-normalization";
 import * as Effect from "effect/Effect";
 import * as Predicate from "effect/Predicate";
+import * as Schedule from "effect/Schedule";
 
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
@@ -148,6 +149,17 @@ export const UrlNormalizationProvider = () =>
         allZones.map((zone) => zone.id),
         (zoneId) =>
           urlNormalization.getUrlNormalization({ zoneId }).pipe(
+            // Cloudflare intermittently rejects a *valid* token with
+            // `Forbidden` (a transient edge auth failure). Retry with capped
+            // backoff rather than dropping the zone, so a genuinely accessible
+            // zone never falls out of the enumeration on a blip.
+            Effect.retry({
+              while: (e) => e._tag === "Forbidden",
+              schedule: Schedule.exponential("500 millis").pipe(
+                Schedule.either(Schedule.spaced("5 seconds")),
+                Schedule.both(Schedule.recurs(8)),
+              ),
+            }),
             Effect.map((observed) => toAttributes(zoneId, observed)),
             // Plan-gated or partial zones reject the route; skip them.
             Effect.catchTag("InvalidRoute", () => Effect.succeed(undefined)),

package/src/Cloudflare/Vectorize/VectorizeIndexBinding.ts

@@ -6,6 +6,7 @@ import * as Binding from "../../Binding.ts";
 import type { ResourceLike } from "../../Resource.ts";
 import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
 import type { VectorizeIndex } from "./VectorizeIndex.ts";
+import type { Providers } from "../Providers.ts";
 
 export interface VectorizeIndexClient {
   /**
@@ -83,7 +84,8 @@ export const VectorizeIndexBindingLive = Layer.effect(
 
 export class VectorizeIndexBindingPolicy extends Binding.Policy<
   VectorizeIndexBindingPolicy,
-  (index: VectorizeIndex) => Effect.Effect<void>
+  (index: VectorizeIndex) => Effect.Effect<void>,
+  Providers
 >()("Cloudflare.Vectorize.IndexBinding") {}
 
 export const VectorizeIndexBindingPolicyLive =

package/src/Cloudflare/VpcService/VpcService.ts

@@ -132,7 +132,7 @@ const createServiceName = (id: string, name: string | undefined) =>
     });
   });
 
-const findServiceByName = Effect.fnUntraced(function* (name: string) {
+const findServiceByName = Effect.fn(function* (name: string) {
   const { accountId } = yield* yield* CloudflareEnvironment;
   return yield* connectivity.listDirectoryServices.items({ accountId }).pipe(
     Stream.filter((s) => s.name === name),

package/src/Cloudflare/WaitingRoom/Settings.ts

@@ -1,6 +1,7 @@
 import * as waitingRooms from "@distilled.cloud/cloudflare/waiting-rooms";
 import * as Effect from "effect/Effect";
 import * as Predicate from "effect/Predicate";
+import * as Schedule from "effect/Schedule";
 
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
@@ -111,6 +112,20 @@ export const WaitingRoomSettingsProvider = () =>
         allZones.map((zone) => zone.id),
         (zoneId) =>
           waitingRooms.getSetting({ zoneId }).pipe(
+            // A freshly-minted scoped token propagates eventually-
+            // consistently across Cloudflare's edge — ride out transient
+            // 403 blips before giving up on a zone. The backoff is CAPPED at
+            // 5s and bounded to ~8 attempts (~40s): an uncapped
+            // `Schedule.exponential` reaches a 64s single delay by the 8th
+            // retry (~128s total) which, fanned across every zone, blows the
+            // test timeout when a zone is persistently 403.
+            Effect.retry({
+              while: (e) => e._tag === "Forbidden",
+              schedule: Schedule.exponential("500 millis").pipe(
+                Schedule.either(Schedule.spaced("5 seconds")),
+                Schedule.both(Schedule.recurs(8)),
+              ),
+            }),
             Effect.map((observed) =>
               toAttributes(
                 zoneId,
@@ -118,8 +133,11 @@ export const WaitingRoomSettingsProvider = () =>
                 observed.searchEngineCrawlerBypass,
               ),
             ),
-            // Plan-gated or partial zones reject the route; skip them.
+            // Plan-gated or partial zones reject the route; a zone the token
+            // still can't read (persistent 403) isn't ours to enumerate —
+            // skip both rather than failing the whole listing.
             Effect.catchTag("InvalidRoute", () => Effect.succeed(undefined)),
+            Effect.catchTag("Forbidden", () => Effect.succeed(undefined)),
           ),
         { concurrency: 10 },
       );

package/src/Cloudflare/Website/StaticSite.ts

@@ -1,8 +1,8 @@
 import * as Effect from "effect/Effect";
+import { cast } from "effect/Function";
 import * as Redacted from "effect/Redacted";
 import { AlchemyContext } from "../../AlchemyContext.ts";
-import { Command, type CommandProps } from "../../Build/Command.ts";
-import { DevServer } from "../../Build/DevServer.ts";
+import * as Command from "../../Command/index.ts";
 import type { Input, InputProps } from "../../Input.ts";
 import * as Namespace from "../../Namespace.ts";
 import * as Output from "../../Output.ts";
@@ -21,7 +21,7 @@ import {
 export interface StaticSiteProps<Bindings extends WorkerBindingProps = {}>
   extends
     Omit<WorkerProps<Bindings, WorkerAssetsConfig>, "assets" | "dev">,
-    Omit<CommandProps, "env"> {
+    Omit<Command.BuildProps, "env"> {
   /**
    * Optional configuration for static asset routing behavior.
    * Supports `runWorkerFirst`, `htmlHandling`, `notFoundHandling`, etc.
@@ -51,8 +51,9 @@ export interface StaticSiteProps<Bindings extends WorkerBindingProps = {}>
      */
     command: string;
     /**
-     * Working directory for {@link command}. Defaults to {@link CommandProps.cwd}
-     * (the build command's `cwd`), or `process.cwd()` if neither is set.
+     * Working directory for {@link command}. Defaults to
+     * {@link Command.BuildProps.cwd} (the build command's `cwd`), or
+     * `process.cwd()` if neither is set.
      */
     cwd?: string;
     /**
@@ -227,7 +228,7 @@ const makeStaticSite = <
     // skip the build, and tell Worker not to start a local instance.
     const dev =
       ctx.dev && props.dev
-        ? yield* DevServer("Dev", {
+        ? yield* Command.Dev("Dev", {
             command: props.dev.command,
             cwd:
               props.dev.cwd ??
@@ -236,7 +237,7 @@ const makeStaticSite = <
           }).pipe(
             Effect.map((d) =>
               Output.map(d.url, (url) => ({
-                url: url ?? props.dev?.url ?? (false as const),
+                url: url ?? props.dev?.url,
               })),
             ),
           )
@@ -244,7 +245,7 @@ const makeStaticSite = <
 
     const build = dev
       ? undefined
-      : yield* Command("Build", {
+      : yield* Command.Build("Build", {
           command: props.command,
           cwd: props.cwd,
           memo: props.memo,
@@ -263,16 +264,16 @@ const makeStaticSite = <
     return yield* Worker<Bindings, WorkerAssetsConfig, Req>("Worker", {
       ...props,
       assets: build
-        ? {
+        ? cast({
             directory: build.outdir,
             hash: build.hash,
             ...props.assets,
-          }
+          })
         : undefined,
       // Opt out of the local Worker in dev when the external DevCommand
       // is serving the content. The Worker resource still exists in
       // state with a stub Attributes shape.
-      dev: dev ? dev.url : undefined,
+      dev: dev ? { mode: "external", url: dev.url } : undefined,
       script: fallbackScript ?? props.script,
     });
   }).pipe(Namespace.push(id));

package/src/Cloudflare/Website/Vite.ts

@@ -1,5 +1,5 @@
 import * as Effect from "effect/Effect";
-import type { MemoOptions } from "../../Build/Memo.ts";
+import type { MemoOptions } from "../../Command/Memo.ts";
 import type { InputProps } from "../../Input.ts";
 import { effectClass } from "../../Util/effect.ts";
 import type { Providers } from "../Providers.ts";

package/src/Cloudflare/Workers/AccountSetting.ts

@@ -199,15 +199,18 @@ export const WorkersAccountSettingProvider = () =>
       }
 
       yield* workers.putAccountSetting({ accountId, ...desired });
-      // 4. Return — re-read for fresh attributes (the PUT response body
-      //    uses a different key shape than the GET response).
-      const final = yield* workers.getAccountSetting({ accountId });
-      return toAttributes(
+      // 4. Return — the PUT is authoritative for what we just wrote. We do
+      //    NOT re-read here: `getAccountSetting` is eventually consistent and
+      //    can briefly echo the pre-write values right after a PUT (observed
+      //    under concurrent load), which would surface a stale `greenCompute`
+      //    in the reconcile output. The values we sent are the new state.
+      return {
         accountId,
-        final,
+        defaultUsageModel: desired.defaultUsageModel,
+        greenCompute: desired.greenCompute,
         initialDefaultUsageModel,
         initialGreenCompute,
-      );
+      };
     }),
 
     delete: Effect.fn(function* ({ output }) {