alchemy 2.0.0-beta.60 → 2.0.0-beta.61

package/src/Cloudflare/KV/Namespace.ts

@@ -5,13 +5,12 @@ import * as Stream from "effect/Stream";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
-import { Resource } from "../../Resource.ts";
+import { isResourceOfType, Resource } from "../../Resource.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Providers } from "../Providers.ts";
 
 export const isNamespace = (value: unknown): value is Namespace =>
-  typeof value === "object" &&
-  (value as any)?.Type === "Cloudflare.KV.Namespace";
+  isResourceOfType(value, "Cloudflare.KV.Namespace");
 
 export type NamespaceProps = {
   /**
@@ -68,7 +67,9 @@ export type Namespace = Resource<
  * / `Cloudflare.KV.WriteNamespace` for least-privilege read- or
  * write-only access.
  */
-export const Namespace = Resource<Namespace>("Cloudflare.KV.Namespace");
+export const Namespace = Resource<Namespace>("Cloudflare.KV.Namespace", {
+  aliases: ["Cloudflare.KVNamespace"],
+});
 
 export const NamespaceProvider = () =>
   Provider.succeed(Namespace, {

package/src/Cloudflare/KeylessCertificate/KeylessCertificate.ts

@@ -214,7 +214,9 @@ export type KeylessCertificate = Resource<
  *
  * @see https://developers.cloudflare.com/ssl/keyless-ssl/
  */
-export const KeylessCertificate = Resource<KeylessCertificate>(TypeId);
+export const KeylessCertificate = Resource<KeylessCertificate>(TypeId, {
+  aliases: ["Cloudflare.KeylessCertificate"],
+});
 
 /**
  * Returns true if the given value is a KeylessCertificate resource.

package/src/Cloudflare/LeakedCredentialCheck/LeakedCredentialCheck.ts

@@ -91,7 +91,9 @@ export type LeakedCredentialCheck = Resource<
  *
  * @see https://developers.cloudflare.com/waf/detections/leaked-credentials/
  */
-export const LeakedCredentialCheck = Resource<LeakedCredentialCheck>(TypeId);
+export const LeakedCredentialCheck = Resource<LeakedCredentialCheck>(TypeId, {
+  aliases: ["Cloudflare.LeakedCredentialCheck"],
+});
 
 /**
  * Returns true if the given value is a LeakedCredentialCheck resource.

package/src/Cloudflare/LoadBalancer/LoadBalancer.ts

@@ -239,7 +239,9 @@ export type LoadBalancer = Resource<
  *
  * @see https://developers.cloudflare.com/load-balancing/
  */
-export const LoadBalancer = Resource<LoadBalancer>(TypeId);
+export const LoadBalancer = Resource<LoadBalancer>(TypeId, {
+  aliases: ["Cloudflare.LoadBalancer"],
+});
 
 /**
  * Returns true if the given value is a LoadBalancer resource.

package/src/Cloudflare/ManagedTransforms/ManagedTransforms.ts

@@ -172,7 +172,9 @@ export type ManagedTransforms = Resource<
  *
  * @see https://developers.cloudflare.com/rules/transform/managed-transforms/
  */
-export const ManagedTransforms = Resource<ManagedTransforms>(TypeId);
+export const ManagedTransforms = Resource<ManagedTransforms>(TypeId, {
+  aliases: ["Cloudflare.ManagedTransforms"],
+});
 
 /**
  * Returns true if the given value is a ManagedTransforms resource.

package/src/Cloudflare/MtlsCertificate/MtlsCertificate.ts

@@ -167,7 +167,9 @@ export type MtlsCertificate = Resource<
  *
  * @see https://developers.cloudflare.com/ssl/client-certificates/
  */
-export const MtlsCertificate = Resource<MtlsCertificate>(TypeId);
+export const MtlsCertificate = Resource<MtlsCertificate>(TypeId, {
+  aliases: ["Cloudflare.MtlsCertificate"],
+});
 
 /**
  * Returns true if the given value is a MtlsCertificate resource.

package/src/Cloudflare/Organization/Organization.ts

@@ -183,7 +183,9 @@ export type Organization = Resource<
  *
  * @see https://developers.cloudflare.com/fundamentals/setup/manage-organizations/
  */
-export const Organization = Resource<Organization>(TypeId);
+export const Organization = Resource<Organization>(TypeId, {
+  aliases: ["Cloudflare.Organization"],
+});
 
 /**
  * Returns true if the given value is an Organization resource.

package/src/Cloudflare/OriginCaCertificate/OriginCaCertificate.ts

@@ -145,7 +145,9 @@ export type OriginCaCertificate = Resource<
  *
  * @see https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/
  */
-export const OriginCaCertificate = Resource<OriginCaCertificate>(TypeId);
+export const OriginCaCertificate = Resource<OriginCaCertificate>(TypeId, {
+  aliases: ["Cloudflare.OriginCaCertificate"],
+});
 
 /**
  * Returns true if the given value is an OriginCaCertificate resource.
@@ -238,7 +240,10 @@ export const OriginCaCertificateProvider = () =>
       // adopt policy. Ambiguity (several live certs with the same
       // hostnames) means no identity at all — report missing and recreate
       // (certificates are free and revocation is harmless).
-      if (!olds?.hostnames?.length) return undefined;
+      // Output-valued hostname elements don't survive a `creating`-state
+      // round-trip (they deserialize as null/undefined) — without a concrete
+      // hostname there is no identity to search by.
+      if (typeof olds?.hostnames?.[0] !== "string") return undefined;
       const matches = yield* findByHostnames(olds.hostnames);
       if (matches.length !== 1) return undefined;
       const observed = yield* getCertificate(matches[0].id!);

package/src/Cloudflare/OriginPostQuantumEncryption/OriginPostQuantumEncryption.ts

@@ -113,7 +113,9 @@ export type OriginPostQuantumEncryption = Resource<
  * @see https://developers.cloudflare.com/ssl/origin-configuration/pqc-to-origin/
  */
 export const OriginPostQuantumEncryption =
-  Resource<OriginPostQuantumEncryption>(TypeId);
+  Resource<OriginPostQuantumEncryption>(TypeId, {
+    aliases: ["Cloudflare.OriginPostQuantumEncryption"],
+  });
 
 /**
  * Returns true if the given value is an OriginPostQuantumEncryption resource.

package/src/Cloudflare/OriginTlsClientAuth/HostnameCertificate.ts

@@ -175,8 +175,12 @@ export const HostnameCertificateProvider = () =>
       ) {
         return { action: "replace" } as const;
       }
+      // Compare the certificate only when the old value is known — an
+      // Output-valued `certificate` doesn't survive a `creating`-state
+      // round-trip (it deserializes as `undefined`).
       if (
-        normalizePem(olds.certificate) !== normalizePem(news.certificate) ||
+        (olds.certificate !== undefined &&
+          normalizePem(olds.certificate) !== normalizePem(news.certificate)) ||
         unwrap(olds.privateKey) !== unwrap(news.privateKey)
       ) {
         // There is no update API for hostname client certificates — every

package/src/Cloudflare/PageRule/PageRule.ts

@@ -170,7 +170,9 @@ export type PageRule = Resource<TypeId, Props, Attributes, never, Providers>;
  *
  * @see https://developers.cloudflare.com/rules/page-rules/
  */
-export const PageRule = Resource<PageRule>(TypeId);
+export const PageRule = Resource<PageRule>(TypeId, {
+  aliases: ["Cloudflare.PageRule"],
+});
 
 /**
  * Returns true if the given value is a PageRule resource.

package/src/Cloudflare/Providers.ts

@@ -684,31 +684,46 @@ export const providers = () =>
     ),
     Layer.provide(DockerLive),
     Layer.provideMerge(localRuntimeServices()),
-    Layer.provideMerge(Credentials.fromAuthProvider()),
+    Layer.provideMerge(CloudflareApiLive()),
+    Layer.orDie,
+  );
+
+/**
+ * The foundation every effect tree that talks to the Cloudflare API
+ * shares — credentials resolved through the Alchemy auth provider,
+ * account environment, Access, profile + credential store — plus a
+ * blanket retry policy applied to every Cloudflare API call.
+ *
+ * Used by {@link providers} and the Cloudflare state store
+ * ({@link ../Cloudflare/StateStore/State.ts state}) so that provider
+ * lifecycle operations and state-store init/bootstrap probes retry
+ * transient failures the same way; without it the state-store
+ * subdomain/script/secrets probes run on the SDK's shorter default
+ * policy and surface throttling ("Please wait and consider throttling
+ * your request speed") to users.
+ *
+ * The retry policy extends `Retry.makeDefault`'s transient detection
+ * (throttling / 5xx / network) with Cloudflare-specific
+ * misleadingly-tagged transient cases the SDK doesn't yet mark
+ * retryable — see `cloudflareRetryFactory` below. Deliberately
+ * narrow: we ONLY add cases where the message unambiguously indicates
+ * a transient infrastructure failure (not a real auth/permission
+ * failure). Auto-retrying ambiguous cases like `Unauthorized:
+ * Authentication error` would silently loop on genuinely invalid
+ * tokens.
+ *
+ * TODO(distilled): once
+ * https://github.com/alchemy-run/distilled/pull/233 lands, the retry
+ * wrapper can collapse back to `Retry.makeDefault`.
+ */
+export const CloudflareApiLive = () =>
+  Credentials.fromAuthProvider().pipe(
     Layer.provideMerge(CloudflareEnvironment.fromProfile()),
     Layer.provideMerge(CloudflareAuth),
     Layer.provideMerge(Access.AccessLive),
     Layer.provideMerge(ProfileLive),
     Layer.provideMerge(CredentialsStoreLive),
-    // Apply a blanket retry policy to every Cloudflare API call. Extends
-    // `Retry.makeDefault`'s transient detection (throttling / 5xx /
-    // network) with one Cloudflare-specific misleadingly-tagged
-    // transient case the SDK doesn't yet mark retryable — see
-    // `cloudflareRetryFactory` below. Without this, the matching brief
-    // CF infrastructure blips surface as test failures and resource
-    // leaks.
-    //
-    // Deliberately narrow: we ONLY add cases where the message
-    // unambiguously indicates a transient infrastructure failure (not
-    // a real auth/permission failure). Auto-retrying ambiguous cases
-    // like `Unauthorized: Authentication error` would silently loop on
-    // genuinely invalid tokens.
-    //
-    // TODO(distilled): once
-    // https://github.com/alchemy-run/distilled/pull/233 lands, this
-    // wrapper can collapse back to `Retry.makeDefault`.
     Layer.provideMerge(Layer.succeed(Retry.Retry, cloudflareRetryFactory)),
-    Layer.orDie,
   );
 
 const cloudflareRetryFactory: Retry.Factory = (lastError) => {

package/src/Cloudflare/Queues/Consumer.ts

@@ -115,7 +115,9 @@ export type Consumer = Resource<
  * });
  * ```
  */
-export const Consumer = Resource<Consumer>("Cloudflare.Queues.Consumer");
+export const Consumer = Resource<Consumer>("Cloudflare.Queues.Consumer", {
+  aliases: ["Cloudflare.QueueConsumer"],
+});
 
 // Cloudflare allows a single Worker consumer per queue, so the
 // first match in the paginated stream is the only one. Using

package/src/Cloudflare/Queues/Queue.ts

@@ -9,7 +9,7 @@ import * as ProviderLayer from "../../Local/ProviderLayer.ts";
 import * as RpcProvider from "../../Local/RpcProvider.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
-import { Resource } from "../../Resource.ts";
+import { isResourceOfType, Resource } from "../../Resource.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import {
   generateLocalId,
@@ -20,8 +20,7 @@ import {
 import type { Providers } from "../Providers.ts";
 
 export const isQueue = (value: unknown): value is Queue =>
-  typeof value === "object" &&
-  (value as any)?.Type === "Cloudflare.Queues.Queue";
+  isResourceOfType(value, "Cloudflare.Queues.Queue");
 
 export type QueueProps = {
   /**
@@ -104,7 +103,9 @@ export type Queue = Resource<
  * );
  * ```
  */
-export const Queue = Resource<Queue>("Cloudflare.Queues.Queue");
+export const Queue = Resource<Queue>("Cloudflare.Queues.Queue", {
+  aliases: ["Cloudflare.Queue"],
+});
 
 export const ProviderLive = () =>
   Provider.succeed(Queue, {

package/src/Cloudflare/Queues/Subscription.ts

@@ -193,7 +193,9 @@ export type Subscription = Resource<
  *
  * @see https://developers.cloudflare.com/queues/event-subscriptions/
  */
-export const Subscription = Resource<Subscription>(TypeId);
+export const Subscription = Resource<Subscription>(TypeId, {
+  aliases: ["Cloudflare.Queue.Subscription"],
+});
 
 /**
  * Returns true if the given value is a Subscription resource.

package/src/Cloudflare/R2/Bucket.ts

@@ -6,13 +6,13 @@ import * as Stream from "effect/Stream";
 import { deepEqual, isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
-import { Resource } from "../../Resource.ts";
+import { isResourceOfType, Resource } from "../../Resource.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type * as Cloudflare from "../Providers.ts";
 import * as Zone from "../Zone/index.ts";
 
 export const isBucket = (value: any): value is Bucket =>
-  typeof value === "object" && (value as any)?.Type === "Cloudflare.R2.Bucket";
+  isResourceOfType(value, "Cloudflare.R2.Bucket");
 
 export type BucketName = string;
 
@@ -99,6 +99,39 @@ export type BucketLifecycleRule = {
   }[];
 };
 
+export type BucketCorsRule = {
+  /**
+   * Optional label for this rule, shown in the Cloudflare dashboard. Not
+   * used to correlate rules across updates — the CORS configuration is
+   * always replaced as a whole.
+   */
+  id?: string;
+  /**
+   * HTTP methods browsers are allowed to use in cross-origin requests.
+   */
+  allowedMethods: ("GET" | "PUT" | "POST" | "DELETE" | "HEAD")[];
+  /**
+   * Origins allowed to make cross-origin requests, e.g.
+   * `"https://example.com"`. Use `"*"` to allow any origin.
+   */
+  allowedOrigins: string[];
+  /**
+   * Request headers browsers are allowed to send, e.g. `"range"` for
+   * range reads. If omitted, only simple headers are allowed.
+   */
+  allowedHeaders?: string[];
+  /**
+   * Response headers the browser is allowed to expose to the requesting
+   * JavaScript, e.g. `"etag"` or `"content-range"`.
+   */
+  exposeHeaders?: string[];
+  /**
+   * How long (in seconds) browsers may cache CORS preflight responses.
+   * Browsers may cap this at 2 hours or less, even if 86400 is specified.
+   */
+  maxAgeSeconds?: number;
+};
+
 export type BucketProps = {
   /**
    * Name of the bucket. If omitted, a unique name will be generated.
@@ -130,6 +163,13 @@ export type BucketProps = {
    * supported transitions.
    */
   lifecycleRules?: BucketLifecycleRule[];
+  /**
+   * CORS rules applied to the bucket, controlling which cross-origin
+   * browser requests are allowed against the bucket's public or S3 API
+   * endpoints. Pass an empty array (or omit) to remove the CORS
+   * configuration.
+   */
+  cors?: BucketCorsRule[];
 };
 
 export type Bucket = Resource<
@@ -143,6 +183,7 @@ export type Bucket = Resource<
     accountId: string;
     domains: Bucket.CustomDomain[];
     lifecycleRules: Bucket.LifecycleRule[];
+    cors: Bucket.CorsRule[];
   },
   never,
   Cloudflare.Providers
@@ -298,8 +339,60 @@ export type Bucket = Resource<
  *   ],
  * });
  * ```
+ *
+ * @section CORS
+ *
+ * Configure CORS rules so browsers can make cross-origin requests against
+ * the bucket's public (custom domain / r2.dev) or S3 API endpoints. Pass an
+ * empty array (or omit) to remove the CORS configuration. See the
+ * [Cloudflare R2 docs](https://developers.cloudflare.com/r2/buckets/cors/)
+ * for details.
+ *
+ * @example Allow cross-origin reads from any origin
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2.Bucket("MyBucket", {
+ *   cors: [
+ *     {
+ *       allowedMethods: ["GET", "HEAD"],
+ *       allowedOrigins: ["*"],
+ *     },
+ *   ],
+ * });
+ * ```
+ *
+ * @example Browser range reads (e.g. PMTiles map tiles)
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2.Bucket("MyBucket", {
+ *   domains: [{ name: "tiles.example.com" }],
+ *   cors: [
+ *     {
+ *       allowedMethods: ["GET", "HEAD"],
+ *       allowedOrigins: ["https://map.example.com"],
+ *       allowedHeaders: ["range", "if-match"],
+ *       exposeHeaders: ["etag", "content-range"],
+ *       maxAgeSeconds: 3600,
+ *     },
+ *   ],
+ * });
+ * ```
+ *
+ * @example Allow uploads from a web app
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2.Bucket("MyBucket", {
+ *   cors: [
+ *     {
+ *       allowedMethods: ["GET", "PUT", "POST"],
+ *       allowedOrigins: ["https://app.example.com"],
+ *       allowedHeaders: ["content-type"],
+ *       exposeHeaders: ["etag"],
+ *     },
+ *   ],
+ * });
+ * ```
  */
-export const Bucket = Resource<Bucket>("Cloudflare.R2.Bucket");
+export const Bucket = Resource<Bucket>("Cloudflare.R2.Bucket", {
+  aliases: ["Cloudflare.R2Bucket"],
+});
 
 export declare namespace Bucket {
   export type StorageClass = "Standard" | "InfrequentAccess";
@@ -322,6 +415,14 @@ export declare namespace Bucket {
         }[]
       | undefined;
   };
+  export type CorsRule = {
+    id: string | undefined;
+    allowedMethods: ("GET" | "PUT" | "POST" | "DELETE" | "HEAD")[];
+    allowedOrigins: string[];
+    allowedHeaders: string[] | undefined;
+    exposeHeaders: string[] | undefined;
+    maxAgeSeconds: number | undefined;
+  };
   export type CustomDomain = {
     domain: string;
     zoneId: string | undefined;
@@ -657,6 +758,71 @@ export const BucketProvider = () =>
           return desiredRules;
         });
 
+      const reconcileCorsRules = (
+        bucketName: string,
+        jurisdiction: Bucket.Jurisdiction,
+        desired: BucketCorsRule[],
+      ) =>
+        Effect.gen(function* () {
+          const { accountId } = yield* yield* CloudflareEnvironment;
+          const observed = yield* r2
+            .getBucketCors({
+              accountId,
+              bucketName,
+              jurisdiction,
+            })
+            .pipe(
+              Effect.map((response) => (response.rules ?? []).map(toCorsRule)),
+              // A bucket with no CORS configuration is a typed error, not an
+              // empty rule list — normalize it to [] for the diff below.
+              Effect.catchTag("NoCorsConfiguration", () =>
+                Effect.succeed([] as Bucket.CorsRule[]),
+              ),
+              Effect.retry({
+                while: (e) => e._tag === "NoSuchBucket",
+                schedule: r2BucketEndpointConsistencySchedule,
+              }),
+            );
+
+          const desiredRules = desired.map(normalizeCorsRule);
+
+          if (deepEqual(observed, desiredRules)) {
+            return desiredRules;
+          }
+
+          if (desiredRules.length === 0) {
+            yield* r2
+              .deleteBucketCors({
+                accountId,
+                bucketName,
+                jurisdiction,
+              })
+              .pipe(
+                Effect.retry({
+                  while: (e) => e._tag === "NoSuchBucket",
+                  schedule: r2BucketEndpointConsistencySchedule,
+                }),
+              );
+            return desiredRules;
+          }
+
+          yield* r2
+            .putBucketCors({
+              accountId,
+              bucketName,
+              jurisdiction,
+              rules: desired.map(toCorsPutPayload),
+            })
+            .pipe(
+              Effect.retry({
+                while: (e) => e._tag === "NoSuchBucket",
+                schedule: r2BucketEndpointConsistencySchedule,
+              }),
+            );
+
+          return desiredRules;
+        });
+
       return {
         stables: ["bucketName", "accountId"],
         list: () =>
@@ -715,6 +881,21 @@ export const BucketProvider = () =>
                         Effect.succeed([] as Bucket.LifecycleRule[]),
                       ),
                     );
+                  const cors = yield* r2
+                    .getBucketCors({
+                      accountId,
+                      bucketName: bucket.name,
+                      jurisdiction: bucket.jurisdiction,
+                    })
+                    .pipe(
+                      Effect.map((observed) =>
+                        (observed.rules ?? []).map(toCorsRule),
+                      ),
+                      Effect.catchTag(
+                        ["NoSuchBucket", "NoCorsConfiguration"],
+                        () => Effect.succeed([] as Bucket.CorsRule[]),
+                      ),
+                    );
                   return {
                     bucketName: bucket.name,
                     storageClass: bucket.storageClass,
@@ -723,6 +904,7 @@ export const BucketProvider = () =>
                     accountId,
                     domains,
                     lifecycleRules,
+                    cors,
                   };
                 }).pipe(
                   // The custom-domain endpoint intermittently 500s ("Failed to
@@ -772,6 +954,9 @@ export const BucketProvider = () =>
           if (!deepEqual(olds.lifecycleRules, news.lifecycleRules)) {
             return { action: "update" } as const;
           }
+          if (!deepEqual(olds.cors, news.cors)) {
+            return { action: "update" } as const;
+          }
         }),
         reconcile: Effect.fn(function* ({ id, news = {}, output }) {
           const { accountId } = yield* yield* CloudflareEnvironment;
@@ -873,10 +1058,17 @@ export const BucketProvider = () =>
             news.lifecycleRules ?? [],
           );
 
+          const cors = yield* reconcileCorsRules(
+            attrs.bucketName,
+            attrs.jurisdiction,
+            news.cors ?? [],
+          );
+
           return {
             ...attrs,
             domains,
             lifecycleRules,
+            cors,
           };
         }),
         delete: Effect.fn(function* ({ output }) {
@@ -931,6 +1123,7 @@ export const BucketProvider = () =>
                 accountId: acct,
                 domains: output?.domains ?? [],
                 lifecycleRules: output?.lifecycleRules ?? [],
+                cors: output?.cors ?? [],
               })),
               Effect.catchTag("NoSuchBucket", () => Effect.succeed(undefined)),
             );
@@ -1021,6 +1214,40 @@ const normalizeLifecycleRule = (
   storageClassTransitions: rule.storageClassTransitions,
 });
 
+type CorsRuleResponse = NonNullable<r2.GetBucketCorsResponse["rules"]>[number];
+
+const toCorsRule = (rule: CorsRuleResponse): Bucket.CorsRule => ({
+  id: rule.id ?? undefined,
+  // Distilled widened generated string enums to open unions.
+  allowedMethods: rule.allowed.methods as Bucket.CorsRule["allowedMethods"],
+  allowedOrigins: rule.allowed.origins,
+  allowedHeaders: rule.allowed.headers ?? undefined,
+  exposeHeaders: rule.exposeHeaders ?? undefined,
+  maxAgeSeconds: rule.maxAgeSeconds ?? undefined,
+});
+
+const normalizeCorsRule = (rule: BucketCorsRule): Bucket.CorsRule => ({
+  id: rule.id,
+  allowedMethods: rule.allowedMethods,
+  allowedOrigins: rule.allowedOrigins,
+  allowedHeaders: rule.allowedHeaders,
+  exposeHeaders: rule.exposeHeaders,
+  maxAgeSeconds: rule.maxAgeSeconds,
+});
+
+const toCorsPutPayload = (
+  rule: BucketCorsRule,
+): NonNullable<r2.PutBucketCorsRequest["rules"]>[number] => ({
+  id: rule.id,
+  allowed: {
+    methods: rule.allowedMethods,
+    origins: rule.allowedOrigins,
+    headers: rule.allowedHeaders,
+  },
+  exposeHeaders: rule.exposeHeaders,
+  maxAgeSeconds: rule.maxAgeSeconds,
+});
+
 const toLifecyclePutPayload = (
   rule: BucketLifecycleRule,
 ): NonNullable<r2.PutBucketLifecycleRequest["rules"]>[number] => ({

package/src/Cloudflare/RegionalHostname/RegionalHostname.ts

@@ -95,7 +95,9 @@ export type RegionalHostname = Resource<
  *
  * @see https://developers.cloudflare.com/data-localization/regional-services/
  */
-export const RegionalHostname = Resource<RegionalHostname>(TypeId);
+export const RegionalHostname = Resource<RegionalHostname>(TypeId, {
+  aliases: ["Cloudflare.RegionalHostname"],
+});
 
 /**
  * Returns true if the given value is a RegionalHostname resource.

package/src/Cloudflare/Ruleset/Ruleset.ts

@@ -98,7 +98,9 @@ export type Ruleset = Resource<
  * });
  * ```
  */
-export const Ruleset = Resource<Ruleset>("Cloudflare.Ruleset.Ruleset")({});
+export const Ruleset = Resource<Ruleset>("Cloudflare.Ruleset.Ruleset", {
+  aliases: ["Cloudflare.Ruleset"],
+})({});
 
 export const RulesetProvider = () =>
   Provider.succeed(Ruleset, {
@@ -255,8 +257,11 @@ export const toRulesetAttributes = (
 // type statically exposes it as an `Output`. During `diff` (plan time) the
 // zone can still be unresolved — e.g. when it's being created in the same
 // deploy — in which case `zoneId` is not yet a string. Callers must treat a
-// non-string result as "not resolved yet".
-const zoneIdOf = (zone: Zone): string | undefined => {
-  const zoneId = (zone as unknown as Partial<Attributes>).zoneId;
+// non-string result as "not resolved yet". May also receive `undefined`:
+// an Output-valued `zone` doesn't survive a `creating`-state round-trip
+// (it deserializes as `undefined`), and recovery paths hand those props
+// back as `olds`.
+const zoneIdOf = (zone: Zone | undefined): string | undefined => {
+  const zoneId = (zone as unknown as Partial<Attributes> | undefined)?.zoneId;
   return typeof zoneId === "string" ? zoneId : undefined;
 };