alchemy 2.0.0-beta.67 → 2.0.0-beta.69

package/src/Cloudflare/DNS/ZoneTransferOutgoing.ts

@@ -228,8 +228,8 @@ export const ZoneTransferOutgoingProvider = () =>
       const observedEnabled = yield* getEnabled(zoneId);
       if (observedEnabled !== desiredEnabled) {
         yield* desiredEnabled
-          ? dns.enableZoneTransferOutgoing({ zoneId, body: {} })
-          : dns.disableZoneTransferOutgoing({ zoneId, body: {} });
+          ? dns.enableZoneTransferOutgoing({ zoneId })
+          : dns.disableZoneTransferOutgoing({ zoneId });
       }
 
       return toAttributes(observed, zoneId, desiredEnabled);

package/src/Cloudflare/Devices/DexTest.ts

@@ -25,7 +25,7 @@ export interface DeviceDexTestData {
   /** The kind of synthetic test the WARP client runs. */
   kind: "http" | "traceroute";
   /** The HTTP method to use — only `GET` is supported. */
-  method?: "GET";
+  method?: "GET" | (string & {});
 }
 
 /**
@@ -258,7 +258,7 @@ type ObservedDexTest = {
   data: {
     host: string;
     kind: "http" | "traceroute" | (string & {});
-    method?: "GET" | null;
+    method?: "GET" | (string & {}) | null;
   };
   enabled: boolean;
   interval: string;
@@ -294,7 +294,11 @@ const createTestName = (id: string, name: string | undefined) =>
 
 const encodeData = (
   data: DeviceDexTestData,
-): { host: string; kind: "http" | "traceroute"; method?: "GET" } => ({
+): {
+  host: string;
+  kind: "http" | "traceroute";
+  method?: "GET" | (string & {});
+} => ({
   host: data.host,
   kind: data.kind,
   ...(data.method !== undefined ? { method: data.method } : {}),

package/src/Cloudflare/Devices/ManagedNetwork.ts

@@ -215,7 +215,7 @@ type ObservedNetwork = {
   config?: { tlsSockaddr: string; sha256?: string | null } | null;
   name?: string | null;
   networkId?: string | null;
-  type?: "tls" | null;
+  type?: "tls" | (string & {}) | null;
 };
 
 /**

package/src/Cloudflare/Diagnostics/EndpointHealthcheck.ts

@@ -47,7 +47,7 @@ export interface EndpointHealthcheckAttributes {
   /** The Cloudflare account the healthcheck belongs to. */
   accountId: string;
   /** Type of check performed. */
-  checkType: "icmp";
+  checkType: "icmp" | (string & {});
   /** The IP address of the host checks are performed against. */
   endpoint: string;
   /** Name associated with this check. */

package/src/Cloudflare/Dlp/Entry.ts

@@ -55,7 +55,7 @@ export type EntryAttributes = {
   /** Whether the entry participates in scans. */
   enabled: boolean;
   /** Observed detection pattern. */
-  pattern: { regex: string; validation: "luhn" | undefined };
+  pattern: { regex: string; validation: "luhn" | (string & {}) | undefined };
   /** The profile the entry is attached to, if any. */
   profileId: string | undefined;
 };
@@ -145,7 +145,7 @@ export const EntryProvider = () =>
           Array.from(chunk).flatMap((page) =>
             (page.result ?? [])
               .filter(
-                (entry): entry is typeof entry & { type: "custom" } =>
+                (entry): entry is zeroTrust.DlpEntriesListResultItemCase0 =>
                   "type" in entry && entry.type === "custom",
               )
               .map((entry) => toAttributes(entry, accountId)),
@@ -221,7 +221,7 @@ type ObservedEntry = {
   id: string;
   enabled: boolean;
   name: string;
-  pattern: { regex: string; validation?: "luhn" | null };
+  pattern: { regex: string; validation?: "luhn" | (string & {}) | null };
   description?: string | null;
   profileId?: string | null;
 };
@@ -233,7 +233,9 @@ type ObservedEntry = {
 const observeEntry = (accountId: string, entryId: string) =>
   zeroTrust.getDlpEntryCustom({ accountId, entryId }).pipe(
     Effect.map((entry) =>
-      "type" in entry && entry.type === "custom" ? entry : undefined,
+      "type" in entry && entry.type === "custom"
+        ? (entry as zeroTrust.DlpEntriesGetResultCase0)
+        : undefined,
     ),
     Effect.catchTag("DlpEntryNotFound", () => Effect.succeed(undefined)),
   );

package/src/Cloudflare/Email/Routing.ts

@@ -136,10 +136,7 @@ export const RoutingProvider = () =>
       const desired = news.enabled ?? true;
 
       if (desired) {
-        const result = yield* emailRouting.enableEmailRouting({
-          zoneId,
-          body: {},
-        });
+        const result = yield* emailRouting.enableEmailRouting({ zoneId });
         return {
           routingId: result.id,
           zoneId,
@@ -148,10 +145,7 @@ export const RoutingProvider = () =>
           status: (result.status ?? undefined) as RoutingStatus | undefined,
         };
       } else {
-        const result = yield* emailRouting.disableEmailRouting({
-          zoneId,
-          body: {},
-        });
+        const result = yield* emailRouting.disableEmailRouting({ zoneId });
         return {
           routingId: result.id,
           zoneId,
@@ -163,7 +157,7 @@ export const RoutingProvider = () =>
     }),
     delete: Effect.fn(function* ({ output }) {
       yield* emailRouting
-        .disableEmailRouting({ zoneId: output.zoneId, body: {} })
+        .disableEmailRouting({ zoneId: output.zoneId })
         .pipe(Effect.catch(() => Effect.void));
     }),
   });

package/src/Cloudflare/Email/SendBinding.ts

@@ -28,7 +28,9 @@ export const SendBinding = Layer.effect(
               allowedSenderAddresses: sender.allowedSenderAddresses,
             },
           ],
-          dev: sender.dev,
+          // Dev-only local-emulation opt-out, contributed as a parallel
+          // channel (like `hyperdrives`) so the wire binding stays pure.
+          ...(sender.devRemote ? { devRemote: { [sender.name]: true } } : {}),
         });
       }
 

package/src/Cloudflare/Email/SendEmail.ts

@@ -1,4 +1,5 @@
 import * as Effect from "effect/Effect";
+import { ProviderModePolicy } from "../../ProviderMode.ts";
 
 type SendEmailTypeId = typeof SendEmailTypeId;
 const SendEmailTypeId = "Cloudflare.Email.SendEmail" as const;
@@ -24,18 +25,6 @@ export type SendEmailProps = {
    * {@link Routing}) and the addresses must be verified.
    */
   allowedSenderAddresses?: string[];
-  /**
-   * Configuration for the binding in `alchemy dev`.
-   * @default { remote: false }
-   */
-  dev?: {
-    /**
-     * Whether to send emails through the live Cloudflare Email service in development.
-     * If `false`, emails will be logged to the console instead.
-     * @default false
-     */
-    remote?: boolean;
-  };
 };
 
 /**
@@ -46,6 +35,12 @@ export type SendEmailProps = {
  * destination/sender restrictions; the actual `send_email` entry is attached
  * to the Worker via {@link SendBinding}.
  *
+ * Under `alchemy dev` the binding is lowered onto the local email simulator:
+ * `send()` validates the message and persists it as a `.eml` under
+ * `.alchemy/local/email` instead of delivering mail. Pipe the descriptor
+ * through `Alchemy.remote()` to send through the live Cloudflare Email
+ * service in dev — the same opt-out aspect resources use.
+ *
  * @resource
  *
  * @section Binding to a Worker
@@ -70,10 +65,27 @@ export type SendEmailProps = {
  *   destinationAddress: "ops@example.com",
  * });
  * ```
+ *
+ * @section Local development
+ * @example Send real mail from the dev loop
+ * ```typescript
+ * // Default: `send()` lands in the local simulator under `alchemy dev`.
+ * // Alchemy.remote() opts into the live Email service instead:
+ * const Email = Cloudflare.Email.SendEmail("Email", {
+ *   allowedSenderAddresses: ["noreply@example.com"],
+ * }).pipe(Alchemy.remote());
+ * ```
  */
 export type SendEmail = SendEmailProps & {
   kind: SendEmailTypeId;
   name: string;
+  /**
+   * Alchemy-internal: opt-out of local emulation in `alchemy dev` — the
+   * `Alchemy.remote()` decoration captured at registration time. Registered
+   * on the host Worker via the binding-data `devRemote` channel, never on
+   * the wire binding itself.
+   */
+  devRemote?: boolean;
 };
 
 export const isSendEmail = (value: unknown): value is SendEmail =>
@@ -89,12 +101,17 @@ export const SendEmail: (
   id: string,
   props?: SendEmailProps,
 ) {
+  // Capture the `Alchemy.remote()` decoration the same way resources do —
+  // at registration time, from the ambient ProviderModePolicy reference.
+  // `send_email` has no cloud-side resource (and thus no provider mode to
+  // stamp), so the captured flag rides on the descriptor instead.
+  const devRemote = (yield* ProviderModePolicy) === true || undefined;
   return {
     kind: SendEmailTypeId,
     name: id,
     destinationAddress: props?.destinationAddress,
     allowedDestinationAddresses: props?.allowedDestinationAddresses,
     allowedSenderAddresses: props?.allowedSenderAddresses,
-    dev: props?.dev,
+    devRemote,
   } satisfies SendEmail;
 });

package/src/Cloudflare/Gateway/Certificate.ts

@@ -224,7 +224,6 @@ export const CertificateProvider = () =>
         yield* zeroTrust.activateGatewayCertificate({
           accountId,
           certificateId,
-          body: {},
         });
       } else if (
         !wantActive &&
@@ -233,7 +232,6 @@ export const CertificateProvider = () =>
         yield* zeroTrust.deactivateGatewayCertificate({
           accountId,
           certificateId,
-          body: {},
         });
       }
       const desired = wantActive ? "available" : "inactive";
@@ -253,7 +251,7 @@ export const CertificateProvider = () =>
       const status = observed.bindingStatus ?? undefined;
       if (status === "available" || status === "pending_deployment") {
         yield* zeroTrust
-          .deactivateGatewayCertificate({ accountId, certificateId, body: {} })
+          .deactivateGatewayCertificate({ accountId, certificateId })
           .pipe(
             Effect.catchTag("GatewayCertificateNotFound", () => Effect.void),
           );

package/src/Cloudflare/Gateway/Configuration.ts

@@ -323,7 +323,7 @@ const managedKeys = (
  * Cloudflare's PATCH ignores `null` blocks.
  */
 const captureBlocks = (
-  observedSettings: Record<string, unknown>,
+  observedSettings: Partial<Record<ConfigurationBlockKey, unknown>>,
   keys: ConfigurationBlockKey[],
 ): ConfigurationSnapshot => {
   const snapshot: ConfigurationSnapshot = {};

package/src/Cloudflare/Gateway/ProxyEndpoint.ts

@@ -189,7 +189,7 @@ export const ProxyEndpointProvider = () =>
       // 3. Sync — diff observed name/ips against desired and PATCH only
       //    the delta; skip the call entirely on a no-op. `ips` compares as
       //    an unordered set and only applies to ip-kind endpoints.
-      const observedIps = "ips" in observed ? [...observed.ips] : [];
+      const observedIps = observedIpsOf(observed);
       const dirty =
         observed.name !== name ||
         (kind === "ip" &&
@@ -268,6 +268,13 @@ const resolveName = (id: string, name: string | undefined) =>
     return yield* createPhysicalName({ id, lowercase: true });
   });
 
+/**
+ * Identity-kind endpoints report `ips: null` on the wire (previously `[]`),
+ * so a key-presence check is not enough — only a real array counts.
+ */
+const observedIpsOf = (endpoint: ObservedEndpoint): string[] =>
+  "ips" in endpoint && Array.isArray(endpoint.ips) ? [...endpoint.ips] : [];
+
 const toAttributes = (
   endpoint: ObservedEndpoint,
   accountId: string,
@@ -276,7 +283,7 @@ const toAttributes = (
   accountId,
   name: endpoint.name,
   kind: (endpoint.kind ?? "ip") as ProxyEndpointKind,
-  ips: "ips" in endpoint ? [...endpoint.ips] : [],
+  ips: observedIpsOf(endpoint),
   subdomain: endpoint.subdomain ?? undefined,
   createdAt: endpoint.createdAt ?? undefined,
   updatedAt: endpoint.updatedAt ?? undefined,

package/src/Cloudflare/Hyperdrive/Connection.ts

@@ -4,13 +4,13 @@ import * as Option from "effect/Option";
 import * as Redacted from "effect/Redacted";
 import * as Stream from "effect/Stream";
 
-import { AlchemyContext } from "../../AlchemyContext.ts";
 import { isResolved } from "../../Diff.ts";
+import * as ProviderLayer from "../../Local/ProviderLayer.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { isResourceOfType, Resource } from "../../Resource.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
-import { generateLocalId, isLiveId } from "../LocalRuntime.ts";
+import { generateLocalId } from "../LocalRuntime.ts";
 import type { Providers } from "../Providers.ts";
 
 export type Scheme = "postgres" | "postgresql" | "mysql";
@@ -145,7 +145,7 @@ export type Connection = Resource<
  *     port: 5432,
  *     database: "app",
  *     user: "app",
- *     password: alchemy.secret.env.DB_PASSWORD,
+ *     password: yield* Config.redacted("DB_PASSWORD"),
  *   },
  * });
  * ```
@@ -162,10 +162,12 @@ export const Connection = Resource<Connection>("Cloudflare.Hyperdrive");
 export const isHyperdriveConnection = (value: unknown): value is Connection =>
   isResourceOfType(value, "Cloudflare.Hyperdrive");
 
-export const ConnectionProvider = () =>
+export const ProviderLive = () =>
   Provider.succeed(Connection, {
-    // The `hyperdriveId` is not marked as stable because if you start in dev mode, the ID will change on first deploy.
-    stables: ["accountId"],
+    // `hyperdriveId` is stable within live mode: `updateConfig` never changes
+    // it, and the dev→deploy transition (which DOES mint a new id) is a
+    // mode-switch the engine plans as a REPLACEMENT, so updates can rely on it.
+    stables: ["hyperdriveId", "accountId"],
     list: Effect.fn(function* () {
       const { accountId } = yield* yield* CloudflareEnvironment;
       return yield* hyperdrive.listConfigs.pages({ accountId }).pipe(
@@ -193,9 +195,6 @@ export const ConnectionProvider = () =>
     }),
     diff: Effect.fn(function* ({ id, olds, news, output }) {
       const { accountId } = yield* yield* CloudflareEnvironment;
-      const ctx = yield* AlchemyContext;
-      if (ctx.dev) return undefined;
-
       if (!isResolved(news)) return undefined;
       if ((output?.accountId ?? accountId) !== accountId) {
         return { action: "replace" } as const;
@@ -208,18 +207,10 @@ export const ConnectionProvider = () =>
       if (oldName !== name) {
         return { action: "replace" } as const;
       }
-      if (!isLiveId(output?.hyperdriveId)) {
-        return { action: "update" };
-      }
     }),
     read: Effect.fn(function* ({ id, output, olds }) {
       const { accountId } = yield* yield* CloudflareEnvironment;
-      const ctx = yield* AlchemyContext;
-      if (ctx.dev) {
-        return output;
-      }
-
-      if (isLiveId(output?.hyperdriveId)) {
+      if (output?.hyperdriveId) {
         return yield* hyperdrive
           .getConfig({
             accountId: output.accountId,
@@ -271,18 +262,6 @@ export const ConnectionProvider = () =>
       const { accountId } = yield* yield* CloudflareEnvironment;
       const name = output?.name ?? (yield* createConfigName(id, news.name));
 
-      const ctx = yield* AlchemyContext;
-      if (ctx.dev) {
-        return {
-          hyperdriveId: output?.hyperdriveId ?? generateLocalId(),
-          name,
-          accountId: output?.accountId ?? accountId,
-          origin: news.origin,
-          mtls: news.mtls ?? {},
-          dev: news.dev,
-        };
-      }
-
       const requestBody = {
         origin: toRequestOrigin(news.origin),
         caching: news.caching,
@@ -294,7 +273,7 @@ export const ConnectionProvider = () =>
       // to update; otherwise we createConfig and fall back to "find by
       // name then update" if Cloudflare reports the name is already in
       // use (race or a cold-start adoption).
-      const synced = isLiveId(output?.hyperdriveId)
+      const synced = output?.hyperdriveId
         ? yield* hyperdrive.updateConfig({
             accountId: output.accountId,
             hyperdriveId: output.hyperdriveId,
@@ -330,8 +309,6 @@ export const ConnectionProvider = () =>
       };
     }),
     delete: Effect.fn(function* ({ output }) {
-      if (!isLiveId(output.hyperdriveId)) return;
-
       yield* hyperdrive
         .deleteConfig({
           accountId: output.accountId,
@@ -341,6 +318,53 @@ export const ConnectionProvider = () =>
     }),
   });
 
+/**
+ * Local (dev) provider — the config is purely virtual: reconcile mints a
+ * `dev:` id and echoes the desired props into attributes, with no cloud API
+ * calls. The actual local behavior lives in the Worker binding: the local
+ * runtime's Hyperdrive plugin is an origin passthrough driven by the
+ * `hyperdrives` record `ConnectBinding` lowers (the `dev` prop when set,
+ * otherwise the real `origin`).
+ */
+export const ProviderLocal = () =>
+  Provider.succeed(Connection, {
+    stables: ["accountId"],
+    diff: Effect.fn(function* ({ news, output }) {
+      const { accountId } = yield* yield* CloudflareEnvironment;
+      if (!output?.hyperdriveId) return { action: "update" } as const;
+      if (!isResolved(news)) return undefined;
+      if (output.accountId !== accountId) {
+        return { action: "replace" } as const;
+      }
+      // Fall through to the engine's default prop diff (name/origin/dev
+      // changes update in place; reconcile re-echoes them).
+    }),
+    read: Effect.fn(function* ({ output }) {
+      // Purely virtual — the persisted state row is the source of truth.
+      return output ?? undefined;
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output }) {
+      const { accountId } = yield* yield* CloudflareEnvironment;
+      return {
+        hyperdriveId: output?.hyperdriveId ?? generateLocalId(),
+        name: yield* createConfigName(id, news.name),
+        accountId: output?.accountId ?? accountId,
+        origin: news.origin,
+        mtls: news.mtls ?? {},
+        dev: news.dev,
+      };
+    }),
+    delete: Effect.fn(function* () {
+      // Purely virtual — dropping the state row is enough.
+    }),
+  });
+
+export const ConnectionProvider = () =>
+  ProviderLayer.dual(Connection, {
+    local: () => ProviderLocal(),
+    live: () => ProviderLive(),
+  });
+
 const createConfigName = (id: string, name: string | undefined) =>
   Effect.gen(function* () {
     if (name) return name;

package/src/Cloudflare/Iam/ResourceGroup.ts

@@ -240,7 +240,7 @@ export const ResourceGroupProvider = () =>
 type ObservedResourceGroup = {
   id: string;
   name?: string | null;
-  scope: unknown;
+  scope: iam.ResourceGroupsListResultItemScopeList;
 };
 
 /**

package/src/Cloudflare/Images/Images.ts

@@ -59,6 +59,18 @@ export class ImagesError extends Data.TaggedError("ImagesError")<{
  * //   { MEDIA: ImagesBinding }
  * ```
  *
+ * @section Local development
+ * @example Proxy to the real Images service in dev
+ * ```typescript
+ * // Default: transforms run locally via Sharp under `alchemy dev` and
+ * // hosted images are stored on disk. Alchemy.remote() opts the binding
+ * // into the real Images service instead — in an Effect-native Worker:
+ * const images = yield* Cloudflare.Images.Images("IMAGES").pipe(Alchemy.remote());
+ *
+ * // or declared on an async Worker's env:
+ * env: { IMAGES: Cloudflare.Images.Images("IMAGES").pipe(Alchemy.remote()) }
+ * ```
+ *
  * @see https://developers.cloudflare.com/images/transform-images/bindings/
  */
 export interface Images extends Binding.Service<Images, TypeId, ImagesClient> {
@@ -72,7 +84,10 @@ export interface Images extends Binding.Service<Images, TypeId, ImagesClient> {
 export const Images = Binding.Service<Images>({
   id: TypeId,
   defaultName: "IMAGES",
-  toWorkerBinding: (binding) => ({ type: "images", name: binding.name }),
+  toWorkerBinding: (binding) => ({
+    type: "images",
+    name: binding.name,
+  }),
 });
 
 export const isImages = (value: unknown): value is ImagesBinding =>

package/src/Cloudflare/KV/ReadNamespaceHttp.ts

@@ -1,6 +1,8 @@
 import * as kv from "@distilled.cloud/cloudflare/kv";
+import type * as Cause from "effect/Cause";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
 import {
   makeHttpKVNamespaceBinding,
   makeKVAuth,
@@ -40,7 +42,7 @@ export const makeReadKVHttpClient = (
         authorize(
           kv.getNamespaceValue({ accountId, namespaceId, keyName: key }),
         ).pipe(
-          Effect.map((value) => decodeValue(value, type)),
+          Effect.flatMap((res) => materializeBody(res.body, type)),
           Effect.catchTag("KeyNotFound", () => Effect.succeed(null)),
         ),
       ),
@@ -77,7 +79,7 @@ export const makeReadKVHttpClient = (
           value: authorize(
             kv.getNamespaceValue({ accountId, namespaceId, keyName: key }),
           ).pipe(
-            Effect.map((value) => decodeValue(value, type)),
+            Effect.flatMap((res) => materializeBody(res.body, type)),
             Effect.catchTag("KeyNotFound", () => Effect.succeed(null)),
           ),
           metadata: authorize(
@@ -153,6 +155,27 @@ export const makeReadKVHttpClient = (
   };
 };
 
+/**
+ * Materialize the raw value byte stream according to the requested type
+ * ("text" | "json" | "arrayBuffer" | "stream").
+ */
+const materializeBody = (
+  body: kv.GetNamespaceValueResponse["body"],
+  type: string,
+): Effect.Effect<unknown, Cause.UnknownError> =>
+  type === "stream"
+    ? Effect.sync(() => Stream.toReadableStream(body))
+    : Effect.tryPromise(() => {
+        const response = new Response(
+          Stream.toReadableStream(body) as BodyInit,
+        );
+        return type === "arrayBuffer"
+          ? response.arrayBuffer()
+          : type === "json"
+            ? response.json()
+            : response.text();
+      });
+
 /** Resolve the requested decode type from the overloaded second argument. */
 const readType = (typeOrOptions: unknown): string =>
   typeof typeOrOptions === "string"

package/src/Cloudflare/Local.ts

@@ -5,9 +5,11 @@ import { CloudflareAuth } from "./Auth/AuthProvider.ts";
 import * as CloudflareEnvironment from "./CloudflareEnvironment.ts";
 import { LocalContainerProvider } from "./Containers/LocalContainerProvider.ts";
 import * as Credentials from "./Credentials.ts";
+import { ProviderLocal as D1ProviderLocal } from "./D1/Database.ts";
 import { localRuntimeServices } from "./LocalRuntime.ts";
 import { ProviderLocal } from "./Queues/Queue.ts";
 import { ConsumerProviderLocal } from "./Queues/Consumer.ts";
+import { SecretProviderLocal } from "./SecretsStore/Secret.ts";
 import { LocalWorkerProvider } from "./Workers/LocalWorkerProvider.ts";
 
 const cloudflareServices = Layer.provide(
@@ -23,6 +25,8 @@ Layer.mergeAll(
   LocalContainerProvider(),
   ProviderLocal(),
   ConsumerProviderLocal(),
+  D1ProviderLocal(),
+  SecretProviderLocal(),
 ).pipe(
   Layer.provide(localRuntimeServices()),
   Layer.provide(cloudflareServices),

package/src/Cloudflare/LocalRuntime.ts

@@ -60,12 +60,21 @@ const LocalRuntimeStateLive = Layer.succeed(
   }),
 );
 
+/**
+ * Directory under `.alchemy` holding local-provider persistent state
+ * (workerd storage). Shared so every consumer — the local runtime layer and
+ * Vite child processes — points at the same storage.
+ */
+export const localStorageDirectory = Effect.gen(function* () {
+  const { dotAlchemy } = yield* AlchemyContext;
+  const path = yield* Path.Path;
+  return path.join(dotAlchemy, "local");
+});
+
 const makeLocalRuntimeServices = () =>
   RpcProvider.providerServicesEffect(
     Effect.gen(function* () {
       const getEnv = yield* CloudflareEnvironment;
-      const { dotAlchemy } = yield* AlchemyContext;
-      const path = yield* Path.Path;
       return Layer.merge(
         LocalRuntimeStateLive,
         layerRuntime({
@@ -73,7 +82,7 @@ const makeLocalRuntimeServices = () =>
             accountId: getEnv.pipe(Effect.map((env) => env.accountId)),
           },
           storage: {
-            directory: path.join(dotAlchemy, "local"),
+            directory: yield* localStorageDirectory,
           },
         }),
       );

package/src/Cloudflare/Logs.ts

@@ -61,7 +61,7 @@ const parseEvents = (
   if (response.events?.events) {
     for (const event of response.events.events) {
       const ts = new Date(event.timestamp);
-      const meta = event.$metadata;
+      const meta = event.metadata;
       const msg =
         meta.message ??
         (meta.level === "error"
@@ -155,7 +155,7 @@ export const CloudflareLogs = Effect.gen(function* () {
       const { id: tailId, url } = yield* createScriptTail({
         scriptName: opts.scriptName,
         accountId: opts.accountId,
-        body: { filters: [] },
+        filters: [],
       });
 
       const socket = yield* Socket.makeWebSocket(url, {

package/src/Cloudflare/MagicNetworkMonitoring/Rule.ts

@@ -118,11 +118,11 @@ export interface RuleAttributes {
    */
   duration: string | undefined;
   /** Zscore sensitivity, if set. */
-  zscoreSensitivity: "low" | "medium" | "high" | undefined;
+  zscoreSensitivity: "low" | "medium" | "high" | (string & {}) | undefined;
   /** Zscore target, if set. */
-  zscoreTarget: "bits" | "packets" | undefined;
+  zscoreTarget: "bits" | "packets" | (string & {}) | undefined;
   /** Prefix match type, if set. */
-  prefixMatch: "exact" | "subnet" | "supernet" | undefined;
+  prefixMatch: "exact" | "subnet" | "supernet" | (string & {}) | undefined;
 }
 
 export type Rule = Resource<

package/src/Cloudflare/MagicTransit/IpsecTunnel.ts

@@ -140,7 +140,7 @@ export type IpsecTunnel = Resource<
  *   cloudflareEndpoint: "203.0.113.1",
  *   customerEndpoint: "198.51.100.1",
  *   interfaceAddress: "10.213.0.10/31",
- *   psk: alchemy.secret.env.IPSEC_PSK,
+ *   psk: yield* Config.redacted("IPSEC_PSK"),
  * });
  * ```
  *

package/src/Cloudflare/MtlsCertificate/MtlsCertificate.ts

@@ -135,7 +135,7 @@ export type MtlsCertificate = Resource<
  * const cert = yield* Cloudflare.MtlsCertificate.MtlsCertificate("origin-client-cert", {
  *   ca: false,
  *   certificates: leafPem,
- *   privateKey: alchemy.secret.env.ORIGIN_CLIENT_KEY,
+ *   privateKey: yield* Config.redacted("ORIGIN_CLIENT_KEY"),
  * });
  * ```
  *