alchemy 2.0.0-beta.76 → 2.0.0-beta.78

package/src/Cloudflare/Logs.ts

@@ -6,6 +6,7 @@ import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import * as Socket from "effect/unstable/socket/Socket";
 import type { LogLine, LogsInput } from "../Provider.ts";
+import { profileCommandHint } from "../Util/interactive.ts";
 
 const DEFAULT_LOOKBACK_MS = 1 * 60 * 60 * 1000;
 
@@ -80,7 +81,7 @@ export const CloudflareLogs = Effect.gen(function* () {
 
   /**
    * The telemetry query needs the `workers_observability:read` OAuth scope.
-   * A token minted by an older `alchemy login` (before the scope joined the
+   * A token minted by an older login (before the scope joined the
    * defaults) keeps its original grants forever, so the query fails with a
    * bare `Unauthorized`/`Forbidden` even though a fresh login would work —
    * explain the fix instead of surfacing the raw tag.
@@ -90,15 +91,20 @@ export const CloudflareLogs = Effect.gen(function* () {
   ): Effect.Effect<A, workers.QueryObservabilityTelemetryError, R> =>
     effect.pipe(
       Effect.catchTag("Unauthorized", () =>
-        Effect.die(
-          new Error(
-            "Cloudflare rejected the observability telemetry query (Unauthorized). " +
-              'Your stored credentials are likely missing the "workers_observability:read" scope — ' +
-              "OAuth tokens keep the scopes they were minted with, so tokens from an older " +
-              "`alchemy login` won't have it. Run `alchemy login` again to mint a token with " +
-              "the current default scopes, or use an API token that grants Workers Observability read access.",
-          ),
-        ),
+        Effect.gen(function* () {
+          const command = yield* profileCommandHint(
+            "alchemy profile edit --reconfigure Cloudflare",
+          );
+          return yield* Effect.die(
+            new Error(
+              "Cloudflare rejected the observability telemetry query (Unauthorized). " +
+                'Your stored credentials are likely missing the "workers_observability:read" scope — ' +
+                "OAuth tokens keep the scopes they were minted with, so tokens minted by " +
+                `an older login won't have it. Run \`${command}\` to mint a token with ` +
+                "the current default scopes, or use an API token that grants Workers Observability read access.",
+            ),
+          );
+        }),
       ),
     );
 
@@ -164,58 +170,66 @@ export const CloudflareLogs = Effect.gen(function* () {
 
       const queue = yield* Queue.make<LogLine, Cause.Done>();
 
-      yield* socket
-        .runRaw((raw) => {
-          const text =
-            typeof raw === "string" ? raw : new TextDecoder().decode(raw);
-          const data: TailEventMessage = JSON.parse(text);
-          const eventTs = new Date(data.eventTimestamp ?? Date.now());
+      const decoder = new TextDecoder();
+      const offerTailMessage = (raw: Uint8Array) => {
+        const data: TailEventMessage = JSON.parse(decoder.decode(raw));
+        const eventTs = new Date(data.eventTimestamp ?? Date.now());
 
-          if (data.event && "request" in data.event) {
-            const reqEvent = data.event;
-            const pathname = (() => {
-              try {
-                return new URL(reqEvent.request.url).pathname;
-              } catch {
-                return reqEvent.request.url;
-              }
-            })();
-            const status = reqEvent.response?.status ?? 500;
-            Queue.offerUnsafe(queue, {
-              timestamp: eventTs,
-              message: `${reqEvent.request.method} ${pathname} > ${status} (cpu: ${Math.round(data.cpuTime)}ms, wall: ${Math.round(data.wallTime)}ms)`,
-            });
-          }
+        if (data.event && "request" in data.event) {
+          const reqEvent = data.event;
+          const pathname = (() => {
+            try {
+              return new URL(reqEvent.request.url).pathname;
+            } catch {
+              return reqEvent.request.url;
+            }
+          })();
+          const status = reqEvent.response?.status ?? 500;
+          Queue.offerUnsafe(queue, {
+            timestamp: eventTs,
+            message: `${reqEvent.request.method} ${pathname} > ${status} (cpu: ${Math.round(data.cpuTime)}ms, wall: ${Math.round(data.wallTime)}ms)`,
+          });
+        }
 
-          for (const log of data.logs) {
-            const msg = log.message.join(" ");
-            Queue.offerUnsafe(queue, {
-              timestamp: new Date(log.timestamp),
-              message: log.level === "log" ? msg : `${log.level}: ${msg}`,
-            });
-          }
+        for (const log of data.logs) {
+          const msg = log.message.join(" ");
+          Queue.offerUnsafe(queue, {
+            timestamp: new Date(log.timestamp),
+            message: log.level === "log" ? msg : `${log.level}: ${msg}`,
+          });
+        }
 
-          for (const exception of data.exceptions) {
-            Queue.offerUnsafe(queue, {
-              timestamp: new Date(exception.timestamp),
-              message: `${exception.name} ${exception.message}\n${exception.stack}`,
-            });
-          }
-        })
-        .pipe(
-          Effect.ensuring(
-            Effect.all([
-              deleteScriptTail({
-                scriptName: opts.scriptName,
-                id: tailId,
-                accountId: opts.accountId,
-              }).pipe(Effect.ignore),
-              Queue.end(queue),
-            ]),
-          ),
-          Effect.ignore,
-          Effect.forkChild(),
-        );
+        for (const exception of data.exceptions) {
+          Queue.offerUnsafe(queue, {
+            timestamp: new Date(exception.timestamp),
+            message: `${exception.name} ${exception.message}\n${exception.stack}`,
+          });
+        }
+      };
+
+      yield* Socket.toStream(socket).pipe(
+        Stream.runForEach((raw) => Effect.sync(() => offerTailMessage(raw))),
+        Effect.catchIf(
+          (error) =>
+            Socket.isSocketError(error) &&
+            error.reason._tag === "SocketCloseError" &&
+            (error.reason.code === 1000 || error.reason.code === 1006),
+          () => Effect.void,
+        ),
+        Effect.ensuring(
+          Effect.all([
+            deleteScriptTail({
+              scriptName: opts.scriptName,
+              id: tailId,
+              accountId: opts.accountId,
+            }).pipe(Effect.ignore),
+            Queue.end(queue),
+          ]),
+        ),
+        Effect.scoped,
+        Effect.ignore,
+        Effect.forkChild(),
+      );
 
       return Stream.fromQueue(queue);
     });

package/src/Cloudflare/MagicTransit/IpsecTunnel.ts

@@ -137,7 +137,7 @@ export type IpsecTunnel = Resource<
  *   cloudflareEndpoint: "203.0.113.1",
  *   customerEndpoint: "198.51.100.1",
  *   interfaceAddress: "10.213.0.10/31",
- *   psk: yield* Config.redacted("IPSEC_PSK"),
+ *   psk: yield* Config.Redacted("IPSEC_PSK"),
  * });
  * ```
  *

package/src/Cloudflare/MtlsCertificate/MtlsCertificate.ts

@@ -132,7 +132,7 @@ export type MtlsCertificate = Resource<
  * const cert = yield* Cloudflare.MtlsCertificate.MtlsCertificate("origin-client-cert", {
  *   ca: false,
  *   certificates: leafPem,
- *   privateKey: yield* Config.redacted("ORIGIN_CLIENT_KEY"),
+ *   privateKey: yield* Config.Redacted("ORIGIN_CLIENT_KEY"),
  * });
  * ```
  *

package/src/Cloudflare/Organization/Organization.ts

@@ -378,7 +378,7 @@ const toAttributes = (
   name: org.name,
   createTime: org.createTime,
   managedBy: org.meta.managedBy ?? undefined,
-  flags: org.meta.flags ?? undefined,
+  flags: org.meta.tenantFlags ?? undefined,
   parent: org.parent ?? undefined,
   profile: org.profile ?? undefined,
 });

package/src/Cloudflare/OriginTlsClientAuth/Certificate.ts

@@ -95,7 +95,7 @@ export type Certificate = Resource<
  * const cert = yield* Cloudflare.OriginTlsClientAuth.Certificate("AopCert", {
  *   zoneId: zone.zoneId,
  *   certificate: clientCertPem,
- *   privateKey: yield* Config.redacted("AOP_CLIENT_KEY"),
+ *   privateKey: yield* Config.Redacted("AOP_CLIENT_KEY"),
  * });
  * ```
  *
@@ -105,7 +105,7 @@ export type Certificate = Resource<
  * const cert = yield* Cloudflare.OriginTlsClientAuth.Certificate("AopCert", {
  *   zoneId: zone.zoneId,
  *   certificate: clientCertPem,
- *   privateKey: yield* Config.redacted("AOP_CLIENT_KEY"),
+ *   privateKey: yield* Config.Redacted("AOP_CLIENT_KEY"),
  * });
  *
  * yield* Cloudflare.OriginTlsClientAuth.Setting("Aop", {

package/src/Cloudflare/OriginTlsClientAuth/HostnameAssociation.ts

@@ -96,7 +96,7 @@ export type HostnameAssociation = Resource<
  * const cert = yield* Cloudflare.OriginTlsClientAuth.HostnameCertificate("AopHostCert", {
  *   zoneId: zone.zoneId,
  *   certificate: clientCertPem,
- *   privateKey: yield* Config.redacted("AOP_CLIENT_KEY"),
+ *   privateKey: yield* Config.Redacted("AOP_CLIENT_KEY"),
  * });
  *
  * yield* Cloudflare.OriginTlsClientAuth.HostnameAssociation("AopHost", {

package/src/Cloudflare/OriginTlsClientAuth/HostnameCertificate.ts

@@ -97,7 +97,7 @@ export type HostnameCertificate = Resource<
  * const cert = yield* Cloudflare.OriginTlsClientAuth.HostnameCertificate("AopHostCert", {
  *   zoneId: zone.zoneId,
  *   certificate: clientCertPem,
- *   privateKey: yield* Config.redacted("AOP_CLIENT_KEY"),
+ *   privateKey: yield* Config.Redacted("AOP_CLIENT_KEY"),
  * });
  * ```
  *
@@ -107,7 +107,7 @@ export type HostnameCertificate = Resource<
  * const cert = yield* Cloudflare.OriginTlsClientAuth.HostnameCertificate("AopHostCert", {
  *   zoneId: zone.zoneId,
  *   certificate: clientCertPem,
- *   privateKey: yield* Config.redacted("AOP_CLIENT_KEY"),
+ *   privateKey: yield* Config.Redacted("AOP_CLIENT_KEY"),
  * });
  *
  * yield* Cloudflare.OriginTlsClientAuth.HostnameAssociation("AopHost", {

package/src/Cloudflare/OriginTlsClientAuth/Setting.ts

@@ -70,7 +70,7 @@ export type Setting = Resource<
  * const cert = yield* Cloudflare.OriginTlsClientAuth.Certificate("AopCert", {
  *   zoneId: zone.zoneId,
  *   certificate: clientCertPem,
- *   privateKey: yield* Config.redacted("AOP_CLIENT_KEY"),
+ *   privateKey: yield* Config.Redacted("AOP_CLIENT_KEY"),
  * });
  *
  * yield* Cloudflare.OriginTlsClientAuth.Setting("Aop", {

package/src/Cloudflare/Pages/Project.ts

@@ -218,7 +218,7 @@ export type Project = Resource<
  * const project = yield* Cloudflare.Pages.Project("site", {
  *   deploymentConfigs: {
  *     production: {
- *       compatibilityDate: "2025-01-01",
+ *       compatibilityDate: "2026-08-31",
  *       envVars: {
  *         API_URL: { value: "https://api.example.com" },
  *         API_KEY: { type: "secret_text", value: apiKey },

package/src/Cloudflare/Pipelines/LegacyPipeline.ts

@@ -178,8 +178,8 @@ export type LegacyPipeline = Resource<
  *   destination: {
  *     bucket: bucket.bucketName,
  *     credentials: {
- *       accessKeyId: yield* Config.redacted("R2_ACCESS_KEY_ID"),
- *       secretAccessKey: yield* Config.redacted("R2_SECRET_ACCESS_KEY"),
+ *       accessKeyId: yield* Config.Redacted("R2_ACCESS_KEY_ID"),
+ *       secretAccessKey: yield* Config.Redacted("R2_SECRET_ACCESS_KEY"),
  *     },
  *   },
  * });

package/src/Cloudflare/Pipelines/Sink.ts

@@ -235,8 +235,8 @@ export type Sink = Resource<
  *   config: {
  *     bucket: bucket.bucketName,
  *     credentials: {
- *       accessKeyId: yield* Config.redacted("R2_ACCESS_KEY_ID"),
- *       secretAccessKey: yield* Config.redacted("R2_SECRET_ACCESS_KEY"),
+ *       accessKeyId: yield* Config.Redacted("R2_ACCESS_KEY_ID"),
+ *       secretAccessKey: yield* Config.Redacted("R2_SECRET_ACCESS_KEY"),
  *     },
  *     path: "ingest",
  *     rollingPolicy: { intervalSeconds: 30 },
@@ -262,7 +262,7 @@ export type Sink = Resource<
  *     bucket: bucket.bucketName,
  *     tableName: "events",
  *     namespace: "default",
- *     token: yield* Config.redacted("CATALOG_TOKEN"),
+ *     token: yield* Config.Redacted("CATALOG_TOKEN"),
  *   },
  * });
  * ```

package/src/Cloudflare/Providers.ts

@@ -1,7 +1,6 @@
-import { Retry } from "@distilled.cloud/cloudflare";
 import * as Layer from "effect/Layer";
 import { CredentialsStoreLive } from "../Auth/Credentials.ts";
-import { ProfileLive } from "../Auth/Profile.ts";
+import { ProfileStoreLive } from "../Auth/Profile.ts";
 import * as Command from "../Command/index.ts";
 import { DockerLive } from "../Docker/Docker.ts";
 import { KeyPair, KeyPairProvider } from "../KeyPair.ts";
@@ -12,8 +11,8 @@ import * as AccessApp from "./Access/Application.ts";
 import * as Bookmark from "./Access/Bookmark.ts";
 import * as AccessCert from "./Access/Certificate.ts";
 import * as CustomPage from "./Access/CustomPage.ts";
-import * as Group from "./Access/Group.ts";
 import { GetIdentityProviderHttp } from "./Access/GetIdentityProviderHttp.ts";
+import * as Group from "./Access/Group.ts";
 import * as AccessIdp from "./Access/IdentityProvider.ts";
 import * as AccessInfraTarget from "./Access/InfrastructureTarget.ts";
 import * as AccessKeyConfig from "./Access/KeyConfiguration.ts";
@@ -386,15 +385,12 @@ export const providers = () =>
   ).pipe(
     Layer.provide(
       Layer.mergeAll(
-        AccessApp.ApplicationProvider(),
         AccessApp.ApplicationProvider(),
         AccessCert.CertificateProvider(),
         AccessIdp.IdentityProviderProvider(),
         AccessInfraTarget.InfrastructureTargetProvider(),
         AccessKeyConfig.KeyConfigurationProvider(),
         AccessOrg.OrganizationProvider(),
-        AccessOrg.OrganizationProvider(),
-        AccessPol.PolicyProvider(),
         AccessPol.PolicyProvider(),
         AccessSvcToken.ServiceTokenProvider(),
         Account.AccountProvider(),
@@ -424,8 +420,6 @@ export const providers = () =>
         ApiShield.OperationProvider(),
         ApiShield.UserSchemaProvider(),
         ApiToken.AccountApiTokenProvider(),
-        ApiToken.AccountApiTokenProvider(),
-        ApiToken.UserApiTokenProvider(),
         ApiToken.UserApiTokenProvider(),
         Argo.SmartRoutingProvider(),
         Argo.TieredCachingProvider(),
@@ -446,7 +440,6 @@ export const providers = () =>
         Configuration.ConfigurationProvider(),
         Connectivity.DirectoryServiceProvider(),
         Containers.ContainerProvider(),
-        Containers.ContainerProvider(),
         ContentScanning.ContentScanningProvider(),
         ContentScanning.ExpressionProvider(),
         CustomCertificates.CustomCertificateProvider(),
@@ -455,7 +448,6 @@ export const providers = () =>
         CustomNameservers.CustomNameserverProvider(),
         CustomPage.CustomPageProvider(),
         D1.DatabaseProvider(),
-        D1.DatabaseProvider(),
         DdosProtection.DdosAllowlistEntryProvider(),
         DdosProtection.SynProtectionFilterProvider(),
         DdosProtection.SynProtectionRuleProvider(),
@@ -463,7 +455,6 @@ export const providers = () =>
         DdosProtection.TcpFlowProtectionRuleProvider(),
         Devices.DeviceCustomProfileProvider(),
         Devices.DeviceDefaultProfileProvider(),
-        Devices.DeviceDefaultProfileProvider(),
         Devices.DeviceDexTestProvider(),
         Devices.DeviceManagedNetworkProvider(),
         Devices.DevicePostureIntegrationProvider(),
@@ -481,7 +472,6 @@ export const providers = () =>
           Dns.DnssecProvider(),
           Dns.FirewallProvider(),
           Dns.RecordProvider(),
-          Dns.RecordProvider(),
           Dns.ViewProvider(),
           Dns.ZoneDnsSettingsProvider(),
           Dns.ZoneTransferAclProvider(),
@@ -490,15 +480,12 @@ export const providers = () =>
           Dns.ZoneTransferPeerProvider(),
           Dns.ZoneTransferTsigProvider(),
           Email.AddressProvider(),
-          Email.AddressProvider(),
           Email.AllowPolicyProvider(),
           Email.BlockSenderProvider(),
           Email.CatchAllProvider(),
           Email.DomainProvider(),
           Email.ImpersonationRegistryEntryProvider(),
           Email.RoutingProvider(),
-          Email.RoutingProvider(),
-          Email.RuleProvider(),
           Email.RuleProvider(),
           Email.SendingSubdomainProvider(),
           Email.TrustedDomainProvider(),
@@ -513,7 +500,6 @@ export const providers = () =>
           Healthcheck.HealthcheckProvider(),
           HostnameTlsSetting.HostnameTlsSettingProvider(),
           Hyperdrive.ConnectionProvider(),
-          Hyperdrive.ConnectionProvider(),
           Iam.ResourceGroupProvider(),
           Iam.UserGroupMembershipProvider(),
           Iam.UserGroupProvider(),
@@ -523,7 +509,6 @@ export const providers = () =>
           Intel.IndicatorFeedProvider(),
           KeylessCertificate.KeylessCertificateProvider(),
           KV.NamespaceProvider(),
-          KV.NamespaceProvider(),
           LeakedCredentialCheck.LeakedCredentialCheckProvider(),
           LeakedCredentialCheck.LeakedCredentialDetectionProvider(),
           List.ListProvider(),
@@ -570,13 +555,10 @@ export const providers = () =>
           Pipelines.StreamProvider(),
           ProxyEndpoint.ProxyEndpointProvider(),
           Queue.ConsumerProvider(),
-          Queue.ConsumerProvider(),
-          Queue.QueueProvider(),
           Queue.QueueProvider(),
           Queue.SubscriptionProvider(),
           R2.BucketEventNotificationProvider(),
           R2.BucketProvider(),
-          R2.BucketProvider(),
           R2.BucketSippyProvider(),
           R2.DataCatalogProvider(),
           RealtimeKit.AppProvider(),
@@ -589,20 +571,16 @@ export const providers = () =>
           ResourceSharing.ShareResourceProvider(),
           RiskScoring.IntegrationProvider(),
           Rule.RuleProvider(),
-          Rule.RuleProvider(),
           Rules.ListProvider(),
           Ruleset.AccountEntrypointProvider(),
           Ruleset.CustomRulesetProvider(),
           Ruleset.RulesetProvider(),
-          Ruleset.RulesetProvider(),
           Rum.RuleProvider(),
           Rum.SiteProvider(),
           SchemaValidation.OperationSettingProvider(),
           SchemaValidation.SchemaProvider(),
           SchemaValidation.SettingsProvider(),
           SecretsStore.SecretsStoreProvider(),
-          SecretsStore.SecretsStoreProvider(),
-          SecretsStore.StoreSecretProvider(),
           SecretsStore.StoreSecretProvider(),
           SecurityTxt.SecurityTxtProvider(),
           Snippets.SnippetProvider(),
@@ -622,11 +600,8 @@ export const providers = () =>
           TokenValidation.RuleProvider(),
           TokenValidation.TokenConfigurationProvider(),
           Tunnel.ConfigurationProvider(),
-          Tunnel.ConfigurationProvider(),
           Tunnel.HostnameRouteProvider(),
           Tunnel.RouteProvider(),
-          Tunnel.RouteProvider(),
-          Tunnel.TunnelProvider(),
           Tunnel.TunnelProvider(),
           Tunnel.VirtualNetworkProvider(),
           Tunnel.WarpConnectorProvider(),
@@ -635,10 +610,7 @@ export const providers = () =>
           Turnstile.WidgetProvider(),
           UrlNorm.UrlNormalizationProvider(),
           Vectorize.IndexProvider(),
-          Vectorize.IndexProvider(),
           Vectorize.MetadataIndexProvider(),
-          Vectorize.MetadataIndexProvider(),
-          VpcService.VpcServiceProvider(),
           VpcService.VpcServiceProvider(),
           VulnScanner.VulnScannerCredentialProvider(),
           VulnScanner.VulnScannerCredentialSetProvider(),
@@ -651,18 +623,14 @@ export const providers = () =>
           Workers.ObservabilityDestinationProvider(),
           Workers.SubdomainProvider(),
           Workers.WorkerProvider(),
-          Workers.WorkerProvider(),
           Workers.WorkerRouteProvider(),
           WorkersForPlatforms.DispatchNamespaceProvider(),
           Workflows.WorkflowProvider(),
-          Workflows.WorkflowProvider(),
-          Zaraz.ConfigProvider(),
           Zaraz.ConfigProvider(),
           Zone.CustomNameserversProvider(),
           Zone.HoldProvider(),
           Zone.SettingProvider(),
           Zone.ZoneProvider(),
-          Zone.ZoneProvider(),
         ),
       ),
     ),
@@ -691,32 +659,26 @@ export const providers = () =>
 /**
  * The foundation every effect tree that talks to the Cloudflare API
  * shares — credentials resolved through the Alchemy auth provider,
- * account environment, Access, profile + credential store — plus a
- * blanket retry policy applied to every Cloudflare API call.
+ * account environment, Access, profile + credential store.
  *
  * Used by {@link providers} and the Cloudflare state store
  * ({@link ../Cloudflare/StateStore/State.ts state}) so that provider
- * lifecycle operations and state-store init/bootstrap probes retry
- * transient failures the same way; without it the state-store
- * subdomain/script/secrets probes run on the SDK's shorter default
- * policy and surface throttling ("Please wait and consider throttling
- * your request speed") to users.
+ * lifecycle operations and state-store init/bootstrap probes run under
+ * the same services.
  *
- * The policy is the SDK's `Retry.makeDefault` (throttling / 5xx /
- * network, server retry-after hints, bounded backoff). The
- * Cloudflare-specific misleadingly-tagged transient cases that used
- * to live here as a custom factory (10001 "internal error", 10001
- * "Unable to authenticate request", 10000 "Authentication error"
- * under load) are now tagged retryable at the source in the SDK's
- * global error map, so `makeDefault`'s transient detection covers
- * them.
+ * No retry policy is installed here: every Cloudflare API call already
+ * runs under the SDK's `makeDefault` (throttling / 5xx / network, server
+ * retry-after hints, bounded backoff) when no policy is in context, and
+ * the Cloudflare-specific misleadingly-tagged transient cases (10001
+ * "internal error", 10001 "Unable to authenticate request", 10000
+ * "Authentication error" under load) are tagged retryable at the source
+ * in the SDK's global error map, so that default covers them.
  */
 export const CloudflareApiLive = () =>
   Credentials.fromAuthProvider().pipe(
     Layer.provideMerge(CloudflareEnvironment.fromProfile()),
     Layer.provideMerge(CloudflareAuth),
     Layer.provideMerge(Access.AccessLive),
-    Layer.provideMerge(ProfileLive),
+    Layer.provideMerge(ProfileStoreLive),
     Layer.provideMerge(CredentialsStoreLive),
-    Layer.provideMerge(Layer.succeed(Retry.Retry, Retry.makeDefault)),
   );

package/src/Cloudflare/Queues/Consumer.ts

@@ -15,7 +15,7 @@ import { Stack } from "../../Stack.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import {
   isLiveId,
-  LOCAL_ENTRY_URL,
+  LOCAL_PROVIDERS_URL,
   LocalRuntimeState,
   localRuntimeServices,
 } from "../LocalRuntime.ts";
@@ -689,7 +689,7 @@ const queueHandlerReadinessSchedule = Schedule.max([
 export const ConsumerProviderLocal = () =>
   RpcProvider.effect(
     Consumer,
-    LOCAL_ENTRY_URL,
+    LOCAL_PROVIDERS_URL,
     Effect.gen(function* () {
       const localRuntimeState = yield* LocalRuntimeState;
 

package/src/Cloudflare/Queues/Queue.ts

@@ -18,7 +18,7 @@ import { detachQueueConsumersOfScript } from "./Consumer.ts";
 import {
   generateLocalId,
   isLiveId,
-  LOCAL_ENTRY_URL,
+  LOCAL_PROVIDERS_URL,
   LocalRuntimeState,
   localRuntimeServices,
 } from "../LocalRuntime.ts";
@@ -400,7 +400,7 @@ const findQueueByName = Effect.fn(function* (queueName: string) {
 export const ProviderLocal = () =>
   RpcProvider.effect(
     Queue,
-    LOCAL_ENTRY_URL,
+    LOCAL_PROVIDERS_URL,
     Effect.gen(function* () {
       const localRuntimeState = yield* LocalRuntimeState;
       return {

package/src/Cloudflare/R2/Bucket.ts

@@ -1305,16 +1305,39 @@ export const ProviderLive = () =>
           // refusal is the data protection users rely on, and emptying the
           // bucket to get past it is how a stack teardown turns into
           // irreversible data loss (#1248).
-          if (olds.forceDestroy === true || force === true) {
+          const destroyContents = olds.forceDestroy === true || force === true;
+          if (destroyContents) {
             yield* emptyBucket(output.bucketName, output.jurisdiction);
           }
-          yield* r2
+          const deleteBucket = r2
             .deleteBucket({
               accountId: output.accountId,
               bucketName: output.bucketName,
               jurisdiction: output.jurisdiction,
             })
             .pipe(Effect.catchTag("NoSuchBucket", () => Effect.void));
+          if (!destroyContents) {
+            return yield* deleteBucket;
+          }
+          // A writer that outlives the emptying pass (a Durable Object's
+          // alarm finishing a job while the stack tears down) can land an
+          // object between the sweep and the delete: re-empty and retry,
+          // bounded. Incomplete multipart uploads also hold a bucket; those
+          // only a lifecycle rule clears, and the refusal then stands.
+          yield* deleteBucket.pipe(
+            Effect.catchTag("BucketNotEmpty", (error) =>
+              Effect.sleep("2 seconds").pipe(
+                Effect.andThen(
+                  emptyBucket(output.bucketName, output.jurisdiction),
+                ),
+                Effect.andThen(Effect.fail(error)),
+              ),
+            ),
+            Effect.retry({
+              while: (error) => error._tag === "BucketNotEmpty",
+              times: 5,
+            }),
+          );
         }),
         read: Effect.fn(function* ({ id, output, olds }) {
           const { accountId } = yield* yield* CloudflareEnvironment;

package/src/Cloudflare/R2/BucketBinding.ts

@@ -102,6 +102,7 @@ export const makeR2ObjectWrappers = (
           cause: error,
         }),
     }),
+    readable: object.body as any as ReadableStream<Uint8Array>,
     bodyUsed: object.bodyUsed,
     arrayBuffer: () => tryPromise(() => object.arrayBuffer()),
     bytes: () => tryPromise(() => object.bytes()),

package/src/Cloudflare/R2/BucketSippy.ts

@@ -158,12 +158,12 @@ export type BucketSippy = Resource<
  *     provider: "aws",
  *     bucket: "legacy-media",
  *     region: "us-east-1",
- *     accessKeyId: yield* Config.redacted("AWS_ACCESS_KEY_ID"),
- *     secretAccessKey: yield* Config.redacted("AWS_SECRET_ACCESS_KEY"),
+ *     accessKeyId: yield* Config.Redacted("AWS_ACCESS_KEY_ID"),
+ *     secretAccessKey: yield* Config.Redacted("AWS_SECRET_ACCESS_KEY"),
  *   },
  *   destination: {
- *     accessKeyId: yield* Config.redacted("R2_ACCESS_KEY_ID"),
- *     secretAccessKey: yield* Config.redacted("R2_SECRET_ACCESS_KEY"),
+ *     accessKeyId: yield* Config.Redacted("R2_ACCESS_KEY_ID"),
+ *     secretAccessKey: yield* Config.Redacted("R2_SECRET_ACCESS_KEY"),
  *   },
  * });
  * ```
@@ -177,11 +177,11 @@ export type BucketSippy = Resource<
  *     provider: "gcs",
  *     bucket: "legacy-media",
  *     clientEmail: "sippy@my-project.iam.gserviceaccount.com",
- *     privateKey: yield* Config.redacted("GCS_PRIVATE_KEY"),
+ *     privateKey: yield* Config.Redacted("GCS_PRIVATE_KEY"),
  *   },
  *   destination: {
- *     accessKeyId: yield* Config.redacted("R2_ACCESS_KEY_ID"),
- *     secretAccessKey: yield* Config.redacted("R2_SECRET_ACCESS_KEY"),
+ *     accessKeyId: yield* Config.Redacted("R2_ACCESS_KEY_ID"),
+ *     secretAccessKey: yield* Config.Redacted("R2_SECRET_ACCESS_KEY"),
  *   },
  * });
  * ```

package/src/Cloudflare/R2/BucketTypes.ts

@@ -9,6 +9,14 @@ export interface R2Object extends Omit<runtime.R2Object, "writeHttpMetadata"> {
 
 export interface ObjectBody extends R2Object {
   get body(): Stream.Stream<Uint8Array, R2Error>;
+  /**
+   * The platform's own body stream, untouched — for hot paths that hand
+   * bytes straight to a `Response` without an Effect stream in between
+   * (a `pipeTo` between native streams is zero JS per chunk). Consume
+   * EITHER this or `body`, never both. Absent on implementations that
+   * have no native stream to offer.
+   */
+  readonly readable?: ReadableStream<Uint8Array> | undefined;
   get bodyUsed(): boolean;
   arrayBuffer(): Effect.Effect<ArrayBuffer, R2Error>;
   bytes(): Effect.Effect<Uint8Array, R2Error>;