alchemy 2.0.0-beta.47 → 2.0.0-beta.49

package/src/Cloudflare/Providers.ts

@@ -18,17 +18,19 @@ import * as AnalyticsEngine from "./AnalyticsEngine/index.ts";
 import * as ApiToken from "./ApiToken/index.ts";
 import * as Artifacts from "./Artifacts/index.ts";
 import { CloudflareAuth } from "./Auth/AuthProvider.ts";
-import * as BrowserRendering from "./BrowserRendering/index.ts";
+import * as Browser from "./Browser/index.ts";
 import * as CloudflareEnvironment from "./CloudflareEnvironment.ts";
 import * as Containers from "./Container/index.ts";
 import * as Credentials from "./Credentials.ts";
 import * as D1 from "./D1/index.ts";
+import * as Dns from "./Dns/index.ts";
 import * as Email from "./Email/index.ts";
 import * as Hyperdrive from "./Hyperdrive/index.ts";
 import * as Images from "./Images/index.ts";
 import * as KV from "./KV/index.ts";
 import * as Queue from "./Queue/index.ts";
 import * as R2 from "./R2/index.ts";
+import * as RateLimit from "./RateLimit/index.ts";
 import * as SecretsStore from "./SecretsStore/index.ts";
 import * as Tunnel from "./Tunnel/index.ts";
 import * as Vectorize from "./Vectorize/index.ts";
@@ -36,6 +38,7 @@ import * as VpcService from "./VpcService/index.ts";
 import * as Workers from "./Workers/index.ts";
 import * as Workflows from "./Workers/Workflow.ts";
 import * as Zaraz from "./Zaraz/index.ts";
+import * as Zone from "./Zone/index.ts";
 
 export { Credentials } from "@distilled.cloud/cloudflare/Credentials";
 
@@ -58,11 +61,14 @@ export const providers = () =>
       AiGateway.AiGatewayBindingPolicy,
       AnalyticsEngine.AnalyticsEngineDatasetBindingPolicy,
       Artifacts.ArtifactsBindingPolicy,
-      BrowserRendering.BrowserRenderingBindingPolicy,
+      Browser.BrowserBindingPolicy,
       Command,
       Containers.Container,
       D1.D1ConnectionPolicy,
       D1.D1Database,
+      Dns.DnsReadPolicy,
+      Dns.DnsReadWritePolicy,
+      Dns.DnsWritePolicy,
       Email.EmailAddress,
       Email.EmailRouting,
       Email.EmailRule,
@@ -78,10 +84,14 @@ export const providers = () =>
       Queue.QueueEventSourcePolicy,
       R2.R2Bucket,
       R2.R2BucketBindingPolicy,
+      RateLimit.RateLimitBindingPolicy,
       SecretsStore.SecretBindingPolicy,
       SecretsStore.SecretsStore,
       SecretsStore.Secret,
       Tunnel.Tunnel,
+      Tunnel.TunnelReadPolicy,
+      Tunnel.TunnelReadWritePolicy,
+      Tunnel.TunnelWritePolicy,
       Vectorize.VectorizeIndexBindingPolicy,
       Vectorize.VectorizeIndex,
       Vectorize.VectorizeMetadataIndex,
@@ -94,6 +104,7 @@ export const providers = () =>
       Workers.Worker,
       Workflows.WorkflowResource,
       Zaraz.ZarazConfig,
+      Zone.Zone,
     ]),
   ).pipe(
     Layer.provide(
@@ -104,10 +115,13 @@ export const providers = () =>
         AiGateway.AiGatewayBindingPolicyLive,
         AnalyticsEngine.AnalyticsEngineDatasetBindingPolicyLive,
         Artifacts.ArtifactsBindingPolicyLive,
-        BrowserRendering.BrowserRenderingBindingPolicyLive,
+        Browser.BrowserBindingPolicyLive,
         Containers.ContainerProvider(),
         D1.D1ConnectionPolicyLive,
         D1.DatabaseProvider(),
+        Dns.DnsReadPolicyLive,
+        Dns.DnsReadWritePolicyLive,
+        Dns.DnsWritePolicyLive,
         Email.EmailAddressProvider(),
         Email.EmailRoutingProvider(),
         Email.EmailRuleProvider(),
@@ -123,10 +137,14 @@ export const providers = () =>
         Queue.QueueConsumerProvider(),
         R2.R2BucketBindingPolicyLive,
         R2.R2BucketProvider(),
+        RateLimit.RateLimitBindingPolicyLive,
         SecretsStore.SecretBindingPolicyLive,
         SecretsStore.SecretsStoreProvider(),
         SecretsStore.StoreSecretProvider(),
         Tunnel.TunnelProvider(),
+        Tunnel.TunnelReadPolicyLive,
+        Tunnel.TunnelReadWritePolicyLive,
+        Tunnel.TunnelWritePolicyLive,
         Vectorize.VectorizeIndexBindingPolicyLive,
         Vectorize.VectorizeIndexProvider(),
         Vectorize.VectorizeMetadataIndexProvider(),
@@ -137,6 +155,7 @@ export const providers = () =>
         Workers.WorkerProvider(),
         Workflows.WorkflowProvider(),
         Zaraz.ZarazConfigProvider(),
+        Zone.ZoneProvider(),
       ),
     ),
     Layer.provideMerge(

package/src/Cloudflare/R2/R2Bucket.ts

@@ -9,7 +9,7 @@ import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type * as Cloudflare from "../Providers.ts";
-import * as Zone from "../Zone.ts";
+import * as Zone from "../Zone/index.ts";
 import { R2BucketBinding } from "./R2BucketBinding.ts";
 
 export const isR2Bucket = (value: unknown): value is R2Bucket =>
@@ -684,8 +684,11 @@ export const R2BucketProvider = () =>
 
           const attrs = {
             bucketName: observed.name!,
-            storageClass: observed.storageClass ?? "Standard",
-            jurisdiction: observed.jurisdiction ?? "default",
+            // Distilled widened generated string enums to open unions.
+            storageClass: (observed.storageClass ??
+              "Standard") as R2Bucket.StorageClass,
+            jurisdiction: (observed.jurisdiction ??
+              "default") as R2Bucket.Jurisdiction,
             location: normalizeLocation(observed.location),
             accountId: acct,
           };
@@ -738,8 +741,11 @@ export const R2BucketProvider = () =>
           }).pipe(
             Effect.map((bucket) => ({
               bucketName: bucket.name!,
-              storageClass: bucket.storageClass ?? "Standard",
-              jurisdiction: bucket.jurisdiction ?? "default",
+              // Distilled widened generated string enums to open unions.
+              storageClass: (bucket.storageClass ??
+                "Standard") as R2Bucket.StorageClass,
+              jurisdiction: (bucket.jurisdiction ??
+                "default") as R2Bucket.Jurisdiction,
               location: normalizeLocation(bucket.location),
               accountId: acct,
               domains: output?.domains ?? [],
@@ -760,13 +766,15 @@ const r2BucketEndpointConsistencySchedule = Schedule.exponential(100).pipe(
   Schedule.both(Schedule.recurs(5)),
 );
 
+// Distilled widened generated string enums to open unions (`string & {}`); the
+// API only ever returns the known variants, narrowed in `toCustomDomainAttributes`.
 type CustomDomainResponse = {
   domain: string;
   zoneId?: string | null;
   enabled?: boolean | null;
   ciphers?: string[] | null;
-  minTLS?: "1.0" | "1.1" | "1.2" | "1.3" | null;
-  status?: R2Bucket.CustomDomain["status"];
+  minTLS?: string | null;
+  status?: { ownership: string; ssl: string } | null;
 };
 
 const toCustomDomainAttributes = (
@@ -776,8 +784,8 @@ const toCustomDomainAttributes = (
   zoneId: domain.zoneId ?? undefined,
   enabled: domain.enabled ?? true,
   ciphers: domain.ciphers ?? undefined,
-  minTLS: domain.minTLS ?? undefined,
-  status: domain.status,
+  minTLS: (domain.minTLS ?? undefined) as R2Bucket.CustomDomain["minTLS"],
+  status: (domain.status ?? undefined) as R2Bucket.CustomDomain["status"],
 });
 
 const sameCustomDomainConfig = (

package/src/Cloudflare/RateLimit/RateLimit.ts

@@ -0,0 +1,160 @@
+import type * as Effect from "effect/Effect";
+import { SingleShotGen } from "effect/Utils";
+import { RateLimitBinding, type RateLimitClient } from "./RateLimitBinding.ts";
+
+type RateLimitTypeId = typeof RateLimitTypeId;
+const RateLimitTypeId = "Cloudflare.RateLimit" as const;
+
+export type RateLimitPeriod = 10 | 60;
+
+export type RateLimitProps = {
+  /**
+   * Binding name used when `RateLimit` is bound from inside a Worker init
+   * phase (`yield* Cloudflare.RateLimit(...)`). When passed through
+   * `Worker({ env: { ... } })`, the object key remains the binding name.
+   *
+   * @default "RATE_LIMIT"
+   */
+  name?: string;
+  /**
+   * Positive integer or string that uniquely identifies this rate limit
+   * configuration.
+   */
+  namespaceId: number | string;
+  /**
+   * Simple rate limiting configuration.
+   */
+  simple: {
+    /**
+     * The number of requests allowed within the period.
+     */
+    limit: number;
+    /**
+     * The period, in seconds, over which requests are counted.
+     */
+    period: RateLimitPeriod;
+  };
+};
+
+/**
+ * The Effect yielded when a `RateLimit` is used inside a Worker init phase:
+ * it attaches the `ratelimit` binding to the surrounding Worker and resolves
+ * to the runtime {@link RateLimitClient}.
+ */
+type BindEffect = Effect.Effect<RateLimitClient, never, RateLimitBinding>;
+
+/**
+ * A Cloudflare Rate Limit binding marker.
+ *
+ * It is a plain data structure (so it can be declared directly on a Worker's
+ * `env`) that is **also** yieldable inside an Effect-native Worker. Yielding it
+ * (`yield* Cloudflare.RateLimit(...)`) attaches the binding to the surrounding
+ * Worker and returns the runtime {@link RateLimitClient} — no separate
+ * `.bind(...)` step required.
+ *
+ * The divergence is achieved via `[Symbol.iterator]`: the object is not an
+ * `Effect` (so `InferEnv` resolves it to the native `cf.RateLimit` in the
+ * `env` position), but it is iterable as one when `yield*`-ed.
+ */
+export interface RateLimit {
+  kind: RateLimitTypeId;
+  name: string;
+  namespaceId: string;
+  simple: {
+    limit: number;
+    period: RateLimitPeriod;
+  };
+  asEffect(): BindEffect;
+  [Symbol.iterator](): SingleShotGen<BindEffect, RateLimitClient>;
+}
+
+export const isRateLimit = (value: unknown): value is RateLimit =>
+  typeof value === "object" &&
+  value !== null &&
+  "kind" in value &&
+  (value as RateLimit).kind === RateLimitTypeId;
+
+/**
+ * A Cloudflare Rate Limit binding for counting arbitrary keys inside Workers.
+ *
+ * Rate Limit bindings are configured directly on Workers and do not have a
+ * standalone provisioning API. The Worker provider sees this object in
+ * `env: { ... }` and emits the corresponding `{ type: "ratelimit" }` metadata
+ * binding to the script.
+ *
+ * @section Declaring on a Worker's env
+ * @example Async (non-Effect) Worker
+ * ```typescript
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   env: {
+ *     THROTTLE: Cloudflare.RateLimit({
+ *       namespaceId: 1001,
+ *       simple: { limit: 10, period: 60 },
+ *     }),
+ *   },
+ * });
+ *
+ * export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+ * //   { THROTTLE: RateLimit } — the native Cloudflare binding
+ *
+ * // worker.ts
+ * export default {
+ *   fetch: async (req: Request, env: WorkerEnv) => {
+ *     const { success } = await env.THROTTLE.limit({ key: "ip" });
+ *     return new Response(success ? "ok" : "rate limited");
+ *   },
+ * };
+ * ```
+ *
+ * @section Binding inside an Effect-native Worker
+ * @example yield* RateLimit does the binding
+ * ```typescript
+ * Cloudflare.Worker("Worker", { main: "./src/worker.ts" },
+ *   Effect.gen(function* () {
+ *     // Attaches the binding to this Worker AND returns the runtime client.
+ *     const throttle = yield* Cloudflare.RateLimit({
+ *       namespaceId: 1001,
+ *       simple: { limit: 10, period: 60 },
+ *     });
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const { success } = yield* throttle.limit({ key: "ip" });
+ *         return HttpServerResponse.text(success ? "ok" : "rate limited");
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(Cloudflare.RateLimitBindingLive)),
+ * );
+ * ```
+ *
+ * @see https://developers.cloudflare.com/workers/runtime-apis/bindings/rate-limit/
+ */
+export const RateLimit: {
+  (props: RateLimitProps): RateLimit;
+  /**
+   * Bind an existing `RateLimit` marker to the surrounding Worker, returning
+   * the runtime client. Equivalent to `yield* rateLimit` — prefer yielding the
+   * marker directly.
+   */
+  bind: typeof RateLimitBinding.bind;
+} = Object.assign(
+  (props: RateLimitProps): RateLimit => {
+    const self: RateLimit = {
+      kind: RateLimitTypeId,
+      name: props.name ?? "RATE_LIMIT",
+      namespaceId: String(props.namespaceId),
+      simple: {
+        limit: props.simple.limit,
+        period: props.simple.period,
+      },
+      asEffect: () => RateLimitBinding.bind(self),
+      [Symbol.iterator]: () => new SingleShotGen(RateLimitBinding.bind(self)),
+    };
+    return self;
+  },
+  {
+    bind: (...args: Parameters<typeof RateLimitBinding.bind>) =>
+      RateLimitBinding.bind(...args),
+  },
+);

package/src/Cloudflare/RateLimit/RateLimitBinding.ts

@@ -0,0 +1,90 @@
+/// <reference types="@cloudflare/workers-types" />
+
+import type * as cf from "@cloudflare/workers-types";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import { type RateLimit as RateLimitLike } from "./RateLimit.ts";
+
+export class RateLimitError extends Data.TaggedError("RateLimitError")<{
+  message: string;
+  cause: unknown;
+}> {}
+
+export interface RateLimitClient {
+  raw: Effect.Effect<cf.RateLimit, never, WorkerEnvironment>;
+  limit(
+    options: Parameters<cf.RateLimit["limit"]>[0],
+  ): Effect.Effect<
+    Awaited<ReturnType<cf.RateLimit["limit"]>>,
+    RateLimitError,
+    WorkerEnvironment
+  >;
+}
+
+export class RateLimitBinding extends Binding.Service<
+  RateLimitBinding,
+  (rateLimit: RateLimitLike) => Effect.Effect<RateLimitClient>
+>()("Cloudflare.RateLimit.Binding") {}
+
+export const RateLimitBindingLive = Layer.effect(
+  RateLimitBinding,
+  Effect.gen(function* () {
+    const Policy = yield* RateLimitBindingPolicy;
+
+    return Effect.fn(function* (rateLimit: RateLimitLike) {
+      yield* Policy(rateLimit);
+      const raw = WorkerEnvironment.useSync(
+        (env) => (env as Record<string, cf.RateLimit>)[rateLimit.name]!,
+      );
+      return {
+        raw,
+        limit: (options) =>
+          raw.pipe(
+            Effect.flatMap((binding) =>
+              Effect.tryPromise({
+                try: () => binding.limit(options),
+                catch: (error) =>
+                  new RateLimitError({
+                    message:
+                      error instanceof Error
+                        ? error.message
+                        : "Unknown RateLimit error",
+                    cause: error,
+                  }),
+              }),
+            ),
+          ),
+      } satisfies RateLimitClient;
+    });
+  }),
+);
+
+export class RateLimitBindingPolicy extends Binding.Policy<
+  RateLimitBindingPolicy,
+  (rateLimit: RateLimitLike) => Effect.Effect<void>
+>()("Cloudflare.RateLimit.Binding") {}
+
+export const RateLimitBindingPolicyLive = RateLimitBindingPolicy.layer.succeed(
+  Effect.fn(function* (host: ResourceLike, rateLimit: RateLimitLike) {
+    if (isWorker(host)) {
+      yield* host.bind(rateLimit.name, {
+        bindings: [
+          {
+            type: "ratelimit",
+            name: rateLimit.name,
+            namespaceId: rateLimit.namespaceId,
+            simple: rateLimit.simple,
+          } as any,
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        new Error(`RateLimitBinding does not support runtime '${host.Type}'`),
+      );
+    }
+  }),
+);

package/src/Cloudflare/RateLimit/index.ts

@@ -0,0 +1,2 @@
+export * from "./RateLimit.ts";
+export * from "./RateLimitBinding.ts";

package/src/Cloudflare/SecretsStore/Secret.ts

@@ -46,7 +46,7 @@ export type Secret = Resource<
     secretName: string;
     storeId: string;
     accountId: string;
-    status: "pending" | "active" | "deleted";
+    status: SecretStatus;
     scopes: string[];
     comment: string | undefined;
   },
@@ -54,6 +54,12 @@ export type Secret = Resource<
   Providers
 >;
 
+export type SecretStatus = "pending" | "active" | "deleted";
+
+// Distilled widened generated string enums to open unions (`string & {}`); the
+// API only ever returns the known variants, so narrow at the boundary.
+const asSecretStatus = (status: string): SecretStatus => status as SecretStatus;
+
 /**
  * A single secret stored inside a Cloudflare Secrets Store.
  *
@@ -132,7 +138,7 @@ export const StoreSecretProvider = () =>
                 id: string;
                 name: string;
                 storeId: string;
-                status: "pending" | "active" | "deleted";
+                status: string;
                 comment?: string | null;
               }
             | undefined;
@@ -188,7 +194,7 @@ export const StoreSecretProvider = () =>
                 secretName: secret.name,
                 storeId: secret.storeId,
                 accountId,
-                status: secret.status,
+                status: asSecretStatus(secret.status),
                 scopes,
                 comment: secret.comment ?? undefined,
               };
@@ -223,7 +229,7 @@ export const StoreSecretProvider = () =>
             secretName: observed.name,
             storeId: observed.storeId,
             accountId,
-            status: patched.status,
+            status: asSecretStatus(patched.status),
             scopes,
             comment: patched.comment ?? undefined,
           };
@@ -253,7 +259,7 @@ export const StoreSecretProvider = () =>
                 secretName: secret.name,
                 storeId: secret.storeId,
                 accountId: output.accountId,
-                status: secret.status,
+                status: asSecretStatus(secret.status),
                 scopes: output.scopes,
                 comment: secret.comment ?? undefined,
               })),
@@ -286,7 +292,7 @@ export const StoreSecretProvider = () =>
             secretName: match.name,
             storeId: match.storeId,
             accountId: olds.store.accountId,
-            status: match.status,
+            status: asSecretStatus(match.status),
             scopes: resolveScopes(olds.scopes),
             comment: match.comment ?? undefined,
           });

package/src/Cloudflare/Tunnel/Tunnel.ts

@@ -120,6 +120,33 @@ export type Tunnel = Resource<
  *   ],
  * });
  * ```
+ *
+ * @section Managing Tunnels at Runtime
+ * The `Tunnel` resource manages a single, statically-declared tunnel as part of
+ * a stack. To create, read, update, or delete tunnels *on the fly* from inside
+ * a deployed Worker, bind one of the runtime tunnel clients instead. Each
+ * provisions a least-privilege {@link AccountApiToken} and injects it into the
+ * Worker:
+ *
+ * - {@link TunnelRead} — read-only (`get`, `list`, `getToken`,
+ *   `getConfiguration`); scoped to `Cloudflare Tunnel Read`.
+ * - {@link TunnelWrite} — mutating (`create`, `update`, `delete`,
+ *   `putConfiguration`); scoped to `Cloudflare Tunnel Write`.
+ * - {@link TunnelReadWrite} — the full CRUD surface; scoped to both.
+ *
+ * @example Create a tunnel on demand from a Worker
+ * ```typescript
+ * // init
+ * const tunnels = yield* Cloudflare.TunnelReadWrite.bind();
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const tunnel = yield* tunnels.create({ name: "on-demand-tunnel" });
+ *     const token = yield* tunnels.getToken(tunnel.id!);
+ *     return HttpServerResponse.json({ id: tunnel.id, token });
+ *   }),
+ * };
+ * ```
  */
 export const Tunnel = Resource<Tunnel>("Cloudflare.Tunnel");
 

package/src/Cloudflare/Tunnel/TunnelBinding.ts

@@ -0,0 +1,114 @@
+import {
+  Credentials,
+  fromApiToken,
+} from "@distilled.cloud/cloudflare/Credentials";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import type { HttpClient } from "effect/unstable/http/HttpClient";
+import type * as Binding from "../../Binding.ts";
+import { RuntimeContext } from "../../RuntimeContext.ts";
+import { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { ApiTokenPermissionGroupRef } from "../ApiToken/Common.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import { Worker } from "../Workers/Worker.ts";
+
+/**
+ * Runtime accessors for a tunnel binding's token, obtained by binding the
+ * {@link AccountApiToken}'s outputs in the Worker's Init phase. Each accessor
+ * reads the value back from the Worker's environment at runtime.
+ */
+export interface TunnelToken {
+  /** The token's plaintext value (injected as a `secret_text` binding). */
+  value: Effect.Effect<Redacted.Redacted<string>>;
+  /** The account id the token is scoped to. */
+  accountId: Effect.Effect<string>;
+}
+
+/**
+ * Bind an {@link AccountApiToken}'s outputs into the Worker so they can be read
+ * at runtime: `token.value` is injected as a `secret_text` binding and
+ * `token.accountId` as `plain_text`. Returns the {@link TunnelToken} accessors.
+ */
+export const bindTunnelToken = (token: AccountApiToken) =>
+  Effect.gen(function* () {
+    const value = yield* token.value;
+    const accountId = yield* token.accountId;
+    return { value, accountId } satisfies TunnelToken;
+  });
+
+/**
+ * Resolve credentials from a bound token and provide them (plus the
+ * fetch-based HTTP client) to a raw SDK operation.
+ */
+export const authorizeWith =
+  (token: TunnelToken) =>
+  <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient>,
+  ): Effect.Effect<A, E, RuntimeContext> =>
+    token.value.pipe(
+      Effect.flatMap((value) =>
+        eff.pipe(
+          Effect.provide(
+            fromApiToken({ apiToken: Redacted.value(value) }).pipe(
+              Layer.provideMerge(FetchHttpClient.layer),
+            ),
+          ),
+        ),
+      ),
+    );
+
+/**
+ * Shared runtime body for a tunnel binding: create a scoped token, attach the
+ * (narrow) policy, bind the token's outputs into the Worker, then build the
+ * client. Pass the result to `Layer.effect(<Binding>, ...)`.
+ */
+export const makeTunnelClient = <C>(
+  Policy: Binding.Policy<
+    any,
+    any,
+    (token: AccountApiToken) => Effect.Effect<void>
+  >,
+  makeClient: (token: TunnelToken) => C,
+) =>
+  Effect.gen(function* () {
+    const Token = yield* AccountApiToken;
+    const attach = yield* Policy;
+
+    return Effect.fn(function* () {
+      const ctx = yield* Worker;
+      const token = yield* Token(`${ctx.LogicalId}Token`);
+      yield* attach(token);
+      return makeClient(yield* bindTunnelToken(token));
+    });
+  });
+
+/**
+ * Build the deploy-time policy layer for a tunnel binding: attach an allow
+ * policy with the given permission groups to the binding's token.
+ */
+export const makeTunnelPolicyLive = <Self, Id extends string>(
+  Policy: Binding.Policy<
+    Self,
+    Id,
+    (token: AccountApiToken) => Effect.Effect<void>
+  >,
+  sid: string,
+  permissionGroups: ApiTokenPermissionGroupRef[],
+) =>
+  Policy.layer.effect(
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      return (_host, token) =>
+        token.bind(sid, {
+          policies: [
+            {
+              effect: "allow",
+              permissionGroups,
+              resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+            },
+          ],
+        });
+    }),
+  );