alchemy 2.0.0-beta.56 → 2.0.0-beta.58

package/src/Cloudflare/Pipelines/LegacyPipeline.ts

@@ -166,7 +166,9 @@ export type LegacyPipeline = Resource<
  * A legacy pipeline accepts JSON events over HTTP (and/or a Worker
  * `pipelines` binding) and batches them into an R2 bucket using
  * S3-compatible credentials.
- *
+ * @resource
+ * @product Pipelines
+ * @category Storage & Databases
  * @section Creating a Legacy Pipeline
  * @example HTTP ingest into R2
  * The S3-compatible credentials are derived from a Cloudflare API token:

package/src/Cloudflare/Pipelines/Pipeline.ts

@@ -72,7 +72,9 @@ export type Pipeline = Resource<
  * The SQL is fixed at creation: changing it (or the name) triggers a
  * replacement. Nothing references a pipeline downstream, so replacements
  * are cheap.
- *
+ * @resource
+ * @product Pipelines
+ * @category Storage & Databases
  * @section Creating a Pipeline
  * @example Stream → Sink passthrough
  * ```typescript

package/src/Cloudflare/Pipelines/Sink.ts

@@ -222,7 +222,9 @@ export type PipelineSink = Resource<
  * sink gets a fresh name before the old one is deleted); with an
  * explicit `name` the create-before-delete replacement collides, so
  * prefer generated names.
- *
+ * @resource
+ * @product Pipelines
+ * @category Storage & Databases
  * @section Creating a Sink
  * @example R2 sink with JSON output
  * The S3-compatible credentials are derived from a Cloudflare API token:

package/src/Cloudflare/Pipelines/Stream.ts

@@ -186,7 +186,9 @@ export type PipelineStream = Resource<
  * The stream's `schema` and `format` are fixed at creation (changing them
  * triggers a replacement); the HTTP endpoint and Worker-binding toggles
  * are mutable in place.
- *
+ * @resource
+ * @product Pipelines
+ * @category Storage & Databases
  * @section Creating a Stream
  * @example Unstructured stream with default settings
  * ```typescript

package/src/Cloudflare/Providers.ts

@@ -7,9 +7,7 @@ import * as Ref from "effect/Ref";
 import * as Schedule from "effect/Schedule";
 import { CredentialsStoreLive } from "../Auth/Credentials.ts";
 import { ProfileLive } from "../Auth/Profile.ts";
-import { Command } from "../Build/Command.ts";
-import { DevServer, DevServerProvider } from "../Build/DevServer.ts";
-import * as Build from "../Build/index.ts";
+import * as Command from "../Command/index.ts";
 import { KeyPair, KeyPairProvider } from "../KeyPair.ts";
 import * as Provider from "../Provider.ts";
 import { Random, RandomProvider } from "../Random.ts";
@@ -182,9 +180,10 @@ export const providers = () =>
       AiGateway.AiGatewayDynamicRouting,
       AiGateway.AiGatewayEvaluation,
       AiGateway.AiGatewayProviderConfig,
-      AiGateway.AiGatewaySpendingLimit,
       AiSearch.AiSearchInstance,
+      AiSearch.AiSearchInstanceBindingPolicy,
       AiSearch.AiSearchNamespace,
+      AiSearch.AiSearchNamespaceBindingPolicy,
       AiSearch.AiSearchToken,
       AiSecurity.AiSecurityCustomTopics,
       AiSecurity.AiSecuritySettings,
@@ -214,9 +213,8 @@ export const providers = () =>
       ClientCertificate.ClientCertificate,
       CloudConnector.CloudConnectorRules,
       CloudforceOne.CloudforceOneScanConfig,
-      Command,
       Connectivity.DirectoryService,
-      Containers.Container,
+      Containers.ContainerPlatform,
       ContentScanning.ContentScanning,
       ContentScanning.ContentScanningExpression,
       CustomCertificates.CustomCertificate,
@@ -237,7 +235,6 @@ export const providers = () =>
       Devices.DevicePostureIntegration,
       Devices.DevicePostureRule,
       Devices.DeviceSettings,
-      DevServer,
       Diagnostics.EndpointHealthcheck,
       Dlp.DlpEntry,
       Dlp.DlpProfile,
@@ -296,7 +293,6 @@ export const providers = () =>
       KeylessCertificate.KeylessCertificate,
       KeyPair,
       KV.KVNamespace,
-      KV.KVNamespaceBindingPolicy,
       LeakedCredentialCheck.LeakedCredentialCheck,
       LeakedCredentialCheck.LeakedCredentialDetection,
       LoadBalancer.LoadBalancer,
@@ -340,12 +336,10 @@ export const providers = () =>
       Pipelines.PipelineSink,
       Pipelines.PipelineStream,
       Queue.Queue,
-      Queue.QueueBindingPolicy,
       Queue.QueueConsumer,
       Queue.QueueEventSourcePolicy,
       Queue.QueueSubscription,
       R2.R2Bucket,
-      R2.R2BucketBindingPolicy,
       R2.R2BucketEventNotification,
       R2.R2BucketSippy,
       R2DataCatalog.R2DataCatalog,
@@ -421,7 +415,6 @@ export const providers = () =>
       Workers.WorkersAccountSetting,
       Workers.WorkersSubdomain,
       WorkersForPlatforms.DispatchNamespace,
-      WorkersForPlatforms.DispatchNamespaceScript,
       Workflows.WorkflowResource,
       Zaraz.ZarazConfig,
       Zone.Zone,
@@ -437,7 +430,6 @@ export const providers = () =>
         AccessPol.AccessPolicyProvider(),
         AiGateway.AiGatewayBindingPolicyLive,
         AiGateway.AiGatewayProvider(),
-        AiGateway.AiGatewaySpendingLimitProvider(),
         AnalyticsEngine.AnalyticsEngineDatasetBindingPolicyLive,
         ApiToken.AccountApiTokenProvider(),
         ApiToken.UserApiTokenProvider(),
@@ -447,7 +439,6 @@ export const providers = () =>
         D1.D1ConnectionPolicyLive,
         D1.DatabaseProvider(),
         Devices.DeviceDefaultProfileProvider(),
-        DevServerProvider(),
         Dns.DnsReadPolicyLive,
         Dns.DnsReadWritePolicyLive,
         Dns.DnsRecordProvider(),
@@ -461,13 +452,10 @@ export const providers = () =>
         Hyperdrive.HyperdriveBindingPolicyLive,
         Hyperdrive.HyperdriveProvider(),
         Images.ImagesBindingPolicyLive,
-        KV.KVNamespaceBindingPolicyLive,
         KV.KVNamespaceProvider(),
-        Queue.QueueBindingPolicyLive,
         Queue.QueueConsumerProvider(),
         Queue.QueueEventSourcePolicyLive,
         Queue.QueueProvider(),
-        R2.R2BucketBindingPolicyLive,
         R2.R2BucketProvider(),
         RateLimit.RateLimitBindingPolicyLive,
         Ruleset.RulesetProvider(),
@@ -525,8 +513,9 @@ export const providers = () =>
           AiGateway.AiGatewayEvaluationProvider(),
           AiGateway.AiGatewayProvider(),
           AiGateway.AiGatewayProviderConfigProvider(),
-          AiGateway.AiGatewaySpendingLimitProvider(),
+          AiSearch.AiSearchInstanceBindingPolicyLive,
           AiSearch.AiSearchInstanceProvider(),
+          AiSearch.AiSearchNamespaceBindingPolicyLive,
           AiSearch.AiSearchNamespaceProvider(),
           AiSearch.AiSearchTokenProvider(),
           AiSecurity.AiSecurityCustomTopicsProvider(),
@@ -579,7 +568,6 @@ export const providers = () =>
           Devices.DevicePostureIntegrationProvider(),
           Devices.DevicePostureRuleProvider(),
           Devices.DeviceSettingsProvider(),
-          DevServerProvider(),
           Diagnostics.EndpointHealthcheckProvider(),
           Dlp.DlpEntryProvider(),
           Dlp.DlpProfileProvider(),
@@ -632,7 +620,6 @@ export const providers = () =>
         ),
         Layer.mergeAll(
           KeylessCertificate.KeylessCertificateProvider(),
-          KV.KVNamespaceBindingPolicyLive,
           KV.KVNamespaceProvider(),
           LeakedCredentialCheck.LeakedCredentialCheckProvider(),
           LeakedCredentialCheck.LeakedCredentialDetectionProvider(),
@@ -672,12 +659,10 @@ export const providers = () =>
           Pipelines.PipelineProvider(),
           Pipelines.PipelineSinkProvider(),
           Pipelines.PipelineStreamProvider(),
-          Queue.QueueBindingPolicyLive,
           Queue.QueueConsumerProvider(),
           Queue.QueueEventSourcePolicyLive,
           Queue.QueueProvider(),
           Queue.QueueSubscriptionProvider(),
-          R2.R2BucketBindingPolicyLive,
           R2.R2BucketEventNotificationProvider(),
           R2.R2BucketProvider(),
           R2.R2BucketSippyProvider(),
@@ -749,7 +734,6 @@ export const providers = () =>
           Workers.WorkersAccountSettingProvider(),
           Workers.WorkersSubdomainProvider(),
           WorkersForPlatforms.DispatchNamespaceProvider(),
-          WorkersForPlatforms.DispatchNamespaceScriptProvider(),
           Workflows.WorkflowProvider(),
           Zaraz.ZarazConfigProvider(),
           Zone.ZoneCustomNameserversProvider(),
@@ -775,7 +759,7 @@ export const providers = () =>
         LoadBalancer.LoadBalancerMonitorProvider(),
         LoadBalancer.LoadBalancerMonitorGroupProvider(),
         LoadBalancer.LoadBalancerPoolProvider(),
-        Build.CommandProvider(),
+        Command.providers(),
         KeyPairProvider(),
         RandomProvider(),
       ),
@@ -816,7 +800,7 @@ const cloudflareRetryFactory: Retry.Factory = (lastError) => {
     schedule: pipe(
       Schedule.exponential(Duration.millis(250), 2),
       Schedule.modifyDelay(
-        Effect.fnUntraced(function* (duration) {
+        Effect.fn(function* (duration) {
           const error = yield* Ref.get(lastError);
           // Throttling errors (429): honor a 500ms floor matching the
           // distilled default.

package/src/Cloudflare/Queue/Queue.ts

@@ -18,7 +18,7 @@ import {
   LocalRuntimeState,
 } from "../LocalRuntime.ts";
 import type { Providers } from "../Providers.ts";
-import { QueueBinding } from "./QueueBinding.ts";
+import { QueueWrite } from "./QueueWrite.ts";
 
 export const isQueue = (value: unknown): value is Queue =>
   typeof value === "object" && (value as any)?.Type === "Cloudflare.Queue";
@@ -49,7 +49,9 @@ export type Queue = Resource<
  * Queues enable you to send and receive messages with guaranteed delivery.
  * Create a queue as a resource, then bind it to a Worker to send messages
  * at runtime. Register a consumer to process messages.
- *
+ * @resource
+ * @product Queues
+ * @category Storage & Databases
  * @section Creating a Queue
  * @example Basic queue
  * ```typescript
@@ -64,10 +66,10 @@ export type Queue = Resource<
  * ```
  *
  * @section Binding to a Worker
- * In an Effect-style Worker, use `Cloudflare.QueueBinding.bind` in
- * the init phase and provide `Cloudflare.QueueBindingLive` in the
- * runtime layer. The returned `QueueSender` exposes `send` and
- * `sendBatch`.
+ * In an Effect-style Worker, use `Cloudflare.Queues.WriteQueue` in
+ * the init phase and provide `Cloudflare.Queues.WriteQueueBinding` in
+ * the runtime layer. The returned `WriteQueueClient` exposes `send`
+ * and `sendBatch`.
  *
  * @example Sending messages from a Worker
  * ```typescript
@@ -82,7 +84,7 @@ export type Queue = Resource<
  *   "Worker",
  *   { main: import.meta.filename },
  *   Effect.gen(function* () {
- *     const queue = yield* Cloudflare.QueueBinding.bind(Queue);
+ *     const queue = yield* Cloudflare.Queues.WriteQueue(Queue);
  *
  *     return {
  *       fetch: Effect.gen(function* () {
@@ -98,12 +100,12 @@ export type Queue = Resource<
  *         return HttpServerResponse.text("Not Found", { status: 404 });
  *       }),
  *     };
- *   }).pipe(Effect.provide(Cloudflare.QueueBindingLive)),
+ *   }).pipe(Effect.provide(Cloudflare.Queues.WriteQueueBinding)),
  * );
  * ```
  */
 export const Queue = Resource<Queue>("Cloudflare.Queue")({
-  bind: QueueBinding.bind,
+  bind: QueueWrite.bind,
 });
 
 export const QueueProviderLive = () =>
@@ -278,7 +280,7 @@ const createQueueName = (id: string, name: string | undefined) =>
 // Cloudflare's `listQueues` accepts no name/prefix filter, so
 // adoption-by-name has to scan every page. Use the paginated
 // `.items` stream off the un-yielded operation method.
-const findQueueByName = Effect.fnUntraced(function* (queueName: string) {
+const findQueueByName = Effect.fn(function* (queueName: string) {
   const { accountId } = yield* yield* CloudflareEnvironment;
   return yield* queues.listQueues.items({ accountId }).pipe(
     Stream.filter((q) => q.queueName === queueName),

package/src/Cloudflare/Queue/QueueBinding.ts

@@ -1,144 +1,63 @@
+import type * as runtime from "@cloudflare/workers-types";
 import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Binding from "../../Binding.ts";
-import type { ResourceLike } from "../../Resource.ts";
-import type { RuntimeContext } from "../../RuntimeContext.ts";
-import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import { Worker, WorkerEnvironment } from "../Workers/Worker.ts";
 import type { Queue } from "./Queue.ts";
-
-export interface QueueSender {
-  raw: Effect.Effect<any, never, RuntimeContext>;
-  send(
-    body: unknown,
-    options?: { contentType?: "json" | "text" },
-  ): Effect.Effect<void, QueueSendError, RuntimeContext>;
-  sendBatch(
-    messages: ReadonlyArray<{
-      body: unknown;
-      contentType?: "json" | "text";
-    }>,
-  ): Effect.Effect<void, QueueSendError, RuntimeContext>;
-}
-
-import * as Data from "effect/Data";
-
-export class QueueSendError extends Data.TaggedError("QueueSendError")<{
-  message: string;
-  cause?: unknown;
-}> {}
+import { QueueSendError } from "./QueueTypes.ts";
 
 /**
- * Binding service that turns a {@link Queue} resource into a typed
- * {@link QueueSender} you can call from a Worker's runtime Effect.
- *
- * @section Sending Messages
- * Bind the queue in the Worker's init phase, then use `send` for
- * single messages or `sendBatch` for many messages in one call.
- * Messages can be any JSON-serializable value.
- *
- * @example Producer route
- * ```typescript
- * const queue = yield* Cloudflare.QueueBinding.bind(Queue);
+ * Shared scaffolding for the Worker-binding implementations of the Queue
+ * services.
  *
- * return {
- *   fetch: Effect.gen(function* () {
- *     yield* queue.send({ text: "hi", sentAt: Date.now() });
- *     return HttpServerResponse.empty({ status: 202 });
- *   }),
- * };
- * ```
- *
- * @example Sending a batch
- * ```typescript
- * yield* queue.sendBatch([
- *   { body: { event: "click", id: 1 } },
- *   { body: { event: "click", id: 2 } },
- *   { body: "raw text", contentType: "text" },
- * ]);
- * ```
- *
- * Provide {@link QueueBindingLive} in the worker's runtime layer to
- * resolve the underlying Cloudflare queue at request time.
+ * Resolves the {@link WorkerEnvironment} and host {@link Worker}, registers
+ * the `queue` binding at deploy time, then delegates to `makeClient` with the
+ * shared {@link makeQueueHelpers} to build the producer client.
  */
-export class QueueBinding extends Binding.Service<
-  QueueBinding,
-  (queue: Queue) => Effect.Effect<QueueSender>
->()("Cloudflare.Queue") {}
-
-export const QueueBindingLive = Layer.effect(
-  QueueBinding,
+export const makeQueueBinding = <Client>(options: {
+  makeClient: (helpers: ReturnType<typeof makeQueueHelpers>) => Client;
+}) =>
   Effect.gen(function* () {
-    const bind = yield* QueueBindingPolicy;
     const env = yield* WorkerEnvironment;
+    const host = yield* Worker;
 
     return Effect.fn(function* (queue: Queue) {
-      yield* bind(queue);
-      const raw = Effect.sync(
-        () => (env as Record<string, any>)[queue.LogicalId],
-      );
-
-      const tryPromise = <T>(
-        fn: () => Promise<T>,
-      ): Effect.Effect<T, QueueSendError> =>
-        Effect.tryPromise({
-          try: fn,
-          catch: (error: any) =>
-            new QueueSendError({
-              message: error?.message ?? "Unknown queue error",
-              cause: error,
-            }),
+      if (!globalThis.__ALCHEMY_RUNTIME__) {
+        yield* host.bind`${queue}`({
+          bindings: [
+            {
+              type: "queue",
+              name: queue.LogicalId,
+              queueName: queue.queueName,
+            },
+          ],
         });
+      }
 
-      return {
-        raw,
-        send: (body: unknown, options?: { contentType?: "json" | "text" }) =>
-          raw.pipe(
-            Effect.flatMap((q) => tryPromise(() => q.send(body, options))),
-          ),
-        sendBatch: (
-          messages: ReadonlyArray<{
-            body: unknown;
-            contentType?: "json" | "text";
-          }>,
-        ) =>
-          raw.pipe(
-            Effect.flatMap((q) =>
-              tryPromise(() =>
-                q.sendBatch(
-                  messages.map((m) => ({
-                    body: m.body,
-                    ...(m.contentType ? { contentType: m.contentType } : {}),
-                  })),
-                ),
-              ),
-            ),
-          ),
-      } satisfies QueueSender;
+      return options.makeClient(makeQueueHelpers(env, queue));
+    });
+  });
+
+/** Primitives shared by the Worker-binding producer clients. */
+export const makeQueueHelpers = (env: Record<string, any>, queue: Queue) => {
+  const raw = Effect.sync(
+    () => (env as Record<string, runtime.Queue<unknown>>)[queue.LogicalId]!,
+  );
+
+  const tryPromise = <T>(
+    fn: () => Promise<T>,
+  ): Effect.Effect<T, QueueSendError> =>
+    Effect.tryPromise({
+      try: fn,
+      catch: (error: any) =>
+        new QueueSendError({
+          message: error?.message ?? "Unknown queue error",
+          cause: error,
+        }),
     });
-  }),
-);
 
-export class QueueBindingPolicy extends Binding.Policy<
-  QueueBindingPolicy,
-  (queue: Queue) => Effect.Effect<void>
->()("Cloudflare.Queue") {}
+  const use = <T>(
+    fn: (raw: runtime.Queue<unknown>) => Promise<T>,
+  ): Effect.Effect<T, QueueSendError> =>
+    raw.pipe(Effect.flatMap((raw) => tryPromise(() => fn(raw))));
 
-export const QueueBindingPolicyLive = QueueBindingPolicy.layer.succeed(
-  Effect.fnUntraced(function* (host: ResourceLike, queue: Queue) {
-    if (isWorker(host)) {
-      yield* host.bind`${queue}`({
-        bindings: [
-          {
-            type: "queue",
-            name: queue.LogicalId,
-            queueName: queue.queueName,
-          },
-        ],
-      });
-    } else {
-      return yield* Effect.die(
-        new Error(`QueueBinding does not support runtime '${host.Type}'`),
-      );
-    }
-  }),
-);
+  return { raw, use, tryPromise };
+};

package/src/Cloudflare/Queue/QueueConsumer.ts

@@ -87,7 +87,9 @@ export type QueueConsumer = Resource<
  * consumers can coexist). The reconciler enforces this: if the queue
  * already has a Worker consumer pointing at a different script, the
  * deploy fails with a clear error rather than silently adopting it.
- *
+ * @resource
+ * @product Queues
+ * @category Storage & Databases
  * @section Registering a Consumer
  * @example Basic consumer
  * ```typescript
@@ -234,7 +236,9 @@ export const QueueConsumerProviderLive = () =>
     reconcile: Effect.fn(function* ({ news, output }) {
       const { accountId } = yield* yield* CloudflareEnvironment;
       const acct = output?.accountId ?? accountId;
-      const queueId = output?.queueId ?? (news.queueId as unknown as string);
+      // Only use `output.queueId` if it's a live ID (i.e. no `dev:` prefix).
+      // Otherwise, the lookup will fail because the request is malformed.
+      const queueId = isLiveId(output?.queueId) ? output.queueId : news.queueId;
 
       // Observe — prefer the cached consumerId, then fall back to
       // listConsumers (paginated) to recover from out-of-band

package/src/Cloudflare/Queue/QueueEventSource.ts

@@ -13,6 +13,7 @@ import * as DurationUtil from "../../Util/Duration.ts";
 import { isWorker, isWorkerEvent } from "../Workers/Worker.ts";
 import type { Queue } from "./Queue.ts";
 import { QueueConsumer } from "./QueueConsumer.ts";
+import type { Providers } from "../Providers.ts";
 
 /**
  * Subscriber settings — the same shape Cloudflare's `QueueConsumer`
@@ -84,7 +85,9 @@ export type QueueMessage<Body = unknown> = cf.Message<Body>;
  * settings before dead-lettering. Per-message control is still
  * available by calling `msg.ack()` / `msg.retry()` inside the
  * handler.
- *
+ * @binding
+ * @product Queues
+ * @category Storage & Databases
  * @example
  * ```typescript
  * import * as Cloudflare from "alchemy/Cloudflare";
@@ -148,7 +151,8 @@ export class QueueEventSource extends Context.Service<
  */
 export class QueueEventSourcePolicy extends Binding.Policy<
   QueueEventSourcePolicy,
-  (queue: Queue, props: MessagesProps) => Effect.Effect<void>
+  (queue: Queue, props: MessagesProps) => Effect.Effect<void>,
+  Providers
 >()("Cloudflare.Queue.QueueEventSource") {}
 
 export const QueueEventSourcePolicyLive = QueueEventSourcePolicy.layer.succeed(
@@ -195,7 +199,7 @@ export const QueueEventSourcePolicyLive = QueueEventSourcePolicy.layer.succeed(
  * `Cloudflare.QueueConsumer` resource.
  *
  * Provide alongside other Cloudflare runtime layers (e.g.
- * `QueueBindingLive`) on the Worker effect.
+ * `WriteQueueBinding`) on the Worker effect.
  */
 export const QueueEventSourceLive = Layer.effect(
   QueueEventSource,

package/src/Cloudflare/Queue/QueueHttp.ts

@@ -0,0 +1,86 @@
+import * as Effect from "effect/Effect";
+import type * as Redacted from "effect/Redacted";
+import { Self } from "../../Self.ts";
+import { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { ApiTokenPermissionGroupRef } from "../ApiToken/Common.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Queue } from "./Queue.ts";
+import { QueueSendError } from "./QueueTypes.ts";
+
+export interface QueueHttpToken {
+  value: Effect.Effect<Redacted.Redacted<string>>;
+  accountId: Effect.Effect<string>;
+}
+
+export interface QueueHttpScope {
+  accountId: string;
+  queueId: string;
+}
+
+const QUEUE_HTTP_PERMISSION_GROUPS: ApiTokenPermissionGroupRef[] = [
+  "Queues Read",
+  "Queues Write",
+];
+
+type PermissionGroup = (typeof QUEUE_HTTP_PERMISSION_GROUPS)[number];
+
+/**
+ * Shared scaffolding for the HTTP-backed Queue services.
+ *
+ * Creates a scoped {@link AccountApiToken}, binds its `value` /
+ * `accountId` into the host Worker at deploy time, then delegates to
+ * `makeClient` with the bound token and the queue's `queueId`.
+ */
+export const makeHttpQueueBinding = <Client>(options: {
+  permissionGroups: PermissionGroup[];
+  makeClient: (token: QueueHttpToken, queueId: Effect.Effect<string>) => Client;
+}) =>
+  Effect.gen(function* () {
+    const Token = yield* AccountApiToken;
+    const self = yield* Self;
+    const env = yield* CloudflareEnvironment;
+
+    return Effect.fn(function* (queue: Queue) {
+      const { accountId } = yield* env;
+      const token = yield* Token(`${self.LogicalId}Token`);
+      if (!globalThis.__ALCHEMY_RUNTIME__) {
+        yield* token.bind`${queue.LogicalId}`({
+          policies: [
+            {
+              effect: "allow",
+              permissionGroups: options.permissionGroups,
+              resources: {
+                [`com.cloudflare.api.account.${accountId}`]: "*",
+              },
+            },
+          ],
+        });
+      }
+      const bound = {
+        value: yield* token.value,
+        accountId: yield* token.accountId,
+      } satisfies QueueHttpToken;
+      const queueId = yield* queue.queueId;
+      return options.makeClient(bound, queueId);
+    });
+  });
+
+/** Resolve the account and queue id once per operation. */
+export const makeQueueHttpScope = (
+  token: QueueHttpToken,
+  queueId: Effect.Effect<string>,
+): Effect.Effect<QueueHttpScope> =>
+  Effect.gen(function* () {
+    const accountId = yield* token.accountId;
+    const id = yield* queueId;
+    return { accountId, queueId: id };
+  });
+
+export const toQueueSendError = (error: unknown): QueueSendError =>
+  new QueueSendError({
+    message:
+      typeof error === "object" && error !== null && "message" in error
+        ? String((error as { message: unknown }).message)
+        : "Unknown queue error",
+    cause: error,
+  });

package/src/Cloudflare/Queue/QueueTypes.ts

@@ -0,0 +1,17 @@
+import * as Data from "effect/Data";
+
+/** Options accepted by a single {@link WriteQueueClient.send} call. */
+export interface QueueSendOptions {
+  contentType?: "json" | "text";
+}
+
+/** A single message handed to {@link WriteQueueClient.sendBatch}. */
+export interface QueueSendMessage {
+  body: unknown;
+  contentType?: "json" | "text";
+}
+
+export class QueueSendError extends Data.TaggedError("QueueSendError")<{
+  message: string;
+  cause?: unknown;
+}> {}