alchemy 2.0.0-beta.61 → 2.0.0-beta.63

package/src/Cloudflare/Queues/Consumer.ts

@@ -308,9 +308,10 @@ export const ConsumerProviderLive = () =>
             Effect.catchTag("ConsumerNotFound", () => Effect.void),
             Effect.retry({
               while: (e) => e === "still-attached",
-              schedule: Schedule.spaced("1 second").pipe(
-                Schedule.both(Schedule.recurs(30)),
-              ),
+              schedule: Schedule.max([
+                Schedule.spaced("1 second"),
+                Schedule.recurs(30),
+              ]),
             }),
             Effect.ignore,
           );
@@ -487,9 +488,10 @@ export const ConsumerProviderLive = () =>
           Effect.catchTag("ConsumerNotFound", () => Effect.void),
           Effect.retry({
             while: (e) => e === "still-attached",
-            schedule: Schedule.spaced("1 second").pipe(
-              Schedule.both(Schedule.recurs(30)),
-            ),
+            schedule: Schedule.max([
+              Schedule.spaced("1 second"),
+              Schedule.recurs(30),
+            ]),
           }),
           Effect.ignore,
         );
@@ -561,9 +563,10 @@ const toObserved = (c: {
 
 // ~60s budget — Worker reconcile uploads typically land in 2–10s,
 // but a fresh container/asset deploy can stretch that.
-const queueHandlerReadinessSchedule = Schedule.spaced("2 seconds").pipe(
-  Schedule.both(Schedule.recurs(30)),
-);
+const queueHandlerReadinessSchedule = Schedule.max([
+  Schedule.spaced("2 seconds"),
+  Schedule.recurs(30),
+]);
 
 export const ConsumerProviderLocal = () =>
   RpcProvider.effect(
@@ -571,6 +574,27 @@ export const ConsumerProviderLocal = () =>
     LOCAL_ENTRY_URL,
     Effect.gen(function* () {
       const localRuntimeState = yield* LocalRuntimeState;
+
+      // Restart the locally running workerd instances (if any) for the
+      // given scripts so start-time queue-consumer wiring is re-read from
+      // `localRuntimeState.queueConsumers`. See `workerRestarts` on
+      // {@link LocalRuntimeState}.
+      const restartScripts = (scriptNames: ReadonlyArray<string>) =>
+        Effect.forEach(
+          scriptNames,
+          (scriptName) =>
+            MutableHashMap.get(
+              localRuntimeState.workerRestarts,
+              scriptName,
+            ).pipe(
+              Option.match({
+                onNone: () => Effect.void,
+                onSome: (restart) => restart,
+              }),
+            ),
+          { discard: true },
+        );
+
       return {
         list: () =>
           Effect.sync(() =>
@@ -625,6 +649,17 @@ export const ConsumerProviderLocal = () =>
             consumer.consumerId,
             consumer,
           );
+          // A local workerd instance only reads its queue-consumer wiring
+          // at start time, and this reconcile races the sibling Worker's
+          // start (the Worker's `precreate` resolves `scriptName` before
+          // workerd is up). Restart any already-running instance so it
+          // picks up the new wiring; if the worker hasn't served yet this
+          // is a no-op and its first serve observes the map we just set.
+          yield* restartScripts(
+            output && output.scriptName !== consumer.scriptName
+              ? [output.scriptName, consumer.scriptName]
+              : [consumer.scriptName],
+          );
           return consumer;
         }),
         delete: Effect.fn(function* ({ output }) {
@@ -632,6 +667,7 @@ export const ConsumerProviderLocal = () =>
             localRuntimeState.queueConsumers,
             output.consumerId,
           );
+          yield* restartScripts([output.scriptName]);
         }),
       };
     }),

package/src/Cloudflare/Queues/Queue.ts

@@ -208,9 +208,10 @@ export const ProviderLive = () =>
         .pipe(
           Effect.retry({
             while: (e) => e._tag === "QueueInUseByEventNotification",
-            schedule: Schedule.exponential("1 second").pipe(
-              Schedule.both(Schedule.recurs(8)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential("1 second"),
+              Schedule.recurs(8),
+            ]),
           }),
           Effect.catchTag("QueueNotFound", () => Effect.void),
         );

package/src/Cloudflare/Queues/QueueHttp.ts

@@ -1,12 +1,34 @@
 import * as Effect from "effect/Effect";
 import type * as Redacted from "effect/Redacted";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
 import { Self } from "../../Self.ts";
 import { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
 import type { PermissionGroupRef } from "../ApiToken/Common.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
 import type { Queue } from "./Queue.ts";
 import { SendError } from "./QueueTypes.ts";
 
+/**
+ * Injectable auth used by the Queue HTTP client builder. Both the
+ * scoped-token HTTP variant ({@link makeWriteQueueHttpClient}) and the
+ * current-credentials Local variant build this so they share the exact
+ * same request path — only the way credentials reach the SDK op differs.
+ *
+ * - `authorize` runs a raw distilled op (which needs
+ *   `Credentials | HttpClient`) and discharges those requirements down to
+ *   {@link RuntimeContext}. The HTTP variant provides a minted token; the
+ *   Local variant provides the ambient current-credentials context.
+ * - `accountId` resolves the Cloudflare account the queue lives in.
+ */
+export interface QueueAuth {
+  authorize: <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+  ) => Effect.Effect<A, E, RuntimeContext>;
+  accountId: Effect.Effect<string>;
+}
+
 /**
  * Shared scaffolding for the HTTP-backed Queue services.
  *
@@ -50,11 +72,11 @@ export const makeHttpQueueBinding = <Client>(options: {
 
 /** Resolve the account and queue id once per operation. */
 export const makeQueueHttpScope = (
-  token: HttpToken,
+  auth: QueueAuth,
   queueId: Effect.Effect<string>,
 ): Effect.Effect<HttpScope> =>
   Effect.gen(function* () {
-    const accountId = yield* token.accountId;
+    const accountId = yield* auth.accountId;
     const id = yield* queueId;
     return { accountId, queueId: id };
   });

package/src/Cloudflare/Queues/WriteQueueHttp.ts

@@ -6,7 +6,7 @@ import {
   makeHttpQueueBinding,
   makeQueueHttpScope,
   toQueueSendError,
-  type HttpToken,
+  type QueueAuth,
 } from "./QueueHttp.ts";
 import { SendError, type SendMessage } from "./QueueTypes.ts";
 import { WriteQueue, type WriteQueueClient } from "./WriteQueue.ts";
@@ -27,7 +27,11 @@ export const WriteQueueHttp = Layer.effect(
   Effect.suspend(() =>
     makeHttpQueueBinding({
       permissionGroups: ["Queues Write"],
-      makeClient: makeWriteQueueHttpClient,
+      makeClient: (token, queueId) =>
+        makeWriteQueueHttpClient(
+          { authorize: authorizeWith(token), accountId: token.accountId },
+          queueId,
+        ),
     }),
   ),
 );
@@ -44,18 +48,23 @@ const toMessage = (message: SendMessage) =>
       }
     : { body: message.body, contentType: "json" as const };
 
-/** Build the producer client over the Queues bulk-push HTTP API. */
+/**
+ * Build the producer client over the Queues bulk-push HTTP API.
+ *
+ * Shared by {@link WriteQueueHttp} (scoped token auth) and
+ * `WriteQueueLocal` (current-credentials auth) — they differ only in the
+ * {@link QueueAuth} they inject.
+ */
 export const makeWriteQueueHttpClient = (
-  token: HttpToken,
+  auth: QueueAuth,
   queueId: Effect.Effect<string>,
 ): WriteQueueClient => {
-  const authorize = authorizeWith(token);
-  const scope = makeQueueHttpScope(token, queueId);
+  const scope = makeQueueHttpScope(auth, queueId);
 
   const push = (messages: ReadonlyArray<SendMessage>) =>
     scope.pipe(
       Effect.flatMap(({ accountId, queueId }) =>
-        authorize(
+        auth.authorize(
           queues.bulkPushMessages({
             accountId,
             queueId,

package/src/Cloudflare/Queues/WriteQueueLocal.ts

@@ -0,0 +1,64 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
+import type { Queue } from "./Queue.ts";
+import { makeWriteQueueHttpClient } from "./WriteQueueHttp.ts";
+import { WriteQueue } from "./WriteQueue.ts";
+
+/**
+ * Local implementation of the {@link WriteQueue} binding — pushes messages
+ * to a Cloudflare Queue over the bulk-push HTTP API using the **current
+ * credentials** instead of a native Worker binding
+ * ({@link WriteQueueBinding}) or a scoped API token ({@link WriteQueueHttp}).
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) so you can send
+ * messages to a queue with the same `send`/`sendBatch` client you'd use inside
+ * a Worker — no Worker host and no minted token.
+ *
+ * @example Seeding a queue from an Action
+ * ```typescript
+ * const Seed = Alchemy.Action(
+ *   "Seed",
+ *   Effect.gen(function* () {
+ *     const q = yield* Cloudflare.Queues.WriteQueue(queue);
+ *     return Effect.fn(function* () {
+ *       yield* q.send({ text: "hi", sentAt: Date.now() });
+ *       yield* q.sendBatch([{ body: { event: "click", id: 1 } }]);
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.Queues.WriteQueueLocal)),
+ * );
+ * ```
+ *
+ * The queue id is resolved at apply time through the ambient
+ * {@link RuntimeContext} (in an Action, that's the resolve context the engine
+ * provides around the body), so `WriteQueue(queue)` works even though the
+ * queue is created in the same deploy.
+ */
+export const WriteQueueLocal = Layer.effect(
+  WriteQueue,
+  Effect.gen(function* () {
+    // Account + credentials are ambient during stack-eval (the stack's
+    // providers layer). Capture the full context so the bulk-push effect can
+    // run with the current credentials instead of a scoped token.
+    const { accountId } = yield* yield* CloudflareEnvironment;
+    const context = yield* Effect.context<
+      Credentials | HttpClient.HttpClient
+    >();
+
+    return Effect.fn(function* (queue: Queue) {
+      // Deferred accessor — resolves the queueId against the tracker at apply
+      // time. No `host.bind`: the local variant registers no binding.
+      const queueId = yield* queue.queueId;
+
+      return makeWriteQueueHttpClient(
+        {
+          authorize: (eff) => eff.pipe(Effect.provideContext(context)),
+          accountId: Effect.succeed(accountId),
+        },
+        queueId,
+      );
+    });
+  }),
+);

package/src/Cloudflare/Queues/index.ts

@@ -5,4 +5,5 @@ export * from "./QueueTypes.ts";
 export * from "./WriteQueue.ts";
 export * from "./WriteQueueBinding.ts";
 export * from "./WriteQueueHttp.ts";
+export * from "./WriteQueueLocal.ts";
 export * from "./Subscription.ts";

package/src/Cloudflare/R2/Bucket.ts

@@ -1136,16 +1136,18 @@ export const BucketProvider = () =>
 // sub-resource endpoints (custom domains, lifecycle) accept it. Retry only
 // that narrow `NoSuchBucket` lag here; not-found sub-resources are still
 // treated as terminal for idempotent deletes.
-const r2BucketEndpointConsistencySchedule = Schedule.exponential(100).pipe(
-  Schedule.both(Schedule.recurs(5)),
-);
+const r2BucketEndpointConsistencySchedule = Schedule.max([
+  Schedule.exponential(100),
+  Schedule.recurs(5),
+]);
 
 // R2 sub-resource reads (notably the custom-domain endpoint, which touches the
 // bucket's public-access policy) can return a transient 500 ("Failed to access
 // or modify the bucket policy"). Ride out the blip with a short bounded retry.
-const r2TransientServerErrorSchedule = Schedule.exponential("500 millis").pipe(
-  Schedule.both(Schedule.recurs(6)),
-);
+const r2TransientServerErrorSchedule = Schedule.max([
+  Schedule.exponential("500 millis"),
+  Schedule.recurs(6),
+]);
 
 // Distilled widened generated string enums to open unions (`string & {}`); the
 // API only ever returns the known variants, narrowed in `toCustomDomainAttributes`.
@@ -1266,6 +1268,7 @@ const toLifecyclePutPayload = (
 // consistency and retry it on create. Releasing a custom domain after delete
 // can lag a few seconds, so give the conflict a longer, bounded budget than
 // the bucket-endpoint lag above.
-const r2CustomDomainConflictSchedule = Schedule.spaced("2 seconds").pipe(
-  Schedule.both(Schedule.recurs(8)),
-);
+const r2CustomDomainConflictSchedule = Schedule.max([
+  Schedule.spaced("2 seconds"),
+  Schedule.recurs(8),
+]);

package/src/Cloudflare/R2/BucketEventNotification.ts

@@ -456,9 +456,10 @@ export const BucketEventNotificationProvider = () =>
 // R2 can make a freshly-created bucket/queue visible to its own endpoints
 // before the event-notification endpoints accept it. Retry only that narrow
 // not-found lag with a bounded budget.
-const r2EventNotificationConsistencySchedule = Schedule.exponential(250).pipe(
-  Schedule.both(Schedule.recurs(6)),
-);
+const r2EventNotificationConsistencySchedule = Schedule.max([
+  Schedule.exponential(250),
+  Schedule.recurs(6),
+]);
 
 type ObservedBucket = NonNullable<r2.ListBucketsResponse["buckets"]>[number];
 

package/src/Cloudflare/R2/BucketHttp.ts

@@ -1,13 +1,30 @@
 import * as Effect from "effect/Effect";
 import type * as Redacted from "effect/Redacted";
 import * as Stream from "effect/Stream";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
 import { Self } from "../../Self.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
 import { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
 import type { PermissionGroupRef } from "../ApiToken/Common.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
 import type { Bucket } from "./Bucket.ts";
 import { R2Error, type R2Object } from "./BucketTypes.ts";
 
+/**
+ * Injectable auth used by the R2 HTTP client builders. Both the token-scoped
+ * `*Http` layers and the current-credentials `*Local` layers build one of
+ * these so they can share the exact same client implementation.
+ */
+export interface R2Auth {
+  /** Provide credentials + HTTP client to a raw distilled R2 op. */
+  authorize: <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+  ) => Effect.Effect<A, E, RuntimeContext>;
+  /** Resolve the Cloudflare account id. */
+  accountId: Effect.Effect<string>;
+}
+
 export const makeHttpBucketBinding = <Client>(options: {
   permissionGroups: PermissionGroup[];
   makeClient: (
@@ -66,16 +83,16 @@ type PermissionGroup = (typeof R2_HTTP_PERMISSION_GROUPS)[number];
 
 /** Resolve the account, bucket, and jurisdiction once per operation. */
 export const makeR2HttpScope = (
-  token: HttpToken,
+  accountId: Effect.Effect<string>,
   bucketName: Effect.Effect<string>,
   jurisdiction: Effect.Effect<string>,
 ): Effect.Effect<HttpScope> =>
   Effect.gen(function* () {
-    const accountId = yield* token.accountId;
+    const accountId_ = yield* accountId;
     const bucket = yield* bucketName;
     const j = yield* jurisdiction;
     return {
-      accountId,
+      accountId: accountId_,
       bucketName: bucket,
       cfR2Jurisdiction: j === "default" ? undefined : j,
     };

package/src/Cloudflare/R2/BucketLocal.ts

@@ -0,0 +1,47 @@
+import * as Effect from "effect/Effect";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
+import type { Bucket } from "./Bucket.ts";
+import type { R2Auth } from "./BucketHttp.ts";
+
+/**
+ * Shared scaffolding for the R2 `*Local` binding layers.
+ *
+ * Resolves the account + captures the ambient current-credentials context at
+ * layer construction, then returns the deferred binding callable. The callable
+ * reads the bucket name/jurisdiction as deferred accessors (resolved at apply
+ * time) and builds the same HTTP-backed client the `*Http` variant uses, but
+ * authorized with the current CLI credentials instead of a minted token.
+ *
+ * NOT exported from `index.ts`.
+ */
+export const makeLocalBucketBinding = <Client>(makeClient: {
+  (
+    auth: R2Auth,
+    bucketName: Effect.Effect<string>,
+    jurisdiction: Effect.Effect<string>,
+  ): Client;
+}) =>
+  Effect.gen(function* () {
+    // Account + credentials are ambient during stack-eval (the stack's
+    // providers layer). Capture the full context so each op can be run with the
+    // current credentials.
+    const { accountId } = yield* yield* CloudflareEnvironment;
+    const context = yield* Effect.context<
+      Credentials | HttpClient.HttpClient
+    >();
+
+    const auth: R2Auth = {
+      authorize: (eff) => eff.pipe(Effect.provideContext(context)),
+      accountId: Effect.succeed(accountId),
+    };
+
+    return Effect.fn(function* (bucket: Bucket) {
+      // Deferred accessors — resolved against the tracker at apply time. No
+      // `host.bind`: the local variant registers no binding.
+      const bucketName = yield* bucket.bucketName;
+      const jurisdiction = yield* bucket.jurisdiction;
+      return makeClient(auth, bucketName, jurisdiction);
+    });
+  });

package/src/Cloudflare/R2/DataCatalog.ts

@@ -373,9 +373,10 @@ export const DataCatalogProvider = () =>
 
 // A freshly-created bucket (or freshly-enabled catalog) can briefly 404 on
 // the r2-catalog endpoints before the warehouse propagates.
-const catalogConsistencySchedule = Schedule.exponential(100).pipe(
-  Schedule.both(Schedule.recurs(5)),
-);
+const catalogConsistencySchedule = Schedule.max([
+  Schedule.exponential(100),
+  Schedule.recurs(5),
+]);
 
 /**
  * Read a catalog by bucket name, mapping "gone" (`WarehouseNotFound`, code

package/src/Cloudflare/R2/ReadBucketHttp.ts

@@ -9,7 +9,7 @@ import {
   makeR2HttpScope,
   toR2Error,
   type HttpMetadata,
-  type HttpToken,
+  type R2Auth,
 } from "./BucketHttp.ts";
 import { ReadBucket, type ReadBucketClient } from "./ReadBucket.ts";
 import {
@@ -29,18 +29,23 @@ export const ReadBucketHttp = Layer.effect(
   Effect.suspend(() =>
     makeHttpBucketBinding({
       permissionGroups: ["Workers R2 Storage Read"],
-      makeClient: makeReadR2HttpClient,
+      makeClient: (token, bucketName, jurisdiction) =>
+        makeReadR2HttpClient(
+          { authorize: authorizeWith(token), accountId: token.accountId },
+          bucketName,
+          jurisdiction,
+        ),
     }),
   ),
 );
 
 export const makeReadR2HttpClient = (
-  token: HttpToken,
+  auth: R2Auth,
   bucketName: Effect.Effect<string>,
   jurisdiction: Effect.Effect<string>,
 ): ReadBucketClient => {
-  const authorize = authorizeWith(token);
-  const scope = makeR2HttpScope(token, bucketName, jurisdiction);
+  const authorize = auth.authorize;
+  const scope = makeR2HttpScope(auth.accountId, bucketName, jurisdiction);
 
   return {
     raw: Effect.die(

package/src/Cloudflare/R2/ReadBucketLocal.ts

@@ -0,0 +1,33 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeLocalBucketBinding } from "./BucketLocal.ts";
+import { ReadBucket } from "./ReadBucket.ts";
+import { makeReadR2HttpClient } from "./ReadBucketHttp.ts";
+
+/**
+ * Local implementation of the {@link ReadBucket} binding — reads R2 objects
+ * over the Cloudflare HTTP API using the **current credentials** instead of a
+ * native Worker binding (`ReadBucketBinding`) or a scoped API token
+ * (`ReadBucketHttp`).
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) to read a bucket
+ * with the same `head`/`get`/`list` client you'd use inside a Worker.
+ *
+ * @example Reading an object from an Action
+ * ```typescript
+ * const Read = Alchemy.Action(
+ *   "Read",
+ *   Effect.gen(function* () {
+ *     const r2 = yield* Cloudflare.R2.ReadBucket(bucket);
+ *     return Effect.fn(function* () {
+ *       const object = yield* r2.get("hello.txt");
+ *       return object ? yield* object.text() : null;
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.R2.ReadBucketLocal)),
+ * );
+ * ```
+ */
+export const ReadBucketLocal = Layer.effect(
+  ReadBucket,
+  Effect.suspend(() => makeLocalBucketBinding(makeReadR2HttpClient)),
+);

package/src/Cloudflare/R2/ReadWriteBucketHttp.ts

@@ -1,6 +1,7 @@
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { makeHttpBucketBinding, type HttpToken } from "./BucketHttp.ts";
+import { authorizeWith } from "../HttpClientUtils.ts";
+import { makeHttpBucketBinding, type R2Auth } from "./BucketHttp.ts";
 import { makeReadR2HttpClient } from "./ReadBucketHttp.ts";
 import {
   ReadWriteBucket,
@@ -18,18 +19,23 @@ export const ReadWriteBucketHttp = Layer.effect(
   Effect.suspend(() =>
     makeHttpBucketBinding({
       permissionGroups: ["Workers R2 Storage Read", "Workers R2 Storage Write"],
-      makeClient: makeReadWriteR2HttpClient,
+      makeClient: (token, bucketName, jurisdiction) =>
+        makeReadWriteR2HttpClient(
+          { authorize: authorizeWith(token), accountId: token.accountId },
+          bucketName,
+          jurisdiction,
+        ),
     }),
   ),
 );
 
 /** Build the HTTP-backed {@link ReadWrite} over a bound token + bucket. */
 export const makeReadWriteR2HttpClient = (
-  token: HttpToken,
+  auth: R2Auth,
   bucketName: Effect.Effect<string>,
   jurisdiction: Effect.Effect<string>,
 ): ReadWriteBucketClient =>
   ({
-    ...makeReadR2HttpClient(token, bucketName, jurisdiction),
-    ...makeWriteR2HttpClient(token, bucketName, jurisdiction),
+    ...makeReadR2HttpClient(auth, bucketName, jurisdiction),
+    ...makeWriteR2HttpClient(auth, bucketName, jurisdiction),
   }) satisfies ReadWriteBucketClient;

package/src/Cloudflare/R2/ReadWriteBucketLocal.ts

@@ -0,0 +1,36 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeLocalBucketBinding } from "./BucketLocal.ts";
+import { ReadWriteBucket } from "./ReadWriteBucket.ts";
+import { makeReadWriteR2HttpClient } from "./ReadWriteBucketHttp.ts";
+
+/**
+ * Local implementation of the {@link ReadWriteBucket} binding — reads and
+ * writes R2 objects over the Cloudflare HTTP API using the **current
+ * credentials** instead of a native Worker binding (`ReadWriteBucketBinding`)
+ * or a scoped API token (`ReadWriteBucketHttp`).
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) to use the same
+ * `head`/`get`/`list`/`put`/`delete` client you'd use inside a Worker.
+ * Multipart uploads are unsupported over the HTTP API (mirrors
+ * `ReadWriteBucketHttp`).
+ *
+ * @example Seeding then reading a bucket from an Action
+ * ```typescript
+ * const Seed = Alchemy.Action(
+ *   "Seed",
+ *   Effect.gen(function* () {
+ *     const r2 = yield* Cloudflare.R2.ReadWriteBucket(bucket);
+ *     return Effect.fn(function* () {
+ *       yield* r2.put("hello.txt", "Hello, World!");
+ *       const object = yield* r2.get("hello.txt");
+ *       return object ? yield* object.text() : null;
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.R2.ReadWriteBucketLocal)),
+ * );
+ * ```
+ */
+export const ReadWriteBucketLocal = Layer.effect(
+  ReadWriteBucket,
+  Effect.suspend(() => makeLocalBucketBinding(makeReadWriteR2HttpClient)),
+);

package/src/Cloudflare/R2/WriteBucketHttp.ts

@@ -10,7 +10,7 @@ import {
   readHttpMetadata,
   toBody,
   toR2Error,
-  type HttpToken,
+  type R2Auth,
 } from "./BucketHttp.ts";
 import { R2Error, type PutOptions } from "./BucketTypes.ts";
 import { WriteBucket, type WriteBucketClient } from "./WriteBucket.ts";
@@ -25,19 +25,24 @@ export const WriteBucketHttp = Layer.effect(
   Effect.suspend(() =>
     makeHttpBucketBinding({
       permissionGroups: ["Workers R2 Storage Write"],
-      makeClient: makeWriteR2HttpClient,
+      makeClient: (token, bucketName, jurisdiction) =>
+        makeWriteR2HttpClient(
+          { authorize: authorizeWith(token), accountId: token.accountId },
+          bucketName,
+          jurisdiction,
+        ),
     }),
   ),
 );
 
 /** Build the write half of the HTTP-backed {@link ReadWrite} client. */
 export const makeWriteR2HttpClient = (
-  token: HttpToken,
+  auth: R2Auth,
   bucketName: Effect.Effect<string>,
   jurisdiction: Effect.Effect<string>,
 ): WriteBucketClient => {
-  const authorize = authorizeWith(token);
-  const scope = makeR2HttpScope(token, bucketName, jurisdiction);
+  const authorize = auth.authorize;
+  const scope = makeR2HttpScope(auth.accountId, bucketName, jurisdiction);
 
   return {
     put: ((

package/src/Cloudflare/R2/WriteBucketLocal.ts

@@ -0,0 +1,33 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeLocalBucketBinding } from "./BucketLocal.ts";
+import { WriteBucket } from "./WriteBucket.ts";
+import { makeWriteR2HttpClient } from "./WriteBucketHttp.ts";
+
+/**
+ * Local implementation of the {@link WriteBucket} binding — writes R2 objects
+ * over the Cloudflare HTTP API using the **current credentials** instead of a
+ * native Worker binding (`WriteBucketBinding`) or a scoped API token
+ * (`WriteBucketHttp`).
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) to write a bucket
+ * with the same `put`/`delete` client you'd use inside a Worker. Multipart
+ * uploads are unsupported over the HTTP API (mirrors `WriteBucketHttp`).
+ *
+ * @example Seeding a bucket from an Action
+ * ```typescript
+ * const Seed = Alchemy.Action(
+ *   "Seed",
+ *   Effect.gen(function* () {
+ *     const r2 = yield* Cloudflare.R2.WriteBucket(bucket);
+ *     return Effect.fn(function* () {
+ *       yield* r2.put("hello.txt", "Hello, World!");
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.R2.WriteBucketLocal)),
+ * );
+ * ```
+ */
+export const WriteBucketLocal = Layer.effect(
+  WriteBucket,
+  Effect.suspend(() => makeLocalBucketBinding(makeWriteR2HttpClient)),
+);