alchemy 2.0.0-beta.61 → 2.0.0-beta.63

package/src/Cloudflare/R2/index.ts

@@ -5,9 +5,12 @@ export * from "./DataCatalog.ts";
 export * from "./ReadBucket.ts";
 export * from "./ReadBucketBinding.ts";
 export * from "./ReadBucketHttp.ts";
+export * from "./ReadBucketLocal.ts";
 export * from "./ReadWriteBucket.ts";
 export * from "./ReadWriteBucketBinding.ts";
 export * from "./ReadWriteBucketHttp.ts";
+export * from "./ReadWriteBucketLocal.ts";
 export * from "./WriteBucket.ts";
 export * from "./WriteBucketBinding.ts";
 export * from "./WriteBucketHttp.ts";
+export * from "./WriteBucketLocal.ts";

package/src/Cloudflare/Rum/Rule.ts

@@ -274,9 +274,10 @@ export const RuleProvider = () =>
             // visible. Ride out the propagation window with a bounded retry.
             Effect.retry({
               while: (e) => e._tag === "RulesetNotFound",
-              schedule: Schedule.exponential("500 millis").pipe(
-                Schedule.both(Schedule.recurs(8)),
-              ),
+              schedule: Schedule.max([
+                Schedule.exponential("500 millis"),
+                Schedule.recurs(8),
+              ]),
             }),
           );
         const fresh = yield* listRules(accountId, rulesetId);

package/src/Cloudflare/Snippets/Snippet.ts

@@ -256,9 +256,10 @@ export const SnippetProvider = () =>
         .pipe(
           Effect.retry({
             while: (e) => e._tag === "SnippetInUse",
-            schedule: Schedule.exponential("1 second").pipe(
-              Schedule.both(Schedule.recurs(8)),
-            ),
+            schedule: Schedule.max([
+              Schedule.exponential("1 second"),
+              Schedule.recurs(8),
+            ]),
           }),
           Effect.catchTag("SnippetNotFound", () => Effect.void),
         );

package/src/Cloudflare/StateStore/CredentialsFile.ts

@@ -0,0 +1,48 @@
+import type { HttpStateStoreCredentials } from "../../State/HttpStateStore.ts";
+
+/**
+ * Filename (under `~/.alchemy/credentials/{profile}/`) used to cache the
+ * Cloudflare-deployed HTTP state store's endpoint + bearer token.
+ *
+ * Kept in this leaf module (rather than `StateStore/State.ts`) so the
+ * Cloudflare auth provider can invalidate the cache on
+ * `login --configure` / `logout` without importing the heavy state-store
+ * module and creating an import cycle
+ * (`StateStore/State.ts` -> `Providers.ts` -> `Auth/AuthProvider.ts`).
+ */
+export const CREDENTIALS_FILE = "cloudflare-state-store";
+
+/**
+ * On-disk shape of the cached Cloudflare state-store credentials.
+ *
+ * Extends the generic {@link HttpStateStoreCredentials} (`{ url, authToken }`)
+ * with the `accountId` the credentials were minted against. The `url` already
+ * encodes the account (via the `*.workers.dev` subdomain), so a cache written
+ * while logged into account A keeps pointing at account A's state store even
+ * after the user re-authenticates against account B. Persisting `accountId`
+ * lets `state()` detect that mismatch and re-derive.
+ *
+ * `accountId` is optional so legacy files written before this field existed
+ * still parse — they are treated as stale (see
+ * {@link isStateStoreCredentialsStale}) and re-derived on next use.
+ */
+export interface StoredStateStoreCredentials extends HttpStateStoreCredentials {
+  /** Cloudflare account ID the `url`/`authToken` were minted against. */
+  accountId?: string;
+}
+
+/**
+ * `true` when cached state-store credentials must not be trusted for the
+ * current account:
+ *
+ * - the file predates the `accountId` field (legacy cache — exactly the
+ *   artifact that caused deploys to silently target the wrong account), or
+ * - it was minted against a different account than the one now in use.
+ *
+ * A stale cache is discarded and re-derived from the current account.
+ */
+export const isStateStoreCredentialsStale = (
+  credentials: StoredStateStoreCredentials,
+  currentAccountId: string,
+): boolean =>
+  credentials.accountId == null || credentials.accountId !== currentAccountId;

package/src/Cloudflare/StateStore/State.ts

@@ -39,6 +39,11 @@ import * as Access from "../Access.ts";
 import * as CloudflareEnvironment from "../CloudflareEnvironment.ts";
 import { EdgeSessionError, createEdgeSession } from "../EdgeSession.ts";
 import Api, { STATE_STORE_SCRIPT_NAME, STATE_STORE_VERSION } from "./Api.ts";
+import {
+  CREDENTIALS_FILE,
+  type StoredStateStoreCredentials,
+  isStateStoreCredentialsStale,
+} from "./CredentialsFile.ts";
 import {
   AuthToken,
   AuthTokenSecretName,
@@ -48,9 +53,6 @@ import {
 
 const CI = Config.boolean("CI").pipe(Config.withDefault(false));
 
-/** Filename used for stored credentials under the profile directory. */
-const CREDENTIALS_FILE = "cloudflare-state-store";
-
 export const state = () =>
   Layer.effect(
     State,
@@ -173,15 +175,32 @@ export const state = () =>
             return yield* makeCloudflareStateStore(credentials);
           });
 
-        const credentials = yield* credStore.read<HttpStateStoreCredentials>(
+        const { accountId } =
+          yield* yield* CloudflareEnvironment.CloudflareEnvironment;
+
+        const credentials = yield* credStore.read<StoredStateStoreCredentials>(
           profileName,
           CREDENTIALS_FILE,
         );
         if (credentials) {
-          return yield* ensureLatest(credentials);
+          // The cached `url`/`authToken` are minted per-account (the `url`
+          // encodes the account via its workers.dev subdomain). If the
+          // active account changed since they were written — or the file
+          // predates the `accountId` field — trusting the cache would
+          // silently read/write state in the wrong account, so discard it
+          // and fall through to re-derivation from the current account.
+          if (isStateStoreCredentialsStale(credentials, accountId)) {
+            yield* Clank.info(
+              `Cloudflare State Store credentials were minted for a different ` +
+                `Cloudflare account; re-deriving for the current account.`,
+            );
+            yield* credStore
+              .delete(profileName, CREDENTIALS_FILE)
+              .pipe(Effect.ignore);
+          } else {
+            return yield* ensureLatest(credentials);
+          }
         }
-        const { accountId } =
-          yield* yield* CloudflareEnvironment.CloudflareEnvironment;
         if (yield* isStateStoreServing(accountId)) {
           return yield* ensureLatest(
             yield* loginWithCloudflare(profileName, false),
@@ -283,7 +302,7 @@ export const bootstrap = (options: BootstrapOptions = {}) =>
       if (!isCI) {
         // we don't write credentials in CI because the file system is ephemeral
         const store = yield* CredentialsStore;
-        yield* store.write<HttpStateStoreCredentials>(
+        yield* store.write<StoredStateStoreCredentials>(
           profileName,
           CREDENTIALS_FILE,
           credentials,
@@ -667,9 +686,10 @@ const hoistBootstrapStack = Effect.fn(function* ({
               // Secrets Store bindings) can take a while to serve
               // consistently; anything persisting past that is a real
               // failure to surface, not to spin on.
-              schedule: Schedule.fixed(500).pipe(
-                Schedule.both(Schedule.recurs(60)),
-              ),
+              schedule: Schedule.max([
+                Schedule.fixed(500),
+                Schedule.recurs(60),
+              ]),
             }),
           );
       }
@@ -703,11 +723,17 @@ export const loginWithCloudflare = (profileName: string, force: boolean) =>
 
     if (!force) {
       // try and read from the cached credentials first if not forcing (force will always refresh)
-      const credentials = yield* credStore.read<HttpStateStoreCredentials>(
+      const credentials = yield* credStore.read<StoredStateStoreCredentials>(
         profileName,
         CREDENTIALS_FILE,
       );
-      if (credentials) {
+      // Ignore a cache minted for a different account (or a legacy file with
+      // no `accountId`) — reusing it would hand back the wrong account's
+      // state-store URL. Fall through to re-derive against `accountId`.
+      if (
+        credentials &&
+        !isStateStoreCredentialsStale(credentials, accountId)
+      ) {
         return credentials;
       }
     }
@@ -736,10 +762,13 @@ export const loginWithCloudflare = (profileName: string, force: boolean) =>
           isTransientEdgeSessionError(error),
         // Cap the exponential delay at 2s so 15 retries stay within
         // ~30s instead of doubling unboundedly.
-        schedule: Schedule.exponential(200).pipe(
-          Schedule.either(Schedule.spaced("2 seconds")),
-          Schedule.both(Schedule.recurs(15)),
-        ),
+        schedule: Schedule.max([
+          Schedule.min([
+            Schedule.exponential(200),
+            Schedule.spaced("2 seconds"),
+          ]),
+          Schedule.recurs(15),
+        ]),
       }),
     );
 
@@ -751,9 +780,10 @@ export const loginWithCloudflare = (profileName: string, force: boolean) =>
       // 4. Persist credentials. The profile entry is managed by
       //    `loadOrConfigure` when this is invoked through `configure`.
       yield* credStore
-        .write<HttpStateStoreCredentials>(profileName, CREDENTIALS_FILE, {
+        .write<StoredStateStoreCredentials>(profileName, CREDENTIALS_FILE, {
           url,
           authToken: authToken.trim(),
+          accountId,
         })
         .pipe(
           Effect.mapError(
@@ -774,6 +804,7 @@ export const loginWithCloudflare = (profileName: string, force: boolean) =>
     return {
       url,
       authToken: authToken.trim(),
+      accountId,
     };
   }).pipe(
     Effect.catchTag("EdgeSessionError", (e) =>
@@ -871,9 +902,10 @@ const waitForStateStoreVersion = (url: string) =>
       // Edge propagation is usually sub-second but production traces
       // show redeploys occasionally serving the old version for well
       // over 10s. Poll for ~30s before failing loudly.
-      schedule: Schedule.spaced("500 millis").pipe(
-        Schedule.both(Schedule.recurs(60)),
-      ),
+      schedule: Schedule.max([
+        Schedule.spaced("500 millis"),
+        Schedule.recurs(60),
+      ]),
     }),
     Effect.withSpan("state_store.wait_for_version", {
       attributes: {
@@ -911,9 +943,10 @@ const checkStateStoreVersion = (url: string) =>
           : Effect.fail(e),
       ),
       Effect.retry({
-        schedule: Schedule.spaced("250 millis").pipe(
-          Schedule.both(Schedule.recurs(40)),
-        ),
+        schedule: Schedule.max([
+          Schedule.spaced("250 millis"),
+          Schedule.recurs(40),
+        ]),
       }),
       Effect.catch(() => Effect.succeed(undefined)),
     );
@@ -1022,12 +1055,15 @@ const writeCredentials = (url: string, authToken: string) =>
   Effect.gen(function* () {
     const profileName = yield* ALCHEMY_PROFILE;
     const credStore = yield* CredentialsStore;
-    yield* credStore.write<HttpStateStoreCredentials>(
+    const { accountId } =
+      yield* yield* CloudflareEnvironment.CloudflareEnvironment;
+    yield* credStore.write<StoredStateStoreCredentials>(
       profileName,
       CREDENTIALS_FILE,
       {
         url,
         authToken,
+        accountId,
       },
     );
   });

package/src/Cloudflare/Tags/ZoneResourceTags.ts

@@ -21,9 +21,10 @@ type TypeId = typeof TypeId;
 // calls on that typed tag so reconcile waits out the propagation window.
 const targetVisibleRetry = {
   while: (e: { _tag: string }) => e._tag === "ZoneTagResourceNotFound",
-  schedule: Schedule.exponential("500 millis").pipe(
-    Schedule.both(Schedule.recurs(10)),
-  ),
+  schedule: Schedule.max([
+    Schedule.exponential("500 millis"),
+    Schedule.recurs(10),
+  ]),
 } as const;
 
 /**

package/src/Cloudflare/Tunnel/ReadTunnel.ts

@@ -15,8 +15,7 @@ import * as Binding from "../../Binding.ts";
 import type { Worker } from "../Workers/Worker.ts";
 import type { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { RuntimeContext } from "../../RuntimeContext.ts";
-import { type Token } from "./TunnelBinding.ts";
-import { authorizeWith } from "../HttpClientUtils.ts";
+import { type TunnelAuth } from "./TunnelBinding.ts";
 
 /**
  * Binding that lets a Worker read Cloudflare Tunnels at runtime.
@@ -117,31 +116,31 @@ export interface ReadTunnelClient {
   >;
 }
 
-/** Build the read-only client over a bound token. */
-export const readClient = (token: Token): ReadTunnelClient => {
-  const authorize = authorizeWith(token);
+/** Build the read-only client over an injectable {@link TunnelAuth}. */
+export const readClient = (auth: TunnelAuth): ReadTunnelClient => {
+  const { authorize } = auth;
   return {
     get: Effect.fn("Cloudflare.Tunnel.get")(function* (tunnelId) {
-      const accountId = yield* token.accountId;
+      const accountId = yield* auth.accountId;
       return yield* authorize(
         zeroTrust.getTunnelCloudflared({ accountId, tunnelId }),
       );
     }),
     list: Effect.fn("Cloudflare.Tunnel.list")(function* (request) {
-      const accountId = yield* token.accountId;
+      const accountId = yield* auth.accountId;
       return yield* authorize(
         zeroTrust.listTunnelCloudflareds({ accountId, ...request }),
       );
     }),
     getToken: Effect.fn("Cloudflare.Tunnel.getToken")(function* (tunnelId) {
-      const accountId = yield* token.accountId;
+      const accountId = yield* auth.accountId;
       return yield* authorize(
         zeroTrust.getTunnelCloudflaredToken({ accountId, tunnelId }),
       );
     }),
     getConfiguration: Effect.fn("Cloudflare.Tunnel.getConfiguration")(
       function* (tunnelId) {
-        const accountId = yield* token.accountId;
+        const accountId = yield* auth.accountId;
         return yield* authorize(
           zeroTrust.getTunnelCloudflaredConfiguration({ accountId, tunnelId }),
         );

package/src/Cloudflare/Tunnel/ReadTunnelLocal.ts

@@ -0,0 +1,33 @@
+import * as Layer from "effect/Layer";
+import { readClient, ReadTunnel } from "./ReadTunnel.ts";
+import { makeLocalTunnelClient } from "./TunnelLocalBinding.ts";
+
+/**
+ * Local implementation of the {@link ReadTunnel} binding — reads Cloudflare
+ * Tunnels over the cfd_tunnel HTTP API using the **current credentials**
+ * instead of a native Worker binding (`ReadTunnelBinding`) or a scoped API
+ * token. No `host.bind`, no minted token, no Worker host.
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) so you can read
+ * tunnels with the same `get`/`list`/`getToken`/`getConfiguration` client you'd
+ * use inside a Worker.
+ *
+ * @example Read a tunnel's connector token from an Action
+ * ```typescript
+ * const Inspect = Alchemy.Action(
+ *   "Inspect",
+ *   Effect.gen(function* () {
+ *     const tunnels = yield* Cloudflare.Tunnel.ReadTunnel();
+ *     const tunnelId = yield* tunnel.tunnelId;
+ *     return Effect.fn(function* () {
+ *       const t = yield* tunnels.get(yield* tunnelId);
+ *       return t.result?.name;
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.Tunnel.ReadTunnelLocal)),
+ * );
+ * ```
+ */
+export const ReadTunnelLocal = Layer.effect(
+  ReadTunnel,
+  makeLocalTunnelClient(readClient),
+);

package/src/Cloudflare/Tunnel/ReadWriteTunnel.ts

@@ -2,7 +2,7 @@ import * as Effect from "effect/Effect";
 import * as Binding from "../../Binding.ts";
 import type { Worker } from "../Workers/Worker.ts";
 import type { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
-import { type Token } from "./TunnelBinding.ts";
+import { type TunnelAuth } from "./TunnelBinding.ts";
 import { readClient, type ReadTunnelClient } from "./ReadTunnel.ts";
 import { writeClient, type WriteTunnelClient } from "./WriteTunnel.ts";
 
@@ -68,8 +68,8 @@ export const ReadWriteTunnel = Binding.Service<ReadWriteTunnel>(
 export interface ReadWriteTunnelClient
   extends ReadTunnelClient, WriteTunnelClient {}
 
-/** Build the combined read + write client over a bound token. */
-export const readWriteClient = (token: Token): ReadWriteTunnelClient => ({
-  ...readClient(token),
-  ...writeClient(token),
+/** Build the combined read + write client over an injectable {@link TunnelAuth}. */
+export const readWriteClient = (auth: TunnelAuth): ReadWriteTunnelClient => ({
+  ...readClient(auth),
+  ...writeClient(auth),
 });

package/src/Cloudflare/Tunnel/ReadWriteTunnelLocal.ts

@@ -0,0 +1,39 @@
+import * as Layer from "effect/Layer";
+import { readWriteClient, ReadWriteTunnel } from "./ReadWriteTunnel.ts";
+import { makeLocalTunnelClient } from "./TunnelLocalBinding.ts";
+
+/**
+ * Local implementation of the {@link ReadWriteTunnel} binding — performs the
+ * full cfd_tunnel CRUD surface over the HTTP API using the **current
+ * credentials** instead of a native Worker binding (`ReadWriteTunnelBinding`)
+ * or a scoped API token. No `host.bind`, no minted token, no Worker host.
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) so you can manage
+ * tunnels with the same combined read + write client you'd use inside a Worker.
+ *
+ * @example Configure a deployed tunnel from an Action
+ * ```typescript
+ * const Configure = Alchemy.Action(
+ *   "Configure",
+ *   Effect.gen(function* () {
+ *     const tunnels = yield* Cloudflare.Tunnel.ReadWriteTunnel();
+ *     const tunnelId = yield* tunnel.tunnelId;
+ *     return Effect.fn(function* () {
+ *       const id = yield* tunnelId;
+ *       yield* tunnels.putConfiguration(id, {
+ *         ingress: [
+ *           { hostname: "app.example.com", service: "http://localhost:3000" },
+ *           { service: "http_status:404" },
+ *         ],
+ *       });
+ *       const { config } = yield* tunnels.getConfiguration(id);
+ *       return config;
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.Tunnel.ReadWriteTunnelLocal)),
+ * );
+ * ```
+ */
+export const ReadWriteTunnelLocal = Layer.effect(
+  ReadWriteTunnel,
+  makeLocalTunnelClient(readWriteClient),
+);

package/src/Cloudflare/Tunnel/TunnelBinding.ts

@@ -1,8 +1,12 @@
 import * as Effect from "effect/Effect";
 import type * as Redacted from "effect/Redacted";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
 import { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
 import type { PermissionGroupRef } from "../ApiToken/Common.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
+import { authorizeWith } from "../HttpClientUtils.ts";
 import { Worker } from "../Workers/Worker.ts";
 
 /**
@@ -16,7 +20,7 @@ import { Worker } from "../Workers/Worker.ts";
 export const makeTunnelClient = <C>(
   sid: string,
   permissionGroups: PermissionGroupRef[],
-  makeClient: (token: Token) => C,
+  makeClient: (auth: TunnelAuth) => C,
 ) =>
   Effect.gen(function* () {
     const Token = yield* AccountApiToken;
@@ -39,10 +43,30 @@ export const makeTunnelClient = <C>(
           ],
         });
       }
-      return makeClient(yield* bindTunnelToken(token));
+      return makeClient(makeTunnelAuth(yield* bindTunnelToken(token)));
     });
   });
 
+/**
+ * Injectable auth for the tunnel client builders. Both the scoped-token
+ * (`*Binding`) and current-credentials (`*Local`) variants supply an
+ * `authorize` (which provides `Credentials` + `HttpClient` to a raw SDK op)
+ * and an `accountId`, so the client builders are agnostic to how creds are
+ * obtained.
+ */
+export interface TunnelAuth {
+  authorize: <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+  ) => Effect.Effect<A, E, RuntimeContext>;
+  accountId: Effect.Effect<string>;
+}
+
+/** Build a scoped-token {@link TunnelAuth} from a bound {@link Token}. */
+export const makeTunnelAuth = (token: Token): TunnelAuth => ({
+  authorize: authorizeWith(token),
+  accountId: token.accountId,
+});
+
 /**
  * Runtime accessors for a tunnel binding's token, obtained by binding the
  * {@link AccountApiToken}'s outputs in the Worker's Init phase. Each accessor

package/src/Cloudflare/Tunnel/TunnelLocalBinding.ts

@@ -0,0 +1,38 @@
+import * as Effect from "effect/Effect";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
+import type { TunnelAuth } from "./TunnelBinding.ts";
+
+/**
+ * Shared scaffolding for the `*Local` tunnel services.
+ *
+ * Instead of minting a scoped {@link AccountApiToken} (the `*Binding` path), it
+ * captures the ambient current-credentials context available during stack-eval
+ * and builds a {@link TunnelAuth} that provides those credentials directly to
+ * the cfd_tunnel HTTP ops. It then delegates to the same client builders the
+ * `*Binding` variant uses.
+ *
+ * NOT exported from `index.ts` — this is internal scaffolding shared by the
+ * three access-level Local layers.
+ */
+export const makeLocalTunnelClient = <Client>(
+  makeClient: (auth: TunnelAuth) => Client,
+) =>
+  Effect.gen(function* () {
+    // Account + credentials are ambient during stack-eval (the stack's
+    // providers layer). Capture the full context so cfd_tunnel HTTP ops can run
+    // with the current credentials — no `host.bind`, no minted token.
+    const { accountId } = yield* yield* CloudflareEnvironment;
+    const context = yield* Effect.context<
+      Credentials | HttpClient.HttpClient
+    >();
+
+    return Effect.fn(function* () {
+      const auth: TunnelAuth = {
+        authorize: (eff) => eff.pipe(Effect.provideContext(context)),
+        accountId: Effect.succeed(accountId),
+      };
+      return makeClient(auth);
+    });
+  });

package/src/Cloudflare/Tunnel/WarpConnector.ts

@@ -6,6 +6,7 @@ import * as Redacted from "effect/Redacted";
 import * as Stream from "effect/Stream";
 
 import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
@@ -19,7 +20,7 @@ export interface WarpConnectorProps {
   /**
    * User-friendly name for the WARP Connector tunnel. Tunnel names are
    * unique per account, which makes the name the resource's identity
-   * during adoption and state recovery. Mutable — patched in place.
+   * during adoption and state recovery. Changing it replaces the tunnel.
    *
    * @default ${app}-${stage}-${id}
    */
@@ -85,9 +86,9 @@ export type WarpConnector = Resource<
  * ```
  *
  * @section Renaming
- * @example Rename in place
+ * @example Replace with a new name
  * ```typescript
- * // Renaming patches the existing tunnel — same tunnelId, no replacement.
+ * // Renaming creates a new tunnel with a new tunnelId.
  * const connector = yield* Cloudflare.Tunnel.WarpConnector("SiteA", {
  *   name: "site-a-connector-v2",
  * });
@@ -107,12 +108,14 @@ export const WarpConnectorProvider = () =>
   Provider.succeed(WarpConnector, {
     stables: ["tunnelId", "accountId", "createdAt"],
 
-    diff: Effect.fn(function* ({ output }) {
+    diff: Effect.fn(function* ({ olds, news, output }) {
       const { accountId } = yield* yield* CloudflareEnvironment;
       if ((output?.accountId ?? accountId) !== accountId) {
         return { action: "replace" } as const;
       }
-      // name converges via PATCH.
+      if (isResolved(news) && olds !== undefined && olds.name !== news.name) {
+        return { action: "replace" } as const;
+      }
       return undefined;
     }),
 

package/src/Cloudflare/Tunnel/WriteTunnel.ts

@@ -17,8 +17,7 @@ import * as Binding from "../../Binding.ts";
 import type { Worker } from "../Workers/Worker.ts";
 import type { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { RuntimeContext } from "../../RuntimeContext.ts";
-import { type Token } from "./TunnelBinding.ts";
-import { authorizeWith } from "../HttpClientUtils.ts";
+import { type TunnelAuth } from "./TunnelBinding.ts";
 
 /**
  * Binding that lets a Worker create, update, and delete Cloudflare Tunnels at
@@ -137,33 +136,33 @@ export interface WriteTunnelClient {
   >;
 }
 
-/** Build the write client over a bound token. */
-export const writeClient = (token: Token): WriteTunnelClient => {
-  const authorize = authorizeWith(token);
+/** Build the write client over an injectable {@link TunnelAuth}. */
+export const writeClient = (auth: TunnelAuth): WriteTunnelClient => {
+  const { authorize } = auth;
   return {
     create: Effect.fn("Cloudflare.Tunnel.create")(function* (request) {
-      const accountId = yield* token.accountId;
+      const accountId = yield* auth.accountId;
       return yield* authorize(
         zeroTrust.createTunnelCloudflared({ accountId, ...request }),
       );
     }),
     update: Effect.fn("Cloudflare.Tunnel.update")(
       function* (tunnelId, request) {
-        const accountId = yield* token.accountId;
+        const accountId = yield* auth.accountId;
         return yield* authorize(
           zeroTrust.patchTunnelCloudflared({ accountId, tunnelId, ...request }),
         );
       },
     ),
     delete: Effect.fn("Cloudflare.Tunnel.delete")(function* (tunnelId) {
-      const accountId = yield* token.accountId;
+      const accountId = yield* auth.accountId;
       return yield* authorize(
         zeroTrust.deleteTunnelCloudflared({ accountId, tunnelId }),
       );
     }),
     putConfiguration: Effect.fn("Cloudflare.Tunnel.putConfiguration")(
       function* (tunnelId, config) {
-        const accountId = yield* token.accountId;
+        const accountId = yield* auth.accountId;
         return yield* authorize(
           zeroTrust.putTunnelCloudflaredConfiguration({
             accountId,

package/src/Cloudflare/Tunnel/WriteTunnelLocal.ts

@@ -0,0 +1,33 @@
+import * as Layer from "effect/Layer";
+import { makeLocalTunnelClient } from "./TunnelLocalBinding.ts";
+import { WriteTunnel, writeClient } from "./WriteTunnel.ts";
+
+/**
+ * Local implementation of the {@link WriteTunnel} binding — creates, updates,
+ * and deletes Cloudflare Tunnels over the cfd_tunnel HTTP API using the
+ * **current credentials** instead of a native Worker binding
+ * (`WriteTunnelBinding`) or a scoped API token. No `host.bind`, no minted
+ * token, no Worker host.
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) so you can mutate
+ * tunnels with the same `create`/`update`/`delete`/`putConfiguration` client
+ * you'd use inside a Worker.
+ *
+ * @example Provision a tunnel from an Action
+ * ```typescript
+ * const Provision = Alchemy.Action(
+ *   "Provision",
+ *   Effect.gen(function* () {
+ *     const tunnels = yield* Cloudflare.Tunnel.WriteTunnel();
+ *     return Effect.fn(function* () {
+ *       const tunnel = yield* tunnels.create({ name: "on-demand-tunnel" });
+ *       return tunnel.result?.id;
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.Tunnel.WriteTunnelLocal)),
+ * );
+ * ```
+ */
+export const WriteTunnelLocal = Layer.effect(
+  WriteTunnel,
+  makeLocalTunnelClient(writeClient),
+);