alchemy 2.0.0-beta.62 → 2.0.0-beta.63

package/src/Cloudflare/Flagship/ReadFlagsHttpClient.ts

@@ -0,0 +1,183 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as flagship from "@distilled.cloud/cloudflare/flagship";
+import * as Effect from "effect/Effect";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import type { Credentials } from "../Credentials.ts";
+import {
+  type EvaluationContext,
+  type EvaluationDetails,
+  FlagshipError,
+  type ReadFlagsClient,
+} from "./ReadFlags.ts";
+
+// Shared HTTP scaffolding for the Flagship `ReadFlags` binding. NOT
+// re-exported from `index.ts` — only the contract and the impl layers are
+// public. A future token-scoped `ReadFlagsHttp` layer reuses this builder with
+// an auth minted from an `AccountApiToken`; `ReadFlagsLocal` builds the auth
+// from the ambient current-credentials context.
+
+/**
+ * Injectable auth shared by the Local (current-credentials) impl and a future
+ * Http (scoped-token) impl. `authorize` discharges the
+ * `Credentials | HttpClient` requirement of a distilled op; `accountId` is the
+ * Cloudflare account the ops run against.
+ */
+export interface FlagshipAuth {
+  authorize: <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+  ) => Effect.Effect<A, E>;
+  accountId: string;
+}
+
+/**
+ * The HTTP evaluate endpoint only supports a single `targetingKey` query
+ * param, not the full flat evaluation context the Worker binding accepts.
+ */
+const targetingKeyOf = (
+  context: EvaluationContext | undefined,
+): string | undefined => {
+  const value = context?.["targetingKey"];
+  return value === undefined ? undefined : String(value);
+};
+
+/**
+ * Build a {@link ReadFlagsClient} over the Flagship HTTP evaluate endpoint
+ * (`GET .../flagship/apps/{appId}/evaluate`).
+ *
+ * `appId` is an Effect so the resolution stays deferred to each call — inside
+ * an Action it resolves through the apply-time RuntimeContext. Mirrors the
+ * Worker binding's fall-back-to-default semantics: evaluation never fails the
+ * effect — an HTTP error or a value whose type does not match the requested
+ * method resolves to `defaultValue` instead. The `raw` runtime binding has no
+ * HTTP equivalent and dies if used.
+ */
+export const makeHttpFlagshipClient = (
+  auth: FlagshipAuth,
+  appId: Effect.Effect<string>,
+): ReadFlagsClient => {
+  const evaluate = (flagKey: string, context?: EvaluationContext) =>
+    appId.pipe(
+      Effect.flatMap((id) =>
+        auth.authorize(
+          flagship.getAppEvaluate({
+            accountId: auth.accountId,
+            appId: id,
+            flagKey,
+            targetingKey: targetingKeyOf(context),
+          }),
+        ),
+      ),
+    );
+
+  const details = <T>(
+    flagKey: string,
+    defaultValue: T,
+    match: (value: unknown) => value is T,
+    context?: EvaluationContext,
+  ): Effect.Effect<EvaluationDetails<T>, FlagshipError, RuntimeContext> =>
+    evaluate(flagKey, context).pipe(
+      Effect.map(
+        (r): EvaluationDetails<T> =>
+          match(r.value)
+            ? { flagKey, value: r.value, variant: r.variant, reason: r.reason }
+            : {
+                flagKey,
+                value: defaultValue,
+                variant: r.variant,
+                reason: r.reason,
+                errorCode: "TYPE_MISMATCH",
+              },
+      ),
+      Effect.catch((error) =>
+        Effect.succeed<EvaluationDetails<T>>({
+          flagKey,
+          value: defaultValue,
+          reason: "ERROR",
+          errorCode: error._tag,
+        }),
+      ),
+    );
+
+  const value = <T>(
+    flagKey: string,
+    defaultValue: T,
+    match: (value: unknown) => value is T,
+    context?: EvaluationContext,
+  ): Effect.Effect<T, FlagshipError, RuntimeContext> =>
+    evaluate(flagKey, context).pipe(
+      Effect.map((r) => (match(r.value) ? r.value : defaultValue)),
+      Effect.catch(() => Effect.succeed(defaultValue)),
+    );
+
+  const isBoolean = (v: unknown): v is boolean => typeof v === "boolean";
+  const isString = (v: unknown): v is string => typeof v === "string";
+  const isNumber = (v: unknown): v is number => typeof v === "number";
+  const isObjectLike = (v: unknown): boolean =>
+    v !== null && typeof v === "object";
+
+  return {
+    // The raw runtime binding is a workerd object with no HTTP surface.
+    raw: Effect.die(
+      new FlagshipError({
+        message:
+          "the raw Flagship runtime binding is unavailable over HTTP; use ReadFlagsBinding inside a Worker",
+        cause: undefined,
+      }),
+    ) as Effect.Effect<cf.Flagship, never, RuntimeContext>,
+    get: (flagKey, defaultValue, context) =>
+      evaluate(flagKey, context).pipe(
+        Effect.map((r) => r.value ?? defaultValue),
+        Effect.catch(() => Effect.succeed(defaultValue)),
+      ),
+    getBooleanValue: (flagKey, defaultValue, context) =>
+      value(flagKey, defaultValue, isBoolean, context),
+    getStringValue: (flagKey, defaultValue, context) =>
+      value(flagKey, defaultValue, isString, context),
+    getNumberValue: (flagKey, defaultValue, context) =>
+      value(flagKey, defaultValue, isNumber, context),
+    getObjectValue: (flagKey, defaultValue, context) =>
+      evaluate(flagKey, context).pipe(
+        Effect.map((r) =>
+          isObjectLike(r.value)
+            ? (r.value as typeof defaultValue)
+            : defaultValue,
+        ),
+        Effect.catch(() => Effect.succeed(defaultValue)),
+      ),
+    getBooleanDetails: (flagKey, defaultValue, context) =>
+      details(flagKey, defaultValue, isBoolean, context),
+    getStringDetails: (flagKey, defaultValue, context) =>
+      details(flagKey, defaultValue, isString, context),
+    getNumberDetails: (flagKey, defaultValue, context) =>
+      details(flagKey, defaultValue, isNumber, context),
+    getObjectDetails: (flagKey, defaultValue, context) =>
+      evaluate(flagKey, context).pipe(
+        Effect.map(
+          (r): EvaluationDetails<typeof defaultValue> =>
+            isObjectLike(r.value)
+              ? {
+                  flagKey,
+                  value: r.value as typeof defaultValue,
+                  variant: r.variant,
+                  reason: r.reason,
+                }
+              : {
+                  flagKey,
+                  value: defaultValue,
+                  variant: r.variant,
+                  reason: r.reason,
+                  errorCode: "TYPE_MISMATCH",
+                },
+        ),
+        Effect.catch((error) =>
+          Effect.succeed<EvaluationDetails<typeof defaultValue>>({
+            flagKey,
+            value: defaultValue,
+            reason: "ERROR",
+            errorCode: error._tag,
+          }),
+        ),
+      ),
+  } satisfies ReadFlagsClient;
+};

package/src/Cloudflare/Flagship/ReadFlagsLocal.ts

@@ -0,0 +1,69 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
+import type { App } from "./App.ts";
+import { ReadFlags } from "./ReadFlags.ts";
+import {
+  type FlagshipAuth,
+  makeHttpFlagshipClient,
+} from "./ReadFlagsHttpClient.ts";
+
+/**
+ * Local implementation of the {@link ReadFlags} binding — evaluates Flagship
+ * feature flags over the Cloudflare HTTP API (`GET .../flagship/apps/{appId}/evaluate`)
+ * using the **current credentials** instead of a native Worker binding
+ * ({@link ReadFlagsBinding}).
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) so you can read
+ * flag values with the same `getBooleanValue`/`getStringValue`/… client you'd
+ * use inside a Worker:
+ *
+ * @example Reading a flag from an Action
+ * ```typescript
+ * const CheckFlag = Alchemy.Action(
+ *   "CheckFlag",
+ *   Effect.gen(function* () {
+ *     const flags = yield* Cloudflare.Flagship.ReadFlags(app);
+ *     return Effect.fn(function* () {
+ *       return yield* flags.getBooleanValue("new-checkout", false);
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.Flagship.ReadFlagsLocal)),
+ * );
+ * ```
+ *
+ * The app id is resolved at apply time through the ambient {@link RuntimeContext}
+ * (in an Action, that's the resolve context the engine provides around the
+ * body), so `ReadFlags(app)` works even though the app is created in the same
+ * deploy.
+ *
+ * Limitations vs. the Worker binding: the HTTP evaluate endpoint only accepts a
+ * single `targetingKey` (read from `context.targetingKey`), so attribute-based
+ * targeting rules that key off other context fields cannot be exercised locally.
+ * The `raw` runtime binding has no HTTP equivalent and dies if used — see
+ * {@link makeHttpFlagshipClient}.
+ */
+export const ReadFlagsLocal = Layer.effect(
+  ReadFlags,
+  Effect.gen(function* () {
+    // Account + credentials are ambient during stack-eval (the stack's
+    // providers layer). Capture the full context so the evaluate op can run
+    // with the current credentials — no `host.bind`, no minted token.
+    const { accountId } = yield* yield* CloudflareEnvironment;
+    const context = yield* Effect.context<
+      Credentials | HttpClient.HttpClient
+    >();
+    const auth: FlagshipAuth = {
+      authorize: (eff) => eff.pipe(Effect.provideContext(context)),
+      accountId,
+    };
+
+    return Effect.fn(function* (app: App) {
+      // Deferred accessor — resolves the appId against the tracker at apply
+      // time (in an Action, that's the engine's resolve context).
+      const appId = yield* app.appId;
+      return makeHttpFlagshipClient(auth, appId);
+    });
+  }),
+);

package/src/Cloudflare/Flagship/index.ts

@@ -8,3 +8,4 @@ export {
   type EvaluationDetails,
 } from "./ReadFlags.ts";
 export { ReadFlagsBinding } from "./ReadFlagsBinding.ts";
+export { ReadFlagsLocal } from "./ReadFlagsLocal.ts";

package/src/Cloudflare/KV/NamespaceHttp.ts

@@ -1,9 +1,13 @@
 import * as Effect from "effect/Effect";
 import type * as Redacted from "effect/Redacted";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
 import { Self } from "../../Self.ts";
 import { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
 import type { PermissionGroupRef } from "../ApiToken/Common.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
+import { authorizeWith } from "../HttpClientUtils.ts";
 import type { Namespace } from "./Namespace.ts";
 import { NamespaceError } from "./NamespaceTypes.ts";
 
@@ -58,6 +62,25 @@ export interface HttpScope {
   namespaceId: string;
 }
 
+/**
+ * Injectable auth for the KV HTTP client builders. Both the scoped-token
+ * (`*Http`) and current-credentials (`*Local`) variants supply an `authorize`
+ * (which provides `Credentials` + `HttpClient` to a raw SDK op) and an
+ * `accountId`, so the client builders are agnostic to how creds are obtained.
+ */
+export interface KVAuth {
+  authorize: <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+  ) => Effect.Effect<A, E, RuntimeContext>;
+  accountId: Effect.Effect<string>;
+}
+
+/** Build a scoped-token {@link KVAuth} from a bound {@link HttpToken}. */
+export const makeKVAuth = (token: HttpToken): KVAuth => ({
+  authorize: authorizeWith(token),
+  accountId: token.accountId,
+});
+
 const KV_HTTP_PERMISSION_GROUPS: PermissionGroupRef[] = [
   "Workers KV Storage Read",
   "Workers KV Storage Write",
@@ -67,11 +90,11 @@ type PermissionGroup = (typeof KV_HTTP_PERMISSION_GROUPS)[number];
 
 /** Resolve the account and namespace id once per operation. */
 export const makeKVHttpScope = (
-  token: HttpToken,
+  auth: KVAuth,
   namespaceId: Effect.Effect<string>,
 ): Effect.Effect<HttpScope> =>
   Effect.gen(function* () {
-    const accountId = yield* token.accountId;
+    const accountId = yield* auth.accountId;
     const id = yield* namespaceId;
     return { accountId, namespaceId: id };
   });

package/src/Cloudflare/KV/NamespaceLocal.ts

@@ -0,0 +1,42 @@
+import * as Effect from "effect/Effect";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
+import type { Namespace } from "./Namespace.ts";
+import type { KVAuth } from "./NamespaceHttp.ts";
+
+/**
+ * Shared scaffolding for the `*Local` KV services.
+ *
+ * Instead of minting a scoped {@link AccountApiToken} (the `*Http` path) or
+ * resolving a native Worker binding (the `*Binding` path), it captures the
+ * ambient current-credentials context available during stack-eval and builds
+ * a {@link KVAuth} that provides those credentials directly to the KV HTTP
+ * ops. It then delegates to the same client builders the `*Http` variant uses.
+ *
+ * NOT exported from `index.ts` — this is internal scaffolding shared by the
+ * three access-level Local layers.
+ */
+export const makeLocalKVNamespaceBinding = <Client>(options: {
+  makeClient: (auth: KVAuth, namespaceId: Effect.Effect<string>) => Client;
+}) =>
+  Effect.gen(function* () {
+    // Account + credentials are ambient during stack-eval (the stack's
+    // providers layer). Capture the full context so KV HTTP ops can run with
+    // the current credentials — no `host.bind`, no minted token.
+    const { accountId } = yield* yield* CloudflareEnvironment;
+    const context = yield* Effect.context<
+      Credentials | HttpClient.HttpClient
+    >();
+
+    return Effect.fn(function* (namespace: Namespace) {
+      // Deferred accessor — resolves the namespaceId against the tracker at
+      // apply time (in an Action, that's the engine's resolve context).
+      const namespaceId = yield* namespace.namespaceId;
+      const auth: KVAuth = {
+        authorize: (eff) => eff.pipe(Effect.provideContext(context)),
+        accountId: Effect.succeed(accountId),
+      };
+      return options.makeClient(auth, namespaceId);
+    });
+  });

package/src/Cloudflare/KV/ReadNamespaceHttp.ts

@@ -1,12 +1,12 @@
 import * as kv from "@distilled.cloud/cloudflare/kv";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { authorizeWith } from "../HttpClientUtils.ts";
 import {
   makeHttpKVNamespaceBinding,
+  makeKVAuth,
   makeKVHttpScope,
   toKVNamespaceError,
-  type HttpToken,
+  type KVAuth,
 } from "./NamespaceHttp.ts";
 import { ReadNamespace, type ReadNamespaceClient } from "./ReadNamespace.ts";
 
@@ -21,17 +21,18 @@ export const ReadNamespaceHttp = Layer.effect(
   Effect.suspend(() =>
     makeHttpKVNamespaceBinding({
       permissionGroups: ["Workers KV Storage Read"],
-      makeClient: makeReadKVHttpClient,
+      makeClient: (token, namespaceId) =>
+        makeReadKVHttpClient(makeKVAuth(token), namespaceId),
     }),
   ),
 );
 
 export const makeReadKVHttpClient = (
-  token: HttpToken,
+  auth: KVAuth,
   namespaceId: Effect.Effect<string>,
 ): ReadNamespaceClient => {
-  const authorize = authorizeWith(token);
-  const scope = makeKVHttpScope(token, namespaceId);
+  const { authorize } = auth;
+  const scope = makeKVHttpScope(auth, namespaceId);
 
   const getOne = (key: string, type: string) =>
     scope.pipe(

package/src/Cloudflare/KV/ReadNamespaceLocal.ts

@@ -0,0 +1,35 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeLocalKVNamespaceBinding } from "./NamespaceLocal.ts";
+import { ReadNamespace } from "./ReadNamespace.ts";
+import { makeReadKVHttpClient } from "./ReadNamespaceHttp.ts";
+
+/**
+ * Local implementation of the {@link ReadNamespace} binding — reads KV values
+ * over the Cloudflare HTTP API using the **current credentials** instead of a
+ * native Worker binding (`ReadNamespaceBinding`) or a scoped API token
+ * (`ReadNamespaceHttp`).
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) so you can read
+ * from a namespace with the same `get`/`getWithMetadata`/`list` client you'd
+ * use inside a Worker:
+ *
+ * @example Reading a value from an Action
+ * ```typescript
+ * const Check = Alchemy.Action(
+ *   "Check",
+ *   Effect.gen(function* () {
+ *     const kv = yield* Cloudflare.KV.ReadNamespace(namespace);
+ *     return Effect.fn(function* () {
+ *       return yield* kv.get("my-key");
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.KV.ReadNamespaceLocal)),
+ * );
+ * ```
+ */
+export const ReadNamespaceLocal = Layer.effect(
+  ReadNamespace,
+  Effect.suspend(() =>
+    makeLocalKVNamespaceBinding({ makeClient: makeReadKVHttpClient }),
+  ),
+);

package/src/Cloudflare/KV/ReadWriteNamespaceHttp.ts

@@ -1,6 +1,10 @@
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { makeHttpKVNamespaceBinding, type HttpToken } from "./NamespaceHttp.ts";
+import {
+  makeHttpKVNamespaceBinding,
+  makeKVAuth,
+  type KVAuth,
+} from "./NamespaceHttp.ts";
 import { makeReadKVHttpClient } from "./ReadNamespaceHttp.ts";
 import {
   ReadWriteNamespace,
@@ -19,17 +23,18 @@ export const ReadWriteNamespaceHttp = Layer.effect(
   Effect.suspend(() =>
     makeHttpKVNamespaceBinding({
       permissionGroups: ["Workers KV Storage Read", "Workers KV Storage Write"],
-      makeClient: makeReadWriteKVHttpClient,
+      makeClient: (token, namespaceId) =>
+        makeReadWriteKVHttpClient(makeKVAuth(token), namespaceId),
     }),
   ),
 );
 
-/** Build the HTTP-backed read-write client over a bound token + namespace. */
+/** Build the HTTP-backed read-write client over an auth + namespace. */
 export const makeReadWriteKVHttpClient = (
-  token: HttpToken,
+  auth: KVAuth,
   namespaceId: Effect.Effect<string>,
 ): ReadWriteNamespaceClient =>
   ({
-    ...makeReadKVHttpClient(token, namespaceId),
-    ...makeWriteKVHttpClient(token, namespaceId),
+    ...makeReadKVHttpClient(auth, namespaceId),
+    ...makeWriteKVHttpClient(auth, namespaceId),
   }) as ReadWriteNamespaceClient;

package/src/Cloudflare/KV/ReadWriteNamespaceLocal.ts

@@ -0,0 +1,42 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeLocalKVNamespaceBinding } from "./NamespaceLocal.ts";
+import { ReadWriteNamespace } from "./ReadWriteNamespace.ts";
+import { makeReadWriteKVHttpClient } from "./ReadWriteNamespaceHttp.ts";
+
+/**
+ * Local implementation of the {@link ReadWriteNamespace} binding — reads and
+ * writes KV values over the Cloudflare HTTP API using the **current
+ * credentials** instead of a native Worker binding
+ * (`ReadWriteNamespaceBinding`) or a scoped API token
+ * (`ReadWriteNamespaceHttp`).
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) so you can talk
+ * to a namespace with the same `get`/`put`/`list`/`delete` client you'd use
+ * inside a Worker:
+ *
+ * @example Seeding a namespace from an Action
+ * ```typescript
+ * const Seed = Alchemy.Action(
+ *   "Seed",
+ *   Effect.gen(function* () {
+ *     const kv = yield* Cloudflare.KV.ReadWriteNamespace(namespace);
+ *     return Effect.fn(function* () {
+ *       yield* kv.put("greeting", "hello world");
+ *       return yield* kv.get("greeting");
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.KV.ReadWriteNamespaceLocal)),
+ * );
+ * ```
+ *
+ * The namespace id is resolved at apply time through the ambient
+ * {@link RuntimeContext} (in an Action, that's the resolve context the engine
+ * provides around the body), so `ReadWriteNamespace(namespace)` works even
+ * though the namespace is created in the same deploy.
+ */
+export const ReadWriteNamespaceLocal = Layer.effect(
+  ReadWriteNamespace,
+  Effect.suspend(() =>
+    makeLocalKVNamespaceBinding({ makeClient: makeReadWriteKVHttpClient }),
+  ),
+);

package/src/Cloudflare/KV/WriteNamespaceHttp.ts

@@ -1,12 +1,12 @@
 import * as kv from "@distilled.cloud/cloudflare/kv";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { authorizeWith } from "../HttpClientUtils.ts";
 import {
   makeHttpKVNamespaceBinding,
+  makeKVAuth,
   makeKVHttpScope,
   toKVNamespaceError,
-  type HttpToken,
+  type KVAuth,
 } from "./NamespaceHttp.ts";
 import { NamespaceError } from "./NamespaceTypes.ts";
 import { WriteNamespace, type WriteNamespaceClient } from "./WriteNamespace.ts";
@@ -22,17 +22,18 @@ export const WriteNamespaceHttp = Layer.effect(
   Effect.suspend(() =>
     makeHttpKVNamespaceBinding({
       permissionGroups: ["Workers KV Storage Write"],
-      makeClient: makeWriteKVHttpClient,
+      makeClient: (token, namespaceId) =>
+        makeWriteKVHttpClient(makeKVAuth(token), namespaceId),
     }),
   ),
 );
 
 export const makeWriteKVHttpClient = (
-  token: HttpToken,
+  auth: KVAuth,
   namespaceId: Effect.Effect<string>,
 ): WriteNamespaceClient => {
-  const authorize = authorizeWith(token);
-  const scope = makeKVHttpScope(token, namespaceId);
+  const { authorize } = auth;
+  const scope = makeKVHttpScope(auth, namespaceId);
 
   return {
     put: ((

package/src/Cloudflare/KV/WriteNamespaceLocal.ts

@@ -0,0 +1,35 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeLocalKVNamespaceBinding } from "./NamespaceLocal.ts";
+import { WriteNamespace } from "./WriteNamespace.ts";
+import { makeWriteKVHttpClient } from "./WriteNamespaceHttp.ts";
+
+/**
+ * Local implementation of the {@link WriteNamespace} binding — writes KV
+ * values over the Cloudflare HTTP API using the **current credentials**
+ * instead of a native Worker binding (`WriteNamespaceBinding`) or a scoped API
+ * token (`WriteNamespaceHttp`).
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) so you can write
+ * to a namespace with the same `put`/`delete` client you'd use inside a
+ * Worker:
+ *
+ * @example Writing a value from an Action
+ * ```typescript
+ * const Seed = Alchemy.Action(
+ *   "Seed",
+ *   Effect.gen(function* () {
+ *     const kv = yield* Cloudflare.KV.WriteNamespace(namespace);
+ *     return Effect.fn(function* () {
+ *       yield* kv.put("my-key", "hello world");
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.KV.WriteNamespaceLocal)),
+ * );
+ * ```
+ */
+export const WriteNamespaceLocal = Layer.effect(
+  WriteNamespace,
+  Effect.suspend(() =>
+    makeLocalKVNamespaceBinding({ makeClient: makeWriteKVHttpClient }),
+  ),
+);

package/src/Cloudflare/KV/index.ts

@@ -3,9 +3,12 @@ export * from "./NamespaceTypes.ts";
 export * from "./ReadNamespace.ts";
 export * from "./ReadNamespaceBinding.ts";
 export * from "./ReadNamespaceHttp.ts";
+export * from "./ReadNamespaceLocal.ts";
 export * from "./ReadWriteNamespace.ts";
 export * from "./ReadWriteNamespaceBinding.ts";
 export * from "./ReadWriteNamespaceHttp.ts";
+export * from "./ReadWriteNamespaceLocal.ts";
 export * from "./WriteNamespace.ts";
 export * from "./WriteNamespaceBinding.ts";
 export * from "./WriteNamespaceHttp.ts";
+export * from "./WriteNamespaceLocal.ts";

package/src/Cloudflare/Queues/QueueHttp.ts

@@ -1,12 +1,34 @@
 import * as Effect from "effect/Effect";
 import type * as Redacted from "effect/Redacted";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
 import { Self } from "../../Self.ts";
 import { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
 import type { PermissionGroupRef } from "../ApiToken/Common.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
 import type { Queue } from "./Queue.ts";
 import { SendError } from "./QueueTypes.ts";
 
+/**
+ * Injectable auth used by the Queue HTTP client builder. Both the
+ * scoped-token HTTP variant ({@link makeWriteQueueHttpClient}) and the
+ * current-credentials Local variant build this so they share the exact
+ * same request path — only the way credentials reach the SDK op differs.
+ *
+ * - `authorize` runs a raw distilled op (which needs
+ *   `Credentials | HttpClient`) and discharges those requirements down to
+ *   {@link RuntimeContext}. The HTTP variant provides a minted token; the
+ *   Local variant provides the ambient current-credentials context.
+ * - `accountId` resolves the Cloudflare account the queue lives in.
+ */
+export interface QueueAuth {
+  authorize: <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+  ) => Effect.Effect<A, E, RuntimeContext>;
+  accountId: Effect.Effect<string>;
+}
+
 /**
  * Shared scaffolding for the HTTP-backed Queue services.
  *
@@ -50,11 +72,11 @@ export const makeHttpQueueBinding = <Client>(options: {
 
 /** Resolve the account and queue id once per operation. */
 export const makeQueueHttpScope = (
-  token: HttpToken,
+  auth: QueueAuth,
   queueId: Effect.Effect<string>,
 ): Effect.Effect<HttpScope> =>
   Effect.gen(function* () {
-    const accountId = yield* token.accountId;
+    const accountId = yield* auth.accountId;
     const id = yield* queueId;
     return { accountId, queueId: id };
   });