alchemy 2.0.0-beta.62 → 2.0.0-beta.63

package/src/Cloudflare/Queues/WriteQueueHttp.ts

@@ -6,7 +6,7 @@ import {
   makeHttpQueueBinding,
   makeQueueHttpScope,
   toQueueSendError,
-  type HttpToken,
+  type QueueAuth,
 } from "./QueueHttp.ts";
 import { SendError, type SendMessage } from "./QueueTypes.ts";
 import { WriteQueue, type WriteQueueClient } from "./WriteQueue.ts";
@@ -27,7 +27,11 @@ export const WriteQueueHttp = Layer.effect(
   Effect.suspend(() =>
     makeHttpQueueBinding({
       permissionGroups: ["Queues Write"],
-      makeClient: makeWriteQueueHttpClient,
+      makeClient: (token, queueId) =>
+        makeWriteQueueHttpClient(
+          { authorize: authorizeWith(token), accountId: token.accountId },
+          queueId,
+        ),
     }),
   ),
 );
@@ -44,18 +48,23 @@ const toMessage = (message: SendMessage) =>
       }
     : { body: message.body, contentType: "json" as const };
 
-/** Build the producer client over the Queues bulk-push HTTP API. */
+/**
+ * Build the producer client over the Queues bulk-push HTTP API.
+ *
+ * Shared by {@link WriteQueueHttp} (scoped token auth) and
+ * `WriteQueueLocal` (current-credentials auth) — they differ only in the
+ * {@link QueueAuth} they inject.
+ */
 export const makeWriteQueueHttpClient = (
-  token: HttpToken,
+  auth: QueueAuth,
   queueId: Effect.Effect<string>,
 ): WriteQueueClient => {
-  const authorize = authorizeWith(token);
-  const scope = makeQueueHttpScope(token, queueId);
+  const scope = makeQueueHttpScope(auth, queueId);
 
   const push = (messages: ReadonlyArray<SendMessage>) =>
     scope.pipe(
       Effect.flatMap(({ accountId, queueId }) =>
-        authorize(
+        auth.authorize(
           queues.bulkPushMessages({
             accountId,
             queueId,

package/src/Cloudflare/Queues/WriteQueueLocal.ts

@@ -0,0 +1,64 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
+import type { Queue } from "./Queue.ts";
+import { makeWriteQueueHttpClient } from "./WriteQueueHttp.ts";
+import { WriteQueue } from "./WriteQueue.ts";
+
+/**
+ * Local implementation of the {@link WriteQueue} binding — pushes messages
+ * to a Cloudflare Queue over the bulk-push HTTP API using the **current
+ * credentials** instead of a native Worker binding
+ * ({@link WriteQueueBinding}) or a scoped API token ({@link WriteQueueHttp}).
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) so you can send
+ * messages to a queue with the same `send`/`sendBatch` client you'd use inside
+ * a Worker — no Worker host and no minted token.
+ *
+ * @example Seeding a queue from an Action
+ * ```typescript
+ * const Seed = Alchemy.Action(
+ *   "Seed",
+ *   Effect.gen(function* () {
+ *     const q = yield* Cloudflare.Queues.WriteQueue(queue);
+ *     return Effect.fn(function* () {
+ *       yield* q.send({ text: "hi", sentAt: Date.now() });
+ *       yield* q.sendBatch([{ body: { event: "click", id: 1 } }]);
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.Queues.WriteQueueLocal)),
+ * );
+ * ```
+ *
+ * The queue id is resolved at apply time through the ambient
+ * {@link RuntimeContext} (in an Action, that's the resolve context the engine
+ * provides around the body), so `WriteQueue(queue)` works even though the
+ * queue is created in the same deploy.
+ */
+export const WriteQueueLocal = Layer.effect(
+  WriteQueue,
+  Effect.gen(function* () {
+    // Account + credentials are ambient during stack-eval (the stack's
+    // providers layer). Capture the full context so the bulk-push effect can
+    // run with the current credentials instead of a scoped token.
+    const { accountId } = yield* yield* CloudflareEnvironment;
+    const context = yield* Effect.context<
+      Credentials | HttpClient.HttpClient
+    >();
+
+    return Effect.fn(function* (queue: Queue) {
+      // Deferred accessor — resolves the queueId against the tracker at apply
+      // time. No `host.bind`: the local variant registers no binding.
+      const queueId = yield* queue.queueId;
+
+      return makeWriteQueueHttpClient(
+        {
+          authorize: (eff) => eff.pipe(Effect.provideContext(context)),
+          accountId: Effect.succeed(accountId),
+        },
+        queueId,
+      );
+    });
+  }),
+);

package/src/Cloudflare/Queues/index.ts

@@ -5,4 +5,5 @@ export * from "./QueueTypes.ts";
 export * from "./WriteQueue.ts";
 export * from "./WriteQueueBinding.ts";
 export * from "./WriteQueueHttp.ts";
+export * from "./WriteQueueLocal.ts";
 export * from "./Subscription.ts";

package/src/Cloudflare/R2/BucketHttp.ts

@@ -1,13 +1,30 @@
 import * as Effect from "effect/Effect";
 import type * as Redacted from "effect/Redacted";
 import * as Stream from "effect/Stream";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
 import { Self } from "../../Self.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
 import { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
 import type { PermissionGroupRef } from "../ApiToken/Common.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
 import type { Bucket } from "./Bucket.ts";
 import { R2Error, type R2Object } from "./BucketTypes.ts";
 
+/**
+ * Injectable auth used by the R2 HTTP client builders. Both the token-scoped
+ * `*Http` layers and the current-credentials `*Local` layers build one of
+ * these so they can share the exact same client implementation.
+ */
+export interface R2Auth {
+  /** Provide credentials + HTTP client to a raw distilled R2 op. */
+  authorize: <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+  ) => Effect.Effect<A, E, RuntimeContext>;
+  /** Resolve the Cloudflare account id. */
+  accountId: Effect.Effect<string>;
+}
+
 export const makeHttpBucketBinding = <Client>(options: {
   permissionGroups: PermissionGroup[];
   makeClient: (
@@ -66,16 +83,16 @@ type PermissionGroup = (typeof R2_HTTP_PERMISSION_GROUPS)[number];
 
 /** Resolve the account, bucket, and jurisdiction once per operation. */
 export const makeR2HttpScope = (
-  token: HttpToken,
+  accountId: Effect.Effect<string>,
   bucketName: Effect.Effect<string>,
   jurisdiction: Effect.Effect<string>,
 ): Effect.Effect<HttpScope> =>
   Effect.gen(function* () {
-    const accountId = yield* token.accountId;
+    const accountId_ = yield* accountId;
     const bucket = yield* bucketName;
     const j = yield* jurisdiction;
     return {
-      accountId,
+      accountId: accountId_,
       bucketName: bucket,
       cfR2Jurisdiction: j === "default" ? undefined : j,
     };

package/src/Cloudflare/R2/BucketLocal.ts

@@ -0,0 +1,47 @@
+import * as Effect from "effect/Effect";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
+import type { Bucket } from "./Bucket.ts";
+import type { R2Auth } from "./BucketHttp.ts";
+
+/**
+ * Shared scaffolding for the R2 `*Local` binding layers.
+ *
+ * Resolves the account + captures the ambient current-credentials context at
+ * layer construction, then returns the deferred binding callable. The callable
+ * reads the bucket name/jurisdiction as deferred accessors (resolved at apply
+ * time) and builds the same HTTP-backed client the `*Http` variant uses, but
+ * authorized with the current CLI credentials instead of a minted token.
+ *
+ * NOT exported from `index.ts`.
+ */
+export const makeLocalBucketBinding = <Client>(makeClient: {
+  (
+    auth: R2Auth,
+    bucketName: Effect.Effect<string>,
+    jurisdiction: Effect.Effect<string>,
+  ): Client;
+}) =>
+  Effect.gen(function* () {
+    // Account + credentials are ambient during stack-eval (the stack's
+    // providers layer). Capture the full context so each op can be run with the
+    // current credentials.
+    const { accountId } = yield* yield* CloudflareEnvironment;
+    const context = yield* Effect.context<
+      Credentials | HttpClient.HttpClient
+    >();
+
+    const auth: R2Auth = {
+      authorize: (eff) => eff.pipe(Effect.provideContext(context)),
+      accountId: Effect.succeed(accountId),
+    };
+
+    return Effect.fn(function* (bucket: Bucket) {
+      // Deferred accessors — resolved against the tracker at apply time. No
+      // `host.bind`: the local variant registers no binding.
+      const bucketName = yield* bucket.bucketName;
+      const jurisdiction = yield* bucket.jurisdiction;
+      return makeClient(auth, bucketName, jurisdiction);
+    });
+  });

package/src/Cloudflare/R2/ReadBucketHttp.ts

@@ -9,7 +9,7 @@ import {
   makeR2HttpScope,
   toR2Error,
   type HttpMetadata,
-  type HttpToken,
+  type R2Auth,
 } from "./BucketHttp.ts";
 import { ReadBucket, type ReadBucketClient } from "./ReadBucket.ts";
 import {
@@ -29,18 +29,23 @@ export const ReadBucketHttp = Layer.effect(
   Effect.suspend(() =>
     makeHttpBucketBinding({
       permissionGroups: ["Workers R2 Storage Read"],
-      makeClient: makeReadR2HttpClient,
+      makeClient: (token, bucketName, jurisdiction) =>
+        makeReadR2HttpClient(
+          { authorize: authorizeWith(token), accountId: token.accountId },
+          bucketName,
+          jurisdiction,
+        ),
     }),
   ),
 );
 
 export const makeReadR2HttpClient = (
-  token: HttpToken,
+  auth: R2Auth,
   bucketName: Effect.Effect<string>,
   jurisdiction: Effect.Effect<string>,
 ): ReadBucketClient => {
-  const authorize = authorizeWith(token);
-  const scope = makeR2HttpScope(token, bucketName, jurisdiction);
+  const authorize = auth.authorize;
+  const scope = makeR2HttpScope(auth.accountId, bucketName, jurisdiction);
 
   return {
     raw: Effect.die(

package/src/Cloudflare/R2/ReadBucketLocal.ts

@@ -0,0 +1,33 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeLocalBucketBinding } from "./BucketLocal.ts";
+import { ReadBucket } from "./ReadBucket.ts";
+import { makeReadR2HttpClient } from "./ReadBucketHttp.ts";
+
+/**
+ * Local implementation of the {@link ReadBucket} binding — reads R2 objects
+ * over the Cloudflare HTTP API using the **current credentials** instead of a
+ * native Worker binding (`ReadBucketBinding`) or a scoped API token
+ * (`ReadBucketHttp`).
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) to read a bucket
+ * with the same `head`/`get`/`list` client you'd use inside a Worker.
+ *
+ * @example Reading an object from an Action
+ * ```typescript
+ * const Read = Alchemy.Action(
+ *   "Read",
+ *   Effect.gen(function* () {
+ *     const r2 = yield* Cloudflare.R2.ReadBucket(bucket);
+ *     return Effect.fn(function* () {
+ *       const object = yield* r2.get("hello.txt");
+ *       return object ? yield* object.text() : null;
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.R2.ReadBucketLocal)),
+ * );
+ * ```
+ */
+export const ReadBucketLocal = Layer.effect(
+  ReadBucket,
+  Effect.suspend(() => makeLocalBucketBinding(makeReadR2HttpClient)),
+);

package/src/Cloudflare/R2/ReadWriteBucketHttp.ts

@@ -1,6 +1,7 @@
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { makeHttpBucketBinding, type HttpToken } from "./BucketHttp.ts";
+import { authorizeWith } from "../HttpClientUtils.ts";
+import { makeHttpBucketBinding, type R2Auth } from "./BucketHttp.ts";
 import { makeReadR2HttpClient } from "./ReadBucketHttp.ts";
 import {
   ReadWriteBucket,
@@ -18,18 +19,23 @@ export const ReadWriteBucketHttp = Layer.effect(
   Effect.suspend(() =>
     makeHttpBucketBinding({
       permissionGroups: ["Workers R2 Storage Read", "Workers R2 Storage Write"],
-      makeClient: makeReadWriteR2HttpClient,
+      makeClient: (token, bucketName, jurisdiction) =>
+        makeReadWriteR2HttpClient(
+          { authorize: authorizeWith(token), accountId: token.accountId },
+          bucketName,
+          jurisdiction,
+        ),
     }),
   ),
 );
 
 /** Build the HTTP-backed {@link ReadWrite} over a bound token + bucket. */
 export const makeReadWriteR2HttpClient = (
-  token: HttpToken,
+  auth: R2Auth,
   bucketName: Effect.Effect<string>,
   jurisdiction: Effect.Effect<string>,
 ): ReadWriteBucketClient =>
   ({
-    ...makeReadR2HttpClient(token, bucketName, jurisdiction),
-    ...makeWriteR2HttpClient(token, bucketName, jurisdiction),
+    ...makeReadR2HttpClient(auth, bucketName, jurisdiction),
+    ...makeWriteR2HttpClient(auth, bucketName, jurisdiction),
   }) satisfies ReadWriteBucketClient;

package/src/Cloudflare/R2/ReadWriteBucketLocal.ts

@@ -0,0 +1,36 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeLocalBucketBinding } from "./BucketLocal.ts";
+import { ReadWriteBucket } from "./ReadWriteBucket.ts";
+import { makeReadWriteR2HttpClient } from "./ReadWriteBucketHttp.ts";
+
+/**
+ * Local implementation of the {@link ReadWriteBucket} binding — reads and
+ * writes R2 objects over the Cloudflare HTTP API using the **current
+ * credentials** instead of a native Worker binding (`ReadWriteBucketBinding`)
+ * or a scoped API token (`ReadWriteBucketHttp`).
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) to use the same
+ * `head`/`get`/`list`/`put`/`delete` client you'd use inside a Worker.
+ * Multipart uploads are unsupported over the HTTP API (mirrors
+ * `ReadWriteBucketHttp`).
+ *
+ * @example Seeding then reading a bucket from an Action
+ * ```typescript
+ * const Seed = Alchemy.Action(
+ *   "Seed",
+ *   Effect.gen(function* () {
+ *     const r2 = yield* Cloudflare.R2.ReadWriteBucket(bucket);
+ *     return Effect.fn(function* () {
+ *       yield* r2.put("hello.txt", "Hello, World!");
+ *       const object = yield* r2.get("hello.txt");
+ *       return object ? yield* object.text() : null;
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.R2.ReadWriteBucketLocal)),
+ * );
+ * ```
+ */
+export const ReadWriteBucketLocal = Layer.effect(
+  ReadWriteBucket,
+  Effect.suspend(() => makeLocalBucketBinding(makeReadWriteR2HttpClient)),
+);

package/src/Cloudflare/R2/WriteBucketHttp.ts

@@ -10,7 +10,7 @@ import {
   readHttpMetadata,
   toBody,
   toR2Error,
-  type HttpToken,
+  type R2Auth,
 } from "./BucketHttp.ts";
 import { R2Error, type PutOptions } from "./BucketTypes.ts";
 import { WriteBucket, type WriteBucketClient } from "./WriteBucket.ts";
@@ -25,19 +25,24 @@ export const WriteBucketHttp = Layer.effect(
   Effect.suspend(() =>
     makeHttpBucketBinding({
       permissionGroups: ["Workers R2 Storage Write"],
-      makeClient: makeWriteR2HttpClient,
+      makeClient: (token, bucketName, jurisdiction) =>
+        makeWriteR2HttpClient(
+          { authorize: authorizeWith(token), accountId: token.accountId },
+          bucketName,
+          jurisdiction,
+        ),
     }),
   ),
 );
 
 /** Build the write half of the HTTP-backed {@link ReadWrite} client. */
 export const makeWriteR2HttpClient = (
-  token: HttpToken,
+  auth: R2Auth,
   bucketName: Effect.Effect<string>,
   jurisdiction: Effect.Effect<string>,
 ): WriteBucketClient => {
-  const authorize = authorizeWith(token);
-  const scope = makeR2HttpScope(token, bucketName, jurisdiction);
+  const authorize = auth.authorize;
+  const scope = makeR2HttpScope(auth.accountId, bucketName, jurisdiction);
 
   return {
     put: ((

package/src/Cloudflare/R2/WriteBucketLocal.ts

@@ -0,0 +1,33 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeLocalBucketBinding } from "./BucketLocal.ts";
+import { WriteBucket } from "./WriteBucket.ts";
+import { makeWriteR2HttpClient } from "./WriteBucketHttp.ts";
+
+/**
+ * Local implementation of the {@link WriteBucket} binding — writes R2 objects
+ * over the Cloudflare HTTP API using the **current credentials** instead of a
+ * native Worker binding (`WriteBucketBinding`) or a scoped API token
+ * (`WriteBucketHttp`).
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) to write a bucket
+ * with the same `put`/`delete` client you'd use inside a Worker. Multipart
+ * uploads are unsupported over the HTTP API (mirrors `WriteBucketHttp`).
+ *
+ * @example Seeding a bucket from an Action
+ * ```typescript
+ * const Seed = Alchemy.Action(
+ *   "Seed",
+ *   Effect.gen(function* () {
+ *     const r2 = yield* Cloudflare.R2.WriteBucket(bucket);
+ *     return Effect.fn(function* () {
+ *       yield* r2.put("hello.txt", "Hello, World!");
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.R2.WriteBucketLocal)),
+ * );
+ * ```
+ */
+export const WriteBucketLocal = Layer.effect(
+  WriteBucket,
+  Effect.suspend(() => makeLocalBucketBinding(makeWriteR2HttpClient)),
+);

package/src/Cloudflare/R2/index.ts

@@ -5,9 +5,12 @@ export * from "./DataCatalog.ts";
 export * from "./ReadBucket.ts";
 export * from "./ReadBucketBinding.ts";
 export * from "./ReadBucketHttp.ts";
+export * from "./ReadBucketLocal.ts";
 export * from "./ReadWriteBucket.ts";
 export * from "./ReadWriteBucketBinding.ts";
 export * from "./ReadWriteBucketHttp.ts";
+export * from "./ReadWriteBucketLocal.ts";
 export * from "./WriteBucket.ts";
 export * from "./WriteBucketBinding.ts";
 export * from "./WriteBucketHttp.ts";
+export * from "./WriteBucketLocal.ts";

package/src/Cloudflare/Tunnel/ReadTunnel.ts

@@ -15,8 +15,7 @@ import * as Binding from "../../Binding.ts";
 import type { Worker } from "../Workers/Worker.ts";
 import type { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { RuntimeContext } from "../../RuntimeContext.ts";
-import { type Token } from "./TunnelBinding.ts";
-import { authorizeWith } from "../HttpClientUtils.ts";
+import { type TunnelAuth } from "./TunnelBinding.ts";
 
 /**
  * Binding that lets a Worker read Cloudflare Tunnels at runtime.
@@ -117,31 +116,31 @@ export interface ReadTunnelClient {
   >;
 }
 
-/** Build the read-only client over a bound token. */
-export const readClient = (token: Token): ReadTunnelClient => {
-  const authorize = authorizeWith(token);
+/** Build the read-only client over an injectable {@link TunnelAuth}. */
+export const readClient = (auth: TunnelAuth): ReadTunnelClient => {
+  const { authorize } = auth;
   return {
     get: Effect.fn("Cloudflare.Tunnel.get")(function* (tunnelId) {
-      const accountId = yield* token.accountId;
+      const accountId = yield* auth.accountId;
       return yield* authorize(
         zeroTrust.getTunnelCloudflared({ accountId, tunnelId }),
       );
     }),
     list: Effect.fn("Cloudflare.Tunnel.list")(function* (request) {
-      const accountId = yield* token.accountId;
+      const accountId = yield* auth.accountId;
       return yield* authorize(
         zeroTrust.listTunnelCloudflareds({ accountId, ...request }),
       );
     }),
     getToken: Effect.fn("Cloudflare.Tunnel.getToken")(function* (tunnelId) {
-      const accountId = yield* token.accountId;
+      const accountId = yield* auth.accountId;
       return yield* authorize(
         zeroTrust.getTunnelCloudflaredToken({ accountId, tunnelId }),
       );
     }),
     getConfiguration: Effect.fn("Cloudflare.Tunnel.getConfiguration")(
       function* (tunnelId) {
-        const accountId = yield* token.accountId;
+        const accountId = yield* auth.accountId;
         return yield* authorize(
           zeroTrust.getTunnelCloudflaredConfiguration({ accountId, tunnelId }),
         );

package/src/Cloudflare/Tunnel/ReadTunnelLocal.ts

@@ -0,0 +1,33 @@
+import * as Layer from "effect/Layer";
+import { readClient, ReadTunnel } from "./ReadTunnel.ts";
+import { makeLocalTunnelClient } from "./TunnelLocalBinding.ts";
+
+/**
+ * Local implementation of the {@link ReadTunnel} binding — reads Cloudflare
+ * Tunnels over the cfd_tunnel HTTP API using the **current credentials**
+ * instead of a native Worker binding (`ReadTunnelBinding`) or a scoped API
+ * token. No `host.bind`, no minted token, no Worker host.
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) so you can read
+ * tunnels with the same `get`/`list`/`getToken`/`getConfiguration` client you'd
+ * use inside a Worker.
+ *
+ * @example Read a tunnel's connector token from an Action
+ * ```typescript
+ * const Inspect = Alchemy.Action(
+ *   "Inspect",
+ *   Effect.gen(function* () {
+ *     const tunnels = yield* Cloudflare.Tunnel.ReadTunnel();
+ *     const tunnelId = yield* tunnel.tunnelId;
+ *     return Effect.fn(function* () {
+ *       const t = yield* tunnels.get(yield* tunnelId);
+ *       return t.result?.name;
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.Tunnel.ReadTunnelLocal)),
+ * );
+ * ```
+ */
+export const ReadTunnelLocal = Layer.effect(
+  ReadTunnel,
+  makeLocalTunnelClient(readClient),
+);

package/src/Cloudflare/Tunnel/ReadWriteTunnel.ts

@@ -2,7 +2,7 @@ import * as Effect from "effect/Effect";
 import * as Binding from "../../Binding.ts";
 import type { Worker } from "../Workers/Worker.ts";
 import type { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
-import { type Token } from "./TunnelBinding.ts";
+import { type TunnelAuth } from "./TunnelBinding.ts";
 import { readClient, type ReadTunnelClient } from "./ReadTunnel.ts";
 import { writeClient, type WriteTunnelClient } from "./WriteTunnel.ts";
 
@@ -68,8 +68,8 @@ export const ReadWriteTunnel = Binding.Service<ReadWriteTunnel>(
 export interface ReadWriteTunnelClient
   extends ReadTunnelClient, WriteTunnelClient {}
 
-/** Build the combined read + write client over a bound token. */
-export const readWriteClient = (token: Token): ReadWriteTunnelClient => ({
-  ...readClient(token),
-  ...writeClient(token),
+/** Build the combined read + write client over an injectable {@link TunnelAuth}. */
+export const readWriteClient = (auth: TunnelAuth): ReadWriteTunnelClient => ({
+  ...readClient(auth),
+  ...writeClient(auth),
 });

package/src/Cloudflare/Tunnel/ReadWriteTunnelLocal.ts

@@ -0,0 +1,39 @@
+import * as Layer from "effect/Layer";
+import { readWriteClient, ReadWriteTunnel } from "./ReadWriteTunnel.ts";
+import { makeLocalTunnelClient } from "./TunnelLocalBinding.ts";
+
+/**
+ * Local implementation of the {@link ReadWriteTunnel} binding — performs the
+ * full cfd_tunnel CRUD surface over the HTTP API using the **current
+ * credentials** instead of a native Worker binding (`ReadWriteTunnelBinding`)
+ * or a scoped API token. No `host.bind`, no minted token, no Worker host.
+ *
+ * Provide it on an {@link Action} (or any deploy-time Effect) so you can manage
+ * tunnels with the same combined read + write client you'd use inside a Worker.
+ *
+ * @example Configure a deployed tunnel from an Action
+ * ```typescript
+ * const Configure = Alchemy.Action(
+ *   "Configure",
+ *   Effect.gen(function* () {
+ *     const tunnels = yield* Cloudflare.Tunnel.ReadWriteTunnel();
+ *     const tunnelId = yield* tunnel.tunnelId;
+ *     return Effect.fn(function* () {
+ *       const id = yield* tunnelId;
+ *       yield* tunnels.putConfiguration(id, {
+ *         ingress: [
+ *           { hostname: "app.example.com", service: "http://localhost:3000" },
+ *           { service: "http_status:404" },
+ *         ],
+ *       });
+ *       const { config } = yield* tunnels.getConfiguration(id);
+ *       return config;
+ *     });
+ *   }).pipe(Effect.provide(Cloudflare.Tunnel.ReadWriteTunnelLocal)),
+ * );
+ * ```
+ */
+export const ReadWriteTunnelLocal = Layer.effect(
+  ReadWriteTunnel,
+  makeLocalTunnelClient(readWriteClient),
+);

package/src/Cloudflare/Tunnel/TunnelBinding.ts

@@ -1,8 +1,12 @@
 import * as Effect from "effect/Effect";
 import type * as Redacted from "effect/Redacted";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
 import { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
 import type { PermissionGroupRef } from "../ApiToken/Common.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
+import { authorizeWith } from "../HttpClientUtils.ts";
 import { Worker } from "../Workers/Worker.ts";
 
 /**
@@ -16,7 +20,7 @@ import { Worker } from "../Workers/Worker.ts";
 export const makeTunnelClient = <C>(
   sid: string,
   permissionGroups: PermissionGroupRef[],
-  makeClient: (token: Token) => C,
+  makeClient: (auth: TunnelAuth) => C,
 ) =>
   Effect.gen(function* () {
     const Token = yield* AccountApiToken;
@@ -39,10 +43,30 @@ export const makeTunnelClient = <C>(
           ],
         });
       }
-      return makeClient(yield* bindTunnelToken(token));
+      return makeClient(makeTunnelAuth(yield* bindTunnelToken(token)));
     });
   });
 
+/**
+ * Injectable auth for the tunnel client builders. Both the scoped-token
+ * (`*Binding`) and current-credentials (`*Local`) variants supply an
+ * `authorize` (which provides `Credentials` + `HttpClient` to a raw SDK op)
+ * and an `accountId`, so the client builders are agnostic to how creds are
+ * obtained.
+ */
+export interface TunnelAuth {
+  authorize: <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+  ) => Effect.Effect<A, E, RuntimeContext>;
+  accountId: Effect.Effect<string>;
+}
+
+/** Build a scoped-token {@link TunnelAuth} from a bound {@link Token}. */
+export const makeTunnelAuth = (token: Token): TunnelAuth => ({
+  authorize: authorizeWith(token),
+  accountId: token.accountId,
+});
+
 /**
  * Runtime accessors for a tunnel binding's token, obtained by binding the
  * {@link AccountApiToken}'s outputs in the Worker's Init phase. Each accessor