@homeflare/alchemy 0.48.0 → 0.49.0

package/dist/cloudflare/saas-oidc-form.d.ts

@@ -0,0 +1,48 @@
+/**
+ * `HomeFlare.Access.SaasOidcApplication` — the pure helpers the lifecycle uses: validation, the
+ * issuer URLs, drift, the write body and the attribute mapping. The props and attributes types are
+ * declared in saas-oidc-props.ts and re-exported here.
+ *
+ * ⛔ THE ATTRIBUTES NEVER HOLD THE CLIENT SECRET, and nothing here can: `ObservedApp`
+ *   (saas-oidc-api.ts) has no field for it. A client that authenticates with PKCE alone declares
+ *   `allowPkceWithoutClientSecret: true`, and then no secret exists to keep.
+ * ★ THE ISSUER IS `https://<teamDomain>/cdn-cgi/access/sso/oidc/<clientId>`. The team domain is a
+ *   prop; the openbao copy this came from hardcoded one account's. Cloudflare also reports the
+ *   same host in the app's own `domain` field (Alchemy's `Access.Application` doc: for `saas`
+ *   "Cloudflare uses the OIDC issuer"), and `checkTeam` refuses a declaration that disagrees with it.
+ */
+import { SaasOidcError } from './saas-oidc-error.ts';
+import type { SaasOidcApplicationAttributes, SaasOidcApplicationProps } from './saas-oidc-props.ts';
+import type { AppWrite, ObservedApp } from './saas-oidc-wire.ts';
+export type { OidcGrantType, OidcScope, SaasOidcApplicationAttributes, SaasOidcApplicationProps, } from './saas-oidc-props.ts';
+/** ⛔ Fail closed on a declaration the API would accept but nobody meant. */
+export declare const validateSaasOidc: (props: SaasOidcApplicationProps) => SaasOidcError | undefined;
+export declare const issuerFor: (teamDomain: string, clientId: string) => string;
+/**
+ * ⛔ A DECLARED TEAM DOMAIN THAT DISAGREES WITH THE APP'S OWN `domain` is refused: the issuer in
+ *   the attributes would point at a different team than the one that holds the app.
+ * ⛔ WHEN CLOUDFLARE REPORTS NO `domain` there is nothing to compare, so the team the row already
+ *   recorded (`knownTeam`, from state) stands in: a declaration that moves it is refused, because
+ *   `issuer` is a declared stable and must not move under the row. With no `knownTeam` either
+ *   (a first create or a cold adoption) there is nothing to compare against and the declaration
+ *   stands.
+ */
+export declare const checkTeam: (teamDomain: string, app: ObservedApp, knownTeam?: string) => SaasOidcError | undefined;
+/** The request body for a create or an update. */
+export declare const writeBody: (news: SaasOidcApplicationProps, name: string) => AppWrite;
+/**
+ * Does the live app differ from the declaration? Compared: name, auth type, redirect URIs, scopes,
+ * grant types (each as a set), both lifetimes, the PKCE flag and the policies IN ORDER — the
+ * openbao copy's set plus the policy order, kept so adopting a live app is not newly a write.
+ * ⚠️ NOT COMPARED: `sessionDuration`, `allowedIdps`, `autoRedirectToIdentity`, `appLauncherVisible`,
+ *   `appLauncherUrl`. They are written on create and on any sync, but a change to only those does
+ *   not trigger one. Carried over unchanged; see saas-oidc.md.
+ */
+export declare const needsSync: (news: SaasOidcApplicationProps, observed: ObservedApp, name: string) => boolean;
+/**
+ * The attributes of a live app, or `undefined` when it lacks an id, an `aud` or a client id (so it
+ * is not a SaaS OIDC app this package can describe). `teamDomain` is the declared one, or, for a
+ * read that has no declaration (state written before the prop existed), the host Cloudflare reports.
+ */
+export declare const toAttributes: (app: ObservedApp, accountId: string, fallbackName: string, declaredTeam: string | undefined) => SaasOidcApplicationAttributes | undefined;
+//# sourceMappingURL=saas-oidc-form.d.ts.map

package/dist/cloudflare/saas-oidc-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saas-oidc-form.d.ts","sourceRoot":"","sources":["../../src/cloudflare/saas-oidc-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACpG,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIjE,YAAY,EACV,aAAa,EACb,SAAS,EACT,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAI9B,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,UAAW,wBAAwB,KAAG,aAAa,GAAG,SAmBlF,CAAC;AAEF,eAAO,MAAM,SAAS,eAAgB,MAAM,YAAY,MAAM,KAAG,MACJ,CAAC;AAI9D;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,eACR,MAAM,OACb,WAAW,cACJ,MAAM,KACjB,aAAa,GAAG,SAalB,CAAC;AAKF,kDAAkD;AAClD,eAAO,MAAM,SAAS,SAAU,wBAAwB,QAAQ,MAAM,KAAG,QAmBvE,CAAC;AAgBH;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,SACd,wBAAwB,YACpB,WAAW,QACf,MAAM,KACX,OAcF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,QAClB,WAAW,aACL,MAAM,gBACH,MAAM,gBACN,MAAM,GAAG,SAAS,KAC/B,6BAA6B,GAAG,SA6BlC,CAAC"}

package/dist/cloudflare/saas-oidc-harness.d.ts

@@ -0,0 +1,50 @@
+import * as State from 'alchemy/State';
+import * as Effect from 'effect/Effect';
+import * as Exit from 'effect/Exit';
+import * as Layer from 'effect/Layer';
+import { type FakeAccess } from './fake-access.ts';
+import type { SaasOidcApplicationAttributes, SaasOidcApplicationProps } from './saas-oidc-form.ts';
+import { SaasOidcApplication } from './saas-oidc.ts';
+export declare const strict: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+export declare const ids: {
+    fqn: string;
+    id: string;
+    instanceId: string;
+};
+export declare const extra: {
+    bindings: never;
+    session: never;
+};
+export type P = Effect.Success<typeof SaasOidcApplication.Provider>;
+/** A public PKCE client, the shape Headlamp declares (Q6). */
+export declare const publicClient: (over?: Partial<SaasOidcApplicationProps>) => SaasOidcApplicationProps;
+/** The wire `saas_app` of a live app that matches `publicClient()` exactly (no drift to sync). */
+export declare const LIVE_OIDC: {
+    auth_type: string;
+    redirect_uris: string[];
+    scopes: string[];
+    grant_types: string[];
+    access_token_lifetime: string;
+    allow_pkce_without_client_secret: boolean;
+};
+/** Build the provider over the fake and hand it to `use`. */
+export declare const run: <A, E>(fake: FakeAccess, use: (p: P) => Effect.Effect<A, E, never>) => Promise<A>;
+export declare const reconcile: (p: P, news: SaasOidcApplicationProps, output?: SaasOidcApplicationAttributes) => Effect.Effect<SaasOidcApplicationAttributes, any, never>;
+export declare const read: (p: P, olds: SaasOidcApplicationProps, output?: SaasOidcApplicationAttributes) => Effect.Effect<SaasOidcApplicationAttributes | undefined, any, never>;
+/** The writes the fake saw, in order: `['POST', 'PUT', …]`. */
+export declare const writes: (fake: FakeAccess) => string[];
+type Rows = Record<string, Record<string, Record<string, State.ResourceState>>>;
+/**
+ * ★ THE REAL ENGINE, NOT A MODEL OF IT: `Plan.make` + `apply` over an in-memory state store, as
+ *   mesh-node-harness.ts does. `rows` is that store, so a test can serialise exactly what Alchemy
+ *   would persist.
+ */
+export declare const engine: (fake: FakeAccess, extra?: Layer.Layer<never, never, never>) => {
+    deploy: <A, E, R>(declare: Effect.Effect<A, E, R>) => Promise<Exit.Exit<unknown, unknown>>;
+    rows: Rows;
+    status: (fqn: string) => "created" | "creating" | "deleting" | "replaced" | "replacing" | "updated" | "updating" | undefined;
+};
+/** The failure sentence of a deploy, or `''` when it succeeded. */
+export declare const failureOf: (exit: Exit.Exit<unknown, unknown>) => string;
+export {};
+//# sourceMappingURL=saas-oidc-harness.d.ts.map

package/dist/cloudflare/saas-oidc-harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saas-oidc-harness.d.ts","sourceRoot":"","sources":["../../src/cloudflare/saas-oidc-harness.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,KAAK,MAAM,eAAe,CAAC;AAGvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,KAAK,UAAU,EAAQ,MAAM,kBAAkB,CAAC;AAEzD,OAAO,KAAK,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAA+B,MAAM,gBAAgB,CAAC;AAclF,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CACpB,CAAC;AAEnE,eAAO,MAAM,GAAG;IAAK,GAAG;IAAoB,EAAE;IAAc,UAAU;CAAS,CAAC;AAChF,eAAO,MAAM,KAAK;IAAK,QAAQ,EAAQ,KAAK;IAAE,OAAO,EAAe,KAAK;CAAE,CAAC;AAE5E,MAAM,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AAEpE,8DAA8D;AAC9D,eAAO,MAAM,YAAY,UACjB,OAAO,CAAC,wBAAwB,CAAC,KACtC,wBAaD,CAAC;AAEH,kGAAkG;AAClG,eAAO,MAAM,SAAS;IACpB,SAAS;IACT,aAAa;IACb,MAAM;IACN,WAAW;IACX,qBAAqB;IACrB,gCAAgC;CACjC,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,QAAQ,UAAU,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,eAWlF,CAAC;AAEJ,eAAO,MAAM,SAAS,MACjB,CAAC,QACE,wBAAwB,WACrB,6BAA6B,6DAC6B,CAAC;AAEtE,eAAO,MAAM,IAAI,MACZ,CAAC,QACE,wBAAwB,WACrB,6BAA6B,yEAKvC,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,MAAM,SAAU,UAAU,aAC2B,CAAC;AAEnE,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,MAAM,SAAU,UAAU,UAAS,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;aAO9D,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;;kBAexC,MAAM;CAEvB,CAAC;AAEF,mEAAmE;AACnE,eAAO,MAAM,SAAS,SAAU,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,WACG,CAAC"}

package/dist/cloudflare/saas-oidc-lifecycle.d.ts

@@ -0,0 +1,14 @@
+import * as Effect from 'effect/Effect';
+import { SaasOidcError } from './saas-oidc-error.ts';
+import { type SaasOidcApplicationAttributes, type SaasOidcApplicationProps } from './saas-oidc-form.ts';
+/**
+ * Owned: refresh by the stored id ONLY (gone is `undefined`, never a same-named app). Cold: find the app by `applicationId` or exact name and hand it
+ * back `Unowned`, so Alchemy refuses to take it over until the stack says `adopt(true)`.
+ * ★ `olds` MAY PREDATE `teamDomain` (state written by the openbao copy of this resource): the host
+ *   Cloudflare reports for the app stands in, so the first plan after the move can still read.
+ */
+export declare const readSaasOidc: (accountId: string, id: string, olds: SaasOidcApplicationProps | undefined, output: SaasOidcApplicationAttributes | undefined) => Effect.Effect<SaasOidcApplicationAttributes | undefined, import("@distilled.cloud/cloudflare/zero-trust").AccessReferenceNotFound | import("@distilled.cloud/cloudflare/Errors").CloudflareError | import("@distilled.cloud/cloudflare/Errors").CloudflareHttpError | import("@distilled.cloud/cloudflare/Errors").CloudflareRateLimited | import("effect/http/HttpClientError").HttpClientError | import("@distilled.cloud/cloudflare/Errors").InvalidRoute | SaasOidcError | import("@distilled.cloud/cloudflare/Errors").UnknownCloudflareError | import("@distilled.cloud/cloudflare/Credentials").CredentialsError | import("@distilled.cloud/grafana").DefaultErrors, import("alchemy").InstanceId | import("alchemy").Stack | import("alchemy").Stage | import("@distilled.cloud/cloudflare/Protocol").CloudflareOpContext>;
+/** observe, ensure (create or sync), read back. A no-op when nothing drifted. */
+export declare const reconcileSaasOidc: (accountId: string, id: string, news: SaasOidcApplicationProps, output: SaasOidcApplicationAttributes | undefined) => Effect.Effect<SaasOidcApplicationAttributes, import("@distilled.cloud/cloudflare/zero-trust").AccessDestinationConflict | import("@distilled.cloud/cloudflare/zero-trust").AccessReferenceNotFound | import("@distilled.cloud/cloudflare/Errors").CloudflareError | import("@distilled.cloud/cloudflare/Errors").CloudflareHttpError | import("@distilled.cloud/cloudflare/Errors").CloudflareRateLimited | import("@distilled.cloud/caddy").ConfigError | import("effect/http/HttpClientError").HttpClientError | import("@distilled.cloud/cloudflare/Errors").InvalidRoute | import("@distilled.cloud/cloudflare/Credentials").OAuthRefreshError | import("@distilled.cloud/cloudflare/zero-trust").OrganizationNotFound | SaasOidcError | import("@distilled.cloud/cloudflare/Errors").UnknownCloudflareError | import("@distilled.cloud/grafana").DefaultErrors, import("alchemy").InstanceId | import("alchemy").Stack | import("alchemy").Stage | import("@distilled.cloud/cloudflare/Protocol").CloudflareOpContext>;
+export declare const deleteSaasOidc: (output: SaasOidcApplicationAttributes) => Effect.Effect<void, import("@distilled.cloud/cloudflare/Errors").CloudflareError | import("@distilled.cloud/cloudflare/Errors").CloudflareHttpError | import("@distilled.cloud/cloudflare/Errors").CloudflareRateLimited | import("@distilled.cloud/caddy").ConfigError | import("effect/http/HttpClientError").HttpClientError | import("@distilled.cloud/cloudflare/Errors").InvalidRoute | import("@distilled.cloud/cloudflare/Credentials").OAuthRefreshError | SaasOidcError | import("@distilled.cloud/cloudflare/Errors").UnknownCloudflareError | import("@distilled.cloud/grafana").DefaultErrors, import("@distilled.cloud/cloudflare/Protocol").CloudflareOpContext>;
+//# sourceMappingURL=saas-oidc-lifecycle.d.ts.map

package/dist/cloudflare/saas-oidc-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saas-oidc-lifecycle.d.ts","sourceRoot":"","sources":["../../src/cloudflare/saas-oidc-lifecycle.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAM9B,MAAM,qBAAqB,CAAC;AAqC7B;;;;;GAKG;AACH,eAAO,MAAM,YAAY,cACZ,MAAM,MACb,MAAM,QACJ,wBAAwB,GAAG,SAAS,UAClC,6BAA6B,GAAG,SAAS,uyBAiB/C,CAAC;AASL,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,cACjB,MAAM,MACb,MAAM,QACJ,wBAAwB,UACtB,6BAA6B,GAAG,SAAS,g+BAmD/C,CAAC;AAEL,eAAO,MAAM,cAAc,WAAY,6BAA6B,opBACjB,CAAC"}

package/dist/cloudflare/saas-oidc-props.d.ts

@@ -0,0 +1,139 @@
+/**
+ * The declared shape of `HomeFlare.Access.SaasOidcApplication` and what it reports back, apart from
+ * the pure helpers that use them (saas-oidc-form.ts re-exports both types, so imports keep working).
+ *
+ * ★ EVERY PROP FIELD CARRIES A JSDOC (provider standard S5). Where the wording below is the API's,
+ *   it is the SDK's own field doc on the request type
+ *   (`@distilled.cloud/cloudflare@1.0.0-rc.13` `zero-trust` `CreateAccessApplicationForAccountRequest`
+ *   and `AccessApplicationsCreateRequestSaasAppOIDCSaaSApp`, src/services/zero_trust.ts:9025-9053 and
+ *   :9728-9794), so a reader gets the vendor's meaning without leaving the editor.
+ * ⛔ THE ATTRIBUTES NEVER HOLD THE CLIENT SECRET, and nothing here can: there is no field for it.
+ */
+/**
+ * An OIDC flow Access can serve for the client: the five literals the SDK names
+ * (`AccessApplicationsCreateRequestSaasAppOIDCSaaSAppGrantTypesItem`, zero_trust.ts:8946-8951).
+ */
+export type OidcGrantType = 'authorization_code' | 'authorization_code_with_pkce' | 'refresh_tokens' | 'hybrid' | 'implicit';
+/** The user information the client may request from Access. */
+export type OidcScope = 'openid' | 'email' | 'profile' | 'groups';
+export interface SaasOidcApplicationProps {
+    /**
+     * Live Access application UUID. Set this when adopting a SaaS app that already exists. Without
+     * it the app is found by exact `name` among saas apps, which also works but refuses two matches.
+     */
+    readonly applicationId?: string;
+    /** The app's name. Defaults to a physical name derived from the logical id. */
+    readonly name?: string;
+    /**
+     * The Zero Trust team domain the issuer lives on, a bare hostname such as
+     * `example.cloudflareaccess.com`: no scheme, no path. Not read from the environment, so the
+     * issuer in the attributes is the one the declaration says.
+     */
+    readonly teamDomain: string;
+    /**
+     * How long Access sessions for this app last, in the API's duration format (`300ms` or `2h45m`).
+     * Written on create and on any sync; not drift-checked.
+     * @default '24h'
+     */
+    readonly sessionDuration?: string;
+    /**
+     * Ids of the identity providers users may pick for this app. Written on create and on any sync;
+     * not drift-checked.
+     * @default every IdP configured in the account (the field is left out of the write)
+     */
+    readonly allowedIdps?: ReadonlyArray<string>;
+    /**
+     * `true` makes users skip the identity-provider selection step; the API requires exactly one
+     * entry in `allowedIdps` then. Written on create and on any sync; not drift-checked.
+     * @default left out of the write (the API's default)
+     */
+    readonly autoRedirectToIdentity?: boolean;
+    /**
+     * Show the app in the App Launcher. Written on create and on any sync; not drift-checked.
+     * @default false
+     */
+    readonly appLauncherVisible?: boolean;
+    /**
+     * Ids of reusable Access policies, in ascending order of precedence (the SDK's own wording:
+     * zero_trust.ts:9774). The ORDER is part of the declaration: a reorder is drift and is synced.
+     */
+    readonly policies: ReadonlyArray<string>;
+    /** The OIDC client: the `saas_app` object of the Access application. */
+    readonly saasApp: {
+        /** The authentication protocol of the SaaS app. Only `oidc` is supported by this resource. */
+        readonly authType: 'oidc';
+        /**
+         * The permitted URLs for Cloudflare to return authorization codes and tokens to. Compared as
+         * a set (order is not significant to the API).
+         */
+        readonly redirectUris: ReadonlyArray<string>;
+        /** The user information shared with the client. Compared as a set. */
+        readonly scopes: ReadonlyArray<OidcScope>;
+        /** The OIDC flows the client may use. Compared as a set. */
+        readonly grantTypes: ReadonlyArray<OidcGrantType>;
+        /** Lifetime of the access token after creation: `m` or `h` units, `1m` to `24h` (the SDK field doc). */
+        readonly accessTokenLifetime: string;
+        /**
+         * How long a refresh token is valid after creation: `m`, `h` or `d` units, longer than `1m`
+         * (the SDK field doc). Needed for the `refresh_tokens` grant. Sent as `refreshTokenOptions.lifetime`.
+         * @default left out of the write
+         */
+        readonly refreshTokenLifetime?: string;
+        /**
+         * `true` makes this a PUBLIC client: the token endpoint does not require a client secret when
+         * the `authorization_code_with_pkce` grant is used, and then no secret exists to keep. Refused
+         * without that grant.
+         * @default false (a confidential client)
+         */
+        readonly allowPkceWithoutClientSecret?: boolean;
+        /**
+         * The URL the app's tile in the App Launcher sends users to. Written on create and on any
+         * sync; not drift-checked.
+         * @default left out of the write
+         */
+        readonly appLauncherUrl?: string;
+    };
+}
+export interface SaasOidcApplicationAttributes {
+    /** The Access application UUID. */
+    readonly applicationId: string;
+    /** The application audience tag, the `aud` of the Access JWTs for this app. */
+    readonly aud: string;
+    /** The `domain` Cloudflare reports for the app (the OIDC issuer without its scheme). */
+    readonly domain: string;
+    /** The app's name as Cloudflare reports it. */
+    readonly name: string;
+    /** The account the app lives in. */
+    readonly accountId: string;
+    /** The declared team domain (or, for state that predates the prop, the host Cloudflare reports). */
+    readonly teamDomain: string;
+    /** The OIDC client id, for the relying party's configuration. */
+    readonly clientId: string;
+    /** `https://<teamDomain>/cdn-cgi/access/sso/oidc/<clientId>`. */
+    readonly issuer: string;
+    /** `<issuer>/authorization`. */
+    readonly authorizationEndpoint: string;
+    /** `<issuer>/token`. */
+    readonly tokenEndpoint: string;
+    /** The signing keys, for a verifier that validates ID tokens. */
+    readonly jwksEndpoint: string;
+    /** `<issuer>/userinfo`. */
+    readonly userinfoEndpoint: string;
+    /** `<issuer>/.well-known/openid-configuration`. */
+    readonly configurationEndpoint: string;
+    /** The redirect URIs the live app permits. */
+    readonly redirectUris: ReadonlyArray<string>;
+    /** The scopes the live app serves. */
+    readonly scopes: ReadonlyArray<string>;
+    /** The grant types the live app allows. */
+    readonly grantTypes: ReadonlyArray<string>;
+    /** The live access token lifetime, or `''` when Cloudflare reports none. */
+    readonly accessTokenLifetime: string;
+    /** The live refresh token lifetime, or `''` when Cloudflare reports none. */
+    readonly refreshTokenLifetime: string;
+    /** When Cloudflare created the app, if it says. */
+    readonly createdAt: string | undefined;
+    /** When Cloudflare last updated the app, if it says. */
+    readonly updatedAt: string | undefined;
+}
+//# sourceMappingURL=saas-oidc-props.d.ts.map

package/dist/cloudflare/saas-oidc-props.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saas-oidc-props.d.ts","sourceRoot":"","sources":["../../src/cloudflare/saas-oidc-props.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,oBAAoB,GACpB,8BAA8B,GAC9B,gBAAgB,GAChB,QAAQ,GACR,UAAU,CAAC;AAEf,+DAA+D;AAC/D,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AAElE,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE;QAChB,8FAA8F;QAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B;;;WAGG;QACH,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAC7C,sEAAsE;QACtE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;QAC1C,4DAA4D;QAC5D,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;QAClD,wGAAwG;QACxG,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC;;;;WAIG;QACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;QACvC;;;;;WAKG;QACH,QAAQ,CAAC,4BAA4B,CAAC,EAAE,OAAO,CAAC;QAChD;;;;WAIG;QACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;KAClC,CAAC;CACH;AAED,MAAM,WAAW,6BAA6B;IAC5C,mCAAmC;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oGAAoG;IACpG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gCAAgC;IAChC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,wBAAwB;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,2BAA2B;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,mDAAmD;IACnD,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,sCAAsC;IACtC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,2CAA2C;IAC3C,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,4EAA4E;IAC5E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,6EAA6E;IAC7E,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC"}

package/dist/cloudflare/saas-oidc-team.d.ts

@@ -0,0 +1,9 @@
+import * as zeroTrust from '@distilled.cloud/cloudflare/zero-trust';
+import * as Effect from 'effect/Effect';
+import { SaasOidcError } from './saas-oidc-error.ts';
+/**
+ * A refusal when the account's organization is read and its domain is not the declared one; else
+ * `undefined` (it matches, or it could not be read, see above). Hostnames compare case-insensitively.
+ */
+export declare const checkTeamBeforeCreate: (accountId: string, teamDomain: string) => Effect.Effect<SaasOidcError | undefined, import("@distilled.cloud/cloudflare/Errors").CloudflareError | import("@distilled.cloud/cloudflare/Errors").CloudflareHttpError | import("@distilled.cloud/cloudflare/Errors").CloudflareRateLimited | import("@distilled.cloud/caddy").ConfigError | import("effect/http/HttpClientError").HttpClientError | import("@distilled.cloud/cloudflare/Errors").InvalidRoute | import("@distilled.cloud/cloudflare/Credentials").OAuthRefreshError | zeroTrust.OrganizationNotFound | SaasOidcError | import("@distilled.cloud/cloudflare/Errors").UnknownCloudflareError | import("@distilled.cloud/grafana").DefaultErrors, zeroTrust.CloudflareOpContext>;
+//# sourceMappingURL=saas-oidc-team.d.ts.map

package/dist/cloudflare/saas-oidc-team.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saas-oidc-team.d.ts","sourceRoot":"","sources":["../../src/cloudflare/saas-oidc-team.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,SAAS,MAAM,wCAAwC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,aAAa,EAAY,MAAM,sBAAsB,CAAC;AAyB/D;;;GAGG;AACH,eAAO,MAAM,qBAAqB,cAAe,MAAM,cAAc,MAAM,qqBASxE,CAAC"}

package/dist/cloudflare/saas-oidc-wire.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The wire shapes of a SaaS OIDC application, and the parse that reads them: pure, no Effect, no
+ * request. saas-oidc-api.ts says why the read is raw JSON (the SDK's responses drop `saas_app`).
+ *
+ * ⛔ `parseApp` COPIES NAMED FIELDS ONLY, and `client_secret` is not among them: an `ObservedApp`
+ *   has nowhere to hold the client secret, so no code path can persist or log one.
+ */
+/** The OIDC half of a live SaaS app, from the wire JSON. */
+export interface ObservedSaas {
+    readonly authType: string | undefined;
+    readonly clientId: string | undefined;
+    readonly redirectUris: ReadonlyArray<string> | undefined;
+    readonly scopes: ReadonlyArray<string> | undefined;
+    readonly grantTypes: ReadonlyArray<string> | undefined;
+    readonly accessTokenLifetime: string | undefined;
+    readonly refreshTokenLifetime: string | undefined;
+    readonly allowPkceWithoutClientSecret: boolean | undefined;
+}
+/** A live Access application as this package sees it. ⛔ There is no secret field, on purpose. */
+export interface ObservedApp {
+    readonly id: string | undefined;
+    readonly aud: string | undefined;
+    readonly type: string | undefined;
+    readonly name: string | undefined;
+    readonly domain: string | undefined;
+    readonly createdAt: string | undefined;
+    readonly updatedAt: string | undefined;
+    readonly policyIds: ReadonlyArray<string>;
+    readonly saasApp: ObservedSaas | undefined;
+}
+/** What a create or an update sends. Built by `writeBody` in saas-oidc-form.ts. */
+export interface AppWrite {
+    readonly name: string;
+    readonly sessionDuration: string;
+    readonly allowedIdps: ReadonlyArray<string> | undefined;
+    readonly autoRedirectToIdentity: boolean | undefined;
+    readonly appLauncherVisible: boolean;
+    readonly policies: ReadonlyArray<string>;
+    readonly saasApp: {
+        readonly authType: 'oidc';
+        readonly redirectUris: ReadonlyArray<string>;
+        readonly scopes: ReadonlyArray<string>;
+        readonly grantTypes: ReadonlyArray<string>;
+        readonly accessTokenLifetime: string;
+        readonly refreshTokenOptions?: {
+            readonly lifetime: string;
+        };
+        readonly allowPkceWithoutClientSecret: boolean;
+        readonly appLauncherUrl: string | undefined;
+    };
+}
+export declare const record: (value: unknown) => Record<string, unknown> | undefined;
+/**
+ * Named fields only, from Cloudflare's snake_case JSON. ⛔ `client_secret` is not among them, and
+ * `public_key`, `custom_claims` and `hybrid_and_implicit_options` are not used by this resource.
+ */
+export declare const parseApp: (raw: Record<string, unknown>) => ObservedApp;
+//# sourceMappingURL=saas-oidc-wire.d.ts.map

package/dist/cloudflare/saas-oidc-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saas-oidc-wire.d.ts","sourceRoot":"","sources":["../../src/cloudflare/saas-oidc-wire.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,4DAA4D;AAC5D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,4BAA4B,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5D;AAED,iGAAiG;AACjG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,SAAS,CAAC;CAC5C;AAED,mFAAmF;AACnF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,sBAAsB,EAAE,OAAO,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAC7C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QACvC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAC3C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,mBAAmB,CAAC,EAAE;YAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7D,QAAQ,CAAC,4BAA4B,EAAE,OAAO,CAAC;QAC/C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;KAC7C,CAAC;CACH;AAOD,eAAO,MAAM,MAAM,UAAW,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAGnD,CAAC;AAuBhB;;;GAGG;AACH,eAAO,MAAM,QAAQ,QAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,WA2BvD,CAAC"}

package/dist/cloudflare/saas-oidc.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `HomeFlare.Access.SaasOidcApplication` — a Cloudflare Access SaaS application that makes Access an
+ * OIDC identity provider for one relying party (OpenBao's JWT/OIDC auth, Headlamp, a Kubernetes
+ * API server). Usage and the secret rules: docs/saas-oidc.md.
+ *
+ * 🔴 WHY THIS EXISTS ALONGSIDE `Cloudflare.Access.Application`. Alchemy beta.81's Application has
+ *   no `saas_app` field (its source mentions `saas` only as a type and in two comments), and
+ *   `@distilled.cloud/cloudflare` rc.13 decodes a saas app's GET and create response WITHOUT it, so
+ *   the client id cannot be read back through either. See saas-oidc-api.ts.
+ *
+ * ⛔ THE TYPE ID IS A STATE KEY, AND THIS ONE WAS MOVED, NOT RENAMED. It is the string the
+ *   homeflare-openbao stack's live `OpenBaoOidcSaas` row was written under. A different string would
+ *   make the next plan see a new resource and an orphaned one: a second OIDC app, with a new
+ *   client id and `aud`, and a delete of the live one unless it were retained. `tests` pin it.
+ *
+ * ★ `retain` BY DEFAULT, like every kit resource whose deletion breaks its consumers: deleting the
+ *   app deletes the client id every relying party is configured with. The openbao declaration
+ *   already pipes `RemovalPolicy.retain()`; `delete` stays fully implemented for a declaration
+ *   that opts in with `.pipe(RemovalPolicy.destroy())`.
+ */
+import { Credentials } from '@distilled.cloud/cloudflare/Credentials';
+import * as Cloudflare from 'alchemy/Cloudflare';
+import * as Provider from 'alchemy/Provider';
+import { Resource, type ResourceClass } from 'alchemy/Resource';
+import * as HttpClient from 'effect/http/HttpClient';
+import type { Providers } from './providers.ts';
+import type { SaasOidcApplicationAttributes, SaasOidcApplicationProps } from './saas-oidc-form.ts';
+export interface SaasOidcApplication extends Resource<'HomeFlare.Access.SaasOidcApplication', SaasOidcApplicationProps, SaasOidcApplicationAttributes, never, Providers> {
+}
+export declare const SaasOidcApplication: ResourceClass<SaasOidcApplication>;
+/**
+ * ★ `Provider.effect`, CAPTURING THE THREE SERVICES AT BUILD, as MeshNodeProvider does
+ *   (mesh-node.ts): correct whether or not the stack also merges `Cloudflare.providers()`.
+ */
+export declare const SaasOidcApplicationProvider: () => import("effect/Layer").Layer<Provider.Provider<SaasOidcApplication>, never, Cloudflare.CloudflareEnvironment | Credentials | HttpClient.HttpClient | import("alchemy").Stack | import("alchemy").Stage>;
+//# sourceMappingURL=saas-oidc.d.ts.map

package/dist/cloudflare/saas-oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saas-oidc.d.ts","sourceRoot":"","sources":["../../src/cloudflare/saas-oidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AACtE,OAAO,KAAK,UAAU,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,KAAK,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAEnG,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,sCAAsC,EACtC,wBAAwB,EACxB,6BAA6B,EAC7B,KAAK,EACL,SAAS,CACV;CAAG;AAEJ,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,mBAAmB,CAG/D,CAAC;AAOL;;;GAGG;AACH,eAAO,MAAM,2BAA2B,+MAqDrC,CAAC"}

package/dist/talos/cluster-adapter-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-adapter-errors.d.ts","sourceRoot":"","sources":["../../src/talos/cluster-adapter-errors.ts"],"names":[],"mappings":";;;AAMA,sEAAsE;AACtE,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,qFAAqF;AACrF,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,8FAA8F;AAC9F,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;CACpB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAQ7B;CACF;;;;AAED,+FAA+F;AAC/F,qBAAa,iBAAkB,SAAQ,uBAAsC;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAQ7B;CACF;;;;AAED,oGAAoG;AACpG,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,qGAAqG;AACrG,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,4DAA4D;AAC5D,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,8FAA8F;AAC9F,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;CACpB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,4FAA4F;AAC5F,qBAAa,4BAA6B,SAAQ,kCAAiD;IACjG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,qFAAqF;AACrF,qBAAa,8BAA+B,SAAQ,oCAElD;IACA,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,mGAAmG;AACnG,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,uFAAuF;AACvF,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;CACpB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF"}
+{"version":3,"file":"cluster-adapter-errors.d.ts","sourceRoot":"","sources":["../../src/talos/cluster-adapter-errors.ts"],"names":[],"mappings":";;;AAMA,sEAAsE;AACtE,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,qFAAqF;AACrF,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,8FAA8F;AAC9F,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;CACpB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAQ7B;CACF;;;;AAED,+FAA+F;AAC/F,qBAAa,iBAAkB,SAAQ,uBAAsC;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAQ7B;CACF;;;;AAED,oGAAoG;AACpG,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,qGAAqG;AACrG,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,4DAA4D;AAC5D,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,8FAA8F;AAC9F,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;CACpB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,4FAA4F;AAC5F,qBAAa,4BAA6B,SAAQ,kCAAiD;IACjG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,qFAAqF;AACrF,qBAAa,8BAA+B,SAAQ,oCAElD;IACA,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,mGAAmG;AACnG,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,uFAAuF;AACvF,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;CACpB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF"}

package/dist/talos/cluster-adapter.d.ts

@@ -33,7 +33,8 @@
  *   (`TalosClusterMoved`); a move is a NEW identity resource per physical cluster, so the old
  *   rows keep their old uid and their cleanup reaches only the old cluster.
  * ⛔ ONE 10 s DEADLINE covers the vault read AND the uid GET (`withConnectDeadline`): a hung `bao`
- *   or silent apiserver fails with `TalosOpenBaoConnectTimeout` and the `bao` child is killed.
+ *   fails with `TalosOpenBaoConnectTimeout` and the `bao` child is killed. The uid GET has its own
+ *   5 s deadline inside it, so a silent apiserver fails first with `TalosClusterIdentityTimeout`.
  *   ⚠️ The in-flight HTTPS GET is NOT aborted: upstream `readObject` takes no signal
  *   (`internal/client.ts:75`), so the socket lives until the OS gives up. Left for the upstream ask.
  *

package/dist/talos/cluster-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-adapter.d.ts","sourceRoot":"","sources":["../../src/talos/cluster-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAEL,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,KAAK,gBAAgB,EACtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,KAAK,4BAA4B,EACjC,2BAA2B,EAC3B,KAAK,2BAA2B,EAChC,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,oBAAoB,EACpB,KAAK,0BAA0B,EAC/B,sBAAsB,EACtB,0BAA0B,EAE1B,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAEL,KAAK,mBAAmB,EAGzB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,2BAA2B,EAC3B,8BAA8B,EAC9B,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,KAAK,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEvF,OAAO,QAAQ,+BAA+B,CAAC;IAC7C,UAAU,YAAY;QACpB;;;WAGG;QACH,eAAe,EAAE;YACf;;;;eAIG;YACH,GAAG,EAAE,MAAM,CAAC;SACb,CAAC;KACH;CACF;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE/E,kGAAkG;AAClG,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG;IAChD,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAAS,MAAM,KAAG,sBAGpD,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,YACrB,kBAAkB,cACf,UAAU,YACb,QAAQ,CAAC,QAAQ,KACzB,MAAM,CAAC,MAAM,CACd,gBAAgB,EACd,oBAAoB,GACpB,0BAA0B,GAC1B,wBAAwB,GACxB,sBAAsB,GACtB,2BAA2B,GAC3B,4BAA4B,GAC5B,8BAA8B,GAC9B,2BAA2B,GAC3B,0BAA0B,GAC1B,oBAAoB,GACpB,oBAAoB,GACpB,yBAAyB,GACzB,KAAK,EACP,mBAAmB,CAAC,mBAAmB,CAyDrC,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,WACtB,kBAAkB,KACzB,KAAK,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,EAAE,mBAAmB,CAAC,mBAAmB,CAYjF,CAAC"}
+{"version":3,"file":"cluster-adapter.d.ts","sourceRoot":"","sources":["../../src/talos/cluster-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAEL,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,KAAK,gBAAgB,EACtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,KAAK,4BAA4B,EACjC,2BAA2B,EAC3B,KAAK,2BAA2B,EAChC,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,oBAAoB,EACpB,KAAK,0BAA0B,EAC/B,sBAAsB,EACtB,0BAA0B,EAE1B,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAEL,KAAK,mBAAmB,EAGzB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,2BAA2B,EAC3B,8BAA8B,EAC9B,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,KAAK,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEvF,OAAO,QAAQ,+BAA+B,CAAC;IAC7C,UAAU,YAAY;QACpB;;;WAGG;QACH,eAAe,EAAE;YACf;;;;eAIG;YACH,GAAG,EAAE,MAAM,CAAC;SACb,CAAC;KACH;CACF;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE/E,kGAAkG;AAClG,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG;IAChD,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAAS,MAAM,KAAG,sBAGpD,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,YACrB,kBAAkB,cACf,UAAU,YACb,QAAQ,CAAC,QAAQ,KACzB,MAAM,CAAC,MAAM,CACd,gBAAgB,EACd,oBAAoB,GACpB,0BAA0B,GAC1B,wBAAwB,GACxB,sBAAsB,GACtB,2BAA2B,GAC3B,4BAA4B,GAC5B,8BAA8B,GAC9B,2BAA2B,GAC3B,0BAA0B,GAC1B,oBAAoB,GACpB,oBAAoB,GACpB,yBAAyB,GACzB,KAAK,EACP,mBAAmB,CAAC,mBAAmB,CAyDrC,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,WACtB,kBAAkB,KACzB,KAAK,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,EAAE,mBAAmB,CAAC,mBAAmB,CAYjF,CAAC"}

package/dist/talos/index.js

@@ -71,7 +71,7 @@ class TalosClusterIdentityUnreadable extends Data.TaggedError("TalosClusterIdent
 
 class TalosClusterIdentityTimeout extends Data.TaggedError("TalosClusterIdentityTimeout") {
   get message() {
-    return `talos-openbao cluster '${this.cluster}': no answer to the kube-system uid read within ` + `${this.seconds}s. Refused (failed closed) rather than waiting on a silent apiserver.`;
+    return `talos-openbao cluster '${this.cluster}': no answer to the kube-system uid read within ` + `${this.seconds}s (the identity read's own deadline, inside the 10 s connect deadline). ` + "Refused (failed closed) rather than waiting on a silent apiserver.";
   }
 }
 
@@ -240,7 +240,7 @@ var resolveBao = () => {
 };
 
 // src/talos/mint-temp-file.ts
-import { closeSync, openSync, writeFileSync } from "node:fs";
+import { closeSync, openSync, unlinkSync, writeFileSync } from "node:fs";
 import { unlink } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
@@ -252,9 +252,16 @@ var mintKvTempFile = (raw, label) => Effect3.gen(function* () {
     try: () => {
       const fd = openSync(path, "wx", 384);
       try {
-        writeFileSync(fd, raw);
-      } finally {
-        closeSync(fd);
+        try {
+          writeFileSync(fd, raw);
+        } finally {
+          closeSync(fd);
+        }
+      } catch (cause) {
+        try {
+          unlinkSync(path);
+        } catch {}
+        throw cause;
       }
     },
     catch: (cause) => new Error(`writing ${label} temp file: ${String(cause)}`)
@@ -590,15 +597,19 @@ var capture = (binary, argv) => Effect8.gen(function* () {
     stdout: child.stdout.pipe(Stream3.decodeText, Stream3.mkString, Effect8.map((text) => text.trim()))
   }, { concurrency: "unbounded" })), Effect8.scoped);
 });
+var VERSION_PROBE_TIMEOUT = Duration5.seconds(10);
 var reportsPinnedVersion = (stdout) => stdout.split(/[^\w.+-]+/).includes(TALOSCTL_PINNED_VERSION);
-var checkOverrideVersion = (binary, source) => capture(binary, ["version", "--client"]).pipe(Effect8.flatMap((out) => out.exitCode === 0 && reportsPinnedVersion(out.stdout) ? Effect8.void : Effect8.fail(new TalosBinaryRefused("version --client", `${source} is not talosctl ${TALOSCTL_PINNED_VERSION} (exit ${String(out.exitCode)})`, binary))));
+var checkOverrideVersion = (binary, source, timeout = VERSION_PROBE_TIMEOUT) => capture(binary, ["version", "--client"]).pipe(Effect8.timeoutOrElse({
+  duration: timeout,
+  orElse: () => Effect8.fail(new TalosBinaryRefused("version --client", `${source} did not answer within ${String(Duration5.toSeconds(timeout))}s`, binary))
+}), Effect8.flatMap((out) => out.exitCode === 0 && reportsPinnedVersion(out.stdout) ? Effect8.void : Effect8.fail(new TalosBinaryRefused("version --client", `${source} is not talosctl ${TALOSCTL_PINNED_VERSION} (exit ${String(out.exitCode)})`, binary))));
 var talosctl = (args, options) => Effect8.gen(function* () {
   const requested = talosctlBinary(options.binary);
   const resolved = requested === DEFAULT_TALOSCTL_BINARY ? yield* resolveDefault(requested) : requested;
   const fromOption = options.binary?.trim();
   const source = requested === DEFAULT_TALOSCTL_BINARY ? "talosctl on PATH" : fromOption !== undefined && fromOption !== "" ? "the `binary` option" : TALOSCTL_BINARY_ENV;
   const binary = yield* checkBinaryPath(resolved, source);
-  yield* checkOverrideVersion(binary, source);
+  yield* checkOverrideVersion(binary, source, options.versionProbeTimeout);
   const argv = [
     ...args,
     "--talosconfig",
@@ -1074,5 +1085,5 @@ export {
   talosOpenBaoConnection
 };
 
-//# debugId=0069C805BB1B149764756E2164756E21
+//# debugId=E9E48AF60568B1C664756E2164756E21
 //# sourceMappingURL=index.js.map