@homeflare/alchemy 0.48.1 → 0.50.0

package/README.md

@@ -69,6 +69,17 @@ const door = yield * MeshNode('vault-door', { name: 'door-a', ha: false });
 
 Guide, the enrolment step and every replace case: [docs/mesh-node.md](./docs/mesh-node.md).
 
+## CloudflaredTunnel
+
+A remotely configured Cloudflare Tunnel declared **without its connector token in state**
+(`Cloudflare.Tunnel.Tunnel` stores it in plaintext): [docs/cloudflared-tunnel.md](./docs/cloudflared-tunnel.md).
+
+## SaasOidcApplication
+
+A Cloudflare Access SaaS application of auth type `oidc` (Access as the OpenID Connect provider for
+one relying party), exposing `issuer`, `clientId` and `jwksEndpoint`. Guide, the client-secret
+rules, adoption and drift: [docs/saas-oidc.md](./docs/saas-oidc.md).
+
 ## Website.Astro / Website.Vite
 
 House flags on Alchemy's own stacks — the two this estate actually ships.

package/dist/cloudflare/cloudflared-tunnel-api.d.ts

@@ -0,0 +1,87 @@
+/**
+ * The `cfd_tunnel` calls a Cloudflare Tunnel (the cloudflared kind) needs, and nothing else.
+ *
+ * ★ OVER `@distilled.cloud/cloudflare`, THE SDK ALCHEMY'S OWN CLOUDFLARE PROVIDERS USE, the same
+ *   one mesh-node-api.ts calls. The operations are `createTunnelCloudflared` (POST
+ *   `/accounts/{account_id}/cfd_tunnel`), `getTunnelCloudflared`, `patchTunnelCloudflared`,
+ *   `deleteTunnelCloudflared` and the account-wide `listTunnels` (GET `/accounts/{id}/tunnels`,
+ *   filtered to `cfd_tunnel`), all in distilled `1.0.0-rc.13` `src/services/zero_trust.ts`
+ *   (read 2026-10-09).
+ *
+ * ⛔ NO FUNCTION IN THIS FILE CALLS `getTunnelCloudflaredToken`, AND `observe` COPIES NAMED FIELDS
+ *   ONLY. Alchemy's own `Cloudflare.Tunnel.Tunnel` (beta.81, Tunnel/Tunnel.ts `reconcile`, `read`
+ *   and `list`) fetches the token on every call and stores it as a `Redacted` attribute, which
+ *   `encodeState` (State/StateEncoding.ts) writes into state as `{"__redacted__": "<token>"}`:
+ *   plaintext, and the token runs the tunnel. This package never holds it, so there is nothing to
+ *   leak. See cloudflared-tunnel-form.ts.
+ * ⚠️ `createTunnelCloudflared` takes no `tunnelSecret` here either: the schema calls the field the
+ *   password for a locally-managed tunnel and marks it optional (distilled rc.13 zero_trust.ts,
+ *   `CreateTunnelCloudflaredRequest`); that Cloudflare generates one when it is omitted is
+ *   UNVERIFIED, and a remotely managed tunnel needs no secret on our side.
+ */
+import * as zeroTrust from '@distilled.cloud/cloudflare/zero-trust';
+import * as Effect from 'effect/Effect';
+/** A live tunnel as this package sees it. ⛔ There is no token or secret field, on purpose. */
+export interface ObservedTunnel {
+    readonly id: string;
+    readonly name: string;
+    /** `undefined` when the response omitted it; only an explicit `local` is refused (lifecycle). */
+    readonly configSrc: 'cloudflare' | 'local' | undefined;
+}
+declare const CloudflaredTunnelError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "CloudflaredTunnelError";
+} & Readonly<A>;
+/** A refusal or failure, carrying the sentence an operator needs. Never a token. */
+export declare class CloudflaredTunnelError extends CloudflaredTunnelError_base<{
+    readonly message: string;
+}> {
+}
+type Raw = {
+    readonly id?: string | null;
+    readonly name?: string | null;
+    readonly configSrc?: string | null;
+    readonly tunType?: string | null;
+    readonly deletedAt?: string | null;
+};
+/**
+ * ⚠️ A DELETED TUNNEL IS NOT A TUNNEL. Cloudflare keeps deleted tunnels (every response carries
+ *   `deleted_at`), so a `GET` by id can answer for one; adopting that tombstone would PATCH it.
+ * ⚠️ NOR IS ANOTHER TUNNEL TYPE. `/tunnels` lists every type, and a `warp_connector` (a Mesh node)
+ *   shares the account's name space. An item whose `tun_type` is anything but `cfd_tunnel` is not
+ *   ours even when the name matches. A response with no `tun_type` is accepted: it came from a
+ *   `cfd_tunnel`-scoped call.
+ */
+export declare const observe: (raw: Raw) => ObservedTunnel | undefined;
+/** The tunnel with this id, or `undefined` when it is gone (404 / code 1002, or soft-deleted). */
+export declare const getTunnel: (accountId: string, tunnelId: string) => Effect.Effect<ObservedTunnel | undefined, zeroTrust.CloudflareOpError, zeroTrust.CloudflareOpContext>;
+/**
+ * The live cloudflared tunnel with exactly this name, or `undefined`.
+ *
+ * ★ `name` and `tunTypes` are sent as filters, but the match is re-checked here: the filter's
+ *   exactness is not documented, and a prefix match would adopt the wrong tunnel.
+ * ⛔ Two live matches is refused rather than resolved. Names are unique per account (the create
+ *   answers code 1013 otherwise), so two means something this package does not understand.
+ */
+export declare const findTunnelByName: (accountId: string, name: string) => Effect.Effect<ObservedTunnel | undefined, CloudflaredTunnelError | zeroTrust.CloudflareOpError, zeroTrust.CloudflareOpContext>;
+/**
+ * ⛔ ALWAYS `configSrc: 'cloudflare'` (remotely managed), NEVER OMITTED. The dashboard and the
+ *   ingress rules a consumer later PUTs are the remote configuration; a `local` tunnel ignores
+ *   them. The SDK types the field as optional with two values (zero_trust.ts
+ *   `CreateTunnelCloudflaredRequest`) and does not say which is the default, so it is sent
+ *   explicitly. Create-only (the PATCH body has `name` and `tunnelSecret` only).
+ */
+export declare const createTunnel: (accountId: string, name: string) => Effect.Effect<ObservedTunnel, CloudflaredTunnelError | zeroTrust.CreateTunnelCloudflaredError, zeroTrust.CloudflareOpContext>;
+/** ★ A rename is a PATCH: same id, same connectors, same `<id>.cfargotunnel.com` target. */
+export declare const renameTunnel: (accountId: string, tunnelId: string, name: string) => Effect.Effect<ObservedTunnel, zeroTrust.PatchTunnelCloudflaredError, zeroTrust.CloudflareOpContext>;
+/**
+ * ⛔ DELETE BY THE STORED ID ONLY, AFTER A READ BY THAT ID. Never by name: a name can have been
+ *   re-used by another tunnel since this one was written, and a delete cannot be taken back. An
+ *   empty id is refused before any request (a blank path segment would address the collection).
+ * ★ Idempotent: a tunnel already gone or soft-deleted is a successful delete, including one that
+ *   vanishes between the read and the DELETE (see `isNotFound`). The API refuses a
+ *   delete while connectors are attached ("The tunnel must have no active connections", SDK doc on
+ *   `deleteTunnelCloudflared`); that error passes through, since the operator must stop cloudflared.
+ */
+export declare const deleteTunnel: (accountId: string, tunnelId: string) => Effect.Effect<undefined, CloudflaredTunnelError | zeroTrust.CloudflareOpError, zeroTrust.CloudflareOpContext>;
+export {};
+//# sourceMappingURL=cloudflared-tunnel-api.d.ts.map

package/dist/cloudflare/cloudflared-tunnel-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflared-tunnel-api.d.ts","sourceRoot":"","sources":["../../src/cloudflare/cloudflared-tunnel-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,SAAS,MAAM,wCAAwC,CAAC;AAEpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,8FAA8F;AAC9F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iGAAiG;IACjG,QAAQ,CAAC,SAAS,EAAE,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;CACxD;;;;AAED,oFAAoF;AACpF,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;AAEL,KAAK,GAAG,GAAG;IACT,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,QAAS,GAAG,KAAG,cAAc,GAAG,SAOnD,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,SAAS,cAAe,MAAM,YAAY,MAAM,0GAI1D,CAAC;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,cAAe,MAAM,QAAQ,MAAM,mIAe7D,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,cAAe,MAAM,QAAQ,MAAM,kIAUzD,CAAC;AAEJ,4FAA4F;AAC5F,eAAO,MAAM,YAAY,cAAe,MAAM,YAAY,MAAM,QAAQ,MAAM,wGAGc,CAAC;AAS7F;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,cAAe,MAAM,YAAY,MAAM,kHAY5D,CAAC"}

package/dist/cloudflare/cloudflared-tunnel-form.d.ts

@@ -0,0 +1,49 @@
+/**
+ * `Cloudflare.CloudflaredTunnel` — its props, its attributes, and the pure `diff`.
+ *
+ * ⛔ THE ATTRIBUTES NEVER HOLD A TOKEN OR A SECRET. That is the reason this resource exists next to
+ *   Alchemy's `Cloudflare.Tunnel.Tunnel` (beta.81): its `reconcile`, `read` and `list` all call
+ *   `getTunnelCloudflaredToken` and keep the result as `token: Redacted<string>`, which
+ *   `encodeState` persists as `{"__redacted__": "<token>"}` in the (unencrypted) state store. That
+ *   token is what `cloudflared tunnel run --token` accepts: whoever reads state can run a connector
+ *   for the tunnel and receive its traffic. It also makes every PLAN need a token with a Write
+ *   permission. This resource never calls the endpoint, so a plan runs on a read token.
+ * ★ THE CONNECTOR'S TOKEN IS A RUNTIME CREDENTIAL, NOT INFRASTRUCTURE STATE. Whatever installs the
+ *   connector fetches it at that moment and hands it straight to the workload's secret store.
+ *   Nothing here does, and nothing here exports a helper that would.
+ * ★ SCOPE: the tunnel object only. No ingress rules, no routes, no DNS, no connector Deployment:
+ *   those are separate declarations that name this tunnel's `id`.
+ */
+import type { Diff } from 'alchemy/Diff';
+import type { Input } from 'alchemy/Input';
+import { CloudflaredTunnelError } from './cloudflared-tunnel-api.ts';
+export interface CloudflaredTunnelProps {
+    /**
+     * The tunnel's name in the account — and its identity when adopting (names are unique per
+     * account). ★ Changing it RENAMES the tunnel in place (`PATCH`): the id, the connectors and the
+     * `<id>.cfargotunnel.com` target survive.
+     */
+    readonly name: string;
+}
+export interface CloudflaredTunnelAttributes {
+    /** The tunnel's UUID: the `<id>.cfargotunnel.com` target and the key for ingress rules. */
+    readonly id: string;
+    /**
+     * The account the provider environment resolved when the tunnel was written. Not a secret; it
+     * is what `delete` and `read` address, so they never act on the current environment's account.
+     */
+    readonly accountId: string;
+    readonly name: string;
+}
+/** ⛔ Fail closed on a declaration the API would accept but nobody meant. */
+export declare const validateCloudflaredTunnel: (props: CloudflaredTunnelProps) => CloudflaredTunnelError | undefined;
+/**
+ * update or replace, from the declaration and what was last written.
+ *
+ * - Account changed → `replace`, create-first: names are unique per ACCOUNT, so the two
+ *   generations cannot collide.
+ * - Name changed → `update` (a PATCH rename).
+ * - Otherwise → no opinion; the engine compares props.
+ */
+export declare const diffCloudflaredTunnel: (news: Input<CloudflaredTunnelProps>, output: CloudflaredTunnelAttributes | undefined, accountId: string) => Diff | undefined;
+//# sourceMappingURL=cloudflared-tunnel-form.d.ts.map

package/dist/cloudflare/cloudflared-tunnel-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflared-tunnel-form.d.ts","sourceRoot":"","sources":["../../src/cloudflare/cloudflared-tunnel-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,2BAA2B;IAC1C,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CAGvB;AAED,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,UAC7B,sBAAsB,KAC5B,sBAAsB,GAAG,SAY3B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,SAC1B,KAAK,CAAC,sBAAsB,CAAC,UAC3B,2BAA2B,GAAG,SAAS,aACpC,MAAM,KAChB,IAAI,GAAG,SAMT,CAAC"}

package/dist/cloudflare/cloudflared-tunnel-harness.d.ts

@@ -0,0 +1,45 @@
+import * as State from 'alchemy/State';
+import * as Effect from 'effect/Effect';
+import * as Exit from 'effect/Exit';
+import { CloudflaredTunnel } from './cloudflared-tunnel.ts';
+import type { CloudflaredTunnelAttributes, CloudflaredTunnelProps } from './cloudflared-tunnel-form.ts';
+import type { FakeTunnels } from './fake-tunnel.ts';
+export declare const ids: {
+    fqn: string;
+    id: string;
+    instanceId: string;
+};
+export declare const extra: {
+    bindings: never;
+    session: never;
+};
+export type P = Effect.Success<typeof CloudflaredTunnel.Provider>;
+export declare const handler: <F>(name: string, fn: F | undefined) => F;
+/** Build the provider over the fake (as `accountId`'s environment) and hand it to `use`. */
+export declare const run: <A, E>(fake: FakeTunnels, use: (p: P) => Effect.Effect<A, E>, accountId?: string) => Promise<A>;
+export declare const reconcile: (p: P, news: CloudflaredTunnelProps, output?: CloudflaredTunnelAttributes) => Effect.Effect<CloudflaredTunnelAttributes, any, never>;
+export declare const read: (p: P, olds: CloudflaredTunnelProps, output?: CloudflaredTunnelAttributes) => Effect.Effect<CloudflaredTunnelAttributes | undefined, any, never>;
+export declare const diff: (p: P, news: CloudflaredTunnelProps, olds: CloudflaredTunnelProps, output: CloudflaredTunnelAttributes) => Effect.Effect<void | import("alchemy").Diff, any, never>;
+/** A stored attribute set for a tunnel that may or may not exist in the fake. */
+export declare const stored: (accountId: string, over?: Partial<CloudflaredTunnelAttributes>) => CloudflaredTunnelAttributes;
+/** Requests the fake saw for any `/token` path. The provider must never make one. */
+export declare const tokenReads: (fake: FakeTunnels) => number;
+/** The writes the fake saw, in order: `['POST', 'DELETE', …]`. */
+export declare const writes: (fake: FakeTunnels) => string[];
+type Rows = Record<string, Record<string, Record<string, State.ResourceState>>>;
+/**
+ * ★ THE REAL ENGINE, NOT A MODEL OF IT: Alchemy's own `Plan.make` + `apply` over an in-memory
+ *   state store (the same construction as mesh-node-harness.ts, which says why
+ *   `FetchHttpClient.Fetch` is provided around the whole deploy). `rows` is the store itself, so a
+ *   test can serialize exactly what Alchemy would persist.
+ */
+export declare const engine: (fake: FakeTunnels) => {
+    deploy: <A, E, R>(declare: Effect.Effect<A, E, R>) => Promise<Exit.Exit<unknown, unknown>>;
+    rows: Rows;
+    /** The stored row's status (`created`, `replacing`, …), or `undefined` when there is none. */
+    status: (fqn: string) => "created" | "creating" | "deleting" | "replaced" | "replacing" | "updated" | "updating" | undefined;
+};
+/** The failure sentence of a deploy, or `''` when it succeeded. */
+export declare const failureOf: (exit: Exit.Exit<unknown, unknown>) => string;
+export {};
+//# sourceMappingURL=cloudflared-tunnel-harness.d.ts.map

package/dist/cloudflare/cloudflared-tunnel-harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflared-tunnel-harness.d.ts","sourceRoot":"","sources":["../../src/cloudflare/cloudflared-tunnel-harness.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,KAAK,MAAM,eAAe,CAAC;AAEvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAGpC,OAAO,EAAE,iBAAiB,EAA6B,MAAM,yBAAyB,CAAC;AACvF,OAAO,KAAK,EACV,2BAA2B,EAC3B,sBAAsB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,eAAO,MAAM,GAAG;IAAK,GAAG;IAAiB,EAAE;IAAW,UAAU;CAAS,CAAC;AAC1E,eAAO,MAAM,KAAK;IAAK,QAAQ,EAAQ,KAAK;IAAE,OAAO,EAAe,KAAK;CAAE,CAAC;AAE5E,MAAM,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AAElE,eAAO,MAAM,OAAO,GAAI,CAAC,QAAQ,MAAM,MAAM,CAAC,GAAG,SAAS,KAAG,CAG5D,CAAC;AAEF,4FAA4F;AAC5F,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,QAChB,WAAW,OACZ,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,cACtB,MAAM,eAUjB,CAAC;AAEJ,eAAO,MAAM,SAAS,MACjB,CAAC,QACE,sBAAsB,WACnB,2BAA2B,2DAC+B,CAAC;AAEtE,eAAO,MAAM,IAAI,MAAO,CAAC,QAAQ,sBAAsB,WAAW,2BAA2B,uEAC1C,CAAC;AAEpD,eAAO,MAAM,IAAI,MACZ,CAAC,QACE,sBAAsB,QACtB,sBAAsB,UACpB,2BAA2B,6DAKkD,CAAC;AAExF,iFAAiF;AACjF,eAAO,MAAM,MAAM,cACN,MAAM,SACX,OAAO,CAAC,2BAA2B,CAAC,KACzC,2BAKD,CAAC;AAEH,qFAAqF;AACrF,eAAO,MAAM,UAAU,SAAU,WAAW,WACe,CAAC;AAE5D,kEAAkE;AAClE,eAAO,MAAM,MAAM,SAAU,WAAW,aAC0B,CAAC;AAEnE,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,MAAM,SAAU,WAAW;aAItB,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;;IAetD,8FAA8F;kBAChF,MAAM;CAEvB,CAAC;AAEF,mEAAmE;AACnE,eAAO,MAAM,SAAS,SAAU,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,WACG,CAAC"}

package/dist/cloudflare/cloudflared-tunnel-lifecycle.d.ts

@@ -0,0 +1,21 @@
+import * as Effect from 'effect/Effect';
+import { CloudflaredTunnelError } from './cloudflared-tunnel-api.ts';
+import { type CloudflaredTunnelAttributes, type CloudflaredTunnelProps } from './cloudflared-tunnel-form.ts';
+/**
+ * Owned: refresh by the stored id. Cold (no stored row): find the live tunnel by exact name and
+ * hand it back `Unowned`, so Alchemy refuses to take it over until the stack says `adopt(true)` —
+ * a `cfd_tunnel` carries no ownership marker to prove it was ours. Adoption is idempotent: the
+ * adopted row holds the id, so every later `read` takes the owned path and writes nothing.
+ *
+ * ⛔ A STORED ID THAT NO LONGER RESOLVES IS "MISSING", NEVER A NAME PROBE. Drift (alchemy beta.81
+ *   src/Drift.ts) passes the row's output and treats whatever `read` returns as already ours
+ *   (`stripUnowned`), then repairs by reconciling onto it. A by-name fallback there would write a
+ *   same-named tunnel somebody else made into this row, bypassing `adopt(true)`; a later rename
+ *   would PATCH it and `RemovalPolicy.destroy` would DELETE it. Returning `undefined` makes Drift
+ *   report "missing" and recreate through `reconcile`, where `createFresh` names the holder.
+ */
+export declare const readCloudflaredTunnel: (accountId: string, olds: CloudflaredTunnelProps | undefined, output: CloudflaredTunnelAttributes | undefined) => Effect.Effect<CloudflaredTunnelAttributes | undefined, CloudflaredTunnelError | import("@distilled.cloud/cloudflare/Protocol").CloudflareOpError, import("@distilled.cloud/cloudflare/Protocol").CloudflareOpContext>;
+export declare const reconcileCloudflaredTunnel: (accountId: string, news: CloudflaredTunnelProps, output: CloudflaredTunnelAttributes | undefined) => Effect.Effect<CloudflaredTunnelAttributes, CloudflaredTunnelError | import("@distilled.cloud/cloudflare/zero-trust").TunnelNotFound | import("@distilled.cloud/cloudflare/Protocol").CloudflareOpError, import("@distilled.cloud/cloudflare/Protocol").CloudflareOpContext>;
+/** By the stored id and account only (cloudflared-tunnel-api.ts, `deleteTunnel`). */
+export declare const deleteCloudflaredTunnel: (output: CloudflaredTunnelAttributes) => Effect.Effect<undefined, CloudflaredTunnelError | import("@distilled.cloud/cloudflare/Protocol").CloudflareOpError, import("@distilled.cloud/cloudflare/Protocol").CloudflareOpContext>;
+//# sourceMappingURL=cloudflared-tunnel-lifecycle.d.ts.map

package/dist/cloudflare/cloudflared-tunnel-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflared-tunnel-lifecycle.d.ts","sourceRoot":"","sources":["../../src/cloudflare/cloudflared-tunnel-lifecycle.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,sBAAsB,EAOvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAE5B,MAAM,8BAA8B,CAAC;AAQtC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,cACrB,MAAM,QACX,sBAAsB,GAAG,SAAS,UAChC,2BAA2B,GAAG,SAAS,0NAY7C,CAAC;AAkEL,eAAO,MAAM,0BAA0B,cAC1B,MAAM,QACX,sBAAsB,UACpB,2BAA2B,GAAG,SAAS,gRAiB7C,CAAC;AAEL,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,WAAY,2BAA2B,4LAChC,CAAC"}

package/dist/cloudflare/cloudflared-tunnel.d.ts

@@ -0,0 +1,39 @@
+/**
+ * `Cloudflare.CloudflaredTunnel` — a Cloudflare Tunnel (the cloudflared kind, `cfd_tunnel`),
+ * declared without its connector token ever touching Alchemy state. Usage: docs/cloudflared-tunnel.md.
+ *
+ * 🔴 WHY THIS EXISTS ALONGSIDE `Cloudflare.Tunnel.Tunnel`. Alchemy beta.81's resource stores the
+ *   token as a `Redacted` attribute, and the state encoder writes it out in plaintext. See
+ *   cloudflared-tunnel-form.ts, which also says what this resource leaves to other declarations.
+ *
+ * ★ REMOVAL POLICY: `retain` BY DEFAULT — see the ★ on `CloudflaredTunnel` below.
+ */
+import { Credentials } from '@distilled.cloud/cloudflare/Credentials';
+import * as Cloudflare from 'alchemy/Cloudflare';
+import * as Provider from 'alchemy/Provider';
+import { Resource, type ResourceClass } from 'alchemy/Resource';
+import * as HttpClient from 'effect/http/HttpClient';
+import { type CloudflaredTunnelAttributes, type CloudflaredTunnelProps } from './cloudflared-tunnel-form.ts';
+import type { Providers } from './providers.ts';
+export interface CloudflaredTunnel extends Resource<'Cloudflare.CloudflaredTunnel', CloudflaredTunnelProps, CloudflaredTunnelAttributes, never, Providers> {
+}
+/**
+ * ★ `defaultRemovalPolicy: 'retain'`, LIKE EVERY KIT RESOURCE WHOSE DELETION BREAKS ITS CONSUMERS
+ *   (MeshNode, the `Bao.*` families, `R2BucketLock`; the reasoning is written once in
+ *   proxmox/resource.ts). Deleting a tunnel drops its remote configuration (ingress rules) and
+ *   orphans every DNS record that targets `<id>.cfargotunnel.com`, and a new tunnel has a new id
+ *   and a new token. So dropping the declaration, or `alchemy destroy`, leaves the tunnel live.
+ * ⚠️ IT ALSO SKIPS THE OLD TUNNEL'S DELETE IN AN ACCOUNT-CHANGE REPLACE (create-first), which
+ *   leaves the old tunnel live and unmanaged (Apply.ts, `deleteOldGenerations`, beta.81).
+ * ⛔ `delete` STAYS FULLY IMPLEMENTED. Retain is Terraform's `prevent_destroy`, not a stub: it runs
+ *   the moment a declaration opts in with `.pipe(RemovalPolicy.destroy())`.
+ */
+export declare const CloudflaredTunnel: ResourceClass<CloudflaredTunnel>;
+/** What every call below needs: the account, credentials and HTTP — Alchemy's own trio. */
+export type CloudflaredTunnelServices = Cloudflare.CloudflareEnvironment | Credentials | HttpClient.HttpClient;
+/**
+ * ★ `Provider.effect`, CAPTURING THE THREE SERVICES AT BUILD, exactly as `MeshNodeProvider` does
+ *   (mesh-node.ts says why): correct whether or not the stack also merges `Cloudflare.providers()`.
+ */
+export declare const CloudflaredTunnelProvider: () => import("effect/Layer").Layer<Provider.Provider<CloudflaredTunnel>, never, Cloudflare.CloudflareEnvironment | Credentials | HttpClient.HttpClient>;
+//# sourceMappingURL=cloudflared-tunnel.d.ts.map

package/dist/cloudflare/cloudflared-tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflared-tunnel.d.ts","sourceRoot":"","sources":["../../src/cloudflare/cloudflared-tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AACtE,OAAO,KAAK,UAAU,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAG5B,MAAM,8BAA8B,CAAC;AAMtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,8BAA8B,EAC9B,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,CAG9D,CAAC;AAEF,2FAA2F;AAC3F,MAAM,MAAM,yBAAyB,GACjC,UAAU,CAAC,qBAAqB,GAChC,WAAW,GACX,UAAU,CAAC,UAAU,CAAC;AAQ1B;;;GAGG;AACH,eAAO,MAAM,yBAAyB,yJA4CnC,CAAC"}

package/dist/cloudflare/fake-access.d.ts

@@ -0,0 +1,40 @@
+export declare const TEAM = "example.cloudflareaccess.com";
+/** ⚠️ A placeholder, not a credential. Tests assert it is stored and logged nowhere. */
+export declare const FAKE_CLIENT_SECRET = "fake-client-secret-0123456789abcdef";
+export type FakeApp = {
+    id: string;
+    aud: string;
+    type: string;
+    name: string;
+    session_duration: string;
+    policies: string[];
+    saas_app?: Record<string, unknown> | undefined;
+};
+export type Seen = {
+    readonly method: string;
+    readonly path: string;
+    readonly body: unknown;
+};
+/** The calls `malformed` can corrupt: `get` is the raw read, the rest are SDK calls. */
+export type FakeOp = 'get' | 'list' | 'delete' | 'org';
+/** How the organization read answers; an object names the `auth_domain` it returns. */
+export type FakeOrg = 'matching' | 'unauthorized' | 'forbidden' | 'not_found' | {
+    authDomain: string;
+};
+export type FakeOptions = {
+    readonly perPage?: number;
+    readonly team?: string;
+    readonly org?: FakeOrg;
+    readonly malformed?: ReadonlyArray<FakeOp>;
+};
+export declare const fakeAccess: (options?: FakeOptions) => {
+    apps: Map<string, FakeApp>;
+    fetch: typeof fetch;
+    seed: (app: Partial<FakeApp> & {
+        name: string;
+    }) => FakeApp;
+    seen: Seen[];
+    team: string;
+};
+export type FakeAccess = ReturnType<typeof fakeAccess>;
+//# sourceMappingURL=fake-access.d.ts.map

package/dist/cloudflare/fake-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-access.d.ts","sourceRoot":"","sources":["../../src/cloudflare/fake-access.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,IAAI,iCAAiC,CAAC;AACnD,wFAAwF;AACxF,eAAO,MAAM,kBAAkB,wCAAwC,CAAC;AAExE,MAAM,MAAM,OAAO,GAAG;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAE9F,wFAAwF;AACxF,MAAM,MAAM,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AACvD,uFAAuF;AACvF,MAAM,MAAM,OAAO,GACf,UAAU,GACV,cAAc,GACd,WAAW,GACX,WAAW,GACX;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3B,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC5C,CAAC;AAuCF,eAAO,MAAM,UAAU,aAAa,WAAW;;;gBAO1B,OAAO,CAAC,OAAO,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAG,OAAO;;;CAwFjE,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC"}

package/dist/cloudflare/fake-mesh.d.ts

@@ -34,6 +34,7 @@ export type Seen = {
     readonly path: string;
     readonly body: unknown;
 };
+export declare const ok: (result: unknown, extra?: Record<string, unknown>) => Response;
 export declare const fakeFailure: (status: number, code: number, message: string) => Response;
 export type FakeOptions = {
     readonly perPage?: number;
@@ -52,7 +53,11 @@ export declare const fakeMesh: (options?: FakeOptions) => {
 };
 export type FakeMesh = ReturnType<typeof fakeMesh>;
 /** distilled Credentials + the real FetchHttpClient over the fake — what a Bun script provides. */
-export declare const fakeClientLayer: (fake: FakeMesh, credentials?: Layer.Layer<Credentials>) => Layer.Layer<Credentials | import("effect/http/HttpClient").HttpClient, never, never>;
+export declare const fakeClientLayer: (fake: {
+    readonly fetch: typeof globalThis.fetch;
+}, credentials?: Layer.Layer<Credentials>) => Layer.Layer<Credentials | import("effect/http/HttpClient").HttpClient, never, never>;
 /** …plus the account, as Alchemy's CloudflareEnvironment hands it to a provider. */
-export declare const fakeProviderLayer: (fake: FakeMesh, accountId?: string) => Layer.Layer<Cloudflare.CloudflareEnvironment | Credentials | import("effect/http/HttpClient").HttpClient, never, never>;
+export declare const fakeProviderLayer: (fake: {
+    readonly fetch: typeof globalThis.fetch;
+}, accountId?: string) => Layer.Layer<Cloudflare.CloudflareEnvironment | Credentials | import("effect/http/HttpClient").HttpClient, never, never>;
 //# sourceMappingURL=fake-mesh.d.ts.map

package/dist/cloudflare/fake-mesh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-mesh.d.ts","sourceRoot":"","sources":["../../src/cloudflare/fake-mesh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,KAAK,WAAW,EAAgB,MAAM,yCAAyC,CAAC;AACzF,OAAO,KAAK,UAAU,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAItC,eAAO,MAAM,SAAS,sCAAsC,CAAC;AAC7D,eAAO,MAAM,YAAY,qCAAqC,CAAC;AAC/D,iFAAiF;AACjF,eAAO,MAAM,cAAc,0BAA0B,CAAC;AAEtD,MAAM,MAAM,QAAQ,GAAG;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAK9F,eAAO,MAAM,WAAW,WAAY,MAAM,QAAQ,MAAM,WAAW,MAAM,aAItE,CAAC;AAaJ,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC;CACvD,CAAC;AAEF,eAAO,MAAM,QAAQ,aAAa,WAAW;;;;;iBAWvB,OAAO,CAAC,QAAQ,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAG,QAAQ;;CAyEpE,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEnD,mGAAmG;AACnG,eAAO,MAAM,eAAe,SACpB,QAAQ,gBACD,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,yFASpC,CAAC;AAEJ,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,SAAU,QAAQ,cAAa,MAAM,4HAYhE,CAAC"}
+{"version":3,"file":"fake-mesh.d.ts","sourceRoot":"","sources":["../../src/cloudflare/fake-mesh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,KAAK,WAAW,EAAgB,MAAM,yCAAyC,CAAC;AACzF,OAAO,KAAK,UAAU,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAItC,eAAO,MAAM,SAAS,sCAAsC,CAAC;AAC7D,eAAO,MAAM,YAAY,qCAAqC,CAAC;AAC/D,iFAAiF;AACjF,eAAO,MAAM,cAAc,0BAA0B,CAAC;AAEtD,MAAM,MAAM,QAAQ,GAAG;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAE9F,eAAO,MAAM,EAAE,WAAY,OAAO,UAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,aACY,CAAC;AAE/E,eAAO,MAAM,WAAW,WAAY,MAAM,QAAQ,MAAM,WAAW,MAAM,aAItE,CAAC;AAaJ,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC;CACvD,CAAC;AAEF,eAAO,MAAM,QAAQ,aAAa,WAAW;;;;;iBAWvB,OAAO,CAAC,QAAQ,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAG,QAAQ;;CAyEpE,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEnD,mGAAmG;AACnG,eAAO,MAAM,eAAe,SACpB;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;CAAE,gBACpC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,yFASpC,CAAC;AAEJ,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,SACtB;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;CAAE,cACtC,MAAM,4HAahB,CAAC"}

package/dist/cloudflare/fake-tunnel.d.ts

@@ -0,0 +1,48 @@
+/**
+ * A fake Cloudflare `cfd_tunnel` API for the CloudflaredTunnel tests — an in-memory `fetch` handed
+ * to Effect's real FetchHttpClient, the same way fake-mesh.ts does it, so the tests exercise
+ * distilled's real path assembly, query and body encoding, envelope decoding and error matching.
+ *
+ * ⛔ TEST-ONLY, AND NO NETWORK. No provider imports this file. Any request outside
+ *   `/accounts/<FAKE_ACCOUNT>/cfd_tunnel` or `/accounts/<FAKE_ACCOUNT>/tunnels` throws, so a
+ *   mis-wired test fails instead of reaching a real API.
+ * ★ THE FAKE HANDS OUT A TOKEN ON EVERY SURFACE IT CAN: a `token` field on the create response and
+ *   on every wire object (worst case: if Cloudflare ever adds one to the documented shape), and the
+ *   `/token` endpoint. The tests then prove none of it reaches an attribute, a state row or a
+ *   request log. The SDK's decoder drops fields outside its schema; the provider must not depend on
+ *   that alone.
+ * ★ THE NAME FILTER IS A SUBSTRING MATCH, as in fake-mesh.ts, so the client's exact re-check is
+ *   exercised. `/tunnels` honours `tun_types` and `is_deleted` as the SDK documents them, and
+ *   answers pages of two by default.
+ */
+import { type Seen } from './fake-mesh.ts';
+export type FakeTunnel = {
+    id: string;
+    name: string;
+    tun_type: string;
+    config_src: string;
+    status: string;
+    token: string;
+    deleted_at: string | null;
+    /** The fake refuses a DELETE while this is set, as the SDK doc says it must ("no active connections"). */
+    connected: boolean;
+};
+export type FakeTunnelOptions = {
+    readonly perPage?: number;
+    /** Return a Response to answer the POST with it instead (e.g. `fakeFailure(409, 1013, …)`). */
+    readonly onCreate?: (name: string) => Response | void;
+    /** Return a Response to answer the DELETE with it instead (e.g. the tunnel vanishing mid-delete). */
+    readonly onDelete?: (id: string) => Response | void;
+};
+export declare const fakeTunnels: (options?: FakeTunnelOptions) => {
+    auth: string[];
+    fetch: typeof fetch;
+    live: () => FakeTunnel[];
+    tunnels: Map<string, FakeTunnel>;
+    seed: (tunnel: Partial<FakeTunnel> & {
+        name: string;
+    }) => FakeTunnel;
+    seen: Seen[];
+};
+export type FakeTunnels = ReturnType<typeof fakeTunnels>;
+//# sourceMappingURL=fake-tunnel.d.ts.map

package/dist/cloudflare/fake-tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-tunnel.d.ts","sourceRoot":"","sources":["../../src/cloudflare/fake-tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAgB,KAAK,IAAI,EAAmB,MAAM,gBAAgB,CAAC;AAE1E,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,0GAA0G;IAC1G,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAcF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC;IACtD,qGAAqG;IACrG,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC;CACrD,CAAC;AAEF,eAAO,MAAM,WAAW,aAAa,iBAAiB;;;;;mBAO9B,OAAO,CAAC,UAAU,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAG,UAAU;;CAuF1E,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/cloudflare/index.d.ts

@@ -1,10 +1,15 @@
 /**
  * Cloudflare providers for Alchemy — the gaps the vendor SDK leaves.
  *
- * ★ Built on vendor SDKs, not hand-rolled HTTP. Both `R2BucketLock` and `MeshNode` call
- *   `@distilled.cloud/cloudflare`, the SDK Alchemy's own Cloudflare providers use — R2BucketLock
- *   over `/r2` (`getBucketLock`/`putBucketLock`), MeshNode over `/zero-trust`, because
- *   `cloudflare@4.5.0` cannot create an HA node (mesh-node-api.ts). Neither invents a path string.
+ * ★ Built on vendor SDKs, not hand-rolled HTTP. `R2BucketLock`, `MeshNode`, `CloudflaredTunnel` and
+ *   `SaasOidcApplication` all call `@distilled.cloud/cloudflare`, the SDK Alchemy's own Cloudflare
+ *   providers use — R2BucketLock over `/r2` (`getBucketLock`/`putBucketLock`), MeshNode over
+ *   `/zero-trust`, because `cloudflare@4.5.0` cannot create an HA node (mesh-node-api.ts). None
+ *   invents a path string.
+ * ⚠️ ONE EXCEPTION, A READ: `SaasOidcApplication` writes and looks up names through the SDK, but its
+ *   responses drop `saas_app`, so `getApp` reads that one object from the wire JSON — the same
+ *   `GET /accounts/{account_id}/access/apps/{app_id}` the SDK's get verb sends, over the SDK's own
+ *   `HttpClient`, credentials and base URL (saas-oidc-api.ts).
  */
 export type { R2LockRule } from './lock-rules.ts';
 export { R2BucketLock, type R2BucketLockProps } from './r2-bucket-lock.ts';
@@ -12,6 +17,12 @@ export { MeshNode, MeshNodeProvider, type MeshNodeServices } from './mesh-node.t
 export type { MeshNodeAttributes, MeshNodeProps } from './mesh-node-form.ts';
 export { MeshNodeError, type MeshNodeStatus } from './mesh-node-api.ts';
 export { fetchMeshNodeToken, type MeshNodeRef } from './mesh-node-token.ts';
+export { CloudflaredTunnel, CloudflaredTunnelProvider, type CloudflaredTunnelServices, } from './cloudflared-tunnel.ts';
+export type { CloudflaredTunnelAttributes, CloudflaredTunnelProps, } from './cloudflared-tunnel-form.ts';
+export { CloudflaredTunnelError } from './cloudflared-tunnel-api.ts';
+export { SaasOidcApplication, SaasOidcApplicationProvider } from './saas-oidc.ts';
+export type { OidcGrantType, OidcScope, SaasOidcApplicationAttributes, SaasOidcApplicationProps, } from './saas-oidc-form.ts';
+export { SaasOidcError } from './saas-oidc-error.ts';
 export { providers } from './providers.ts';
 export { astroWebsite, viteWebsite, type AstroWebsiteProps, type ViteWebsiteProps, } from './website.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/cloudflare/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACnF,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACnF,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,yBAAyB,GAC/B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClF,YAAY,EACV,aAAa,EACb,SAAS,EACT,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC"}