@homeflare/alchemy 0.48.1 → 0.50.0

package/dist/cloudflare/index.js

@@ -296,16 +296,521 @@ var fetchMeshNodeToken = (ref) => Effect5.gen(function* () {
   }
   return Redacted.make(token);
 });
-// src/cloudflare/providers.ts
+// src/cloudflare/cloudflared-tunnel.ts
+import { Credentials as Credentials4 } from "@distilled.cloud/cloudflare/Credentials";
 import * as Cloudflare2 from "alchemy/Cloudflare";
+import { isResolved as isResolved2 } from "alchemy/Diff";
 import * as Provider3 from "alchemy/Provider";
+import { Resource as Resource3 } from "alchemy/Resource";
+import * as Context3 from "effect/Context";
+import * as Effect8 from "effect/Effect";
+import * as HttpClient5 from "effect/http/HttpClient";
+
+// src/cloudflare/cloudflared-tunnel-api.ts
+import * as zeroTrust3 from "@distilled.cloud/cloudflare/zero-trust";
+import * as Data2 from "effect/Data";
+import * as Effect6 from "effect/Effect";
+import * as Stream2 from "effect/Stream";
+
+class CloudflaredTunnelError extends Data2.TaggedError("CloudflaredTunnelError") {
+}
+var observe2 = (raw) => {
+  if (typeof raw.id !== "string" || raw.id.length === 0)
+    return;
+  if (raw.deletedAt !== undefined && raw.deletedAt !== null)
+    return;
+  if (typeof raw.tunType === "string" && raw.tunType !== "cfd_tunnel")
+    return;
+  const configSrc = raw.configSrc === "cloudflare" || raw.configSrc === "local" ? raw.configSrc : undefined;
+  return { id: raw.id, name: raw.name ?? "", configSrc };
+};
+var getTunnel = (accountId2, tunnelId) => zeroTrust3.getTunnelCloudflared({ accountId: accountId2, tunnelId }).pipe(Effect6.map(observe2), Effect6.catchTag("TunnelNotFound", () => Effect6.succeed(undefined)));
+var findTunnelByName = (accountId2, name) => zeroTrust3.listTunnels.items({ accountId: accountId2, name, isDeleted: false, tunTypes: ["cfd_tunnel"] }).pipe(Stream2.map(observe2), Stream2.filter((t) => t !== undefined && t.name === name), Stream2.runCollect, Effect6.flatMap((chunk) => {
+  const matches = Array.from(chunk);
+  if (matches.length <= 1)
+    return Effect6.succeed(matches[0]);
+  const ids = matches.map((t) => t.id).join(", ");
+  return Effect6.fail(new CloudflaredTunnelError({
+    message: `Tunnel name "${name}" matches ${matches.length} live cloudflared tunnels (${ids}). Names are unique per account, so refusing to guess which one is meant.`
+  }));
+}));
+var createTunnel = (accountId2, name) => zeroTrust3.createTunnelCloudflared({ accountId: accountId2, name, configSrc: "cloudflare" }).pipe(Effect6.flatMap((raw) => {
+  const tunnel = observe2(raw);
+  return tunnel === undefined ? Effect6.fail(new CloudflaredTunnelError({ message: `Creating tunnel "${name}" returned no id.` })) : Effect6.succeed(tunnel);
+}));
+var renameTunnel = (accountId2, tunnelId, name) => zeroTrust3.patchTunnelCloudflared({ accountId: accountId2, tunnelId, name }).pipe(Effect6.map((raw) => observe2(raw) ?? { id: tunnelId, name, configSrc: undefined }));
+var isNotFound = (error) => error._tag === "NotFound";
+var deleteTunnel = (accountId2, tunnelId) => Effect6.gen(function* () {
+  if (tunnelId.length === 0) {
+    return yield* Effect6.fail(new CloudflaredTunnelError({ message: "Refusing to delete a tunnel with an empty id." }));
+  }
+  const live = yield* getTunnel(accountId2, tunnelId);
+  if (live === undefined)
+    return;
+  yield* zeroTrust3.deleteTunnelCloudflared({ accountId: accountId2, tunnelId }).pipe(Effect6.catchIf(isNotFound, () => Effect6.void));
+});
+
+// src/cloudflare/cloudflared-tunnel-form.ts
+var validateCloudflaredTunnel = (props) => {
+  if (typeof props.name !== "string" || props.name.trim().length === 0) {
+    return new CloudflaredTunnelError({
+      message: "CloudflaredTunnel `name` must be a non-empty string."
+    });
+  }
+  if (props.name !== props.name.trim()) {
+    return new CloudflaredTunnelError({
+      message: `CloudflaredTunnel name "${props.name}" has leading or trailing whitespace; adoption matches names exactly.`
+    });
+  }
+  return;
+};
+var diffCloudflaredTunnel = (news, output, accountId2) => {
+  if (output === undefined)
+    return;
+  if (output.accountId !== accountId2)
+    return { action: "replace" };
+  const name = news.name;
+  if (typeof name === "string" && name !== output.name)
+    return { action: "update" };
+  return;
+};
+
+// src/cloudflare/cloudflared-tunnel-lifecycle.ts
+import { Unowned as Unowned3 } from "alchemy/AdoptPolicy";
+import * as Effect7 from "effect/Effect";
+var attributesOf2 = (tunnel, accountId2) => ({
+  id: tunnel.id,
+  accountId: accountId2,
+  name: tunnel.name
+});
+var readCloudflaredTunnel = (accountId2, olds, output) => Effect7.gen(function* () {
+  const account = output?.accountId ?? accountId2;
+  if (output !== undefined) {
+    const tunnel = yield* getTunnel(account, output.id);
+    return tunnel === undefined ? undefined : attributesOf2(tunnel, account);
+  }
+  const name = olds?.name;
+  if (name === undefined)
+    return;
+  const match = yield* findTunnelByName(account, name);
+  return match === undefined ? undefined : Unowned3(attributesOf2(match, account));
+});
+var nameHeld = (name, holder) => new CloudflaredTunnelError({
+  message: `A tunnel named "${name}" already exists (${holder}) and is not the tunnel this resource ` + "tracks, so it is left alone: names are unique per account. If it is meant to be this " + "one, deploy under adopt(true). Otherwise choose another name; do not delete it."
+});
+var raced2 = (accountId2, name) => findTunnelByName(accountId2, name).pipe(Effect7.flatMap((holder) => Effect7.fail(holder === undefined ? nameHeld(name, "not a live cloudflared tunnel: another tunnel type, or one just deleted") : new CloudflaredTunnelError({
+  message: `Tunnel "${name}" (${holder.id}) appeared between this deploy's lookup and its ` + "create. The likeliest cause is this deploy itself: the SDK retries a create " + "whose response was lost. If so, deploy again under adopt(true). Otherwise " + "another creator raced this one."
+}))));
+var createFresh2 = (accountId2, name) => Effect7.gen(function* () {
+  const existing = yield* findTunnelByName(accountId2, name);
+  if (existing !== undefined)
+    return yield* Effect7.fail(nameHeld(name, existing.id));
+  const tunnel = yield* createTunnel(accountId2, name).pipe(Effect7.catchTag("DuplicateTunnelName", () => raced2(accountId2, name)));
+  return attributesOf2(tunnel, accountId2);
+});
+var requireRemote = (tunnel) => tunnel.configSrc === "local" ? Effect7.fail(new CloudflaredTunnelError({
+  message: `Tunnel "${tunnel.name}" (${tunnel.id}) is locally configured (config_src local), which cannot be changed after creation. CloudflaredTunnel manages remotely configured tunnels only; create a new tunnel under another name.`
+})) : Effect7.void;
+var reconcileCloudflaredTunnel = (accountId2, news, output) => Effect7.gen(function* () {
+  const invalid = validateCloudflaredTunnel(news);
+  if (invalid !== undefined)
+    return yield* Effect7.fail(invalid);
+  const owned = output !== undefined && output.accountId === accountId2 ? output : undefined;
+  const live = owned === undefined ? undefined : yield* getTunnel(accountId2, owned.id);
+  if (owned === undefined || live === undefined)
+    return yield* createFresh2(accountId2, news.name);
+  yield* requireRemote(live);
+  if (live.name === news.name)
+    return attributesOf2(live, accountId2);
+  const renamed = yield* renameTunnel(accountId2, live.id, news.name).pipe(Effect7.catchTag("DuplicateTunnelName", () => Effect7.fail(nameHeld(news.name, "held by another tunnel"))));
+  return attributesOf2(renamed, accountId2);
+});
+var deleteCloudflaredTunnel = (output) => deleteTunnel(output.accountId, output.id);
+
+// src/cloudflare/cloudflared-tunnel.ts
+var CloudflaredTunnel = Resource3("Cloudflare.CloudflaredTunnel", { defaultRemovalPolicy: "retain" });
+var accountId2 = Effect8.gen(function* () {
+  const resolved = yield* yield* Cloudflare2.CloudflareEnvironment;
+  return resolved.accountId;
+});
+var CloudflaredTunnelProvider = () => Provider3.effect(CloudflaredTunnel, Effect8.gen(function* () {
+  const services = Context3.make(Cloudflare2.CloudflareEnvironment, yield* Cloudflare2.CloudflareEnvironment).pipe(Context3.add(Credentials4, yield* Credentials4), Context3.add(HttpClient5.HttpClient, yield* HttpClient5.HttpClient));
+  const run = (effect4) => Effect8.provideContext(effect4, services);
+  return CloudflaredTunnel.Provider.of({
+    stables: ["id", "accountId"],
+    list: () => Effect8.succeed([]),
+    nuke: { skip: true },
+    diff: ({ news, output }) => run(Effect8.gen(function* () {
+      const invalid = isResolved2(news) ? validateCloudflaredTunnel(news) : undefined;
+      if (invalid !== undefined)
+        return yield* Effect8.fail(invalid);
+      return diffCloudflaredTunnel(news, output, yield* accountId2);
+    })),
+    read: ({ olds, output }) => run(Effect8.flatMap(accountId2, (account) => readCloudflaredTunnel(account, olds, output))),
+    reconcile: ({ news, output }) => run(Effect8.flatMap(accountId2, (account) => reconcileCloudflaredTunnel(account, news, output))),
+    delete: ({ output }) => run(deleteCloudflaredTunnel(output))
+  });
+}));
+// src/cloudflare/saas-oidc.ts
+import { Credentials as Credentials6 } from "@distilled.cloud/cloudflare/Credentials";
+import * as Cloudflare3 from "alchemy/Cloudflare";
+import * as Provider4 from "alchemy/Provider";
+import { Resource as Resource4 } from "alchemy/Resource";
+import * as Context4 from "effect/Context";
+import * as Effect13 from "effect/Effect";
+import * as HttpClient9 from "effect/http/HttpClient";
+
+// src/cloudflare/saas-oidc-lifecycle.ts
+import { Unowned as Unowned4 } from "alchemy/AdoptPolicy";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Effect12 from "effect/Effect";
+
+// src/cloudflare/saas-oidc-api.ts
+import { Credentials as Credentials5, formatHeaders } from "@distilled.cloud/cloudflare/Credentials";
+import * as zeroTrust4 from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect10 from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as Stream3 from "effect/Stream";
+import * as HttpClient7 from "effect/http/HttpClient";
+import * as HttpClientRequest from "effect/http/HttpClientRequest";
+
+// src/cloudflare/saas-oidc-error.ts
+import * as Data3 from "effect/Data";
+import * as Effect9 from "effect/Effect";
+
+class SaasOidcError extends Data3.TaggedError("SaasOidcError") {
+}
+var withheld = (operation) => () => Effect9.fail(new SaasOidcError({
+  message: `Access ${operation} succeeded at the HTTP level but the SDK could not validate the response. The response is withheld on purpose (a create response carries the client secret). Check the application in the Zero Trust dashboard, then run again.`
+}));
+
+// src/cloudflare/saas-oidc-wire.ts
+var str = (value2) => typeof value2 === "string" ? value2 : undefined;
+var bool = (value2) => typeof value2 === "boolean" ? value2 : undefined;
+var strings = (value2) => Array.isArray(value2) && value2.every((item) => typeof item === "string") ? value2 : undefined;
+var record = (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2) ? value2 : undefined;
+var policyIds = (policies) => {
+  const entries = policies.flatMap((policy, index) => {
+    const id = str(record(policy)?.["id"]);
+    const precedence = record(policy)?.["precedence"];
+    return id === undefined ? [] : [{ id, index, precedence: typeof precedence === "number" ? precedence : undefined }];
+  });
+  if (!entries.every((entry) => entry.precedence !== undefined))
+    return entries.map((e) => e.id);
+  return [...entries].sort((a, b) => (a.precedence ?? 0) - (b.precedence ?? 0) || a.index - b.index).map((entry) => entry.id);
+};
+var parseApp = (raw) => {
+  const saas = record(raw["saas_app"]);
+  const refresh = record(saas?.["refresh_token_options"]);
+  const policies = Array.isArray(raw["policies"]) ? raw["policies"] : [];
+  return {
+    id: str(raw["id"]),
+    aud: str(raw["aud"]),
+    type: str(raw["type"]),
+    name: str(raw["name"]),
+    domain: str(raw["domain"]),
+    createdAt: str(raw["created_at"]),
+    updatedAt: str(raw["updated_at"]),
+    policyIds: policyIds(policies),
+    saasApp: saas === undefined ? undefined : {
+      authType: str(saas["auth_type"]),
+      clientId: str(saas["client_id"]),
+      redirectUris: strings(saas["redirect_uris"]),
+      scopes: strings(saas["scopes"]),
+      grantTypes: strings(saas["grant_types"]),
+      accessTokenLifetime: str(saas["access_token_lifetime"]),
+      refreshTokenLifetime: str(refresh?.["lifetime"]),
+      allowPkceWithoutClientSecret: bool(saas["allow_pkce_without_client_secret"])
+    }
+  };
+};
+
+// src/cloudflare/saas-oidc-api.ts
+var sdkWrites = {
+  create: zeroTrust4.createAccessApplicationForAccount,
+  update: zeroTrust4.updateAccessApplicationForAccount
+};
+var TRANSIENT_STATUS = (status) => status === 403 || status === 429 || status >= 500;
+var retryTransient = (effect4) => effect4.pipe(Effect10.retry({
+  while: (e) => e._tag === "AccessReferenceNotFound" || e._tag === "Forbidden" || e._tag === "SaasOidcError" && TRANSIENT_STATUS(e.status ?? 0),
+  schedule: Schedule.max([
+    Schedule.min([Schedule.exponential("1 second", 1.5), Schedule.spaced("5 seconds")]),
+    Schedule.recurs(12)
+  ])
+}));
+var refuseDebugHttp = Effect10.suspend(() => (globalThis.process?.env?.["DISTILLED_DEBUG_HTTP"] ?? "") === "" ? Effect10.void : Effect10.fail(new SaasOidcError({
+  message: "Refusing to write a SaaS OIDC application while DISTILLED_DEBUG_HTTP is set: the SDK would print the response, which carries the client secret, to stderr. Unset it and run again."
+})));
+var getApp = (accountId3, appId) => Effect10.gen(function* () {
+  const credentials = yield* yield* Credentials5;
+  const client = yield* HttpClient7.HttpClient;
+  const request = HttpClientRequest.get(`${credentials.apiBaseUrl}/accounts/${accountId3}/access/apps/${appId}`).pipe(HttpClientRequest.setHeaders(formatHeaders(credentials)), HttpClientRequest.acceptJson);
+  const transport = (cause) => new SaasOidcError({ message: `Access application GET failed: ${cause.message}`, status: 0 });
+  const response = yield* client.execute(request).pipe(Effect10.mapError(transport));
+  if (response.status === 404)
+    return;
+  if (response.status < 200 || response.status >= 300) {
+    return yield* Effect10.fail(new SaasOidcError({
+      message: `Access application GET returned ${response.status}`,
+      status: response.status
+    }));
+  }
+  const text = yield* response.text.pipe(Effect10.mapError(transport));
+  const body = yield* Effect10.try({
+    try: () => record(JSON.parse(text)),
+    catch: () => new SaasOidcError({ message: "Access application GET was not JSON", status: 200 })
+  });
+  const result = record(body?.["result"]);
+  return result === undefined ? undefined : parseApp(result);
+}).pipe(retryTransient);
+var findSaasByName = (accountId3, name) => zeroTrust4.listAccessApplicationsForAccount.items({ accountId: accountId3 }).pipe(Stream3.filter((app) => app.type === "saas" && app.name === name), Stream3.runCollect, Effect10.catchTag("CloudflareParseError", withheld("application list")), retryTransient, Effect10.flatMap((chunk) => {
+  const ids = Array.from(chunk).flatMap((app) => app.id == null ? [] : [app.id]);
+  if (ids.length <= 1)
+    return Effect10.succeed(ids[0]);
+  return Effect10.fail(new SaasOidcError({
+    message: `SaaS application name "${name}" matches ${ids.length} live apps (${ids.join(", ")}). Refusing to guess which one is meant; set \`applicationId\`.`
+  }));
+}));
+var sdkBody = (write) => ({
+  type: "saas",
+  name: write.name,
+  sessionDuration: write.sessionDuration,
+  ...write.allowedIdps === undefined ? {} : { allowedIdps: [...write.allowedIdps] },
+  ...write.autoRedirectToIdentity === undefined ? {} : { autoRedirectToIdentity: write.autoRedirectToIdentity },
+  appLauncherVisible: write.appLauncherVisible,
+  policies: [...write.policies],
+  saasApp: {
+    authType: write.saasApp.authType,
+    redirectUris: [...write.saasApp.redirectUris],
+    scopes: [...write.saasApp.scopes],
+    grantTypes: [...write.saasApp.grantTypes],
+    accessTokenLifetime: write.saasApp.accessTokenLifetime,
+    allowPkceWithoutClientSecret: write.saasApp.allowPkceWithoutClientSecret,
+    ...write.saasApp.refreshTokenOptions === undefined ? {} : { refreshTokenOptions: write.saasApp.refreshTokenOptions },
+    ...write.saasApp.appLauncherUrl === undefined ? {} : { appLauncherUrl: write.saasApp.appLauncherUrl }
+  }
+});
+var createApp = (accountId3, write) => refuseDebugHttp.pipe(Effect10.andThen(sdkWrites.create({ accountId: accountId3, ...sdkBody(write) }).pipe(Effect10.catchTag("CloudflareParseError", withheld("application create")), retryTransient)), Effect10.flatMap((created) => created.id == null ? Effect10.fail(new SaasOidcError({ message: "SaaS OIDC create did not return an id." })) : Effect10.succeed(created.id)));
+var updateApp = (accountId3, appId, write) => refuseDebugHttp.pipe(Effect10.andThen(sdkWrites.update({ accountId: accountId3, appId, ...sdkBody(write) }).pipe(Effect10.catchTag("CloudflareParseError", withheld("application update")), retryTransient)), Effect10.asVoid);
+var deleteApp = (accountId3, appId) => zeroTrust4.deleteAccessApplicationForAccount({ accountId: accountId3, appId }).pipe(Effect10.asVoid, Effect10.catchTags({
+  AccessApplicationNotFound: () => Effect10.void,
+  CloudflareParseError: withheld("application delete")
+}));
+
+// src/cloudflare/saas-oidc-form.ts
+var HOSTNAME = /^[a-z0-9]+(?:[.-][a-z0-9]+)+$/;
+var validateSaasOidc = (props) => {
+  const fail10 = (message) => new SaasOidcError({ message });
+  if (typeof props.teamDomain !== "string" || !HOSTNAME.test(props.teamDomain)) {
+    return fail10(`SaasOidcApplication \`teamDomain\` must be a bare lowercase hostname such as "example.cloudflareaccess.com" (no scheme, no path); got ${JSON.stringify(props.teamDomain)}.`);
+  }
+  if (props.name !== undefined && props.name.trim() === "") {
+    return fail10("SaasOidcApplication `name`, when set, must not be empty.");
+  }
+  if (props.saasApp.allowPkceWithoutClientSecret === true && !props.saasApp.grantTypes.includes("authorization_code_with_pkce")) {
+    return fail10("`allowPkceWithoutClientSecret: true` only applies to the `authorization_code_with_pkce` grant; add it to `grantTypes` or drop the flag.");
+  }
+  return;
+};
+var issuerFor = (teamDomain, clientId) => `https://${teamDomain}/cdn-cgi/access/sso/oidc/${clientId}`;
+var hostOf = (domain) => domain.split("/")[0]?.toLowerCase() ?? "";
+var checkTeam = (teamDomain, app, knownTeam) => {
+  if (app.domain === undefined) {
+    return knownTeam === undefined || knownTeam.toLowerCase() === teamDomain.toLowerCase() ? undefined : new SaasOidcError({
+      message: `SaasOidcApplication declares teamDomain "${teamDomain}" but the row recorded "${knownTeam}" and Cloudflare reports no domain for the app to confirm the change. The issuer cannot move; revert the declaration.`
+    });
+  }
+  return hostOf(app.domain) === teamDomain.toLowerCase() ? undefined : new SaasOidcError({
+    message: `SaasOidcApplication declares teamDomain "${teamDomain}" but Cloudflare reports the app on "${hostOf(app.domain)}".`
+  });
+};
+var refreshLifetime = (props) => props.saasApp.refreshTokenLifetime ?? "";
+var writeBody = (news, name) => ({
+  name,
+  sessionDuration: news.sessionDuration ?? "24h",
+  allowedIdps: news.allowedIdps,
+  autoRedirectToIdentity: news.autoRedirectToIdentity,
+  appLauncherVisible: news.appLauncherVisible ?? false,
+  policies: news.policies,
+  saasApp: {
+    authType: "oidc",
+    redirectUris: news.saasApp.redirectUris,
+    scopes: news.saasApp.scopes,
+    grantTypes: news.saasApp.grantTypes,
+    accessTokenLifetime: news.saasApp.accessTokenLifetime,
+    ...news.saasApp.refreshTokenLifetime === undefined ? {} : { refreshTokenOptions: { lifetime: news.saasApp.refreshTokenLifetime } },
+    allowPkceWithoutClientSecret: news.saasApp.allowPkceWithoutClientSecret ?? false,
+    appLauncherUrl: news.saasApp.appLauncherUrl
+  }
+});
+var sameSet = (a, b) => JSON.stringify([...a].sort()) === JSON.stringify([...b ?? []].sort());
+var sameList = (a, b) => {
+  const other = b ?? [];
+  return a.length === other.length && a.every((item, index) => item === other[index]);
+};
+var needsSync = (news, observed, name) => {
+  const saas = observed.saasApp;
+  return (observed.name ?? "") !== name || (saas?.authType ?? "") !== "oidc" || !sameSet(news.saasApp.redirectUris, saas?.redirectUris) || !sameSet(news.saasApp.scopes, saas?.scopes) || !sameSet(news.saasApp.grantTypes, saas?.grantTypes) || (saas?.accessTokenLifetime ?? "") !== news.saasApp.accessTokenLifetime || refreshLifetime(news) !== (saas?.refreshTokenLifetime ?? "") || (saas?.allowPkceWithoutClientSecret ?? false) !== (news.saasApp.allowPkceWithoutClientSecret ?? false) || !sameList(news.policies, observed.policyIds);
+};
+var toAttributes = (app, accountId3, fallbackName, declaredTeam) => {
+  const clientId = app.saasApp?.clientId;
+  const teamDomain = declaredTeam ?? (app.domain === undefined ? undefined : hostOf(app.domain));
+  if (app.id === undefined || app.aud === undefined || clientId === undefined)
+    return;
+  if (teamDomain === undefined || teamDomain === "")
+    return;
+  const issuer = issuerFor(teamDomain, clientId);
+  const saas = app.saasApp;
+  return {
+    applicationId: app.id,
+    aud: app.aud,
+    domain: app.domain ?? issuer.replace("https://", ""),
+    name: app.name ?? fallbackName,
+    accountId: accountId3,
+    teamDomain,
+    clientId,
+    issuer,
+    authorizationEndpoint: `${issuer}/authorization`,
+    tokenEndpoint: `${issuer}/token`,
+    jwksEndpoint: `${issuer}/jwks`,
+    userinfoEndpoint: `${issuer}/userinfo`,
+    configurationEndpoint: `${issuer}/.well-known/openid-configuration`,
+    redirectUris: saas?.redirectUris ?? [],
+    scopes: saas?.scopes ?? [],
+    grantTypes: saas?.grantTypes ?? [],
+    accessTokenLifetime: saas?.accessTokenLifetime ?? "",
+    refreshTokenLifetime: saas?.refreshTokenLifetime ?? "",
+    createdAt: app.createdAt,
+    updatedAt: app.updatedAt
+  };
+};
+
+// src/cloudflare/saas-oidc-team.ts
+import * as Retry from "@distilled.cloud/cloudflare/Retry";
+import * as zeroTrust5 from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect11 from "effect/Effect";
+var cannotRead = (error) => error._tag === "Unauthorized" || error._tag === "Forbidden" || error._tag === "OrganizationNotFound";
+var readAuthDomain = (accountId3) => zeroTrust5.listOrganizationsForAccount({ accountId: accountId3 }).pipe(Retry.none, Effect11.map((organization) => organization.authDomain ?? undefined), Effect11.catchTag("CloudflareParseError", withheld("organization read")), Effect11.catchIf(cannotRead, () => Effect11.succeed(undefined)));
+var checkTeamBeforeCreate = (accountId3, teamDomain) => readAuthDomain(accountId3).pipe(Effect11.map((authDomain) => authDomain === undefined || authDomain.toLowerCase() === teamDomain.toLowerCase() ? undefined : new SaasOidcError({
+  message: `SaasOidcApplication declares teamDomain "${teamDomain}" but this account's Zero Trust organization is "${authDomain}". Refused before any write; no application was created.`
+})));
+
+// src/cloudflare/saas-oidc-lifecycle.ts
+var resolveName = (id, name) => name !== undefined && name !== "" ? Effect12.succeed(name) : createPhysicalName({ id });
+var observe3 = (accountId3, knownId, name, options = {}) => Effect12.gen(function* () {
+  const byId = knownId === undefined ? undefined : yield* getApp(accountId3, knownId);
+  if (byId !== undefined) {
+    if (byId.type !== "saas") {
+      return yield* Effect12.fail(new SaasOidcError({
+        message: `Access application ${knownId} is type "${byId.type ?? "unknown"}", not "saas". Refusing to rewrite it as a SaaS OIDC app.`
+      }));
+    }
+    return byId;
+  }
+  if (options.byIdOnly === true)
+    return;
+  const foundId = yield* findSaasByName(accountId3, name);
+  return foundId === undefined ? undefined : yield* getApp(accountId3, foundId);
+});
+var readSaasOidc = (accountId3, id, olds, output) => Effect12.gen(function* () {
+  const name = yield* resolveName(id, output?.name ?? olds?.name);
+  const owned = output?.applicationId;
+  const observed = yield* observe3(accountId3, owned ?? olds?.applicationId, name, {
+    byIdOnly: owned !== undefined
+  });
+  if (observed === undefined)
+    return;
+  const attributes = toAttributes(observed, output?.accountId ?? accountId3, name, output?.teamDomain ?? olds?.teamDomain);
+  if (attributes === undefined)
+    return;
+  return owned !== undefined ? attributes : Unowned4(attributes);
+});
+var missing = (what) => Effect12.fail(new SaasOidcError({
+  message: `SaaS OIDC ${what} succeeded but the GET did not return the app.`
+}));
+var reconcileSaasOidc = (accountId3, id, news, output) => Effect12.gen(function* () {
+  const invalid = validateSaasOidc(news);
+  if (invalid !== undefined)
+    return yield* Effect12.fail(invalid);
+  const name = yield* resolveName(id, news.name);
+  const ownedId = output?.applicationId;
+  let observed = yield* observe3(accountId3, ownedId ?? news.applicationId, name, { byIdOnly: ownedId !== undefined });
+  const wrongTeam = observed === undefined ? undefined : checkTeam(news.teamDomain, observed, output?.teamDomain);
+  if (wrongTeam !== undefined)
+    return yield* Effect12.fail(wrongTeam);
+  const write = writeBody(news, name);
+  if (observed === undefined) {
+    const wrongOrganization = yield* checkTeamBeforeCreate(accountId3, news.teamDomain);
+    if (wrongOrganization !== undefined)
+      return yield* Effect12.fail(wrongOrganization);
+    const createdId = yield* createApp(accountId3, write);
+    observed = yield* getApp(accountId3, createdId);
+    if (observed === undefined)
+      return yield* missing("create");
+  } else if (needsSync(news, observed, name)) {
+    const appId = observed.id;
+    if (appId === undefined) {
+      return yield* Effect12.fail(new SaasOidcError({ message: "SaaS OIDC app has no id." }));
+    }
+    yield* updateApp(accountId3, appId, write);
+    observed = yield* getApp(accountId3, appId);
+    if (observed === undefined)
+      return yield* missing("update");
+  }
+  const teamAfterWrite = checkTeam(news.teamDomain, observed, output?.teamDomain);
+  if (teamAfterWrite !== undefined)
+    return yield* Effect12.fail(teamAfterWrite);
+  const attributes = toAttributes(observed, accountId3, name, news.teamDomain);
+  if (attributes === undefined) {
+    return yield* Effect12.fail(new SaasOidcError({
+      message: "Cloudflare returned a SaaS OIDC application without an id, aud or client id."
+    }));
+  }
+  return attributes;
+});
+var deleteSaasOidc = (output) => deleteApp(output.accountId, output.applicationId);
+
+// src/cloudflare/saas-oidc.ts
+var SaasOidcApplication = Resource4("HomeFlare.Access.SaasOidcApplication", {
+  defaultRemovalPolicy: "retain"
+});
+var accountId3 = Effect13.gen(function* () {
+  const resolved = yield* yield* Cloudflare3.CloudflareEnvironment;
+  return resolved.accountId;
+});
+var SaasOidcApplicationProvider = () => Provider4.effect(SaasOidcApplication, Effect13.gen(function* () {
+  const services = Context4.make(Cloudflare3.CloudflareEnvironment, yield* Cloudflare3.CloudflareEnvironment).pipe(Context4.add(Credentials6, yield* Credentials6), Context4.add(HttpClient9.HttpClient, yield* HttpClient9.HttpClient));
+  const run = (effect5) => Effect13.provideContext(effect5, services);
+  return SaasOidcApplication.Provider.of({
+    stables: [
+      "applicationId",
+      "aud",
+      "clientId",
+      "accountId",
+      "issuer",
+      "authorizationEndpoint",
+      "tokenEndpoint",
+      "jwksEndpoint",
+      "userinfoEndpoint",
+      "configurationEndpoint"
+    ],
+    list: () => Effect13.succeed([]),
+    nuke: { skip: true },
+    read: ({ id, olds, output }) => run(Effect13.flatMap(accountId3, (account) => readSaasOidc(account, id, olds, output))),
+    reconcile: ({ id, news, output }) => run(Effect13.flatMap(accountId3, (account) => reconcileSaasOidc(account, id, news, output))),
+    delete: ({ output }) => run(deleteSaasOidc(output))
+  });
+}));
+// src/cloudflare/providers.ts
+import * as Cloudflare4 from "alchemy/Cloudflare";
+import * as Provider5 from "alchemy/Provider";
 import * as Layer from "effect/Layer";
-class Providers extends Provider3.ProviderCollection()("HomeflareCloudflare") {
+class Providers extends Provider5.ProviderCollection()("HomeflareCloudflare") {
 }
-var providers = () => Layer.effect(Providers, Provider3.collection([R2BucketLock, MeshNode])).pipe(Layer.provide(Layer.mergeAll(R2BucketLockProvider().pipe(Layer.provide(Cloudflare2.CloudflareApiLive()), Layer.orDie), MeshNodeProvider().pipe(Layer.provide(Cloudflare2.CloudflareApiLive()), Layer.orDie))));
+var providers = () => Layer.effect(Providers, Provider5.collection([R2BucketLock, MeshNode, CloudflaredTunnel, SaasOidcApplication])).pipe(Layer.provide(Layer.mergeAll(R2BucketLockProvider().pipe(Layer.provide(Cloudflare4.CloudflareApiLive()), Layer.orDie), MeshNodeProvider().pipe(Layer.provide(Cloudflare4.CloudflareApiLive()), Layer.orDie), CloudflaredTunnelProvider().pipe(Layer.provide(Cloudflare4.CloudflareApiLive()), Layer.orDie), SaasOidcApplicationProvider().pipe(Layer.provide(Cloudflare4.CloudflareApiLive()), Layer.orDie))));
 // src/cloudflare/website.ts
 import * as AdoptPolicy from "alchemy/AdoptPolicy";
-import * as Cloudflare3 from "alchemy/Cloudflare";
+import * as Cloudflare5 from "alchemy/Cloudflare";
 import * as RemovalPolicy from "alchemy/RemovalPolicy";
 var ASTRO_FLAGS = ["nodejs_compat", "disable_nodejs_process_v2"];
 function astroWebsite(name, props) {
@@ -316,22 +821,28 @@ function astroWebsite(name, props) {
     sessionKVBindingName: props.sessionKVBindingName ?? false,
     compatibility: { ...props.compatibility, flags: [...flags] }
   };
-  return Cloudflare3.Website.Astro(name, merged).pipe(AdoptPolicy.adopt(true), RemovalPolicy.retain());
+  return Cloudflare5.Website.Astro(name, merged).pipe(AdoptPolicy.adopt(true), RemovalPolicy.retain());
 }
 function viteWebsite(name, props) {
   const merged = { ...props, name: props?.name ?? name };
-  return Cloudflare3.Website.Vite(name, merged).pipe(AdoptPolicy.adopt(true), RemovalPolicy.retain());
+  return Cloudflare5.Website.Vite(name, merged).pipe(AdoptPolicy.adopt(true), RemovalPolicy.retain());
 }
 export {
+  CloudflaredTunnel,
+  CloudflaredTunnelError,
+  CloudflaredTunnelProvider,
   MeshNode,
   MeshNodeError,
   MeshNodeProvider,
   R2BucketLock,
+  SaasOidcApplication,
+  SaasOidcApplicationProvider,
+  SaasOidcError,
   astroWebsite,
   fetchMeshNodeToken,
   providers,
   viteWebsite
 };
 
-//# debugId=95ACB917FDFEA2D864756E2164756E21
+//# debugId=C4EF78F8A64F7A6064756E2164756E21
 //# sourceMappingURL=index.js.map