@pellux/goodvibes-sdk 0.25.14 → 0.25.15

package/dist/_internal/contracts/artifacts/operator-contract.json

@@ -3,7 +3,7 @@
   "product": {
     "id": "goodvibes",
     "surface": "operator",
-    "version": "0.25.14"
+    "version": "0.25.15"
   },
   "auth": {
     "modes": [

package/dist/_internal/contracts/generated/foundation-metadata.d.ts

@@ -1,6 +1,6 @@
 export declare const FOUNDATION_METADATA: {
     readonly productId: "goodvibes";
-    readonly productVersion: "0.25.14";
+    readonly productVersion: "0.25.15";
     readonly operatorMethodCount: 224;
     readonly operatorEventCount: 30;
     readonly peerEndpointCount: 6;

package/dist/_internal/contracts/generated/foundation-metadata.js

@@ -1,7 +1,7 @@
 // Synced from packages/contracts/src/generated/foundation-metadata.ts
 export const FOUNDATION_METADATA = {
     "productId": "goodvibes",
-    "productVersion": "0.25.14",
+    "productVersion": "0.25.15",
     "operatorMethodCount": 224,
     "operatorEventCount": 30,
     "peerEndpointCount": 6

package/dist/_internal/contracts/generated/operator-contract.js

@@ -3,7 +3,7 @@ export const OPERATOR_CONTRACT = {
     "product": {
         "id": "goodvibes",
         "surface": "operator",
-        "version": "0.25.14"
+        "version": "0.25.15"
     },
     "auth": {
         "modes": [

package/dist/_internal/platform/cloudflare/manager.d.ts

@@ -21,7 +21,7 @@ export declare class CloudflareControlPlaneManager {
     private resolveSecretRef;
     private storeSecret;
     private requireUserTokens;
-    private collectPermissionGroups;
+    private resolvePermissionGroupIds;
     private createProvisioningContext;
     private fetchWorker;
     private generateToken;

package/dist/_internal/platform/cloudflare/manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/cloudflare/manager.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAIV,6BAA6B,EAC7B,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EAGvB,+BAA+B,EAC/B,gCAAgC,EAEhC,wBAAwB,EACxB,yBAAyB,EAMzB,gCAAgC,EAChC,iCAAiC,EAEjC,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAiBpB,qBAAa,6BAA6B;IAI5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqD;IAClF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAEZ,OAAO,EAAE,6BAA6B;IAK7D,cAAc,IAAI,OAAO,CAAC,4BAA4B,CAAC;IA0C7D,iBAAiB,CAAC,KAAK,GAAE,gCAAqC,GAAG,iCAAiC;IAkB5F,sBAAsB,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,gCAAgC,CAAC;IA0EzG,QAAQ,CAAC,KAAK,GAAE,uBAA4B,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAuEhF,QAAQ,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAuB3E,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IA2S9E,MAAM,CAAC,KAAK,GAAE,qBAA0B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAe1E,OAAO,CAAC,KAAK,GAAE,sBAA2B,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA0BnF,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,gBAAgB;IAYxB,OAAO,CAAC,iBAAiB;YAYX,eAAe;YAaf,oBAAoB;YAapB,wBAAwB;YAaxB,gBAAgB;YAahB,WAAW;IAOzB,OAAO,CAAC,iBAAiB;YAOX,uBAAuB;IAKrC,OAAO,CAAC,yBAAyB;YAQnB,WAAW;IAazB,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,SAAS;CAMlB"}
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/cloudflare/manager.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAIV,6BAA6B,EAC7B,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EAGvB,+BAA+B,EAC/B,gCAAgC,EAChC,wBAAwB,EACxB,yBAAyB,EAOzB,gCAAgC,EAChC,iCAAiC,EAEjC,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAiBpB,qBAAa,6BAA6B;IAI5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqD;IAClF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAEZ,OAAO,EAAE,6BAA6B;IAK7D,cAAc,IAAI,OAAO,CAAC,4BAA4B,CAAC;IA0C7D,iBAAiB,CAAC,KAAK,GAAE,gCAAqC,GAAG,iCAAiC;IAkB5F,sBAAsB,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAyEzG,QAAQ,CAAC,KAAK,GAAE,uBAA4B,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAuEhF,QAAQ,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAuB3E,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IA2S9E,MAAM,CAAC,KAAK,GAAE,qBAA0B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAe1E,OAAO,CAAC,KAAK,GAAE,sBAA2B,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA0BnF,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,gBAAgB;IAYxB,OAAO,CAAC,iBAAiB;YAYX,eAAe;YAaf,oBAAoB;YAapB,wBAAwB;YAaxB,gBAAgB;YAahB,WAAW;IAOzB,OAAO,CAAC,iBAAiB;YAOX,yBAAyB;IAQvC,OAAO,CAAC,yBAAyB;YAQnB,WAAW;IAazB,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,SAAS;CAMlB"}

package/dist/_internal/platform/cloudflare/manager.js

@@ -6,7 +6,7 @@ import { CLOUDFLARE_API_TOKEN_KEY, CLOUDFLARE_WORKER_CLIENT_TOKEN_KEY, CLOUDFLAR
 import { discoverZones, resolveZone, selectDiscoveredZone, tryDiscover, } from './discovery.js';
 import { configureDns, configureWorkerSubdomain, ensureAccess, ensureKvNamespace, ensureQueue, ensureQueueConsumer, ensureR2Bucket, ensureSecretsStore, ensureTunnel, findDurableObjectNamespace, uploadWorker, } from './resources.js';
 import { CloudflareControlPlaneError } from './types.js';
-import { buildTokenRequirements, buildTokenResources, clean, collectAsync, collectSingleAccount, hostnameFromUrl, requireKvNamespaceId, requireQueueId, resolveComponents, safeResponseText, selectPermissionGroups, stripTrailingSlash, } from './utils.js';
+import { buildTokenRequirements, buildTokenResources, clean, collectAsync, collectSingleAccount, hostnameFromUrl, requireKvNamespaceId, requireQueueId, resolveComponents, resolvePermissionGroupIds, safeResponseText, stripTrailingSlash, } from './utils.js';
 export class CloudflareControlPlaneManager {
     options;
     createClient;
@@ -105,8 +105,7 @@ export class CloudflareControlPlaneManager {
                 required: components.dns,
             });
         }
-        const groups = await this.collectPermissionGroups(client);
-        const permissionIds = selectPermissionGroups(requirements, groups);
+        const permissionIds = await this.resolvePermissionGroupIds(client, requirements);
         const resources = buildTokenResources(accountId, zone?.id, components);
         const tokenName = clean(input.tokenName) || 'GoodVibes Cloudflare Operational';
         const token = await this.requireUserTokens(client).create({
@@ -636,9 +635,9 @@ export class CloudflareControlPlaneManager {
         }
         return client.user.tokens;
     }
-    async collectPermissionGroups(client) {
+    async resolvePermissionGroupIds(client, requirements) {
         const tokenApi = this.requireUserTokens(client);
-        return await collectAsync(tokenApi.permissionGroups.list());
+        return await resolvePermissionGroupIds(requirements, (params) => tokenApi.permissionGroups.list(params));
     }
     createProvisioningContext() {
         return {

package/dist/_internal/platform/cloudflare/utils.d.ts

@@ -2,6 +2,10 @@ import type { CloudflareAccountLike, CloudflareApiClient, CloudflareComponent, C
 export declare function resolveComponents(selection: CloudflareComponentSelection | undefined): Readonly<Record<CloudflareComponent, boolean>>;
 export declare function buildTokenRequirements(components: Readonly<Record<CloudflareComponent, boolean>>, includeBootstrap: boolean): readonly CloudflareTokenPermissionRequirement[];
 export declare function selectPermissionGroups(requirements: readonly CloudflareTokenPermissionRequirement[], groups: readonly CloudflarePermissionGroupLike[]): readonly string[];
+export declare function resolvePermissionGroupIds(requirements: readonly CloudflareTokenPermissionRequirement[], listPermissionGroups: (params?: {
+    readonly name?: string;
+    readonly scope?: string;
+}) => AsyncIterable<CloudflarePermissionGroupLike>): Promise<readonly string[]>;
 export declare function buildTokenResources(accountId: string, zoneId: string | undefined, components: Readonly<Record<CloudflareComponent, boolean>>): Record<string, string>;
 export declare function collectSingleAccount(client: CloudflareApiClient, accountId: string, warnings: string[]): Promise<readonly CloudflareAccountLike[]>;
 export declare function collectAsync<T>(iterable: AsyncIterable<T>, limit?: number): Promise<readonly T[]>;

package/dist/_internal/platform/cloudflare/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/cloudflare/utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAC5B,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,oCAAoC,EACrC,MAAM,YAAY,CAAC;AAGpB,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,4BAA4B,GAAG,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAKrI;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,EAC1D,gBAAgB,EAAE,OAAO,GACxB,SAAS,oCAAoC,EAAE,CAiHjD;AAED,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,SAAS,oCAAoC,EAAE,EAC7D,MAAM,EAAE,SAAS,6BAA6B,EAAE,GAC/C,SAAS,MAAM,EAAE,CAoBnB;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,GACzD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWxB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,mBAAmB,EAC3B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAW3C;AAED,wBAAsB,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,SAAM,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAOpG;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAEvD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAGpF;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,yBAAyB,GAAG,MAAM,CAGjF;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAM1E"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/cloudflare/utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAC5B,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,oCAAoC,EACrC,MAAM,YAAY,CAAC;AAGpB,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,4BAA4B,GAAG,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAKrI;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,EAC1D,gBAAgB,EAAE,OAAO,GACxB,SAAS,oCAAoC,EAAE,CAiHjD;AAED,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,SAAS,oCAAoC,EAAE,EAC7D,MAAM,EAAE,SAAS,6BAA6B,EAAE,GAC/C,SAAS,MAAM,EAAE,CAmBnB;AAED,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,SAAS,oCAAoC,EAAE,EAC7D,oBAAoB,EAAE,CAAC,MAAM,CAAC,EAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,aAAa,CAAC,6BAA6B,CAAC,GACnI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAqD5B;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,GACzD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWxB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,mBAAmB,EAC3B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAW3C;AAED,wBAAsB,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,SAAM,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAOpG;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAEvD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAGpF;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,yBAAyB,GAAG,MAAM,CAGjF;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAM1E"}

package/dist/_internal/platform/cloudflare/utils.js

@@ -117,8 +117,7 @@ export function selectPermissionGroups(requirements, groups) {
     const ids = [];
     const missing = [];
     for (const requirement of requirements) {
-        const names = [requirement.permission, ...(requirement.alternatives ?? [])];
-        const group = groups.find((entry) => entry.id && entry.name && names.some((name) => normalizePermissionName(entry.name) === normalizePermissionName(name)));
+        const group = findPermissionGroup(requirement, groups);
         if (group?.id) {
             ids.push(group.id);
         }
@@ -131,6 +130,54 @@ export function selectPermissionGroups(requirements, groups) {
     }
     return Array.from(new Set(ids));
 }
+export async function resolvePermissionGroupIds(requirements, listPermissionGroups) {
+    const ids = [];
+    const missing = [];
+    let scannedGroups = null;
+    let lastError;
+    const scanAllGroups = async () => {
+        if (scannedGroups)
+            return scannedGroups;
+        scannedGroups = await collectAsync(listPermissionGroups(), 5_000);
+        return scannedGroups;
+    };
+    for (const requirement of requirements) {
+        const scope = cloudflareScopeForRequirement(requirement);
+        const names = [requirement.permission, ...(requirement.alternatives ?? [])];
+        let group;
+        for (const name of names) {
+            try {
+                const exactMatches = await collectAsync(listPermissionGroups({ name, scope }), 50);
+                group = findPermissionGroup(requirement, exactMatches);
+                if (group)
+                    break;
+            }
+            catch (error) {
+                lastError = error;
+                break;
+            }
+        }
+        if (!group) {
+            try {
+                group = findPermissionGroup(requirement, await scanAllGroups());
+            }
+            catch (error) {
+                lastError = error;
+            }
+        }
+        if (group?.id) {
+            ids.push(group.id);
+        }
+        else {
+            missing.push(`${requirement.permission} (${requirement.component})`);
+        }
+    }
+    if (missing.length > 0) {
+        const suffix = lastError ? ` Last Cloudflare permission-group error: ${summarizeError(lastError)}` : '';
+        throw new CloudflareControlPlaneError(`Could not resolve Cloudflare permission groups for: ${missing.join(', ')}.${suffix} Use /api/cloudflare/token/requirements to show the exact required token shape and create the operational token manually if this Cloudflare account uses different permission names.`, 'CLOUDFLARE_PERMISSION_GROUPS_MISSING', 400);
+    }
+    return Array.from(new Set(ids));
+}
 export function buildTokenResources(accountId, zoneId, components) {
     const resources = {
         [`com.cloudflare.api.account.${accountId}`]: '*',
@@ -211,6 +258,29 @@ function uniqueRequirements(requirements) {
     }
     return unique;
 }
+function findPermissionGroup(requirement, groups) {
+    const names = [requirement.permission, ...(requirement.alternatives ?? [])].map(normalizePermissionName);
+    const scope = cloudflareScopeForRequirement(requirement);
+    return groups.find((entry) => entry.id &&
+        entry.name &&
+        names.includes(normalizePermissionName(entry.name)) &&
+        matchesPermissionScope(entry, scope));
+}
+function matchesPermissionScope(group, scope) {
+    return !group.scopes || group.scopes.length === 0 || group.scopes.includes(scope);
+}
+function cloudflareScopeForRequirement(requirement) {
+    switch (requirement.scope) {
+        case 'account':
+            return 'com.cloudflare.api.account';
+        case 'zone':
+            return 'com.cloudflare.api.account.zone';
+        case 'user':
+            return 'com.cloudflare.api.user';
+        case 'r2':
+            return 'com.cloudflare.edge.r2.bucket';
+    }
+}
 function normalizePermissionName(value) {
     return value.toLowerCase().replace(/[^a-z0-9]+/g, '');
 }

package/dist/_internal/platform/version.js

@@ -1,6 +1,6 @@
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-let version = '0.25.14';
+let version = '0.25.15';
 try {
     const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', '..', 'package.json'), 'utf-8'));
     version = pkg.version ?? version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-sdk",
-  "version": "0.25.14",
+  "version": "0.25.15",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/mgd34msu/goodvibes-sdk.git"