alchemy 2.0.0-beta.13 → 2.0.0-beta.15

package/lib/index.d.ts

@@ -1,7 +1,7 @@
 export * as AdoptPolicy from "./AdoptPolicy.ts";
+export * from "./AlchemyContext.ts";
 export * from "./Apply.ts";
 export { Service as BindingService, Policy, type ServiceLike as BindingServiceLike, type ServiceShape as BindingServiceShape, type PolicyLike, type PolicyShape, } from "./Binding.ts";
-export * from "./Config.ts";
 export * from "./Destroy.ts";
 export * from "./Diff.ts";
 export * from "./Input.ts";
@@ -20,6 +20,7 @@ export * as Server from "./Server/index.ts";
 export * as Serverless from "./Serverless/index.ts";
 export { Stack } from "./Stack.ts";
 export * from "./Stage.ts";
+export { inMemoryState, localState } from "./State/index.ts";
 export * from "./Trait.ts";
 export * as Construct from "./Construct.ts";
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAChD,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,OAAO,IAAI,cAAc,EACzB,MAAM,EACN,KAAK,WAAW,IAAI,kBAAkB,EACtC,KAAK,YAAY,IAAI,mBAAmB,EACxC,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,cAAc,CAAC;AACtB,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,YAAY,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7D,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AACpD,cAAc,eAAe,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,UAAU,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAE3B,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAChD,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,OAAO,IAAI,cAAc,EACzB,MAAM,EACN,KAAK,WAAW,IAAI,kBAAkB,EACtC,KAAK,YAAY,IAAI,mBAAmB,EACxC,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,cAAc,CAAC;AACtB,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,YAAY,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7D,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AACpD,cAAc,eAAe,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,UAAU,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC7D,cAAc,YAAY,CAAC;AAE3B,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAC"}

package/lib/index.js

@@ -1,7 +1,7 @@
 export * as AdoptPolicy from "./AdoptPolicy.js";
+export * from "./AlchemyContext.js";
 export * from "./Apply.js";
 export { Service as BindingService, Policy, } from "./Binding.js";
-export * from "./Config.js";
 export * from "./Destroy.js";
 export * from "./Diff.js";
 export * from "./Input.js";
@@ -19,6 +19,7 @@ export * as Server from "./Server/index.js";
 export * as Serverless from "./Serverless/index.js";
 export { Stack } from "./Stack.js";
 export * from "./Stage.js";
+export { inMemoryState, localState } from "./State/index.js";
 export * from "./Trait.js";
 export * as Construct from "./Construct.js";
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAChD,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,OAAO,IAAI,cAAc,EACzB,MAAM,GAKP,MAAM,cAAc,CAAC;AACtB,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,mBAAmB,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7D,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AACpD,cAAc,eAAe,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,UAAU,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAE3B,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAChD,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,OAAO,IAAI,cAAc,EACzB,MAAM,GAKP,MAAM,cAAc,CAAC;AACtB,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,mBAAmB,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7D,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AACpD,cAAc,eAAe,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,UAAU,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC7D,cAAc,YAAY,CAAC;AAE3B,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alchemy",
-  "version": "2.0.0-beta.13",
+  "version": "2.0.0-beta.15",
   "homepage": "https://alchemy.run",
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",
@@ -9,6 +9,9 @@
     "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
     "directory": "package/alchemy"
   },
+  "bin": {
+    "alchemy": "./bin/cli.js"
+  },
   "files": [
     "bin",
     "lib",
@@ -43,6 +46,12 @@
       "worker": "./src/Agent/index.ts",
       "import": "./lib/Agent/index.js"
     },
+    "./Auth": {
+      "types": "./src/Auth/index.ts",
+      "bun": "./src/Auth/index.ts",
+      "worker": "./src/Auth/index.ts",
+      "import": "./lib/Auth/index.js"
+    },
     "./AWS": {
       "types": "./src/AWS/index.ts",
       "bun": "./src/AWS/index.ts",
@@ -187,6 +196,12 @@
       "worker": "./src/State/index.ts",
       "import": "./lib/State/index.js"
     },
+    "./State/*": {
+      "types": "./src/State/*.ts",
+      "bun": "./src/State/*.ts",
+      "worker": "./src/State/*.ts",
+      "import": "./lib/State/*.js"
+    },
     "./Test/Bun": {
       "types": "./src/Test/Bun.ts",
       "bun": "./src/Test/Bun.ts",
@@ -199,26 +214,28 @@
       "worker": "./src/Util/index.ts",
       "import": "./lib/Util/index.js"
     },
+    "./Util/Clank": {
+      "types": "./src/Util/Clank.ts",
+      "bun": "./src/Util/Clank.ts",
+      "worker": "./src/Util/Clank.ts",
+      "import": "./lib/Util/Clank.js"
+    },
     "./bin/alchemy.js": "./bin/alchemy.js"
   },
   "publishConfig": {
     "access": "public"
   },
-  "optionalDependencies": {
-    "@alchemy.run/cli-posix": "2.0.0-beta.13",
-    "@alchemy.run/cli-win32": "2.0.0-beta.13"
-  },
   "dependencies": {
     "@ai-sdk/anthropic": "^3.0.31",
     "@ai-sdk/openai": "^3.0.23",
     "@ai-sdk/provider": "^3.0.8",
     "@aws-sdk/credential-providers": "^3.0.0",
     "@clack/prompts": "^0.11.0",
-    "@distilled.cloud/aws": "^0.10.2",
-    "@distilled.cloud/cloudflare": "^0.10.2",
+    "@distilled.cloud/aws": "^0.12.4",
+    "@distilled.cloud/cloudflare": "^0.12.4",
     "@distilled.cloud/cloudflare-rolldown-plugin": "0.3.0",
     "@distilled.cloud/cloudflare-vite-plugin": "0.2.0",
-    "@distilled.cloud/core": "^0.10.2",
+    "@distilled.cloud/core": "^0.12.4",
     "@effect/vitest": "4.0.0-beta.48",
     "@libsql/client": "^0.17.0",
     "@octokit/rest": "^22.0.1",
@@ -233,11 +250,11 @@
     "cloudflare": "^5.2.0",
     "fast-glob": "^3.3.2",
     "fast-xml-parser": "^5.3.4",
+    "foreground-child": "^4.0.3",
     "ignore": "^7.0.5",
     "jszip": "^3.10.1",
     "libsodium-wrappers": "^0.8.3",
     "rolldown": "1.0.0-rc.13",
-    "solid-js": "latest",
     "sonda": "^0.11.1",
     "web-tree-sitter": "0.25.10",
     "workerd": "1.20260417.1",
@@ -259,15 +276,16 @@
     "pathe": "^2.0.3",
     "react": "^19.2.0",
     "react-devtools-core": "^7.0.1",
+    "solid-js": "latest",
     "tsconfig-paths": "^4.2.0",
     "tsdown": "^0.15.4",
     "tsx": "^4.20.6",
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@effect/platform-bun": "*",
-    "@effect/platform-node": "*",
-    "effect": "*",
+    "@effect/platform-bun": "4.0.0-beta.48",
+    "@effect/platform-node": "4.0.0-beta.48",
+    "effect": "4.0.0-beta.48",
     "vite": "^8.0.7"
   },
   "peerDependenciesMeta": {
@@ -277,9 +295,6 @@
     "@effect/platform-bun": {
       "optional": true
     },
-    "effect": {
-      "optional": true
-    },
     "vite": {
       "optional": true
     }

package/src/AWS/ECS/Task.ts

@@ -8,6 +8,7 @@ import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import type * as rolldown from "rolldown";
+import { AlchemyContext } from "../../AlchemyContext.ts";
 import * as Bundle from "../../Bundle/Bundle.ts";
 import {
   dockerBuild,
@@ -19,20 +20,19 @@ import {
   findCwdForBundle,
   getStableContextDir,
 } from "../../Bundle/TempRoot.ts";
-import { DotAlchemy } from "../../Config.ts";
 import { isResolved } from "../../Diff.ts";
 import * as Output from "../../Output.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import { Platform, type Main, type PlatformProps } from "../../Platform.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource, type ResourceBinding } from "../../Resource.ts";
-import type { Providers } from "../Providers.ts";
 import type { ProcessContext, ServerHost } from "../../Server/Process.ts";
 import { Stack } from "../../Stack.ts";
 import { createInternalTags, createTagsList, hasTags } from "../../Tags.ts";
-import { AWSEnvironment } from "../Environment.ts";
 import type { Credentials } from "../Credentials.ts";
+import { AWSEnvironment } from "../Environment.ts";
 import type { PolicyStatement } from "../IAM/Policy.ts";
+import type { Providers } from "../Providers.ts";
 
 export const isTask = (value: any): value is Task => {
   return (
@@ -225,7 +225,7 @@ export const TaskProvider = () =>
       const stack = yield* Stack;
       const { accountId } = yield* AWSEnvironment;
       const region = yield* Region;
-      const dotAlchemy = yield* DotAlchemy;
+      const { dotAlchemy } = yield* AlchemyContext;
       const fs = yield* FileSystem.FileSystem;
       const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
 

package/src/AWS/Lambda/Function.ts

@@ -23,16 +23,16 @@ import { Platform, type Main, type PlatformProps } from "../../Platform.ts";
 import type { LogLine, LogsInput } from "../../Provider.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource, type ResourceBinding } from "../../Resource.ts";
-import type { Providers } from "../Providers.ts";
 import * as Serverless from "../../Serverless/index.ts";
 import { Stack } from "../../Stack.ts";
 import { createInternalTags, createTagsList, hasTags } from "../../Tags.ts";
 import { sha256 } from "../../Util/sha256.ts";
 import { zipCode } from "../../Util/zip.ts";
-import { AWSEnvironment } from "../Environment.ts";
 import { Assets } from "../Assets.ts";
+import { AWSEnvironment } from "../Environment.ts";
 import * as IAM from "../IAM/index.ts";
 import type { PolicyStatement } from "../IAM/Policy.ts";
+import type { Providers } from "../Providers.ts";
 import { makeFunctionHttpHandler } from "./HttpServer.ts";
 
 export const FunctionTypeId = "AWS.Lambda.Function" as const;
@@ -403,7 +403,6 @@ export const Function: Platform<
           }),
           (handlers) =>
             async (event: any, context: lambda.Context): Promise<any> => {
-              console.log({ event, handlers });
               for (const handler of handlers) {
                 const eff = handler(event);
                 if (Effect.isEffect(eff)) {

package/src/AWS/SQS/QueueSink.ts

@@ -1,4 +1,3 @@
-import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Sink from "effect/Sink";
@@ -30,7 +29,7 @@ export const QueueSinkLive = Layer.effect(
             Id: `${i}`,
             MessageBody: message,
           })),
-        }).pipe(Effect.tapError(Console.log), Effect.orDie, Effect.asVoid),
+        }).pipe(Effect.orDie, Effect.asVoid),
       );
     });
   }),

package/src/Agent/coding/bash.ts

@@ -2,7 +2,6 @@ import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as S from "effect/Schema";
 import { ChildProcess } from "effect/unstable/process";
-import { cwd } from "../../Config.ts";
 import { AspectConfig } from "../Aspect.ts";
 import { Tool } from "../tool/tool.ts";
 import { CommandValidator } from "../util/command-validator.ts";
@@ -18,7 +17,7 @@ export class timeout extends Tool.input(
 export class workdir extends Tool.input(
   "workdir",
   S.optional(S.String),
-)`The working directory to run the command in. Defaults to ${cwd}. Use this instead of 'cd' commands.` {}
+)`The working directory to run the command in. Defaults to cwd. Use this instead of 'cd' commands.` {}
 
 export class description extends Tool.input(
   "description",
@@ -51,7 +50,7 @@ export class bash extends Tool("bash", {
 Returns the ${exitCode} and ${stdout} containing both stdout and stderr.
 If the command is invalid, an error message will be returned as a ${S.String}.
 
-All commands run in ${cwd} by default. Use the ${workdir} parameter if you need to run a command in a different directory. AVOID using \`cd <directory> && <command>\` patterns - use \`workdir\` instead.
+All commands run in cwd by default. Use the ${workdir} parameter if you need to run a command in a different directory. AVOID using \`cd <directory> && <command>\` patterns - use \`workdir\` instead.
 
 IMPORTANT: This tool is for terminal operations like git, npm, docker, etc. DO NOT use it for file operations (reading, writing, editing, searching, finding files) - use the specialized tools for this instead.
 

package/src/Agent/coding/glob.ts

@@ -3,7 +3,6 @@ import * as FileSystem from "effect/FileSystem";
 import * as Option from "effect/Option";
 import * as Path from "effect/Path";
 import * as S from "effect/Schema";
-import { cwd } from "../../Config.ts";
 import { AspectConfig } from "../Aspect.ts";
 import { Tool } from "../tool/tool.ts";
 import * as Ripgrep from "../util/ripgrep.ts";
@@ -21,7 +20,7 @@ Examples:
 export class path extends Tool.input(
   "path",
   S.optional(S.String),
-)`The directory to search in. Defaults to ${cwd} if not specified.` {}
+)`The directory to search in. Defaults to cwd if not specified.` {}
 
 export class files extends Tool.output(
   "files",

package/src/Agent/coding/grep.ts

@@ -3,7 +3,6 @@ import * as FileSystem from "effect/FileSystem";
 import * as Option from "effect/Option";
 import * as S from "effect/Schema";
 import { ChildProcess } from "effect/unstable/process";
-import { cwd } from "../../Config.ts";
 import { AspectConfig } from "../Aspect.ts";
 import { Tool } from "../tool/tool.ts";
 import { exec } from "../util/exec.ts";
@@ -18,7 +17,7 @@ Supports full regex syntax (e.g., "log.*Error", "function\\s+\\w+", etc.)` {}
 class path extends Tool.input(
   "path",
   S.optional(S.String),
-)`The directory to search in. Defaults to ${cwd} if not specified.` {}
+)`The directory to search in. Defaults to cwd if not specified.` {}
 
 class include extends Tool.input(
   "include",

package/src/AlchemyContext.ts

@@ -0,0 +1,27 @@
+import * as EffectContext from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+
+export class AlchemyContext extends EffectContext.Service<
+  AlchemyContext,
+  {
+    dotAlchemy: string;
+    updateStateStore: boolean;
+  }
+>()("alchemy/Context") {}
+
+export const AlchemyContextLive = Layer.effect(
+  AlchemyContext,
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const dir = path.join(process.cwd(), ".alchemy");
+    yield* fs.makeDirectory(dir, { recursive: true });
+    return {
+      dotAlchemy: dir,
+      updateStateStore: false,
+    };
+  }),
+);

package/src/Auth/AuthProvider.ts

@@ -206,7 +206,7 @@ export const getAuthProvider = <
     registry[name] == null
       ? Effect.fail(
           new AuthError({
-            message: `AuthProvider '${name}' is not registered. Make sure its layer has been built.`,
+            message: `AuthProvider '${name}' is not registered. Make sure its layer has been provided.`,
           }),
         )
       : Effect.succeed(registry[name] as AuthProvider<Config, Credentials>),

package/src/Auth/index.ts

@@ -1,2 +1,4 @@
 export * from "./AuthProvider.ts";
-export type * from "./Profile.ts";
+export * from "./Credentials.ts";
+export * from "./Env.ts";
+export * from "./Profile.ts";

package/src/{Test/TestCli.ts → Cli/LoggingCli.ts}

@@ -1,8 +1,8 @@
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { Cli } from "../Cli/Cli.ts";
+import { Cli } from "./Cli.ts";
 
-export const TestCli = Layer.succeed(
+export const LoggingCli = Layer.succeed(
   Cli,
   Cli.of({
     approvePlan: () => Effect.succeed(true),

package/src/Cli/index.ts

@@ -1,2 +1,5 @@
 export * from "./Cli.ts";
-export * from "./InkCLI.tsx";
+// Note: do NOT re-export InkCLI here. The Ink-based renderer pulls in
+// `react`/`ink`, which we do not want consumers of `alchemy/Cli` to
+// transitively depend on. Import `alchemy/Cli/InkCLI` directly when needed
+// (currently only from `bin/alchemy.ts`, which is bundled).

package/src/Cloudflare/ApiToken/AccountApiToken.ts

@@ -0,0 +1,197 @@
+import * as accounts from "@distilled.cloud/cloudflare/accounts";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  buildConditionPayload,
+  conditionFingerprint,
+  policyFingerprint,
+  resolvePolicies,
+  type BaseApiTokenProps,
+} from "./Common.ts";
+
+export type AccountApiTokenProps = BaseApiTokenProps;
+
+export type AccountApiToken = Resource<
+  "Cloudflare.AccountApiToken",
+  AccountApiTokenProps,
+  {
+    tokenId: string;
+    name: string;
+    status: "active" | "disabled" | "expired";
+    /**
+     * The plaintext token value. Cloudflare returns this only once, on
+     * creation, so we persist it here for downstream consumers (e.g. a
+     * GitHub Actions secret).
+     */
+    value: Redacted.Redacted<string>;
+    accountId: string;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A Cloudflare account-owned API token (`POST /accounts/{account_id}/tokens`).
+ *
+ * Account-owned tokens are managed at the account level and persist
+ * independently of any single user. Use these for CI tokens, third-party
+ * integrations, or anywhere the token should outlive an individual user's
+ * session.
+ *
+ * Creating account-owned tokens requires the caller to have the
+ * `API Tokens > Write` account permission.
+ *
+ * @section Creating a Token
+ * @example A token for managing Workers and KV from CI
+ * ```typescript
+ * const token = yield* Cloudflare.AccountApiToken("ci-token", {
+ *   name: "my-ci-token",
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: [
+ *         "Workers Scripts Write",
+ *         "Workers KV Storage Write",
+ *       ],
+ *       resources: { "com.cloudflare.api.account": "*" },
+ *     },
+ *   ],
+ * });
+ *
+ * yield* GitHub.Secret("cf-api-token", {
+ *   owner: "me",
+ *   repository: "my-repo",
+ *   name: "CLOUDFLARE_API_TOKEN",
+ *   value: token.value,
+ * });
+ * ```
+ */
+export const AccountApiToken = Resource<AccountApiToken>(
+  "Cloudflare.AccountApiToken",
+);
+
+type AccountApiTokenAttributes = AccountApiToken["Attributes"];
+
+const resolveName = (id: string, name: string | undefined) =>
+  Effect.gen(function* () {
+    return name ?? (yield* createPhysicalName({ id }));
+  });
+
+export const AccountApiTokenProvider = () =>
+  Provider.effect(
+    AccountApiToken,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const createToken = yield* accounts.createToken;
+      const updateToken = yield* accounts.updateToken;
+      const deleteToken = yield* accounts.deleteToken;
+      const getToken = yield* accounts.getToken;
+
+      const buildAttributes = (
+        tokenData: {
+          id?: string | null;
+          name?: string | null;
+          status?: "active" | "disabled" | "expired" | null;
+        },
+        value: Redacted.Redacted<string>,
+      ): AccountApiTokenAttributes => ({
+        tokenId: tokenData.id ?? "",
+        name: tokenData.name ?? "",
+        status: tokenData.status ?? "active",
+        value,
+        accountId,
+      });
+
+      return {
+        stables: ["tokenId", "accountId"],
+        diff: Effect.fn(function* ({ id, olds, news, output }) {
+          if (!isResolved(news)) return undefined;
+          if ((output?.accountId ?? accountId) !== accountId) {
+            return { action: "replace" } as const;
+          }
+          const oldName = output?.name ?? (yield* resolveName(id, olds?.name));
+          const newName = yield* resolveName(id, news.name);
+          const oldPolicyFp = policyFingerprint(
+            resolvePolicies(olds?.policies ?? [], accountId),
+          );
+          const newPolicyFp = policyFingerprint(
+            resolvePolicies(news.policies, accountId),
+          );
+          const oldCondFp = conditionFingerprint(olds?.condition);
+          const newCondFp = conditionFingerprint(news.condition);
+          if (
+            oldName !== newName ||
+            oldPolicyFp !== newPolicyFp ||
+            oldCondFp !== newCondFp ||
+            (olds?.expiresOn ?? undefined) !== (news.expiresOn ?? undefined) ||
+            (olds?.notBefore ?? undefined) !== (news.notBefore ?? undefined)
+          ) {
+            return { action: "update" } as const;
+          }
+        }),
+        create: Effect.fn(function* ({ id, news }) {
+          const name = yield* resolveName(id, news.name);
+          const policies = resolvePolicies(news.policies, accountId);
+          const result = yield* createToken({
+            accountId,
+            name,
+            policies,
+            condition: buildConditionPayload(news.condition),
+            expiresOn: news.expiresOn,
+            notBefore: news.notBefore,
+          });
+          if (!result.value) {
+            return yield* Effect.die(
+              `Cloudflare did not return a value for token "${name}".`,
+            );
+          }
+          return buildAttributes(result, Redacted.make(result.value));
+        }),
+        update: Effect.fn(function* ({ id, news, output }) {
+          const name = yield* resolveName(id, news.name);
+          const policies = resolvePolicies(news.policies, accountId);
+          const result = yield* updateToken({
+            accountId,
+            tokenId: output.tokenId,
+            name,
+            policies,
+            condition: buildConditionPayload(news.condition),
+            expiresOn: news.expiresOn,
+            notBefore: news.notBefore,
+          });
+          // Cloudflare doesn't return the value on update; preserve the
+          // value captured at creation.
+          return buildAttributes(result, output.value);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteToken({
+            accountId: output.accountId,
+            tokenId: output.tokenId,
+          }).pipe(
+            // Already gone — Cloudflare may report this as either an
+            // `InvalidRoute` (token-id no longer routable) or a generic
+            // `TokenNotFound`. Either is fine; we just want the resource gone.
+            Effect.catchTag("InvalidRoute", () => Effect.void),
+            Effect.catchTag("TokenNotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.tokenId) return undefined;
+          return yield* getToken({
+            accountId: output.accountId,
+            tokenId: output.tokenId,
+          }).pipe(
+            Effect.map((token) => buildAttributes(token, output.value)),
+            Effect.catchTag("InvalidRoute", () => Effect.succeed(undefined)),
+            Effect.catchTag("TokenNotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+      };
+    }),
+  );