alchemy 2.0.0-beta.13 → 2.0.0-beta.15

package/lib/AlchemyContext.d.ts

@@ -0,0 +1,13 @@
+import * as EffectContext from "effect/Context";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+declare const AlchemyContext_base: EffectContext.ServiceClass<AlchemyContext, "alchemy/Context", {
+    dotAlchemy: string;
+    updateStateStore: boolean;
+}>;
+export declare class AlchemyContext extends AlchemyContext_base {
+}
+export declare const AlchemyContextLive: Layer.Layer<AlchemyContext, import("effect/PlatformError").PlatformError, Path.Path | FileSystem.FileSystem>;
+export {};
+//# sourceMappingURL=AlchemyContext.d.ts.map

package/lib/AlchemyContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AlchemyContext.d.ts","sourceRoot":"","sources":["../src/AlchemyContext.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,gBAAgB,CAAC;AAEhD,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;;gBAKpB,MAAM;sBACA,OAAO;;AAJ7B,qBAAa,cAAe,SAAQ,mBAMd;CAAG;AAEzB,eAAO,MAAM,kBAAkB,8GAY9B,CAAC"}

package/lib/AlchemyContext.js

@@ -0,0 +1,18 @@
+import * as EffectContext from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+export class AlchemyContext extends EffectContext.Service()("alchemy/Context") {
+}
+export const AlchemyContextLive = Layer.effect(AlchemyContext, Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const dir = path.join(process.cwd(), ".alchemy");
+    yield* fs.makeDirectory(dir, { recursive: true });
+    return {
+        dotAlchemy: dir,
+        updateStateStore: false,
+    };
+}));
+//# sourceMappingURL=AlchemyContext.js.map

package/lib/AlchemyContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AlchemyContext.js","sourceRoot":"","sources":["../src/AlchemyContext.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAEpC,MAAM,OAAO,cAAe,SAAQ,aAAa,CAAC,OAAO,EAMtD,CAAC,iBAAiB,CAAC;CAAG;AAEzB,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,CAC5C,cAAc,EACd,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;IACjD,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,OAAO;QACL,UAAU,EAAE,GAAG;QACf,gBAAgB,EAAE,KAAK;KACxB,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Auth/AuthProvider.js

@@ -38,7 +38,7 @@ export const AuthProviderLayer = () => (name, impl) => Layer.effectDiscard(AuthP
  */
 export const getAuthProvider = (name) => Effect.flatMap(AuthProviders.asEffect(), (registry) => registry[name] == null
     ? Effect.fail(new AuthError({
-        message: `AuthProvider '${name}' is not registered. Make sure its layer has been built.`,
+        message: `AuthProvider '${name}' is not registered. Make sure its layer has been provided.`,
     }))
     : Effect.succeed(registry[name]));
 //# sourceMappingURL=AuthProvider.js.map

package/lib/Auth/AuthProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.js","sourceRoot":"","sources":["../../src/Auth/AuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,gBAAgB,EAAa,CACjE,WAAW,EACX;IACE,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACtC,CACF;CAAG;AAEJ,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAK/C,CAAC,eAAe,CAAC;CAAG;AAkEvB,MAAM,CAAC,MAAM,YAAY,GACvB,GAAmD,EAAE,CACrD,CAQE,IAAY,EACZ,IAsBK,EACL,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,GAAG,EAAE,CACH,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;QACjB,IAAI,EAAE,cAAc;QACpB,IAAI;QACJ,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI;YACJ,CAAC,GAAG,IAA2B,EAAE,EAAE,CACjC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;SAC/C,CAAC,CACH;KACmC,CAAC,CAC1C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEP;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,GAAmD,EAAE,CACrD,CAQE,IAAY,EACZ,IAsBK,EACL,EAAE,CACF,KAAK,CAAC,aAAa,CACjB,YAAY,EAAuB,CAOjC,IAAI,EAAE,IAAI,CAAC,CACd,CAAC;AAEN;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAI7B,IAAY,EACgE,EAAE,CAC9E,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,CACpD,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI;IACpB,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,SAAS,CAAC;QACZ,OAAO,EAAE,iBAAiB,IAAI,0DAA0D;KACzF,CAAC,CACH;IACH,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsC,CAAC,CACxE,CAAC"}
+{"version":3,"file":"AuthProvider.js","sourceRoot":"","sources":["../../src/Auth/AuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,gBAAgB,EAAa,CACjE,WAAW,EACX;IACE,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACtC,CACF;CAAG;AAEJ,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAK/C,CAAC,eAAe,CAAC;CAAG;AAkEvB,MAAM,CAAC,MAAM,YAAY,GACvB,GAAmD,EAAE,CACrD,CAQE,IAAY,EACZ,IAsBK,EACL,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,GAAG,EAAE,CACH,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;QACjB,IAAI,EAAE,cAAc;QACpB,IAAI;QACJ,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI;YACJ,CAAC,GAAG,IAA2B,EAAE,EAAE,CACjC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;SAC/C,CAAC,CACH;KACmC,CAAC,CAC1C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEP;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,GAAmD,EAAE,CACrD,CAQE,IAAY,EACZ,IAsBK,EACL,EAAE,CACF,KAAK,CAAC,aAAa,CACjB,YAAY,EAAuB,CAOjC,IAAI,EAAE,IAAI,CAAC,CACd,CAAC;AAEN;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAI7B,IAAY,EACgE,EAAE,CAC9E,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,CACpD,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI;IACpB,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,SAAS,CAAC;QACZ,OAAO,EAAE,iBAAiB,IAAI,6DAA6D;KAC5F,CAAC,CACH;IACH,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsC,CAAC,CACxE,CAAC"}

package/lib/Auth/Profile.d.ts

@@ -74,6 +74,6 @@ export declare const loadOrConfigure: <Config extends {
      * - other: Other authentication methods
      */
     method: string;
-}, import("./AuthProvider.ts").AuthError | import("effect/PlatformError").PlatformError, FileSystem.FileSystem>;
+}, import("effect/PlatformError").PlatformError | import("./AuthProvider.ts").AuthError, FileSystem.FileSystem>;
 export {};
 //# sourceMappingURL=Profile.d.ts.map

package/lib/Auth/index.d.ts

@@ -1,3 +1,5 @@
 export * from "./AuthProvider.ts";
-export type * from "./Profile.ts";
+export * from "./Credentials.ts";
+export * from "./Env.ts";
+export * from "./Profile.ts";
 //# sourceMappingURL=index.d.ts.map

package/lib/Auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,mBAAmB,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC"}

package/lib/Auth/index.js

@@ -1,2 +1,5 @@
 export * from "./AuthProvider.js";
+export * from "./Credentials.js";
+export * from "./Env.js";
+export * from "./Profile.js";
 //# sourceMappingURL=index.js.map

package/lib/Auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC"}

package/lib/Build/Command.d.ts

@@ -89,7 +89,7 @@ export interface Command extends Resource<"Build.Command", CommandProps, {
  * });
  */
 export declare const Command: import("../Resource.ts").ResourceClass<Command>;
-export declare const CommandProvider: () => import("effect/Layer").Layer<Provider.Provider<Command>, never, import("effect/Scope").Scope | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | FileSystem.FileSystem | Path.Path>;
+export declare const CommandProvider: () => import("effect/Layer").Layer<Provider.Provider<Command>, never, Path.Path | FileSystem.FileSystem | import("effect/Scope").Scope | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
 export interface RunBuildCommandOptions {
     command: string;
     cwd?: string;

package/lib/Build/Memo.d.ts

@@ -41,5 +41,5 @@ export interface MemoOptions {
 export declare const hashDirectory: (props: {
     cwd?: string;
     memo?: MemoOptions;
-}) => Effect.Effect<string, PlatformError, FileSystem.FileSystem | Path.Path>;
+}) => Effect.Effect<string, PlatformError, Path.Path | FileSystem.FileSystem>;
 //# sourceMappingURL=Memo.d.ts.map

package/lib/Bundle/Docker.d.ts

@@ -31,11 +31,11 @@ export interface DockerBuildOptions {
     readonly extraArgs?: ReadonlyArray<string>;
     readonly env?: Record<string, string | undefined>;
 }
-export declare const materializeDockerfile: (dockerfile: string, dir: string) => Effect.Effect<string, import("effect/PlatformError").PlatformError, FileSystem.FileSystem | Path.Path>;
+export declare const materializeDockerfile: (dockerfile: string, dir: string) => Effect.Effect<string, import("effect/PlatformError").PlatformError, Path.Path | FileSystem.FileSystem>;
 export declare const writeContextFiles: (dir: string, files: readonly {
     readonly path: string;
     readonly content: string | Uint8Array;
-}[]) => Effect.Effect<void, import("effect/PlatformError").PlatformError, FileSystem.FileSystem | Path.Path>;
+}[]) => Effect.Effect<void, import("effect/PlatformError").PlatformError, Path.Path | FileSystem.FileSystem>;
 export declare const runDockerCommand: (args: readonly string[], options?: {
     cwd?: string;
     env?: Record<string, string | undefined>;
@@ -67,6 +67,6 @@ export declare const dockerLogin: (auth: RegistryAuth, options?: {
  * Push an image ref. When `auth` is set, uses an isolated `DOCKER_CONFIG`
  * directory so concurrent deploys do not race on global docker credentials.
  */
-export declare const pushImage: (imageRef: string, auth?: RegistryAuth | undefined) => Effect.Effect<void, import("effect/PlatformError").PlatformError | DockerCommandError, import("effect/Scope").Scope | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | FileSystem.FileSystem>;
+export declare const pushImage: (imageRef: string, auth?: RegistryAuth | undefined) => Effect.Effect<void, import("effect/PlatformError").PlatformError | DockerCommandError, FileSystem.FileSystem | import("effect/Scope").Scope | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
 export {};
 //# sourceMappingURL=Docker.d.ts.map

package/lib/Bundle/TempRoot.d.ts

@@ -9,16 +9,16 @@ import { Stage } from "../Stage.ts";
  * nonce) so concurrent bundle operations for the same resource never collide.
  * Stale directories from previous crashed runs are cleaned up best-effort.
  */
-export declare const createTempBundleDir: (entry: string, dotAlchemy: string, id: string) => Effect.Effect<string, import("effect/PlatformError").PlatformError, FileSystem.FileSystem | Path.Path | Stage | Stack>;
+export declare const createTempBundleDir: (entry: string, dotAlchemy: string, id: string) => Effect.Effect<string, import("effect/PlatformError").PlatformError, Path.Path | FileSystem.FileSystem | Stage | Stack>;
 /**
  * Returns a deterministic bundle staging directory without clearing it first.
  * Useful for Docker build contexts where keeping the directory stable avoids
  * unnecessary file churn between builds.
  */
-export declare const getStableContextDir: (entry: string, dotAlchemy: string, id: string) => Effect.Effect<string, import("effect/PlatformError").PlatformError, FileSystem.FileSystem | Path.Path | Stage | Stack>;
+export declare const getStableContextDir: (entry: string, dotAlchemy: string, id: string) => Effect.Effect<string, import("effect/PlatformError").PlatformError, Path.Path | FileSystem.FileSystem | Stage | Stack>;
 /**
  * Cleans up a bundle's private temp directory.
  */
 export declare const cleanupBundleTempDir: (tempDir: string) => Effect.Effect<void, never, FileSystem.FileSystem>;
-export declare const findCwdForBundle: (entry: string) => Effect.Effect<string, import("effect/PlatformError").PlatformError, FileSystem.FileSystem | Path.Path>;
+export declare const findCwdForBundle: (entry: string) => Effect.Effect<string, import("effect/PlatformError").PlatformError, Path.Path | FileSystem.FileSystem>;
 //# sourceMappingURL=TempRoot.d.ts.map

package/lib/Cli/LoggingCli.d.ts

@@ -0,0 +1,4 @@
+import * as Layer from "effect/Layer";
+import { Cli } from "./Cli.ts";
+export declare const LoggingCli: Layer.Layer<Cli, never, never>;
+//# sourceMappingURL=LoggingCli.d.ts.map

package/lib/Cli/LoggingCli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoggingCli.d.ts","sourceRoot":"","sources":["../../src/Cli/LoggingCli.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,eAAO,MAAM,UAAU,gCAgBtB,CAAC"}

package/lib/{Test/TestCli.js → Cli/LoggingCli.js}

@@ -1,7 +1,7 @@
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { Cli } from "../Cli/Cli.js";
-export const TestCli = Layer.succeed(Cli, Cli.of({
+import { Cli } from "./Cli.js";
+export const LoggingCli = Layer.succeed(Cli, Cli.of({
     approvePlan: () => Effect.succeed(true),
     displayPlan: () => Effect.void,
     startApplySession: () => Effect.succeed({
@@ -11,4 +11,4 @@ export const TestCli = Layer.succeed(Cli, Cli.of({
             : `${event.id}: ${event.message}`),
     }),
 }));
-//# sourceMappingURL=TestCli.js.map
+//# sourceMappingURL=LoggingCli.js.map

package/lib/Cli/LoggingCli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoggingCli.js","sourceRoot":"","sources":["../../src/Cli/LoggingCli.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CACrC,GAAG,EACH,GAAG,CAAC,EAAE,CAAC;IACL,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;IACvC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;IAC9B,iBAAiB,EAAE,GAAG,EAAE,CACtB,MAAM,CAAC,OAAO,CAAC;QACb,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;QACvB,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CACd,MAAM,CAAC,GAAG,CACR,KAAK,CAAC,IAAI,KAAK,eAAe;YAC5B,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG;YAC9C,CAAC,CAAC,GAAG,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO,EAAE,CACpC;KACJ,CAAC;CACL,CAAC,CACH,CAAC"}

package/lib/Cli/index.d.ts

@@ -1,3 +1,2 @@
 export * from "./Cli.ts";
-export * from "./InkCLI.tsx";
 //# sourceMappingURL=index.d.ts.map

package/lib/Cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Cli/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Cli/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC"}

package/lib/Cli/index.js

@@ -1,3 +1,6 @@
 export * from "./Cli.js";
-export * from "./InkCLI.js";
+// Note: do NOT re-export InkCLI here. The Ink-based renderer pulls in
+// `react`/`ink`, which we do not want consumers of `alchemy/Cli` to
+// transitively depend on. Import `alchemy/Cli/InkCLI` directly when needed
+// (currently only from `bin/alchemy.ts`, which is bundled).
 //# sourceMappingURL=index.js.map

package/lib/Cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Cli/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,aAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Cli/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,4DAA4D"}

package/lib/Cloudflare/ApiToken/AccountApiToken.d.ts

@@ -0,0 +1,58 @@
+import * as Redacted from "effect/Redacted";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+import { type BaseApiTokenProps } from "./Common.ts";
+export type AccountApiTokenProps = BaseApiTokenProps;
+export type AccountApiToken = Resource<"Cloudflare.AccountApiToken", AccountApiTokenProps, {
+    tokenId: string;
+    name: string;
+    status: "active" | "disabled" | "expired";
+    /**
+     * The plaintext token value. Cloudflare returns this only once, on
+     * creation, so we persist it here for downstream consumers (e.g. a
+     * GitHub Actions secret).
+     */
+    value: Redacted.Redacted<string>;
+    accountId: string;
+}, never, Providers>;
+/**
+ * A Cloudflare account-owned API token (`POST /accounts/{account_id}/tokens`).
+ *
+ * Account-owned tokens are managed at the account level and persist
+ * independently of any single user. Use these for CI tokens, third-party
+ * integrations, or anywhere the token should outlive an individual user's
+ * session.
+ *
+ * Creating account-owned tokens requires the caller to have the
+ * `API Tokens > Write` account permission.
+ *
+ * @section Creating a Token
+ * @example A token for managing Workers and KV from CI
+ * ```typescript
+ * const token = yield* Cloudflare.AccountApiToken("ci-token", {
+ *   name: "my-ci-token",
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: [
+ *         "Workers Scripts Write",
+ *         "Workers KV Storage Write",
+ *       ],
+ *       resources: { "com.cloudflare.api.account": "*" },
+ *     },
+ *   ],
+ * });
+ *
+ * yield* GitHub.Secret("cf-api-token", {
+ *   owner: "me",
+ *   repository: "my-repo",
+ *   name: "CLOUDFLARE_API_TOKEN",
+ *   value: token.value,
+ * });
+ * ```
+ */
+export declare const AccountApiToken: import("../../Resource.ts").ResourceClass<AccountApiToken>;
+export declare const AccountApiTokenProvider: () => import("effect/Layer").Layer<Provider.Provider<AccountApiToken>, never, import("effect/unstable/http/HttpClient").HttpClient | import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("@distilled.cloud/cloudflare").Credentials | CloudflareEnvironment>;
+//# sourceMappingURL=AccountApiToken.d.ts.map

package/lib/Cloudflare/ApiToken/AccountApiToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountApiToken.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/AccountApiToken.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAErD,MAAM,MAAM,eAAe,GAAG,QAAQ,CACpC,4BAA4B,EAC5B,oBAAoB,EACpB;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB,EACD,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,eAAe,4DAE3B,CAAC;AASF,eAAO,MAAM,uBAAuB,mRA+GjC,CAAC"}

package/lib/Cloudflare/ApiToken/AccountApiToken.js

@@ -0,0 +1,137 @@
+import * as accounts from "@distilled.cloud/cloudflare/accounts";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
+import { buildConditionPayload, conditionFingerprint, policyFingerprint, resolvePolicies, } from "./Common.js";
+/**
+ * A Cloudflare account-owned API token (`POST /accounts/{account_id}/tokens`).
+ *
+ * Account-owned tokens are managed at the account level and persist
+ * independently of any single user. Use these for CI tokens, third-party
+ * integrations, or anywhere the token should outlive an individual user's
+ * session.
+ *
+ * Creating account-owned tokens requires the caller to have the
+ * `API Tokens > Write` account permission.
+ *
+ * @section Creating a Token
+ * @example A token for managing Workers and KV from CI
+ * ```typescript
+ * const token = yield* Cloudflare.AccountApiToken("ci-token", {
+ *   name: "my-ci-token",
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: [
+ *         "Workers Scripts Write",
+ *         "Workers KV Storage Write",
+ *       ],
+ *       resources: { "com.cloudflare.api.account": "*" },
+ *     },
+ *   ],
+ * });
+ *
+ * yield* GitHub.Secret("cf-api-token", {
+ *   owner: "me",
+ *   repository: "my-repo",
+ *   name: "CLOUDFLARE_API_TOKEN",
+ *   value: token.value,
+ * });
+ * ```
+ */
+export const AccountApiToken = Resource("Cloudflare.AccountApiToken");
+const resolveName = (id, name) => Effect.gen(function* () {
+    return name ?? (yield* createPhysicalName({ id }));
+});
+export const AccountApiTokenProvider = () => Provider.effect(AccountApiToken, Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+    const createToken = yield* accounts.createToken;
+    const updateToken = yield* accounts.updateToken;
+    const deleteToken = yield* accounts.deleteToken;
+    const getToken = yield* accounts.getToken;
+    const buildAttributes = (tokenData, value) => ({
+        tokenId: tokenData.id ?? "",
+        name: tokenData.name ?? "",
+        status: tokenData.status ?? "active",
+        value,
+        accountId,
+    });
+    return {
+        stables: ["tokenId", "accountId"],
+        diff: Effect.fn(function* ({ id, olds, news, output }) {
+            if (!isResolved(news))
+                return undefined;
+            if ((output?.accountId ?? accountId) !== accountId) {
+                return { action: "replace" };
+            }
+            const oldName = output?.name ?? (yield* resolveName(id, olds?.name));
+            const newName = yield* resolveName(id, news.name);
+            const oldPolicyFp = policyFingerprint(resolvePolicies(olds?.policies ?? [], accountId));
+            const newPolicyFp = policyFingerprint(resolvePolicies(news.policies, accountId));
+            const oldCondFp = conditionFingerprint(olds?.condition);
+            const newCondFp = conditionFingerprint(news.condition);
+            if (oldName !== newName ||
+                oldPolicyFp !== newPolicyFp ||
+                oldCondFp !== newCondFp ||
+                (olds?.expiresOn ?? undefined) !== (news.expiresOn ?? undefined) ||
+                (olds?.notBefore ?? undefined) !== (news.notBefore ?? undefined)) {
+                return { action: "update" };
+            }
+        }),
+        create: Effect.fn(function* ({ id, news }) {
+            const name = yield* resolveName(id, news.name);
+            const policies = resolvePolicies(news.policies, accountId);
+            const result = yield* createToken({
+                accountId,
+                name,
+                policies,
+                condition: buildConditionPayload(news.condition),
+                expiresOn: news.expiresOn,
+                notBefore: news.notBefore,
+            });
+            if (!result.value) {
+                return yield* Effect.die(`Cloudflare did not return a value for token "${name}".`);
+            }
+            return buildAttributes(result, Redacted.make(result.value));
+        }),
+        update: Effect.fn(function* ({ id, news, output }) {
+            const name = yield* resolveName(id, news.name);
+            const policies = resolvePolicies(news.policies, accountId);
+            const result = yield* updateToken({
+                accountId,
+                tokenId: output.tokenId,
+                name,
+                policies,
+                condition: buildConditionPayload(news.condition),
+                expiresOn: news.expiresOn,
+                notBefore: news.notBefore,
+            });
+            // Cloudflare doesn't return the value on update; preserve the
+            // value captured at creation.
+            return buildAttributes(result, output.value);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* deleteToken({
+                accountId: output.accountId,
+                tokenId: output.tokenId,
+            }).pipe(
+            // Already gone — Cloudflare may report this as either an
+            // `InvalidRoute` (token-id no longer routable) or a generic
+            // `TokenNotFound`. Either is fine; we just want the resource gone.
+            Effect.catchTag("InvalidRoute", () => Effect.void), Effect.catchTag("TokenNotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ output }) {
+            if (!output?.tokenId)
+                return undefined;
+            return yield* getToken({
+                accountId: output.accountId,
+                tokenId: output.tokenId,
+            }).pipe(Effect.map((token) => buildAttributes(token, output.value)), Effect.catchTag("InvalidRoute", () => Effect.succeed(undefined)), Effect.catchTag("TokenNotFound", () => Effect.succeed(undefined)));
+        }),
+    };
+}));
+//# sourceMappingURL=AccountApiToken.js.map

package/lib/Cloudflare/ApiToken/AccountApiToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountApiToken.js","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/AccountApiToken.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,sCAAsC,CAAC;AACjE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,GAEhB,MAAM,aAAa,CAAC;AAuBrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CACrC,4BAA4B,CAC7B,CAAC;AAIF,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC3D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,EAAE,CAC1C,QAAQ,CAAC,MAAM,CACb,eAAe,EACf,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC;IACnD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAE1C,MAAM,eAAe,GAAG,CACtB,SAIC,EACD,KAAgC,EACL,EAAE,CAAC,CAAC;QAC/B,OAAO,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE;QAC3B,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE;QAC1B,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,QAAQ;QACpC,KAAK;QACL,SAAS;KACV,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC;QACjC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;YACnD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;gBACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,iBAAiB,CACnC,eAAe,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,SAAS,CAAC,CACjD,CAAC;YACF,MAAM,WAAW,GAAG,iBAAiB,CACnC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAC1C,CAAC;YACF,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvD,IACE,OAAO,KAAK,OAAO;gBACnB,WAAW,KAAK,WAAW;gBAC3B,SAAS,KAAK,SAAS;gBACvB,CAAC,IAAI,EAAE,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;gBAChE,CAAC,IAAI,EAAE,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,EAChE,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAW,CAAC;YACvC,CAAC;QACH,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;gBAChC,SAAS;gBACT,IAAI;gBACJ,QAAQ;gBACR,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;gBAChD,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,gDAAgD,IAAI,IAAI,CACzD,CAAC;YACJ,CAAC;YACD,OAAO,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;gBAChC,SAAS;gBACT,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI;gBACJ,QAAQ;gBACR,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;gBAChD,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;YACH,8DAA8D;YAC9D,8BAA8B;YAC9B,OAAO,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,WAAW,CAAC;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC,IAAI;YACL,yDAAyD;YACzD,4DAA4D;YAC5D,mEAAmE;YACnE,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAClD,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACpD,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACnC,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAE,OAAO,SAAS,CAAC;YACvC,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAC3D,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAChE,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAClE,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Cloudflare/ApiToken/Common.d.ts

@@ -0,0 +1,91 @@
+import { type PermissionGroupName } from "./PermissionGroups.ts";
+/**
+ * Resource keys recognized by Cloudflare API token policies.
+ *
+ * The literal `"com.cloudflare.api.account"` is rewritten by the account-scoped
+ * provider to `"com.cloudflare.api.account.${accountId}"` so callers don't have
+ * to splice the account ID themselves.
+ *
+ * @see https://developers.cloudflare.com/fundamentals/api/reference/permissions/
+ */
+export type ApiTokenResourceKey = "com.cloudflare.api.account" | `com.cloudflare.api.account.${string}` | `com.cloudflare.api.account.zone.${string}` | `com.cloudflare.edge.r2.bucket.${string}` | (string & {});
+/**
+ * A permission group reference: either a typed Cloudflare permission-group
+ * name (resolved against the static catalog) or an explicit `{ id }` for
+ * names that aren't in the catalog or have multiple scopes.
+ */
+export type ApiTokenPermissionGroupRef = PermissionGroupName | {
+    id: string;
+    meta?: {
+        key?: string;
+        value?: string;
+    };
+};
+export interface ApiTokenPolicy {
+    effect: "allow" | "deny";
+    permissionGroups: ApiTokenPermissionGroupRef[];
+    resources: {
+        [K in ApiTokenResourceKey]?: string;
+    };
+}
+export interface ApiTokenCondition {
+    requestIp?: {
+        in?: string[];
+        notIn?: string[];
+    };
+}
+export type BaseApiTokenProps = {
+    /**
+     * Token name. Defaults to a generated physical name based on the
+     * resource's logical id, app name, and stage.
+     */
+    name?: string;
+    /**
+     * Access policies attached to the token. At least one policy is required
+     * by Cloudflare.
+     */
+    policies: ApiTokenPolicy[];
+    /** ISO 8601 expiration timestamp. */
+    expiresOn?: string;
+    /** ISO 8601 "not before" timestamp. */
+    notBefore?: string;
+    /** Optional usage conditions (e.g. IP allowlist). */
+    condition?: ApiTokenCondition;
+};
+export type ResolvedPolicy = {
+    effect: "allow" | "deny";
+    permissionGroups: {
+        id: string;
+        meta?: {
+            key?: string;
+            value?: string;
+        };
+    }[];
+    resources: Record<string, unknown>;
+};
+export declare const resolvePermissionGroup: (ref: ApiTokenPermissionGroupRef) => {
+    id: string;
+    meta?: undefined;
+} | {
+    id: string;
+    meta: {
+        key?: string;
+        value?: string;
+    };
+};
+/**
+ * Rewrite the bare `"com.cloudflare.api.account"` key to the
+ * account-scoped form. Pass `accountId: undefined` to leave keys unchanged
+ * (e.g. for user-owned tokens whose policies don't carry an account scope).
+ */
+export declare const resolveResources: (resources: ApiTokenPolicy["resources"], accountId: string | undefined) => Record<string, string>;
+export declare const resolvePolicies: (policies: ApiTokenPolicy[], accountId: string | undefined) => ResolvedPolicy[];
+export declare const policyFingerprint: (policies: ResolvedPolicy[]) => string;
+export declare const conditionFingerprint: (condition: ApiTokenCondition | undefined) => string;
+export declare const buildConditionPayload: (condition: ApiTokenCondition | undefined) => {
+    requestIp: {
+        in: string[] | undefined;
+        notIn: string[] | undefined;
+    } | undefined;
+} | undefined;
+//# sourceMappingURL=Common.d.ts.map

package/lib/Cloudflare/ApiToken/Common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Common.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/Common.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAC3B,4BAA4B,GAC5B,8BAA8B,MAAM,EAAE,GACtC,mCAAmC,MAAM,EAAE,GAC3C,iCAAiC,MAAM,EAAE,GACzC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAClC,mBAAmB,GACnB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,gBAAgB,EAAE,0BAA0B,EAAE,CAAC;IAC/C,SAAS,EAAE;SAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC,EAAE,MAAM;KAAE,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE;QACV,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;CACH;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,gBAAgB,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC;IAC5E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAI,KAAK,0BAA0B;;;;;;cAxCrC,MAAM;gBAAU,MAAM;;CAqDtD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAC3B,WAAW,cAAc,CAAC,WAAW,CAAC,EACtC,WAAW,MAAM,GAAG,SAAS,KAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAWvB,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,UAAU,cAAc,EAAE,EAC1B,WAAW,MAAM,GAAG,SAAS,KAC5B,cAAc,EAKZ,CAAC;AAEN,eAAO,MAAM,iBAAiB,GAAI,UAAU,cAAc,EAAE,KAAG,MAW5D,CAAC;AAEJ,eAAO,MAAM,oBAAoB,GAC/B,WAAW,iBAAiB,GAAG,SAAS,KACvC,MAIC,CAAC;AAEL,eAAO,MAAM,qBAAqB,GAChC,WAAW,iBAAiB,GAAG,SAAS;;;;;aAW3B,CAAC"}

package/lib/Cloudflare/ApiToken/Common.js

@@ -0,0 +1,61 @@
+import { PERMISSION_GROUPS_BY_NAME, } from "./PermissionGroups.js";
+export const resolvePermissionGroup = (ref) => {
+    if (typeof ref === "string") {
+        const group = PERMISSION_GROUPS_BY_NAME[ref];
+        if (!group) {
+            // Should be unreachable due to the typed union, but guard anyway in
+            // case Cloudflare retires a name we still have in the catalog.
+            throw new Error(`Unknown Cloudflare permission group: "${ref}". Pass an explicit { id } instead.`);
+        }
+        return { id: group.id };
+    }
+    return ref.meta ? { id: ref.id, meta: ref.meta } : { id: ref.id };
+};
+/**
+ * Rewrite the bare `"com.cloudflare.api.account"` key to the
+ * account-scoped form. Pass `accountId: undefined` to leave keys unchanged
+ * (e.g. for user-owned tokens whose policies don't carry an account scope).
+ */
+export const resolveResources = (resources, accountId) => {
+    const out = {};
+    for (const [key, value] of Object.entries(resources)) {
+        if (value === undefined)
+            continue;
+        if (key === "com.cloudflare.api.account" && accountId) {
+            out[`com.cloudflare.api.account.${accountId}`] = value;
+        }
+        else {
+            out[key] = value;
+        }
+    }
+    return out;
+};
+export const resolvePolicies = (policies, accountId) => policies.map((policy) => ({
+    effect: policy.effect,
+    permissionGroups: policy.permissionGroups.map(resolvePermissionGroup),
+    resources: resolveResources(policy.resources, accountId),
+}));
+export const policyFingerprint = (policies) => JSON.stringify(policies.map((p) => ({
+    effect: p.effect,
+    permissionGroups: [...p.permissionGroups]
+        .map((g) => ({ id: g.id, meta: g.meta ?? null }))
+        .sort((a, b) => a.id.localeCompare(b.id)),
+    resources: Object.keys(p.resources)
+        .sort()
+        .map((k) => [k, p.resources[k]]),
+})));
+export const conditionFingerprint = (condition) => JSON.stringify({
+    in: [...(condition?.requestIp?.in ?? [])].sort(),
+    notIn: [...(condition?.requestIp?.notIn ?? [])].sort(),
+});
+export const buildConditionPayload = (condition) => condition
+    ? {
+        requestIp: condition.requestIp
+            ? {
+                in: condition.requestIp.in,
+                notIn: condition.requestIp.notIn,
+            }
+            : undefined,
+    }
+    : undefined;
+//# sourceMappingURL=Common.js.map

package/lib/Cloudflare/ApiToken/Common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Common.js","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/Common.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAE1B,MAAM,uBAAuB,CAAC;AAiE/B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAA+B,EAAE,EAAE;IACxE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,IAAI,KAAK,CACb,yCAAyC,GAAG,qCAAqC,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;AACpE,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,SAAsC,EACtC,SAA6B,EACL,EAAE;IAC1B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,GAAG,KAAK,4BAA4B,IAAI,SAAS,EAAE,CAAC;YACtD,GAAG,CAAC,8BAA8B,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAA0B,EAC1B,SAA6B,EACX,EAAE,CACpB,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACrE,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC;CACzD,CAAC,CAAC,CAAC;AAEN,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAA0B,EAAU,EAAE,CACtE,IAAI,CAAC,SAAS,CACZ,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;SAChD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;SAChC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC,CACJ,CAAC;AAEJ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,SAAwC,EAChC,EAAE,CACV,IAAI,CAAC,SAAS,CAAC;IACb,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IAChD,KAAK,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;CACvD,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,SAAwC,EACxC,EAAE,CACF,SAAS;IACP,CAAC,CAAC;QACE,SAAS,EAAE,SAAS,CAAC,SAAS;YAC5B,CAAC,CAAC;gBACE,EAAE,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE;gBAC1B,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,KAAK;aACjC;YACH,CAAC,CAAC,SAAS;KACd;IACH,CAAC,CAAC,SAAS,CAAC"}