alchemy 2.0.0-beta.47 → 2.0.0-beta.48

package/lib/Cloudflare/ApiToken/AccountApiToken.d.ts

@@ -3,7 +3,7 @@ import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Providers } from "../Providers.ts";
-import { type ApiTokenProps } from "./Common.ts";
+import { type ApiTokenBinding, type ApiTokenProps } from "./Common.ts";
 export type AccountApiToken = Resource<"Cloudflare.AccountApiToken", ApiTokenProps, {
     tokenId: string;
     name: string;
@@ -15,7 +15,7 @@ export type AccountApiToken = Resource<"Cloudflare.AccountApiToken", ApiTokenPro
      */
     value: Redacted.Redacted<string>;
     accountId: string;
-}, never, Providers>;
+}, ApiTokenBinding, Providers>;
 /**
  * A Cloudflare account-owned API token (`POST /accounts/{account_id}/tokens`).
  *
@@ -52,6 +52,44 @@ export type AccountApiToken = Resource<"Cloudflare.AccountApiToken", ApiTokenPro
  *   value: token.value,
  * });
  * ```
+ *
+ * @section Attaching Policies via Bindings
+ * @example Let a downstream capability contribute its own policies
+ * A token can be created with no `policies` of its own; the policies are
+ * supplied through its binding contract (see {@link ApiTokenBinding}). This is
+ * how capabilities like {@link CreateTunnel} provision a least-privilege token.
+ * ```typescript
+ * const token = yield* Cloudflare.AccountApiToken("scoped-token");
+ *
+ * yield* token.bind("MyCapability", {
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: ["Cloudflare Tunnel Write"],
+ *       resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+ *     },
+ *   ],
+ * });
+ * ```
+ *
+ * @section Exposing a Token to a Worker
+ * @example Read the token value at runtime
+ * Bind the token's outputs in the Worker's Init phase to get runtime
+ * accessors. Binding `token.value` injects it as a `secret_text` Worker
+ * binding; the returned accessor reads it back (as `Redacted`) at runtime.
+ * ```typescript
+ * // init
+ * const value = yield* token.value; // Accessor<Redacted<string>>
+ * const accountId = yield* token.accountId; // Accessor<string>
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const apiToken = yield* value; // Redacted<string>
+ *     // ... call the Cloudflare API with `apiToken`
+ *     return HttpServerResponse.text("ok");
+ *   }),
+ * };
+ * ```
  */
 export declare const AccountApiToken: import("../../Resource.ts").ResourceClass<AccountApiToken>;
 export declare const AccountApiTokenProvider: () => import("effect/Layer").Layer<Provider.Provider<AccountApiToken>, never, import("effect/unstable/http/HttpClient").HttpClient | import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("@distilled.cloud/cloudflare").Credentials | CloudflareEnvironment>;

package/lib/Cloudflare/ApiToken/AccountApiToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccountApiToken.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/AccountApiToken.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,eAAe,GAAG,QAAQ,CACpC,4BAA4B,EAC5B,aAAa,EACb;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB,EACD,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,eAAe,4DAE3B,CAAC;AASF,eAAO,MAAM,uBAAuB,mRAiJjC,CAAC"}
+{"version":3,"file":"AccountApiToken.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/AccountApiToken.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,eAAe,GAAG,QAAQ,CACpC,4BAA4B,EAC5B,aAAa,EACb;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB,EACD,eAAe,EACf,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AACH,eAAO,MAAM,eAAe,4DAE3B,CAAC;AASF,eAAO,MAAM,uBAAuB,mRA8JjC,CAAC"}

package/lib/Cloudflare/ApiToken/AccountApiToken.js

@@ -6,7 +6,7 @@ import { createPhysicalName } from "../../PhysicalName.js";
 import * as Provider from "../../Provider.js";
 import { Resource } from "../../Resource.js";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
-import { buildConditionPayload, conditionFingerprint, policyFingerprint, resolvePolicies, } from "./Common.js";
+import { buildConditionPayload, collectPolicies, conditionFingerprint, policyFingerprint, resolvePolicies, } from "./Common.js";
 /**
  * A Cloudflare account-owned API token (`POST /accounts/{account_id}/tokens`).
  *
@@ -43,6 +43,44 @@ import { buildConditionPayload, conditionFingerprint, policyFingerprint, resolve
  *   value: token.value,
  * });
  * ```
+ *
+ * @section Attaching Policies via Bindings
+ * @example Let a downstream capability contribute its own policies
+ * A token can be created with no `policies` of its own; the policies are
+ * supplied through its binding contract (see {@link ApiTokenBinding}). This is
+ * how capabilities like {@link CreateTunnel} provision a least-privilege token.
+ * ```typescript
+ * const token = yield* Cloudflare.AccountApiToken("scoped-token");
+ *
+ * yield* token.bind("MyCapability", {
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: ["Cloudflare Tunnel Write"],
+ *       resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+ *     },
+ *   ],
+ * });
+ * ```
+ *
+ * @section Exposing a Token to a Worker
+ * @example Read the token value at runtime
+ * Bind the token's outputs in the Worker's Init phase to get runtime
+ * accessors. Binding `token.value` injects it as a `secret_text` Worker
+ * binding; the returned accessor reads it back (as `Redacted`) at runtime.
+ * ```typescript
+ * // init
+ * const value = yield* token.value; // Accessor<Redacted<string>>
+ * const accountId = yield* token.accountId; // Accessor<string>
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const apiToken = yield* value; // Redacted<string>
+ *     // ... call the Cloudflare API with `apiToken`
+ *     return HttpServerResponse.text("ok");
+ *   }),
+ * };
+ * ```
  */
 export const AccountApiToken = Resource("Cloudflare.AccountApiToken");
 const resolveName = (id, name) => Effect.gen(function* () {
@@ -57,13 +95,13 @@ export const AccountApiTokenProvider = () => Provider.effect(AccountApiToken, Ef
     const buildAttributes = (tokenData, value, accountId) => ({
         tokenId: tokenData.id ?? "",
         name: tokenData.name ?? "",
-        status: tokenData.status ?? "active",
+        status: (tokenData.status ?? "active"),
         value,
         accountId,
     });
     return {
         stables: ["tokenId", "accountId"],
-        diff: Effect.fn(function* ({ id, olds, news, output }) {
+        diff: Effect.fn(function* ({ id, olds, news = {}, output }) {
             if (!isResolved(news))
                 return undefined;
             const newAccountId = news.accountId ?? defaultAccountId;
@@ -74,7 +112,7 @@ export const AccountApiTokenProvider = () => Provider.effect(AccountApiToken, Ef
             const oldName = output?.name ?? (yield* resolveName(id, olds?.name));
             const newName = yield* resolveName(id, news.name);
             const oldPolicyFp = policyFingerprint(resolvePolicies(olds?.policies ?? []));
-            const newPolicyFp = policyFingerprint(resolvePolicies(news.policies));
+            const newPolicyFp = policyFingerprint(resolvePolicies(news.policies ?? []));
             const oldCondFp = conditionFingerprint(olds?.condition);
             const newCondFp = conditionFingerprint(news.condition);
             if (oldName !== newName ||
@@ -85,10 +123,15 @@ export const AccountApiTokenProvider = () => Provider.effect(AccountApiToken, Ef
                 return { action: "update" };
             }
         }),
-        reconcile: Effect.fn(function* ({ id, news, output }) {
+        reconcile: Effect.fn(function* ({ id, news = {}, output, bindings }) {
             const accountId = news.accountId ?? defaultAccountId;
             const name = yield* resolveName(id, news.name);
-            const policies = resolvePolicies(news.policies);
+            const collected = collectPolicies(news.policies, bindings);
+            if (collected.length === 0) {
+                return yield* Effect.die(`Cloudflare requires at least one policy on token "${name}". ` +
+                    "Pass `policies` or attach them via a binding.");
+            }
+            const policies = resolvePolicies(collected);
             // Observe — fetch current state if we already know the token id.
             // Cloudflare reports a deleted token as `InvalidRoute` or
             // `TokenNotFound`; both mean "create from scratch".

package/lib/Cloudflare/ApiToken/AccountApiToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"AccountApiToken.js","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/AccountApiToken.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,sCAAsC,CAAC;AACjE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,GAEhB,MAAM,aAAa,CAAC;AAqBrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CACrC,4BAA4B,CAC7B,CAAC;AAIF,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC3D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,EAAE,CAC1C,QAAQ,CAAC,MAAM,CACb,eAAe,EACf,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAE1C,MAAM,eAAe,GAAG,CACtB,SAIC,EACD,KAAgC,EAChC,SAAiB,EACU,EAAE,CAAC,CAAC;QAC/B,OAAO,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE;QAC3B,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE;QAC1B,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,QAAQ;QACpC,KAAK;QACL,SAAS;KACV,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC;QACjC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;YACnD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;YACxD,MAAM,YAAY,GAChB,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,SAAS,IAAI,gBAAgB,CAAC;YAC3D,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;gBAClC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,iBAAiB,CACnC,eAAe,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CACtC,CAAC;YACF,MAAM,WAAW,GAAG,iBAAiB,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtE,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvD,IACE,OAAO,KAAK,OAAO;gBACnB,WAAW,KAAK,WAAW;gBAC3B,SAAS,KAAK,SAAS;gBACvB,CAAC,IAAI,EAAE,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;gBAChE,CAAC,IAAI,EAAE,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,EAChE,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAW,CAAC;YACvC,CAAC;QACH,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAClD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;YACrD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEhD,iEAAiE;YACjE,0DAA0D;YAC1D,oDAAoD;YACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,OAAO;gBAC9B,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;oBACd,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAC5B,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CACnC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,EACD,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CACpC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF;gBACH,CAAC,CAAC,SAAS,CAAC;YAEd,+DAA+D;YAC/D,gEAAgE;YAChE,+DAA+D;YAC/D,gEAAgE;YAChE,8CAA8C;YAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;oBAChC,SAAS;oBACT,IAAI;oBACJ,QAAQ;oBACR,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;oBAChD,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,gDAAgD,IAAI,IAAI,CACzD,CAAC;gBACJ,CAAC;gBACD,OAAO,eAAe,CACpB,MAAM,EACN,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAC3B,SAAS,CACV,CAAC;YACJ,CAAC;YAED,2DAA2D;YAC3D,6DAA6D;YAC7D,+DAA+D;YAC/D,wBAAwB;YACxB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;gBAChC,SAAS;gBACT,OAAO,EAAE,MAAO,CAAC,OAAO;gBACxB,IAAI;gBACJ,QAAQ;gBACR,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;gBAChD,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;YACH,OAAO,eAAe,CAAC,MAAM,EAAE,MAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,WAAW,CAAC;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC,IAAI;YACL,yDAAyD;YACzD,4DAA4D;YAC5D,mEAAmE;YACnE,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAClD,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACpD,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACnC,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAE,OAAO,SAAS,CAAC;YACvC,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CACvD,EACD,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAChE,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAClE,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}
+{"version":3,"file":"AccountApiToken.js","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/AccountApiToken.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,sCAAsC,CAAC;AACjE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,GAGhB,MAAM,aAAa,CAAC;AAqBrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CACrC,4BAA4B,CAC7B,CAAC;AAIF,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC3D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,EAAE,CAC1C,QAAQ,CAAC,MAAM,CACb,eAAe,EACf,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAE1C,MAAM,eAAe,GAAG,CACtB,SAKC,EACD,KAAgC,EAChC,SAAiB,EACU,EAAE,CAAC,CAAC;QAC/B,OAAO,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE;QAC3B,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE;QAC1B,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,IAAI,QAAQ,CAGxB;QACb,KAAK;QACL,SAAS;KACV,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC;QACjC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE;YACxD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;YACxD,MAAM,YAAY,GAChB,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,SAAS,IAAI,gBAAgB,CAAC;YAC3D,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;gBAClC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,iBAAiB,CACnC,eAAe,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CACtC,CAAC;YACF,MAAM,WAAW,GAAG,iBAAiB,CACnC,eAAe,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CACrC,CAAC;YACF,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvD,IACE,OAAO,KAAK,OAAO;gBACnB,WAAW,KAAK,WAAW;gBAC3B,SAAS,KAAK,SAAS;gBACvB,CAAC,IAAI,EAAE,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;gBAChE,CAAC,IAAI,EAAE,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,EAChE,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAW,CAAC;YACvC,CAAC;QACH,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;YACjE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;YACrD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC3D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,qDAAqD,IAAI,KAAK;oBAC5D,+CAA+C,CAClD,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;YAE5C,iEAAiE;YACjE,0DAA0D;YAC1D,oDAAoD;YACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,OAAO;gBAC9B,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;oBACd,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAC5B,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CACnC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,EACD,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CACpC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF;gBACH,CAAC,CAAC,SAAS,CAAC;YAEd,+DAA+D;YAC/D,gEAAgE;YAChE,+DAA+D;YAC/D,gEAAgE;YAChE,8CAA8C;YAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;oBAChC,SAAS;oBACT,IAAI;oBACJ,QAAQ;oBACR,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;oBAChD,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,gDAAgD,IAAI,IAAI,CACzD,CAAC;gBACJ,CAAC;gBACD,OAAO,eAAe,CACpB,MAAM,EACN,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAC3B,SAAS,CACV,CAAC;YACJ,CAAC;YAED,2DAA2D;YAC3D,6DAA6D;YAC7D,+DAA+D;YAC/D,wBAAwB;YACxB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;gBAChC,SAAS;gBACT,OAAO,EAAE,MAAO,CAAC,OAAO;gBACxB,IAAI;gBACJ,QAAQ;gBACR,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;gBAChD,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;YACH,OAAO,eAAe,CAAC,MAAM,EAAE,MAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,WAAW,CAAC;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC,IAAI;YACL,yDAAyD;YACzD,4DAA4D;YAC5D,mEAAmE;YACnE,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAClD,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACpD,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACnC,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAE,OAAO,SAAS,CAAC;YACvC,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CACvD,EACD,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAChE,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAClE,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Cloudflare/ApiToken/Common.d.ts

@@ -46,10 +46,11 @@ export type ApiTokenProps = {
      */
     accountId?: string;
     /**
-     * Access policies attached to the token. At least one policy is required
-     * by Cloudflare.
+     * Access policies attached to the token. Cloudflare requires at least one
+     * policy on a token; if you omit `policies` here, the policies must instead
+     * be contributed by bindings (see {@link ApiTokenBinding}).
      */
-    policies: ApiTokenPolicy[];
+    policies?: ApiTokenPolicy[];
     /** ISO 8601 expiration timestamp. */
     expiresOn?: string;
     /** ISO 8601 "not before" timestamp. */
@@ -57,6 +58,28 @@ export type ApiTokenProps = {
     /** Optional usage conditions (e.g. IP allowlist). */
     condition?: ApiTokenCondition;
 };
+/**
+ * Binding contract for {@link AccountApiToken} / {@link UserApiToken}.
+ *
+ * A binding contributes additional access policies to the token. This lets a
+ * downstream resource (e.g. a runtime capability that needs to call a specific
+ * Cloudflare API) create a token and attach exactly the policies it requires,
+ * without the token's owner having to enumerate them up front.
+ *
+ * Binding-contributed policies are merged with any `policies` passed directly
+ * as props; the union must contain at least one policy.
+ */
+export type ApiTokenBinding = {
+    /** Access policies to attach to the token. */
+    policies?: ApiTokenPolicy[];
+};
+/**
+ * Collect the policies a token should be created with: those passed directly
+ * as props, plus those contributed by bindings.
+ */
+export declare const collectPolicies: (props: ApiTokenPolicy[] | undefined, bindings: {
+    data: ApiTokenBinding;
+}[]) => ApiTokenPolicy[];
 export type ResolvedPolicy = {
     effect: "allow" | "deny";
     permissionGroups: {

package/lib/Cloudflare/ApiToken/Common.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Common.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/Common.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAC3B,8BAA8B,MAAM,EAAE,GACtC,mCAAmC,MAAM,EAAE,GAC3C,iCAAiC,MAAM,EAAE,GACzC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAClC,mBAAmB,GACnB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,gBAAgB,EAAE,0BAA0B,EAAE,CAAC;IAC/C,SAAS,EAAE;SAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC,EAAE,MAAM;KAAE,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE;QACV,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;CACH;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,gBAAgB,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC;IAC5E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAI,KAAK,0BAA0B;;;;;;cA7CrC,MAAM;gBAAU,MAAM;;CA0DtD,CAAC;AAaF,eAAO,MAAM,eAAe,GAAI,UAAU,cAAc,EAAE,KAAG,cAAc,EAKtE,CAAC;AAEN,eAAO,MAAM,iBAAiB,GAAI,UAAU,cAAc,EAAE,KAAG,MAW5D,CAAC;AAEJ,eAAO,MAAM,oBAAoB,GAC/B,WAAW,iBAAiB,GAAG,SAAS,KACvC,MAIC,CAAC;AAEL,eAAO,MAAM,qBAAqB,GAChC,WAAW,iBAAiB,GAAG,SAAS;;;;;aAW3B,CAAC"}
+{"version":3,"file":"Common.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/Common.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAC3B,8BAA8B,MAAM,EAAE,GACtC,mCAAmC,MAAM,EAAE,GAC3C,iCAAiC,MAAM,EAAE,GACzC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAClC,mBAAmB,GACnB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,gBAAgB,EAAE,0BAA0B,EAAE,CAAC;IAC/C,SAAS,EAAE;SAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC,EAAE,MAAM;KAAE,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE;QACV,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;CACH;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO,cAAc,EAAE,GAAG,SAAS,EACnC,UAAU;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,EAAE,KACpC,cAAc,EAGhB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,gBAAgB,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC;IAC5E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAI,KAAK,0BAA0B;;;;;;cA1ErC,MAAM;gBAAU,MAAM;;CAuFtD,CAAC;AAaF,eAAO,MAAM,eAAe,GAAI,UAAU,cAAc,EAAE,KAAG,cAAc,EAKtE,CAAC;AAEN,eAAO,MAAM,iBAAiB,GAAI,UAAU,cAAc,EAAE,KAAG,MAW5D,CAAC;AAEJ,eAAO,MAAM,oBAAoB,GAC/B,WAAW,iBAAiB,GAAG,SAAS,KACvC,MAIC,CAAC;AAEL,eAAO,MAAM,qBAAqB,GAChC,WAAW,iBAAiB,GAAG,SAAS;;;;;aAW3B,CAAC"}

package/lib/Cloudflare/ApiToken/Common.js

@@ -1,4 +1,12 @@
 import { PERMISSION_GROUPS_BY_NAME, } from "./PermissionGroups.js";
+/**
+ * Collect the policies a token should be created with: those passed directly
+ * as props, plus those contributed by bindings.
+ */
+export const collectPolicies = (props, bindings) => [
+    ...(props ?? []),
+    ...bindings.flatMap((binding) => binding.data.policies ?? []),
+];
 export const resolvePermissionGroup = (ref) => {
     if (typeof ref === "string") {
         const group = PERMISSION_GROUPS_BY_NAME[ref];

package/lib/Cloudflare/ApiToken/Common.js.map

@@ -1 +1 @@
-{"version":3,"file":"Common.js","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/Common.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAE1B,MAAM,uBAAuB,CAAC;AAqE/B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAA+B,EAAE,EAAE;IACxE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,IAAI,KAAK,CACb,yCAAyC,GAAG,qCAAqC,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,SAAsC,EACd,EAAE;IAC1B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAA0B,EAAoB,EAAE,CAC9E,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACrE,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC;CAC9C,CAAC,CAAC,CAAC;AAEN,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAA0B,EAAU,EAAE,CACtE,IAAI,CAAC,SAAS,CACZ,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;SAChD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;SAChC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC,CACJ,CAAC;AAEJ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,SAAwC,EAChC,EAAE,CACV,IAAI,CAAC,SAAS,CAAC;IACb,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IAChD,KAAK,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;CACvD,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,SAAwC,EACxC,EAAE,CACF,SAAS;IACP,CAAC,CAAC;QACE,SAAS,EAAE,SAAS,CAAC,SAAS;YAC5B,CAAC,CAAC;gBACE,EAAE,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE;gBAC1B,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,KAAK;aACjC;YACH,CAAC,CAAC,SAAS;KACd;IACH,CAAC,CAAC,SAAS,CAAC"}
+{"version":3,"file":"Common.js","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/Common.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAE1B,MAAM,uBAAuB,CAAC;AAgF/B;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,KAAmC,EACnC,QAAqC,EACnB,EAAE,CAAC;IACrB,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;IAChB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;CAC9D,CAAC;AAQF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAA+B,EAAE,EAAE;IACxE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,IAAI,KAAK,CACb,yCAAyC,GAAG,qCAAqC,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,SAAsC,EACd,EAAE;IAC1B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAA0B,EAAoB,EAAE,CAC9E,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACrE,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC;CAC9C,CAAC,CAAC,CAAC;AAEN,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAA0B,EAAU,EAAE,CACtE,IAAI,CAAC,SAAS,CACZ,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;SAChD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;SAChC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC,CACJ,CAAC;AAEJ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,SAAwC,EAChC,EAAE,CACV,IAAI,CAAC,SAAS,CAAC;IACb,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IAChD,KAAK,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;CACvD,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,SAAwC,EACxC,EAAE,CACF,SAAS;IACP,CAAC,CAAC;QACE,SAAS,EAAE,SAAS,CAAC,SAAS;YAC5B,CAAC,CAAC;gBACE,EAAE,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE;gBAC1B,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,KAAK;aACjC;YACH,CAAC,CAAC,SAAS;KACd;IACH,CAAC,CAAC,SAAS,CAAC"}

package/lib/Cloudflare/ApiToken/UserApiToken.d.ts

@@ -2,7 +2,7 @@ import * as Redacted from "effect/Redacted";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import type { Providers } from "../Providers.ts";
-import { type ApiTokenProps } from "./Common.ts";
+import { type ApiTokenBinding, type ApiTokenProps } from "./Common.ts";
 export type UserApiToken = Resource<"Cloudflare.UserApiToken", ApiTokenProps, {
     tokenId: string;
     name: string;
@@ -12,7 +12,7 @@ export type UserApiToken = Resource<"Cloudflare.UserApiToken", ApiTokenProps, {
      * creation, so we persist it here for downstream consumers.
      */
     value: Redacted.Redacted<string>;
-}, never, Providers>;
+}, ApiTokenBinding, Providers>;
 /**
  * A Cloudflare user-owned API token (`POST /user/tokens`).
  *
@@ -42,6 +42,42 @@ export type UserApiToken = Resource<"Cloudflare.UserApiToken", ApiTokenProps, {
  *   ],
  * });
  * ```
+ *
+ * @section Attaching Policies via Bindings
+ * @example Let a downstream capability contribute its own policies
+ * A token can be created with no `policies` of its own; the policies are
+ * supplied through its binding contract (see {@link ApiTokenBinding}).
+ * ```typescript
+ * const token = yield* Cloudflare.UserApiToken("scoped-token");
+ *
+ * yield* token.bind("MyCapability", {
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: ["Workers Scripts Read"],
+ *       resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+ *     },
+ *   ],
+ * });
+ * ```
+ *
+ * @section Exposing a Token to a Worker
+ * @example Read the token value at runtime
+ * Bind the token's value output in the Worker's Init phase to get a runtime
+ * accessor. Binding it injects a `secret_text` Worker binding; the returned
+ * accessor reads it back (as `Redacted`) at runtime.
+ * ```typescript
+ * // init
+ * const value = yield* token.value; // Accessor<Redacted<string>>
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const apiToken = yield* value; // Redacted<string>
+ *     // ... call the Cloudflare API with `apiToken`
+ *     return HttpServerResponse.text("ok");
+ *   }),
+ * };
+ * ```
  */
 export declare const UserApiToken: import("../../Resource.ts").ResourceClass<UserApiToken>;
 export declare const UserApiTokenProvider: () => import("effect/Layer").Layer<Provider.Provider<UserApiToken>, never, import("effect/unstable/http/HttpClient").HttpClient | import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("@distilled.cloud/cloudflare").Credentials>;

package/lib/Cloudflare/ApiToken/UserApiToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserApiToken.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/UserApiToken.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,YAAY,GAAG,QAAQ,CACjC,yBAAyB,EACzB,aAAa,EACb;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IAC1C;;;OAGG;IACH,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CAClC,EACD,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,YAAY,yDAAoD,CAAC;AAS9E,eAAO,MAAM,oBAAoB,wPA4G9B,CAAC"}
+{"version":3,"file":"UserApiToken.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/UserApiToken.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,YAAY,GAAG,QAAQ,CACjC,yBAAyB,EACzB,aAAa,EACb;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IAC1C;;;OAGG;IACH,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CAClC,EACD,eAAe,EACf,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,eAAO,MAAM,YAAY,yDAAoD,CAAC;AAS9E,eAAO,MAAM,oBAAoB,wPAyH9B,CAAC"}

package/lib/Cloudflare/ApiToken/UserApiToken.js

@@ -5,7 +5,7 @@ import { isResolved } from "../../Diff.js";
 import { createPhysicalName } from "../../PhysicalName.js";
 import * as Provider from "../../Provider.js";
 import { Resource } from "../../Resource.js";
-import { buildConditionPayload, conditionFingerprint, policyFingerprint, resolvePolicies, } from "./Common.js";
+import { buildConditionPayload, collectPolicies, conditionFingerprint, policyFingerprint, resolvePolicies, } from "./Common.js";
 /**
  * A Cloudflare user-owned API token (`POST /user/tokens`).
  *
@@ -35,6 +35,42 @@ import { buildConditionPayload, conditionFingerprint, policyFingerprint, resolve
  *   ],
  * });
  * ```
+ *
+ * @section Attaching Policies via Bindings
+ * @example Let a downstream capability contribute its own policies
+ * A token can be created with no `policies` of its own; the policies are
+ * supplied through its binding contract (see {@link ApiTokenBinding}).
+ * ```typescript
+ * const token = yield* Cloudflare.UserApiToken("scoped-token");
+ *
+ * yield* token.bind("MyCapability", {
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: ["Workers Scripts Read"],
+ *       resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+ *     },
+ *   ],
+ * });
+ * ```
+ *
+ * @section Exposing a Token to a Worker
+ * @example Read the token value at runtime
+ * Bind the token's value output in the Worker's Init phase to get a runtime
+ * accessor. Binding it injects a `secret_text` Worker binding; the returned
+ * accessor reads it back (as `Redacted`) at runtime.
+ * ```typescript
+ * // init
+ * const value = yield* token.value; // Accessor<Redacted<string>>
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const apiToken = yield* value; // Redacted<string>
+ *     // ... call the Cloudflare API with `apiToken`
+ *     return HttpServerResponse.text("ok");
+ *   }),
+ * };
+ * ```
  */
 export const UserApiToken = Resource("Cloudflare.UserApiToken");
 const resolveName = (id, name) => Effect.gen(function* () {
@@ -48,18 +84,18 @@ export const UserApiTokenProvider = () => Provider.effect(UserApiToken, Effect.g
     const buildAttributes = (tokenData, value) => ({
         tokenId: tokenData.id ?? "",
         name: tokenData.name ?? "",
-        status: tokenData.status ?? "active",
+        status: (tokenData.status ?? "active"),
         value,
     });
     return {
         stables: ["tokenId"],
-        diff: Effect.fn(function* ({ id, olds, news, output }) {
+        diff: Effect.fn(function* ({ id, olds, news = {}, output }) {
             if (!isResolved(news))
                 return undefined;
             const oldName = output?.name ?? (yield* resolveName(id, olds?.name));
             const newName = yield* resolveName(id, news.name);
             const oldPolicyFp = policyFingerprint(resolvePolicies(olds?.policies ?? []));
-            const newPolicyFp = policyFingerprint(resolvePolicies(news.policies));
+            const newPolicyFp = policyFingerprint(resolvePolicies(news.policies ?? []));
             const oldCondFp = conditionFingerprint(olds?.condition);
             const newCondFp = conditionFingerprint(news.condition);
             if (oldName !== newName ||
@@ -70,9 +106,14 @@ export const UserApiTokenProvider = () => Provider.effect(UserApiToken, Effect.g
                 return { action: "update" };
             }
         }),
-        reconcile: Effect.fn(function* ({ id, news, output }) {
+        reconcile: Effect.fn(function* ({ id, news = {}, output, bindings }) {
             const name = yield* resolveName(id, news.name);
-            const policies = resolvePolicies(news.policies);
+            const collected = collectPolicies(news.policies, bindings);
+            if (collected.length === 0) {
+                return yield* Effect.die(`Cloudflare requires at least one policy on token "${name}". ` +
+                    "Pass `policies` or attach them via a binding.");
+            }
+            const policies = resolvePolicies(collected);
             // Observe — fetch current state if we know the token id;
             // Cloudflare reports a deleted token as `TokenNotFound`, which
             // we treat as "create from scratch".

package/lib/Cloudflare/ApiToken/UserApiToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserApiToken.js","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/UserApiToken.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,kCAAkC,CAAC;AACzD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,GAEhB,MAAM,aAAa,CAAC;AAmBrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAe,yBAAyB,CAAC,CAAC;AAI9E,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC3D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,EAAE,CACvC,QAAQ,CAAC,MAAM,CACb,YAAY,EACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAEtC,MAAM,eAAe,GAAG,CACtB,SAIC,EACD,KAAgC,EACR,EAAE,CAAC,CAAC;QAC5B,OAAO,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE;QAC3B,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE;QAC1B,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,QAAQ;QACpC,KAAK;KACN,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,SAAS,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;YACnD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,iBAAiB,CACnC,eAAe,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CACtC,CAAC;YACF,MAAM,WAAW,GAAG,iBAAiB,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtE,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvD,IACE,OAAO,KAAK,OAAO;gBACnB,WAAW,KAAK,WAAW;gBAC3B,SAAS,KAAK,SAAS;gBACvB,CAAC,IAAI,EAAE,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;gBAChE,CAAC,IAAI,EAAE,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,EAChE,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAW,CAAC;YACvC,CAAC;QACH,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAClD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEhD,yDAAyD;YACzD,+DAA+D;YAC/D,qCAAqC;YACrC,MAAM,QAAQ,GAAG,MAAM,EAAE,OAAO;gBAC9B,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAC5B,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CACpC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF;gBACH,CAAC,CAAC,SAAS,CAAC;YAEd,+DAA+D;YAC/D,6DAA6D;YAC7D,gEAAgE;YAChE,2BAA2B;YAC3B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;oBAChC,IAAI;oBACJ,QAAQ;oBACR,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;oBAChD,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,gDAAgD,IAAI,IAAI,CACzD,CAAC;gBACJ,CAAC;gBACD,OAAO,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9D,CAAC;YAED,gEAAgE;YAChE,6DAA6D;YAC7D,gCAAgC;YAChC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;gBAChC,OAAO,EAAE,MAAO,CAAC,OAAO;gBACxB,IAAI;gBACJ,QAAQ;gBACR,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;gBAChD,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;YACH,OAAO,eAAe,CAAC,MAAM,EAAE,MAAO,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAClD,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACpD,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACnC,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAE,OAAO,SAAS,CAAC;YACvC,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CACtD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAC3D,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAClE,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}
+{"version":3,"file":"UserApiToken.js","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/UserApiToken.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,kCAAkC,CAAC;AACzD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,GAGhB,MAAM,aAAa,CAAC;AAmBrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAe,yBAAyB,CAAC,CAAC;AAI9E,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC3D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,EAAE,CACvC,QAAQ,CAAC,MAAM,CACb,YAAY,EACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAEtC,MAAM,eAAe,GAAG,CACtB,SAKC,EACD,KAAgC,EACR,EAAE,CAAC,CAAC;QAC5B,OAAO,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE;QAC3B,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE;QAC1B,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,IAAI,QAAQ,CAGxB;QACb,KAAK;KACN,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,SAAS,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE;YACxD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,iBAAiB,CACnC,eAAe,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CACtC,CAAC;YACF,MAAM,WAAW,GAAG,iBAAiB,CACnC,eAAe,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CACrC,CAAC;YACF,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvD,IACE,OAAO,KAAK,OAAO;gBACnB,WAAW,KAAK,WAAW;gBAC3B,SAAS,KAAK,SAAS;gBACvB,CAAC,IAAI,EAAE,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;gBAChE,CAAC,IAAI,EAAE,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,EAChE,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAW,CAAC;YACvC,CAAC;QACH,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;YACjE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC3D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,qDAAqD,IAAI,KAAK;oBAC5D,+CAA+C,CAClD,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;YAE5C,yDAAyD;YACzD,+DAA+D;YAC/D,qCAAqC;YACrC,MAAM,QAAQ,GAAG,MAAM,EAAE,OAAO;gBAC9B,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAC5B,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CACpC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF;gBACH,CAAC,CAAC,SAAS,CAAC;YAEd,+DAA+D;YAC/D,6DAA6D;YAC7D,gEAAgE;YAChE,2BAA2B;YAC3B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;oBAChC,IAAI;oBACJ,QAAQ;oBACR,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;oBAChD,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,gDAAgD,IAAI,IAAI,CACzD,CAAC;gBACJ,CAAC;gBACD,OAAO,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9D,CAAC;YAED,gEAAgE;YAChE,6DAA6D;YAC7D,gCAAgC;YAChC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;gBAChC,OAAO,EAAE,MAAO,CAAC,OAAO;gBACxB,IAAI;gBACJ,QAAQ;gBACR,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;gBAChD,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;YACH,OAAO,eAAe,CAAC,MAAM,EAAE,MAAO,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAClD,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACpD,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACnC,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAE,OAAO,SAAS,CAAC;YACvC,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CACtD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAC3D,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAClE,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Cloudflare/Browser/Browser.d.ts

@@ -0,0 +1,121 @@
+import type * as Effect from "effect/Effect";
+import { SingleShotGen } from "effect/Utils";
+import { BrowserBinding, type BrowserClient } from "./BrowserBinding.ts";
+type BrowserTypeId = typeof BrowserTypeId;
+declare const BrowserTypeId: "Cloudflare.Browser";
+export type BrowserProps = {
+    /**
+     * Binding name used when `Browser` is bound from inside a Worker init phase
+     * (`yield* Cloudflare.Browser(...)`). When passed through
+     * `Worker({ env: { ... } })`, the object key remains the binding name.
+     *
+     * @default "BROWSER"
+     */
+    name?: string;
+};
+/**
+ * The Effect yielded when a `Browser` marker is used inside a Worker init
+ * phase: it attaches the `browser` binding to the surrounding Worker and
+ * resolves to the runtime {@link BrowserClient}.
+ */
+type BindEffect = Effect.Effect<BrowserClient, never, BrowserBinding>;
+/**
+ * Marker for a Cloudflare Browser Rendering binding.
+ *
+ * It is a plain data structure (so it can be declared directly on a Worker's
+ * `env`) that is **also** yieldable inside an Effect-native Worker. Yielding it
+ * (`yield* Cloudflare.Browser(...)`) attaches the binding to the surrounding
+ * Worker and returns the runtime {@link BrowserClient} — no separate
+ * `.bind(...)` step required.
+ *
+ * The divergence is achieved via `[Symbol.iterator]`: the object is not an
+ * `Effect` (so `InferEnv` resolves it to the native `Fetcher` in the `env`
+ * position), but it is iterable as one when `yield*`-ed.
+ */
+export interface Browser {
+    kind: BrowserTypeId;
+    name: string;
+    asEffect(): BindEffect;
+    [Symbol.iterator](): SingleShotGen<BindEffect, BrowserClient>;
+}
+export declare const isBrowser: (value: unknown) => value is Browser;
+/**
+ * A Cloudflare Browser Rendering binding for launching headless browser
+ * sessions from Workers via `@cloudflare/puppeteer`.
+ *
+ * @binding
+ *
+ * @section Effect-style Worker (recommended)
+ * @example Render a page title with managed browser cleanup
+ * ```typescript
+ * import puppeteer from "@cloudflare/puppeteer";
+ * import * as Effect from "effect/Effect";
+ *
+ * Cloudflare.Worker(
+ *   "BrowserWorker",
+ *   { main: import.meta.filename },
+ *   Effect.gen(function* () {
+ *     // Attaches the binding to this Worker AND returns the runtime client.
+ *     const browser = yield* Cloudflare.Browser({ name: "BROWSER" });
+ *
+ *     return {
+ *       fetch: browser.withBrowser(puppeteer, (browser) =>
+ *         Effect.gen(function* () {
+ *           const page = yield* Effect.tryPromise(() => browser.newPage());
+ *           yield* Effect.tryPromise(() => page.goto("https://example.com"));
+ *           const title = yield* Effect.tryPromise(() => page.title());
+ *           return Response.json({ title });
+ *         }),
+ *       ),
+ *     };
+ *   }).pipe(Effect.provide(Cloudflare.BrowserBindingLive)),
+ * );
+ * ```
+ *
+ * @section Worker binding metadata
+ * @example
+ * ```typescript
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   env: {
+ *     BROWSER: Cloudflare.Browser(),
+ *   },
+ * });
+ *
+ * export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+ * //   { BROWSER: Fetcher }
+ * ```
+ *
+ * @example Async-style worker with the raw runtime binding
+ * ```typescript
+ * import puppeteer from "@cloudflare/puppeteer";
+ * import type { WorkerEnv } from "../alchemy.run.ts";
+ *
+ * export default {
+ *   async fetch(request: Request, env: WorkerEnv) {
+ *     const browser = await puppeteer.launch(env.BROWSER);
+ *     const page = await browser.newPage();
+ *     await page.goto("https://example.com");
+ *     const screenshot = await page.screenshot();
+ *     await browser.close();
+ *
+ *     return new Response(screenshot, {
+ *       headers: { "content-type": "image/png" },
+ *     });
+ *   },
+ * };
+ * ```
+ *
+ * @see https://developers.cloudflare.com/browser-rendering/workers-binding-api/
+ */
+export declare const Browser: {
+    (props?: BrowserProps): Browser;
+    /**
+     * Bind an existing `Browser` marker to the surrounding Worker, returning the
+     * runtime client. Equivalent to `yield* browser` — prefer yielding the marker
+     * directly.
+     */
+    bind: typeof BrowserBinding.bind;
+};
+export {};
+//# sourceMappingURL=Browser.d.ts.map

package/lib/Cloudflare/Browser/Browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Browser.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Browser/Browser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzE,KAAK,aAAa,GAAG,OAAO,aAAa,CAAC;AAC1C,QAAA,MAAM,aAAa,EAAG,oBAA6B,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IACzB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;GAIG;AACH,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;AAEtE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,IAAI,UAAU,CAAC;IACvB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;CAC/D;AAED,eAAO,MAAM,SAAS,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,OACqB,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,eAAO,MAAM,OAAO,EAAE;IACpB,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC;IAChC;;;;OAIG;IACH,IAAI,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC;CAelC,CAAC"}