alchemy 2.0.0-beta.47 → 2.0.0-beta.49

package/lib/Cloudflare/Tunnel/TunnelBinding.js

@@ -0,0 +1,56 @@
+import { Credentials, fromApiToken, } from "@distilled.cloud/cloudflare/Credentials";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import { RuntimeContext } from "../../RuntimeContext.js";
+import { AccountApiToken } from "../ApiToken/AccountApiToken.js";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
+import { Worker } from "../Workers/Worker.js";
+/**
+ * Bind an {@link AccountApiToken}'s outputs into the Worker so they can be read
+ * at runtime: `token.value` is injected as a `secret_text` binding and
+ * `token.accountId` as `plain_text`. Returns the {@link TunnelToken} accessors.
+ */
+export const bindTunnelToken = (token) => Effect.gen(function* () {
+    const value = yield* token.value;
+    const accountId = yield* token.accountId;
+    return { value, accountId };
+});
+/**
+ * Resolve credentials from a bound token and provide them (plus the
+ * fetch-based HTTP client) to a raw SDK operation.
+ */
+export const authorizeWith = (token) => (eff) => token.value.pipe(Effect.flatMap((value) => eff.pipe(Effect.provide(fromApiToken({ apiToken: Redacted.value(value) }).pipe(Layer.provideMerge(FetchHttpClient.layer))))));
+/**
+ * Shared runtime body for a tunnel binding: create a scoped token, attach the
+ * (narrow) policy, bind the token's outputs into the Worker, then build the
+ * client. Pass the result to `Layer.effect(<Binding>, ...)`.
+ */
+export const makeTunnelClient = (Policy, makeClient) => Effect.gen(function* () {
+    const Token = yield* AccountApiToken;
+    const attach = yield* Policy;
+    return Effect.fn(function* () {
+        const ctx = yield* Worker;
+        const token = yield* Token(`${ctx.LogicalId}Token`);
+        yield* attach(token);
+        return makeClient(yield* bindTunnelToken(token));
+    });
+});
+/**
+ * Build the deploy-time policy layer for a tunnel binding: attach an allow
+ * policy with the given permission groups to the binding's token.
+ */
+export const makeTunnelPolicyLive = (Policy, sid, permissionGroups) => Policy.layer.effect(Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+    return (_host, token) => token.bind(sid, {
+        policies: [
+            {
+                effect: "allow",
+                permissionGroups,
+                resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+            },
+        ],
+    });
+}));
+//# sourceMappingURL=TunnelBinding.js.map

package/lib/Cloudflare/Tunnel/TunnelBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TunnelBinding.js","sourceRoot":"","sources":["../../../src/Cloudflare/Tunnel/TunnelBinding.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,YAAY,GACb,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,eAAe,MAAM,sCAAsC,CAAC;AAGxE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAc9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAsB,EAAE,EAAE,CACxD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IACjC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;IACzC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAwB,CAAC;AACpD,CAAC,CAAC,CAAC;AAEL;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GACxB,CAAC,KAAkB,EAAE,EAAE,CACvB,CACE,GAAkD,EACb,EAAE,CACvC,KAAK,CAAC,KAAK,CAAC,IAAI,CACd,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,GAAG,CAAC,IAAI,CACN,MAAM,CAAC,OAAO,CACZ,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CACpD,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,KAAK,CAAC,CAC1C,CACF,CACF,CACF,CACF,CAAC;AAEN;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAIC,EACD,UAAqC,EACrC,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;IAE7B,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,SAAS,OAAO,CAAC,CAAC;QACpD,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,MAIC,EACD,GAAW,EACX,gBAA8C,EAC9C,EAAE,CACF,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC;IACnD,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACtB,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;QACd,QAAQ,EAAE;YACR;gBACE,MAAM,EAAE,OAAO;gBACf,gBAAgB;gBAChB,SAAS,EAAE,EAAE,CAAC,8BAA8B,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE;aAChE;SACF;KACF,CAAC,CAAC;AACP,CAAC,CAAC,CACH,CAAC"}

package/lib/Cloudflare/Tunnel/TunnelRead.d.ts

@@ -0,0 +1,83 @@
+import type { GetTunnelCloudflaredConfigurationError, GetTunnelCloudflaredConfigurationResponse, GetTunnelCloudflaredError, GetTunnelCloudflaredResponse, GetTunnelCloudflaredTokenError, GetTunnelCloudflaredTokenResponse, ListTunnelCloudflaredsError, ListTunnelCloudflaredsRequest, ListTunnelCloudflaredsResponse } from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import type { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { Worker } from "../Workers/Worker.ts";
+import { type TunnelToken } from "./TunnelBinding.ts";
+/** List-tunnels request, minus the account id (supplied by the binding). */
+export type ListTunnelsRequest = Omit<ListTunnelCloudflaredsRequest, "accountId">;
+/**
+ * Read-only tunnel operations. Backed by the `Cloudflare Tunnel Read`
+ * permission group.
+ */
+export interface TunnelReadClient {
+    /** Fetch a single tunnel by id. */
+    get(tunnelId: string): Effect.Effect<GetTunnelCloudflaredResponse, GetTunnelCloudflaredError, RuntimeContext>;
+    /** List tunnels in the account. */
+    list(request?: ListTunnelsRequest): Effect.Effect<ListTunnelCloudflaredsResponse, ListTunnelCloudflaredsError, RuntimeContext>;
+    /** Fetch the connector token used to run the tunnel. */
+    getToken(tunnelId: string): Effect.Effect<GetTunnelCloudflaredTokenResponse, GetTunnelCloudflaredTokenError, RuntimeContext>;
+    /** Read the remotely-managed configuration (ingress rules) for a tunnel. */
+    getConfiguration(tunnelId: string): Effect.Effect<GetTunnelCloudflaredConfigurationResponse, GetTunnelCloudflaredConfigurationError, RuntimeContext>;
+}
+/** Build the read-only client over a bound token. */
+export declare const readClient: (token: TunnelToken) => TunnelReadClient;
+declare const TunnelRead_base: Binding.Service<TunnelRead, "Cloudflare.TunnelRead", () => Effect.Effect<TunnelReadClient, never, Worker>> & {
+    bind: () => Effect.Effect<any, any, any>;
+};
+/**
+ * Binding that lets a Worker read Cloudflare Tunnels at runtime.
+ *
+ * Creates a scoped {@link AccountApiToken} with only the `Cloudflare Tunnel
+ * Read` permission and binds its outputs into the Worker (the token value as a
+ * `secret_text` binding) so runtime code can authenticate.
+ *
+ * @binding
+ *
+ * @section Reading tunnels at runtime
+ * @example Bind the read client
+ * Bind once in the Init phase; every method is available on the returned client.
+ * ```typescript
+ * const tunnels = yield* Cloudflare.TunnelRead.bind();
+ * ```
+ *
+ * @example List tunnels
+ * ```typescript
+ * const { result } = yield* tunnels.list({ isDeleted: false });
+ * ```
+ *
+ * @example Fetch a tunnel and its connector token
+ * `getToken` returns the plaintext token used to run `cloudflared`.
+ * ```typescript
+ * const tunnel = yield* tunnels.get(tunnelId);
+ * const token = yield* tunnels.getToken(tunnelId);
+ * ```
+ *
+ * @example Read the ingress configuration
+ * ```typescript
+ * const { config } = yield* tunnels.getConfiguration(tunnelId);
+ * ```
+ *
+ * @section Runtime Layer
+ * Provide {@link TunnelReadLive} in the Worker's runtime layer.
+ * ```typescript
+ * Effect.provide(Cloudflare.TunnelReadLive)
+ * ```
+ */
+export declare class TunnelRead extends TunnelRead_base {
+}
+declare const TunnelReadPolicy_base: Binding.Policy<TunnelReadPolicy, "Policy<Cloudflare.TunnelRead>", (token: AccountApiToken) => Effect.Effect<void>>;
+/**
+ * Deploy-time policy for {@link TunnelRead}. Attaches the `Cloudflare Tunnel
+ * Read` permission to the token via its binding contract.
+ */
+export declare class TunnelReadPolicy extends TunnelReadPolicy_base {
+}
+/** Runtime layer for {@link TunnelRead}. */
+export declare const TunnelReadLive: Layer.Layer<TunnelRead, never, any>;
+/** Live deploy-time policy layer for {@link TunnelReadPolicy}. */
+export declare const TunnelReadPolicyLive: Layer.Layer<TunnelReadPolicy, never, import("../CloudflareEnvironment.ts").CloudflareEnvironment>;
+export {};
+//# sourceMappingURL=TunnelRead.d.ts.map

package/lib/Cloudflare/Tunnel/TunnelRead.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TunnelRead.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Tunnel/TunnelRead.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sCAAsC,EACtC,yCAAyC,EACzC,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,EAC9B,iCAAiC,EACjC,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC/B,MAAM,wCAAwC,CAAC;AAEhD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAE5B,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,IAAI,CACnC,6BAA6B,EAC7B,WAAW,CACZ,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mCAAmC;IACnC,GAAG,CACD,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,CACd,4BAA4B,EAC5B,yBAAyB,EACzB,cAAc,CACf,CAAC;IACF,mCAAmC;IACnC,IAAI,CACF,OAAO,CAAC,EAAE,kBAAkB,GAC3B,MAAM,CAAC,MAAM,CACd,8BAA8B,EAC9B,2BAA2B,EAC3B,cAAc,CACf,CAAC;IACF,wDAAwD;IACxD,QAAQ,CACN,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,CACd,iCAAiC,EACjC,8BAA8B,EAC9B,cAAc,CACf,CAAC;IACF,4EAA4E;IAC5E,gBAAgB,CACd,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,CACd,yCAAyC,EACzC,sCAAsC,EACtC,cAAc,CACf,CAAC;CACH;AAED,qDAAqD;AACrD,eAAO,MAAM,UAAU,GAAI,OAAO,WAAW,KAAG,gBA8B/C,CAAC;0FA2CM,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC;;;AAzCtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,qBAAa,UAAW,SAAQ,eAGJ;CAAG;+GAQrB,eAAe,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;AANjD;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,qBAGV;CAAG;AAE/B,4CAA4C;AAC5C,eAAO,MAAM,cAAc,qCAG1B,CAAC;AAEF,kEAAkE;AAClE,eAAO,MAAM,oBAAoB,mGAIhC,CAAC"}

package/lib/Cloudflare/Tunnel/TunnelRead.js

@@ -0,0 +1,79 @@
+import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.js";
+import { authorizeWith, makeTunnelClient, makeTunnelPolicyLive, } from "./TunnelBinding.js";
+/** Build the read-only client over a bound token. */
+export const readClient = (token) => {
+    const authorize = authorizeWith(token);
+    return {
+        get: Effect.fn("Cloudflare.Tunnel.get")(function* (tunnelId) {
+            const accountId = yield* token.accountId;
+            return yield* authorize(zeroTrust.getTunnelCloudflared({ accountId, tunnelId }));
+        }),
+        list: Effect.fn("Cloudflare.Tunnel.list")(function* (request) {
+            const accountId = yield* token.accountId;
+            return yield* authorize(zeroTrust.listTunnelCloudflareds({ accountId, ...request }));
+        }),
+        getToken: Effect.fn("Cloudflare.Tunnel.getToken")(function* (tunnelId) {
+            const accountId = yield* token.accountId;
+            return yield* authorize(zeroTrust.getTunnelCloudflaredToken({ accountId, tunnelId }));
+        }),
+        getConfiguration: Effect.fn("Cloudflare.Tunnel.getConfiguration")(function* (tunnelId) {
+            const accountId = yield* token.accountId;
+            return yield* authorize(zeroTrust.getTunnelCloudflaredConfiguration({ accountId, tunnelId }));
+        }),
+    };
+};
+/**
+ * Binding that lets a Worker read Cloudflare Tunnels at runtime.
+ *
+ * Creates a scoped {@link AccountApiToken} with only the `Cloudflare Tunnel
+ * Read` permission and binds its outputs into the Worker (the token value as a
+ * `secret_text` binding) so runtime code can authenticate.
+ *
+ * @binding
+ *
+ * @section Reading tunnels at runtime
+ * @example Bind the read client
+ * Bind once in the Init phase; every method is available on the returned client.
+ * ```typescript
+ * const tunnels = yield* Cloudflare.TunnelRead.bind();
+ * ```
+ *
+ * @example List tunnels
+ * ```typescript
+ * const { result } = yield* tunnels.list({ isDeleted: false });
+ * ```
+ *
+ * @example Fetch a tunnel and its connector token
+ * `getToken` returns the plaintext token used to run `cloudflared`.
+ * ```typescript
+ * const tunnel = yield* tunnels.get(tunnelId);
+ * const token = yield* tunnels.getToken(tunnelId);
+ * ```
+ *
+ * @example Read the ingress configuration
+ * ```typescript
+ * const { config } = yield* tunnels.getConfiguration(tunnelId);
+ * ```
+ *
+ * @section Runtime Layer
+ * Provide {@link TunnelReadLive} in the Worker's runtime layer.
+ * ```typescript
+ * Effect.provide(Cloudflare.TunnelReadLive)
+ * ```
+ */
+export class TunnelRead extends Binding.Service()("Cloudflare.TunnelRead") {
+}
+/**
+ * Deploy-time policy for {@link TunnelRead}. Attaches the `Cloudflare Tunnel
+ * Read` permission to the token via its binding contract.
+ */
+export class TunnelReadPolicy extends Binding.Policy()("Cloudflare.TunnelRead") {
+}
+/** Runtime layer for {@link TunnelRead}. */
+export const TunnelReadLive = Layer.effect(TunnelRead, makeTunnelClient(TunnelReadPolicy, readClient));
+/** Live deploy-time policy layer for {@link TunnelReadPolicy}. */
+export const TunnelReadPolicyLive = makeTunnelPolicyLive(TunnelReadPolicy, "Cloudflare.TunnelRead", ["Cloudflare Tunnel Read"]);
+//# sourceMappingURL=TunnelRead.js.map

package/lib/Cloudflare/Tunnel/TunnelRead.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TunnelRead.js","sourceRoot":"","sources":["../../../src/Cloudflare/Tunnel/TunnelRead.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,SAAS,MAAM,wCAAwC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAI5C,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AA+C5B,qDAAqD;AACrD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAkB,EAAoB,EAAE;IACjE,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ;YACzD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;YACzC,OAAO,KAAK,CAAC,CAAC,SAAS,CACrB,SAAS,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO;YAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;YACzC,OAAO,KAAK,CAAC,CAAC,SAAS,CACrB,SAAS,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAC5D,CAAC;QACJ,CAAC,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ;YACnE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;YACzC,OAAO,KAAK,CAAC,CAAC,SAAS,CACrB,SAAS,CAAC,yBAAyB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAC7D,CAAC;QACJ,CAAC,CAAC;QACF,gBAAgB,EAAE,MAAM,CAAC,EAAE,CAAC,oCAAoC,CAAC,CAC/D,QAAQ,CAAC,EAAE,QAAQ;YACjB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;YACzC,OAAO,KAAK,CAAC,CAAC,SAAS,CACrB,SAAS,CAAC,iCAAiC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CACrE,CAAC;QACJ,CAAC,CACF;KACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,OAAO,UAAW,SAAQ,OAAO,CAAC,OAAO,EAG5C,CAAC,uBAAuB,CAAC;CAAG;AAE/B;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,OAAO,CAAC,MAAM,EAGjD,CAAC,uBAAuB,CAAC;CAAG;AAE/B,4CAA4C;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CACxC,UAAU,EACV,gBAAgB,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAC/C,CAAC;AAEF,kEAAkE;AAClE,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CACtD,gBAAgB,EAChB,uBAAuB,EACvB,CAAC,wBAAwB,CAAC,CAC3B,CAAC"}

package/lib/Cloudflare/Tunnel/TunnelReadWrite.d.ts

@@ -0,0 +1,70 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { Worker } from "../Workers/Worker.ts";
+import { type TunnelToken } from "./TunnelBinding.ts";
+import { type TunnelReadClient } from "./TunnelRead.ts";
+import { type TunnelWriteClient } from "./TunnelWrite.ts";
+/** Combined read + write tunnel operations. */
+export interface TunnelReadWriteClient extends TunnelReadClient, TunnelWriteClient {
+}
+/** Build the combined read + write client over a bound token. */
+export declare const readWriteClient: (token: TunnelToken) => TunnelReadWriteClient;
+declare const TunnelReadWrite_base: Binding.Service<TunnelReadWrite, "Cloudflare.TunnelReadWrite", () => Effect.Effect<TunnelReadWriteClient, never, Worker>> & {
+    bind: () => Effect.Effect<any, any, any>;
+};
+/**
+ * Binding that lets a Worker perform the full Cloudflare Tunnel CRUD surface at
+ * runtime.
+ *
+ * Creates a scoped {@link AccountApiToken} with both the `Cloudflare Tunnel
+ * Read` and `Cloudflare Tunnel Write` permissions and binds its outputs into
+ * the Worker (the token value as a `secret_text` binding) so runtime code can
+ * authenticate.
+ *
+ * @binding
+ *
+ * @section Managing tunnels at runtime
+ * @example Create, configure, and delete a tunnel from a request handler
+ * ```typescript
+ * // init
+ * const tunnels = yield* Cloudflare.TunnelReadWrite.bind();
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const tunnel = yield* tunnels.create({ name: "on-demand-tunnel" });
+ *     yield* tunnels.putConfiguration(tunnel.id!, {
+ *       ingress: [
+ *         { hostname: "app.example.com", service: "http://localhost:3000" },
+ *         { service: "http_status:404" },
+ *       ],
+ *     });
+ *     const token = yield* tunnels.getToken(tunnel.id!);
+ *     return HttpServerResponse.json({ id: tunnel.id, token });
+ *   }),
+ * };
+ * ```
+ *
+ * @section Runtime Layer
+ * Provide {@link TunnelReadWriteLive} in the Worker's runtime layer.
+ * ```typescript
+ * Effect.provide(Cloudflare.TunnelReadWriteLive)
+ * ```
+ */
+export declare class TunnelReadWrite extends TunnelReadWrite_base {
+}
+declare const TunnelReadWritePolicy_base: Binding.Policy<TunnelReadWritePolicy, "Policy<Cloudflare.TunnelReadWrite>", (token: AccountApiToken) => Effect.Effect<void>>;
+/**
+ * Deploy-time policy for {@link TunnelReadWrite}. Attaches both the `Cloudflare
+ * Tunnel Read` and `Cloudflare Tunnel Write` permissions to the token via its
+ * binding contract.
+ */
+export declare class TunnelReadWritePolicy extends TunnelReadWritePolicy_base {
+}
+/** Runtime layer for {@link TunnelReadWrite}. */
+export declare const TunnelReadWriteLive: Layer.Layer<TunnelReadWrite, never, any>;
+/** Live deploy-time policy layer for {@link TunnelReadWritePolicy}. */
+export declare const TunnelReadWritePolicyLive: Layer.Layer<TunnelReadWritePolicy, never, import("../CloudflareEnvironment.ts").CloudflareEnvironment>;
+export {};
+//# sourceMappingURL=TunnelReadWrite.d.ts.map

package/lib/Cloudflare/Tunnel/TunnelReadWrite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TunnelReadWrite.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Tunnel/TunnelReadWrite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAe,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,+CAA+C;AAC/C,MAAM,WAAW,qBACf,SAAQ,gBAAgB,EAAE,iBAAiB;CAAG;AAEhD,iEAAiE;AACjE,eAAO,MAAM,eAAe,GAAI,OAAO,WAAW,KAAG,qBAGnD,CAAC;yGA0CK,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC;;;AAxC3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,qBAAa,eAAgB,SAAQ,oBAGJ;CAAG;8HAS1B,eAAe,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;AAPjD;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,0BAGV;CAAG;AAEpC,iDAAiD;AACjD,eAAO,MAAM,mBAAmB,0CAG/B,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,wGAIrC,CAAC"}

package/lib/Cloudflare/Tunnel/TunnelReadWrite.js

@@ -0,0 +1,63 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.js";
+import { makeTunnelClient, makeTunnelPolicyLive, } from "./TunnelBinding.js";
+import { readClient } from "./TunnelRead.js";
+import { writeClient } from "./TunnelWrite.js";
+/** Build the combined read + write client over a bound token. */
+export const readWriteClient = (token) => ({
+    ...readClient(token),
+    ...writeClient(token),
+});
+/**
+ * Binding that lets a Worker perform the full Cloudflare Tunnel CRUD surface at
+ * runtime.
+ *
+ * Creates a scoped {@link AccountApiToken} with both the `Cloudflare Tunnel
+ * Read` and `Cloudflare Tunnel Write` permissions and binds its outputs into
+ * the Worker (the token value as a `secret_text` binding) so runtime code can
+ * authenticate.
+ *
+ * @binding
+ *
+ * @section Managing tunnels at runtime
+ * @example Create, configure, and delete a tunnel from a request handler
+ * ```typescript
+ * // init
+ * const tunnels = yield* Cloudflare.TunnelReadWrite.bind();
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const tunnel = yield* tunnels.create({ name: "on-demand-tunnel" });
+ *     yield* tunnels.putConfiguration(tunnel.id!, {
+ *       ingress: [
+ *         { hostname: "app.example.com", service: "http://localhost:3000" },
+ *         { service: "http_status:404" },
+ *       ],
+ *     });
+ *     const token = yield* tunnels.getToken(tunnel.id!);
+ *     return HttpServerResponse.json({ id: tunnel.id, token });
+ *   }),
+ * };
+ * ```
+ *
+ * @section Runtime Layer
+ * Provide {@link TunnelReadWriteLive} in the Worker's runtime layer.
+ * ```typescript
+ * Effect.provide(Cloudflare.TunnelReadWriteLive)
+ * ```
+ */
+export class TunnelReadWrite extends Binding.Service()("Cloudflare.TunnelReadWrite") {
+}
+/**
+ * Deploy-time policy for {@link TunnelReadWrite}. Attaches both the `Cloudflare
+ * Tunnel Read` and `Cloudflare Tunnel Write` permissions to the token via its
+ * binding contract.
+ */
+export class TunnelReadWritePolicy extends Binding.Policy()("Cloudflare.TunnelReadWrite") {
+}
+/** Runtime layer for {@link TunnelReadWrite}. */
+export const TunnelReadWriteLive = Layer.effect(TunnelReadWrite, makeTunnelClient(TunnelReadWritePolicy, readWriteClient));
+/** Live deploy-time policy layer for {@link TunnelReadWritePolicy}. */
+export const TunnelReadWritePolicyLive = makeTunnelPolicyLive(TunnelReadWritePolicy, "Cloudflare.TunnelReadWrite", ["Cloudflare Tunnel Read", "Cloudflare Tunnel Write"]);
+//# sourceMappingURL=TunnelReadWrite.js.map

package/lib/Cloudflare/Tunnel/TunnelReadWrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TunnelReadWrite.js","sourceRoot":"","sources":["../../../src/Cloudflare/Tunnel/TunnelReadWrite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAG5C,OAAO,EACL,gBAAgB,EAChB,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAyB,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,WAAW,EAA0B,MAAM,kBAAkB,CAAC;AAMvE,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAkB,EAAyB,EAAE,CAAC,CAAC;IAC7E,GAAG,UAAU,CAAC,KAAK,CAAC;IACpB,GAAG,WAAW,CAAC,KAAK,CAAC;CACtB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,OAAO,eAAgB,SAAQ,OAAO,CAAC,OAAO,EAGjD,CAAC,4BAA4B,CAAC;CAAG;AAEpC;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,OAAO,CAAC,MAAM,EAGtD,CAAC,4BAA4B,CAAC;CAAG;AAEpC,iDAAiD;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CAC7C,eAAe,EACf,gBAAgB,CAAC,qBAAqB,EAAE,eAAe,CAAC,CACzD,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAC3D,qBAAqB,EACrB,4BAA4B,EAC5B,CAAC,wBAAwB,EAAE,yBAAyB,CAAC,CACtD,CAAC"}

package/lib/Cloudflare/Tunnel/TunnelWrite.d.ts

@@ -0,0 +1,92 @@
+import type { CreateTunnelCloudflaredError, CreateTunnelCloudflaredRequest, CreateTunnelCloudflaredResponse, DeleteTunnelCloudflaredError, DeleteTunnelCloudflaredResponse, PatchTunnelCloudflaredError, PatchTunnelCloudflaredRequest, PatchTunnelCloudflaredResponse, PutTunnelCloudflaredConfigurationError, PutTunnelCloudflaredConfigurationRequest, PutTunnelCloudflaredConfigurationResponse } from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import type { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { Worker } from "../Workers/Worker.ts";
+import { type TunnelToken } from "./TunnelBinding.ts";
+/** Create-tunnel request, minus the account id (supplied by the binding). */
+export type CreateTunnelRequest = Omit<CreateTunnelCloudflaredRequest, "accountId">;
+/** Update-tunnel request, minus the account id and tunnel id (positional). */
+export type UpdateTunnelRequest = Omit<PatchTunnelCloudflaredRequest, "accountId" | "tunnelId">;
+/** Tunnel configuration body, minus the account id and tunnel id (positional). */
+export type TunnelConfiguration = NonNullable<PutTunnelCloudflaredConfigurationRequest["config"]>;
+/**
+ * Mutating tunnel operations. Backed by the `Cloudflare Tunnel Write`
+ * permission group.
+ */
+export interface TunnelWriteClient {
+    /** Create a new tunnel. */
+    create(request: CreateTunnelRequest): Effect.Effect<CreateTunnelCloudflaredResponse, CreateTunnelCloudflaredError, RuntimeContext>;
+    /** Update a tunnel's mutable fields (name, secret). */
+    update(tunnelId: string, request: UpdateTunnelRequest): Effect.Effect<PatchTunnelCloudflaredResponse, PatchTunnelCloudflaredError, RuntimeContext>;
+    /** Delete a tunnel by id. */
+    delete(tunnelId: string): Effect.Effect<DeleteTunnelCloudflaredResponse, DeleteTunnelCloudflaredError, RuntimeContext>;
+    /** Replace the remotely-managed configuration (ingress rules) for a tunnel. */
+    putConfiguration(tunnelId: string, config: TunnelConfiguration): Effect.Effect<PutTunnelCloudflaredConfigurationResponse, PutTunnelCloudflaredConfigurationError, RuntimeContext>;
+}
+/** Build the write client over a bound token. */
+export declare const writeClient: (token: TunnelToken) => TunnelWriteClient;
+declare const TunnelWrite_base: Binding.Service<TunnelWrite, "Cloudflare.TunnelWrite", () => Effect.Effect<TunnelWriteClient, never, Worker>> & {
+    bind: () => Effect.Effect<any, any, any>;
+};
+/**
+ * Binding that lets a Worker create, update, and delete Cloudflare Tunnels at
+ * runtime.
+ *
+ * Creates a scoped {@link AccountApiToken} with only the `Cloudflare Tunnel
+ * Write` permission and binds its outputs into the Worker (the token value as a
+ * `secret_text` binding) so runtime code can authenticate.
+ *
+ * @binding
+ *
+ * @section Mutating tunnels at runtime
+ * @example Bind the write client
+ * Bind once in the Init phase; every method is available on the returned client.
+ * ```typescript
+ * const tunnels = yield* Cloudflare.TunnelWrite.bind();
+ * ```
+ *
+ * @example Create a tunnel
+ * ```typescript
+ * const tunnel = yield* tunnels.create({ name: "on-demand-tunnel" });
+ * ```
+ *
+ * @example Push ingress configuration
+ * ```typescript
+ * yield* tunnels.putConfiguration(tunnel.id!, {
+ *   ingress: [
+ *     { hostname: "app.example.com", service: "http://localhost:3000" },
+ *     { service: "http_status:404" },
+ *   ],
+ * });
+ * ```
+ *
+ * @example Rename and delete a tunnel
+ * ```typescript
+ * yield* tunnels.update(tunnel.id!, { name: "renamed-tunnel" });
+ * yield* tunnels.delete(tunnel.id!);
+ * ```
+ *
+ * @section Runtime Layer
+ * Provide {@link TunnelWriteLive} in the Worker's runtime layer.
+ * ```typescript
+ * Effect.provide(Cloudflare.TunnelWriteLive)
+ * ```
+ */
+export declare class TunnelWrite extends TunnelWrite_base {
+}
+declare const TunnelWritePolicy_base: Binding.Policy<TunnelWritePolicy, "Policy<Cloudflare.TunnelWrite>", (token: AccountApiToken) => Effect.Effect<void>>;
+/**
+ * Deploy-time policy for {@link TunnelWrite}. Attaches the `Cloudflare Tunnel
+ * Write` permission to the token via its binding contract.
+ */
+export declare class TunnelWritePolicy extends TunnelWritePolicy_base {
+}
+/** Runtime layer for {@link TunnelWrite}. */
+export declare const TunnelWriteLive: Layer.Layer<TunnelWrite, never, any>;
+/** Live deploy-time policy layer for {@link TunnelWritePolicy}. */
+export declare const TunnelWritePolicyLive: Layer.Layer<TunnelWritePolicy, never, import("../CloudflareEnvironment.ts").CloudflareEnvironment>;
+export {};
+//# sourceMappingURL=TunnelWrite.d.ts.map

package/lib/Cloudflare/Tunnel/TunnelWrite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TunnelWrite.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Tunnel/TunnelWrite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,8BAA8B,EAC9B,+BAA+B,EAC/B,4BAA4B,EAC5B,+BAA+B,EAC/B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,sCAAsC,EACtC,wCAAwC,EACxC,yCAAyC,EAC1C,MAAM,wCAAwC,CAAC;AAEhD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAE5B,6EAA6E;AAC7E,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,8BAA8B,EAC9B,WAAW,CACZ,CAAC;AAEF,8EAA8E;AAC9E,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,6BAA6B,EAC7B,WAAW,GAAG,UAAU,CACzB,CAAC;AAEF,kFAAkF;AAClF,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAC3C,wCAAwC,CAAC,QAAQ,CAAC,CACnD,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,2BAA2B;IAC3B,MAAM,CACJ,OAAO,EAAE,mBAAmB,GAC3B,MAAM,CAAC,MAAM,CACd,+BAA+B,EAC/B,4BAA4B,EAC5B,cAAc,CACf,CAAC;IACF,uDAAuD;IACvD,MAAM,CACJ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,mBAAmB,GAC3B,MAAM,CAAC,MAAM,CACd,8BAA8B,EAC9B,2BAA2B,EAC3B,cAAc,CACf,CAAC;IACF,6BAA6B;IAC7B,MAAM,CACJ,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,CACd,+BAA+B,EAC/B,4BAA4B,EAC5B,cAAc,CACf,CAAC;IACF,+EAA+E;IAC/E,gBAAgB,CACd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,mBAAmB,GAC1B,MAAM,CAAC,MAAM,CACd,yCAAyC,EACzC,sCAAsC,EACtC,cAAc,CACf,CAAC;CACH;AAED,iDAAiD;AACjD,eAAO,MAAM,WAAW,GAAI,OAAO,WAAW,KAAG,iBAoChD,CAAC;6FAgDM,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,KAAK,EAAE,MAAM,CAAC;;;AA9CvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,qBAAa,WAAY,SAAQ,gBAGJ;CAAG;kHAQtB,eAAe,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;AANjD;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,sBAGV;CAAG;AAEhC,6CAA6C;AAC7C,eAAO,MAAM,eAAe,sCAG3B,CAAC;AAEF,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,oGAIjC,CAAC"}

package/lib/Cloudflare/Tunnel/TunnelWrite.js

@@ -0,0 +1,88 @@
+import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.js";
+import { authorizeWith, makeTunnelClient, makeTunnelPolicyLive, } from "./TunnelBinding.js";
+/** Build the write client over a bound token. */
+export const writeClient = (token) => {
+    const authorize = authorizeWith(token);
+    return {
+        create: Effect.fn("Cloudflare.Tunnel.create")(function* (request) {
+            const accountId = yield* token.accountId;
+            return yield* authorize(zeroTrust.createTunnelCloudflared({ accountId, ...request }));
+        }),
+        update: Effect.fn("Cloudflare.Tunnel.update")(function* (tunnelId, request) {
+            const accountId = yield* token.accountId;
+            return yield* authorize(zeroTrust.patchTunnelCloudflared({ accountId, tunnelId, ...request }));
+        }),
+        delete: Effect.fn("Cloudflare.Tunnel.delete")(function* (tunnelId) {
+            const accountId = yield* token.accountId;
+            return yield* authorize(zeroTrust.deleteTunnelCloudflared({ accountId, tunnelId }));
+        }),
+        putConfiguration: Effect.fn("Cloudflare.Tunnel.putConfiguration")(function* (tunnelId, config) {
+            const accountId = yield* token.accountId;
+            return yield* authorize(zeroTrust.putTunnelCloudflaredConfiguration({
+                accountId,
+                tunnelId,
+                config,
+            }));
+        }),
+    };
+};
+/**
+ * Binding that lets a Worker create, update, and delete Cloudflare Tunnels at
+ * runtime.
+ *
+ * Creates a scoped {@link AccountApiToken} with only the `Cloudflare Tunnel
+ * Write` permission and binds its outputs into the Worker (the token value as a
+ * `secret_text` binding) so runtime code can authenticate.
+ *
+ * @binding
+ *
+ * @section Mutating tunnels at runtime
+ * @example Bind the write client
+ * Bind once in the Init phase; every method is available on the returned client.
+ * ```typescript
+ * const tunnels = yield* Cloudflare.TunnelWrite.bind();
+ * ```
+ *
+ * @example Create a tunnel
+ * ```typescript
+ * const tunnel = yield* tunnels.create({ name: "on-demand-tunnel" });
+ * ```
+ *
+ * @example Push ingress configuration
+ * ```typescript
+ * yield* tunnels.putConfiguration(tunnel.id!, {
+ *   ingress: [
+ *     { hostname: "app.example.com", service: "http://localhost:3000" },
+ *     { service: "http_status:404" },
+ *   ],
+ * });
+ * ```
+ *
+ * @example Rename and delete a tunnel
+ * ```typescript
+ * yield* tunnels.update(tunnel.id!, { name: "renamed-tunnel" });
+ * yield* tunnels.delete(tunnel.id!);
+ * ```
+ *
+ * @section Runtime Layer
+ * Provide {@link TunnelWriteLive} in the Worker's runtime layer.
+ * ```typescript
+ * Effect.provide(Cloudflare.TunnelWriteLive)
+ * ```
+ */
+export class TunnelWrite extends Binding.Service()("Cloudflare.TunnelWrite") {
+}
+/**
+ * Deploy-time policy for {@link TunnelWrite}. Attaches the `Cloudflare Tunnel
+ * Write` permission to the token via its binding contract.
+ */
+export class TunnelWritePolicy extends Binding.Policy()("Cloudflare.TunnelWrite") {
+}
+/** Runtime layer for {@link TunnelWrite}. */
+export const TunnelWriteLive = Layer.effect(TunnelWrite, makeTunnelClient(TunnelWritePolicy, writeClient));
+/** Live deploy-time policy layer for {@link TunnelWritePolicy}. */
+export const TunnelWritePolicyLive = makeTunnelPolicyLive(TunnelWritePolicy, "Cloudflare.TunnelWrite", ["Cloudflare Tunnel Write"]);
+//# sourceMappingURL=TunnelWrite.js.map

package/lib/Cloudflare/Tunnel/TunnelWrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TunnelWrite.js","sourceRoot":"","sources":["../../../src/Cloudflare/Tunnel/TunnelWrite.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,SAAS,MAAM,wCAAwC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAI5C,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AA4D5B,iDAAiD;AACjD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAkB,EAAqB,EAAE;IACnE,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO;YAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;YACzC,OAAO,KAAK,CAAC,CAAC,SAAS,CACrB,SAAS,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAC7D,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAC3C,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO;YAC1B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;YACzC,OAAO,KAAK,CAAC,CAAC,SAAS,CACrB,SAAS,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC,CACtE,CAAC;QACJ,CAAC,CACF;QACD,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ;YAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;YACzC,OAAO,KAAK,CAAC,CAAC,SAAS,CACrB,SAAS,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAC3D,CAAC;QACJ,CAAC,CAAC;QACF,gBAAgB,EAAE,MAAM,CAAC,EAAE,CAAC,oCAAoC,CAAC,CAC/D,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM;YACzB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;YACzC,OAAO,KAAK,CAAC,CAAC,SAAS,CACrB,SAAS,CAAC,iCAAiC,CAAC;gBAC1C,SAAS;gBACT,QAAQ;gBACR,MAAM;aACP,CAAC,CACH,CAAC;QACJ,CAAC,CACF;KACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,OAAO,EAG7C,CAAC,wBAAwB,CAAC;CAAG;AAEhC;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,OAAO,CAAC,MAAM,EAGlD,CAAC,wBAAwB,CAAC;CAAG;AAEhC,6CAA6C;AAC7C,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CACzC,WAAW,EACX,gBAAgB,CAAC,iBAAiB,EAAE,WAAW,CAAC,CACjD,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAAoB,CACvD,iBAAiB,EACjB,wBAAwB,EACxB,CAAC,yBAAyB,CAAC,CAC5B,CAAC"}

package/lib/Cloudflare/Tunnel/index.d.ts

@@ -1,2 +1,6 @@
 export * from "./Tunnel.ts";
+export * from "./TunnelBinding.ts";
+export * from "./TunnelRead.ts";
+export * from "./TunnelReadWrite.ts";
+export * from "./TunnelWrite.ts";
 //# sourceMappingURL=index.d.ts.map

package/lib/Cloudflare/Tunnel/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Tunnel/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Tunnel/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC"}

package/lib/Cloudflare/Tunnel/index.js

@@ -1,2 +1,6 @@
 export * from "./Tunnel.js";
+export * from "./TunnelBinding.js";
+export * from "./TunnelRead.js";
+export * from "./TunnelReadWrite.js";
+export * from "./TunnelWrite.js";
 //# sourceMappingURL=index.js.map

package/lib/Cloudflare/Tunnel/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/Cloudflare/Tunnel/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/Cloudflare/Tunnel/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC"}

package/lib/Cloudflare/Vectorize/VectorizeIndex.d.ts

@@ -103,7 +103,7 @@ export type VectorizeIndex = Resource<VectorizeIndexTypeId, VectorizeIndexProps,
  * @see https://developers.cloudflare.com/vectorize/
  */
 export declare const VectorizeIndex: import("../../Resource.ts").ResourceClassWithMethods<VectorizeIndex, {
-    readonly bind: (<Req = never>(args_0: VectorizeIndex | Effect.Effect<VectorizeIndex, never, Req>) => Effect.Effect<import("./VectorizeIndexBinding.ts").VectorizeIndexClient, never, VectorizeIndexBinding | Req>) & ((index: VectorizeIndex) => Effect.Effect<any, any, any>);
+    readonly bind: (<Req = never>(args_0: import("../../Input.ts").Input<VectorizeIndex> | Effect.Effect<VectorizeIndex, never, Req>) => Effect.Effect<import("./VectorizeIndexBinding.ts").VectorizeIndexClient, never, VectorizeIndexBinding | Req>) & ((index: VectorizeIndex) => Effect.Effect<any, any, any>);
 }>;
 /**
  * Returns true if the given value is a VectorizeIndex resource.

package/lib/Cloudflare/Vectorize/VectorizeIndex.js

@@ -148,6 +148,7 @@ export const VectorizeIndexProvider = () => Provider.effect(VectorizeIndex, Effe
 const toAttributes = (index, name, accountId) => ({
     indexName: index.name ?? name,
     dimensions: index.config?.dimensions,
+    // Distilled widened generated string enums to open unions (`string & {}`).
     metric: index.config?.metric,
     description: index.description ?? undefined,
     accountId,