alchemy 2.0.0-beta.55 → 2.0.0-beta.57

package/lib/Cloudflare/Access/Tag.d.ts

@@ -0,0 +1,59 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+export type AccessTagProps = {
+    /**
+     * The name of the tag. The name IS the tag's identity on the Cloudflare
+     * API (it is the path parameter for get/update/delete), so changing it
+     * replaces the resource. If omitted, a unique name is generated from the
+     * stack/stage/logical id.
+     *
+     * @default ${app}-${stage}-${id}
+     */
+    name?: string;
+};
+export type AccessTag = Resource<"Cloudflare.Access.Tag", AccessTagProps, {
+    /** The name of the tag — also its identity on the Cloudflare API. */
+    name: string;
+    /** Cloudflare account that owns the tag. */
+    accountId: string;
+}, never, Providers>;
+/**
+ * A Cloudflare Zero Trust Access tag. Tags are plain labels that can be
+ * attached to Access applications to group and filter them.
+ *
+ * The tag's name is its identity — there is nothing to update in place, so
+ * renaming replaces the tag.
+ * @resource
+ * @product Access
+ * @category Cloudflare One (Zero Trust)
+ * @section Creating a Tag
+ * @example Tag with a generated name
+ * ```typescript
+ * const tag = yield* Cloudflare.AccessTag("Team", {});
+ * ```
+ *
+ * @example Tag with an explicit name
+ * ```typescript
+ * const tag = yield* Cloudflare.AccessTag("Team", {
+ *   name: "platform-team",
+ * });
+ * ```
+ *
+ * @section Tagging an Application
+ * @example Reference from an Access application
+ * ```typescript
+ * const tag = yield* Cloudflare.AccessTag("Team", { name: "platform-team" });
+ *
+ * const app = yield* Cloudflare.AccessApplication("Dashboard", {
+ *   type: "self_hosted",
+ *   domain: "dash.example.com",
+ *   tags: [tag.name],
+ * });
+ * ```
+ */
+export declare const AccessTag: import("../../Resource.ts").ResourceClass<AccessTag>;
+export declare const isAccessTag: (value: unknown) => value is AccessTag;
+export declare const AccessTagProvider: () => import("effect/Layer").Layer<Provider.Provider<AccessTag>, never, CloudflareEnvironment | import("@distilled.cloud/cloudflare").Credentials | import("effect/unstable/http/HttpClient").HttpClient | import("../../Stack.ts").Stack | import("../../Stage.ts").Stage>;
+//# sourceMappingURL=Tag.d.ts.map

package/lib/Cloudflare/Access/Tag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Tag.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Access/Tag.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,MAAM,cAAc,GAAG;IAC3B;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,QAAQ,CAC9B,uBAAuB,EACvB,cAAc,EACd;IACE,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;CACnB,EACD,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,SAAS,sDAA+C,CAAC;AAEtE,eAAO,MAAM,WAAW,UAAW,OAAO,KAAG,KAAK,IAAI,SAEd,CAAC;AAEzC,eAAO,MAAM,iBAAiB,6QA2E1B,CAAC"}

package/lib/Cloudflare/Access/Tag.js

@@ -0,0 +1,110 @@
+import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+import * as Stream from "effect/Stream";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
+/**
+ * A Cloudflare Zero Trust Access tag. Tags are plain labels that can be
+ * attached to Access applications to group and filter them.
+ *
+ * The tag's name is its identity — there is nothing to update in place, so
+ * renaming replaces the tag.
+ * @resource
+ * @product Access
+ * @category Cloudflare One (Zero Trust)
+ * @section Creating a Tag
+ * @example Tag with a generated name
+ * ```typescript
+ * const tag = yield* Cloudflare.AccessTag("Team", {});
+ * ```
+ *
+ * @example Tag with an explicit name
+ * ```typescript
+ * const tag = yield* Cloudflare.AccessTag("Team", {
+ *   name: "platform-team",
+ * });
+ * ```
+ *
+ * @section Tagging an Application
+ * @example Reference from an Access application
+ * ```typescript
+ * const tag = yield* Cloudflare.AccessTag("Team", { name: "platform-team" });
+ *
+ * const app = yield* Cloudflare.AccessApplication("Dashboard", {
+ *   type: "self_hosted",
+ *   domain: "dash.example.com",
+ *   tags: [tag.name],
+ * });
+ * ```
+ */
+export const AccessTag = Resource("Cloudflare.Access.Tag");
+export const isAccessTag = (value) => Predicate.hasProperty(value, "Type") &&
+    value.Type === "Cloudflare.Access.Tag";
+export const AccessTagProvider = () => Provider.succeed(AccessTag, {
+    stables: ["name", "accountId"],
+    list: Effect.fn(function* () {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        return yield* zeroTrust.listAccessTags.pages({ accountId }).pipe(Stream.runCollect, Effect.map((chunk) => Array.from(chunk).flatMap((page) => (page.result ?? []).map((tag) => ({
+            name: tag.name,
+            accountId,
+        })))));
+    }),
+    diff: Effect.fn(function* ({ news, output }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        if (!isResolved(news))
+            return undefined;
+        if ((output?.accountId ?? accountId) !== accountId) {
+            return { action: "replace" };
+        }
+        // The name is the identity — an explicit rename is a replacement.
+        if (output && news.name !== undefined && news.name !== output.name) {
+            return { action: "replace" };
+        }
+    }),
+    read: Effect.fn(function* ({ id, output, olds }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const acct = output?.accountId ?? accountId;
+        const name = yield* createTagName(id, output?.name ?? olds?.name);
+        const existing = yield* zeroTrust
+            .getAccessTag({ accountId: acct, tagName: name })
+            .pipe(Effect.catchTag("AccessTagNotFound", () => Effect.succeed(undefined)));
+        if (!existing)
+            return undefined;
+        return { name: existing.name, accountId: acct };
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const acct = output?.accountId ?? accountId;
+        const name = yield* createTagName(id, news.name);
+        // Observe — the name is the identity, so existence is the only state.
+        const observed = yield* zeroTrust
+            .getAccessTag({ accountId: acct, tagName: name })
+            .pipe(Effect.catchTag("AccessTagNotFound", () => Effect.succeed(undefined)));
+        // Ensure — create when missing; a create race resolves to the same tag.
+        if (!observed) {
+            const created = yield* zeroTrust
+                .createAccessTag({ accountId: acct, name })
+                .pipe(Effect.catch((err) => zeroTrust
+                .getAccessTag({ accountId: acct, tagName: name })
+                .pipe(Effect.catchTag("AccessTagNotFound", () => Effect.fail(err)))));
+            return { name: created.name, accountId: acct };
+        }
+        return { name: observed.name, accountId: acct };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        yield* zeroTrust
+            .deleteAccessTag({ accountId: output.accountId, tagName: output.name })
+            .pipe(Effect.catchTag("AccessTagNotFound", () => Effect.void));
+    }),
+});
+const createTagName = (id, name) => Effect.gen(function* () {
+    if (name)
+        return name;
+    // Tag names are capped at 35 characters by the Cloudflare API.
+    return yield* createPhysicalName({ id, maxLength: 35, suffixLength: 12 });
+});
+//# sourceMappingURL=Tag.js.map

package/lib/Cloudflare/Access/Tag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Tag.js","sourceRoot":"","sources":["../../../src/Cloudflare/Access/Tag.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,wCAAwC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AA4BpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAY,uBAAuB,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAc,EAAsB,EAAE,CAChE,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC;IACpC,KAAK,CAAC,IAAI,KAAK,uBAAuB,CAAC;AAEzC,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,EAAE,CACpC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE;IAC1B,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAC9D,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAChC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS;SACV,CAAC,CAAC,CACJ,CACF,CACF,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,kEAAkE;QAClE,IAAI,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS;aAC9B,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aAChD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACtE,CAAC;QACJ,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC,CAAC;IACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAClD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEjD,sEAAsE;QACtE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS;aAC9B,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aAChD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACtE,CAAC;QAEJ,wEAAwE;QACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS;iBAC7B,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;iBAC1C,IAAI,CACH,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACnB,SAAS;iBACN,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;iBAChD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAC7D,CACJ,CACF,CAAC;YACJ,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACjD,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,KAAK,CAAC,CAAC,SAAS;aACb,eAAe,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aACtE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC;CACH,CAAC,CAAC;AAEL,MAAM,aAAa,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC7D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,+DAA+D;IAC/D,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC"}

package/lib/Cloudflare/Account/Account.d.ts

@@ -0,0 +1,136 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+declare const AccountTypeId: "Cloudflare.Account";
+type AccountTypeId = typeof AccountTypeId;
+/**
+ * The kind of Cloudflare account. Cannot be changed after creation.
+ */
+export type AccountType = "standard" | "enterprise";
+export interface AccountProps {
+    /**
+     * Account name (display name). Mutable in place. If omitted, a unique
+     * name is generated from the app, stage, and logical ID.
+     * @default ${app}-${stage}-${id}
+     */
+    name?: string;
+    /**
+     * The kind of account to create. Cannot be changed after creation —
+     * Cloudflare rejects type changes (`UpdateAccountTypeNotSupported`), so
+     * updating this property triggers a replacement.
+     * @default "standard"
+     */
+    type?: AccountType;
+    /**
+     * Tenant unit to create the account under. Only meaningful for tenant /
+     * partner credentials; defaults to the tenant's root unit. Create-only —
+     * updating this property triggers a replacement.
+     *
+     * @see https://developers.cloudflare.com/tenant/how-to/manage-accounts/
+     */
+    unit?: {
+        /**
+         * The id of the tenant unit to create the account on.
+         */
+        id?: string;
+    };
+    /**
+     * Abuse contact email address for the account
+     * (`settings.abuse_contact_email`). Mutable in place. When omitted, the
+     * setting is left unmanaged (an existing value is not cleared).
+     */
+    abuseContactEmail?: string;
+    /**
+     * Whether membership in this account requires that two-factor
+     * authentication is enabled (`settings.enforce_twofactor`). Mutable in
+     * place. When omitted, the setting is left unmanaged.
+     * @default false
+     */
+    enforceTwofactor?: boolean;
+}
+export interface AccountAttributes {
+    /**
+     * Account identifier tag assigned by Cloudflare.
+     */
+    accountId: string;
+    /**
+     * Account name (display name).
+     */
+    name: string;
+    /**
+     * The kind of account.
+     */
+    type: AccountType;
+    /**
+     * Timestamp for the creation of the account.
+     */
+    createdOn: string | undefined;
+    /**
+     * Id of the tenant organization the account is managed by, if any.
+     */
+    parentOrgId: string | undefined;
+    /**
+     * Name of the tenant organization the account is managed by, if any.
+     */
+    parentOrgName: string | undefined;
+    /**
+     * Abuse contact email address configured on the account, if any.
+     */
+    abuseContactEmail: string | undefined;
+    /**
+     * Whether membership in the account requires two-factor authentication.
+     */
+    enforceTwofactor: boolean;
+}
+export type Account = Resource<AccountTypeId, AccountProps, AccountAttributes, never, Providers>;
+/**
+ * A Cloudflare account (subaccount), for tenant / partner platforms that
+ * provision an account per customer.
+ *
+ * Creating accounts (`POST /accounts`) is restricted to credentials with the
+ * tenant entitlement — a standard user receives the typed
+ * `AccountCreationForbidden` error (Cloudflare error code 1002). The `name`
+ * and account settings are mutable in place; `type` and the tenant `unit`
+ * are create-only and trigger a replacement. Deleting the resource queues
+ * the account for deletion (also tenant-gated).
+ *
+ * The account's physical identity is the Cloudflare-assigned `accountId`.
+ * Account names are not unique, so there is no find-by-name fallback: if
+ * state is lost, the account is treated as missing rather than guessed at.
+ * @resource
+ * @product Accounts
+ * @category Account & Identity
+ * @section Creating an account
+ * @example Standard subaccount with a generated name
+ * ```typescript
+ * const account = yield* Cloudflare.Account("CustomerAccount", {});
+ * ```
+ *
+ * @example Subaccount on a specific tenant unit
+ * ```typescript
+ * const account = yield* Cloudflare.Account("CustomerAccount", {
+ *   name: "Customer: ACME Inc",
+ *   unit: { id: tenantUnitId },
+ * });
+ * ```
+ *
+ * @section Account settings
+ * @example Enforce two-factor authentication for all members
+ * ```typescript
+ * const account = yield* Cloudflare.Account("CustomerAccount", {
+ *   name: "Customer: ACME Inc",
+ *   enforceTwofactor: true,
+ *   abuseContactEmail: "abuse@acme.example",
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/tenant/how-to/manage-accounts/
+ */
+export declare const Account: import("../../Resource.ts").ResourceClass<Account>;
+/**
+ * Returns true if the given value is an Account resource.
+ */
+export declare const isAccount: (value: unknown) => value is Account;
+export declare const AccountProvider: () => import("effect/Layer").Layer<Provider.Provider<Account>, never, import("@distilled.cloud/cloudflare").Credentials | import("effect/unstable/http/HttpClient").HttpClient | import("../../Stack.ts").Stack | import("../../Stage.ts").Stage>;
+export {};
+//# sourceMappingURL=Account.d.ts.map

package/lib/Cloudflare/Account/Account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Account.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Account/Account.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,QAAA,MAAM,aAAa,EAAG,oBAA6B,CAAC;AACpD,KAAK,aAAa,GAAG,OAAO,aAAa,CAAC;AAE1C;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,YAAY,CAAC;AAEpD,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE;QACL;;WAEG;QACH,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,IAAI,EAAE,WAAW,CAAC;IAClB;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC;;OAEG;IACH,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC;;OAEG;IACH,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;OAEG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,MAAM,OAAO,GAAG,QAAQ,CAC5B,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,eAAO,MAAM,OAAO,oDAAmC,CAAC;AAExD;;GAEG;AACH,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,KAAK,IAAI,OACkB,CAAC;AAEvE,eAAO,MAAM,eAAe,mPAuGxB,CAAC"}

package/lib/Cloudflare/Account/Account.js

@@ -0,0 +1,159 @@
+import * as accounts from "@distilled.cloud/cloudflare/accounts";
+import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+import * as Stream from "effect/Stream";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+const AccountTypeId = "Cloudflare.Account";
+/**
+ * A Cloudflare account (subaccount), for tenant / partner platforms that
+ * provision an account per customer.
+ *
+ * Creating accounts (`POST /accounts`) is restricted to credentials with the
+ * tenant entitlement — a standard user receives the typed
+ * `AccountCreationForbidden` error (Cloudflare error code 1002). The `name`
+ * and account settings are mutable in place; `type` and the tenant `unit`
+ * are create-only and trigger a replacement. Deleting the resource queues
+ * the account for deletion (also tenant-gated).
+ *
+ * The account's physical identity is the Cloudflare-assigned `accountId`.
+ * Account names are not unique, so there is no find-by-name fallback: if
+ * state is lost, the account is treated as missing rather than guessed at.
+ * @resource
+ * @product Accounts
+ * @category Account & Identity
+ * @section Creating an account
+ * @example Standard subaccount with a generated name
+ * ```typescript
+ * const account = yield* Cloudflare.Account("CustomerAccount", {});
+ * ```
+ *
+ * @example Subaccount on a specific tenant unit
+ * ```typescript
+ * const account = yield* Cloudflare.Account("CustomerAccount", {
+ *   name: "Customer: ACME Inc",
+ *   unit: { id: tenantUnitId },
+ * });
+ * ```
+ *
+ * @section Account settings
+ * @example Enforce two-factor authentication for all members
+ * ```typescript
+ * const account = yield* Cloudflare.Account("CustomerAccount", {
+ *   name: "Customer: ACME Inc",
+ *   enforceTwofactor: true,
+ *   abuseContactEmail: "abuse@acme.example",
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/tenant/how-to/manage-accounts/
+ */
+export const Account = Resource(AccountTypeId);
+/**
+ * Returns true if the given value is an Account resource.
+ */
+export const isAccount = (value) => Predicate.hasProperty(value, "Type") && value.Type === AccountTypeId;
+export const AccountProvider = () => Provider.succeed(Account, {
+    stables: ["accountId", "type", "createdOn", "parentOrgId", "parentOrgName"],
+    diff: Effect.fn(function* ({ olds, news, output }) {
+        if (!isResolved(news))
+            return undefined;
+        // The account type cannot be changed after creation — Cloudflare
+        // rejects it with `UpdateAccountTypeNotSupported`.
+        const oldType = output?.type ?? olds?.type ?? "standard";
+        if ((news.type ?? "standard") !== oldType) {
+            return { action: "replace" };
+        }
+        // The tenant unit is a create-only placement decision.
+        if ((olds?.unit?.id ?? undefined) !== (news.unit?.id ?? undefined)) {
+            return { action: "replace" };
+        }
+        return undefined;
+    }),
+    list: () => 
+    // `listAccounts` (GET /accounts) enumerates every account the API
+    // token can access — no scope input required. The list items carry
+    // the full account shape (settings + managedBy), so each maps
+    // directly to the same `Attributes` `read` produces with no
+    // per-item hydration. Paginate exhaustively.
+    accounts.listAccounts.pages({}).pipe(Stream.runCollect, Effect.map((chunk) => Array.from(chunk).flatMap((page) => (page.result ?? []).map((account) => toAttributes(account))))),
+    read: Effect.fn(function* ({ output }) {
+        // The physical identity is the Cloudflare-assigned account id —
+        // names are not unique, so there is no cold find-by-name fallback.
+        if (!output?.accountId)
+            return undefined;
+        const observed = yield* getAccount(output.accountId);
+        return observed ? toAttributes(observed) : undefined;
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output }) {
+        const name = news.name ?? (yield* createPhysicalName({ id, lowercase: true }));
+        // 1. Observe — the account id cached on `output` is a hint, not a
+        //    guarantee: a deleted account falls through to create.
+        let observed = output?.accountId
+            ? yield* getAccount(output.accountId)
+            : undefined;
+        // 2. Ensure — create when missing. Names are not unique on
+        //    Cloudflare's side, so there is no AlreadyExists race to
+        //    tolerate. Requires the tenant entitlement: a standard user
+        //    surfaces the typed `AccountCreationForbidden` (code 1002).
+        if (!observed) {
+            observed = yield* accounts.createAccount({
+                name,
+                type: news.type,
+                unit: news.unit,
+            });
+        }
+        // 3. Sync — diff observed cloud state against desired; skip the PUT
+        //    entirely on a no-op. Settings props left undefined are
+        //    unmanaged: the observed value is kept as-is.
+        const settings = observed.settings ?? undefined;
+        const nameDirty = observed.name !== name;
+        const abuseDirty = news.abuseContactEmail !== undefined &&
+            (settings?.abuseContactEmail ?? undefined) !== news.abuseContactEmail;
+        const twofactorDirty = news.enforceTwofactor !== undefined &&
+            (settings?.enforceTwofactor ?? false) !== news.enforceTwofactor;
+        if (nameDirty || abuseDirty || twofactorDirty) {
+            observed = yield* accounts.updateAccount({
+                accountId: observed.id,
+                id: observed.id,
+                name,
+                settings: abuseDirty || twofactorDirty
+                    ? {
+                        abuseContactEmail: news.abuseContactEmail,
+                        enforceTwofactor: news.enforceTwofactor,
+                    }
+                    : undefined,
+            });
+        }
+        return toAttributes(observed);
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        // Account deletion is queued / asynchronous on Cloudflare's side —
+        // a successful DELETE means "pending deletion", which is success for
+        // us. An already-gone (or already-pending) account surfaces as
+        // `InvalidRoute` (code 7003): that's success too.
+        yield* accounts
+            .deleteAccount({ accountId: output.accountId })
+            .pipe(Effect.catchTag("InvalidRoute", () => Effect.void));
+    }),
+});
+/**
+ * Read an account by id, mapping "gone" to `undefined`. A missing (or
+ * deletion-pending) account surfaces as `InvalidRoute` (Cloudflare error
+ * code 7003).
+ */
+const getAccount = (accountId) => accounts.getAccount({ accountId }).pipe(Effect.map((account) => account), Effect.catchTag("InvalidRoute", () => Effect.succeed(undefined)));
+const toAttributes = (account) => ({
+    accountId: account.id,
+    name: account.name,
+    // Distilled widens generated string enums to open unions (`string & {}`).
+    type: account.type,
+    createdOn: account.createdOn ?? undefined,
+    parentOrgId: account.managedBy?.parentOrgId ?? undefined,
+    parentOrgName: account.managedBy?.parentOrgName ?? undefined,
+    abuseContactEmail: account.settings?.abuseContactEmail ?? undefined,
+    enforceTwofactor: account.settings?.enforceTwofactor ?? false,
+});
+//# sourceMappingURL=Account.js.map

package/lib/Cloudflare/Account/Account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Account.js","sourceRoot":"","sources":["../../../src/Cloudflare/Account/Account.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,sCAAsC,CAAC;AACjE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAG7C,MAAM,aAAa,GAAG,oBAA6B,CAAC;AA6FpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAU,aAAa,CAAC,CAAC;AAExD;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAoB,EAAE,CAC5D,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC;AAEvE,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,EAAE,CAClC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE;IACxB,OAAO,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,CAAC;IAE3E,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,iEAAiE;QACjE,mDAAmD;QACnD,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,UAAU,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,OAAO,EAAE,CAAC;YAC1C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,uDAAuD;QACvD,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,SAAS,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,EAAE,GAAG,EAAE;IACT,kEAAkE;IAClE,mEAAmE;IACnE,8DAA8D;IAC9D,4DAA4D;IAC5D,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAClC,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAC5D,CACF,CACF;IAEH,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACnC,gEAAgE;QAChE,mEAAmE;QACnE,IAAI,CAAC,MAAM,EAAE,SAAS;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAClD,MAAM,IAAI,GACR,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEpE,kEAAkE;QAClE,2DAA2D;QAC3D,IAAI,QAAQ,GAAG,MAAM,EAAE,SAAS;YAC9B,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;YACrC,CAAC,CAAC,SAAS,CAAC;QAEd,2DAA2D;QAC3D,6DAA6D;QAC7D,gEAAgE;QAChE,gEAAgE;QAChE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACvC,IAAI;gBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QAED,oEAAoE;QACpE,4DAA4D;QAC5D,kDAAkD;QAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,SAAS,CAAC;QAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC;QACzC,MAAM,UAAU,GACd,IAAI,CAAC,iBAAiB,KAAK,SAAS;YACpC,CAAC,QAAQ,EAAE,iBAAiB,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC;QACxE,MAAM,cAAc,GAClB,IAAI,CAAC,gBAAgB,KAAK,SAAS;YACnC,CAAC,QAAQ,EAAE,gBAAgB,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,gBAAgB,CAAC;QAElE,IAAI,SAAS,IAAI,UAAU,IAAI,cAAc,EAAE,CAAC;YAC9C,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACvC,SAAS,EAAE,QAAQ,CAAC,EAAE;gBACtB,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,IAAI;gBACJ,QAAQ,EACN,UAAU,IAAI,cAAc;oBAC1B,CAAC,CAAC;wBACE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;wBACzC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;qBACxC;oBACH,CAAC,CAAC,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,mEAAmE;QACnE,qEAAqE;QACrE,+DAA+D;QAC/D,kDAAkD;QAClD,KAAK,CAAC,CAAC,QAAQ;aACZ,aAAa,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;aAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC;CACH,CAAC,CAAC;AAYL;;;;GAIG;AACH,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,EAAE,CACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CACrC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAA+B,EAAE,CAAC,OAAO,CAAC,EAC7D,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACjE,CAAC;AAEJ,MAAM,YAAY,GAAG,CAAC,OAAwB,EAAqB,EAAE,CAAC,CAAC;IACrE,SAAS,EAAE,OAAO,CAAC,EAAE;IACrB,IAAI,EAAE,OAAO,CAAC,IAAI;IAClB,0EAA0E;IAC1E,IAAI,EAAE,OAAO,CAAC,IAAmB;IACjC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,SAAS;IACzC,WAAW,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW,IAAI,SAAS;IACxD,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,IAAI,SAAS;IAC5D,iBAAiB,EAAE,OAAO,CAAC,QAAQ,EAAE,iBAAiB,IAAI,SAAS;IACnE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE,gBAAgB,IAAI,KAAK;CAC9D,CAAC,CAAC"}