alchemy 2.0.0-beta.76 → 2.0.0-beta.77

package/lib/Alchemist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Alchemist/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACrC,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,IAAI,EACJ,oBAAoB,EACpB,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,MAAM,GACZ,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,GAAG,MAAM,iBAAiB,CAAC;AACvC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAC;AAC3C,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAC;AACzC,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAC/C,OAAO,KAAK,QAAQ,MAAM,sBAAsB,CAAC;AACjD,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAC;AAC3C,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAC"}

package/lib/Alchemist/index.js

@@ -0,0 +1,15 @@
+export * from "./Errors.js";
+export * from "./Progress.js";
+export { layer } from "./Runtime.js";
+export { routeCacheLayer, DEFAULT_ENTRYPOINT, open, StackEntrypointError, } from "./Session.js";
+export * as Aws from "./routes/aws.js";
+export * as Cloudflare from "./routes/cloudflare.js";
+export * as CloudflareToken from "./routes/cloudflareToken.js";
+export * as Drift from "./routes/drift.js";
+export * as Logs from "./routes/logs.js";
+export * as Nuke from "./routes/nuke.js";
+export * as Profile from "./routes/profile.js";
+export * as Provider from "./routes/provider.js";
+export * as Stack from "./routes/stack.js";
+export * as State from "./routes/state.js";
+//# sourceMappingURL=index.js.map

package/lib/Alchemist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Alchemist/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACrC,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,IAAI,EACJ,oBAAoB,GAKrB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,GAAG,MAAM,iBAAiB,CAAC;AACvC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAC;AAC3C,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAC;AACzC,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAC/C,OAAO,KAAK,QAAQ,MAAM,sBAAsB,CAAC;AACjD,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAC;AAC3C,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAC"}

package/lib/Alchemist/routes/aws.d.ts

@@ -0,0 +1,21 @@
+import * as Effect from "effect/Effect";
+import { AuthError } from "../../Auth/AuthProvider.ts";
+import type { Target } from "../Session.ts";
+export interface AwsTarget extends Target {
+    readonly profile: string;
+    readonly region?: string;
+}
+/** Provision the AWS deployment assets bucket. */
+export declare const bootstrap: (target: AwsTarget) => Effect.Effect<{
+    bucketName: string;
+    created: boolean;
+    accountId: string;
+    region: string;
+}, import("@distilled.cloud/aws/Errors").AccessDeniedException | AuthError | import("@distilled.cloud/aws/s3").BucketAlreadyExists | import("@distilled.cloud/aws/Errors").EndpointError | import("@distilled.cloud/aws/Errors").ExpiredTokenException | import("@distilled.cloud/aws/s3").IllegalLocationConstraintException | import("@distilled.cloud/aws/Errors").IncompleteSignature | import("@distilled.cloud/aws/Errors").InternalFailure | import("@distilled.cloud/aws/s3").InvalidArgument | import("@distilled.cloud/aws/s3").InvalidBucketName | import("@distilled.cloud/aws/s3").InvalidLocationConstraint | import("@distilled.cloud/aws/Errors").MalformedHttpRequestException | import("@distilled.cloud/aws/Errors").NoMatchingRuleError | import("@distilled.cloud/aws/s3").NoSuchBucket | import("@distilled.cloud/aws/Errors").NotAuthorized | import("@distilled.cloud/aws/s3").NotFound | import("@distilled.cloud/aws/Errors").OperationAborted | import("@distilled.cloud/aws/Errors").OptInRequired | import("@distilled.cloud/aws/s3").ParseError | import("@distilled.cloud/aws/s3").PermanentRedirect | import("@distilled.cloud/aws/Errors").RequestAbortedException | import("@distilled.cloud/aws/Errors").RequestEntityTooLargeException | import("@distilled.cloud/aws/s3").RequestError | import("@distilled.cloud/aws/Errors").RequestExpired | import("@distilled.cloud/aws/s3").RequestLimitExceeded | import("@distilled.cloud/aws/Errors").RequestTimeoutException | import("@distilled.cloud/aws/Errors").ServiceUnavailable | import("@distilled.cloud/aws/s3").SlowDown | import("@distilled.cloud/aws/Errors").ThrottlingException | import("@distilled.cloud/aws/Errors").UnknownAwsError | import("@distilled.cloud/aws/Errors").UnknownOperationException | import("@distilled.cloud/aws/Errors").UnrecognizedClientException | import("@distilled.cloud/aws/Errors").ValidationError | import("@distilled.cloud/aws/Errors").ValidationException | import("@distilled.cloud/aws/Credentials").CredentialsError, import("effect/FileSystem").FileSystem | import("effect/unstable/http/HttpClient").HttpClient | import("effect/Path").Path>;
+/** Destroy every Alchemy bootstrap bucket in the region. */
+export declare const teardown: (target: AwsTarget) => Effect.Effect<{
+    accountId: string;
+    region: string;
+    destroyed: string[];
+}, import("@distilled.cloud/aws/Errors").AccessDeniedException | AuthError | import("@distilled.cloud/aws/s3").BucketHasAccessPointsAttached | import("@distilled.cloud/aws/s3").BucketNotEmpty | import("@distilled.cloud/aws/Errors").EndpointError | import("@distilled.cloud/aws/Errors").ExpiredTokenException | import("@distilled.cloud/aws/Errors").IncompleteSignature | import("@distilled.cloud/aws/Errors").InternalFailure | import("@distilled.cloud/aws/Errors").MalformedHttpRequestException | import("@distilled.cloud/aws/Errors").NoMatchingRuleError | import("@distilled.cloud/aws/s3").NoSuchBucket | import("@distilled.cloud/aws/Errors").NotAuthorized | import("@distilled.cloud/aws/Errors").OperationAborted | import("@distilled.cloud/aws/Errors").OptInRequired | import("@distilled.cloud/aws/s3").PermanentRedirect | import("@distilled.cloud/aws/Errors").RequestAbortedException | import("@distilled.cloud/aws/Errors").RequestEntityTooLargeException | import("@distilled.cloud/aws/s3").RequestError | import("@distilled.cloud/aws/Errors").RequestExpired | import("@distilled.cloud/aws/s3").RequestLimitExceeded | import("@distilled.cloud/aws/Errors").RequestTimeoutException | import("@distilled.cloud/aws/Errors").ServiceUnavailable | import("@distilled.cloud/aws/s3").SlowDown | import("@distilled.cloud/aws/Errors").ThrottlingException | import("@distilled.cloud/aws/Errors").UnknownAwsError | import("@distilled.cloud/aws/Errors").UnknownOperationException | import("@distilled.cloud/aws/Errors").UnrecognizedClientException | import("@distilled.cloud/aws/Errors").ValidationError | import("@distilled.cloud/aws/Errors").ValidationException | import("@distilled.cloud/aws/Credentials").CredentialsError, import("effect/FileSystem").FileSystem | import("effect/unstable/http/HttpClient").HttpClient | import("effect/Path").Path>;
+//# sourceMappingURL=aws.d.ts.map

package/lib/Alchemist/routes/aws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../../src/Alchemist/routes/aws.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAUvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,MAAM,WAAW,SAAU,SAAQ,MAAM;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AA8CD,kDAAkD;AAClD,eAAO,MAAM,SAAS;;;;;4jEAMrB,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,QAAQ;;;;8yDAUnB,CAAC"}

package/lib/Alchemist/routes/aws.js

@@ -0,0 +1,54 @@
+import * as Auth from "@distilled.cloud/aws/Auth";
+import * as EffectConsole from "effect/Console";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import { AuthError } from "../../Auth/AuthProvider.js";
+import { silentConsole } from "../../AWS/AuthProvider.js";
+import { bootstrap as bootstrapAws, destroyBootstrap as destroyBootstrapAws, } from "../../AWS/Bootstrap.js";
+import * as AWSCredentials from "../../AWS/Credentials.js";
+import { AWSEnvironment } from "../../AWS/Environment.js";
+import * as AWSRegion from "../../AWS/Region.js";
+import { loadConfigProvider } from "../../Util/ConfigProvider.js";
+const environment = Effect.fn(function* (target) {
+    const ssoProfile = yield* Auth.loadProfile(target.profile);
+    if (!ssoProfile.sso_account_id) {
+        return yield* Effect.fail(new AuthError({
+            message: `AWS SSO profile '${target.profile}' is missing sso_account_id`,
+        }));
+    }
+    const region = target.region ?? ssoProfile.region ?? "us-east-1";
+    // The credentials effect runs later, inside the built layer, where these
+    // services are no longer in context — capture them here so the route's
+    // requirements stay visible in its type.
+    const credentialServices = yield* Effect.context();
+    const aws = Layer.provideMerge(Layer.mergeAll(AWSRegion.fromEnvironment, AWSCredentials.fromEnvironment), Layer.succeed(AWSEnvironment, Effect.succeed({
+        accountId: ssoProfile.sso_account_id,
+        region,
+        credentials: Auth.loadProfileCredentials(target.profile).pipe(Effect.provideService(EffectConsole.Console, silentConsole), Effect.provide(credentialServices)),
+        profile: target.profile,
+    })));
+    return {
+        accountId: ssoProfile.sso_account_id,
+        region,
+        layer: Layer.provide(aws, ConfigProvider.layer(yield* loadConfigProvider(Option.fromNullishOr(target.envFile)))),
+    };
+});
+/** Provision the AWS deployment assets bucket. */
+export const bootstrap = Effect.fn("Alchemist.provider.aws.bootstrap")(function* (target) {
+    const env = yield* environment(target);
+    const result = yield* Effect.provide(bootstrapAws(), env.layer);
+    return { accountId: env.accountId, region: env.region, ...result };
+});
+/** Destroy every Alchemy bootstrap bucket in the region. */
+export const teardown = Effect.fn("Alchemist.provider.aws.teardown")(function* (target) {
+    const env = yield* environment(target);
+    const result = yield* Effect.provide(destroyBootstrapAws(), env.layer);
+    return {
+        accountId: env.accountId,
+        region: env.region,
+        destroyed: result.bucketNames,
+    };
+});
+//# sourceMappingURL=aws.js.map

package/lib/Alchemist/routes/aws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../src/Alchemist/routes/aws.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,2BAA2B,CAAC;AAClD,OAAO,KAAK,aAAa,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,cAAc,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EACL,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,GACxC,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,cAAc,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,SAAS,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAQlE,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAiB;IACxD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CAAC;YACZ,OAAO,EAAE,oBAAoB,MAAM,CAAC,OAAO,6BAA6B;SACzE,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,IAAI,WAAW,CAAC;IACjE,yEAAyE;IACzE,uEAAuE;IACvE,yCAAyC;IACzC,MAAM,kBAAkB,GACtB,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAElB,CAAC;IACN,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAC5B,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,cAAc,CAAC,eAAe,CAAC,EACzE,KAAK,CAAC,OAAO,CACX,cAAc,EACd,MAAM,CAAC,OAAO,CAAC;QACb,SAAS,EAAE,UAAU,CAAC,cAAc;QACpC,MAAM;QACN,WAAW,EAAE,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,EAC3D,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CACnC;QACD,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CACH,CACF,CAAC;IACF,OAAO;QACL,SAAS,EAAE,UAAU,CAAC,cAAc;QACpC,MAAM;QACN,KAAK,EAAE,KAAK,CAAC,OAAO,CAClB,GAAG,EACH,cAAc,CAAC,KAAK,CAClB,KAAK,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAChE,CACF;KACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,kDAAkD;AAClD,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CACpE,QAAQ,CAAC,EAAE,MAAiB;IAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;AACrE,CAAC,CACF,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC,EAC5E,MAAiB;IAEjB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS,EAAE,MAAM,CAAC,WAAW;KAC9B,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/lib/Alchemist/routes/cloudflare.d.ts

@@ -0,0 +1,63 @@
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import { AuthProviders } from "../../Auth/AuthProvider.ts";
+import * as CloudflareAccess from "../../Cloudflare/Access.ts";
+import * as CloudflareEnvironment from "../../Cloudflare/CloudflareEnvironment.ts";
+import * as CloudflareCredentials from "../../Cloudflare/Credentials.ts";
+import type { Target } from "../Session.ts";
+import type { LogEntry } from "./logs.ts";
+export interface StateTarget extends Target {
+    /** State-store worker to act on. @default the managed state-store worker */
+    readonly workerName?: string;
+}
+export interface BootstrapInput extends StateTarget {
+    readonly force?: boolean;
+}
+export interface StateLogsInput extends StateTarget {
+    readonly limit?: number;
+    readonly since?: Date;
+}
+/**
+ * Resolve the profile, Cloudflare account, and provider layer every
+ * state-store route (`bootstrap`, `teardown`, logs) is scoped to.
+ */
+export declare const resolveStateStoreScope: (target: StateTarget) => Effect.Effect<{
+    layer: Layer.Layer<CloudflareAccess.Access | AuthProviders | CloudflareEnvironment.CloudflareEnvironment | CloudflareCredentials.Credentials, import("../../Auth/AuthProvider.ts").AuthError | import("effect/Config").ConfigError | import("../../Auth/Profile.ts").MissingProviderConfig | import("effect/PlatformError").PlatformError | import("../../Auth/Profile.ts").ProfileError, import("../../AlchemyContext.ts").AlchemyContext | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("../../Auth/Credentials.ts").CredentialsStore | import("effect/Crypto").Crypto | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("../../Auth/Profile.ts").ProfileStore>;
+    profile: string;
+    accountId: string;
+    workerName: string;
+}, import("../../Auth/AuthProvider.ts").AuthError | import("effect/Config").ConfigError | import("../../Auth/Profile.ts").MissingProviderConfig | import("effect/PlatformError").PlatformError | import("../../Auth/Profile.ts").ProfileError, import("../../AlchemyContext.ts").AlchemyContext | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("../../Auth/Credentials.ts").CredentialsStore | import("effect/Crypto").Crypto | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("../../Auth/Profile.ts").ProfileStore>;
+/** Provision (or adopt) the Cloudflare-hosted state-store worker. */
+export declare const bootstrap: (input: BootstrapInput) => Effect.Effect<{
+    accountId: string;
+    workerName: string;
+    status: "adopted" | "created" | "redeployed";
+    credentialsRefreshed: boolean;
+    stateStoreVersion: number;
+}, CloudflareAccess.AccessError | import("../../Auth/AuthProvider.ts").AuthError | import("@distilled.cloud/cloudflare").CloudflareError | import("@distilled.cloud/cloudflare").CloudflareHttpError | import("@distilled.cloud/cloudflare").CloudflareParseError | import("@distilled.cloud/cloudflare").CloudflareRateLimited | import("effect/Config").ConfigError | import("@distilled.cloud/fly-io").ConfigError | import("../../Auth/Demand.ts").CredentialsRequired | import("../../Apply.ts").DestroyError | workers.Forbidden | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/cloudflare/secrets-store").InvalidAccountId | import("../../Output.ts").InvalidReferenceError | import("@distilled.cloud/cloudflare").InvalidRoute | workers.InvalidRoute | import("../../Auth/Profile.ts").MissingProviderConfig | import("../../Output.ts").MissingSourceError | import("../../Auth/AuthProvider.ts").NeedsReauth | import("@distilled.cloud/cloudflare").OAuthRefreshError | import("effect/PlatformError").PlatformError | import("../../Auth/Profile.ts").ProfileError | import("../../State/State.ts").StateStoreError | {
+    readonly _tag: "StateStoreVersionNotReady";
+    readonly expected: number;
+    readonly observed: number | undefined;
+    name: string;
+    message: string;
+    stack?: string;
+    cause?: unknown;
+    readonly "~effect/Runtime/errorExitCode"?: number;
+    readonly "~effect/Runtime/errorReported"?: boolean;
+    readonly "~effect/ErrorReporter/ignore"?: boolean;
+    readonly "~effect/ErrorReporter/severity"?: import("effect/LogLevel").Severity;
+    readonly "~effect/ErrorReporter/attributes"?: import("effect/Record").ReadonlyRecord<string, unknown>;
+} | workers.SubdomainNotFound | import("@distilled.cloud/cloudflare").UnknownCloudflareError | import("@distilled.cloud/planetscale").DefaultErrors, import("../../AlchemyContext.ts").AlchemyContext | import("../../Artifacts.ts").ArtifactStore | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("../../Auth/Credentials.ts").CredentialsStore | import("effect/Crypto").Crypto | import("effect/FileSystem").FileSystem | import("effect/unstable/http/HttpClient").HttpClient | import("../../Interaction.ts").Interaction | import("effect/Path").Path | import("../../Auth/Profile.ts").ProfileStore>;
+/** Tear down the Cloudflare-hosted state store. */
+export declare const teardown: (input: StateTarget) => Effect.Effect<{
+    accountId: string;
+    workerName: string;
+    deleted: string[];
+}, import("../../Auth/AuthProvider.ts").AuthError | import("effect/Config").ConfigError | import("../../Auth/Profile.ts").MissingProviderConfig | import("effect/PlatformError").PlatformError | import("../../Auth/Profile.ts").ProfileError | workers.QueueConsumerConflict | workers.ServiceBindingConflict | workers.CloudflareOpError, import("../../AlchemyContext.ts").AlchemyContext | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("../../Auth/Credentials.ts").CredentialsStore | import("effect/Crypto").Crypto | import("effect/FileSystem").FileSystem | import("effect/unstable/http/HttpClient").HttpClient | import("../../Interaction.ts").Interaction | import("effect/Path").Path | import("../../Auth/Profile.ts").ProfileStore>;
+/** Query past log entries from the state-store worker, oldest first. */
+export declare const stateLogs: (input: StateLogsInput) => Effect.Effect<LogEntry[], import("../../Auth/AuthProvider.ts").AuthError | import("effect/Config").ConfigError | import("../../Auth/Profile.ts").MissingProviderConfig | import("effect/PlatformError").PlatformError | import("../../Auth/Profile.ts").ProfileError | workers.QueryObservabilityTelemetryError, import("../../AlchemyContext.ts").AlchemyContext | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("../../Auth/Credentials.ts").CredentialsStore | import("effect/Crypto").Crypto | import("effect/FileSystem").FileSystem | import("effect/unstable/http/HttpClient").HttpClient | import("effect/Path").Path | import("../../Auth/Profile.ts").ProfileStore>;
+/** Live-stream log entries from the state-store worker. */
+export declare const tailStateLogs: (input: StateTarget) => Stream.Stream<LogEntry, import("../../Auth/AuthProvider.ts").AuthError | import("effect/Config").ConfigError | import("../../Auth/Profile.ts").MissingProviderConfig | import("effect/PlatformError").PlatformError | import("../../Auth/Profile.ts").ProfileError | workers.CreateScriptTailError, import("../../AlchemyContext.ts").AlchemyContext | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("../../Auth/Credentials.ts").CredentialsStore | import("effect/Crypto").Crypto | import("effect/FileSystem").FileSystem | import("effect/unstable/http/HttpClient").HttpClient | import("effect/Path").Path | import("../../Auth/Profile.ts").ProfileStore | import("effect/unstable/socket/Socket").WebSocketConstructor>;
+//# sourceMappingURL=cloudflare.d.ts.map

package/lib/Alchemist/routes/cloudflare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../../src/Alchemist/routes/cloudflare.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,qCAAqC,CAAC;AAE/D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAE3D,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAC;AAE/D,OAAO,KAAK,qBAAqB,MAAM,2CAA2C,CAAC;AACnF,OAAO,KAAK,qBAAqB,MAAM,iCAAiC,CAAC;AASzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,WAAW,WAAY,SAAQ,MAAM;IACzC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;CACvB;AA4CD;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;yjBAkBjC,CAAC;AAEH,qEAAqE;AACrE,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;gnBAgCrB,CAAC;AAEF,mDAAmD;AACnD,eAAO,MAAM,QAAQ;;;;0vBAOpB,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,SAAS,+sBAuBrB,CAAC;AAEF,2DAA2D;AAC3D,eAAO,MAAM,aAAa,UAAW,WAAW,yuBAW7C,CAAC"}

package/lib/Alchemist/routes/cloudflare.js

@@ -0,0 +1,113 @@
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Option from "effect/Option";
+import * as Stream from "effect/Stream";
+import { AuthProviders } from "../../Auth/AuthProvider.js";
+import { resolveProfileName, withProfileOverride } from "../../Auth/Resolve.js";
+import * as CloudflareAccess from "../../Cloudflare/Access.js";
+import { CloudflareAuth } from "../../Cloudflare/Auth/AuthProvider.js";
+import * as CloudflareEnvironment from "../../Cloudflare/CloudflareEnvironment.js";
+import * as CloudflareCredentials from "../../Cloudflare/Credentials.js";
+import { CloudflareLogs } from "../../Cloudflare/Logs.js";
+import { STATE_STORE_SCRIPT_NAME } from "../../Cloudflare/StateStore/Api.js";
+import { bootstrap as bootstrapStateStore, teardownStateStore, } from "../../Cloudflare/StateStore/State.js";
+import { loadConfigProvider } from "../../Util/ConfigProvider.js";
+import { fileLogger } from "../../Util/FileLogger.js";
+const logEntry = (scriptName, line) => ({
+    resource: {
+        fqn: scriptName,
+        logicalId: scriptName,
+        resourceType: "Cloudflare.Worker",
+    },
+    timestamp: line.timestamp,
+    message: line.message,
+});
+const services = Effect.fn(function* (target) {
+    const auth = Layer.provideMerge(CloudflareAuth, Layer.succeed(AuthProviders, {}));
+    // `provideMerge` (not `mergeAll`) so `fromProfile` / `fromAuthProvider`
+    // actually *see* `--profile`. Sibling-merging ConfigProvider left those
+    // layers requiring it from the outer CLI `fromEnv()` — which is how
+    // `alchemy provider cloudflare bootstrap --profile <name>` ignored the
+    // flag and resolved the default profile (#252).
+    const config = ConfigProvider.layer(withProfileOverride(yield* loadConfigProvider(Option.fromNullishOr(target.envFile)), target.profile));
+    return Layer.mergeAll(Layer.provideMerge(Layer.mergeAll(CloudflareCredentials.fromAuthProvider(), CloudflareEnvironment.fromProfile(), CloudflareAccess.AccessLive), auth).pipe(Layer.provideMerge(config)), Logger.layer([fileLogger("cloudflare.txt")], { mergeWithExisting: true }));
+});
+/**
+ * Resolve the profile, Cloudflare account, and provider layer every
+ * state-store route (`bootstrap`, `teardown`, logs) is scoped to.
+ */
+export const resolveStateStoreScope = Effect.fn(function* (target) {
+    const profile = yield* resolveProfileName(Option.fromNullishOr(target.envFile), target.profile);
+    const resolved = { ...target, profile };
+    const layer = yield* services(resolved);
+    const { accountId } = yield* Effect.flatten(CloudflareEnvironment.CloudflareEnvironment).pipe(Effect.provide(layer));
+    return {
+        layer,
+        profile,
+        accountId,
+        workerName: target.workerName ?? STATE_STORE_SCRIPT_NAME,
+    };
+});
+/** Provision (or adopt) the Cloudflare-hosted state-store worker. */
+export const bootstrap = Effect.fn("Alchemist.provider.cloudflare.bootstrap")(function* (input) {
+    const { layer, accountId, workerName, profile } = yield* resolveStateStoreScope(input);
+    return yield* Effect.gen(function* () {
+        const existed = yield* workers
+            .getScriptSetting({ accountId, scriptName: workerName })
+            .pipe(Effect.as(true), Effect.catchTag(["WorkerNotFound", "InvalidRoute", "WorkerHasNoVersions"], () => Effect.succeed(false)));
+        const state = yield* bootstrapStateStore({
+            workerName,
+            force: input.force,
+            profile,
+        });
+        return {
+            accountId,
+            workerName,
+            status: !existed
+                ? "created"
+                : input.force
+                    ? "redeployed"
+                    : "adopted",
+            credentialsRefreshed: true,
+            stateStoreVersion: yield* state.getVersion(),
+        };
+    }).pipe(Effect.provide(layer));
+});
+/** Tear down the Cloudflare-hosted state store. */
+export const teardown = Effect.fn("Alchemist.provider.cloudflare.teardown")(function* (input) {
+    const { layer, accountId, workerName, profile } = yield* resolveStateStoreScope(input);
+    yield* Effect.provide(teardownStateStore({ workerName, profile }), layer);
+    return { accountId, workerName, deleted: [workerName] };
+});
+/** Query past log entries from the state-store worker, oldest first. */
+export const stateLogs = Effect.fn("Alchemist.provider.cloudflare.stateLogs")(function* (input) {
+    const { layer, accountId, workerName } = yield* resolveStateStoreScope(input);
+    const lines = yield* Effect.gen(function* () {
+        const telemetry = yield* CloudflareLogs;
+        return yield* telemetry.queryLogs({
+            accountId,
+            filters: [
+                {
+                    key: "$workers.scriptName",
+                    operation: "eq",
+                    type: "string",
+                    value: workerName,
+                },
+            ],
+            options: { limit: input.limit ?? 100, since: input.since },
+        });
+    }).pipe(Effect.provide(layer));
+    return lines
+        .map((line) => logEntry(workerName, line))
+        .sort((a, b) => a.timestamp.getTime() - b.timestamp.getTime());
+});
+/** Live-stream log entries from the state-store worker. */
+export const tailStateLogs = (input) => Stream.unwrap(Effect.gen(function* () {
+    const { layer, accountId, workerName } = yield* resolveStateStoreScope(input);
+    const telemetry = yield* Effect.provide(CloudflareLogs, layer);
+    return telemetry.tailScript({ accountId, scriptName: workerName }).pipe(Stream.provide(layer), Stream.map((line) => logEntry(workerName, line)));
+}));
+//# sourceMappingURL=cloudflare.js.map

package/lib/Alchemist/routes/cloudflare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../../src/Alchemist/routes/cloudflare.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,qCAAqC,CAAC;AAC/D,OAAO,KAAK,cAAc,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,KAAK,qBAAqB,MAAM,2CAA2C,CAAC;AACnF,OAAO,KAAK,qBAAqB,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EACL,SAAS,IAAI,mBAAmB,EAChC,kBAAkB,GACnB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAkBtD,MAAM,QAAQ,GAAG,CACf,UAAkB,EAClB,IAA4D,EAClD,EAAE,CAAC,CAAC;IACd,QAAQ,EAAE;QACR,GAAG,EAAE,UAAU;QACf,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,mBAAmB;KAClC;IACD,SAAS,EAAE,IAAI,CAAC,SAAS;IACzB,OAAO,EAAE,IAAI,CAAC,OAAO;CACtB,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAmB;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAC7B,cAAc,EACd,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAqC,CAAC,CACpE,CAAC;IACF,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,gDAAgD;IAChD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CACjC,mBAAmB,CACjB,KAAK,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAC/D,MAAM,CAAC,OAAO,CACf,CACF,CAAC;IACF,OAAO,KAAK,CAAC,QAAQ,CACnB,KAAK,CAAC,YAAY,CAChB,KAAK,CAAC,QAAQ,CACZ,qBAAqB,CAAC,gBAAgB,EAAE,EACxC,qBAAqB,CAAC,WAAW,EAAE,EACnC,gBAAgB,CAAC,UAAU,CAC5B,EACD,IAAI,CACL,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAClC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAC1E,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACvD,MAAmB;IAEnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,kBAAkB,CACvC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EACpC,MAAM,CAAC,OAAO,CACf,CAAC;IACF,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACzC,qBAAqB,CAAC,qBAAqB,CAC5C,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9B,OAAO;QACL,KAAK;QACL,OAAO;QACP,SAAS;QACT,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,uBAAuB;KACzD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,yCAAyC,CAAC,CAC3E,QAAQ,CAAC,EAAE,KAAqB;IAC9B,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,GAC7C,KAAK,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO;aAC3B,gBAAgB,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;aACvD,IAAI,CACH,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EACf,MAAM,CAAC,QAAQ,CACb,CAAC,gBAAgB,EAAE,cAAc,EAAE,qBAAqB,CAAC,EACzD,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAC5B,CACF,CAAC;QACJ,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;YACvC,UAAU;YACV,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO;SACR,CAAC,CAAC;QACH,OAAO;YACL,SAAS;YACT,UAAU;YACV,MAAM,EAAE,CAAC,OAAO;gBACd,CAAC,CAAE,SAAmB;gBACtB,CAAC,CAAC,KAAK,CAAC,KAAK;oBACX,CAAC,CAAE,YAAsB;oBACzB,CAAC,CAAE,SAAmB;YAC1B,oBAAoB,EAAE,IAAI;YAC1B,iBAAiB,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE;SAC7C,CAAC;IACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACjC,CAAC,CACF,CAAC;AAEF,mDAAmD;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,wCAAwC,CAAC,CACzE,QAAQ,CAAC,EAAE,KAAkB;IAC3B,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,GAC7C,KAAK,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACvC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1E,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;AAC1D,CAAC,CACF,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,yCAAyC,CAAC,CAC3E,QAAQ,CAAC,EAAE,KAAqB;IAC9B,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GACpC,KAAK,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;QACxC,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC;YAChC,SAAS;YACT,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,qBAAqB;oBAC1B,SAAS,EAAE,IAAI;oBACf,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,UAAU;iBAClB;aACF;YACD,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;SAC3D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;SACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;AACnE,CAAC,CACF,CAAC;AAEF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAkB,EAAE,EAAE,CAClD,MAAM,CAAC,MAAM,CACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GACpC,KAAK,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CACrE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CACjD,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Alchemist/routes/cloudflareToken.d.ts

@@ -0,0 +1,93 @@
+import * as accounts from "@distilled.cloud/cloudflare/accounts";
+import * as user from "@distilled.cloud/cloudflare/user";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { type PermissionGroup, type TokenPolicy } from "../../Cloudflare/Auth/TokenPolicy.ts";
+import { AlchemistInvalidInput, type Diagnostic } from "../Errors.ts";
+export interface GlobalCredentials {
+    readonly email: string;
+    readonly apiKey: Redacted.Redacted<string>;
+}
+export interface Account {
+    readonly id: string;
+    readonly name: string;
+}
+export type { PermissionGroup, TokenPolicy, } from "../../Cloudflare/Auth/TokenPolicy.ts";
+export interface TokenCatalog {
+    readonly accounts: ReadonlyArray<Account>;
+    readonly permissionGroups: ReadonlyArray<PermissionGroup>;
+}
+export interface PlanInput {
+    readonly credentials: GlobalCredentials;
+    readonly name: string;
+    readonly accountIds: ReadonlyArray<string>;
+    readonly permissionGroupIds: ReadonlyArray<string> | "all";
+}
+export interface TokenPlan {
+    readonly name: string;
+    readonly accountIds: ReadonlyArray<string>;
+    readonly permissionGroupIds: ReadonlyArray<string>;
+    readonly permissionCount: number;
+    readonly grantsFullAccess: boolean;
+    readonly policies: ReadonlyArray<TokenPolicy>;
+}
+export interface CreateInput {
+    readonly credentials: GlobalCredentials;
+    readonly plan: TokenPlan;
+}
+export interface CreatedToken {
+    readonly id: string;
+    readonly name: string;
+    readonly value: Redacted.Redacted<string>;
+    readonly grantedPermissionGroups: number;
+    /** Echoed back by Cloudflare; may contain effects we never request. */
+    readonly policies: ReadonlyArray<unknown>;
+    readonly verificationStatus?: string;
+    readonly diagnostics: ReadonlyArray<Diagnostic>;
+}
+declare const CloudflareTokenError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "CloudflareTokenError";
+} & Readonly<A>;
+/** Cloudflare accepted the create call but returned no usable token. */
+export declare class CloudflareTokenError extends CloudflareTokenError_base<{
+    readonly message: string;
+}> {
+}
+/** The accounts and permission groups a token can be scoped to. */
+export declare const catalog: (credentials: GlobalCredentials) => Effect.Effect<{
+    accounts: {
+        id: string;
+        name: string;
+    }[];
+    permissionGroups: {
+        id: string;
+        name: string;
+        category: user.TokensPermissionGroupsListResultItemCategory | undefined;
+        scopes: user.TokensPermissionGroupsListResultItemScopesList;
+        selectable: boolean;
+    }[];
+}, accounts.CloudflareOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+/** Resolve the selected permission groups into concrete token policies. */
+export declare const plan: (input: PlanInput) => Effect.Effect<{
+    name: string;
+    accountIds: readonly string[];
+    permissionGroupIds: string[];
+    permissionCount: number;
+    grantsFullAccess: boolean;
+    policies: TokenPolicy[];
+}, AlchemistInvalidInput | accounts.CloudflareOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+/** Mint the planned token with the user's Global API Key. */
+export declare const create: (input: CreateInput) => Effect.Effect<{
+    id: string;
+    name: string;
+    value: Redacted.Redacted<string>;
+    grantedPermissionGroups: number;
+    policies: readonly TokenPolicy[] | user.TokensCreateResponsePoliciesList;
+    verificationStatus: user.TokensVerifyResponseStatus | undefined;
+    diagnostics: {
+        severity: "warning";
+        code: string;
+        message: string;
+    }[];
+}, CloudflareTokenError | user.CreateTokenError, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=cloudflareToken.d.ts.map

package/lib/Alchemist/routes/cloudflareToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflareToken.d.ts","sourceRoot":"","sources":["../../../src/Alchemist/routes/cloudflareToken.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,sCAAsC,CAAC;AAKjE,OAAO,KAAK,IAAI,MAAM,kCAAkC,CAAC;AAEzD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAEtE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,YAAY,EACV,eAAe,EACf,WAAW,GACZ,MAAM,sCAAsC,CAAC;AAE9C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;CAC5D;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CACjD;;;;AAED,wEAAwE;AACxE,qBAAa,oBAAqB,SAAQ,0BAExC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;CAAG;AAclC,mEAAmE;AACnE,eAAO,MAAM,OAAO;;;;;;;;;;;;oFAiCnB,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,IAAI;;;;;;;4GA0Cf,CAAC;AAEH,6DAA6D;AAC7D,eAAO,MAAM,MAAM;;;;;;;;kBAoCO,SAAS;;;;sGASlC,CAAC"}

package/lib/Alchemist/routes/cloudflareToken.js

@@ -0,0 +1,111 @@
+import * as accounts from "@distilled.cloud/cloudflare/accounts";
+import { apiKeyCredentials, apiTokenCredentials, } from "@distilled.cloud/cloudflare/Credentials";
+import * as user from "@distilled.cloud/cloudflare/user";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { selectableScopes, tokenPolicies, } from "../../Cloudflare/Auth/TokenPolicy.js";
+import * as CloudflareCredentials from "../../Cloudflare/Credentials.js";
+import { AlchemistInvalidInput } from "../Errors.js";
+/** Cloudflare accepted the create call but returned no usable token. */
+export class CloudflareTokenError extends Data.TaggedError("CloudflareTokenError") {
+}
+/** Authenticate the surrounding effect with the user's Global API Key. */
+const withGlobalKey = (credentials) => Effect.provideService(CloudflareCredentials.Credentials, Effect.succeed(apiKeyCredentials({
+    apiKey: Redacted.value(credentials.apiKey),
+    email: credentials.email,
+})));
+/** The accounts and permission groups a token can be scoped to. */
+export const catalog = Effect.fn("Alchemist.cloudflare.token.catalog")(
+// The credentials only authenticate the call, via the transformer below.
+function* (_credentials) {
+    const listAccounts = yield* accounts.listAccounts;
+    const listPermissionGroups = yield* user.listTokenPermissionGroups;
+    const { accountResponse, permissionGroupResponse } = yield* Effect.all({
+        accountResponse: listAccounts({}),
+        permissionGroupResponse: listPermissionGroups({}),
+    }, { concurrency: "unbounded" });
+    return {
+        accounts: accountResponse.result.map(({ id, name }) => ({
+            id,
+            name,
+        })),
+        permissionGroups: permissionGroupResponse.result.flatMap((group) => group.id && group.name && group.scopes?.length
+            ? [
+                {
+                    id: group.id,
+                    name: group.name,
+                    category: group.category ?? undefined,
+                    scopes: group.scopes,
+                    selectable: selectableScopes.has(group.scopes[0]),
+                },
+            ]
+            : []),
+    };
+}, (effect, credentials) => withGlobalKey(credentials)(effect));
+/** Resolve the selected permission groups into concrete token policies. */
+export const plan = Effect.fn("Alchemist.cloudflare.token.plan")(function* (input) {
+    const tokenCatalog = yield* catalog(input.credentials);
+    const selected = input.permissionGroupIds === "all"
+        ? tokenCatalog.permissionGroups
+        : yield* Effect.forEach(input.permissionGroupIds, (id) => {
+            const group = tokenCatalog.permissionGroups.find((candidate) => candidate.id === id);
+            if (group === undefined) {
+                return Effect.fail(new AlchemistInvalidInput({
+                    field: "permissionGroupIds",
+                    message: `Unknown Cloudflare permission group '${id}'.`,
+                }));
+            }
+            return Effect.succeed(group);
+        });
+    const currentUser = yield* user
+        .getUser({})
+        .pipe(withGlobalKey(input.credentials));
+    const resolved = tokenPolicies(input.accountIds, currentUser.id, selected);
+    if (resolved.length === 0) {
+        return yield* Effect.fail(new AlchemistInvalidInput({
+            field: "permissionGroupIds",
+            message: "No selected permission groups can be expressed as token policies.",
+        }));
+    }
+    return {
+        name: input.name,
+        accountIds: input.accountIds,
+        permissionGroupIds: selected.map(({ id }) => id),
+        permissionCount: selected.length,
+        grantsFullAccess: input.permissionGroupIds === "all",
+        policies: resolved,
+    };
+});
+/** Mint the planned token with the user's Global API Key. */
+export const create = Effect.fn("Alchemist.cloudflare.token.create")(function* (input) {
+    const result = yield* user.createToken({
+        name: input.plan.name,
+        policies: input.plan.policies,
+    });
+    if (!result.value) {
+        return yield* Effect.fail(new CloudflareTokenError({
+            message: "Cloudflare did not return a token value.",
+        }));
+    }
+    const granted = (result.policies ?? []).reduce((count, policy) => count + (policy.permissionGroups?.length ?? 0), 0);
+    const verificationStatus = yield* user.verifyToken({}).pipe(Effect.provideService(CloudflareCredentials.Credentials, Effect.succeed(apiTokenCredentials({ apiToken: result.value }))), Effect.map(({ status }) => status), Effect.catch(() => Effect.succeed(undefined)));
+    return {
+        id: result.id ?? "unknown",
+        name: result.name ?? input.plan.name,
+        value: Redacted.make(result.value),
+        grantedPermissionGroups: granted,
+        policies: result.policies ?? input.plan.policies,
+        verificationStatus,
+        diagnostics: granted === 0
+            ? [
+                {
+                    severity: "warning",
+                    code: "cloudflare.token.zero-permissions",
+                    message: "Cloudflare created the token with zero permissions.",
+                },
+            ]
+            : [],
+    };
+}, (effect, input) => withGlobalKey(input.credentials)(effect));
+//# sourceMappingURL=cloudflareToken.js.map

package/lib/Alchemist/routes/cloudflareToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflareToken.js","sourceRoot":"","sources":["../../../src/Alchemist/routes/cloudflareToken.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,sCAAsC,CAAC;AACjE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,IAAI,MAAM,kCAAkC,CAAC;AACzD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,aAAa,GAGd,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,qBAAqB,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAmB,MAAM,cAAc,CAAC;AAsDtE,wEAAwE;AACxE,MAAM,OAAO,oBAAqB,SAAQ,IAAI,CAAC,WAAW,CACxD,sBAAsB,CACO;CAAG;AAElC,0EAA0E;AAC1E,MAAM,aAAa,GAAG,CAAC,WAA8B,EAAE,EAAE,CACvD,MAAM,CAAC,cAAc,CACnB,qBAAqB,CAAC,WAAW,EACjC,MAAM,CAAC,OAAO,CACZ,iBAAiB,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,WAAW,CAAC,KAAK;CACzB,CAAC,CACH,CACF,CAAC;AAEJ,mEAAmE;AACnE,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,oCAAoC,CAAC;AACpE,yEAAyE;AACzE,QAAQ,CAAC,EAAE,YAA+B;IACxC,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;IAClD,MAAM,oBAAoB,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IACnE,MAAM,EAAE,eAAe,EAAE,uBAAuB,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACpE;QACE,eAAe,EAAE,YAAY,CAAC,EAAE,CAAC;QACjC,uBAAuB,EAAE,oBAAoB,CAAC,EAAE,CAAC;KAClD,EACD,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACtD,EAAE;YACF,IAAI;SACL,CAAC,CAAC;QACH,gBAAgB,EAAE,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACjE,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,MAAM;YAC5C,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,SAAS;oBACrC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;iBACnD;aACF;YACH,CAAC,CAAC,EAAE,CACP;KACqB,CAAC;AAC3B,CAAC,EACD,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAC5D,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC,EACxE,KAAgB;IAEhB,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,QAAQ,GACZ,KAAK,CAAC,kBAAkB,KAAK,KAAK;QAChC,CAAC,CAAC,YAAY,CAAC,gBAAgB;QAC/B,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,EAAE,EAAE,EAAE;YACrD,MAAM,KAAK,GAAG,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAC9C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CACnC,CAAC;YACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,qBAAqB,CAAC;oBACxB,KAAK,EAAE,oBAAoB;oBAC3B,OAAO,EAAE,wCAAwC,EAAE,IAAI;iBACxD,CAAC,CACH,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACT,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,IAAI;SAC5B,OAAO,CAAC,EAAE,CAAC;SACX,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EACL,mEAAmE;SACtE,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,kBAAkB,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QAChD,eAAe,EAAE,QAAQ,CAAC,MAAM;QAChC,gBAAgB,EAAE,KAAK,CAAC,kBAAkB,KAAK,KAAK;QACpD,QAAQ,EAAE,QAAQ;KACC,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,mCAAmC,CAAC,CAClE,QAAQ,CAAC,EAAE,KAAkB;IAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAyB;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,oBAAoB,CAAC;YACvB,OAAO,EAAE,0CAA0C;SACpD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5C,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,IAAI,CAAC,CAAC,EACjE,CAAC,CACF,CAAC;IACF,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,CACzD,MAAM,CAAC,cAAc,CACnB,qBAAqB,CAAC,WAAW,EACjC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAChE,EACD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAClC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAC9C,CAAC;IACF,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,SAAS;QAC1B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI;QACpC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAClC,uBAAuB,EAAE,OAAO;QAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ;QAChD,kBAAkB;QAClB,WAAW,EACT,OAAO,KAAK,CAAC;YACX,CAAC,CAAC;gBACE;oBACE,QAAQ,EAAE,SAAkB;oBAC5B,IAAI,EAAE,mCAAmC;oBACzC,OAAO,EAAE,qDAAqD;iBAC/D;aACF;YACH,CAAC,CAAC,EAAE;KACc,CAAC;AAC3B,CAAC,EACD,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAC5D,CAAC"}

package/lib/Alchemist/routes/drift.d.ts

@@ -0,0 +1,55 @@
+import * as Effect from "effect/Effect";
+import * as EngineDrift from "../../Drift.ts";
+import type { Plan } from "../../Plan.ts";
+import { type Session, type StackTarget } from "../Session.ts";
+import * as Stack from "./stack.ts";
+export interface DriftedResource {
+    readonly fqn: string;
+    readonly logicalId: string;
+    readonly resourceType: string;
+    readonly status: "in-sync" | "drifted" | "missing";
+    readonly actual?: unknown;
+}
+export interface DriftSnapshot {
+    readonly stack: {
+        readonly name: string;
+        readonly stage: string;
+    };
+    readonly resources: ReadonlyArray<DriftedResource>;
+    readonly repairPlan: {
+        readonly summary: Stack.PlanSummary;
+        readonly native: Plan;
+    };
+    /** The session drift was inspected under; {@link repair} runs in it. */
+    readonly session: Session;
+}
+/** Whether the drift check found anything worth repairing. */
+export declare const hasDrift: (snapshot: DriftSnapshot) => boolean;
+/** Compare deployed state against the real cloud and plan the repair. */
+export declare const inspect: (target: StackTarget) => Effect.Effect<{
+    stack: {
+        name: string;
+        stage: string;
+    };
+    resources: {
+        fqn: string;
+        logicalId: string;
+        resourceType: string;
+        status: "drifted" | "in-sync" | "missing";
+        actual: any;
+    }[];
+    repairPlan: {
+        summary: Stack.PlanSummary;
+        native: Plan;
+    };
+    session: {
+        stack: import("../../Stack.ts").CompiledStack<unknown, unknown>;
+        context: import("effect/Context").Context<unknown>;
+    };
+}, any, import("../../AlchemyContext.ts").AlchemyContext | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("../../Auth/Credentials.ts").CredentialsStore | import("effect/Crypto").Crypto | import("effect/FileSystem").FileSystem | import("effect/unstable/http/HttpClient").HttpClient | import("../../Interaction.ts").Interaction | import("effect/Path").Path | import("../../Auth/Profile.ts").ProfileStore | import("effect/Scope").Scope>;
+/**
+ * Converge state back to the cloud's actual shape. Engine apply events are
+ * reported through {@link Progress}.
+ */
+export declare const repair: (snapshot: DriftSnapshot) => Effect.Effect<EngineDrift.DriftResult, any, never>;
+//# sourceMappingURL=drift.d.ts.map

package/lib/Alchemist/routes/drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift.d.ts","sourceRoot":"","sources":["../../../src/Alchemist/routes/drift.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,WAAW,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAE1C,OAAO,EAAQ,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAEpC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC;QACpC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;KACvB,CAAC;IACF,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,8DAA8D;AAC9D,eAAO,MAAM,QAAQ,aAAc,aAAa,KAAG,OAIhD,CAAC;AASJ,yEAAyE;AACzE,eAAO,MAAM,OAAO;;;;;;;;;;;;;QAgCF,OAAO;QAAyB,MAAM;;;;;;qdAGtD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,MAAM,iFAWjB,CAAC"}