alchemy 2.0.0-beta.76 → 2.0.0-beta.77

package/lib/Cli/commands/cloudflare.d.ts

@@ -1,11 +1,10 @@
-import * as cfAccounts from "@distilled.cloud/cloudflare/accounts";
-import * as user from "@distilled.cloud/cloudflare/user";
 import * as Config from "effect/Config";
 import { Command } from "effect/unstable/cli";
-import * as HttpClient from "effect/unstable/http/HttpClient";
-import * as CloudflareAccess from "../../Cloudflare/Access.ts";
-import * as Clank from "../../Util/Clank.ts";
-export declare const cloudflareCommand: Command.Command<"cloudflare", {} | {}, {}, CloudflareAccess.AccessError | import("../../Auth/AuthProvider.ts").AuthError | Config.ConfigError | import("../../Auth/Demand.ts").CredentialsRequired | import("../../Apply.ts").DestroyError | import("@distilled.cloud/cloudflare/workers").Forbidden | import("@distilled.cloud/cloudflare/secrets-store").InvalidAccountId | import("../../Output.ts").InvalidReferenceError | user.InvalidRoute | import("@distilled.cloud/cloudflare/workers").InvalidRoute | user.InvalidTokenName | import("../../Output.ts").MissingSourceError | user.PermissionGroupNotFound | import("effect/PlatformError").PlatformError | Clank.PromptCancelled | import("@distilled.cloud/cloudflare/workers").QueueConsumerConflict | import("@distilled.cloud/cloudflare/workers").ServiceBindingConflict | import("../../State/State.ts").StateStoreError | {
+import * as CloudflareToken from "../../Alchemist/routes/cloudflareToken.ts";
+import type { CreatedToken } from "../../Alchemist/routes/cloudflareToken.ts";
+import * as CliKit from "../../Cli/CliKit/index.ts";
+export declare const formatCreatedCloudflareToken: (result: CreatedToken, token: string) => string;
+export declare const cloudflareCommand: Command.Command<"cloudflare", {} | {}, {}, import("../../Cloudflare/Access.ts").AccessError | import("../../Alchemist/Errors.ts").AlchemistInvalidInput | import("../../Auth/AuthProvider.ts").AuthError | import("@distilled.cloud/fly-io").BadGateway | import("@distilled.cloud/cloudflare").CloudflareError | import("@distilled.cloud/cloudflare").CloudflareHttpError | import("@distilled.cloud/cloudflare").CloudflareParseError | import("@distilled.cloud/cloudflare").CloudflareRateLimited | CloudflareToken.CloudflareTokenError | Config.ConfigError | import("@distilled.cloud/fly-io").ConfigError | import("./confirm.ts").ConfirmationDeclined | import("../../Auth/Demand.ts").CredentialsRequired | import("../../Apply.ts").DestroyError | import("@distilled.cloud/cloudflare/workers").Forbidden | import("@distilled.cloud/fly-io").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/fly-io").InternalServerError | import("@distilled.cloud/cloudflare/secrets-store").InvalidAccountId | import("../../Output.ts").InvalidReferenceError | import("@distilled.cloud/cloudflare").InvalidRoute | import("@distilled.cloud/cloudflare/workers").InvalidRoute | import("@distilled.cloud/cloudflare/user").InvalidRoute | import("@distilled.cloud/cloudflare/user").InvalidTokenName | import("../../Auth/Profile.ts").MissingProviderConfig | import("../../Output.ts").MissingSourceError | import("../../Auth/AuthProvider.ts").NeedsReauth | CliKit.NonInteractiveTerminal | import("@distilled.cloud/cloudflare").OAuthRefreshError | import("@distilled.cloud/cloudflare/user").PermissionGroupNotFound | import("effect/PlatformError").PlatformError | import("../../Auth/Profile.ts").ProfileError | import("@distilled.cloud/cloudflare/workers").QueueConsumerConflict | import("@distilled.cloud/cloudflare/workers").ServiceBindingConflict | import("@distilled.cloud/fly-io").ServiceUnavailable | import("../../State/State.ts").StateStoreError | {
     readonly _tag: "StateStoreVersionNotReady";
     readonly expected: number;
     readonly observed: number | undefined;
@@ -18,5 +17,5 @@ export declare const cloudflareCommand: Command.Command<"cloudflare", {} | {}, {
     readonly "~effect/ErrorReporter/ignore"?: boolean;
     readonly "~effect/ErrorReporter/severity"?: import("effect/LogLevel").Severity;
     readonly "~effect/ErrorReporter/attributes"?: import("effect/Record").ReadonlyRecord<string, unknown>;
-} | import("@distilled.cloud/cloudflare/workers").SubdomainNotFound | import("@distilled.cloud/cloudflare/workers").WorkerNotFound | cfAccounts.CloudflareOpError, import("../../AlchemyContext.ts").AlchemyContext | import("../../Auth/Profile.ts").AlchemyProfile | import("../../Artifacts.ts").ArtifactStore | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("../Cli.ts").Cli | import("../../Auth/Credentials.ts").CredentialsStore | import("effect/FileSystem").FileSystem | HttpClient.HttpClient | import("effect/Path").Path | import("effect/unstable/socket/Socket").WebSocketConstructor>;
+} | import("@distilled.cloud/cloudflare/workers").SubdomainNotFound | CliKit.TerminalCancelled | import("@distilled.cloud/fly-io").TooManyRequests | import("@distilled.cloud/fly-io").Unauthorized | import("@distilled.cloud/cloudflare").UnknownCloudflareError | import("./errors.ts").UserInputError | import("@distilled.cloud/cloudflare/workers").WorkerNotFound, import("../../AlchemyContext.ts").AlchemyContext | import("../../Artifacts.ts").ArtifactStore | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | CliKit.CliKit | import("../../Auth/Credentials.ts").CredentialsStore | import("effect/Crypto").Crypto | import("effect/FileSystem").FileSystem | import("effect/unstable/http/HttpClient").HttpClient | import("../../Interaction.ts").Interaction | import("effect/Path").Path | import("../../Auth/Profile.ts").ProfileStore | import("effect/unstable/socket/Socket").WebSocketConstructor>;
 //# sourceMappingURL=cloudflare.d.ts.map

package/lib/Cli/commands/cloudflare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../../src/Cli/commands/cloudflare.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,sCAAsC,CAAC;AAEnE,OAAO,KAAK,IAAI,MAAM,kCAAkC,CAAC;AACzD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAQxC,OAAO,EAAE,OAAO,EAAQ,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAI9D,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAC;AAU/D,OAAO,KAAK,KAAK,MAAM,qBAAqB,CAAC;AAmmB7C,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;4mBAO7B,CAAC"}
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../../src/Cli/commands/cloudflare.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAOxC,OAAO,EAAE,OAAO,EAAQ,MAAM,qBAAqB,CAAC;AAGpD,OAAO,KAAK,eAAe,MAAM,2CAA2C,CAAC;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAE9E,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AAcpD,eAAO,MAAM,4BAA4B,WAC/B,YAAY,SACb,MAAM,WAkBD,CAAC;AA6Vf,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;o5BAQ7B,CAAC"}

package/lib/Cli/commands/cloudflare.js

@@ -1,45 +1,38 @@
-import * as cfAccounts from "@distilled.cloud/cloudflare/accounts";
-import { apiKeyCredentials } from "@distilled.cloud/cloudflare/Credentials";
-import * as user from "@distilled.cloud/cloudflare/user";
 import * as Config from "effect/Config";
 import * as ConfigProvider from "effect/ConfigProvider";
 import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
 import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
 import * as Stream from "effect/Stream";
 import { Command, Flag } from "effect/unstable/cli";
-import * as HttpClient from "effect/unstable/http/HttpClient";
-import { AuthProviders } from "../../Auth/AuthProvider.js";
-import { withProfileOverride } from "../../Auth/Profile.js";
-import * as CloudflareAccess from "../../Cloudflare/Access.js";
-import { CloudflareAuth } from "../../Cloudflare/Auth/AuthProvider.js";
-import * as CloudflareEnvironment from "../../Cloudflare/CloudflareEnvironment.js";
-import * as CloudflareCredentials from "../../Cloudflare/Credentials.js";
-import { CloudflareLogs } from "../../Cloudflare/Logs.js";
+import * as Cloudflare from "../../Alchemist/routes/cloudflare.js";
+import * as CloudflareToken from "../../Alchemist/routes/cloudflareToken.js";
 import { STATE_STORE_SCRIPT_NAME } from "../../Cloudflare/StateStore/Api.js";
-import { bootstrap as bootstrapCloudflare, teardownStateStore, } from "../../Cloudflare/StateStore/State.js";
-import * as Clank from "../../Util/Clank.js";
+import * as CliKit from "../../Cli/CliKit/index.js";
+import { formatLocalTimestamp } from "../Format.js";
 import { loadConfigProvider } from "../../Util/ConfigProvider.js";
-import { fileLogger } from "../../Util/FileLogger.js";
-import { envFile, formatLocalTimestamp, instrumentCommand, parseSince, profile, } from "./_shared.js";
-/**
- * Build the Cloudflare auth + environment layer stack used by every
- * `alchemy cloudflare ...` subcommand. Mirrors the wiring inside
- * `Cloudflare.state(...)` so the command can talk to the user's
- * account out-of-band.
- */
-const cloudflareLayers = (envFileOpt, profileName) => Effect.gen(function* () {
-    const authProviders = {};
-    const authRegistry = Layer.succeed(AuthProviders, authProviders);
-    const authLayer = Layer.provideMerge(CloudflareAuth, authRegistry);
-    const cf = Layer.provideMerge(Layer.mergeAll(CloudflareCredentials.fromAuthProvider(), CloudflareEnvironment.fromProfile(), CloudflareAccess.AccessLive), authLayer);
-    const logger = Logger.layer([fileLogger("cloudflare.txt")], {
-        mergeWithExisting: true,
-    });
-    return Layer.mergeAll(cf, ConfigProvider.layer(withProfileOverride(yield* loadConfigProvider(envFileOpt), profileName)), logger);
-});
+import { confirmOrDecline } from "./confirm.js";
+import { envFile, parseSince, profile, yes } from "./flags.js";
+import { instrumentCommand } from "./instrument.js";
+const SELECTABLE_SCOPE_LABELS = {
+    "com.cloudflare.api.account": "account",
+    "com.cloudflare.api.account.zone": "zone",
+    "com.cloudflare.api.user": "user",
+    "com.cloudflare.edge.r2.bucket": "r2",
+};
+export const formatCreatedCloudflareToken = (result, token) => [
+    "",
+    `Created Cloudflare API token "${result.name}" (${result.id}).`,
+    `Granted ${result.grantedPermissionGroups} permission group(s) across ${result.policies.length} policy(ies)${result.verificationStatus
+        ? `; token status: ${result.verificationStatus}.`
+        : "."}`,
+    "",
+    token,
+    "",
+    "Store this value now — Cloudflare only shows it once. Use it as CLOUDFLARE_API_TOKEN.",
+    ...result.diagnostics.map((diagnostic) => `${diagnostic.severity.toUpperCase()}: ${diagnostic.message}`),
+].join("\n");
 const cloudflareForce = Flag.boolean("force").pipe(Flag.withDescription("Force a full redeploy even if the state-store worker already exists. " +
     "Without this flag, an existing worker is adopted and only its credentials are refreshed."), Flag.withDefault(false));
 const cloudflareWorkerName = Flag.string("worker-name").pipe(Flag.withDescription("Override the default state-store worker name (advanced; only needed for multiple state stores per account)."), Flag.optional, Flag.map(Option.getOrUndefined));
@@ -48,117 +41,39 @@ const bootstrapCommand = Command.make("bootstrap", {
     profile,
     force: cloudflareForce,
     workerName: cloudflareWorkerName,
-}, instrumentCommand("cloudflare.bootstrap", (a) => ({
-    "alchemy.profile": a.profile,
+}, instrumentCommand("provider.cloudflare.bootstrap", (a) => ({
+    "alchemy.profile": a.profile ?? "",
     "alchemy.force": a.force,
     "alchemy.worker_name": a.workerName ?? "",
 }))(Effect.fn(function* ({ envFile, profile, force, workerName }) {
-    const services = yield* cloudflareLayers(envFile, profile);
-    yield* bootstrapCloudflare({
+    yield* Cloudflare.bootstrap({
         workerName,
         force,
         profile,
-    }).pipe(Effect.provide(services));
-})));
+        envFile: Option.getOrUndefined(envFile),
+    });
+}))).pipe(Command.withDescription("Provision Cloudflare account prerequisites for deployments"));
 const teardownCommand = Command.make("teardown", {
     envFile,
     profile,
     workerName: cloudflareWorkerName,
-}, instrumentCommand("cloudflare.teardown", (a) => ({
-    "alchemy.profile": a.profile,
+    yes,
+}, instrumentCommand("provider.cloudflare.teardown", (a) => ({
+    "alchemy.profile": a.profile ?? "",
     "alchemy.worker_name": a.workerName ?? "",
-}))(Effect.fn(function* ({ envFile, profile, workerName }) {
-    const services = yield* cloudflareLayers(envFile, profile);
-    yield* teardownStateStore({
+}))(Effect.fn(function* ({ envFile, profile, workerName, yes: approved }) {
+    yield* confirmOrDecline({
+        yes: approved,
+        message: "Tear down the Cloudflare state store and its backing resources?",
+        confirmLabel: "Destroy",
+        cancelLabel: "Cancel",
+    });
+    yield* Cloudflare.teardown({
         workerName,
         profile,
-    }).pipe(Effect.provide(services));
-}))).pipe(Command.unlisted, Command.withDescription("Tear down the cloudflare state store"));
-/**
- * Cloudflare scopes that `buildTokenPolicies` knows how to turn into a policy,
- * mapped to a short human label shown as a hint in the selection prompt.
- * Groups with any other scope cannot be expressed as a policy and are omitted
- * from the prompt.
- */
-const SELECTABLE_SCOPE_LABELS = {
-    "com.cloudflare.api.account": "account",
-    "com.cloudflare.api.account.zone": "zone",
-    "com.cloudflare.edge.r2.bucket": "r2",
-};
-/**
- * Group permission groups by their Cloudflare scope and produce one policy
- * per scope, wiring up the right resource selector for each:
- *
- * - `com.cloudflare.api.account` → scoped to each selected account ID
- * - `com.cloudflare.api.account.zone` → all zones (`*`)
- * - `com.cloudflare.edge.r2.bucket` → all buckets (`*`)
- *
- * Mirrors the upstream `alchemy` "god token" policy shape. Groups with an
- * unrecognized scope are skipped, and empty policies are dropped. When more
- * than one account is selected, the account-scoped policy lists every chosen
- * account in its `resources` map so the token spans all of them.
- */
-const buildTokenPolicies = (accountIds, groups) => {
-    const buckets = {
-        "com.cloudflare.api.account": {
-            effect: "allow",
-            permissionGroups: [],
-            resources: Object.fromEntries(accountIds.map((id) => [`com.cloudflare.api.account.${id}`, "*"])),
-        },
-        "com.cloudflare.api.account.zone": {
-            effect: "allow",
-            permissionGroups: [],
-            resources: { "com.cloudflare.api.account.zone.*": "*" },
-        },
-        "com.cloudflare.edge.r2.bucket": {
-            effect: "allow",
-            permissionGroups: [],
-            resources: { "com.cloudflare.edge.r2.bucket.*": "*" },
-        },
-    };
-    const seen = new Set();
-    for (const group of groups) {
-        const bucket = buckets[group.scopes[0]];
-        if (!bucket || seen.has(group.id))
-            continue;
-        seen.add(group.id);
-        bucket.permissionGroups.push({ id: group.id });
-    }
-    return Object.values(buckets).filter((p) => p.permissionGroups.length > 0);
-};
-/**
- * Let the user pick which Cloudflare account(s) the token is scoped to. Lists
- * the accounts visible to the configured credentials and prompts a
- * multi-selection (defaulting the cursor to the profile's account). If there's
- * exactly one account, it's used without prompting; if the API returns none,
- * falls back to the profile's account.
- */
-const selectAccountIds = (defaultAccountId) => Effect.gen(function* () {
-    const list = yield* cfAccounts.listAccounts;
-    const response = yield* list({});
-    const accounts = response.result;
-    if (accounts.length === 0) {
-        if (defaultAccountId)
-            return [defaultAccountId];
-        return yield* Effect.die("No Cloudflare accounts found for these credentials.");
-    }
-    if (accounts.length === 1) {
-        const account = accounts[0];
-        yield* Clank.info(`Using account: ${account.name} (${account.id})`);
-        return [account.id];
-    }
-    return yield* Clank.multiselect({
-        message: "Select the Cloudflare account(s) to scope the token to " +
-            "(space to toggle, enter to confirm)",
-        initialValues: defaultAccountId ? [defaultAccountId] : undefined,
-        options: accounts.map((a) => ({
-            value: a.id,
-            label: a.name,
-            hint: a.id === defaultAccountId ? `${a.id} (current profile)` : a.id,
-        })),
-        required: true,
+        envFile: Option.getOrUndefined(envFile),
     });
-});
+}))).pipe(Command.withDescription("Tear down the Cloudflare state store"), Command.unlisted);
 const allPermissionsFlag = Flag.boolean("all-permissions").pipe(Flag.withDescription("Grant the token EVERY Cloudflare permission group (a 'god token'). " +
     "Use with care — it has full access to your account."), Flag.withDefault(false));
 const tokenNameFlag = Flag.string("name").pipe(Flag.withDescription("Name for the API token. Defaults to 'alchemy' (or 'alchemy-all-permissions')."), Flag.optional, Flag.map(Option.getOrUndefined));
@@ -171,7 +86,7 @@ const tokenAccountIdFlag = Flag.string("account-id").pipe(Flag.withDescription("
         .filter((s) => s.length > 0),
 })));
 /**
- * `alchemy cloudflare create-token` — mint a Cloudflare API token
+ * `alchemy provider cloudflare create-token` — mint a Cloudflare API token
  * (`POST /user/tokens`).
  *
  * This command is **standalone**: it does not use an Alchemy auth profile.
@@ -190,156 +105,94 @@ const tokenAccountIdFlag = Flag.string("account-id").pipe(Flag.withDescription("
  * list to `--account-id`, or (when neither is supplied) pick multiple accounts
  * from the interactive selection prompt.
  */
-const createTokenCommand = Command.make("create-token", {
+const createTokenCommand = Command.make("token", {
     envFile,
     allPermissions: allPermissionsFlag,
     name: tokenNameFlag,
     accountId: tokenAccountIdFlag,
+    yes,
 }, instrumentCommand("cloudflare.create-token", (a) => ({
     "alchemy.all_permissions": a.allPermissions,
-}))(Effect.fn(function* ({ envFile, allPermissions, name, accountId }) {
-    const configProvider = ConfigProvider.layer(yield* loadConfigProvider(envFile));
-    yield* Effect.gen(function* () {
-        // The Global API Key is a dashboard-only secret — there is no API to
-        // fetch it — so read it from the environment or prompt for it. It is
-        // used only to create the token and is never stored.
-        const envApiKey = yield* Config.string("CLOUDFLARE_API_KEY").pipe(Config.option, Config.map(Option.getOrUndefined));
-        const apiKey = envApiKey ??
-            (yield* Clank.password({
-                message: "Paste your Global API Key (see bottom of https://dash.cloudflare.com/profile/api-tokens)",
-                validate: (v) => (v.trim().length === 0 ? "Required" : undefined),
-            }));
-        const envEmail = yield* Config.string("CLOUDFLARE_EMAIL").pipe(Config.option, Config.map(Option.getOrUndefined));
-        const email = envEmail ??
-            (yield* Clank.text({
-                message: "Cloudflare account email",
-                validate: (v) => (v.trim().length === 0 ? "Required" : undefined),
-            }));
-        const credentials = Effect.succeed(apiKeyCredentials({ apiKey, email }));
-        const withCreds = (self) => self.pipe(Effect.provideService(CloudflareCredentials.Credentials, credentials));
-        const resolvedAccountIds = accountId ?? (yield* withCreds(selectAccountIds(undefined)));
-        const tokenName = name ??
-            (yield* Clank.text({
-                message: "Token name",
-                placeholder: allPermissions ? "alchemy-superuser" : "alchemy",
-                validate: (v) => v.trim().length === 0 ? "Token name is required" : undefined,
-            }));
-        // Resolve permission groups live from Cloudflare instead of a static
-        // catalog. Cloudflare silently ignores permission-group IDs it doesn't
-        // recognize, so a stale local list yields a token with zero
-        // permissions. `/user/tokens/permission_groups` returns exactly the
-        // groups (and IDs) valid for this credential.
-        //
-        // We hit the endpoint with a raw GET rather than the typed distilled
-        // client: the client hard-codes the set of valid `scopes` literals,
-        // and Cloudflare keeps adding new ones (e.g. `com.cloudflare.edge.
-        // worker.script`), which makes the strict schema reject the whole
-        // response. Parsing leniently keeps us forward-compatible.
-        const http = yield* HttpClient.HttpClient;
-        const pgResponse = yield* http.get("https://api.cloudflare.com/client/v4/user/tokens/permission_groups", {
-            headers: {
-                "X-Auth-Key": apiKey,
-                "X-Auth-Email": email,
-                Accept: "application/json",
-            },
-        });
-        const pgBody = (yield* pgResponse.json);
-        const liveGroups = (pgBody.result ?? []).flatMap((g) => g.id && g.scopes && g.scopes.length > 0
-            ? [{ id: g.id, name: g.name ?? "", scopes: g.scopes }]
-            : []);
-        let selected;
-        if (allPermissions) {
-            selected = liveGroups;
-        }
-        else {
-            // Only groups whose scope maps to one of the three policy buckets
-            // can actually become a policy (see `buildTokenPolicies`); offering
-            // the rest would let the user "select" permissions that are then
-            // silently dropped. Restrict the prompt to selectable groups.
-            const selectable = liveGroups
-                .filter((g) => SELECTABLE_SCOPE_LABELS[g.scopes[0]] !== undefined)
-                .sort((a, b) => a.name.localeCompare(b.name));
-            const chosenIds = yield* Clank.multiselect({
-                message: "Select the permission groups to grant (space to toggle, enter to confirm)",
-                options: selectable.map((g) => ({
-                    value: g.id,
-                    label: g.name,
-                    hint: SELECTABLE_SCOPE_LABELS[g.scopes[0]],
+}))(Effect.fn(function* ({ envFile, allPermissions, name, accountId, yes: approved, }) {
+    const prompt = yield* CliKit.CliKit;
+    const provider = yield* loadConfigProvider(envFile);
+    const read = (config) => config.pipe(Effect.provide(ConfigProvider.layer(provider)), Effect.map(Option.getOrUndefined));
+    const apiKey = (yield* read(Config.string("CLOUDFLARE_API_KEY").pipe(Config.option))) ??
+        (yield* prompt.prompt.password({
+            message: "Paste your Global API Key (see bottom of https://dash.cloudflare.com/profile/api-tokens)",
+            validate: (value) => value.trim().length === 0 ? "Required" : undefined,
+        }));
+    const email = (yield* read(Config.string("CLOUDFLARE_EMAIL").pipe(Config.option))) ??
+        (yield* prompt.prompt.text({
+            message: "Cloudflare account email",
+            validate: (value) => value.trim().length === 0 ? "Required" : undefined,
+        }));
+    const credentials = { email, apiKey: Redacted.make(apiKey) };
+    const catalog = yield* CloudflareToken.catalog(credentials);
+    const resolvedAccountIds = accountId ??
+        (catalog.accounts.length === 1
+            ? [catalog.accounts[0].id]
+            : yield* prompt.prompt.multiSelect({
+                message: "Select the Cloudflare accounts to scope the token to",
+                searchable: true,
+                options: catalog.accounts.map((account) => ({
+                    value: account.id,
+                    label: account.name,
+                    description: account.id,
                 })),
                 required: true,
-            });
-            const chosen = new Set(chosenIds);
-            selected = selectable.filter((g) => chosen.has(g.id));
-        }
-        const policies = buildTokenPolicies(resolvedAccountIds, selected);
-        if (policies.length === 0) {
-            return yield* Effect.die("No permission groups resolved for this account; cannot create a token.");
-        }
-        if (allPermissions) {
-            yield* Clank.warn("This token will have FULL access to your Cloudflare account. " +
-                "Keep it secret — anyone with it can control your account.");
-            const ok = yield* Clank.confirm({
-                message: "Create a superuser token with all permissions?",
-                initialValue: false,
-            });
-            if (!ok) {
-                yield* Console.log("Cancelled.");
-                return;
-            }
-        }
-        const result = yield* withCreds(user.createToken({ name: tokenName, policies }));
-        if (!result.value) {
-            return yield* Effect.die("Cloudflare did not return a token value. Try again.");
-        }
-        // Cloudflare echoes back the policies it actually accepted. It silently
-        // drops permission groups the authenticating user isn't allowed to
-        // grant — so a token can come back with zero permissions even though
-        // the request was well-formed. Count what was granted and warn loudly
-        // if it's empty (almost always an account-role problem, not a bug).
-        const granted = (result.policies ?? []).reduce((n, p) => n + (p.permissionGroups?.length ?? 0), 0);
-        // Verify the freshly minted token actually authenticates. The
-        // Cloudflare dashboard has a long-standing rendering bug where
-        // API-created tokens show a blank permission summary (and a disabled
-        // "View"), which makes a perfectly good token look empty. A live
-        // `/user/tokens/verify` is the source of truth.
-        const status = yield* http
-            .get("https://api.cloudflare.com/client/v4/user/tokens/verify", {
-            headers: {
-                Authorization: `Bearer ${result.value}`,
-                Accept: "application/json",
-            },
-        })
-            .pipe(Effect.flatMap((r) => r.json), Effect.map((b) => b.result?.status), Effect.catch(() => Effect.succeed(undefined)));
-        yield* Console.log("");
-        yield* Console.log(`Created Cloudflare API token "${result.name ?? tokenName}" (${result.id ?? "unknown id"}).`);
-        yield* Console.log(`Granted ${granted} permission group(s) across ${result.policies?.length ?? 0} policy(ies)` +
-            (status ? `; token status: ${status}.` : "."));
-        yield* Console.log("");
-        yield* Console.log(result.value);
-        yield* Console.log("");
-        yield* Console.log("Store this value now — Cloudflare only shows it once. " +
-            "Use it as CLOUDFLARE_API_TOKEN.");
-        if (granted === 0) {
-            yield* Clank.warn("Cloudflare granted 0 permissions. A token can only carry permissions " +
-                "the authenticating user already holds, so this usually means the " +
-                "Global API Key's user is not a Super Administrator on the selected " +
-                "account. Check the user's role in the Cloudflare dashboard " +
-                "(Members) and retry with an owner/Super Administrator.");
-        }
-        else {
-            // Token is good; preempt the "it looks empty" confusion.
-            yield* Clank.info("Heads up: the Cloudflare dashboard often renders API-created tokens " +
-                'with a blank permission summary (and a greyed-out "View") — this is ' +
-                "a known UI bug, not a broken token. The permissions above are applied. " +
-                'To see them in the dashboard, open the token and click "← Edit token".');
-        }
-    }).pipe(Effect.provide(configProvider));
-})));
-const tailFlag = Flag.boolean("tail").pipe(Flag.withDescription("Stream logs in real time via the Cloudflare tail websocket instead of fetching past entries."), Flag.withDefault(false));
+            }));
+    const tokenName = name ??
+        (yield* prompt.prompt.text({
+            message: "Token name",
+            placeholder: allPermissions ? "alchemy-superuser" : "alchemy",
+            validate: (value) => value.trim().length === 0 ? "Token name is required" : undefined,
+        }));
+    const permissionGroupIds = allPermissions
+        ? "all"
+        : yield* prompt.prompt.multiSelect({
+            message: "Select the permission groups to grant",
+            descriptionPlacement: "inline",
+            options: catalog.permissionGroups
+                .filter(({ selectable }) => selectable)
+                .sort((a, b) => (a.category ?? "").localeCompare(b.category ?? "") ||
+                a.name.localeCompare(b.name))
+                .map((group) => ({
+                value: group.id,
+                label: group.name,
+                description: SELECTABLE_SCOPE_LABELS[group.scopes[0]] ?? group.scopes[0],
+            })),
+            required: true,
+        });
+    const plan = yield* CloudflareToken.plan({
+        credentials,
+        name: tokenName,
+        accountIds: resolvedAccountIds,
+        permissionGroupIds,
+    });
+    if (plan.grantsFullAccess) {
+        yield* prompt.output.warning("This token will have FULL access to your Cloudflare account. Keep it secret.");
+        // `--yes` is the non-interactive path: without it, a CI invocation
+        // of `--all-permissions` dies on the confirm prompt.
+        yield* confirmOrDecline({
+            yes: approved,
+            message: "Create a superuser token with all permissions?",
+            confirmLabel: "Create",
+            cancelLabel: "Cancel",
+            abortMessage: "Cancelled.",
+        });
+    }
+    const result = yield* CloudflareToken.create({
+        credentials,
+        plan,
+    });
+    yield* Console.log(formatCreatedCloudflareToken(result, Redacted.value(result.value)));
+}))).pipe(Command.withDescription("Create a scoped Cloudflare API token"));
+const tailFlag = Flag.boolean("tail").pipe(Flag.withAlias("t"), Flag.withDescription("Stream logs in real time via the Cloudflare tail websocket instead of fetching past entries."), Flag.withDefault(false));
 const limitFlag = Flag.integer("limit").pipe(Flag.withDescription("Number of log entries to fetch (ignored with --tail)"), Flag.withDefault(100));
 const sinceFlag = Flag.string("since").pipe(Flag.withDescription("Fetch logs since this time (e.g. '1h', '30m', '2024-01-01T00:00:00Z')"), Flag.optional, Flag.map(Option.getOrUndefined));
 /**
- * `alchemy cloudflare state logs` — get or tail logs from the
+ * `alchemy provider cloudflare state logs` — get or tail logs from the
  * `alchemy-state-store` Worker on the user's account. Lets us debug
  * the state-store worker without standing up a stack file.
  */
@@ -351,48 +204,37 @@ const stateLogsCommand = Command.make("logs", {
     limit: limitFlag,
     since: sinceFlag,
 }, instrumentCommand("cloudflare.state.logs", (a) => ({
-    "alchemy.profile": a.profile,
+    "alchemy.profile": a.profile ?? "",
     "alchemy.worker_name": a.workerName ?? STATE_STORE_SCRIPT_NAME,
     "alchemy.tail": a.tail,
     "alchemy.limit": a.limit,
 }))(Effect.fn(function* ({ envFile, profile, workerName, tail, limit, since }) {
-    const services = yield* cloudflareLayers(envFile, profile);
     const scriptName = workerName ?? STATE_STORE_SCRIPT_NAME;
-    yield* Effect.gen(function* () {
-        const { accountId } = yield* yield* CloudflareEnvironment.CloudflareEnvironment;
-        const telemetry = yield* CloudflareLogs;
-        const formatLine = (line) => `${formatLocalTimestamp(line.timestamp)} [${scriptName}] ${line.message}`;
-        if (tail) {
-            yield* Console.log(`Tailing ${scriptName}...`);
-            yield* telemetry
-                .tailScript({ accountId, scriptName })
-                .pipe(Stream.runForEach((line) => Console.log(formatLine(line))));
-            return;
-        }
-        const sinceDate = since ? parseSince(since) : undefined;
-        const lines = yield* telemetry.queryLogs({
-            accountId,
-            filters: [
-                {
-                    key: "$workers.scriptName",
-                    operation: "eq",
-                    type: "string",
-                    value: scriptName,
-                },
-            ],
-            options: { limit, since: sinceDate },
-        });
-        if (lines.length === 0) {
-            yield* Console.log(`(no log entries for ${scriptName})`);
-            return;
-        }
-        for (const line of lines.sort((a, b) => a.timestamp.getTime() - b.timestamp.getTime())) {
-            yield* Console.log(formatLine(line));
-        }
-    }).pipe(Effect.provide(services));
-})));
-const stateCommand = Command.make("state", {}).pipe(Command.withSubcommands([stateLogsCommand]));
-export const cloudflareCommand = Command.make("cloudflare", {}).pipe(Command.withSubcommands([
+    const target = {
+        profile,
+        workerName,
+        envFile: Option.getOrUndefined(envFile),
+    };
+    const formatLine = (line) => `${formatLocalTimestamp(line.timestamp)} [${scriptName}] ${line.message}`;
+    if (tail) {
+        yield* CliKit.accessors.output.info(`Tailing ${scriptName}...`);
+        yield* Cloudflare.tailStateLogs(target).pipe(Stream.runForEach((line) => Console.log(formatLine(line))));
+        return;
+    }
+    const lines = yield* Cloudflare.stateLogs({
+        ...target,
+        limit,
+        since: since ? yield* parseSince(since) : undefined,
+    });
+    if (lines.length === 0) {
+        yield* Console.log(`(no log entries for ${scriptName})`);
+        return;
+    }
+    for (const line of lines)
+        yield* Console.log(formatLine(line));
+}))).pipe(Command.withDescription("Stream or fetch logs from the state-store worker"));
+const stateCommand = Command.make("state", {}).pipe(Command.withDescription("Manage the Cloudflare-hosted state store"), Command.withSubcommands([stateLogsCommand]));
+export const cloudflareCommand = Command.make("cloudflare", {}).pipe(Command.withDescription("Manage Cloudflare provider prerequisites"), Command.withSubcommands([
     bootstrapCommand,
     teardownCommand,
     createTokenCommand,