pangea 0.0.45 → 0.0.47

data/lib/pangea/resources/types/aws/security.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require_relative 'core'
+
+module Pangea
+  module Resources
+    module Types
+      # ACM Certificate types
+      AcmValidationMethod = String.enum('DNS', 'EMAIL')
+      AcmCertificateStatus = String.enum('PENDING_VALIDATION', 'ISSUED', 'INACTIVE', 'EXPIRED', 'VALIDATION_TIMED_OUT', 'REVOKED', 'FAILED')
+      AcmKeyAlgorithm = String.enum('RSA-2048', 'RSA-1024', 'RSA-4096', 'EC-prime256v1', 'EC-secp384r1', 'EC-secp521r1')
+      CertificateTransparencyLogging = String.default('ENABLED').enum('ENABLED', 'DISABLED')
+
+      AcmValidationOption = Hash.schema(domain_name: DomainName, validation_domain?: DomainName.optional)
+      AcmDomainValidationOption = Hash.schema(
+        domain_name: DomainName,
+        resource_record_name?: String.optional,
+        resource_record_type?: String.enum('CNAME', 'A', 'AAAA', 'TXT').optional,
+        resource_record_value?: String.optional
+      )
+
+      # KMS key types
+      KmsKeyUsage = String.enum('SIGN_VERIFY', 'ENCRYPT_DECRYPT')
+      KmsKeySpec = String.enum('SYMMETRIC_DEFAULT', 'RSA_2048', 'RSA_3072', 'RSA_4096', 'ECC_NIST_P256', 'ECC_NIST_P384', 'ECC_NIST_P521', 'ECC_SECG_P256K1')
+      KmsOrigin = String.enum('AWS_KMS', 'EXTERNAL', 'AWS_CLOUDHSM')
+      KmsMultiRegion = Bool.default(false)
+      KmsEnableKeyRotation = Bool.constructor { |value, _attrs| value }
+
+      KmsKeyPolicy = String.constrained(format: /\A\{.*\}\z/).constructor { |value|
+        begin
+          JSON.parse(value)
+          value
+        rescue JSON::ParserError
+          raise Dry::Types::ConstraintError, "KMS key policy must be valid JSON"
+        end
+      }
+
+      # Secrets Manager types
+      SecretsManagerSecretType = String.enum('SecureString', 'String', 'StringList')
+      SecretsManagerRecoveryWindowInDays = Integer.constrained(gteq: 7, lteq: 30).default(30)
+
+      SecretName = String.constrained(format: /\A[a-zA-Z0-9\/_+=.@-]{1,512}\z/).constructor { |value|
+        if value.start_with?('/') || value.end_with?('/')
+          raise Dry::Types::ConstraintError, "Secret name cannot start or end with a slash"
+        end
+        if value.include?('//')
+          raise Dry::Types::ConstraintError, "Secret name cannot contain consecutive slashes"
+        end
+        value
+      }
+
+      SecretArn = String.constrained(format: /\Aarn:aws:secretsmanager:[a-z0-9-]+:\d{12}:secret:[a-zA-Z0-9\/_+=.@-]+-[a-zA-Z0-9]{6}\z/)
+      SecretVersionStage = String.enum('AWSCURRENT', 'AWSPENDING').constructor { |value|
+        if !['AWSCURRENT', 'AWSPENDING'].include?(value)
+          unless value.match?(/\A[a-zA-Z0-9_]{1,256}\z/)
+            raise Dry::Types::ConstraintError, "Custom version stage must be alphanumeric with underscores, max 256 characters"
+          end
+        end
+        value
+      }
+
+      SecretsManagerReplicaRegion = Hash.schema(region: AwsRegion, kms_key_id?: String.optional)
+      SecretValue = String | Hash.map(String, String)
+      SecretBinary = String.constructor { |value|
+        unless value.match?(/\A[A-Za-z0-9+\/]*={0,2}\z/)
+          raise Dry::Types::ConstraintError, "Secret binary must be base64 encoded"
+        end
+        begin
+          Base64.decode64(value)
+          value
+        rescue ArgumentError
+          raise Dry::Types::ConstraintError, "Secret binary must be valid base64"
+        end
+      }
+
+      # WAF v2 types
+      WafV2Scope = String.enum('REGIONAL', 'CLOUDFRONT')
+      WafV2IpAddressVersion = String.enum('IPV4', 'IPV6')
+      WafV2DefaultAction = String.enum('ALLOW', 'BLOCK')
+      WafV2RuleActionType = String.enum('ALLOW', 'BLOCK', 'COUNT', 'CAPTCHA', 'CHALLENGE')
+      WafV2ComparisonOperator = String.enum('EQ', 'NE', 'LE', 'LT', 'GE', 'GT')
+      WafV2PositionalConstraint = String.enum('EXACTLY', 'STARTS_WITH', 'ENDS_WITH', 'CONTAINS', 'CONTAINS_WORD')
+      WafV2CapacityUnits = Integer.constrained(gteq: 1, lteq: 1500)
+      WafV2RateLimit = Integer.constrained(gteq: 100, lteq: 2000000000)
+
+      WafV2StatementType = String.enum(
+        'ByteMatchStatement', 'SqliMatchStatement', 'XssMatchStatement', 'SizeConstraintStatement',
+        'GeoMatchStatement', 'RuleGroupReferenceStatement', 'IPSetReferenceStatement',
+        'RegexPatternSetReferenceStatement', 'RateBasedStatement', 'AndStatement', 'OrStatement',
+        'NotStatement', 'ManagedRuleGroupStatement', 'LabelMatchStatement'
+      )
+
+      WafV2TextTransformation = String.enum(
+        'NONE', 'COMPRESS_WHITE_SPACE', 'HTML_ENTITY_DECODE', 'LOWERCASE', 'CMD_LINE',
+        'URL_DECODE', 'BASE64_DECODE', 'HEX_DECODE', 'MD5', 'REPLACE_COMMENTS',
+        'ESCAPE_SEQ_DECODE', 'SQL_HEX_DECODE', 'CSS_DECODE', 'JS_DECODE', 'NORMALIZE_PATH',
+        'NORMALIZE_PATH_WIN', 'REMOVE_NULLS', 'REPLACE_NULLS', 'BASE64_DECODE_EXT',
+        'URL_DECODE_UNI', 'UTF8_TO_UNICODE'
+      )
+
+      WafV2FieldToMatch = String.enum(
+        'URI', 'QUERY_STRING', 'HEADER', 'METHOD', 'BODY', 'SINGLE_HEADER',
+        'SINGLE_QUERY_ARGUMENT', 'ALL_QUERY_ARGUMENTS', 'URI_PATH', 'JSON_BODY',
+        'HEADERS', 'COOKIES'
+      )
+
+      WafV2JsonBodyMatchPattern = Hash.schema(
+        all?: Hash.schema({}).optional,
+        included_paths?: Array.of(String).optional
+      ).constructor { |value|
+        has_all = value.key?(:all)
+        has_paths = value.key?(:included_paths) && value[:included_paths]&.any?
+        if has_all && has_paths
+          raise Dry::Types::ConstraintError, "WAF v2 JSON body match pattern cannot specify both 'all' and 'included_paths'"
+        end
+        if !has_all && !has_paths
+          raise Dry::Types::ConstraintError, "WAF v2 JSON body match pattern must specify either 'all' or 'included_paths'"
+        end
+        value
+      }
+
+      WafV2WebAclArn = String.constrained(format: /\Aarn:aws:wafv2:[a-z0-9-]+:\d{12}:(global|regional)\/webacl\/[a-zA-Z0-9_-]+\/[a-f0-9-]{36}\z/)
+    end
+  end
+end

data/lib/pangea/resources/types/aws/storage.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require_relative 'core'
+
+module Pangea
+  module Resources
+    module Types
+      # S3 bucket versioning
+      S3Versioning = String.enum('Enabled', 'Suspended', 'Disabled')
+
+      # EFS-specific types
+      EfsPerformanceMode = String.constrained(included_in: ['generalPurpose', 'maxIO'])
+      EfsThroughputMode = String.constrained(included_in: ['bursting', 'provisioned', 'elastic'])
+
+      # EFS Lifecycle Policy configuration
+      EfsLifecyclePolicy = Hash.schema(
+        transition_to_ia?: String.constrained(included_in: ['AFTER_7_DAYS', 'AFTER_14_DAYS', 'AFTER_30_DAYS', 'AFTER_60_DAYS', 'AFTER_90_DAYS']).optional,
+        transition_to_primary_storage_class?: String.constrained(included_in: ['AFTER_1_ACCESS']).optional
+      ).constructor { |value|
+        if value.empty? || (!value[:transition_to_ia] && !value[:transition_to_primary_storage_class])
+          raise Dry::Types::ConstraintError, "EFS lifecycle policy must specify at least one transition"
+        end
+        value
+      }
+
+      # EFS Access Point POSIX user
+      EfsPosixUser = Hash.schema(
+        uid: Integer.constrained(gteq: 0, lteq: 4294967295),
+        gid: Integer.constrained(gteq: 0, lteq: 4294967295),
+        secondary_gids?: Array.of(Integer.constrained(gteq: 0, lteq: 4294967295)).optional
+      )
+
+      # EFS Access Point root directory creation info
+      EfsCreationInfo = Hash.schema(
+        owner_uid: Integer.constrained(gteq: 0, lteq: 4294967295),
+        owner_gid: Integer.constrained(gteq: 0, lteq: 4294967295),
+        permissions: String.constrained(format: /\A[0-7]{3,4}\z/)
+      )
+
+      # EFS Access Point root directory
+      EfsRootDirectory = Hash.schema(
+        path?: String.constrained(format: /\A\/.*/).default("/"),
+        creation_info?: EfsCreationInfo.optional
+      )
+    end
+  end
+end

data/lib/pangea/resources/types/cloudflare/core.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require_relative '../core'
+
+module Pangea
+  module Resources
+    module Types
+      # Cloudflare Zone Types
+      CloudflareZoneType = String.default('full').enum('full', 'partial', 'secondary')
+      CloudflareZonePlan = String.default('free').enum('free', 'pro', 'business', 'enterprise')
+      CloudflareZoneStatus = String.enum('active', 'pending', 'initializing', 'moved', 'deleted', 'deactivated')
+
+      # Cloudflare DNS Record Types
+      CloudflareDnsRecordType = String.enum(
+        'A', 'AAAA', 'CNAME', 'TXT', 'MX', 'NS', 'SRV', 'CAA',
+        'HTTPS', 'SVCB', 'LOC', 'PTR', 'CERT', 'DNSKEY', 'DS',
+        'NAPTR', 'SMIMEA', 'SSHFP', 'TLSA', 'URI'
+      )
+
+      # Cloudflare proxied status (orange cloud vs grey cloud)
+      CloudflareProxied = Bool.default(false)
+
+      # Cloudflare TTL validation (1 = automatic, or 60-86400 for manual)
+      CloudflareTtl = Integer.constructor { |value|
+        next value if value == 1
+        unless (60..86400).include?(value)
+          raise Dry::Types::ConstraintError, "Cloudflare TTL must be 1 (automatic) or between 60-86400 seconds"
+        end
+        value
+      }
+
+      # Cloudflare priority (for MX, SRV records)
+      CloudflarePriority = Integer.constrained(gteq: 0, lteq: 65535)
+
+      # Cloudflare Page Rule actions
+      CloudflarePageRuleAction = String.enum(
+        'always_online', 'always_use_https', 'automatic_https_rewrites',
+        'browser_cache_ttl', 'browser_check', 'bypass_cache_on_cookie',
+        'cache_by_device_type', 'cache_deception_armor', 'cache_key_fields',
+        'cache_level', 'cache_on_cookie', 'cache_ttl_by_status',
+        'disable_apps', 'disable_performance', 'disable_railgun',
+        'disable_security', 'edge_cache_ttl', 'email_obfuscation',
+        'explicit_cache_control', 'forwarding_url', 'host_header_override',
+        'ip_geolocation', 'minify', 'mirage', 'opportunistic_encryption',
+        'origin_error_page_pass_thru', 'polish', 'resolve_override',
+        'respect_strong_etag', 'response_buffering', 'rocket_loader',
+        'security_level', 'server_side_exclude', 'sort_query_string_for_cache',
+        'ssl', 'true_client_ip_header', 'waf'
+      )
+
+      # Cloudflare cache level
+      CloudflareCacheLevel = String.enum('bypass', 'basic', 'simplified', 'aggressive', 'cache_everything')
+
+      # Cloudflare security level
+      CloudflareSecurityLevel = String.enum('off', 'essentially_off', 'low', 'medium', 'high', 'under_attack')
+
+      # Cloudflare SSL mode
+      CloudflareSslMode = String.enum('off', 'flexible', 'full', 'strict', 'origin_pull')
+
+      # Cloudflare Rocket Loader setting
+      CloudflareRocketLoader = String.enum('off', 'manual', 'automatic')
+
+      # Cloudflare Polish setting
+      CloudflarePolish = String.enum('off', 'lossless', 'lossy')
+
+      # Cloudflare Zone ID validation
+      # Accepts both valid 32-char hex IDs and Terraform interpolation strings
+      CloudflareZoneId = String.constructor { |value|
+        next value if value.match?(/\A\$\{.+\}\z/)
+        unless value.match?(/\A[a-f0-9]{32}\z/)
+          raise Dry::Types::ConstraintError, "Cloudflare Zone ID must be 32-character hex or a Terraform interpolation string"
+        end
+        value
+      }
+
+      # Cloudflare Account ID validation
+      # Accepts both valid 32-char hex IDs and Terraform interpolation strings
+      CloudflareAccountId = String.constructor { |value|
+        next value if value.match?(/\A\$\{.+\}\z/)
+        unless value.match?(/\A[a-f0-9]{32}\z/)
+          raise Dry::Types::ConstraintError, "Cloudflare Account ID must be 32-character hex or a Terraform interpolation string"
+        end
+        value
+      }
+
+      # Cloudflare API Token validation (40 character hex)
+      CloudflareApiToken = String.constrained(min_size: 40, max_size: 40)
+
+      # Cloudflare Email validation
+      CloudflareEmail = String.constrained(
+        format: /\A[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}\z/
+      )
+
+      # Cloudflare common tags
+      CloudflareTags = Hash.map(String, String).default({}.freeze)
+
+      # Cloudflare Argo smart routing
+      CloudflareArgoSmartRouting = String.enum('on', 'off')
+
+      # Cloudflare Argo Tiered Caching
+      CloudflareArgoTieredCaching = String.enum('on', 'off')
+
+      # Cloudflare Logpush job dataset
+      CloudflareLogpushDataset = String.enum(
+        'http_requests', 'spectrum_events', 'firewall_events', 'nel_reports',
+        'dns_logs', 'network_analytics_logs', 'workers_trace_events',
+        'access_requests', 'gateway_dns', 'gateway_http', 'gateway_network'
+      )
+
+      # Cloudflare Logpush destination type
+      CloudflareLogpushDestinationType = String.enum('s3', 'gcs', 'azure', 'sumo_logic', 'splunk', 'datadog')
+
+      # Cloudflare Logpush frequency
+      CloudflareLogpushFrequency = String.enum('high', 'low')
+    end
+  end
+end

data/lib/pangea/resources/types/cloudflare/load_balancing.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require_relative '../core'
+
+module Pangea
+  module Resources
+    module Types
+      # Cloudflare Load Balancer steering policy
+      CloudflareLoadBalancerSteeringPolicy = String.default('off').enum(
+        'off', 'geo', 'random', 'dynamic_latency', 'proximity', 'least_outstanding_requests', 'least_connections'
+      )
+
+      # Cloudflare Load Balancer session affinity
+      CloudflareLoadBalancerSessionAffinity = String.default('none').enum('none', 'cookie', 'ip_cookie', 'header')
+
+      # Cloudflare Load Balancer fallback pool
+      CloudflareLoadBalancerFallbackPool = String.optional
+
+      # Cloudflare Load Balancer Pool health check region
+      CloudflareHealthCheckRegion = String.enum(
+        'WNAM', 'ENAM', 'WEU', 'EEU', 'NSAM', 'SSAM', 'OC', 'ME', 'NAF', 'SAF',
+        'SAS', 'SEAS', 'NEAS', 'ALL_REGIONS'
+      )
+
+      # Cloudflare Load Balancer Monitor type
+      CloudflareMonitorType = String.default('http').enum('http', 'https', 'tcp', 'udp_icmp', 'icmp_ping', 'smtp')
+
+      # Cloudflare Load Balancer Monitor method
+      CloudflareMonitorMethod = String.default('GET').enum('GET', 'HEAD', 'POST', 'PUT', 'DELETE', 'CONNECT', 'OPTIONS', 'TRACE', 'PATCH')
+
+      # Cloudflare Load Balancer Monitor interval (in seconds)
+      CloudflareMonitorInterval = Integer.constrained(gteq: 5, lteq: 3600)
+
+      # Cloudflare Load Balancer Monitor timeout (in seconds)
+      CloudflareMonitorTimeout = Integer.constrained(gteq: 1, lteq: 10)
+
+      # Cloudflare Load Balancer Monitor retries
+      CloudflareMonitorRetries = Integer.constrained(gteq: 0, lteq: 5)
+
+      # Cloudflare Load Balancer Monitor expected codes (e.g., "2xx", "200-299")
+      CloudflareMonitorExpectedCodes = String.constructor { |value|
+        valid_formats = [
+          /\A\dxx\z/,
+          /\A\d{3}\z/,
+          /\A\d{3}-\d{3}\z/
+        ]
+        unless valid_formats.any? { |pattern| value.match?(pattern) }
+          raise Dry::Types::ConstraintError, "Monitor expected codes must be in format '2xx', '200', or '200-299'"
+        end
+        value
+      }
+
+      # Cloudflare origin pool configuration
+      CloudflareOriginPoolOrigin = Hash.schema(
+        name: String,
+        address: String,
+        enabled?: Bool.default(true),
+        weight?: Integer.constrained(gteq: 0, lteq: 1).default(1),
+        header?: Hash.map(String, String).optional
+      )
+
+      # Cloudflare Load Balancer region pool
+      CloudflareRegionPool = Hash.schema(
+        region: CloudflareHealthCheckRegion,
+        pool_ids: Array.of(String).constrained(min_size: 1)
+      )
+
+      # Cloudflare Load Balancer pop pool
+      CloudflarePopPool = Hash.schema(
+        pop: String.constrained(format: /\A[A-Z]{3}\z/),
+        pool_ids: Array.of(String).constrained(min_size: 1)
+      )
+
+      # Cloudflare Load Balancer adaptive routing
+      CloudflareAdaptiveRouting = Hash.schema(
+        failover_across_pools?: Bool.default(false)
+      )
+
+      # Cloudflare Load Balancer location strategy
+      CloudflareLocationStrategy = Hash.schema(
+        prefer_ecs?: String.enum('always', 'never', 'proximity', 'geo').optional,
+        mode?: String.enum('pop', 'resolver_ip').optional
+      )
+
+      # Cloudflare Load Balancer random steering
+      CloudflareRandomSteering = Hash.schema(
+        pool_weights: Hash.map(String, Integer.constrained(gteq: 0, lteq: 1))
+      )
+    end
+  end
+end

data/lib/pangea/resources/types/cloudflare/security.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require_relative '../core'
+
+module Pangea
+  module Resources
+    module Types
+      # Cloudflare Firewall rule action
+      CloudflareFirewallAction = String.enum(
+        'block', 'challenge', 'js_challenge', 'managed_challenge', 'allow', 'log', 'bypass'
+      )
+
+      # Cloudflare Filter expression (Wirefilter syntax)
+      CloudflareFilterExpression = String.constructor { |value|
+        if value.strip.empty?
+          raise Dry::Types::ConstraintError, "Filter expression cannot be empty"
+        end
+        value
+      }
+
+      # Cloudflare Access application type
+      CloudflareAccessApplicationType = String.enum('self_hosted', 'saas', 'ssh', 'vnc', 'app_launcher', 'warp', 'biso', 'bookmark')
+
+      # Cloudflare Access session duration
+      CloudflareAccessSessionDuration = String.constructor { |value|
+        unless value.match?(/\A\d+[mhd]\z/)
+          raise Dry::Types::ConstraintError, "Access session duration must be in format like '24h', '30m', '7d'"
+        end
+        value
+      }
+
+      # Cloudflare Access policy decision
+      CloudflareAccessPolicyDecision = String.enum('allow', 'deny', 'non_identity', 'bypass')
+
+      # Cloudflare Access identity provider type
+      CloudflareAccessIdentityProviderType = String.enum(
+        'onetimepin', 'azureAD', 'saml', 'centrify', 'facebook',
+        'github', 'google-apps', 'google', 'linkedin', 'oidc',
+        'okta', 'onelogin', 'pingone', 'yandex'
+      )
+
+      # Cloudflare Rate Limit threshold
+      CloudflareRateLimitThreshold = Integer.constrained(gteq: 2, lteq: 1000000)
+
+      # Cloudflare Rate Limit period (in seconds)
+      CloudflareRateLimitPeriod = Integer.constrained(gteq: 1, lteq: 86400)
+
+      # Cloudflare Rate Limit action mode
+      CloudflareRateLimitActionMode = String.enum('simulate', 'ban', 'challenge', 'js_challenge', 'managed_challenge')
+
+      # Cloudflare Rate Limit action timeout (in seconds)
+      CloudflareRateLimitActionTimeout = Integer.constrained(gteq: 10, lteq: 86400)
+
+      # Cloudflare WAF rule mode
+      CloudflareWafRuleMode = String.enum('default', 'disable', 'simulate', 'block', 'challenge')
+
+      # Cloudflare WAF package sensitivity
+      CloudflareWafPackageSensitivity = String.enum('high', 'medium', 'low', 'off')
+
+      # Cloudflare WAF package action mode
+      CloudflareWafPackageActionMode = String.enum('simulate', 'block', 'challenge')
+
+      # Cloudflare Access CORS headers
+      CloudflareAccessCorsHeaders = Hash.schema(
+        allowed_methods?: Array.of(String).optional,
+        allowed_origins?: Array.of(String).optional,
+        allow_credentials?: Bool.optional,
+        max_age?: Integer.optional
+      )
+
+      # Cloudflare Access include/exclude configuration
+      CloudflareAccessRuleConfiguration = Hash.schema(
+        email?: Array.of(String).optional,
+        email_domain?: Array.of(String).optional,
+        ip?: Array.of(String).optional,
+        ip_list?: Array.of(String).optional,
+        everyone?: Bool.optional,
+        certificate?: Bool.optional,
+        common_name?: String.optional,
+        auth_method?: String.optional,
+        geo?: Array.of(String).optional,
+        login_method?: Array.of(String).optional,
+        service_token?: Array.of(String).optional,
+        any_valid_service_token?: Bool.optional,
+        group?: Array.of(String).optional,
+        azure?: Array.of(Hash).optional,
+        github?: Array.of(Hash).optional,
+        google?: Array.of(Hash).optional,
+        okta?: Array.of(Hash).optional,
+        saml?: Array.of(Hash).optional
+      )
+    end
+  end
+end

data/lib/pangea/resources/types/cloudflare/workers.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require_relative '../core'
+
+module Pangea
+  module Resources
+    module Types
+      # Cloudflare Worker script format
+      CloudflareWorkerScriptFormat = String.enum('service-worker', 'modules')
+
+      # Cloudflare Worker route pattern validation
+      CloudflareWorkerRoutePattern = String.constructor { |value|
+        unless value.match?(/\A[a-z0-9\-\.\*]+\/.*\z/i)
+          raise Dry::Types::ConstraintError, "Worker route pattern must include hostname and path (e.g., 'example.com/*')"
+        end
+        if value.include?('**')
+          raise Dry::Types::ConstraintError, "Worker route pattern cannot contain consecutive asterisks"
+        end
+        value
+      }
+
+      # Cloudflare Spectrum application protocol
+      CloudflareSpectrumProtocol = String.enum('tcp/22', 'tcp/80', 'tcp/443', 'tcp/3389', 'tcp/8080', 'udp/53')
+
+      # Cloudflare Spectrum edge IP connectivity
+      CloudflareSpectrumEdgeIpConnectivity = String.enum('all', 'ipv4', 'ipv6')
+
+      # Cloudflare Spectrum TLS mode
+      CloudflareSpectrumTls = String.enum('off', 'flexible', 'full', 'strict')
+
+      # Cloudflare Custom Hostname SSL method
+      CloudflareCustomHostnameSslMethod = String.enum('http', 'txt', 'email')
+
+      # Cloudflare Custom Hostname SSL type
+      CloudflareCustomHostnameSslType = String.enum('dv')
+
+      # Cloudflare Custom Hostname SSL settings
+      CloudflareCustomHostnameSslSettings = Hash.schema(
+        http2?: String.enum('on', 'off').optional,
+        http3?: String.enum('on', 'off').optional,
+        tls_1_3?: String.enum('on', 'off').optional,
+        min_tls_version?: String.enum('1.0', '1.1', '1.2', '1.3').optional,
+        ciphers?: Array.of(String).optional
+      )
+    end
+  end
+end

data/lib/pangea/resources/types/core.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'dry-types'
+require 'json'
+require 'base64'
+
+module Pangea
+  module Resources
+    # Common types for resource definitions
+    module Types
+      include Dry.Types()
+
+      # Alias for ResourceReference to support Types::ResourceReference usage
+      def self.const_missing(name)
+        if name == :ResourceReference
+          require 'pangea/resources/reference' unless defined?(::Pangea::Resources::ResourceReference)
+          ::Pangea::Resources::ResourceReference
+        else
+          super
+        end
+      end
+    end
+  end
+end