@atensec/pulumi-thoth 0.1.11 → 0.1.13

package/mcp/catalogVerify.ts

@@ -0,0 +1,225 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class CatalogVerify extends pulumi.CustomResource {
+    /**
+     * Get an existing CatalogVerify resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: CatalogVerifyState, opts?: pulumi.CustomResourceOptions): CatalogVerify {
+        return new CatalogVerify(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:mcp/catalogVerify:CatalogVerify';
+
+    /**
+     * Returns true if the given object is an instance of CatalogVerify.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is CatalogVerify {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === CatalogVerify.__pulumiType;
+    }
+
+    /**
+     * Number of allowed tools in the result catalog.
+     */
+    declare public /*out*/ readonly allowedToolsCount: pulumi.Output<number>;
+    /**
+     * Optional auth context JSON object merged into the verification request.
+     */
+    declare public readonly authContextJson: pulumi.Output<string | undefined>;
+    /**
+     * Number of blocked tools in the result catalog.
+     */
+    declare public /*out*/ readonly blockedToolsCount: pulumi.Output<number>;
+    /**
+     * Optional environment filter (dev/prod).
+     */
+    declare public readonly environment: pulumi.Output<string | undefined>;
+    /**
+     * Optional human groups for catalog verification context.
+     */
+    declare public readonly humanGroups: pulumi.Output<string[] | undefined>;
+    /**
+     * Optional human principal seed for catalog verification.
+     */
+    declare public readonly humanPrincipal: pulumi.Output<string | undefined>;
+    /**
+     * Optional human role seed for catalog verification.
+     */
+    declare public readonly humanRole: pulumi.Output<string | undefined>;
+    /**
+     * Matched policy count returned by the verifier.
+     */
+    declare public /*out*/ readonly policyCount: pulumi.Output<number>;
+    /**
+     * Principal used for catalog verification.
+     */
+    declare public readonly principal: pulumi.Output<string | undefined>;
+    /**
+     * Catalog verification response payload as JSON.
+     */
+    declare public /*out*/ readonly responseJson: pulumi.Output<string>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * Change this field to force another verification run.
+     */
+    declare public readonly trigger: pulumi.Output<string | undefined>;
+    /**
+     * RFC3339 timestamp when verification ran.
+     */
+    declare public /*out*/ readonly verifiedAt: pulumi.Output<string>;
+
+    /**
+     * Create a CatalogVerify resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args?: CatalogVerifyArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: CatalogVerifyArgs | CatalogVerifyState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as CatalogVerifyState | undefined;
+            resourceInputs["allowedToolsCount"] = state?.allowedToolsCount;
+            resourceInputs["authContextJson"] = state?.authContextJson;
+            resourceInputs["blockedToolsCount"] = state?.blockedToolsCount;
+            resourceInputs["environment"] = state?.environment;
+            resourceInputs["humanGroups"] = state?.humanGroups;
+            resourceInputs["humanPrincipal"] = state?.humanPrincipal;
+            resourceInputs["humanRole"] = state?.humanRole;
+            resourceInputs["policyCount"] = state?.policyCount;
+            resourceInputs["principal"] = state?.principal;
+            resourceInputs["responseJson"] = state?.responseJson;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["trigger"] = state?.trigger;
+            resourceInputs["verifiedAt"] = state?.verifiedAt;
+        } else {
+            const args = argsOrState as CatalogVerifyArgs | undefined;
+            resourceInputs["authContextJson"] = args?.authContextJson;
+            resourceInputs["environment"] = args?.environment;
+            resourceInputs["humanGroups"] = args?.humanGroups;
+            resourceInputs["humanPrincipal"] = args?.humanPrincipal;
+            resourceInputs["humanRole"] = args?.humanRole;
+            resourceInputs["principal"] = args?.principal;
+            resourceInputs["trigger"] = args?.trigger;
+            resourceInputs["allowedToolsCount"] = undefined /*out*/;
+            resourceInputs["blockedToolsCount"] = undefined /*out*/;
+            resourceInputs["policyCount"] = undefined /*out*/;
+            resourceInputs["responseJson"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+            resourceInputs["verifiedAt"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(CatalogVerify.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering CatalogVerify resources.
+ */
+export interface CatalogVerifyState {
+    /**
+     * Number of allowed tools in the result catalog.
+     */
+    allowedToolsCount?: pulumi.Input<number | undefined>;
+    /**
+     * Optional auth context JSON object merged into the verification request.
+     */
+    authContextJson?: pulumi.Input<string | undefined>;
+    /**
+     * Number of blocked tools in the result catalog.
+     */
+    blockedToolsCount?: pulumi.Input<number | undefined>;
+    /**
+     * Optional environment filter (dev/prod).
+     */
+    environment?: pulumi.Input<string | undefined>;
+    /**
+     * Optional human groups for catalog verification context.
+     */
+    humanGroups?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Optional human principal seed for catalog verification.
+     */
+    humanPrincipal?: pulumi.Input<string | undefined>;
+    /**
+     * Optional human role seed for catalog verification.
+     */
+    humanRole?: pulumi.Input<string | undefined>;
+    /**
+     * Matched policy count returned by the verifier.
+     */
+    policyCount?: pulumi.Input<number | undefined>;
+    /**
+     * Principal used for catalog verification.
+     */
+    principal?: pulumi.Input<string | undefined>;
+    /**
+     * Catalog verification response payload as JSON.
+     */
+    responseJson?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * Change this field to force another verification run.
+     */
+    trigger?: pulumi.Input<string | undefined>;
+    /**
+     * RFC3339 timestamp when verification ran.
+     */
+    verifiedAt?: pulumi.Input<string | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a CatalogVerify resource.
+ */
+export interface CatalogVerifyArgs {
+    /**
+     * Optional auth context JSON object merged into the verification request.
+     */
+    authContextJson?: pulumi.Input<string | undefined>;
+    /**
+     * Optional environment filter (dev/prod).
+     */
+    environment?: pulumi.Input<string | undefined>;
+    /**
+     * Optional human groups for catalog verification context.
+     */
+    humanGroups?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Optional human principal seed for catalog verification.
+     */
+    humanPrincipal?: pulumi.Input<string | undefined>;
+    /**
+     * Optional human role seed for catalog verification.
+     */
+    humanRole?: pulumi.Input<string | undefined>;
+    /**
+     * Principal used for catalog verification.
+     */
+    principal?: pulumi.Input<string | undefined>;
+    /**
+     * Change this field to force another verification run.
+     */
+    trigger?: pulumi.Input<string | undefined>;
+}

package/mcp/getInventoryDigest.ts

@@ -0,0 +1,51 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getInventoryDigest(args?: GetInventoryDigestArgs, opts?: pulumi.InvokeOptions): Promise<GetInventoryDigestResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:mcp/getInventoryDigest:getInventoryDigest", {
+        "windowHours": args.windowHours,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getInventoryDigest.
+ */
+export interface GetInventoryDigestArgs {
+    windowHours?: number;
+}
+
+/**
+ * A collection of values returned by getInventoryDigest.
+ */
+export interface GetInventoryDigestResult {
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly recommendedActions: string[];
+    readonly responseJson: string;
+    readonly topUnapprovedEndpointsJson: string;
+    readonly totalEndpoints: number;
+    readonly unapprovedCalls: number;
+    readonly unapprovedEndpoints: number;
+    readonly windowHours: number;
+}
+export function getInventoryDigestOutput(args?: GetInventoryDigestOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetInventoryDigestResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:mcp/getInventoryDigest:getInventoryDigest", {
+        "windowHours": args.windowHours,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getInventoryDigest.
+ */
+export interface GetInventoryDigestOutputArgs {
+    windowHours?: pulumi.Input<number | undefined>;
+}

package/mcp/getInventoryReport.ts

@@ -0,0 +1,50 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getInventoryReport(args?: GetInventoryReportArgs, opts?: pulumi.InvokeOptions): Promise<GetInventoryReportResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:mcp/getInventoryReport:getInventoryReport", {
+        "windowHours": args.windowHours,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getInventoryReport.
+ */
+export interface GetInventoryReportArgs {
+    windowHours?: number;
+}
+
+/**
+ * A collection of values returned by getInventoryReport.
+ */
+export interface GetInventoryReportResult {
+    readonly dataJson: string;
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly responseJson: string;
+    readonly total: number;
+    readonly unapprovedCalls: number;
+    readonly unapprovedEndpoints: number;
+    readonly windowHours: number;
+}
+export function getInventoryReportOutput(args?: GetInventoryReportOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetInventoryReportResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:mcp/getInventoryReport:getInventoryReport", {
+        "windowHours": args.windowHours,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getInventoryReport.
+ */
+export interface GetInventoryReportOutputArgs {
+    windowHours?: pulumi.Input<number | undefined>;
+}

package/mcp/getVendor.ts

@@ -0,0 +1,44 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getVendor(args: GetVendorArgs, opts?: pulumi.InvokeOptions): Promise<GetVendorResult> {
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:mcp/getVendor:getVendor", {
+        "vendorId": args.vendorId,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getVendor.
+ */
+export interface GetVendorArgs {
+    vendorId: string;
+}
+
+/**
+ * A collection of values returned by getVendor.
+ */
+export interface GetVendorResult {
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly responseJson: string;
+    readonly vendorId: string;
+}
+export function getVendorOutput(args: GetVendorOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetVendorResult> {
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:mcp/getVendor:getVendor", {
+        "vendorId": args.vendorId,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getVendor.
+ */
+export interface GetVendorOutputArgs {
+    vendorId: pulumi.Input<string>;
+}

package/mcp/getVendors.ts

@@ -0,0 +1,48 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getVendors(args?: GetVendorsArgs, opts?: pulumi.InvokeOptions): Promise<GetVendorsResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:mcp/getVendors:getVendors", {
+        "approved": args.approved,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getVendors.
+ */
+export interface GetVendorsArgs {
+    approved?: boolean;
+}
+
+/**
+ * A collection of values returned by getVendors.
+ */
+export interface GetVendorsResult {
+    readonly approved?: boolean;
+    readonly dataJson: string;
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly responseJson: string;
+    readonly total: number;
+}
+export function getVendorsOutput(args?: GetVendorsOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetVendorsResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:mcp/getVendors:getVendors", {
+        "approved": args.approved,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getVendors.
+ */
+export interface GetVendorsOutputArgs {
+    approved?: pulumi.Input<boolean | undefined>;
+}

package/mcp/index.ts

@@ -0,0 +1,53 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+// Export members:
+export { CatalogVerifyArgs, CatalogVerifyState } from "./catalogVerify";
+export type CatalogVerify = import("./catalogVerify").CatalogVerify;
+export const CatalogVerify: typeof import("./catalogVerify").CatalogVerify = null as any;
+utilities.lazyLoad(exports, ["CatalogVerify"], () => require("./catalogVerify"));
+
+export { GetInventoryDigestArgs, GetInventoryDigestResult, GetInventoryDigestOutputArgs } from "./getInventoryDigest";
+export const getInventoryDigest: typeof import("./getInventoryDigest").getInventoryDigest = null as any;
+export const getInventoryDigestOutput: typeof import("./getInventoryDigest").getInventoryDigestOutput = null as any;
+utilities.lazyLoad(exports, ["getInventoryDigest","getInventoryDigestOutput"], () => require("./getInventoryDigest"));
+
+export { GetInventoryReportArgs, GetInventoryReportResult, GetInventoryReportOutputArgs } from "./getInventoryReport";
+export const getInventoryReport: typeof import("./getInventoryReport").getInventoryReport = null as any;
+export const getInventoryReportOutput: typeof import("./getInventoryReport").getInventoryReportOutput = null as any;
+utilities.lazyLoad(exports, ["getInventoryReport","getInventoryReportOutput"], () => require("./getInventoryReport"));
+
+export { GetVendorArgs, GetVendorResult, GetVendorOutputArgs } from "./getVendor";
+export const getVendor: typeof import("./getVendor").getVendor = null as any;
+export const getVendorOutput: typeof import("./getVendor").getVendorOutput = null as any;
+utilities.lazyLoad(exports, ["getVendor","getVendorOutput"], () => require("./getVendor"));
+
+export { GetVendorsArgs, GetVendorsResult, GetVendorsOutputArgs } from "./getVendors";
+export const getVendors: typeof import("./getVendors").getVendors = null as any;
+export const getVendorsOutput: typeof import("./getVendors").getVendorsOutput = null as any;
+utilities.lazyLoad(exports, ["getVendors","getVendorsOutput"], () => require("./getVendors"));
+
+export { VendorArgs, VendorState } from "./vendor";
+export type Vendor = import("./vendor").Vendor;
+export const Vendor: typeof import("./vendor").Vendor = null as any;
+utilities.lazyLoad(exports, ["Vendor"], () => require("./vendor"));
+
+
+const _module = {
+    version: utilities.getVersion(),
+    construct: (name: string, type: string, urn: string): pulumi.Resource => {
+        switch (type) {
+            case "thoth:mcp/catalogVerify:CatalogVerify":
+                return new CatalogVerify(name, <any>undefined, { urn })
+            case "thoth:mcp/vendor:Vendor":
+                return new Vendor(name, <any>undefined, { urn })
+            default:
+                throw new Error(`unknown resource type ${type}`);
+        }
+    },
+};
+pulumi.runtime.registerResourceModule("thoth", "mcp/catalogVerify", _module)
+pulumi.runtime.registerResourceModule("thoth", "mcp/vendor", _module)

package/mcp/vendor.ts

@@ -0,0 +1,204 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class Vendor extends pulumi.CustomResource {
+    /**
+     * Get an existing Vendor resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: VendorState, opts?: pulumi.CustomResourceOptions): Vendor {
+        return new Vendor(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:mcp/vendor:Vendor';
+
+    /**
+     * Returns true if the given object is an instance of Vendor.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is Vendor {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === Vendor.__pulumiType;
+    }
+
+    /**
+     * Whether this vendor is approved for pass-through MCP host access.
+     */
+    declare public readonly approved: pulumi.Output<boolean>;
+    /**
+     * Creation timestamp.
+     */
+    declare public /*out*/ readonly createdAt: pulumi.Output<string>;
+    /**
+     * Human-friendly vendor display name.
+     */
+    declare public readonly displayName: pulumi.Output<string>;
+    /**
+     * Allowed host patterns for this vendor (for example api.openai.com).
+     */
+    declare public readonly hostPatterns: pulumi.Output<string[]>;
+    /**
+     * Last observed timestamp (RFC3339) for this vendor in runtime traffic.
+     */
+    declare public readonly lastSeenAt: pulumi.Output<string>;
+    /**
+     * Optional reviewer notes for this vendor entry.
+     */
+    declare public readonly notes: pulumi.Output<string | undefined>;
+    /**
+     * Vendor entry source (for example manual, discovered).
+     */
+    declare public readonly source: pulumi.Output<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * Last update timestamp.
+     */
+    declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
+    /**
+     * Stable vendor identifier.
+     */
+    declare public readonly vendorId: pulumi.Output<string>;
+
+    /**
+     * Create a Vendor resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: VendorArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: VendorArgs | VendorState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as VendorState | undefined;
+            resourceInputs["approved"] = state?.approved;
+            resourceInputs["createdAt"] = state?.createdAt;
+            resourceInputs["displayName"] = state?.displayName;
+            resourceInputs["hostPatterns"] = state?.hostPatterns;
+            resourceInputs["lastSeenAt"] = state?.lastSeenAt;
+            resourceInputs["notes"] = state?.notes;
+            resourceInputs["source"] = state?.source;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["updatedAt"] = state?.updatedAt;
+            resourceInputs["vendorId"] = state?.vendorId;
+        } else {
+            const args = argsOrState as VendorArgs | undefined;
+            if (args?.displayName === undefined && !opts.urn) {
+                throw new Error("Missing required property 'displayName'");
+            }
+            if (args?.hostPatterns === undefined && !opts.urn) {
+                throw new Error("Missing required property 'hostPatterns'");
+            }
+            if (args?.vendorId === undefined && !opts.urn) {
+                throw new Error("Missing required property 'vendorId'");
+            }
+            resourceInputs["approved"] = args?.approved;
+            resourceInputs["displayName"] = args?.displayName;
+            resourceInputs["hostPatterns"] = args?.hostPatterns;
+            resourceInputs["lastSeenAt"] = args?.lastSeenAt;
+            resourceInputs["notes"] = args?.notes;
+            resourceInputs["source"] = args?.source;
+            resourceInputs["vendorId"] = args?.vendorId;
+            resourceInputs["createdAt"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+            resourceInputs["updatedAt"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(Vendor.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering Vendor resources.
+ */
+export interface VendorState {
+    /**
+     * Whether this vendor is approved for pass-through MCP host access.
+     */
+    approved?: pulumi.Input<boolean | undefined>;
+    /**
+     * Creation timestamp.
+     */
+    createdAt?: pulumi.Input<string | undefined>;
+    /**
+     * Human-friendly vendor display name.
+     */
+    displayName?: pulumi.Input<string | undefined>;
+    /**
+     * Allowed host patterns for this vendor (for example api.openai.com).
+     */
+    hostPatterns?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Last observed timestamp (RFC3339) for this vendor in runtime traffic.
+     */
+    lastSeenAt?: pulumi.Input<string | undefined>;
+    /**
+     * Optional reviewer notes for this vendor entry.
+     */
+    notes?: pulumi.Input<string | undefined>;
+    /**
+     * Vendor entry source (for example manual, discovered).
+     */
+    source?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * Last update timestamp.
+     */
+    updatedAt?: pulumi.Input<string | undefined>;
+    /**
+     * Stable vendor identifier.
+     */
+    vendorId?: pulumi.Input<string | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a Vendor resource.
+ */
+export interface VendorArgs {
+    /**
+     * Whether this vendor is approved for pass-through MCP host access.
+     */
+    approved?: pulumi.Input<boolean | undefined>;
+    /**
+     * Human-friendly vendor display name.
+     */
+    displayName: pulumi.Input<string>;
+    /**
+     * Allowed host patterns for this vendor (for example api.openai.com).
+     */
+    hostPatterns: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Last observed timestamp (RFC3339) for this vendor in runtime traffic.
+     */
+    lastSeenAt?: pulumi.Input<string | undefined>;
+    /**
+     * Optional reviewer notes for this vendor entry.
+     */
+    notes?: pulumi.Input<string | undefined>;
+    /**
+     * Vendor entry source (for example manual, discovered).
+     */
+    source?: pulumi.Input<string | undefined>;
+    /**
+     * Stable vendor identifier.
+     */
+    vendorId: pulumi.Input<string>;
+}