alchemy 0.93.4 → 0.93.7

package/lib/cloudflare/access-group.d.ts

@@ -0,0 +1,115 @@
+import type { Context } from "../context.ts";
+import { type AccessRule } from "./access-rule.ts";
+import { type CloudflareApiOptions } from "./api.ts";
+/**
+ * Properties for creating or updating an {@link AccessGroup}.
+ */
+export interface AccessGroupProps extends CloudflareApiOptions {
+    /**
+     * Display name of the group.
+     *
+     * @default ${app}-${stage}-${id}
+     */
+    name?: string;
+    /**
+     * Rules that grant membership (OR logic — any match includes the user).
+     */
+    include?: AccessRule[];
+    /**
+     * Rules that revoke membership when matched.
+     */
+    exclude?: AccessRule[];
+    /**
+     * Rules that must additionally match for membership (AND logic).
+     */
+    require?: AccessRule[];
+    /**
+     * Mark this group as the account default. Default groups apply to every
+     * Access application unless explicitly overridden.
+     *
+     * @default false
+     */
+    isDefault?: boolean;
+    /**
+     * Adopt an existing group with the same name instead of failing.
+     *
+     * @default false
+     */
+    adopt?: boolean;
+    /**
+     * Whether to delete the group when removed from Alchemy.
+     *
+     * @default true
+     */
+    delete?: boolean;
+}
+/**
+ * Output for an {@link AccessGroup}.
+ */
+export type AccessGroup = Omit<AccessGroupProps, "adopt" | "delete"> & {
+    /** Cloudflare-assigned group UUID. */
+    id: string;
+    /** Display name. */
+    name: string;
+    /** ISO 8601 creation timestamp. */
+    createdAt: string;
+    /** ISO 8601 last-update timestamp. */
+    updatedAt: string;
+};
+/**
+ * Type guard for {@link AccessGroup}.
+ */
+export declare function isAccessGroup(resource: any): resource is AccessGroup;
+/**
+ * Creates a Cloudflare Zero Trust [Access group](https://developers.cloudflare.com/cloudflare-one/identity/users/groups/),
+ * a reusable bundle of rules that can be referenced by Access policies.
+ *
+ * @example
+ * // Engineering team by email domain.
+ * const engineering = await AccessGroup("engineering", {
+ *   name: "Engineering",
+ *   include: [{ email_domain: { domain: "acme.com" } }],
+ * });
+ *
+ * @example
+ * // Allow a managed IP list, exclude one specific IP.
+ * const officeIps = await AccessGroup("office", {
+ *   name: "Office IPs",
+ *   include: [{ ip_list: { id: "<list-uuid>" } }],
+ *   exclude: [{ ip: { ip: "203.0.113.99/32" } }],
+ * });
+ *
+ * @example
+ * // Compose groups: admins are engineers who are also on-call. Resources
+ * // can be passed directly — Alchemy lifts `.id` at the wire boundary.
+ * const onCall = await AccessGroup("on-call", {
+ *   include: [{ email_domain: { domain: "acme.com" } }],
+ * });
+ * const admins = await AccessGroup("admins", {
+ *   include: [{ group: { id: engineering } }],
+ *   require: [{ group: { id: onCall } }],
+ * });
+ *
+ * @example
+ * // IdP-bound rules — match Okta groups via an AccessIdentityProvider.
+ * const okta = await AccessIdentityProvider("okta", {
+ *   type: "okta",
+ *   name: "Acme Okta",
+ *   oktaAccount: "acme.okta.com",
+ *   clientId: "...",
+ *   clientSecret: alchemy.secret.env.OKTA_SECRET,
+ * });
+ * const sre = await AccessGroup("sre", {
+ *   include: [{ okta: { name: "sre", identity_provider_id: okta } }],
+ * });
+ *
+ * @example
+ * // Account default — applied implicitly to every Access application.
+ * await AccessGroup("default-deny", {
+ *   isDefault: true,
+ *   include: [{ everyone: {} }],
+ *   exclude: [{ email_domain: { domain: "acme.com" } }],
+ * });
+ */
+export declare const AccessGroup: (((this: any, id: string, props?: {}) => never) & (new (_: never) => never)) | ((this: Context<AccessGroup>, id: string, props: AccessGroupProps) => Promise<AccessGroup>);
+//# sourceMappingURL=access-group.d.ts.map

package/lib/cloudflare/access-group.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-group.d.ts","sourceRoot":"","sources":["../../src/cloudflare/access-group.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAG7C,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMxE,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,UAAU,CAAC;AAElB;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,oBAAoB;IAC5D;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IAEvB;;OAEG;IACH,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IAEvB;;OAEG;IACH,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IAEvB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG;IACrE,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,GAAG,GAAG,QAAQ,IAAI,WAAW,CAEpE;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,eAAO,MAAM,WAAW,yFAGd,OAAO,CAAC,WAAW,CAAC,MACtB,MAAM,SACH,gBAAgB,KACtB,OAAO,CAAC,WAAW,CAAC,CAkExB,CAAC"}

package/lib/cloudflare/access-group.js

@@ -0,0 +1,147 @@
+import { Resource, ResourceKind } from "../resource.js";
+import { logger } from "../util/logger.js";
+import { serializeAccessRule } from "./access-rule.js";
+import { isCloudflareApiError } from "./api-error.js";
+import { extractCloudflareResult, } from "./api-response.js";
+import { createCloudflareApi, } from "./api.js";
+/**
+ * Type guard for {@link AccessGroup}.
+ */
+export function isAccessGroup(resource) {
+    return resource?.[ResourceKind] === "cloudflare::AccessGroup";
+}
+/**
+ * Creates a Cloudflare Zero Trust [Access group](https://developers.cloudflare.com/cloudflare-one/identity/users/groups/),
+ * a reusable bundle of rules that can be referenced by Access policies.
+ *
+ * @example
+ * // Engineering team by email domain.
+ * const engineering = await AccessGroup("engineering", {
+ *   name: "Engineering",
+ *   include: [{ email_domain: { domain: "acme.com" } }],
+ * });
+ *
+ * @example
+ * // Allow a managed IP list, exclude one specific IP.
+ * const officeIps = await AccessGroup("office", {
+ *   name: "Office IPs",
+ *   include: [{ ip_list: { id: "<list-uuid>" } }],
+ *   exclude: [{ ip: { ip: "203.0.113.99/32" } }],
+ * });
+ *
+ * @example
+ * // Compose groups: admins are engineers who are also on-call. Resources
+ * // can be passed directly — Alchemy lifts `.id` at the wire boundary.
+ * const onCall = await AccessGroup("on-call", {
+ *   include: [{ email_domain: { domain: "acme.com" } }],
+ * });
+ * const admins = await AccessGroup("admins", {
+ *   include: [{ group: { id: engineering } }],
+ *   require: [{ group: { id: onCall } }],
+ * });
+ *
+ * @example
+ * // IdP-bound rules — match Okta groups via an AccessIdentityProvider.
+ * const okta = await AccessIdentityProvider("okta", {
+ *   type: "okta",
+ *   name: "Acme Okta",
+ *   oktaAccount: "acme.okta.com",
+ *   clientId: "...",
+ *   clientSecret: alchemy.secret.env.OKTA_SECRET,
+ * });
+ * const sre = await AccessGroup("sre", {
+ *   include: [{ okta: { name: "sre", identity_provider_id: okta } }],
+ * });
+ *
+ * @example
+ * // Account default — applied implicitly to every Access application.
+ * await AccessGroup("default-deny", {
+ *   isDefault: true,
+ *   include: [{ everyone: {} }],
+ *   exclude: [{ email_domain: { domain: "acme.com" } }],
+ * });
+ */
+export const AccessGroup = Resource("cloudflare::AccessGroup", async function (id, props) {
+    const api = await createCloudflareApi(props);
+    const name = props.name ?? this.scope.createPhysicalName(id);
+    const basePath = `/accounts/${api.accountId}/access/groups`;
+    if (this.phase === "delete") {
+        if (this.output?.id && props.delete !== false) {
+            await deleteAccessGroup(api, this.output.id);
+        }
+        return this.destroy();
+    }
+    const body = {
+        name,
+        include: (props.include ?? []).map(serializeAccessRule),
+        exclude: (props.exclude ?? []).map(serializeAccessRule),
+        require: (props.require ?? []).map(serializeAccessRule),
+        is_default: props.isDefault ?? false,
+    };
+    let group;
+    if (this.phase === "update" && this.output?.id) {
+        group = await extractCloudflareResult(`update access group "${name}"`, api.put(`${basePath}/${this.output.id}`, body));
+    }
+    else {
+        const adopt = props.adopt ?? this.scope.adopt;
+        try {
+            group = await extractCloudflareResult(`create access group "${name}"`, api.post(basePath, body));
+        }
+        catch (err) {
+            if (adopt && isAccessDuplicateNameError(err)) {
+                const existing = await findAccessGroupByName(api, name);
+                if (!existing) {
+                    throw new Error(`Access group "${name}" already exists but could not be found for adoption.`, { cause: err });
+                }
+                logger.log(`Adopting existing access group "${name}" (${existing.id})`);
+                group = await extractCloudflareResult(`adopt access group "${name}"`, api.put(`${basePath}/${existing.id}`, body));
+            }
+            else {
+                throw err;
+            }
+        }
+    }
+    return {
+        id: group.id,
+        name: group.name,
+        include: props.include,
+        exclude: props.exclude,
+        require: props.require,
+        isDefault: group.is_default,
+        createdAt: group.created_at,
+        updatedAt: group.updated_at,
+    };
+});
+function isAccessDuplicateNameError(err) {
+    if (isCloudflareApiError(err, { status: 409 }) ||
+        isCloudflareApiError(err, { status: 400 })) {
+        const data = err.errorData;
+        return (Array.isArray(data) &&
+            data.some((e) => "message" in e && /already exists/i.test(String(e.message))));
+    }
+    return false;
+}
+async function findAccessGroupByName(api, name) {
+    let page = 1;
+    const perPage = 50;
+    while (true) {
+        const response = await api.get(`/accounts/${api.accountId}/access/groups?page=${page}&per_page=${perPage}`);
+        if (!response.ok)
+            return null;
+        const data = (await response.json());
+        const match = data.result.find((g) => g.name === name);
+        if (match)
+            return match;
+        const info = data.result_info;
+        if (!info || info.page * info.per_page >= info.total_count)
+            return null;
+        page++;
+    }
+}
+async function deleteAccessGroup(api, groupId) {
+    const response = await api.delete(`/accounts/${api.accountId}/access/groups/${groupId}`);
+    if (!response.ok && response.status !== 404) {
+        logger.error(`Error deleting access group ${groupId}: ${response.status} ${response.statusText}`);
+    }
+}
+//# sourceMappingURL=access-group.js.map

package/lib/cloudflare/access-group.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-group.js","sourceRoot":"","sources":["../../src/cloudflare/access-group.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAmB,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,GAGpB,MAAM,UAAU,CAAC;AAiElB;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,QAAa;IACzC,OAAO,QAAQ,EAAE,CAAC,YAAY,CAAC,KAAK,yBAAyB,CAAC;AAChE,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CACjC,yBAAyB,EACzB,KAAK,WAEH,EAAU,EACV,KAAuB;IAEvB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,aAAa,GAAG,CAAC,SAAS,gBAAgB,CAAC;IAE5D,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC9C,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,IAAI,GAA4B;QACpC,IAAI;QACJ,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACvD,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACvD,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACvD,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;KACrC,CAAC;IAEF,IAAI,KAA4B,CAAC;IACjC,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;QAC/C,KAAK,GAAG,MAAM,uBAAuB,CACnC,wBAAwB,IAAI,GAAG,EAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAC/C,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC9C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,uBAAuB,CACnC,wBAAwB,IAAI,GAAG,EAC/B,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CACzB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,KAAK,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,uDAAuD,EAC5E,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,GAAG,CACR,mCAAmC,IAAI,MAAM,QAAQ,CAAC,EAAE,GAAG,CAC5D,CAAC;gBACF,KAAK,GAAG,MAAM,uBAAuB,CACnC,uBAAuB,IAAI,GAAG,EAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAC5C,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,SAAS,EAAE,KAAK,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,SAAS,0BAA0B,CAAC,GAAY;IAC9C,IACE,oBAAoB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC1C,oBAAoB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC;QAC3B,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,IAAI,CAAC,IAAI,CACP,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CACnE,CACF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAkB,EAClB,IAAY;IAEZ,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,CAC5B,aAAa,GAAG,CAAC,SAAS,uBAAuB,IAAI,aAAa,OAAO,EAAE,CAC5E,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,IAAI,GACR,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqD,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACvD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC;QAC9B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACxE,IAAI,EAAE,CAAC;IACT,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAkB,EAClB,OAAe;IAEf,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAC/B,aAAa,GAAG,CAAC,SAAS,kBAAkB,OAAO,EAAE,CACtD,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,CAAC,KAAK,CACV,+BAA+B,OAAO,KAAK,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CACpF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/lib/cloudflare/access-identity-provider.d.ts

@@ -0,0 +1,261 @@
+import type { Context } from "../context.ts";
+import { Secret } from "../secret.ts";
+import { type CloudflareApiOptions } from "./api.ts";
+/**
+ * Supported Access identity provider types. The five most common providers
+ * have strict {@link AccessIdentityProviderProps} variants below; everything
+ * else falls back to {@link OtherIdentityProviderProps} with a permissive
+ * `config` shape.
+ */
+export type AccessIdentityProviderType = "onetimepin" | "google" | "google-apps" | "github" | "okta" | "azureAD" | "oidc" | "saml" | "centrify" | "facebook" | "linkedin" | "onelogin" | "pingone" | "yandex" | (string & {});
+interface BaseAccessIdpProps extends CloudflareApiOptions {
+    /**
+     * Display name shown on the Access login page.
+     *
+     * @default ${app}-${stage}-${id}
+     */
+    name?: string;
+    /**
+     * Adopt an existing IdP with the same name instead of failing.
+     *
+     * @default false
+     */
+    adopt?: boolean;
+    /**
+     * Whether to delete the IdP when removed from Alchemy.
+     *
+     * @default true
+     */
+    delete?: boolean;
+}
+/**
+ * One-Time PIN — Cloudflare emails a code to the user. No external IdP
+ * configuration required.
+ */
+export interface OneTimePinIdentityProviderProps extends BaseAccessIdpProps {
+    type: "onetimepin";
+}
+/**
+ * Google OAuth identity provider.
+ */
+export interface GoogleIdentityProviderProps extends BaseAccessIdpProps {
+    type: "google";
+    /**
+     * OAuth 2.0 client ID issued by Google for your application.
+     * This is a public identifier (not a secret).
+     */
+    clientId: string;
+    /**
+     * OAuth 2.0 client secret issued by Google. Use {@link alchemy.secret} so
+     * the value is encrypted at rest in the Alchemy state file.
+     */
+    clientSecret: string | Secret;
+    /**
+     * Custom claims to request from the IdP and forward into the Access JWT.
+     */
+    claims?: string[];
+    /**
+     * Override the OIDC claim Cloudflare reads as the user's email
+     * (defaults to `email`).
+     */
+    emailClaimName?: string;
+}
+/**
+ * Okta identity provider (OIDC under the hood).
+ */
+export interface OktaIdentityProviderProps extends BaseAccessIdpProps {
+    type: "okta";
+    /**
+     * Your Okta tenant subdomain, e.g. `acme` for `acme.okta.com`.
+     */
+    oktaAccount: string;
+    /**
+     * Custom Okta authorization server ID. Omit to use Okta's default
+     * authorization server.
+     */
+    authorizationServerId?: string;
+    /**
+     * OAuth 2.0 client ID of the Okta app integration.
+     */
+    clientId: string;
+    /**
+     * OAuth 2.0 client secret of the Okta app integration. Use
+     * {@link alchemy.secret} for at-rest encryption.
+     */
+    clientSecret: string | Secret;
+    /**
+     * Custom claims to request from Okta and forward into the Access JWT.
+     */
+    claims?: string[];
+    /**
+     * Override the OIDC claim Cloudflare reads as the user's email
+     * (defaults to `email`).
+     */
+    emailClaimName?: string;
+}
+/**
+ * Generic OpenID Connect identity provider.
+ */
+export interface OidcIdentityProviderProps extends BaseAccessIdpProps {
+    type: "oidc";
+    /**
+     * IdP authorization endpoint URL (the page users are redirected to to
+     * sign in).
+     */
+    authUrl: string;
+    /**
+     * IdP token endpoint URL (used by Cloudflare to exchange the auth code
+     * for tokens).
+     */
+    tokenUrl: string;
+    /**
+     * JWKS endpoint URL — public keys Cloudflare uses to verify ID-token
+     * signatures.
+     */
+    certsUrl: string;
+    /**
+     * OAuth 2.0 client ID registered with the IdP.
+     */
+    clientId: string;
+    /**
+     * OAuth 2.0 client secret registered with the IdP. Use
+     * {@link alchemy.secret} for at-rest encryption.
+     */
+    clientSecret: string | Secret;
+    /**
+     * OIDC scopes to request. Defaults to `["openid", "email", "profile"]`
+     * server-side if omitted.
+     */
+    scopes?: string[];
+    /**
+     * Custom claims to request from the IdP and forward into the Access JWT.
+     */
+    claims?: string[];
+    /**
+     * Override the OIDC claim Cloudflare reads as the user's email
+     * (defaults to `email`).
+     */
+    emailClaimName?: string;
+    /**
+     * Enable PKCE on the authorization code flow. Recommended for public
+     * clients and required by some IdPs.
+     */
+    pkceEnabled?: boolean;
+}
+/**
+ * Generic SAML 2.0 identity provider.
+ */
+export interface SamlIdentityProviderProps extends BaseAccessIdpProps {
+    type: "saml";
+    /**
+     * SAML issuer (entity ID) of the IdP, used to validate the `Issuer`
+     * element of incoming assertions.
+     */
+    issuerUrl: string;
+    /**
+     * IdP single sign-on URL — Cloudflare redirects users here to start
+     * the SAML flow.
+     */
+    ssoTargetUrl: string;
+    /**
+     * PEM-encoded x509 certificates the IdP will use to sign assertions.
+     * Multiple entries support certificate rotation.
+     */
+    idpPublicCerts: string[];
+    /**
+     * SAML attributes to forward from the assertion into the Access JWT.
+     */
+    attributes?: string[];
+    /**
+     * Override the SAML attribute Cloudflare reads as the user's email
+     * (defaults to `email`).
+     */
+    emailAttributeName?: string;
+    /**
+     * Map SAML attributes to HTTP headers Cloudflare will inject when
+     * forwarding requests to the origin.
+     */
+    headerAttributes?: {
+        headerName: string;
+        attributeName: string;
+    }[];
+    /**
+     * Sign outgoing AuthnRequests with Cloudflare's signing key.
+     */
+    signRequest?: boolean;
+}
+/**
+ * Catch-all for IdP types not covered by a strict variant
+ * (`azureAD`, `github`, `google-apps`, `centrify`, `facebook`, `linkedin`,
+ * `onelogin`, `pingone`, `yandex`, or future providers).
+ *
+ * Pass a free-form camelCase `config` object — keys are converted to
+ * snake_case at the API boundary. This nested escape hatch is an
+ * intentional exception to the flat-props convention used by the strict
+ * variants above.
+ */
+export interface OtherIdentityProviderProps extends BaseAccessIdpProps {
+    type: Exclude<AccessIdentityProviderType, "onetimepin" | "google" | "okta" | "oidc" | "saml">;
+    /**
+     * Free-form provider configuration. Use {@link alchemy.secret} for any
+     * sensitive values; they are unwrapped before sending to Cloudflare.
+     */
+    config: {
+        clientId?: string;
+        clientSecret?: string | Secret;
+    } & Record<string, unknown>;
+}
+/**
+ * Properties for creating or updating an {@link AccessIdentityProvider}.
+ */
+export type AccessIdentityProviderProps = OneTimePinIdentityProviderProps | GoogleIdentityProviderProps | OktaIdentityProviderProps | OidcIdentityProviderProps | SamlIdentityProviderProps | OtherIdentityProviderProps;
+/**
+ * Output for an {@link AccessIdentityProvider}.
+ */
+export type AccessIdentityProvider = Omit<AccessIdentityProviderProps, "adopt" | "delete"> & {
+    /** Cloudflare-assigned IdP UUID. */
+    id: string;
+    /** Display name. */
+    name: string;
+};
+/**
+ * Type guard for {@link AccessIdentityProvider}.
+ */
+export declare function isAccessIdentityProvider(resource: any): resource is AccessIdentityProvider;
+/**
+ * Creates a Cloudflare Zero Trust [Access identity provider](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/)
+ * which lets users sign in to Access-protected applications.
+ *
+ * @example
+ * // Built-in One-Time PIN (no IdP setup required).
+ * const otp = await AccessIdentityProvider("otp", {
+ *   type: "onetimepin",
+ *   name: "Email OTP",
+ * });
+ *
+ * @example
+ * // Google OAuth. clientId is a public OAuth identifier (not a secret).
+ * const google = await AccessIdentityProvider("google", {
+ *   type: "google",
+ *   name: "Google",
+ *   clientId: process.env.GOOGLE_CLIENT_ID!,
+ *   clientSecret: alchemy.secret.env.GOOGLE_CLIENT_SECRET,
+ * });
+ *
+ * @example
+ * // Generic OIDC provider.
+ * const oidc = await AccessIdentityProvider("idp", {
+ *   type: "oidc",
+ *   name: "Corporate IdP",
+ *   authUrl: "https://idp.example.com/oauth2/authorize",
+ *   tokenUrl: "https://idp.example.com/oauth2/token",
+ *   certsUrl: "https://idp.example.com/oauth2/certs",
+ *   clientId: "my-app",
+ *   clientSecret: alchemy.secret.env.IDP_CLIENT_SECRET,
+ *   scopes: ["openid", "email", "profile"],
+ *   pkceEnabled: true,
+ * });
+ */
+export declare const AccessIdentityProvider: (((this: any, id: string, props?: {}) => never) & (new (_: never) => never)) | ((this: Context<AccessIdentityProvider>, id: string, props: AccessIdentityProviderProps) => Promise<AccessIdentityProvider>);
+export {};
+//# sourceMappingURL=access-identity-provider.d.ts.map

package/lib/cloudflare/access-identity-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-identity-provider.d.ts","sourceRoot":"","sources":["../../src/cloudflare/access-identity-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAOtC,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,UAAU,CAAC;AAElB;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAClC,YAAY,GACZ,QAAQ,GACR,aAAa,GACb,QAAQ,GACR,MAAM,GACN,SAAS,GACT,MAAM,GACN,MAAM,GACN,UAAU,GACV,UAAU,GACV,UAAU,GACV,UAAU,GACV,SAAS,GACT,QAAQ,GACR,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,UAAU,kBAAmB,SAAQ,oBAAoB;IACvD;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,+BAAgC,SAAQ,kBAAkB;IACzE,IAAI,EAAE,YAAY,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA4B,SAAQ,kBAAkB;IACrE,IAAI,EAAE,QAAQ,CAAC;IAEf;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IAE9B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,yBAA0B,SAAQ,kBAAkB;IACnE,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IAE9B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,yBAA0B,SAAQ,kBAAkB;IACnE,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IAE9B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,yBAA0B,SAAQ,kBAAkB;IACnE,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAEzB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;;OAGG;IACH,gBAAgB,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAEnE;;OAEG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,0BAA2B,SAAQ,kBAAkB;IACpE,IAAI,EAAE,OAAO,CACX,0BAA0B,EAC1B,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CACnD,CAAC;IAEF;;;OAGG;IACH,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,MAAM,CACpE,MAAM,EACN,OAAO,CACR,CAAC;CACH;AAED;;GAEG;AACH,MAAM,MAAM,2BAA2B,GACnC,+BAA+B,GAC/B,2BAA2B,GAC3B,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,0BAA0B,CAAC;AAE/B;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,IAAI,CACvC,2BAA2B,EAC3B,OAAO,GAAG,QAAQ,CACnB,GAAG;IACF,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,GAAG,GACZ,QAAQ,IAAI,sBAAsB,CAEpC;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,sBAAsB,yFAGzB,OAAO,CAAC,sBAAsB,CAAC,MACjC,MAAM,SACH,2BAA2B,KACjC,OAAO,CAAC,sBAAsB,CAAC,CA2FnC,CAAC"}