alchemy 2.0.0-beta.55 → 2.0.0-beta.56

package/lib/Cloudflare/Access/KeyConfiguration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyConfiguration.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Access/KeyConfiguration.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,QAAA,MAAM,4BAA4B,EAChC,oCAA6C,CAAC;AAChD,KAAK,4BAA4B,GAAG,OAAO,4BAA4B,CAAC;AAExE,MAAM,MAAM,2BAA2B,GAAG;IACxC;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,uBAAuB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,sDAAsD;IACtD,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,uEAAuE;IACvE,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;;;OAKG;IACH,8BAA8B,EAAE,MAAM,GAAG,SAAS,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAC3C,4BAA4B,EAC5B,2BAA2B,EAC3B,gCAAgC,EAChC,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,sBAAsB,mEAElC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,UAC5B,OAAO,KACb,KAAK,IAAI,sBAEiC,CAAC;AAE9C,eAAO,MAAM,8BAA8B,wNA0FvC,CAAC"}

package/lib/Cloudflare/Access/KeyConfiguration.js

@@ -0,0 +1,126 @@
+import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
+const AccessKeyConfigurationTypeId = "Cloudflare.Access.KeyConfiguration";
+/**
+ * The Cloudflare Zero Trust Access service-key rotation configuration for an
+ * account (`/accounts/{account_id}/access/keys`).
+ *
+ * The key configuration is an account singleton — it always exists, so this
+ * resource never creates or deletes anything physical. Reconcile PUTs the
+ * rotation interval when the observed value differs from the desired one;
+ * destroy restores the interval the account had before Alchemy first managed
+ * it (captured as `initialKeyRotationIntervalDays`).
+ *
+ * @section Managing the rotation interval
+ * @example Rotate Access service keys every 30 days
+ * ```typescript
+ * const keys = yield* Cloudflare.AccessKeyConfiguration("Keys", {
+ *   keyRotationIntervalDays: 30,
+ * });
+ * ```
+ *
+ * @example Inspect rotation status
+ * ```typescript
+ * const keys = yield* Cloudflare.AccessKeyConfiguration("Keys", {
+ *   keyRotationIntervalDays: 90,
+ * });
+ * // keys.daysUntilNextRotation, keys.lastKeyRotationAt
+ * ```
+ *
+ * @see https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/keys/
+ */
+export const AccessKeyConfiguration = Resource(AccessKeyConfigurationTypeId);
+/**
+ * Returns true if the given value is an AccessKeyConfiguration resource.
+ */
+export const isAccessKeyConfiguration = (value) => Predicate.hasProperty(value, "Type") &&
+    value.Type === AccessKeyConfigurationTypeId;
+export const AccessKeyConfigurationProvider = () => Provider.succeed(AccessKeyConfiguration, {
+    nuke: { singleton: true },
+    stables: ["accountId", "initialKeyRotationIntervalDays"],
+    list: Effect.fn(function* () {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        // Per-account singleton: the key configuration always exists with a
+        // Cloudflare default and there is no enumeration API — read the one
+        // instance and return it as a one-element array. The observed
+        // interval becomes the value restored on destroy (adoption read).
+        const observed = yield* zeroTrust.getAccessKey({ accountId });
+        return [
+            toAttributes(accountId, observed, observed.keyRotationIntervalDays ?? undefined),
+        ];
+    }),
+    diff: Effect.fn(function* ({ output }) {
+        // The configuration is an account singleton — its identity is the
+        // account. Moving accounts replaces (old account's interval is
+        // restored as the old instance deletes).
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        if ((output?.accountId ?? accountId) !== accountId) {
+            return { action: "replace" };
+        }
+        return undefined;
+    }),
+    read: Effect.fn(function* ({ output }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const acct = output?.accountId ?? accountId;
+        const observed = yield* zeroTrust.getAccessKey({ accountId: acct });
+        // The configuration is a singleton that always exists with a
+        // Cloudflare default — there is nothing to "own", so a cold read
+        // adopts freely (never `Unowned`). The observed interval at adoption
+        // time becomes the value restored on destroy.
+        const initial = output !== undefined
+            ? output.initialKeyRotationIntervalDays
+            : (observed.keyRotationIntervalDays ?? undefined);
+        return toAttributes(acct, observed, initial);
+    }),
+    reconcile: Effect.fn(function* ({ news, output }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        // 1. Observe — the configuration always exists; read the live value.
+        const observed = yield* zeroTrust.getAccessKey({ accountId });
+        // 2. Capture — the pre-management interval, restored on destroy.
+        //    `output` (including an adoption read) already carries it;
+        //    otherwise this is our first touch and the observed interval is
+        //    the account's original.
+        const initial = output !== undefined
+            ? output.initialKeyRotationIntervalDays
+            : (observed.keyRotationIntervalDays ?? undefined);
+        // 3. Sync — PUT only when the observed interval differs.
+        if (observed.keyRotationIntervalDays === news.keyRotationIntervalDays) {
+            return toAttributes(accountId, observed, initial);
+        }
+        const updated = yield* zeroTrust.putAccessKey({
+            accountId,
+            keyRotationIntervalDays: news.keyRotationIntervalDays,
+        });
+        return toAttributes(accountId, updated, initial);
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        const { accountId, initialKeyRotationIntervalDays } = output;
+        // Nothing physical to delete — restore the pre-management interval.
+        // If Cloudflare reported no interval at adoption time there is
+        // nothing to restore to; leave the current value in place.
+        if (initialKeyRotationIntervalDays === undefined)
+            return;
+        const observed = yield* zeroTrust.getAccessKey({ accountId });
+        // Skip the PUT when the live value already matches (idempotent
+        // re-delete after a crashed run).
+        if (observed.keyRotationIntervalDays === initialKeyRotationIntervalDays) {
+            return;
+        }
+        yield* zeroTrust.putAccessKey({
+            accountId,
+            keyRotationIntervalDays: initialKeyRotationIntervalDays,
+        });
+    }),
+});
+const toAttributes = (accountId, observed, initialKeyRotationIntervalDays) => ({
+    accountId,
+    keyRotationIntervalDays: observed.keyRotationIntervalDays ?? undefined,
+    daysUntilNextRotation: observed.daysUntilNextRotation ?? undefined,
+    lastKeyRotationAt: observed.lastKeyRotationAt ?? undefined,
+    initialKeyRotationIntervalDays,
+});
+//# sourceMappingURL=KeyConfiguration.js.map

package/lib/Cloudflare/Access/KeyConfiguration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyConfiguration.js","sourceRoot":"","sources":["../../../src/Cloudflare/Access/KeyConfiguration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,wCAAwC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAGpE,MAAM,4BAA4B,GAChC,oCAA6C,CAAC;AAuChD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAC5C,4BAA4B,CAC7B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,KAAc,EACmB,EAAE,CACnC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC;IACpC,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC;AAE9C,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,EAAE,CACjD,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE;IACvC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;IACzB,OAAO,EAAE,CAAC,WAAW,EAAE,gCAAgC,CAAC;IAExD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,oEAAoE;QACpE,oEAAoE;QACpE,8DAA8D;QAC9D,kEAAkE;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO;YACL,YAAY,CACV,SAAS,EACT,QAAQ,EACR,QAAQ,CAAC,uBAAuB,IAAI,SAAS,CAC9C;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACnC,kEAAkE;QAClE,+DAA+D;QAC/D,yCAAyC;QACzC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACnC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,6DAA6D;QAC7D,iEAAiE;QACjE,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,OAAO,GACX,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,MAAM,CAAC,8BAA8B;YACvC,CAAC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,IAAI,SAAS,CAAC,CAAC;QACtD,OAAO,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC9C,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAE1D,qEAAqE;QACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAE9D,iEAAiE;QACjE,+DAA+D;QAC/D,oEAAoE;QACpE,6BAA6B;QAC7B,MAAM,OAAO,GACX,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,MAAM,CAAC,8BAA8B;YACvC,CAAC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,IAAI,SAAS,CAAC,CAAC;QAEtD,yDAAyD;QACzD,IAAI,QAAQ,CAAC,uBAAuB,KAAK,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACtE,OAAO,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC;YAC5C,SAAS;YACT,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;SACtD,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,MAAM,EAAE,SAAS,EAAE,8BAA8B,EAAE,GAAG,MAAM,CAAC;QAC7D,oEAAoE;QACpE,+DAA+D;QAC/D,2DAA2D;QAC3D,IAAI,8BAA8B,KAAK,SAAS;YAAE,OAAO;QACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,+DAA+D;QAC/D,kCAAkC;QAClC,IAAI,QAAQ,CAAC,uBAAuB,KAAK,8BAA8B,EAAE,CAAC;YACxE,OAAO;QACT,CAAC;QACD,KAAK,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC;YAC5B,SAAS;YACT,uBAAuB,EAAE,8BAA8B;SACxD,CAAC,CAAC;IACL,CAAC,CAAC;CACH,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,CACnB,SAAiB,EACjB,QAAyE,EACzE,8BAAkD,EAChB,EAAE,CAAC,CAAC;IACtC,SAAS;IACT,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB,IAAI,SAAS;IACtE,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,IAAI,SAAS;IAClE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,IAAI,SAAS;IAC1D,8BAA8B;CAC/B,CAAC,CAAC"}

package/lib/Cloudflare/Access/McpPortal.d.ts

@@ -0,0 +1,97 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+declare const AccessMcpPortalTypeId: "Cloudflare.Access.McpPortal";
+type AccessMcpPortalTypeId = typeof AccessMcpPortalTypeId;
+export interface AccessMcpPortalProps {
+    /**
+     * The client-supplied portal identifier. Immutable — changing it
+     * triggers a replacement. If omitted, a deterministic id is generated
+     * from the app, stage, and logical ID.
+     * @default ${app}-${stage}-${id}
+     */
+    portalId?: string;
+    /**
+     * Display name of the portal. If omitted, the portal id is reused.
+     * @default the portal id
+     */
+    name?: string;
+    /**
+     * The hostname the portal is served on. Must belong to a zone on the
+     * account.
+     */
+    hostname: string;
+    /**
+     * Optional description of the portal.
+     */
+    description?: string;
+    /**
+     * Allow remote code execution in Dynamic Workers (beta). When omitted,
+     * the server-side default applies (observed: `true`).
+     */
+    allowCodeMode?: boolean;
+    /**
+     * Route outbound MCP traffic through the Zero Trust Secure Web
+     * Gateway.
+     * @default false
+     */
+    secureWebGateway?: boolean;
+}
+export type AccessMcpPortalAttributes = {
+    /** The portal id. */
+    portalId: string;
+    /** Account that owns the portal. */
+    accountId: string;
+    /** Observed display name. */
+    name: string;
+    /** Observed portal hostname. */
+    hostname: string;
+    /** Observed description, if any. */
+    description: string | undefined;
+    /** Whether Dynamic Workers code mode is allowed. */
+    allowCodeMode: boolean;
+    /** Whether outbound MCP traffic routes through the gateway. */
+    secureWebGateway: boolean;
+    /** RFC 3339 timestamp of when the portal was created, if reported. */
+    createdAt: string | undefined;
+};
+export type AccessMcpPortal = Resource<AccessMcpPortalTypeId, AccessMcpPortalProps, AccessMcpPortalAttributes, never, Providers>;
+/**
+ * A Cloudflare Zero Trust **AI Controls MCP portal** — a hosted gateway
+ * that aggregates MCP servers behind a single Access-protected hostname
+ * so administrators can govern which AI tools and prompts are exposed to
+ * users.
+ *
+ * The product surface is in beta and requires the AI Controls
+ * entitlement; accounts without it receive the typed `Forbidden` error
+ * on all writes. Attaching servers to the portal is managed out of band
+ * (a future `Cloudflare.Access.McpServer` resource).
+ *
+ * @section Creating an MCP portal
+ * @example Minimal portal
+ * ```typescript
+ * const portal = yield* Cloudflare.AccessMcpPortal("AiPortal", {
+ *   hostname: "mcp.example.com",
+ * });
+ * ```
+ *
+ * @example Portal with gateway egress
+ * ```typescript
+ * const portal = yield* Cloudflare.AccessMcpPortal("AiPortal", {
+ *   hostname: "mcp.example.com",
+ *   description: "Company-approved AI tools",
+ *   secureWebGateway: true,
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/
+ */
+export declare const AccessMcpPortal: import("../../Resource.ts").ResourceClass<AccessMcpPortal>;
+/**
+ * Returns true if the given value is an AccessMcpPortal resource.
+ */
+export declare const isAccessMcpPortal: (value: unknown) => value is AccessMcpPortal;
+export declare const AccessMcpPortalProvider: () => import("effect/Layer").Layer<Provider.Provider<AccessMcpPortal>, never, CloudflareEnvironment | import("@distilled.cloud/cloudflare").Credentials | import("effect/unstable/http/HttpClient").HttpClient | import("../../Stack.ts").Stack | import("../../Stage.ts").Stage>;
+export {};
+//# sourceMappingURL=McpPortal.d.ts.map

package/lib/Cloudflare/Access/McpPortal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpPortal.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Access/McpPortal.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,QAAA,MAAM,qBAAqB,EAAG,6BAAsC,CAAC;AACrE,KAAK,qBAAqB,GAAG,OAAO,qBAAqB,CAAC;AAE1D,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,qBAAqB;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,oDAAoD;IACpD,aAAa,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,gBAAgB,EAAE,OAAO,CAAC;IAC1B,sEAAsE;IACtE,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,QAAQ,CACpC,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,eAAe,4DAAmD,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,iBAAiB,UAAW,OAAO,KAAG,KAAK,IAAI,eACkB,CAAC;AAE/E,eAAO,MAAM,uBAAuB,mRA0HhC,CAAC"}

package/lib/Cloudflare/Access/McpPortal.js

@@ -0,0 +1,164 @@
+import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+import * as Stream from "effect/Stream";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
+const AccessMcpPortalTypeId = "Cloudflare.Access.McpPortal";
+/**
+ * A Cloudflare Zero Trust **AI Controls MCP portal** — a hosted gateway
+ * that aggregates MCP servers behind a single Access-protected hostname
+ * so administrators can govern which AI tools and prompts are exposed to
+ * users.
+ *
+ * The product surface is in beta and requires the AI Controls
+ * entitlement; accounts without it receive the typed `Forbidden` error
+ * on all writes. Attaching servers to the portal is managed out of band
+ * (a future `Cloudflare.Access.McpServer` resource).
+ *
+ * @section Creating an MCP portal
+ * @example Minimal portal
+ * ```typescript
+ * const portal = yield* Cloudflare.AccessMcpPortal("AiPortal", {
+ *   hostname: "mcp.example.com",
+ * });
+ * ```
+ *
+ * @example Portal with gateway egress
+ * ```typescript
+ * const portal = yield* Cloudflare.AccessMcpPortal("AiPortal", {
+ *   hostname: "mcp.example.com",
+ *   description: "Company-approved AI tools",
+ *   secureWebGateway: true,
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/
+ */
+export const AccessMcpPortal = Resource(AccessMcpPortalTypeId);
+/**
+ * Returns true if the given value is an AccessMcpPortal resource.
+ */
+export const isAccessMcpPortal = (value) => Predicate.hasProperty(value, "Type") && value.Type === AccessMcpPortalTypeId;
+export const AccessMcpPortalProvider = () => Provider.succeed(AccessMcpPortal, {
+    stables: ["portalId", "accountId", "createdAt"],
+    list: Effect.fn(function* () {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        // Account-scoped collection; exhaustively paginate. The list rows
+        // carry the full portal shape, so each maps directly into the same
+        // Attributes `read` returns. Accounts without the AI Controls
+        // entitlement reject the route with the typed `Forbidden` — treat
+        // them as having no portals.
+        return yield* zeroTrust.listAccessAiControlMcpPortals
+            .pages({ accountId })
+            .pipe(Stream.runCollect, Effect.map((chunk) => Array.from(chunk).flatMap((page) => (page.result ?? []).map((portal) => toAttributes(portal, accountId)))), Effect.catchTag("Forbidden", () => Effect.succeed([])));
+    }),
+    diff: Effect.fn(function* ({ olds, news, output }) {
+        if (!isResolved(news))
+            return undefined;
+        // The portal id is the API identity — changing it is a replacement.
+        const oldId = output?.portalId ?? olds?.portalId;
+        if (news.portalId !== undefined &&
+            oldId !== undefined &&
+            oldId !== news.portalId) {
+            return { action: "replace" };
+        }
+        return undefined;
+    }),
+    read: Effect.fn(function* ({ id, output, olds }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const acct = output?.accountId ?? accountId;
+        // The portal id is deterministic (client-supplied or derived from
+        // the logical id), so a direct read covers the cold case too.
+        const portalId = output?.portalId ?? (yield* createPortalId(id, olds?.portalId));
+        const observed = yield* observePortal(acct, portalId);
+        return observed ? toAttributes(observed, acct) : undefined;
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const portalId = output?.portalId ?? (yield* createPortalId(id, news.portalId));
+        const name = news.name ?? portalId;
+        // 1. Observe.
+        const observed = yield* observePortal(accountId, portalId);
+        // 2. Ensure — create when missing.
+        if (!observed) {
+            const created = yield* zeroTrust.createAccessAiControlMcpPortal({
+                accountId,
+                id: portalId,
+                hostname: news.hostname,
+                name,
+                ...(news.description !== undefined
+                    ? { description: news.description }
+                    : {}),
+                ...(news.allowCodeMode !== undefined
+                    ? { allowCodeMode: news.allowCodeMode }
+                    : {}),
+                ...(news.secureWebGateway !== undefined
+                    ? { secureWebGateway: news.secureWebGateway }
+                    : {}),
+            });
+            return toAttributes(created, accountId);
+        }
+        // 3. Sync — update only when the observed state differs. Unset
+        //    optional props mean "keep the observed value" (the API applies
+        //    server-side defaults on create, e.g. allowCodeMode: true).
+        const dirty = observed.name !== name ||
+            observed.hostname !== news.hostname ||
+            (news.description !== undefined &&
+                (observed.description || undefined) !== news.description) ||
+            (news.allowCodeMode !== undefined &&
+                (observed.allowCodeMode ?? false) !== news.allowCodeMode) ||
+            (news.secureWebGateway !== undefined &&
+                (observed.secureWebGateway ?? false) !== news.secureWebGateway);
+        if (!dirty) {
+            return toAttributes(observed, accountId);
+        }
+        const updated = yield* zeroTrust.updateAccessAiControlMcpPortal({
+            accountId,
+            id: portalId,
+            name,
+            hostname: news.hostname,
+            ...(news.description !== undefined
+                ? { description: news.description }
+                : {}),
+            ...(news.allowCodeMode !== undefined
+                ? { allowCodeMode: news.allowCodeMode }
+                : {}),
+            ...(news.secureWebGateway !== undefined
+                ? { secureWebGateway: news.secureWebGateway }
+                : {}),
+        });
+        return toAttributes(updated, accountId);
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        yield* zeroTrust
+            .deleteAccessAiControlMcpPortal({
+            accountId: output.accountId,
+            id: output.portalId,
+        })
+            .pipe(Effect.catchTag("McpPortalNotFound", () => Effect.void));
+    }),
+});
+/**
+ * Read a portal by id, mapping "gone" to `undefined`.
+ */
+const observePortal = (accountId, id) => zeroTrust
+    .readAccessAiControlMcpPortal({ accountId, id })
+    .pipe(Effect.catchTag("McpPortalNotFound", () => Effect.succeed(undefined)));
+const createPortalId = (id, portalId) => Effect.gen(function* () {
+    return portalId ?? (yield* createPhysicalName({ id, lowercase: true }));
+});
+const toAttributes = (portal, accountId) => ({
+    portalId: portal.id,
+    accountId,
+    name: portal.name,
+    hostname: portal.hostname,
+    description: portal.description || undefined,
+    allowCodeMode: portal.allowCodeMode ?? false,
+    secureWebGateway: portal.secureWebGateway ?? false,
+    createdAt: portal.createdAt ?? undefined,
+});
+//# sourceMappingURL=McpPortal.js.map

package/lib/Cloudflare/Access/McpPortal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpPortal.js","sourceRoot":"","sources":["../../../src/Cloudflare/Access/McpPortal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,wCAAwC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAGpE,MAAM,qBAAqB,GAAG,6BAAsC,CAAC;AAiErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAkB,qBAAqB,CAAC,CAAC;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAA4B,EAAE,CAC5E,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,CAAC;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,EAAE,CAC1C,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE;IAChC,OAAO,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC;IAE/C,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,kEAAkE;QAClE,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,6BAA6B;QAC7B,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,6BAA6B;aAClD,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;aACpB,IAAI,CACH,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACjC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAChC,CACF,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CACvD,CAAC;IACN,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,oEAAoE;QACpE,MAAM,KAAK,GAAG,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,CAAC;QACjD,IACE,IAAI,CAAC,QAAQ,KAAK,SAAS;YAC3B,KAAK,KAAK,SAAS;YACnB,KAAK,KAAK,IAAI,CAAC,QAAQ,EACvB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;QAE5C,kEAAkE;QAClE,8DAA8D;QAC9D,MAAM,QAAQ,GACZ,MAAM,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtD,OAAO,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAClD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,QAAQ,GACZ,MAAM,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;QAEnC,cAAc;QACd,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAE3D,mCAAmC;QACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC;gBAC9D,SAAS;gBACT,EAAE,EAAE,QAAQ;gBACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI;gBACJ,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;oBAChC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;oBACnC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;oBAClC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE;oBACvC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE;oBAC7C,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;QAED,+DAA+D;QAC/D,oEAAoE;QACpE,gEAAgE;QAChE,MAAM,KAAK,GACT,QAAQ,CAAC,IAAI,KAAK,IAAI;YACtB,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YACnC,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;gBAC7B,CAAC,QAAQ,CAAC,WAAW,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC;YAC3D,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;gBAC/B,CAAC,QAAQ,CAAC,aAAa,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC;YAC3D,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS;gBAClC,CAAC,QAAQ,CAAC,gBAAgB,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC;YAC9D,SAAS;YACT,EAAE,EAAE,QAAQ;YACZ,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;gBAChC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;gBACnC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,KAAK,CAAC,CAAC,SAAS;aACb,8BAA8B,CAAC;YAC9B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,EAAE,EAAE,MAAM,CAAC,QAAQ;SACpB,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC;CACH,CAAC,CAAC;AAeL;;GAEG;AACH,MAAM,aAAa,GAAG,CAAC,SAAiB,EAAE,EAAU,EAAE,EAAE,CACtD,SAAS;KACN,4BAA4B,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;KAC/C,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACtE,CAAC;AAEN,MAAM,cAAc,GAAG,CAAC,EAAU,EAAE,QAA4B,EAAE,EAAE,CAClE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,CACnB,MAAsB,EACtB,SAAiB,EACU,EAAE,CAAC,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC,EAAE;IACnB,SAAS;IACT,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,SAAS;IAC5C,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,KAAK;IAC5C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,KAAK;IAClD,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;CACzC,CAAC,CAAC"}

package/lib/Cloudflare/Access/Organization.d.ts

@@ -0,0 +1,176 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+export type AccessOrganizationProps = {
+    /**
+     * The unique subdomain assigned to your Zero Trust organization, e.g.
+     * `acme.cloudflareaccess.com`. Per-account this is functionally immutable —
+     * Cloudflare allocates exactly one team domain when the account first
+     * enables Zero Trust and changing it is a manual support operation.
+     *
+     * @see https://developers.cloudflare.com/cloudflare-one/setup/#1-create-a-team-name
+     */
+    authDomain: string;
+    /**
+     * Human-readable display name of your Zero Trust organization. Usually the
+     * same as `authDomain`. Mutable.
+     *
+     * @see https://developers.cloudflare.com/api/operations/zero-trust-organization-update-your-zero-trust-organization
+     */
+    name?: string;
+    /**
+     * Default session lifetime for Access applications. Must be a Go duration
+     * string (e.g. `30m`, `2h45m`, `24h`). Valid units: `ns`, `us`, `ms`, `s`,
+     * `m`, `h`. Per-application settings override this default.
+     *
+     * @see https://developers.cloudflare.com/cloudflare-one/identity/users/session-management/
+     */
+    sessionDuration?: string;
+    /**
+     * When `true`, users may authenticate to Access applications via the WARP
+     * client without going through the configured identity providers. Per-app
+     * settings take precedence.
+     *
+     * @default false
+     * @see https://developers.cloudflare.com/cloudflare-one/identity/devices/warp-authentication-identity/
+     */
+    allowAuthenticateViaWarp?: boolean;
+    /**
+     * When `true`, all Zero Trust settings in the Cloudflare dashboard are
+     * read-only and may only be modified via the API or Terraform.
+     *
+     * @default false
+     */
+    isUiReadOnly?: boolean;
+    /**
+     * When `true`, users skip the identity provider selection step on login.
+     * Only valid when exactly one IdP is configured (or one is set as default).
+     *
+     * @default false
+     */
+    autoRedirectToIdentity?: boolean;
+    /**
+     * Free-form description of why `isUiReadOnly` is toggled. Surfaced in the
+     * Cloudflare dashboard.
+     */
+    uiReadOnlyToggleReason?: string;
+    /**
+     * Duration of user-seat inactivity before the user is removed as an active
+     * seat and stops counting against the Teams seat quota. Go duration string.
+     */
+    userSeatExpirationInactiveTime?: string;
+    /**
+     * Lifetime of tokens issued by the WARP authentication flow. Go duration
+     * string limited to `m` and `h` units, e.g. `30m` or `2h45m`.
+     */
+    warpAuthSessionDuration?: string;
+    /**
+     * Branding for the Access login screen.
+     *
+     * @see https://developers.cloudflare.com/cloudflare-one/identity/users/login-page/
+     */
+    loginDesign?: AccessOrganization.LoginDesign;
+    /**
+     * Pointers to custom HTML pages shown when Access blocks a request.
+     *
+     * @see https://developers.cloudflare.com/cloudflare-one/policies/access/custom-pages/
+     */
+    customPages?: AccessOrganization.CustomPages;
+};
+export declare namespace AccessOrganization {
+    /**
+     * Branding for the Access login screen.
+     */
+    interface LoginDesign {
+        /** URL of the logo image rendered at the top of the login form. */
+        logoPath?: string;
+        /** CSS color for the header background, e.g. `#1a1a1a`. */
+        headerBgColor?: string;
+        /** CSS color for the page background. */
+        backgroundColor?: string;
+        /** CSS color for the body text. */
+        textColor?: string;
+        /** Markdown rendered at the top of the login form (legacy). */
+        headerText?: string;
+        /** Markdown rendered at the bottom of the login form. */
+        footerText?: string;
+    }
+    /**
+     * Pointers to custom HTML pages shown when Access denies a request.
+     */
+    interface CustomPages {
+        /**
+         * UUID of a custom forbidden page (created via the Access Custom Pages
+         * API) shown when a policy denies access.
+         */
+        forbidden?: string;
+        /**
+         * UUID of a custom identity-denied page shown when the identity provider
+         * rejects the user.
+         */
+        identityDenied?: string;
+    }
+}
+export type AccessOrganization = Resource<"Cloudflare.AccessOrganization", AccessOrganizationProps, {
+    /** Cloudflare account that owns the Zero Trust organization. */
+    accountId: string;
+    /** The Zero Trust team domain, e.g. `acme.cloudflareaccess.com`. */
+    authDomain: string;
+    /** Display name of the organization. */
+    name: string;
+    /** Default Access application session duration. */
+    sessionDuration: string | undefined;
+    /** WARP-as-IdP toggle observed on Cloudflare. */
+    allowAuthenticateViaWarp: boolean | undefined;
+    /** Dashboard read-only lock observed on Cloudflare. */
+    isUiReadOnly: boolean | undefined;
+    /** Skip-IdP-picker toggle observed on Cloudflare. */
+    autoRedirectToIdentity: boolean | undefined;
+    /** Free-form note explaining the `isUiReadOnly` setting. */
+    uiReadOnlyToggleReason: string | undefined;
+    /** User-seat inactivity expiration observed on Cloudflare. */
+    userSeatExpirationInactiveTime: string | undefined;
+    /** WARP authentication session duration observed on Cloudflare. */
+    warpAuthSessionDuration: string | undefined;
+    /** Login-page branding observed on Cloudflare. */
+    loginDesign: AccessOrganization.LoginDesign | undefined;
+    /** Custom-pages pointers observed on Cloudflare. */
+    customPages: AccessOrganization.CustomPages | undefined;
+}, never, Providers>;
+/**
+ * Account-level Cloudflare Zero Trust organization settings — the team
+ * domain, login branding, session lifetimes, WARP authentication toggle, etc.
+ *
+ * Wraps `PUT /accounts/{account_id}/access/organizations`.
+ *
+ * @remarks
+ * **This resource is a singleton.** Every Cloudflare account owns exactly one
+ * Access Organization; you cannot create a second one and you cannot delete
+ * the existing one without deleting the entire Cloudflare account. As a
+ * result:
+ *
+ * - The `reconcile` lifecycle always **adopts** the existing organization on
+ *   first deploy rather than failing on conflict.
+ * - The `delete` lifecycle is a **no-op** that logs a warning. Removing the
+ *   resource from your stack leaves the Cloudflare-side settings untouched.
+ *
+ * @section Configuring the organization
+ * @example Adopt and brand the organization
+ * ```typescript
+ * const org = yield* Cloudflare.AccessOrganization("Org", {
+ *   authDomain: "acme.cloudflareaccess.com",
+ *   name: "Acme",
+ *   sessionDuration: "24h",
+ *   allowAuthenticateViaWarp: true,
+ *   loginDesign: {
+ *     logoPath: "https://acme.example/logo.png",
+ *     backgroundColor: "#111111",
+ *     textColor: "#ffffff",
+ *   },
+ * });
+ * ```
+ */
+export declare const AccessOrganization: import("../../Resource.ts").ResourceClass<AccessOrganization>;
+export declare const AccessOrganizationProvider: () => import("effect/Layer").Layer<Provider.Provider<AccessOrganization>, never, CloudflareEnvironment | import("@distilled.cloud/cloudflare").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=Organization.d.ts.map

package/lib/Cloudflare/Access/Organization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Organization.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Access/Organization.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;;;;;OAOG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC,WAAW,CAAC;IAC7C;;;;OAIG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC,WAAW,CAAC;CAC9C,CAAC;AAEF,MAAM,CAAC,OAAO,WAAW,kBAAkB,CAAC;IAC1C;;OAEG;IACH,UAAiB,WAAW;QAC1B,mEAAmE;QACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,2DAA2D;QAC3D,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,yCAAyC;QACzC,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,mCAAmC;QACnC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,+DAA+D;QAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,yDAAyD;QACzD,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB;IACD;;OAEG;IACH,UAAiB,WAAW;QAC1B;;;WAGG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB;;;WAGG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB;CACF;AAED,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CACvC,+BAA+B,EAC/B,uBAAuB,EACvB;IACE,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,iDAAiD;IACjD,wBAAwB,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,uDAAuD;IACvD,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,qDAAqD;IACrD,sBAAsB,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5C,4DAA4D;IAC5D,sBAAsB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,8DAA8D;IAC9D,8BAA8B,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,mEAAmE;IACnE,uBAAuB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,kDAAkD;IAClD,WAAW,EAAE,kBAAkB,CAAC,WAAW,GAAG,SAAS,CAAC;IACxD,oDAAoD;IACpD,WAAW,EAAE,kBAAkB,CAAC,WAAW,GAAG,SAAS,CAAC;CACzD,EACD,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,kBAAkB,+DAE9B,CAAC;AAEF,eAAO,MAAM,0BAA0B,oNAoJnC,CAAC"}