alchemy 2.0.0-beta.55 → 2.0.0-beta.56

package/lib/Cloudflare/AiSearch/Token.d.ts

@@ -0,0 +1,127 @@
+import * as Redacted from "effect/Redacted";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+declare const AiSearchTokenTypeId: "Cloudflare.AiSearch.Token";
+type AiSearchTokenTypeId = typeof AiSearchTokenTypeId;
+export type AiSearchTokenProps = {
+    /**
+     * Display name for the service token. Mutable in place.
+     * If omitted, a unique name is generated from the app, stage, and
+     * logical ID.
+     * @default ${app}-${id}-${stage}-${suffix}
+     */
+    name?: string;
+    /**
+     * Id of the underlying Cloudflare API token AI Search authenticates
+     * with when syncing the data source. The token must carry the
+     * "AI Search Index Engine" permission group — Cloudflare validates it
+     * on create/update and rejects tokens without it.
+     */
+    cfApiId: string;
+    /**
+     * Plaintext value of the underlying Cloudflare API token. Write-only —
+     * Cloudflare never returns it, so rotation is detected against the
+     * previously-persisted props rather than observed cloud state.
+     */
+    cfApiKey: Redacted.Redacted<string>;
+    /**
+     * Whether this is a legacy (account-level instance) token.
+     * @default false
+     */
+    legacy?: boolean;
+};
+export type AiSearchTokenAttributes = {
+    /**
+     * AI Search service token id (a UUID). Stable across updates.
+     */
+    id: string;
+    /**
+     * The Cloudflare account the token belongs to.
+     */
+    accountId: string;
+    /**
+     * Display name of the service token.
+     */
+    name: string;
+    /**
+     * Id of the underlying Cloudflare API token.
+     */
+    cfApiId: string;
+    /**
+     * Whether the token is enabled.
+     */
+    enabled: boolean | undefined;
+    /**
+     * Whether this is a legacy (account-level instance) token.
+     */
+    legacy: boolean | undefined;
+    /**
+     * When the token was created.
+     */
+    createdAt: string | undefined;
+    /**
+     * When the token was last modified.
+     */
+    modifiedAt: string | undefined;
+    /**
+     * Who created the token.
+     */
+    createdBy: string | undefined;
+    /**
+     * Who last modified the token.
+     */
+    modifiedBy: string | undefined;
+};
+export type AiSearchToken = Resource<AiSearchTokenTypeId, AiSearchTokenProps, AiSearchTokenAttributes, never, Providers>;
+/**
+ * A Cloudflare AI Search service token — the credential AI Search uses to
+ * access your data source (R2 bucket, Vectorize index, Workers AI) when
+ * indexing.
+ *
+ * The token wraps an existing Cloudflare API token (`cfApiId` +
+ * `cfApiKey`). That API token must carry the "AI Search Index Engine"
+ * permission group — Cloudflare validates the credential on create and
+ * update and rejects tokens without it. Pair it with
+ * `Cloudflare.AccountApiToken` to mint the underlying API token in the
+ * same stack, then reference the service token's `id` from an AI Search
+ * instance's `tokenId` prop.
+ *
+ * @section Creating a Token
+ * @example Minting the underlying API token in the same stack
+ * ```typescript
+ * const apiToken = yield* Cloudflare.AccountApiToken("SearchTokenSource", {
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: ["AI Search Index Engine"],
+ *       resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+ *     },
+ *   ],
+ * });
+ * const token = yield* Cloudflare.AiSearchToken("SearchToken", {
+ *   cfApiId: apiToken.tokenId,
+ *   cfApiKey: apiToken.value,
+ * });
+ * ```
+ *
+ * @section Using the Token from an Instance
+ * @example Wiring the token into an AI Search instance
+ * ```typescript
+ * const search = yield* Cloudflare.AiSearchInstance("Search", {
+ *   source: bucket.bucketName,
+ *   tokenId: token.id,
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/ai-search/
+ */
+export declare const AiSearchToken: import("../../Resource.ts").ResourceClass<AiSearchToken>;
+/**
+ * Returns true if the given value is an AiSearchToken resource.
+ */
+export declare const isAiSearchToken: (value: unknown) => value is AiSearchToken;
+export declare const AiSearchTokenProvider: () => import("effect/Layer").Layer<Provider.Provider<AiSearchToken>, never, CloudflareEnvironment | import("@distilled.cloud/cloudflare").Credentials | import("effect/unstable/http/HttpClient").HttpClient | import("../../Stack.ts").Stack | import("../../Stage.ts").Stage>;
+export {};
+//# sourceMappingURL=Token.d.ts.map

package/lib/Cloudflare/AiSearch/Token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Token.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/AiSearch/Token.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAM5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,QAAA,MAAM,mBAAmB,EAAG,2BAAoC,CAAC;AACjE,KAAK,mBAAmB,GAAG,OAAO,mBAAmB,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,OAAO,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B;;OAEG;IACH,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B;;OAEG;IACH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B;;OAEG;IACH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,QAAQ,CAClC,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,aAAa,0DAA+C,CAAC;AAE1E;;GAEG;AACH,eAAO,MAAM,eAAe,UAAW,OAAO,KAAG,KAAK,IAAI,aACkB,CAAC;AAE7E,eAAO,MAAM,qBAAqB,iRAwH9B,CAAC"}

package/lib/Cloudflare/AiSearch/Token.js

@@ -0,0 +1,213 @@
+import * as aisearch from "@distilled.cloud/cloudflare/aisearch";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Predicate from "effect/Predicate";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
+const AiSearchTokenTypeId = "Cloudflare.AiSearch.Token";
+/**
+ * A Cloudflare AI Search service token — the credential AI Search uses to
+ * access your data source (R2 bucket, Vectorize index, Workers AI) when
+ * indexing.
+ *
+ * The token wraps an existing Cloudflare API token (`cfApiId` +
+ * `cfApiKey`). That API token must carry the "AI Search Index Engine"
+ * permission group — Cloudflare validates the credential on create and
+ * update and rejects tokens without it. Pair it with
+ * `Cloudflare.AccountApiToken` to mint the underlying API token in the
+ * same stack, then reference the service token's `id` from an AI Search
+ * instance's `tokenId` prop.
+ *
+ * @section Creating a Token
+ * @example Minting the underlying API token in the same stack
+ * ```typescript
+ * const apiToken = yield* Cloudflare.AccountApiToken("SearchTokenSource", {
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: ["AI Search Index Engine"],
+ *       resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+ *     },
+ *   ],
+ * });
+ * const token = yield* Cloudflare.AiSearchToken("SearchToken", {
+ *   cfApiId: apiToken.tokenId,
+ *   cfApiKey: apiToken.value,
+ * });
+ * ```
+ *
+ * @section Using the Token from an Instance
+ * @example Wiring the token into an AI Search instance
+ * ```typescript
+ * const search = yield* Cloudflare.AiSearchInstance("Search", {
+ *   source: bucket.bucketName,
+ *   tokenId: token.id,
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/ai-search/
+ */
+export const AiSearchToken = Resource(AiSearchTokenTypeId);
+/**
+ * Returns true if the given value is an AiSearchToken resource.
+ */
+export const isAiSearchToken = (value) => Predicate.hasProperty(value, "Type") && value.Type === AiSearchTokenTypeId;
+export const AiSearchTokenProvider = () => Provider.succeed(AiSearchToken, {
+    stables: ["id", "accountId", "createdAt", "createdBy"],
+    diff: Effect.fn(function* ({ news, output }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        if (!isResolved(news))
+            return undefined;
+        if ((output?.accountId ?? accountId) !== accountId) {
+            return { action: "replace" };
+        }
+        // Everything (name, credentials, legacy flag) is mutable via PUT —
+        // let the engine apply its default update logic.
+        return undefined;
+    }),
+    read: Effect.fn(function* ({ id, output, olds }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const acct = output?.accountId ?? accountId;
+        const observed = output?.id
+            ? yield* getToken(acct, output.id)
+            : // Cold read (lost state): the display name is deterministic, so
+                // scan the token list for it.
+                yield* findTokenByName(acct, yield* createTokenName(id, olds?.name));
+        return observed ? toAttributes(observed, acct) : undefined;
+    }),
+    reconcile: Effect.fn(function* ({ id, news, olds, output }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const acct = output?.accountId ?? accountId;
+        const name = yield* createTokenName(id, news.name);
+        // Observe — `output.id` is a cache, not a guarantee: a missing
+        // token falls through to "missing" and we recreate. Without an id
+        // (greenfield or adoption-by-name), scan the list for the
+        // deterministic display name.
+        const observed = output?.id
+            ? yield* getToken(acct, output.id)
+            : yield* findTokenByName(acct, name);
+        const body = {
+            name,
+            cfApiId: news.cfApiId,
+            cfApiKey: Redacted.value(news.cfApiKey),
+            legacy: news.legacy,
+        };
+        if (!observed) {
+            // Ensure — create with the full desired body. A freshly minted
+            // underlying API token propagates eventually-consistently, so a
+            // transient `InvalidTokenCredentials` (code 7012) is retried
+            // briefly before being treated as a real validation failure.
+            const created = yield* aisearch
+                .createToken({ accountId: acct, ...body })
+                .pipe(retryTokenPropagation);
+            return toAttributes(created, acct);
+        }
+        // Sync — Cloudflare never returns `cfApiKey`, so the secret cannot
+        // be diffed against observed state; fall back to the previously
+        // persisted props for the key only. Everything else diffs against
+        // the observed cloud state.
+        const keyRotated = olds === undefined ||
+            olds.cfApiKey === undefined ||
+            !isResolved(olds.cfApiKey) ||
+            Redacted.value(olds.cfApiKey) !== body.cfApiKey;
+        const dirty = keyRotated ||
+            observed.name !== name ||
+            observed.cfApiId !== body.cfApiId ||
+            (news.legacy !== undefined &&
+                (observed.legacy ?? undefined) !== news.legacy);
+        if (!dirty) {
+            return toAttributes(observed, acct);
+        }
+        // The update is a PUT and always requires the full credential pair.
+        const updated = yield* aisearch
+            .updateToken({ accountId: acct, id: observed.id, ...body })
+            .pipe(retryTokenPropagation);
+        return toAttributes(updated, acct);
+    }),
+    list: () => 
+    // Service tokens are account-scoped (`/accounts/{id}/ai-search/tokens`),
+    // not nested under an instance — one paginated list per account.
+    Effect.gen(function* () {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        return yield* aisearch.listTokens
+            .pages({ accountId, perPage: 50 })
+            .pipe(Stream.runCollect, Effect.map((chunk) => Array.from(chunk).flatMap((page) => 
+        // The list item shape matches the create/read response, so the
+        // emitted Attributes are identical to `read` (the write-only
+        // `cfApiKey` is never part of Attributes anyway).
+        (page.result ?? []).map((t) => toAttributes(t, accountId)))), 
+        // AI Search isn't enabled on every account — the route is gated
+        // rather than returning an empty list. Treat it as "none".
+        Effect.catchTag("InvalidRoute", () => Effect.succeed([])));
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        // A missing token (already deleted) is success. An AI Search
+        // instance that referenced this token may still be deleting
+        // asynchronously — Cloudflare rejects the delete with
+        // `token_in_use_by_instances` until the instance is gone, so ride
+        // that out briefly.
+        yield* aisearch
+            .deleteToken({ accountId: output.accountId, id: output.id })
+            .pipe(Effect.retry({
+            while: (e) => e._tag === "TokenInUseByInstances",
+            schedule: Schedule.exponential("1 second").pipe(Schedule.either(Schedule.spaced("5 seconds"))),
+            times: 10,
+        }), Effect.catchTag("TokenNotFound", () => Effect.void));
+    }),
+});
+/**
+ * Read a token by id, mapping "gone" (`TokenNotFound`, Cloudflare error
+ * code 7075) to `undefined`. The read response declares every field
+ * optional, so observed identity fields are re-asserted from the request.
+ */
+const getToken = (accountId, id) => aisearch.readToken({ accountId, id }).pipe(Effect.map((t) => ({
+    id: t.id ?? id,
+    name: t.name ?? "",
+    cfApiId: t.cfApiId ?? "",
+    createdAt: t.createdAt ?? "",
+    modifiedAt: t.modifiedAt ?? "",
+    createdBy: t.createdBy,
+    enabled: t.enabled,
+    legacy: t.legacy,
+    modifiedBy: t.modifiedBy,
+})), Effect.catchTag("TokenNotFound", () => Effect.succeed(undefined)));
+/**
+ * Scan the account's service tokens for an exact display-name match
+ * (used for cold reads and greenfield creates after lost state). The
+ * `search` query param chokes on long strings (generated physical names
+ * can hit the limit), so this streams all pages and filters client-side.
+ */
+const findTokenByName = (accountId, name) => aisearch.listTokens.items({ accountId, perPage: 50 }).pipe(Stream.filter((t) => t.name === name), Stream.runHead, Effect.map(Option.getOrUndefined));
+const createTokenName = (id, name) => Effect.gen(function* () {
+    return name ?? (yield* createPhysicalName({ id, lowercase: true }));
+});
+/**
+ * A freshly minted underlying API token may not have propagated yet when
+ * AI Search validates it — ride out transient `InvalidTokenCredentials`
+ * (code 7012) with a short, bounded retry. Genuinely invalid credentials
+ * still fail after the retries are exhausted.
+ */
+const retryTokenPropagation = (effect) => effect.pipe(Effect.retry({
+    while: (e) => e._tag === "InvalidTokenCredentials",
+    schedule: Schedule.exponential("1 second"),
+    times: 6,
+}));
+const toAttributes = (token, accountId) => ({
+    id: token.id,
+    accountId,
+    name: token.name,
+    cfApiId: token.cfApiId,
+    enabled: token.enabled ?? undefined,
+    legacy: token.legacy ?? undefined,
+    createdAt: token.createdAt || undefined,
+    modifiedAt: token.modifiedAt || undefined,
+    createdBy: token.createdBy ?? undefined,
+    modifiedBy: token.modifiedBy ?? undefined,
+});
+//# sourceMappingURL=Token.js.map

package/lib/Cloudflare/AiSearch/Token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Token.js","sourceRoot":"","sources":["../../../src/Cloudflare/AiSearch/Token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,sCAAsC,CAAC;AACjE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAGpE,MAAM,mBAAmB,GAAG,2BAAoC,CAAC;AAkFjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAgB,mBAAmB,CAAC,CAAC;AAE1E;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAc,EAA0B,EAAE,CACxE,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC;AAE7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,EAAE,CACxC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE;IAC9B,OAAO,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC;IACtD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,mEAAmE;QACnE,iDAAiD;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,EAAE,EAAE;YACzB,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,CAAC,CAAC,gEAAgE;gBAChE,8BAA8B;gBAC9B,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACzE,OAAO,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC,CAAC;IACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;QACxD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEnD,+DAA+D;QAC/D,kEAAkE;QAClE,0DAA0D;QAC1D,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,MAAM,EAAE,EAAE;YACzB,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEvC,MAAM,IAAI,GAAG;YACX,IAAI;YACJ,OAAO,EAAE,IAAI,CAAC,OAAiB;YAC/B,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAqC,CAAC;YACpE,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,+DAA+D;YAC/D,gEAAgE;YAChE,6DAA6D;YAC7D,6DAA6D;YAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ;iBAC5B,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;iBACzC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAC/B,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QAED,mEAAmE;QACnE,gEAAgE;QAChE,kEAAkE;QAClE,4BAA4B;QAC5B,MAAM,UAAU,GACd,IAAI,KAAK,SAAS;YAClB,IAAI,CAAC,QAAQ,KAAK,SAAS;YAC3B,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC1B,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC;QAClD,MAAM,KAAK,GACT,UAAU;YACV,QAAQ,CAAC,IAAI,KAAK,IAAI;YACtB,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;YACjC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;gBACxB,CAAC,QAAQ,CAAC,MAAM,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QAED,oEAAoE;QACpE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ;aAC5B,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC;aAC1D,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC/B,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,IAAI,EAAE,GAAG,EAAE;IACT,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU;aAC9B,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;aACjC,IAAI,CACH,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,+DAA+D;QAC/D,6DAA6D;QAC7D,kDAAkD;QAClD,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAC3D,CACF;QACD,gEAAgE;QAChE,2DAA2D;QAC3D,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAC1D,CAAC;IACN,CAAC,CAAC;IACJ,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,6DAA6D;QAC7D,4DAA4D;QAC5D,sDAAsD;QACtD,kEAAkE;QAClE,oBAAoB;QACpB,KAAK,CAAC,CAAC,QAAQ;aACZ,WAAW,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;aAC3D,IAAI,CACH,MAAM,CAAC,KAAK,CAAC;YACX,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB;YAChD,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,CAC7C,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAC9C;YACD,KAAK,EAAE,EAAE;SACV,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACpD,CAAC;IACN,CAAC,CAAC;CACH,CAAC,CAAC;AAIL;;;;GAIG;AACH,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAE,EAAU,EAAE,EAAE,CACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CACxC,MAAM,CAAC,GAAG,CACR,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC;IACrB,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;IAClB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE;IAC5B,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,UAAU,EAAE,CAAC,CAAC,UAAU;CACzB,CAAC,CACH,EACD,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAClE,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAE,IAAY,EAAE,EAAE,CAC1D,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CACxD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EACrC,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAClC,CAAC;AAEJ,MAAM,eAAe,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC/D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,CAC5B,MAA8B,EAC9B,EAAE,CACF,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,KAAK,CAAC;IACX,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB;IAClD,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC;IAC1C,KAAK,EAAE,CAAC;CACT,CAAC,CACH,CAAC;AAEJ,MAAM,YAAY,GAAG,CACnB,KAAmD,EACnD,SAAiB,EACQ,EAAE,CAAC,CAAC;IAC7B,EAAE,EAAE,KAAK,CAAC,EAAE;IACZ,SAAS;IACT,IAAI,EAAE,KAAK,CAAC,IAAI;IAChB,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,SAAS;IACnC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS;IACjC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS;IACvC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,SAAS;IACzC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS;IACvC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,SAAS;CAC1C,CAAC,CAAC"}

package/lib/Cloudflare/AiSearch/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./Instance.ts";
+export * from "./Namespace.ts";
+export * from "./Token.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/Cloudflare/AiSearch/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/AiSearch/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}

package/lib/Cloudflare/AiSearch/index.js

@@ -0,0 +1,4 @@
+export * from "./Instance.js";
+export * from "./Namespace.js";
+export * from "./Token.js";
+//# sourceMappingURL=index.js.map

package/lib/Cloudflare/AiSearch/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/Cloudflare/AiSearch/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}

package/lib/Cloudflare/AiSecurity/CustomTopics.d.ts

@@ -0,0 +1,92 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+declare const AiSecurityCustomTopicsTypeId: "Cloudflare.AiSecurity.CustomTopics";
+type AiSecurityCustomTopicsTypeId = typeof AiSecurityCustomTopicsTypeId;
+/**
+ * A custom topic category for AI Security for Apps content detection.
+ */
+export type AiSecurityTopic = {
+    /**
+     * Human-readable label for the topic category.
+     */
+    label: string;
+    /**
+     * The topic description used to classify AI (LLM) traffic content.
+     */
+    topic: string;
+};
+export type AiSecurityCustomTopicsProps = {
+    /**
+     * Zone the custom topics belong to. Stable — changing the zone
+     * triggers a replacement (the old zone's topic list is restored to
+     * the value it had before Alchemy managed it).
+     */
+    zoneId: string;
+    /**
+     * The full list of custom topic categories. Mutable — the PUT
+     * replaces the entire list, so reconcile syncs the list as a whole.
+     */
+    topics: AiSecurityTopic[];
+};
+export type AiSecurityCustomTopicsAttributes = {
+    /** Zone the custom topics belong to. */
+    zoneId: string;
+    /** The custom topic categories currently configured on the zone. */
+    topics: AiSecurityTopic[];
+    /**
+     * The topic list the zone had before Alchemy first managed it.
+     * Restored on destroy, so deleting the resource puts the zone back
+     * the way it was found.
+     */
+    initialTopics: AiSecurityTopic[];
+};
+export type AiSecurityCustomTopics = Resource<AiSecurityCustomTopicsTypeId, AiSecurityCustomTopicsProps, AiSecurityCustomTopicsAttributes, never, Providers>;
+/**
+ * Custom topic categories for AI Security for Apps (Firewall for AI)
+ * content detection on a Cloudflare zone
+ * (`/zones/{zone_id}/ai-security/custom-topics`).
+ *
+ * The topic list is a zone singleton — it always exists (defaulting to
+ * empty) and is never created or deleted, only replaced wholesale via
+ * PUT. Reconcile PUTs the desired list when the observed list differs;
+ * destroy restores the list the zone had before Alchemy first managed it.
+ *
+ * Declare at most one `AiSecurityCustomTopics` per zone — two instances
+ * managing the same zone would fight over the single underlying list.
+ *
+ * AI Security for Apps is entitlement-gated: on accounts without the
+ * feature every call fails with the typed `AiSecurityNotEntitled` error
+ * (Cloudflare error code 13101).
+ *
+ * @section Managing custom topics
+ * @example Classify traffic into two custom topics
+ * ```typescript
+ * const topics = yield* Cloudflare.AiSecurityCustomTopics("Topics", {
+ *   zoneId: zone.zoneId,
+ *   topics: [
+ *     { label: "billing", topic: "Questions about invoices and payments" },
+ *     { label: "abuse", topic: "Harassment or abusive language" },
+ *   ],
+ * });
+ * ```
+ *
+ * @example Clear all custom topics
+ * ```typescript
+ * yield* Cloudflare.AiSecurityCustomTopics("Topics", {
+ *   zoneId: zone.zoneId,
+ *   topics: [],
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/waf/detections/firewall-for-ai/
+ */
+export declare const AiSecurityCustomTopics: import("../../Resource.ts").ResourceClass<AiSecurityCustomTopics>;
+/**
+ * Returns true if the given value is an AiSecurityCustomTopics resource.
+ */
+export declare const isAiSecurityCustomTopics: (value: unknown) => value is AiSecurityCustomTopics;
+export declare const AiSecurityCustomTopicsProvider: () => import("effect/Layer").Layer<Provider.Provider<AiSecurityCustomTopics>, never, CloudflareEnvironment | import("@distilled.cloud/cloudflare").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+export {};
+//# sourceMappingURL=CustomTopics.d.ts.map

package/lib/Cloudflare/AiSecurity/CustomTopics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomTopics.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/AiSecurity/CustomTopics.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,QAAA,MAAM,4BAA4B,EAChC,oCAA6C,CAAC;AAChD,KAAK,4BAA4B,GAAG,OAAO,4BAA4B,CAAC;AAExE;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B;;;;OAIG;IACH,aAAa,EAAE,eAAe,EAAE,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAC3C,4BAA4B,EAC5B,2BAA2B,EAC3B,gCAAgC,EAChC,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,sBAAsB,mEAElC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,UAC5B,OAAO,KACb,KAAK,IAAI,sBAEiC,CAAC;AAE9C,eAAO,MAAM,8BAA8B,wNA0HvC,CAAC"}

package/lib/Cloudflare/AiSecurity/CustomTopics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomTopics.js","sourceRoot":"","sources":["../../../src/Cloudflare/AiSecurity/CustomTopics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,yCAAyC,CAAC;AACtE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,4BAA4B,GAChC,oCAA6C,CAAC;AAoDhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAC5C,4BAA4B,CAC7B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,KAAc,EACmB,EAAE,CACnC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC;IACpC,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC;AAE9C,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,EAAE,CACjD,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE;IACvC,OAAO,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEpC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,gEAAgE;QAChE,gEAAgE;QAChE,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAChC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAC/B,CAAC,MAAM,EAAE,EAAE,CACT,UAAU,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CACxC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO;gBACL,MAAM;gBACN,MAAM;gBACN,wDAAwD;gBACxD,oDAAoD;gBACpD,aAAa,EAAE,MAAM;aACtB,CAAC;QACJ,CAAC,CAAC;QACF,4DAA4D;QAC5D,wDAAwD;QACxD,MAAM,CAAC,QAAQ,CACb,CAAC,uBAAuB,EAAE,mBAAmB,EAAE,WAAW,CAAC,EAC3D,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAChC,CACF,EACH,EAAE,WAAW,EAAE,EAAE,EAAE,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAChB,CAAC,GAAG,EAA2C,EAAE,CAAC,GAAG,KAAK,SAAS,CACpE,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACpD,MAAM,CAAC,GAAG,IAAmC,CAAC;QAC9C,MAAM,CAAC,GAAG,IAAmC,CAAC;QAC9C,sEAAsE;QACtE,MAAM,SAAS,GACb,MAAM,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1E,IACE,SAAS,KAAK,SAAS;YACvB,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAC5B,SAAS,KAAK,CAAC,CAAC,MAAM,EACtB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACzC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAK,IAAI,EAAE,MAA6B,CAAC;QACtE,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI;QAChE,4DAA4D;QAC5D,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACtE,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,+DAA+D;QAC/D,iEAAiE;QACjE,6DAA6D;QAC7D,uCAAuC;QACvC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,aAAa,GACjB,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC3C,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC9C,yDAAyD;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgB,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAE5B,gEAAgE;QAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9D,MAAM,cAAc,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAExD,6DAA6D;QAC7D,+DAA+D;QAC/D,gEAAgE;QAChE,0BAA0B;QAC1B,MAAM,aAAa,GACjB,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC;QAE/D,4DAA4D;QAC5D,IAAI,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC;YAC/C,MAAM;YACN,MAAM,EAAE,OAAO;SAChB,CAAC,CAAC;QACH,OAAO;YACL,MAAM;YACN,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC;YAClD,aAAa;SACd,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;QACzC,+DAA+D;QAC/D,gEAAgE;QAChE,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAChE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EACrE,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;QACnC,iEAAiE;QACjE,sDAAsD;QACtD,IAAI,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;YAAE,OAAO;QACzE,KAAK,CAAC,CAAC,UAAU;aACd,cAAc,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;aACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC;CACH,CAAC,CAAC;AAEL;;GAEG;AACH,MAAM,eAAe,GAAG,CACtB,MAAqD,EAClC,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,GAAG,CAClB,CAA6B,EAC7B,CAA6B,EACpB,EAAE;IACX,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,CAAC,CAAkB,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5D,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC,CAAC"}

package/lib/Cloudflare/AiSecurity/Settings.d.ts

@@ -0,0 +1,77 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+declare const AiSecuritySettingsTypeId: "Cloudflare.AiSecurity.Settings";
+type AiSecuritySettingsTypeId = typeof AiSecuritySettingsTypeId;
+export type AiSecuritySettingsProps = {
+    /**
+     * Zone the AI Security settings belong to. Stable — changing the zone
+     * triggers a replacement (the old zone's setting is restored to the
+     * value it had before Alchemy managed it).
+     */
+    zoneId: string;
+    /**
+     * Whether AI Security for Apps (Firewall for AI) is enabled on the
+     * zone. Mutable — toggled in place via PUT.
+     *
+     * @default false
+     */
+    enabled?: boolean;
+};
+export type AiSecuritySettingsAttributes = {
+    /** Zone the AI Security settings belong to. */
+    zoneId: string;
+    /** Whether AI Security for Apps is currently enabled on the zone. */
+    enabled: boolean;
+    /**
+     * The value `enabled` had before Alchemy first managed the setting.
+     * Restored on destroy, so deleting the resource puts the zone back
+     * the way it was found.
+     */
+    initialEnabled: boolean;
+};
+export type AiSecuritySettings = Resource<AiSecuritySettingsTypeId, AiSecuritySettingsProps, AiSecuritySettingsAttributes, never, Providers>;
+/**
+ * AI Security for Apps (Firewall for AI) settings on a Cloudflare zone
+ * (`/zones/{zone_id}/ai-security/settings`).
+ *
+ * The settings object is a zone singleton — it always exists and is never
+ * created or deleted, only toggled. Reconcile PUTs the desired `enabled`
+ * value when the observed value differs; destroy restores the value the
+ * zone had before Alchemy first managed it.
+ *
+ * Declare at most one `AiSecuritySettings` per zone — two instances
+ * managing the same zone would fight over the single underlying setting.
+ *
+ * AI Security for Apps is entitlement-gated: on accounts without the
+ * feature every call fails with the typed `AiSecurityNotEntitled` error
+ * (Cloudflare error code 13101).
+ *
+ * @section Enabling AI Security
+ * @example Enable AI Security for Apps on a zone
+ * ```typescript
+ * const settings = yield* Cloudflare.AiSecuritySettings("AiSecurity", {
+ *   zoneId: zone.zoneId,
+ *   enabled: true,
+ * });
+ * ```
+ *
+ * @example Pin AI Security off
+ * ```typescript
+ * yield* Cloudflare.AiSecuritySettings("AiSecurity", {
+ *   zoneId: zone.zoneId,
+ *   enabled: false,
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/waf/detections/firewall-for-ai/
+ */
+export declare const AiSecuritySettings: import("../../Resource.ts").ResourceClass<AiSecuritySettings>;
+/**
+ * Returns true if the given value is an AiSecuritySettings resource.
+ */
+export declare const isAiSecuritySettings: (value: unknown) => value is AiSecuritySettings;
+export declare const AiSecuritySettingsProvider: () => import("effect/Layer").Layer<Provider.Provider<AiSecuritySettings>, never, CloudflareEnvironment | import("@distilled.cloud/cloudflare").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+export {};
+//# sourceMappingURL=Settings.d.ts.map

package/lib/Cloudflare/AiSecurity/Settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Settings.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/AiSecurity/Settings.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,QAAA,MAAM,wBAAwB,EAAG,gCAAyC,CAAC;AAC3E,KAAK,wBAAwB,GAAG,OAAO,wBAAwB,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CACvC,wBAAwB,EACxB,uBAAuB,EACvB,4BAA4B,EAC5B,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,kBAAkB,+DAE9B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,UACxB,OAAO,KACb,KAAK,IAAI,kBAE6B,CAAC;AAE1C,eAAO,MAAM,0BAA0B,oNAkHnC,CAAC"}