alchemy 2.0.0-beta.55 → 2.0.0-beta.57

package/lib/Cloudflare/Devices/PostureRule.js

@@ -0,0 +1,203 @@
+import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+import * as Stream from "effect/Stream";
+import { Unowned } from "../../AdoptPolicy.js";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
+const DevicePostureRuleTypeId = "Cloudflare.Devices.PostureRule";
+/**
+ * A Cloudflare Zero Trust **device posture rule** — a periodic check the
+ * WARP client runs on enrolled devices (OS version, firewall status, disk
+ * encryption, file presence, or a third-party security provider's
+ * verdict). Posture results can then gate Access policies and Gateway
+ * rules.
+ *
+ * Everything except `type` is mutable in place (full PUT). Changing
+ * `type` replaces the rule.
+ * @resource
+ * @product Devices
+ * @category Cloudflare One (Zero Trust)
+ * @section Infrastructure-free checks
+ * @example Require a minimum Windows version
+ * ```typescript
+ * const rule = yield* Cloudflare.DevicePostureRule("WindowsOsVersion", {
+ *   type: "os_version",
+ *   description: "Require Windows 10.0.19045+",
+ *   match: [{ platform: "windows" }],
+ *   schedule: "5m",
+ *   input: {
+ *     operatingSystem: "windows",
+ *     operator: ">=",
+ *     version: "10.0.19045",
+ *   },
+ * });
+ * ```
+ *
+ * @example Require the OS firewall to be enabled
+ * ```typescript
+ * yield* Cloudflare.DevicePostureRule("Firewall", {
+ *   type: "firewall",
+ *   match: [{ platform: "windows" }, { platform: "mac" }],
+ *   input: { enabled: true, operatingSystem: "windows" },
+ * });
+ * ```
+ *
+ * @example Require disk encryption on all drives
+ * ```typescript
+ * yield* Cloudflare.DevicePostureRule("DiskEncryption", {
+ *   type: "disk_encryption",
+ *   match: [{ platform: "mac" }],
+ *   input: { requireAll: true },
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/cloudflare-one/identity/devices/
+ */
+export const DevicePostureRule = Resource(DevicePostureRuleTypeId);
+/**
+ * Returns true if the given value is a DevicePostureRule resource.
+ */
+export const isDevicePostureRule = (value) => Predicate.hasProperty(value, "Type") &&
+    value.Type === DevicePostureRuleTypeId;
+export const DevicePostureRuleProvider = () => Provider.succeed(DevicePostureRule, {
+    stables: ["postureRuleId", "accountId", "type"],
+    list: Effect.fn(function* () {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        // Account-scoped collection: exhaustively paginate the device
+        // posture rules list and hydrate each into the `read` shape.
+        return yield* zeroTrust.listDevicePostures.pages({ accountId }).pipe(Stream.runCollect, Effect.map((chunk) => Array.from(chunk).flatMap((page) => (page.result ?? []).map((rule) => toAttributes(rule, accountId)))), 
+        // Account lacks the Zero Trust / device posture entitlement.
+        Effect.catchTag("Forbidden", () => Effect.succeed([])));
+    }),
+    diff: Effect.fn(function* ({ olds, news, output }) {
+        if (!isResolved(news))
+            return undefined;
+        // `type` is immutable on Cloudflare's side — replace on change.
+        const oldType = output?.type ?? olds?.type;
+        if (oldType !== undefined && oldType !== news.type) {
+            return { action: "replace" };
+        }
+        return undefined;
+    }),
+    read: Effect.fn(function* ({ id, output, olds }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const acct = output?.accountId ?? accountId;
+        // Owned path: refresh by our persisted rule id.
+        if (output?.postureRuleId) {
+            const observed = yield* observeRule(acct, output.postureRuleId);
+            return observed ? toAttributes(observed, acct) : undefined;
+        }
+        // Cold lookup: recover from lost state by exact name. Posture rules
+        // carry no ownership markers, so brand the match `Unowned`.
+        const name = yield* createRuleName(id, olds?.name);
+        const match = yield* findByName(acct, name);
+        if (match)
+            return Unowned(toAttributes(match, acct));
+        return undefined;
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const name = yield* createRuleName(id, news.name);
+        // 1. Observe — the rule id cached on `output` is a hint, not a
+        //    guarantee: a missing rule falls through to create.
+        const observed = output?.postureRuleId
+            ? yield* observeRule(accountId, output.postureRuleId)
+            : undefined;
+        // 2. Ensure — create when missing. Names are not unique on
+        //    Cloudflare's side, so there is no AlreadyExists race.
+        if (!observed) {
+            const created = yield* zeroTrust.createDevicePosture({
+                accountId,
+                name,
+                type: news.type,
+                description: news.description,
+                schedule: news.schedule,
+                expiration: news.expiration,
+                match: news.match,
+                input: news.input,
+            });
+            return toAttributes(created, accountId);
+        }
+        // 3. Sync — the update API is a PUT that requires the full body;
+        //    send everything, but skip the call entirely on a no-op.
+        const dirty = (observed.name ?? "") !== name ||
+            (news.description !== undefined &&
+                !sameJSON(denull(observed.description), news.description)) ||
+            (news.schedule !== undefined &&
+                denull(observed.schedule) !== news.schedule) ||
+            (news.expiration !== undefined &&
+                denull(observed.expiration) !== news.expiration) ||
+            (news.match !== undefined &&
+                !sameJSON(normalizeMatch(observed.match), news.match)) ||
+            (news.input !== undefined && !sameJSON(observed.input, news.input));
+        if (!dirty) {
+            return toAttributes(observed, accountId);
+        }
+        const updated = yield* zeroTrust.updateDevicePosture({
+            accountId,
+            ruleId: observed.id,
+            name,
+            type: news.type,
+            description: news.description,
+            schedule: news.schedule,
+            expiration: news.expiration,
+            match: news.match,
+            input: news.input,
+        });
+        return toAttributes(updated, accountId);
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        // Cloudflare's delete is already idempotent (200 on a missing
+        // rule); the typed catch covers the documented 404 path too.
+        yield* zeroTrust
+            .deleteDevicePosture({
+            accountId: output.accountId,
+            ruleId: output.postureRuleId,
+        })
+            .pipe(Effect.catchTag("PostureRuleNotFound", () => Effect.void));
+    }),
+});
+/**
+ * Read a posture rule by id, mapping "gone" (`PostureRuleNotFound`,
+ * Cloudflare error code 6024) to `undefined`.
+ */
+const observeRule = (accountId, ruleId) => zeroTrust
+    .getDevicePosture({ accountId, ruleId })
+    .pipe(Effect.catchTag("PostureRuleNotFound", () => Effect.succeed(undefined)));
+/**
+ * Find a posture rule by exact name (oldest-id-first for determinism when
+ * names collide).
+ */
+const findByName = (accountId, name) => zeroTrust.listDevicePostures({ accountId }).pipe(Effect.map((list) => list.result
+    .filter((r) => r.name === name && r.id != null)
+    .sort((a, b) => (a.id ?? "").localeCompare(b.id ?? ""))
+    .at(0)));
+const createRuleName = (id, name) => Effect.gen(function* () {
+    return name ?? (yield* createPhysicalName({ id, lowercase: true }));
+});
+const toAttributes = (rule, accountId) => ({
+    postureRuleId: rule.id ?? "",
+    accountId,
+    name: rule.name ?? "",
+    type: rule.type ?? "",
+    description: denull(rule.description),
+    schedule: denull(rule.schedule),
+    expiration: denull(rule.expiration),
+    match: normalizeMatch(rule.match),
+    input: denull(rule.input),
+});
+const normalizeMatch = (match) => match == null
+    ? undefined
+    : match.map((m) => ({ platform: denull(m.platform) }));
+/**
+ * Strip Cloudflare's `null` echoes to `undefined` so structural equality
+ * (`JSON.stringify`) works.
+ */
+const denull = (v) => v == null ? undefined : v;
+/** Structural deep-equality via canonical JSON. */
+const sameJSON = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+//# sourceMappingURL=PostureRule.js.map

package/lib/Cloudflare/Devices/PostureRule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostureRule.js","sourceRoot":"","sources":["../../../src/Cloudflare/Devices/PostureRule.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,wCAAwC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAGpE,MAAM,uBAAuB,GAAG,gCAAyC,CAAC;AAiG1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CACvC,uBAAuB,CACxB,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,KAAc,EACc,EAAE,CAC9B,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC;IACpC,KAAK,CAAC,IAAI,KAAK,uBAAuB,CAAC;AAEzC,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,EAAE,CAC5C,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE;IAClC,OAAO,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,MAAM,CAAC;IAE/C,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,8DAA8D;QAC9D,6DAA6D;QAC7D,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAClE,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CACjE,CACF;QACD,6DAA6D;QAC7D,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CACvD,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,gEAAgE;QAChE,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC;QAC3C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;QAE5C,gDAAgD;QAChD,IAAI,MAAM,EAAE,aAAa,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YAChE,OAAO,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,CAAC;QAED,oEAAoE;QACpE,4DAA4D;QAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK;YAAE,OAAO,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAClD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAElD,+DAA+D;QAC/D,wDAAwD;QACxD,MAAM,QAAQ,GAAG,MAAM,EAAE,aAAa;YACpC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC;YACrD,CAAC,CAAC,SAAS,CAAC;QAEd,2DAA2D;QAC3D,2DAA2D;QAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC;gBACnD,SAAS;gBACT,IAAI;gBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;QAED,iEAAiE;QACjE,6DAA6D;QAC7D,MAAM,KAAK,GACT,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,IAAI;YAC9B,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;gBAC7B,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YAC5D,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAC1B,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC;YAC9C,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS;gBAC5B,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC;YAClD,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACvB,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACxD,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC;YACnD,SAAS;YACT,MAAM,EAAE,QAAQ,CAAC,EAAG;YACpB,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,8DAA8D;QAC9D,6DAA6D;QAC7D,KAAK,CAAC,CAAC,SAAS;aACb,mBAAmB,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,aAAa;SAC7B,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC;CACH,CAAC,CAAC;AAQL;;;GAGG;AACH,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAE,MAAc,EAAE,EAAE,CACxD,SAAS;KACN,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;KACvC,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACxE,CAAC;AAEN;;;GAGG;AACH,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,IAAY,EAAE,EAAE,CACrD,SAAS,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClB,IAAI,CAAC,MAAM;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC;KAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;KACtD,EAAE,CAAC,CAAC,CAAC,CACT,CACF,CAAC;AAEJ,MAAM,cAAc,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC9D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,CACnB,IAAkB,EAClB,SAAiB,EACY,EAAE,CAAC,CAAC;IACjC,aAAa,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;IAC5B,SAAS;IACT,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;IACrB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;IACrB,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;IACnC,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;CAC1B,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CACrB,KAA4B,EACoB,EAAE,CAClD,KAAK,IAAI,IAAI;IACX,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,MAAM,GAAG,CAAI,CAAuB,EAAiB,EAAE,CAC3D,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5B,mDAAmD;AACnD,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,CAAU,EAAW,EAAE,CACnD,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC"}

package/lib/Cloudflare/Devices/Settings.d.ts

@@ -0,0 +1,126 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+declare const DeviceSettingsTypeId: "Cloudflare.Devices.Settings";
+type DeviceSettingsTypeId = typeof DeviceSettingsTypeId;
+/**
+ * A snapshot of the account's WARP device settings, as observed on
+ * Cloudflare. Captured before Alchemy first patches the singleton and
+ * restored on destroy.
+ */
+export interface DeviceSettingsSnapshot {
+    /** Time limit, in seconds, that a user can bypass WARP with an override code. */
+    disableForTime?: number;
+    /** Whether the external emergency disconnect feature is enabled. */
+    externalEmergencySignalEnabled?: boolean;
+    /** SHA-256 fingerprint pinning the emergency-signal server certificate. */
+    externalEmergencySignalFingerprint?: string;
+    /** Polling interval for the emergency disconnect signal (e.g. `"5m"`). */
+    externalEmergencySignalInterval?: string;
+    /** HTTPS URL the emergency disconnect signal is fetched from. */
+    externalEmergencySignalUrl?: string;
+    /** Whether Gateway proxy filtering on TCP is enabled. */
+    gatewayProxyEnabled?: boolean;
+    /** Whether Gateway proxy filtering on UDP is enabled. */
+    gatewayUdpProxyEnabled?: boolean;
+    /** Whether the Cloudflare-managed root certificate is installed on devices. */
+    rootCertificateInstallationEnabled?: boolean;
+    /** Whether CGNAT virtual IPv4 addressing is used. */
+    useZtVirtualIp?: boolean;
+}
+export interface DeviceSettingsProps {
+    /**
+     * Sets the time limit, in seconds, that a user can use an override code
+     * to bypass WARP. `0` disables override codes.
+     */
+    disableForTime?: number;
+    /**
+     * Controls whether the external emergency disconnect feature is enabled.
+     */
+    externalEmergencySignalEnabled?: boolean;
+    /**
+     * The SHA-256 fingerprint (64 hexadecimal characters) of the HTTPS
+     * server certificate for {@link externalEmergencySignalUrl}. When set,
+     * the WARP client uses it to verify the server's identity.
+     */
+    externalEmergencySignalFingerprint?: string;
+    /**
+     * The interval at which the WARP client fetches the emergency disconnect
+     * signal, as a duration string (e.g. `"5m"`, `"2m30s"`, `"1h"`).
+     * Minimum 30 seconds.
+     */
+    externalEmergencySignalInterval?: string;
+    /**
+     * The HTTPS URL from which to fetch the emergency disconnect signal.
+     * Must use HTTPS with an IPv4 or IPv6 address as the host.
+     */
+    externalEmergencySignalUrl?: string;
+    /**
+     * Enable Gateway proxy filtering on TCP.
+     */
+    gatewayProxyEnabled?: boolean;
+    /**
+     * Enable Gateway proxy filtering on UDP.
+     */
+    gatewayUdpProxyEnabled?: boolean;
+    /**
+     * Enable installation of the Cloudflare-managed root certificate on
+     * enrolled devices.
+     */
+    rootCertificateInstallationEnabled?: boolean;
+    /**
+     * Enable using CGNAT virtual IPv4 addressing.
+     */
+    useZtVirtualIp?: boolean;
+}
+export type DeviceSettingsAttributes = DeviceSettingsSnapshot & {
+    /** Account that owns the device settings singleton. */
+    accountId: string;
+    /**
+     * The settings the account had before Alchemy first patched them.
+     * Restored (via PUT, which resets unspecified fields) on destroy, so
+     * deleting the resource puts the account back the way it was found.
+     */
+    initialSettings: DeviceSettingsSnapshot;
+};
+export type DeviceSettings = Resource<DeviceSettingsTypeId, DeviceSettingsProps, DeviceSettingsAttributes, never, Providers>;
+/**
+ * Manages the **singleton** Cloudflare Zero Trust **device settings** for
+ * an account (`/accounts/{accountId}/devices/settings`) — account-wide
+ * WARP toggles like the Gateway TCP/UDP proxy, managed root certificate
+ * installation, and CGNAT virtual IP.
+ *
+ * The singleton always exists, so reconcile patches only the declared
+ * fields in place. The pre-management snapshot is captured on first touch
+ * and restored on destroy (capture-and-restore), returning the account to
+ * the state Alchemy found it in.
+ * @resource
+ * @product Devices
+ * @category Cloudflare One (Zero Trust)
+ * @section Managing device settings
+ * @example Enable the Gateway proxy
+ * ```typescript
+ * yield* Cloudflare.DeviceSettings("Devices", {
+ *   gatewayProxyEnabled: true,
+ *   gatewayUdpProxyEnabled: true,
+ * });
+ * ```
+ *
+ * @example Allow one-hour WARP override codes
+ * ```typescript
+ * yield* Cloudflare.DeviceSettings("Devices", {
+ *   disableForTime: 3600,
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/
+ */
+export declare const DeviceSettings: import("../../Resource.ts").ResourceClass<DeviceSettings>;
+/**
+ * Returns true if the given value is a DeviceSettings resource.
+ */
+export declare const isDeviceSettings: (value: unknown) => value is DeviceSettings;
+export declare const DeviceSettingsProvider: () => import("effect/Layer").Layer<Provider.Provider<DeviceSettings>, never, CloudflareEnvironment | import("@distilled.cloud/cloudflare").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+export {};
+//# sourceMappingURL=Settings.d.ts.map

package/lib/Cloudflare/Devices/Settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Settings.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Devices/Settings.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,QAAA,MAAM,oBAAoB,EAAG,6BAAsC,CAAC;AACpE,KAAK,oBAAoB,GAAG,OAAO,oBAAoB,CAAC;AAExD;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,iFAAiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,8BAA8B,CAAC,EAAE,OAAO,CAAC;IACzC,2EAA2E;IAC3E,kCAAkC,CAAC,EAAE,MAAM,CAAC;IAC5C,0EAA0E;IAC1E,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC,iEAAiE;IACjE,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,yDAAyD;IACzD,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,yDAAyD;IACzD,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,+EAA+E;IAC/E,kCAAkC,CAAC,EAAE,OAAO,CAAC;IAC7C,qDAAqD;IACrD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;IACzC;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,MAAM,CAAC;IAC5C;;;;OAIG;IACH,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;OAEG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAC;IAC7C;;OAEG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,wBAAwB,GAAG,sBAAsB,GAAG;IAC9D,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,eAAe,EAAE,sBAAsB,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,QAAQ,CACnC,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,cAAc,2DAAiD,CAAC;AAE7E;;GAEG;AACH,eAAO,MAAM,gBAAgB,UAAW,OAAO,KAAG,KAAK,IAAI,cACkB,CAAC;AAE9E,eAAO,MAAM,sBAAsB,gNA0E/B,CAAC"}

package/lib/Cloudflare/Devices/Settings.js

@@ -0,0 +1,162 @@
+import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
+const DeviceSettingsTypeId = "Cloudflare.Devices.Settings";
+/**
+ * Manages the **singleton** Cloudflare Zero Trust **device settings** for
+ * an account (`/accounts/{accountId}/devices/settings`) — account-wide
+ * WARP toggles like the Gateway TCP/UDP proxy, managed root certificate
+ * installation, and CGNAT virtual IP.
+ *
+ * The singleton always exists, so reconcile patches only the declared
+ * fields in place. The pre-management snapshot is captured on first touch
+ * and restored on destroy (capture-and-restore), returning the account to
+ * the state Alchemy found it in.
+ * @resource
+ * @product Devices
+ * @category Cloudflare One (Zero Trust)
+ * @section Managing device settings
+ * @example Enable the Gateway proxy
+ * ```typescript
+ * yield* Cloudflare.DeviceSettings("Devices", {
+ *   gatewayProxyEnabled: true,
+ *   gatewayUdpProxyEnabled: true,
+ * });
+ * ```
+ *
+ * @example Allow one-hour WARP override codes
+ * ```typescript
+ * yield* Cloudflare.DeviceSettings("Devices", {
+ *   disableForTime: 3600,
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/
+ */
+export const DeviceSettings = Resource(DeviceSettingsTypeId);
+/**
+ * Returns true if the given value is a DeviceSettings resource.
+ */
+export const isDeviceSettings = (value) => Predicate.hasProperty(value, "Type") && value.Type === DeviceSettingsTypeId;
+export const DeviceSettingsProvider = () => Provider.succeed(DeviceSettings, {
+    nuke: { singleton: true },
+    stables: ["accountId", "initialSettings"],
+    // Account singleton: there is exactly one device-settings object per
+    // account and no enumeration API. Mirror `read` — observe the single
+    // singleton and return it as a one-element array. With no prior
+    // output, the observed snapshot is itself the restore target.
+    list: Effect.fn(function* () {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const observed = yield* observeSettings(accountId);
+        return [toAttributes(accountId, observed, observed)];
+    }),
+    read: Effect.fn(function* ({ output }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const acct = output?.accountId ?? accountId;
+        const observed = yield* observeSettings(acct);
+        // The singleton always exists with account defaults — there is
+        // nothing to "own", so a cold read adopts freely. The observed
+        // snapshot at adoption time becomes the restore target.
+        const initialSettings = output?.initialSettings ?? observed;
+        return toAttributes(acct, observed, initialSettings);
+    }),
+    reconcile: Effect.fn(function* ({ news, output }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        // 1. Observe — the singleton always exists; read its live state.
+        const observed = yield* observeSettings(accountId);
+        // 2. Capture — the pre-management snapshot, restored on destroy.
+        //    `output` (including an adoption read) already carries it;
+        //    otherwise this is our first touch.
+        const initialSettings = output?.initialSettings ?? observed;
+        // 3. Sync — patch only the declared fields that differ.
+        const changes = {};
+        const assign = (key, value) => {
+            changes[key] = value;
+        };
+        let dirty = false;
+        for (const key of SETTING_KEYS) {
+            const desired = news[key];
+            if (desired === undefined)
+                continue;
+            if (observed[key] !== desired) {
+                assign(key, desired);
+                dirty = true;
+            }
+        }
+        if (!dirty) {
+            return toAttributes(accountId, observed, initialSettings);
+        }
+        yield* zeroTrust.patchDeviceSetting({ accountId, ...changes });
+        // 4. Return — re-read so attrs reflect post-sync truth.
+        const final = yield* observeSettings(accountId);
+        return toAttributes(accountId, final, initialSettings);
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        const { accountId, initialSettings } = output;
+        // Observe — skip the restore when the account already matches the
+        // captured snapshot (idempotent re-delete after a crashed run).
+        const observed = yield* observeSettings(accountId);
+        if (sameSnapshot(observed, initialSettings))
+            return;
+        // Restore via PUT: fields absent from the captured snapshot were
+        // unset before we managed the singleton, and PUT resets them.
+        yield* zeroTrust.putDeviceSetting({ accountId, ...initialSettings });
+    }),
+});
+const SETTING_KEYS = [
+    "disableForTime",
+    "externalEmergencySignalEnabled",
+    "externalEmergencySignalFingerprint",
+    "externalEmergencySignalInterval",
+    "externalEmergencySignalUrl",
+    "gatewayProxyEnabled",
+    "gatewayUdpProxyEnabled",
+    "rootCertificateInstallationEnabled",
+    "useZtVirtualIp",
+];
+/**
+ * Read the live settings, normalized to a `null`-free snapshot.
+ */
+const observeSettings = (accountId) => zeroTrust.getDeviceSetting({ accountId }).pipe(Effect.map((s) => {
+    const snapshot = {};
+    if (s.disableForTime != null)
+        snapshot.disableForTime = s.disableForTime;
+    if (s.externalEmergencySignalEnabled != null) {
+        snapshot.externalEmergencySignalEnabled =
+            s.externalEmergencySignalEnabled;
+    }
+    if (s.externalEmergencySignalFingerprint != null) {
+        snapshot.externalEmergencySignalFingerprint =
+            s.externalEmergencySignalFingerprint;
+    }
+    if (s.externalEmergencySignalInterval != null) {
+        snapshot.externalEmergencySignalInterval =
+            s.externalEmergencySignalInterval;
+    }
+    if (s.externalEmergencySignalUrl != null) {
+        snapshot.externalEmergencySignalUrl = s.externalEmergencySignalUrl;
+    }
+    if (s.gatewayProxyEnabled != null) {
+        snapshot.gatewayProxyEnabled = s.gatewayProxyEnabled;
+    }
+    if (s.gatewayUdpProxyEnabled != null) {
+        snapshot.gatewayUdpProxyEnabled = s.gatewayUdpProxyEnabled;
+    }
+    if (s.rootCertificateInstallationEnabled != null) {
+        snapshot.rootCertificateInstallationEnabled =
+            s.rootCertificateInstallationEnabled;
+    }
+    if (s.useZtVirtualIp != null)
+        snapshot.useZtVirtualIp = s.useZtVirtualIp;
+    return snapshot;
+}));
+const toAttributes = (accountId, observed, initialSettings) => ({
+    ...observed,
+    accountId,
+    initialSettings,
+});
+const sameSnapshot = (a, b) => SETTING_KEYS.every((key) => a[key] === b[key]);
+//# sourceMappingURL=Settings.js.map

package/lib/Cloudflare/Devices/Settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Settings.js","sourceRoot":"","sources":["../../../src/Cloudflare/Devices/Settings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,wCAAwC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAGpE,MAAM,oBAAoB,GAAG,6BAAsC,CAAC;AA8FpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAiB,oBAAoB,CAAC,CAAC;AAE7E;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAA2B,EAAE,CAC1E,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,CAAC;AAE9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CACzC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE;IAC/B,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;IACzB,OAAO,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC;IAEzC,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACnD,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACnC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC9C,+DAA+D;QAC/D,+DAA+D;QAC/D,wDAAwD;QACxD,MAAM,eAAe,GAAG,MAAM,EAAE,eAAe,IAAI,QAAQ,CAAC;QAC5D,OAAO,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IACvD,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC9C,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAE1D,iEAAiE;QACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAEnD,iEAAiE;QACjE,+DAA+D;QAC/D,wCAAwC;QACxC,MAAM,eAAe,GAAG,MAAM,EAAE,eAAe,IAAI,QAAQ,CAAC;QAE5D,wDAAwD;QACxD,MAAM,OAAO,GAAoC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,CACb,GAAM,EACN,KAAgC,EAChC,EAAE;YACF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC,CAAC;QACF,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAS;YACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACrB,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAE/D,wDAAwD;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAChD,OAAO,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IACzD,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;QAC9C,kEAAkE;QAClE,gEAAgE;QAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC;YAAE,OAAO;QACpD,iEAAiE;QACjE,8DAA8D;QAC9D,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,GAAG,eAAe,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC;CACH,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG;IACnB,gBAAgB;IAChB,gCAAgC;IAChC,oCAAoC;IACpC,iCAAiC;IACjC,4BAA4B;IAC5B,qBAAqB;IACrB,wBAAwB;IACxB,oCAAoC;IACpC,gBAAgB;CAC4C,CAAC;AAE/D;;GAEG;AACH,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAE,EAAE,CAC5C,SAAS,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAA0B,EAAE;IACvC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI;QAAE,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IACzE,IAAI,CAAC,CAAC,8BAA8B,IAAI,IAAI,EAAE,CAAC;QAC7C,QAAQ,CAAC,8BAA8B;YACrC,CAAC,CAAC,8BAA8B,CAAC;IACrC,CAAC;IACD,IAAI,CAAC,CAAC,kCAAkC,IAAI,IAAI,EAAE,CAAC;QACjD,QAAQ,CAAC,kCAAkC;YACzC,CAAC,CAAC,kCAAkC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,CAAC,+BAA+B,IAAI,IAAI,EAAE,CAAC;QAC9C,QAAQ,CAAC,+BAA+B;YACtC,CAAC,CAAC,+BAA+B,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,CAAC,0BAA0B,IAAI,IAAI,EAAE,CAAC;QACzC,QAAQ,CAAC,0BAA0B,GAAG,CAAC,CAAC,0BAA0B,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,CAAC,mBAAmB,IAAI,IAAI,EAAE,CAAC;QAClC,QAAQ,CAAC,mBAAmB,GAAG,CAAC,CAAC,mBAAmB,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,CAAC,sBAAsB,IAAI,IAAI,EAAE,CAAC;QACrC,QAAQ,CAAC,sBAAsB,GAAG,CAAC,CAAC,sBAAsB,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,CAAC,kCAAkC,IAAI,IAAI,EAAE,CAAC;QACjD,QAAQ,CAAC,kCAAkC;YACzC,CAAC,CAAC,kCAAkC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI;QAAE,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IACzE,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,YAAY,GAAG,CACnB,SAAiB,EACjB,QAAgC,EAChC,eAAuC,EACb,EAAE,CAAC,CAAC;IAC9B,GAAG,QAAQ;IACX,SAAS;IACT,eAAe;CAChB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CACnB,CAAyB,EACzB,CAAyB,EAChB,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC"}

package/lib/Cloudflare/Devices/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./CustomProfile.ts";
+export * from "./DefaultProfile.ts";
+export * from "./DexTest.ts";
+export * from "./ManagedNetwork.ts";
+export * from "./PostureIntegration.ts";
+export * from "./PostureRule.ts";
+export * from "./Settings.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/Cloudflare/Devices/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Devices/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC"}

package/lib/Cloudflare/Devices/index.js

@@ -0,0 +1,8 @@
+export * from "./CustomProfile.js";
+export * from "./DefaultProfile.js";
+export * from "./DexTest.js";
+export * from "./ManagedNetwork.js";
+export * from "./PostureIntegration.js";
+export * from "./PostureRule.js";
+export * from "./Settings.js";
+//# sourceMappingURL=index.js.map

package/lib/Cloudflare/Devices/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/Cloudflare/Devices/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC"}

package/lib/Cloudflare/Diagnostics/EndpointHealthcheck.d.ts

@@ -0,0 +1,92 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+declare const EndpointHealthcheckTypeId: "Cloudflare.Diagnostics.EndpointHealthcheck";
+type EndpointHealthcheckTypeId = typeof EndpointHealthcheckTypeId;
+export interface EndpointHealthcheckProps {
+    /**
+     * The IP address of the host to perform checks against. Must be an
+     * on-net (private) IP reachable through Magic Transit / Magic WAN, and
+     * unique among the account's endpoint healthchecks — Cloudflare rejects
+     * public or duplicate IPs with an "Invalid request" error (code 1002,
+     * surfaced as the typed `InvalidHealthcheckEndpoint`).
+     */
+    endpoint: string;
+    /**
+     * Type of check to perform. Only `"icmp"` is supported today.
+     * @default "icmp"
+     */
+    checkType?: "icmp";
+    /**
+     * Optional name associated with this check. Not unique on Cloudflare's
+     * side. If omitted, a unique name is generated from the app, stage, and
+     * logical ID.
+     *
+     * Cannot be changed after creation — Cloudflare's PUT endpoint echoes a
+     * new name back but never persists it — so updating this property
+     * triggers a replacement.
+     * @default ${app}-${stage}-${id}
+     */
+    name?: string;
+}
+export interface EndpointHealthcheckAttributes {
+    /** UUID of the endpoint healthcheck. Stable across updates. */
+    healthcheckId: string;
+    /** The Cloudflare account the healthcheck belongs to. */
+    accountId: string;
+    /** Type of check performed. */
+    checkType: "icmp";
+    /** The IP address of the host checks are performed against. */
+    endpoint: string;
+    /** Name associated with this check. */
+    name: string;
+}
+export type EndpointHealthcheck = Resource<EndpointHealthcheckTypeId, EndpointHealthcheckProps, EndpointHealthcheckAttributes, never, Providers>;
+/**
+ * A Magic Transit / Magic WAN endpoint healthcheck — a continuous ICMP
+ * probe of an on-net IP address used to monitor reachability of hosts
+ * behind Magic tunnels.
+ *
+ * The `endpoint` must be a private (on-net) IP; Cloudflare rejects public
+ * IPs with the typed `InvalidHealthcheckEndpoint` error. The `endpoint` is
+ * mutable in place via PUT (the UUID is stable across updates), but `name`
+ * is create-only — changing it triggers a replacement.
+ * @resource
+ * @product Diagnostics
+ * @category Observability & Analytics
+ * @section Creating an endpoint healthcheck
+ * @example Probe an on-net host
+ * ```typescript
+ * const check = yield* Cloudflare.EndpointHealthcheck("core-router", {
+ *   endpoint: "10.0.0.1",
+ * });
+ * ```
+ *
+ * @example With an explicit name
+ * ```typescript
+ * const check = yield* Cloudflare.EndpointHealthcheck("core-router", {
+ *   endpoint: "10.0.0.1",
+ *   name: "core-router-probe",
+ * });
+ * ```
+ *
+ * @section Updating
+ * @example Re-point the probe at a different host
+ * ```typescript
+ * // Changing `endpoint` updates the same healthcheck in place.
+ * const check = yield* Cloudflare.EndpointHealthcheck("core-router", {
+ *   endpoint: "10.0.0.2",
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/magic-wan/
+ */
+export declare const EndpointHealthcheck: import("../../Resource.ts").ResourceClass<EndpointHealthcheck>;
+/**
+ * Returns true if the given value is an EndpointHealthcheck resource.
+ */
+export declare const isEndpointHealthcheck: (value: unknown) => value is EndpointHealthcheck;
+export declare const EndpointHealthcheckProvider: () => import("effect/Layer").Layer<Provider.Provider<EndpointHealthcheck>, never, CloudflareEnvironment | import("@distilled.cloud/cloudflare").Credentials | import("effect/unstable/http/HttpClient").HttpClient | import("../../Stack.ts").Stack | import("../../Stage.ts").Stage>;
+export {};
+//# sourceMappingURL=EndpointHealthcheck.d.ts.map

package/lib/Cloudflare/Diagnostics/EndpointHealthcheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EndpointHealthcheck.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Diagnostics/EndpointHealthcheck.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,QAAA,MAAM,yBAAyB,EAC7B,4CAAqD,CAAC;AACxD,KAAK,yBAAyB,GAAG,OAAO,yBAAyB,CAAC;AAElE,MAAM,WAAW,wBAAwB;IACvC;;;;;;OAMG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,6BAA6B;IAC5C,+DAA+D;IAC/D,aAAa,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CACxC,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,EAC7B,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,mBAAmB,gEAE/B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,UACzB,OAAO,KACb,KAAK,IAAI,mBAE8B,CAAC;AAE3C,eAAO,MAAM,2BAA2B,uRAuHpC,CAAC"}