alchemy 2.0.0-beta.55 → 2.0.0-beta.57

package/lib/Cloudflare/ApiShield/Configuration.d.ts

@@ -0,0 +1,100 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+declare const ApiShieldConfigurationTypeId: "Cloudflare.ApiShield.Configuration";
+type ApiShieldConfigurationTypeId = typeof ApiShieldConfigurationTypeId;
+/**
+ * A session identifier ("auth ID characteristic") used by API Shield to
+ * correlate API requests to individual API consumers. Header and cookie
+ * characteristics name the header/cookie carrying the session token; `jwt`
+ * characteristics take a claim path expression in `name`.
+ */
+export type ApiShieldAuthIdCharacteristic = {
+    /** Name of the header or cookie carrying the session identifier. */
+    name: string;
+    /** Where the session identifier lives on the request. */
+    type: "header" | "cookie";
+} | {
+    /** Claim path expression locating the session identifier in the JWT. */
+    name: string;
+    /** The session identifier is a claim inside a validated JWT. */
+    type: "jwt";
+};
+export interface ApiShieldConfigurationProps {
+    /**
+     * Zone whose API Shield configuration is managed.
+     *
+     * Immutable — moving the configuration between zones triggers a
+     * replacement (the old zone's configuration is restored to the value it
+     * had before Alchemy managed it).
+     */
+    zoneId: string;
+    /**
+     * The session identifiers ("auth ID characteristics") API Shield uses to
+     * attribute API requests to individual consumers — used by API Discovery
+     * and volumetric abuse detection. At most 10.
+     *
+     * Mutable — written in place via PUT.
+     */
+    authIdCharacteristics: ApiShieldAuthIdCharacteristic[];
+}
+export interface ApiShieldConfigurationAttributes {
+    /** Zone whose API Shield configuration is managed. */
+    zoneId: string;
+    /** The session identifiers currently configured on the zone. */
+    authIdCharacteristics: ApiShieldAuthIdCharacteristic[];
+    /**
+     * The session identifiers the zone had before Alchemy first managed the
+     * configuration. Restored on destroy, so deleting the resource puts the
+     * zone back the way it was found.
+     */
+    initialAuthIdCharacteristics: ApiShieldAuthIdCharacteristic[];
+}
+export type ApiShieldConfiguration = Resource<ApiShieldConfigurationTypeId, ApiShieldConfigurationProps, ApiShieldConfigurationAttributes, never, Providers>;
+/**
+ * The API Shield configuration of a Cloudflare zone — the session
+ * identifiers ("auth ID characteristics") used to attribute API traffic to
+ * individual consumers for API Discovery and volumetric abuse detection.
+ *
+ * The configuration is a zone singleton: it always exists (defaulting to an
+ * empty list), so this resource never creates or deletes anything physical.
+ * Reconcile PUTs the configuration when the observed characteristics differ
+ * from the desired ones; destroy restores the characteristics the zone had
+ * before Alchemy first managed them.
+ *
+ * Requires an API Shield entitlement (Enterprise) — on other plans every
+ * operation fails with Cloudflare's `NotEntitled` error (code 10403).
+ * @resource
+ * @product API Shield
+ * @category Application Security
+ * @section Configuring session identifiers
+ * @example Identify sessions by an Authorization header
+ * ```typescript
+ * yield* Cloudflare.ApiShieldConfiguration("SessionIds", {
+ *   zoneId: zone.zoneId,
+ *   authIdCharacteristics: [{ name: "authorization", type: "header" }],
+ * });
+ * ```
+ *
+ * @example Identify sessions by a cookie and a JWT claim
+ * ```typescript
+ * yield* Cloudflare.ApiShieldConfiguration("SessionIds", {
+ *   zoneId: zone.zoneId,
+ *   authIdCharacteristics: [
+ *     { name: "session_id", type: "cookie" },
+ *     { name: '$.cf.token_configurations[?(@.title=="api")].sub', type: "jwt" },
+ *   ],
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/api-shield/get-started/#session-identifiers
+ */
+export declare const ApiShieldConfiguration: import("../../Resource.ts").ResourceClass<ApiShieldConfiguration>;
+/**
+ * Returns true if the given value is an ApiShieldConfiguration resource.
+ */
+export declare const isApiShieldConfiguration: (value: unknown) => value is ApiShieldConfiguration;
+export declare const ApiShieldConfigurationProvider: () => import("effect/Layer").Layer<Provider.Provider<ApiShieldConfiguration>, never, CloudflareEnvironment | import("@distilled.cloud/cloudflare").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+export {};
+//# sourceMappingURL=Configuration.d.ts.map

package/lib/Cloudflare/ApiShield/Configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Configuration.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/ApiShield/Configuration.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,QAAA,MAAM,4BAA4B,EAChC,oCAA6C,CAAC;AAChD,KAAK,4BAA4B,GAAG,OAAO,4BAA4B,CAAC;AAExE;;;;;GAKG;AACH,MAAM,MAAM,6BAA6B,GACrC;IACE,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC3B,GACD;IACE,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,IAAI,EAAE,KAAK,CAAC;CACb,CAAC;AAEN,MAAM,WAAW,2BAA2B;IAC1C;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,qBAAqB,EAAE,6BAA6B,EAAE,CAAC;CACxD;AAED,MAAM,WAAW,gCAAgC;IAC/C,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,qBAAqB,EAAE,6BAA6B,EAAE,CAAC;IACvD;;;;OAIG;IACH,4BAA4B,EAAE,6BAA6B,EAAE,CAAC;CAC/D;AAED,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAC3C,4BAA4B,EAC5B,2BAA2B,EAC3B,gCAAgC,EAChC,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,sBAAsB,mEAElC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,UAC5B,OAAO,KACb,KAAK,IAAI,sBAEiC,CAAC;AAE9C,eAAO,MAAM,8BAA8B,wNA0IvC,CAAC"}

package/lib/Cloudflare/ApiShield/Configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Configuration.js","sourceRoot":"","sources":["../../../src/Cloudflare/ApiShield/Configuration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,yCAAyC,CAAC;AACtE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,4BAA4B,GAChC,oCAA6C,CAAC;AA+DhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAC5C,4BAA4B,CAC7B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,KAAc,EACmB,EAAE,CACnC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC;IACpC,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC;AAE9C,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,EAAE,CACjD,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE;IACvC,OAAO,EAAE,CAAC,QAAQ,EAAE,8BAA8B,CAAC;IAEnD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,gEAAgE;QAChE,oEAAoE;QACpE,wDAAwD;QACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAChC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAC/B,CAAC,MAAM,EAAE,EAAE,CACT,UAAU,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YACtB,MAAM,eAAe,GAAG,iBAAiB,CACvC,QAAQ,CAAC,qBAAqB,CAC/B,CAAC;YACF,OAAO,YAAY,CACjB,MAAM,EACN,QAAQ,CAAC,qBAAqB;YAC9B,yDAAyD;YACzD,oDAAoD;YACpD,eAAe,CAChB,CAAC;QACJ,CAAC,CAAC;QACF,8DAA8D;QAC9D,qDAAqD;QACrD,MAAM,CAAC,QAAQ,CACb,CAAC,aAAa,EAAE,yBAAyB,EAAE,WAAW,CAAC,EACvD,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAChC,CACF,EACH,EAAE,WAAW,EAAE,EAAE,EAAE,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAChB,CAAC,GAAG,EAA2C,EAAE,CAAC,GAAG,KAAK,SAAS,CACpE,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;QAC/C,MAAM,CAAC,GAAG,IAA+C,CAAC;QAC1D,MAAM,CAAC,GAAG,IAAmC,CAAC;QAC9C,sEAAsE;QACtE,MAAM,SAAS,GACb,MAAM,EAAE,MAAM;YACd,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzD,IACE,SAAS,KAAK,SAAS;YACvB,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAC5B,SAAS,KAAK,CAAC,CAAC,MAAM,EACtB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACzC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAK,IAAI,EAAE,MAA6B,CAAC;QACtE,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI;QAClE,gEAAgE;QAChE,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAC9C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,qEAAqE;QACrE,mEAAmE;QACnE,gEAAgE;QAChE,4CAA4C;QAC5C,MAAM,OAAO,GACX,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,MAAM,CAAC,4BAA4B;YACrC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC9C,yDAAyD;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgB,CAAC;QAErC,qEAAqE;QACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhE,+DAA+D;QAC/D,oEAAoE;QACpE,oEAAoE;QACpE,6BAA6B;QAC7B,MAAM,OAAO,GACX,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,MAAM,CAAC,4BAA4B;YACrC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QAExD,+DAA+D;QAC/D,IACE,oBAAoB,CAClB,iBAAiB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EACjD,IAAI,CAAC,qBAAqB,CAC3B,EACD,CAAC;YACD,OAAO,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAChD,MAAM;YACN,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,MAAM,EAAE,MAAM,EAAE,4BAA4B,EAAE,GAAG,MAAM,CAAC;QACxD,iEAAiE;QACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU;aAC/B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;aAC5B,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAC9C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;QACnC,iEAAiE;QACjE,iEAAiE;QACjE,IACE,oBAAoB,CAClB,iBAAiB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EACjD,4BAA4B,CAC7B,EACD,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,CAAC,CAAC,UAAU;aACd,gBAAgB,CAAC;YAChB,MAAM;YACN,qBAAqB,EAAE,4BAA4B;SACpD,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC;CACH,CAAC,CAAC;AAEL;;;GAGG;AACH,MAAM,iBAAiB,GAAG,CACxB,eAA0D,EACzB,EAAE,CACnC,eAAe,CAAC,GAAG,CACjB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC;IACC,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,IAAI,EAAE,CAAC,CAAC,IAAI;CACb,CAAkC,CACtC,CAAC;AAEJ;;;GAGG;AACH,MAAM,oBAAoB,GAAG,CAC3B,CAAkC,EAClC,CAAkC,EACzB,EAAE;IACX,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,CAAC,CAAgC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,MAAc,EACd,QAAmD,EACnD,OAAwC,EACN,EAAE,CAAC,CAAC;IACtC,MAAM;IACN,qBAAqB,EAAE,iBAAiB,CAAC,QAAQ,CAAC;IAClD,4BAA4B,EAAE,OAAO;CACtC,CAAC,CAAC"}

package/lib/Cloudflare/ApiShield/Label.d.ts

@@ -0,0 +1,86 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+declare const ApiShieldLabelTypeId: "Cloudflare.ApiShield.Label";
+type ApiShieldLabelTypeId = typeof ApiShieldLabelTypeId;
+export interface ApiShieldLabelProps {
+    /**
+     * Zone the label is defined on.
+     *
+     * Immutable — moving a label between zones triggers a replacement.
+     */
+    zoneId: string;
+    /**
+     * Name of the label. Must be 1–24 characters. If omitted, a unique
+     * lowercase name is generated from the app, stage, and logical ID.
+     *
+     * Immutable — the name is the label's identity, so changing it triggers
+     * a replacement.
+     * @default ${app}-${id}-${stage}-${suffix} (truncated to 24 characters)
+     */
+    name?: string;
+    /**
+     * Human-readable description of the label. Mutable — patched in place.
+     * @default ""
+     */
+    description?: string;
+}
+export interface ApiShieldLabelAttributes {
+    /** Zone the label is defined on. */
+    zoneId: string;
+    /** Name of the label (its identity within the zone). */
+    name: string;
+    /** Human-readable description of the label. */
+    description: string;
+    /**
+     * Who owns the label: `user` for labels we manage, `managed` for
+     * Cloudflare-curated labels.
+     */
+    source: string;
+    /** ISO8601 creation timestamp. */
+    createdAt: string;
+    /** ISO8601 timestamp of the last update. */
+    lastUpdated: string;
+}
+export type ApiShieldLabel = Resource<ApiShieldLabelTypeId, ApiShieldLabelProps, ApiShieldLabelAttributes, never, Providers>;
+/**
+ * A Cloudflare API Shield user label — a zone-scoped tag that can be
+ * attached to registered API operations to organize and filter them
+ * (e.g. by team, service, or sensitivity).
+ *
+ * The label's `name` is its identity (and Cloudflare limits it to 24
+ * characters), so renaming triggers a replacement; only the `description`
+ * is mutable in place. Deleting a label detaches it from any operations
+ * server-side.
+ * @resource
+ * @product API Shield
+ * @category Application Security
+ * @section Creating a Label
+ * @example Label with a generated name
+ * ```typescript
+ * const label = yield* Cloudflare.ApiShieldLabel("TeamPayments", {
+ *   zoneId: zone.zoneId,
+ *   description: "endpoints owned by the payments team",
+ * });
+ * ```
+ *
+ * @example Label with an explicit name
+ * ```typescript
+ * yield* Cloudflare.ApiShieldLabel("Pii", {
+ *   zoneId: zone.zoneId,
+ *   name: "pii",
+ *   description: "endpoints that return personal data",
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/api-shield/management-and-monitoring/endpoint-labels/
+ */
+export declare const ApiShieldLabel: import("../../Resource.ts").ResourceClass<ApiShieldLabel>;
+/**
+ * Returns true if the given value is an ApiShieldLabel resource.
+ */
+export declare const isApiShieldLabel: (value: unknown) => value is ApiShieldLabel;
+export declare const ApiShieldLabelProvider: () => import("effect/Layer").Layer<Provider.Provider<ApiShieldLabel>, never, CloudflareEnvironment | import("@distilled.cloud/cloudflare").Credentials | import("effect/unstable/http/HttpClient").HttpClient | import("../../Stack.ts").Stack | import("../../Stage.ts").Stage>;
+export {};
+//# sourceMappingURL=Label.d.ts.map

package/lib/Cloudflare/ApiShield/Label.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Label.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/ApiShield/Label.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,QAAA,MAAM,oBAAoB,EAAG,4BAAqC,CAAC;AACnE,KAAK,oBAAoB,GAAG,OAAO,oBAAoB,CAAC;AAExD,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CACnC,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,cAAc,2DAAiD,CAAC;AAE7E;;GAEG;AACH,eAAO,MAAM,gBAAgB,UAAW,OAAO,KAAG,KAAK,IAAI,cACkB,CAAC;AAE9E,eAAO,MAAM,sBAAsB,kRA+H/B,CAAC"}

package/lib/Cloudflare/ApiShield/Label.js

@@ -0,0 +1,167 @@
+import * as apiGateway from "@distilled.cloud/cloudflare/api-gateway";
+import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+import * as Stream from "effect/Stream";
+import { Unowned } from "../../AdoptPolicy.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
+import { listAllZones } from "../Zone/lookup.js";
+const ApiShieldLabelTypeId = "Cloudflare.ApiShield.Label";
+/**
+ * A Cloudflare API Shield user label — a zone-scoped tag that can be
+ * attached to registered API operations to organize and filter them
+ * (e.g. by team, service, or sensitivity).
+ *
+ * The label's `name` is its identity (and Cloudflare limits it to 24
+ * characters), so renaming triggers a replacement; only the `description`
+ * is mutable in place. Deleting a label detaches it from any operations
+ * server-side.
+ * @resource
+ * @product API Shield
+ * @category Application Security
+ * @section Creating a Label
+ * @example Label with a generated name
+ * ```typescript
+ * const label = yield* Cloudflare.ApiShieldLabel("TeamPayments", {
+ *   zoneId: zone.zoneId,
+ *   description: "endpoints owned by the payments team",
+ * });
+ * ```
+ *
+ * @example Label with an explicit name
+ * ```typescript
+ * yield* Cloudflare.ApiShieldLabel("Pii", {
+ *   zoneId: zone.zoneId,
+ *   name: "pii",
+ *   description: "endpoints that return personal data",
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/api-shield/management-and-monitoring/endpoint-labels/
+ */
+export const ApiShieldLabel = Resource(ApiShieldLabelTypeId);
+/**
+ * Returns true if the given value is an ApiShieldLabel resource.
+ */
+export const isApiShieldLabel = (value) => Predicate.hasProperty(value, "Type") && value.Type === ApiShieldLabelTypeId;
+export const ApiShieldLabelProvider = () => Provider.succeed(ApiShieldLabel, {
+    stables: ["zoneId", "name", "source", "createdAt"],
+    list: Effect.fn(function* () {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        // Labels are zone-scoped — fan out over every zone and list its
+        // user labels. Only `user`-sourced labels are enumerated;
+        // `managed` labels are Cloudflare-curated and not ours to delete.
+        const zones = yield* listAllZones(accountId);
+        const rows = yield* Effect.forEach(zones, (zone) => apiGateway.listLabels.pages({ zoneId: zone.id, source: "user" }).pipe(Stream.runCollect, Effect.map((chunk) => Array.from(chunk).flatMap((page) => (page.result ?? []).map((label) => toAttributes(label, zone.id)))), 
+        // A zone may genuinely vanish mid-enumeration: a concurrent
+        // delete purged it (ZonePurged, Cloudflare code 10410), it lacks
+        // the route (InvalidRoute), or it's already gone (NotFound). Skip
+        // that zone rather than fail the whole enumeration. (Transient
+        // code-10000 "Authentication error" blips under concurrency are
+        // retried globally by the Cloudflare retry policy, so they never
+        // reach here as a real failure.)
+        Effect.catchTag(["ZonePurged", "InvalidRoute", "NotFound"], () => Effect.succeed([]))), { concurrency: 10 });
+        return rows.flat();
+    }),
+    diff: Effect.fn(function* ({ id, olds, news, output }) {
+        const o = olds;
+        const n = news;
+        if (o === undefined)
+            return undefined;
+        // The name is the label's identity — compare the resolved physical
+        // names (an omitted name resolves deterministically from the id).
+        const oldName = output?.name ?? (yield* createLabelName(id, o.name));
+        const newName = yield* createLabelName(id, n.name);
+        if (oldName !== newName) {
+            return { action: "replace" };
+        }
+        // zoneId is Input<string>; compare only once both are concrete.
+        if (typeof o.zoneId === "string" &&
+            typeof n.zoneId === "string" &&
+            o.zoneId !== n.zoneId) {
+            return { action: "replace" };
+        }
+        return undefined;
+    }),
+    read: Effect.fn(function* ({ id, output, olds }) {
+        const zoneId = output?.zoneId ?? olds?.zoneId;
+        if (zoneId === undefined)
+            return undefined;
+        // Owned path: refresh by the persisted name.
+        if (output?.name) {
+            const observed = yield* getLabel(zoneId, output.name);
+            return observed ? toAttributes(observed, zoneId) : undefined;
+        }
+        // Cold path: recover from lost state via the deterministic name.
+        // Labels carry no ownership markers, so an existing label is
+        // reported as `Unowned` and adoption is gated by the adopt policy.
+        const name = yield* createLabelName(id, olds?.name);
+        const observed = yield* getLabel(zoneId, name);
+        return observed ? Unowned(toAttributes(observed, zoneId)) : undefined;
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output }) {
+        // Inputs have been resolved to concrete strings by Plan.
+        const zoneId = news.zoneId;
+        const name = output?.name ?? (yield* createLabelName(id, news.name));
+        // 1. Observe — read the live label; the attributes cached on
+        //    `output` are a hint, not a guarantee.
+        let observed = yield* getLabel(zoneId, name);
+        // 2. Ensure — create when missing. A concurrent create surfaces as
+        //    `LabelAlreadyExists` (Cloudflare code 70009): converge by
+        //    re-reading the label that won the race.
+        if (!observed) {
+            observed = yield* apiGateway
+                .bulkCreateLabelUsers({
+                zoneId,
+                body: [{ name, description: news.description }],
+            })
+                .pipe(Effect.map((response) => response.result[0]), Effect.catchTag("LabelAlreadyExists", (error) => getLabel(zoneId, name).pipe(Effect.flatMap((existing) => existing ? Effect.succeed(existing) : Effect.fail(error)))));
+        }
+        // 3. Sync — diff the observed description against desired; skip the
+        //    patch call entirely on a no-op.
+        const desired = news.description ?? "";
+        if (observed.description !== desired) {
+            observed = yield* apiGateway.patchLabelUser({
+                zoneId,
+                name,
+                description: desired,
+            });
+        }
+        return toAttributes(observed, zoneId);
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        yield* apiGateway
+            .deleteLabelUser({ zoneId: output.zoneId, name: output.name })
+            .pipe(Effect.catchTag("LabelNotFound", () => Effect.void));
+    }),
+});
+/**
+ * Read a label by name, mapping "gone" (`LabelNotFound`, Cloudflare error
+ * code 70014) to `undefined`.
+ */
+const getLabel = (zoneId, name) => apiGateway.getLabelUser({ zoneId, name }).pipe(Effect.map((label) => label), Effect.catchTag("LabelNotFound", () => Effect.succeed(undefined)));
+/**
+ * Resolve the label's physical name: the explicit prop wins; otherwise a
+ * deterministic name is generated from the app, stage, and logical ID,
+ * truncated to Cloudflare's 24-character limit.
+ */
+const createLabelName = (id, name) => Effect.gen(function* () {
+    return (name ??
+        (yield* createPhysicalName({
+            id,
+            lowercase: true,
+            maxLength: 24,
+            suffixLength: 8,
+        })));
+});
+const toAttributes = (label, zoneId) => ({
+    zoneId,
+    name: label.name,
+    description: label.description,
+    source: label.source,
+    createdAt: label.createdAt,
+    lastUpdated: label.lastUpdated,
+});
+//# sourceMappingURL=Label.js.map

package/lib/Cloudflare/ApiShield/Label.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Label.js","sourceRoot":"","sources":["../../../src/Cloudflare/ApiShield/Label.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,yCAAyC,CAAC;AACtE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,oBAAoB,GAAG,4BAAqC,CAAC;AAoDnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAiB,oBAAoB,CAAC,CAAC;AAE7E;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAA2B,EAAE,CAC1E,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,CAAC;AAE9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CACzC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE;IAC/B,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC;IAElD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,gEAAgE;QAChE,0DAA0D;QAC1D,kEAAkE;QAClE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAChC,KAAK,EACL,CAAC,IAAI,EAAE,EAAE,CACP,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAChC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAC7B,CACF,CACF;QACD,4DAA4D;QAC5D,iEAAiE;QACjE,kEAAkE;QAClE,+DAA+D;QAC/D,gEAAgE;QAChE,iEAAiE;QACjE,iCAAiC;QACjC,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,CAC/D,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CACnB,CACF,EACH,EAAE,WAAW,EAAE,EAAE,EAAE,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;QACnD,MAAM,CAAC,GAAG,IAAuC,CAAC;QAClD,MAAM,CAAC,GAAG,IAA2B,CAAC;QACtC,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACtC,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,gEAAgE;QAChE,IACE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAC5B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAC5B,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EACrB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC7C,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAK,IAAI,EAAE,MAA6B,CAAC;QACtE,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAE3C,6CAA6C;QAC7C,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,CAAC;QAED,iEAAiE;QACjE,6DAA6D;QAC7D,mEAAmE;QACnE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/C,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAClD,yDAAyD;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgB,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAErE,6DAA6D;QAC7D,2CAA2C;QAC3C,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE7C,mEAAmE;QACnE,+DAA+D;QAC/D,6CAA6C;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU;iBACzB,oBAAoB,CAAC;gBACpB,MAAM;gBACN,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;aAChD,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAC5C,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC9C,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CACzB,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CACzD,CACF,CACF,CACF,CAAC;QACN,CAAC;QAED,oEAAoE;QACpE,qCAAqC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;YACrC,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC;gBAC1C,MAAM;gBACN,IAAI;gBACJ,WAAW,EAAE,OAAO;aACrB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,KAAK,CAAC,CAAC,UAAU;aACd,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC;CACH,CAAC,CAAC;AAOL;;;GAGG;AACH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,EAAE,CAChD,UAAU,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,EACvD,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAClE,CAAC;AAEJ;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC/D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO,CACL,IAAI;QACJ,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC;YACzB,EAAE;YACF,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,EAAE;YACb,YAAY,EAAE,CAAC;SAChB,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,CACnB,KAAoB,EACpB,MAAc,EACY,EAAE,CAAC,CAAC;IAC9B,MAAM;IACN,IAAI,EAAE,KAAK,CAAC,IAAI;IAChB,WAAW,EAAE,KAAK,CAAC,WAAW;IAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,SAAS,EAAE,KAAK,CAAC,SAAS;IAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;CAC/B,CAAC,CAAC"}

package/lib/Cloudflare/ApiShield/Operation.d.ts

@@ -0,0 +1,112 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+declare const ApiShieldOperationTypeId: "Cloudflare.ApiShield.Operation";
+type ApiShieldOperationTypeId = typeof ApiShieldOperationTypeId;
+/**
+ * HTTP method of an API Shield operation.
+ */
+export type ApiShieldOperationMethod = "GET" | "POST" | "HEAD" | "OPTIONS" | "PUT" | "DELETE" | "CONNECT" | "PATCH" | "TRACE";
+export interface ApiShieldOperationProps {
+    /**
+     * Zone the operation is registered on.
+     *
+     * Immutable — moving an operation between zones triggers a replacement.
+     */
+    zoneId: string;
+    /**
+     * The HTTP method used to access the endpoint.
+     *
+     * Immutable — an operation is the `(method, host, endpoint)` tuple, so
+     * changing the method triggers a replacement.
+     */
+    method: ApiShieldOperationMethod;
+    /**
+     * RFC3986-compliant host the endpoint lives on (e.g. `api.example.com`).
+     * Must belong to the zone.
+     *
+     * Immutable — changing the host triggers a replacement.
+     */
+    host: string;
+    /**
+     * The endpoint path, which may contain path-parameter templates in curly
+     * braces (e.g. `/api/v1/users/{id}`). Cloudflare normalizes variable
+     * names left-to-right to `{var1}`, `{var2}`, … on insertion.
+     *
+     * Immutable — changing the (normalized) endpoint triggers a replacement.
+     */
+    endpoint: string;
+}
+export interface ApiShieldOperationAttributes {
+    /** Cloudflare-assigned UUID of the operation. */
+    operationId: string;
+    /** Zone the operation is registered on. */
+    zoneId: string;
+    /** The HTTP method used to access the endpoint. */
+    method: ApiShieldOperationMethod;
+    /** RFC3986-compliant host the endpoint lives on. */
+    host: string;
+    /**
+     * The endpoint path as stored by Cloudflare — variable names are
+     * normalized left-to-right to `{var1}`, `{var2}`, …
+     */
+    endpoint: string;
+    /** ISO8601 timestamp of the last update. */
+    lastUpdated: string;
+}
+export type ApiShieldOperation = Resource<ApiShieldOperationTypeId, ApiShieldOperationProps, ApiShieldOperationAttributes, never, Providers>;
+/**
+ * A Cloudflare API Shield operation — a registered API endpoint on a zone,
+ * identified by the `(method, host, endpoint)` tuple. Registered operations
+ * are the unit other API Shield features (schema validation, rate limiting
+ * recommendations, API Discovery) attach to.
+ *
+ * An operation is pure identity: there is no update API, so changing any
+ * property triggers a replacement. Cloudflare upserts by identity — creating
+ * an already-registered tuple returns the existing operation — which makes
+ * reconciliation race-free.
+ *
+ * Endpoint paths may contain `{placeholder}` templates; Cloudflare
+ * normalizes the variable names left-to-right to `{var1}`, `{var2}`, … and
+ * the normalized form is what is stored and diffed.
+ * @resource
+ * @product API Shield
+ * @category Application Security
+ * @section Registering an Operation
+ * @example Register a GET endpoint
+ * ```typescript
+ * const op = yield* Cloudflare.ApiShieldOperation("GetUser", {
+ *   zoneId: zone.zoneId,
+ *   method: "GET",
+ *   host: "api.example.com",
+ *   endpoint: "/api/v1/users/{id}",
+ * });
+ * // op.endpoint === "/api/v1/users/{var1}"
+ * ```
+ *
+ * @example Register a POST endpoint
+ * ```typescript
+ * yield* Cloudflare.ApiShieldOperation("CreateUser", {
+ *   zoneId: zone.zoneId,
+ *   method: "POST",
+ *   host: "api.example.com",
+ *   endpoint: "/api/v1/users",
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/api-shield/management-and-monitoring/endpoint-management/
+ */
+export declare const ApiShieldOperation: import("../../Resource.ts").ResourceClass<ApiShieldOperation>;
+/**
+ * Returns true if the given value is an ApiShieldOperation resource.
+ */
+export declare const isApiShieldOperation: (value: unknown) => value is ApiShieldOperation;
+export declare const ApiShieldOperationProvider: () => import("effect/Layer").Layer<Provider.Provider<ApiShieldOperation>, never, CloudflareEnvironment | import("@distilled.cloud/cloudflare").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * Normalize an endpoint path the way Cloudflare does on insertion: each
+ * `{placeholder}` is replaced left-to-right with `{var1}`, `{var2}`, …
+ */
+export declare const normalizeEndpoint: (endpoint: string) => string;
+export {};
+//# sourceMappingURL=Operation.d.ts.map

package/lib/Cloudflare/ApiShield/Operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Operation.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/ApiShield/Operation.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,QAAA,MAAM,wBAAwB,EAAG,gCAAyC,CAAC;AAC3E,KAAK,wBAAwB,GAAG,OAAO,wBAAwB,CAAC;AAEhE;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAChC,KAAK,GACL,MAAM,GACN,MAAM,GACN,SAAS,GACT,KAAK,GACL,QAAQ,GACR,SAAS,GACT,OAAO,GACP,OAAO,CAAC;AAEZ,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,EAAE,wBAAwB,CAAC;IACjC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC3C,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,MAAM,EAAE,wBAAwB,CAAC;IACjC,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CACvC,wBAAwB,EACxB,uBAAuB,EACvB,4BAA4B,EAC5B,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,kBAAkB,+DAE9B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,UACxB,OAAO,KACb,KAAK,IAAI,kBAE6B,CAAC;AAE1C,eAAO,MAAM,0BAA0B,oNAwHnC,CAAC;AAOL;;;GAGG;AACH,eAAO,MAAM,iBAAiB,aAAc,MAAM,KAAG,MAMpD,CAAC"}