alchemy 2.0.0-beta.56 → 2.0.0-beta.57

package/src/AWS/StateStore/State.ts

@@ -359,9 +359,15 @@ export const createStateBucketName = (accountId: string, region: string) =>
  */
 const ensureStateBucket = (bucket: string, region: string) =>
   Effect.gen(function* () {
+    // An absent bucket surfaces as either `NotFound` (the HEAD 404) or
+    // `NoSuchBucket` depending on the namespace/path — treat both as "create
+    // it". Catching only `NotFound` let a deleted state bucket (e.g. after a
+    // nuke) escape as an uncaught `NoSuchBucket` instead of being recreated.
     const exists = yield* s3.headBucket({ Bucket: bucket }).pipe(
       Effect.map(() => true),
-      Effect.catchTag("NotFound", () => Effect.succeed(false)),
+      Effect.catchTag(["NotFound", "NoSuchBucket"], () =>
+        Effect.succeed(false),
+      ),
     );
     if (exists) {
       return;

package/src/AWS/Website/AssetDeployment.ts

@@ -79,7 +79,7 @@ export interface AssetDeployment extends Resource<
  * `AssetDeployment` is a helper resource for website hosting. It uploads all
  * files in a directory, infers content types, applies cache-control defaults,
  * and can optionally purge stale files under a prefix.
- *
+ * @resource
  * @section Deploying Files
  * @example Upload A Build Directory
  * ```typescript

package/src/AWS/Website/Router.ts

@@ -37,7 +37,7 @@ import type { RouterProps } from "./shared.ts";
  * the Router's KV store. The Router's CF function matches incoming requests to
  * routes by host pattern and path prefix, then delegates to `routeSite()` for
  * static site routing or directly sets URL/S3 origins.
- *
+ * @resource
  * @section Creating Routers
  * @example Basic Router
  * ```typescript

package/src/AWS/Website/SsrSite.ts

@@ -139,7 +139,7 @@ const serverOriginOf = (server: SsrSiteServerOrigin): Input<string> =>
  *
  * `SsrSite` serves a dynamic origin behind CloudFront and can optionally split
  * immutable static assets into a private S3 bucket origin.
- *
+ * @resource
  * @section Creating SSR Sites
  * @example Lambda URL Origin
  * ```typescript

package/src/AWS/Website/StaticSite.ts

@@ -117,7 +117,7 @@ export interface StaticSiteProps {
  * KeyValueStore with a file manifest for edge routing, and optionally builds
  * the site first. Supports standalone distribution or composition with
  * `AWS.Website.Router`.
- *
+ * @resource
  * @section Basic Sites
  * @example Simple Static Site
  * ```typescript

package/src/AWS/index.ts

@@ -21,6 +21,7 @@ export * as ELBv2 from "./ELBv2/index.ts";
 export * as EventBridge from "./EventBridge/index.ts";
 export * as IAM from "./IAM/index.ts";
 export * as IdentityCenter from "./IdentityCenter/index.ts";
+export * as KMS from "./KMS/index.ts";
 export * as Kinesis from "./Kinesis/index.ts";
 export * as Lambda from "./Lambda/index.ts";
 export * as Logs from "./Logs/index.ts";

package/src/Axiom/Annotation.ts

@@ -26,7 +26,7 @@ export type Annotation = Resource<
  * Although typically created at deploy/release time (out-of-band of
  * regular IaC), modelling them as resources makes per-environment
  * annotation history reproducible.
- *
+ * @resource
  * @see https://axiom.co/docs/query-data/annotate-charts
  *
  * @section Creating an Annotation

package/src/Axiom/ApiToken.ts

@@ -34,7 +34,7 @@ export type ApiToken = Resource<
  * {@link Redacted}) on initial create and persisted in resource state.
  * Treat resource state as sensitive — anyone with read access can recover
  * the token. Pair with a secret store for downstream consumption.
- *
+ * @resource
  * @see https://axiom.co/docs/reference/tokens
  *
  * @section Creating an API Token

package/src/Axiom/Dashboard.ts

@@ -62,7 +62,7 @@ export type Dashboard = Resource<
  * - The chart payload is strict: only `id`, `name`, `type`, `query`. Extra
  *   keys (e.g. `dataset`, `description`) trigger
  *   `Unrecognized keys: "<name>"`.
- *
+ * @resource
  * @see https://axiom.co/docs/query-data/dashboards
  *
  * @section Creating a Dashboard

package/src/Axiom/Dataset.ts

@@ -80,7 +80,7 @@ export type Dataset = Resource<
  * inject them into a Worker / Lambda's env vars for OpenTelemetry shipping.
  * The bearer token is **not** stored in resource state — supply
  * `Authorization: Bearer <AXIOM_TOKEN>` separately at runtime.
- *
+ * @resource
  * @see https://axiom.co/docs/reference/datasets
  * @see https://axiom.co/docs/send-data/opentelemetry — OTLP endpoint reference
  *

package/src/Axiom/Monitor.ts

@@ -29,7 +29,7 @@ export type Monitor = Resource<
  *   baseline by more than `tolerance` over `compareDays`.
  *
  * Changing `type` triggers a replacement; everything else updates in place.
- *
+ * @resource
  * @see https://axiom.co/docs/monitor-data/monitors
  *
  * @section Creating a Monitor

package/src/Axiom/Notifier.ts

@@ -19,7 +19,7 @@ export type Notifier = Resource<
  * Opsgenie, Discord, Microsoft Teams, generic webhook, or a fully custom
  * webhook with templated body/headers) that {@link Monitor monitors} target
  * via `notifierIds`. Exactly one channel under `properties` should be set.
- *
+ * @resource
  * @see https://axiom.co/docs/monitor-data/notifiers
  *
  * @section Creating a Notifier

package/src/Axiom/View.ts

@@ -29,7 +29,7 @@ export type View = Resource<
  *
  * The path identifier is `name`. Renaming a view triggers a replacement
  * (the old one is deleted, a new one is created).
- *
+ * @resource
  * @see https://axiom.co/docs/query-data/datasets — APL query reference
  *
  * @section Creating a View

package/src/Axiom/VirtualField.ts

@@ -22,7 +22,7 @@ export type VirtualField = Resource<
  * dashboards and monitors don't have to redefine them.
  *
  * Bound to a single `dataset`; changing the dataset triggers a replacement.
- *
+ * @resource
  * @see https://axiom.co/docs/query-data/virtual-fields
  *
  * @section Creating a Virtual Field

package/src/Build/Command.ts

@@ -46,7 +46,13 @@ export interface Command extends Resource<
   CommandProps,
   {
     /**
-     * Absolute path to the build output.
+     * Path to the build output, relative to `process.cwd()`.
+     *
+     * Stored relative (rather than absolute) so the value is portable across
+     * machines — state written by a CI runner
+     * (`/home/runner/work/.../dist`) resolves correctly on a local laptop and
+     * vice versa. Consumers should `path.resolve()` it against their own cwd
+     * to obtain an absolute path.
      */
     outdir: string;
     /**
@@ -59,7 +65,7 @@ export interface Command extends Resource<
 /**
  * A Build resource that runs a shell command and produces an output asset.
  * Input files are hashed using globs to avoid redundant rebuilds.
- *
+ * @resource
  * @section Building a Vite App
  * @example Basic Vite Build
  * ```typescript
@@ -122,13 +128,31 @@ export const CommandProvider = () =>
           });
         });
 
+      // Absolute build-output path, used for all filesystem operations.
       const getOutputPath = (props: CommandProps) => {
         const cwd = props.cwd ? pathModule.resolve(props.cwd) : process.cwd();
         return pathModule.resolve(cwd, props.outdir);
       };
 
+      // The value persisted in `outdir`: relative to `process.cwd()` so it is
+      // portable across machines and resolves correctly anywhere it is read
+      // back (e.g. `Cloudflare.Worker` assets via `readAssets`).
+      const getRelativeOutputPath = (props: CommandProps) =>
+        pathModule.relative(process.cwd(), getOutputPath(props));
+
+      // Resolve a persisted `outdir` (relative going forward, but possibly an
+      // absolute path written by an older version of this provider) to an
+      // absolute path for filesystem access.
+      const resolveOutdir = (outdir: string) => pathModule.resolve(outdir);
+
       return Command.Provider.of({
-        stables: ["outdir"],
+        // `outdir` is intentionally NOT declared stable: it is derived from
+        // mutable inputs (`cwd` + `outdir`) and is machine-relative. Marking
+        // it stable made the engine carry the *old* state's path into
+        // downstream resources at plan time (e.g. a Worker's
+        // `assets.directory`), so a rebuild that produced a different path —
+        // or state written on another machine — fed a stale, non-existent
+        // directory to the consumer and crashed its asset read.
         // Non-listable: a Build.Command is a local build/exec step whose
         // artifact is a directory on the local filesystem keyed by the hash of
         // its inputs. There is no remote enumeration API to discover existing
@@ -150,17 +174,17 @@ export const CommandProvider = () =>
           }
           // Recompute the output path against the *current* cwd. State
           // may have been written by a different machine (e.g. CI) and
-          // the absolute path baked into `output.outdir` won't exist
-          // locally. As long as the path resolved against this
-          // machine's cwd is present, return the refreshed output so
-          // downstream consumers (e.g. `Cloudflare.Worker` assets)
-          // don't try to read a stale, foreign-machine path.
+          // the path baked into `output.outdir` won't exist locally. As
+          // long as the path resolved against this machine's cwd is
+          // present, return the refreshed (relative) output so downstream
+          // consumers (e.g. `Cloudflare.Worker` assets) don't try to read
+          // a stale, foreign-machine path.
           const outputPath = getOutputPath(olds);
           const exists = yield* fs.exists(outputPath);
           if (!exists) {
             return undefined;
           }
-          return { ...output, outdir: outputPath };
+          return { ...output, outdir: getRelativeOutputPath(olds) };
         }),
         reconcile: Effect.fnUntraced(function* ({ news, output, session }) {
           // Observe — the build artifact is a local directory keyed by the
@@ -169,11 +193,12 @@ export const CommandProvider = () =>
           const desiredHash = yield* hashDirectory(news);
           const outputPath = getOutputPath(news);
           const cachedExists =
-            output !== undefined && (yield* fs.exists(output.outdir));
+            output !== undefined &&
+            (yield* fs.exists(resolveOutdir(output.outdir)));
           const reusable =
             cachedExists &&
             output!.hash === desiredHash &&
-            output!.outdir === outputPath;
+            resolveOutdir(output!.outdir) === outputPath;
 
           // Ensure — when the cached artifact is missing, stale, or the
           // output path moved, run the build. The build command itself is
@@ -198,16 +223,18 @@ export const CommandProvider = () =>
             );
           }
 
-          // Return — the artifact location and the hash that produced it.
+          // Return — the artifact location (relative, for portability) and
+          // the hash that produced it.
           return {
-            outdir: outputPath,
+            outdir: getRelativeOutputPath(news),
             hash: desiredHash,
           };
         }),
         delete: Effect.fnUntraced(function* ({ output, session }) {
-          const exists = yield* fs.exists(output.outdir);
+          const outputPath = resolveOutdir(output.outdir);
+          const exists = yield* fs.exists(outputPath);
           if (exists) {
-            yield* fs.remove(output.outdir, { recursive: true });
+            yield* fs.remove(outputPath, { recursive: true });
             yield* session.note(`Removed build output: ${output.outdir}`);
           }
         }),

package/src/Bundle/Bundle.ts

@@ -161,6 +161,16 @@ export const watch = (
               },
             },
           ],
+          watch: {
+            // Watching the full module graph of an Effect worker (all of
+            // `effect`, `alchemy`, `@distilled.cloud/*`) registers thousands
+            // of OS watch handles *per worker*; with several Effect workers
+            // this exhausts the process fd table and the next `posix_spawn`
+            // (workerd / docker) fails with `spawn EBADF`. Workspace packages
+            // resolve to their real source paths (outside `node_modules`), so
+            // they stay watched and local HMR is unaffected.
+            exclude: ["**/node_modules/**"],
+          },
           output: outputOptions,
         });
         watcher.on("event", (event) => {

package/src/Cli/commands/cloudflare.ts

@@ -127,81 +127,41 @@ type CreateTokenPolicy = {
 };
 
 /**
- * Curated set of permission groups granted by `create-token` when
- * `--all-permissions` is NOT passed. Covers the services Alchemy commonly
- * deploys (Workers + storage + zone/DNS) without handing out a god token.
- * Names are matched against the account's live permission groups; any name
- * not available for the account is silently skipped.
+ * Cloudflare scopes that `buildTokenPolicies` knows how to turn into a policy,
+ * mapped to a short human label shown as a hint in the selection prompt.
+ * Groups with any other scope cannot be expressed as a policy and are omitted
+ * from the prompt.
  */
-const ALCHEMY_DEFAULT_PERMISSION_GROUP_NAMES: ReadonlySet<string> = new Set([
-  "Account Settings Read",
-  "Workers Scripts Read",
-  "Workers Scripts Write",
-  "Workers KV Storage Read",
-  "Workers KV Storage Write",
-  "Workers R2 Storage Read",
-  "Workers R2 Storage Write",
-  "Workers Routes Read",
-  "Workers Routes Write",
-  "Workers Tail Read",
-  "Workers Observability Read",
-  "Workers Observability Write",
-  "Workers AI Read",
-  "Workers AI Write",
-  "D1 Read",
-  "D1 Write",
-  "Queues Read",
-  "Queues Write",
-  "Hyperdrive Read",
-  "Hyperdrive Write",
-  "Pages Read",
-  "Pages Write",
-  "Vectorize Read",
-  "Vectorize Write",
-  "Pipelines Read",
-  "Pipelines Write",
-  "AI Gateway Read",
-  "AI Gateway Run",
-  "AI Gateway Write",
-  "Flagship Read",
-  "Flagship Write",
-  "Browser Rendering Read",
-  "Browser Rendering Write",
-  "Images Read",
-  "Images Write",
-  "Stream Read",
-  "Stream Write",
-  "Secrets Store Read",
-  "Secrets Store Write",
-  "DNS Read",
-  "DNS Write",
-  "Zone Read",
-  "Zone Settings Read",
-  "Zone Settings Write",
-  "SSL and Certificates Read",
-  "SSL and Certificates Write",
-]);
+const SELECTABLE_SCOPE_LABELS: Record<string, string> = {
+  "com.cloudflare.api.account": "account",
+  "com.cloudflare.api.account.zone": "zone",
+  "com.cloudflare.edge.r2.bucket": "r2",
+};
 
 /**
  * Group permission groups by their Cloudflare scope and produce one policy
  * per scope, wiring up the right resource selector for each:
  *
- * - `com.cloudflare.api.account` → scoped to the account ID
+ * - `com.cloudflare.api.account` → scoped to each selected account ID
  * - `com.cloudflare.api.account.zone` → all zones (`*`)
  * - `com.cloudflare.edge.r2.bucket` → all buckets (`*`)
  *
  * Mirrors the upstream `alchemy` "god token" policy shape. Groups with an
- * unrecognized scope are skipped, and empty policies are dropped.
+ * unrecognized scope are skipped, and empty policies are dropped. When more
+ * than one account is selected, the account-scoped policy lists every chosen
+ * account in its `resources` map so the token spans all of them.
  */
 const buildTokenPolicies = (
-  accountId: string,
+  accountIds: readonly string[],
   groups: readonly { id: string; scopes: readonly string[] }[],
 ): CreateTokenPolicy[] => {
   const buckets: Record<string, CreateTokenPolicy> = {
     "com.cloudflare.api.account": {
       effect: "allow",
       permissionGroups: [],
-      resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+      resources: Object.fromEntries(
+        accountIds.map((id) => [`com.cloudflare.api.account.${id}`, "*"]),
+      ),
     },
     "com.cloudflare.api.account.zone": {
       effect: "allow",
@@ -225,20 +185,20 @@ const buildTokenPolicies = (
 };
 
 /**
- * Let the user pick which Cloudflare account the token is scoped to. Lists
- * the accounts visible to the configured credentials and prompts a selection
- * (defaulting the cursor to the profile's account). If there's exactly one
- * account, it's used without prompting; if the API returns none, falls back
- * to the profile's account.
+ * Let the user pick which Cloudflare account(s) the token is scoped to. Lists
+ * the accounts visible to the configured credentials and prompts a
+ * multi-selection (defaulting the cursor to the profile's account). If there's
+ * exactly one account, it's used without prompting; if the API returns none,
+ * falls back to the profile's account.
  */
-const selectAccountId = (defaultAccountId: string | undefined) =>
+const selectAccountIds = (defaultAccountId: string | undefined) =>
   Effect.gen(function* () {
     const list = yield* cfAccounts.listAccounts;
     const response = yield* list({});
     const accounts = response.result;
 
     if (accounts.length === 0) {
-      if (defaultAccountId) return defaultAccountId;
+      if (defaultAccountId) return [defaultAccountId];
       return yield* Effect.die(
         "No Cloudflare accounts found for these credentials.",
       );
@@ -246,16 +206,19 @@ const selectAccountId = (defaultAccountId: string | undefined) =>
     if (accounts.length === 1) {
       const account = accounts[0]!;
       yield* Clank.info(`Using account: ${account.name} (${account.id})`);
-      return account.id;
+      return [account.id];
     }
-    return yield* Clank.select({
-      message: "Select a Cloudflare account",
-      initialValue: defaultAccountId,
+    return yield* Clank.multiselect<string>({
+      message:
+        "Select the Cloudflare account(s) to scope the token to " +
+        "(space to toggle, enter to confirm)",
+      initialValues: defaultAccountId ? [defaultAccountId] : undefined,
       options: accounts.map((a) => ({
         value: a.id,
         label: a.name,
         hint: a.id === defaultAccountId ? `${a.id} (current profile)` : a.id,
       })),
+      required: true,
     });
   });
 
@@ -277,10 +240,20 @@ const tokenNameFlag = Flag.string("name").pipe(
 
 const tokenAccountIdFlag = Flag.string("account-id").pipe(
   Flag.withDescription(
-    "Cloudflare account ID to scope the token to. Defaults to the profile's account.",
+    "Cloudflare account ID(s) to scope the token to (comma-separated for " +
+      "multiple). If omitted, you'll be prompted to select from your accounts.",
   ),
   Flag.optional,
-  Flag.map(Option.getOrUndefined),
+  Flag.map(
+    Option.match({
+      onNone: () => undefined,
+      onSome: (v) =>
+        v
+          .split(",")
+          .map((s) => s.trim())
+          .filter((s) => s.length > 0),
+    }),
+  ),
 );
 
 /**
@@ -296,8 +269,12 @@ const tokenAccountIdFlag = Flag.string("account-id").pipe(
  * stored.
  *
  * With `--all-permissions` it builds a "superuser" token spanning every
- * permission group (after a confirmation prompt). Otherwise it grants a
- * curated set covering the services Alchemy commonly deploys.
+ * permission group (after a confirmation prompt). Otherwise it prompts the
+ * user to pick which permission groups to grant from the account's live set.
+ *
+ * The token can be scoped to more than one account: pass a comma-separated
+ * list to `--account-id`, or (when neither is supplied) pick multiple accounts
+ * from the interactive selection prompt.
  */
 const createTokenCommand = Command.make(
   "create-token",
@@ -356,8 +333,8 @@ const createTokenCommand = Command.make(
             ),
           );
 
-        const resolvedAccountId =
-          accountId ?? (yield* withCreds(selectAccountId(undefined)));
+        const resolvedAccountIds =
+          accountId ?? (yield* withCreds(selectAccountIds(undefined)));
 
         const tokenName =
           name ??
@@ -399,12 +376,33 @@ const createTokenCommand = Command.make(
             : [],
         );
 
-        const selected = allPermissions
-          ? liveGroups
-          : liveGroups.filter((g) =>
-              ALCHEMY_DEFAULT_PERMISSION_GROUP_NAMES.has(g.name),
-            );
-        const policies = buildTokenPolicies(resolvedAccountId, selected);
+        let selected: typeof liveGroups;
+        if (allPermissions) {
+          selected = liveGroups;
+        } else {
+          // Only groups whose scope maps to one of the three policy buckets
+          // can actually become a policy (see `buildTokenPolicies`); offering
+          // the rest would let the user "select" permissions that are then
+          // silently dropped. Restrict the prompt to selectable groups.
+          const selectable = liveGroups
+            .filter((g) => SELECTABLE_SCOPE_LABELS[g.scopes[0]!] !== undefined)
+            .sort((a, b) => a.name.localeCompare(b.name));
+
+          const chosenIds = yield* Clank.multiselect<string>({
+            message:
+              "Select the permission groups to grant (space to toggle, enter to confirm)",
+            options: selectable.map((g) => ({
+              value: g.id,
+              label: g.name,
+              hint: SELECTABLE_SCOPE_LABELS[g.scopes[0]!],
+            })),
+            required: true,
+          });
+
+          const chosen = new Set(chosenIds);
+          selected = selectable.filter((g) => chosen.has(g.id));
+        }
+        const policies = buildTokenPolicies(resolvedAccountIds, selected);
 
         if (policies.length === 0) {
           return yield* Effect.die(

package/src/Cloudflare/Access/Application.ts

@@ -199,7 +199,9 @@ export type AccessApplication = Resource<
  *
  * Access policies are authored as standalone {@link AccessPolicy} resources
  * and referenced here by id — there is no inline-policy support.
- *
+ * @resource
+ * @product Access
+ * @category Cloudflare One (Zero Trust)
  * @section Creating an Application
  * @example Self-hosted application gated by a reusable Access policy
  * ```typescript

package/src/Cloudflare/Access/Bookmark.ts

@@ -64,7 +64,9 @@ export type AccessBookmark = Resource<
 /**
  * A Cloudflare Zero Trust Access bookmark application — an unprotected link
  * shown in the App Launcher.
- *
+ * @resource
+ * @product Access
+ * @category Cloudflare One (Zero Trust)
  * @deprecated **Legacy resource.** Cloudflare has deprecated the dedicated
  * bookmarks API in favor of Access applications with `type: "bookmark"` —
  * prefer {@link AccessApplication} for new configurations. This resource is

package/src/Cloudflare/Access/Certificate.ts

@@ -68,7 +68,9 @@ export type AccessCertificate = Resource<
  *
  * The certificate body is immutable — changing the PEM replaces the
  * resource. The name and associated hostnames converge in place.
- *
+ * @resource
+ * @product Access
+ * @category Cloudflare One (Zero Trust)
  * @section Creating a Certificate
  * @example Upload a CA certificate
  * ```typescript

package/src/Cloudflare/Access/CustomPage.ts

@@ -55,7 +55,9 @@ export type AccessCustomPage = Resource<
  * A Cloudflare Zero Trust Access custom page. Replaces the default Access
  * block pages (`identity_denied` / `forbidden`) with custom HTML, which can
  * then be selected on an Access application.
- *
+ * @resource
+ * @product Access
+ * @category Cloudflare One (Zero Trust)
  * @section Creating a Custom Page
  * @example Custom forbidden page
  * ```typescript

package/src/Cloudflare/Access/Group.ts

@@ -78,7 +78,9 @@ export type AccessGroup = Resource<
  * Access rule criteria. Groups are referenced from Access policies via a
  * `{ group: { id } }` rule, letting many policies share one membership
  * definition.
- *
+ * @resource
+ * @product Access
+ * @category Cloudflare One (Zero Trust)
  * @section Creating a Group
  * @example Allow a single email domain
  * ```typescript

package/src/Cloudflare/Access/IdentityProvider.ts

@@ -141,7 +141,9 @@ export type AccessIdentityProvider = Resource<
  * place. Cloudflare masks secret config fields (`clientSecret`, API
  * tokens) on read, so those fields diff against your previously declared
  * props instead of observed cloud state.
- *
+ * @resource
+ * @product Access
+ * @category Cloudflare One (Zero Trust)
  * @section Creating an Identity Provider
  * @example One-time PIN (no external dependencies)
  * ```typescript

package/src/Cloudflare/Access/InfrastructureTarget.ts

@@ -89,7 +89,9 @@ export type AccessInfrastructureTarget = Resource<
  * Targets are referenced by infrastructure Access applications, which
  * attach SSH access policies to them. Hostname and IP are both mutable
  * in place; the target's identity is its Cloudflare-assigned UUID.
- *
+ * @resource
+ * @product Access
+ * @category Cloudflare One (Zero Trust)
  * @section Creating a Target
  * @example Basic IPv4 target
  * ```typescript

package/src/Cloudflare/Access/KeyConfiguration.ts

@@ -56,7 +56,9 @@ export type AccessKeyConfiguration = Resource<
  * rotation interval when the observed value differs from the desired one;
  * destroy restores the interval the account had before Alchemy first managed
  * it (captured as `initialKeyRotationIntervalDays`).
- *
+ * @resource
+ * @product Access
+ * @category Cloudflare One (Zero Trust)
  * @section Managing the rotation interval
  * @example Rotate Access service keys every 30 days
  * ```typescript

package/src/Cloudflare/Access/McpPortal.ts

@@ -85,7 +85,9 @@ export type AccessMcpPortal = Resource<
  * entitlement; accounts without it receive the typed `Forbidden` error
  * on all writes. Attaching servers to the portal is managed out of band
  * (a future `Cloudflare.Access.McpServer` resource).
- *
+ * @resource
+ * @product Access
+ * @category Cloudflare One (Zero Trust)
  * @section Creating an MCP portal
  * @example Minimal portal
  * ```typescript

package/src/Cloudflare/Access/Organization.ts

@@ -156,7 +156,9 @@ export type AccessOrganization = Resource<
  * domain, login branding, session lifetimes, WARP authentication toggle, etc.
  *
  * Wraps `PUT /accounts/{account_id}/access/organizations`.
- *
+ * @resource
+ * @product Access
+ * @category Cloudflare One (Zero Trust)
  * @remarks
  * **This resource is a singleton.** Every Cloudflare account owns exactly one
  * Access Organization; you cannot create a second one and you cannot delete