Cloudflare/cws
@swamp/cloudflare/cwsv2026.10.23.1
01README
Cloudflare cws infrastructure models
02Release Notes
- Updated: basic-auth-credentials
- Updated: deployments
- Updated: domain-acls
- Updated: policies
- Updated: policy-sets
- Updated: rego-metadata
- Updated: rego-modules
- Updated: tenant-structures
- Updated: workloads
03Behaviors
@swamp/cloudflare/cws/basic-auth-credentialsv2026.10.23.1basic-auth-credentials.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| username? | string | Login presented by the client. Printable ASCII only, excluding space and colon. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Basic-auth-credentials
fn get(id: string)
Get a Basic-auth-credentials
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Basic-auth-credentials |
fn lookup(allowMissing?: boolean)
Look up an existing Basic-auth-credentials by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Basic-auth-credentials by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Basic-auth-credentials to import |
fn delete(id: string)
Delete the Basic-auth-credentials
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Basic-auth-credentials |
fn sync(identifier?: string)
Sync Basic-auth-credentials state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Basic-auth-credentials by id (e.g. one discovered by list) |
Resources
state(infinite)— Basic-auth-credentials resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/cws/deploymentsv2026.10.23.1deployments.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| basic_auth_credential_ids? | array | IDs of basic-auth credentials to attach |
| default_mode? | enum | Default traffic mode: ALLOW or BLOCK |
| description? | string | Optional free-form description. |
| domain_acl_id? | string | ID of the domain ACL to attach (omit or null for none) |
| name? | string | Name of the deployment |
| on_error_action? | enum | Action for runtime Rego errors. Omit to use BLOCK. |
| policy_set_ids? | array | IDs of policy sets to attach |
| rego_raise_error? | boolean | Whether OPA builtin failures are raised as runtime evaluation errors. Omit to use the default true value. |
| tags? | record | Tags to attach. Keys are limited to 256 UTF-8 bytes and values to 1024 UTF-8 bytes. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Deployments
fn get(id: string)
Get a Deployments
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Deployments |
fn lookup(allowMissing?: boolean)
Look up an existing Deployments by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Deployments by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Deployments to import |
fn update(identifier?: string)
Update Deployments attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Deployments by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Deployments
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Deployments |
fn sync(identifier?: string)
Sync Deployments state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Deployments by id (e.g. one discovered by list) |
Resources
state(infinite)— Deployments resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/cws/domain-aclsv2026.10.23.1domain-acls.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| default_action? | enum | Default action when no entry matches |
| entries? | array | Domain entries for this ACL. Each domain must appear at most once. |
| name? | string | Name of the domain ACL |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Domain-acls
fn get(id: string)
Get a Domain-acls
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Domain-acls |
fn lookup(allowMissing?: boolean)
Look up an existing Domain-acls by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Domain-acls by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Domain-acls to import |
fn update(identifier?: string)
Update Domain-acls attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Domain-acls by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Domain-acls
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Domain-acls |
fn sync(identifier?: string)
Sync Domain-acls state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Domain-acls by id (e.g. one discovered by list) |
Resources
state(infinite)— Domain-acls resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/cws/policiesv2026.10.23.1policies.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| description? | string | Optional free-form description. |
| entrypoint? | string | Non-function rule declared in rego_source. Evaluation uses data.<package_path>.<entrypoint>. |
| filter? | string | Filter expression that determines whether this policy applies. Maximum 4096 UTF-8 bytes. |
| name? | string | Name of the policy |
| rego_source? | string | Inline Rego source with a package beginning with "policy." Maximum 16384 UTF-8 bytes. |
| tags? | record | Tags to attach. Keys are limited to 256 UTF-8 bytes and values to 1024 UTF-8 bytes. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Policies
fn get(id: string)
Get a Policies
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Policies |
fn lookup(allowMissing?: boolean)
Look up an existing Policies by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Policies by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Policies to import |
fn update(identifier?: string)
Update Policies attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Policies by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Policies
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Policies |
fn sync(identifier?: string)
Sync Policies state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Policies by id (e.g. one discovered by list) |
Resources
state(infinite)— Policies resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/cws/policy-setsv2026.10.23.1policy-sets.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| description? | string | Optional free-form description. |
| exclude_workload_ids? | array | Workload IDs that exclude matching requests. Exclusions take precedence. |
| include_workload_ids? | array | Workload IDs that include matching requests. Empty or omitted includes all requests before exclusions. |
| name? | string | Name of the policy set |
| policies? | array | Policies to include with per-membership enforcement mode |
| tags? | record | Tags to attach. Keys are limited to 256 UTF-8 bytes and values to 1024 UTF-8 bytes. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Policy-sets
fn get(id: string)
Get a Policy-sets
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Policy-sets |
fn lookup(allowMissing?: boolean)
Look up an existing Policy-sets by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Policy-sets by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Policy-sets to import |
fn update(identifier?: string)
Update Policy-sets attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Policy-sets by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Policy-sets
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Policy-sets |
fn sync(identifier?: string)
Sync Policy-sets state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Policy-sets by id (e.g. one discovered by list) |
Resources
state(infinite)— Policy-sets resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/cws/rego-metadatav2026.10.23.1rego-metadata.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| data? | string | |
| import_path? | string | Unique Rego import path in the form metadata.<segment>, with one alphanumeric or underscore segment. Reference it as data.<import_path>. |
| name? | string | Name of the rego metadata document (unique per account) |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Rego-metadata
fn get(id: string)
Get a Rego-metadata
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Rego-metadata |
fn lookup(allowMissing?: boolean)
Look up an existing Rego-metadata by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Rego-metadata by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Rego-metadata to import |
fn update(identifier?: string)
Update Rego-metadata attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Rego-metadata by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Rego-metadata
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Rego-metadata |
fn sync(identifier?: string)
Sync Rego-metadata state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Rego-metadata by id (e.g. one discovered by list) |
Resources
state(infinite)— Rego-metadata resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/cws/rego-modulesv2026.10.23.1rego-modules.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| name? | string | Name of the Rego module (unique per account) |
| rego_source? | string | Library Rego source with a package beginning with "lib." Maximum 16384 UTF-8 bytes. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Rego-modules
fn get(id: string)
Get a Rego-modules
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Rego-modules |
fn lookup(allowMissing?: boolean)
Look up an existing Rego-modules by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Rego-modules by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Rego-modules to import |
fn update(identifier?: string)
Update Rego-modules attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Rego-modules by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Rego-modules
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Rego-modules |
fn sync(identifier?: string)
Sync Rego-modules state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Rego-modules by id (e.g. one discovered by list) |
Resources
state(infinite)— Rego-modules resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/cws/tenant-structuresv2026.10.23.1tenant-structures.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| application? | enum | Platform this structure models. Immutable after creation. |
| import_path? | string | Optional unique Rego mount path in the form tenant.<application>.<name>; application must match. Omit to leave unmounted. |
| name? | string | Human-readable name; unique per account |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Tenant-structures
fn get(id: string)
Get a Tenant-structures
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Tenant-structures |
fn lookup(allowMissing?: boolean)
Look up an existing Tenant-structures by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Tenant-structures by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Tenant-structures to import |
fn update(identifier?: string)
Update Tenant-structures attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Tenant-structures by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Tenant-structures
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Tenant-structures |
fn sync(identifier?: string)
Sync Tenant-structures state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Tenant-structures by id (e.g. one discovered by list) |
Resources
state(infinite)— Tenant-structures resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/cws/workloadsv2026.10.23.1workloads.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| description? | string | Optional free-form description. |
| filter? | string | Filter expression selecting the requests this workload matches. Maximum 4096 UTF-8 bytes. |
| name? | string | Human-readable handle; unique per account. |
| tags? | record | Tags to attach. Keys are limited to 256 UTF-8 bytes and values to 1024 UTF-8 bytes. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Workloads
fn get(id: string)
Get a Workloads
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Workloads |
fn lookup(allowMissing?: boolean)
Look up an existing Workloads by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Workloads by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Workloads to import |
fn update(identifier?: string)
Update Workloads attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Workloads by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Workloads
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Workloads |
fn sync(identifier?: string)
Sync Workloads state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Workloads by id (e.g. one discovered by list) |
Resources
state(infinite)— Workloads resource state
lookupResult(infinite)— Outcome of the most recent lookup
04Previous Versions
2026.10.20.1AGPL-3.0-or-later
- Updated: basic-auth-credentials
- Updated: deployments
- Updated: domain-acls
- Updated: policies
- Updated: policy-sets
- Updated: rego-metadata
- Updated: rego-modules
- Updated: tenant-structures
- Updated: workloads
Modified 9 behaviors
2026.10.17.1AGPL-3.0-or-later
- Updated: policies
2026.10.16.1AGPL-3.0-or-later(was none)
2026.10.13.1
- Added: basic-auth-credentials
- Added: deployments
- Added: domain-acls
- Added: policies
- Added: policy-sets
- Added: rego-metadata
- Added: rego-modules
- Added: tenant-structures
- Added: workloads
05Stats
A
100 / 100
Downloads
9
Archive size
27.2 KB
Verified by Swamp
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Docs keep secrets in a vault1/1earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License2/2earned
- Verified public repository2/2earned
06Platforms
07Labels