feat(ai-gateway): add guardrails property to resource and data sources

[fabiogermann]

• I understand that this repository is auto-generated and my pull request may not be merged

Changes being requested

Add guardrails property to the cloudflare_ai_gateway resource, single data source (cloudflare_ai_gateway), and list data source (cloudflare_ai_gateways), mirroring the pattern used by the existing dlp field.

What changed

• guardrails is a SingleNestedAttribute (optional on the resource, computed on data sources)
• It contains two MapAttribute fields - prompt and response - each mapping hazard codes (e.g. S1-S13, P1) to an action string ("BLOCK" or "FLAG")
• The map shape matches the Cloudflare API payload directly; using a map instead of fixed per-code fields means new hazard codes added by Cloudflare are automatically supported without a provider release
• mapvalidator.ValueStringsAre enforces the BLOCK/FLAG enum on all values

Files changed

File	Change
internal/services/ai_gateway/schema.go	Add guardrails SingleNestedAttribute with mapvalidator
internal/services/ai_gateway/model.go	Add AIGatewayGuardrailsModel struct and field on AIGatewayModel
internal/services/ai_gateway/data_source_schema.go	Add computed guardrails attribute
internal/services/ai_gateway/data_source_model.go	Add AIGatewayGuardrailsDataSourceModel and field
internal/services/ai_gateway/list_data_source_schema.go	Add computed guardrails attribute
internal/services/ai_gateway/list_data_source_model.go	Add AIGatewaysGuardrailsDataSourceModel and field

Example HCL

resource "cloudflare_ai_gateway" "example" {
  account_id = var.account_id
  id         = "my-gateway"
  # ... other fields ...
  guardrails = {
    prompt = {
      S1  = "BLOCK"
      S2  = "BLOCK"
      S6  = "FLAG"
      P1  = "FLAG"
    }
    response = {
      S1  = "BLOCK"
      S2  = "BLOCK"
      P1  = "FLAG"
    }
  }
}

Acceptance test run results

• I have added or updated acceptance tests for my changes
• I have run acceptance tests for my changes and included the results below

Steps to run acceptance tests

pre-existing test suite

Test output

All schema parity tests pass locally:

=== RUN   TestAIGatewayModelSchemaParity
--- PASS: TestAIGatewayModelSchemaParity (0.00s)
=== RUN   TestAIGatewayDataSourceModelSchemaParity
--- PASS: TestAIGatewayDataSourceModelSchemaParity (0.00s)
=== RUN   TestAIGatewaysDataSourceModelSchemaParity
--- PASS: TestAIGatewaysDataSourceModelSchemaParity (0.00s)
PASS
ok  	github.com/cloudflare/terraform-provider-cloudflare/internal/services/ai_gateway	0.564s

Additional context & links

• Cloudflare AI Gateway API payload reference for guardrails:

  "guardrails": {
    "prompt":   { "S1": "BLOCK", "S2": "BLOCK", "S6": "FLAG", "P1": "FLAG" },
    "response": { "S1": "BLOCK", "P1": "FLAG" }
  }

• The write path is not blocked by cloudflare-go/v6 v6.10.0 lacking Guardrails on its typed params — the resource serialises the request body via apijson.MarshalRoot on the tfsdk model directly, bypassing the SDK's param structs entirely.