@leaflow/sdk 0.0.0-dev.29.g8fe6a71 → 0.0.0-dev.291.gcde7444

package/dist/dns/v1/generated/schemas.zod.js

@@ -0,0 +1,364 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow DNS API
+ * Manage DNS records across supported providers through a single API. Register a provider
+ * credential, and every domain that credential can reach becomes readable and writable here.
+ *
+ * Reads and writes always reflect the current state at the provider. Records changed through the
+ * provider's own console, an ACME client, or any other automation are visible here immediately,
+ * and changes made here take effect there.
+ *
+ * ## Authentication
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme.
+ *
+ * **Neither the path nor the headers carry a `project_id`**: the current project is determined by
+ * the token.
+ *
+ * ## Conventions
+ *
+ * - **Records are addressed as record sets, not as individual records.** All records sharing a
+ *   name and a type form one set — for example, three A records pointing at three addresses. This
+ *   API exposes no per-record identifier, because provider-assigned identifiers are neither
+ *   portable across providers nor guaranteed to be stable within one.
+ * - **`PUT` replaces an entire record set; `PATCH` names individual values.** See below; this is
+ *   the single most consequential distinction in this API.
+ * - **Confirm which credential owns a domain before writing to it.** The same domain can exist in
+ *   more than one provider account — most commonly while a domain is being migrated and the old
+ *   account still holds it — and only one of them is actually serving queries.
+ * - **Changes do not take effect everywhere at once.** A write reaches the provider immediately,
+ *   but resolvers elsewhere continue serving the previous value until its TTL expires. Allow at
+ *   least one TTL before verifying a change by resolving the name.
+ * - **Credential material is never returned.** No operation, including the one that registers it,
+ *   returns the values that were submitted. A credential that was entered incorrectly must be
+ *   deleted and registered again.
+ *
+ * ## PUT or PATCH
+ *
+ * `PUT` states what a record set should contain. `PATCH` names values to add or remove and leaves
+ * the rest alone. The distinction is concurrency.
+ *
+ * Changing part of a set with `PUT` means reading it and submitting a modified list. That is a
+ * read-modify-write: a value added in between — by a concurrent certificate issuance, by another
+ * automation, or from the provider's own console — is absent from the submitted list and is
+ * therefore removed. Every request in that sequence returns 2xx.
+ *
+ * `PATCH` reads nothing. It is the only operation on a record set safe to issue concurrently, and
+ * the one certificate issuance must use.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+import { CreateCredentialRequestBody } from "./validators/createCredentialRequestBody.zod.js";
+import { ModifyRecordSetRequestBody } from "./validators/modifyRecordSetRequestBody.zod.js";
+import { RenameCredentialRequestBody } from "./validators/renameCredentialRequestBody.zod.js";
+import { SetRecordSetRequestBody } from "./validators/setRecordSetRequestBody.zod.js";
+/**
+ * @summary List provider credentials
+ */
+export const listCredentialsQueryLimitDefault = 50;
+export const listCredentialsQueryLimitMax = 200;
+export const listCredentialsQueryOffsetDefault = 0;
+export const listCredentialsQueryOffsetMin = 0;
+export const listCredentialsQueryOffsetMax = 10000;
+export const ListCredentialsQueryParams = zod.strictObject({
+    limit: zod
+        .int()
+        .min(1)
+        .max(listCredentialsQueryLimitMax)
+        .default(listCredentialsQueryLimitDefault)
+        .describe("Items returned in this page. Defaults to 50; at most 200."),
+    offset: zod
+        .int()
+        .min(listCredentialsQueryOffsetMin)
+        .max(listCredentialsQueryOffsetMax)
+        .default(listCredentialsQueryOffsetDefault)
+        .describe("Items to skip. Defaults to 0; at most 10000."),
+    provider: zod
+        .enum(["cloudflare", "tencentcloud", "alidns", "route53"])
+        .optional()
+        .describe("Return only credentials for this provider; omit for all providers"),
+});
+/**
+ * The credential is validated against the provider before it is accepted. A credential that
+ * cannot list domains is rejected with `CREDENTIAL_REJECTED_UPSTREAM` and is not stored.
+ *
+ * `provider` selects which configuration block is required: `provider: cloudflare` requires
+ * the `cloudflare` block, and the remaining blocks are ignored. Omitting the matching block
+ * returns `CREDENTIAL_CONFIG_MISSING`.
+ *
+ * Registering a credential that is already held by this project returns
+ * `CREDENTIAL_DUPLICATE`. Provider rate limits apply per credential, so a second copy grants
+ * no additional capacity.
+ *
+ * The submitted credential material is not returned by this or any other operation.
+ * @summary Register a provider credential
+ */
+export const CreateCredentialBody = CreateCredentialRequestBody;
+/**
+ * @summary Get a provider credential
+ */
+export const GetCredentialParams = zod.strictObject({
+    credentialId: zod.uuid(),
+});
+/**
+ * Only the display name can be changed. To use different credential material, delete this
+ * credential and register a new one: a credential's identity does not change over its
+ * lifetime.
+ * @summary Rename a provider credential
+ */
+export const RenameCredentialParams = zod.strictObject({
+    credentialId: zod.uuid(),
+});
+export const RenameCredentialBody = RenameCredentialRequestBody;
+/**
+ * Domains reachable only through this credential stop appearing in `GET /zones` and can no
+ * longer be read or written through this API.
+ *
+ * **No DNS record is modified.** Deleting a credential withdraws this project's access to the
+ * provider account; it does not remove anything that was published there.
+ * @summary Delete a provider credential
+ */
+export const DeleteCredentialParams = zod.strictObject({
+    credentialId: zod.uuid(),
+});
+/**
+ * Checks the credential against the provider and records the outcome in `last_verified_at`
+ * and `last_verify_error`.
+ *
+ * A credential is validated when it is registered. This operation exists for credentials whose
+ * permissions or keys were subsequently changed at the provider, which is a change this API is
+ * not notified of.
+ *
+ * **A failed check returns 200, not an error.** The outcome is reported in
+ * `last_verify_error`: the request itself succeeded, and the answer it obtained is that the
+ * credential is no longer usable.
+ * @summary Re-validate a provider credential
+ */
+export const VerifyCredentialParams = zod.strictObject({
+    credentialId: zod.uuid(),
+});
+/**
+ * Lists every domain reachable through the credentials registered by this project.
+ *
+ * Listings may briefly lag behind domains added or removed at the provider. Set `refresh` for
+ * an up-to-date answer.
+ *
+ * ## A domain that appears more than once
+ *
+ * While a domain is being migrated it commonly exists in both provider accounts at once. Such
+ * a domain is returned once per credential, with the same `zone` and different
+ * `credential_id`.
+ *
+ * `authoritative` reports which entry is the one currently serving queries, determined from
+ * the domain's delegation. `null` means no determination was made: either the domain appears
+ * only once, or its delegation does not identify any of the registered providers — for
+ * example when custom nameservers are in use, or the domain is not delegated at all.
+ *
+ * **Write operations are refused while the determination is `null` and the domain appears more
+ * than once**, with `ZONE_AMBIGUOUS`. Supply `credential_id` on the write request to select a
+ * credential explicitly.
+ * @summary List domains
+ */
+export const listZonesQueryRefreshDefault = false;
+export const ListZonesQueryParams = zod.strictObject({
+    credential_id: zod
+        .uuid()
+        .optional()
+        .describe("Return only domains reachable through this credential"),
+    refresh: zod
+        .boolean()
+        .default(listZonesQueryRefreshDefault)
+        .describe("Return the current set of domains rather than a possibly slightly stale one. Slower, and consumes provider API quota"),
+});
+/**
+ * Returns the domain's records grouped into record sets: all records sharing a name and a type
+ * are reported as one entry, with their values in `values`.
+ *
+ * `limit` and `offset` reduce the size of the response but not the time taken to produce it.
+ * For domains with many records, filter by `name` or `type`.
+ * @summary List record sets
+ */
+export const listRecordsPathZoneMax = 253;
+export const ListRecordsParams = zod.strictObject({
+    zone: zod
+        .string()
+        .min(1)
+        .max(listRecordsPathZoneMax)
+        .describe("The domain. A trailing dot is optional"),
+});
+export const listRecordsQueryNameMax = 253;
+export const listRecordsQueryLimitDefault = 50;
+export const listRecordsQueryLimitMax = 200;
+export const listRecordsQueryOffsetDefault = 0;
+export const listRecordsQueryOffsetMin = 0;
+export const listRecordsQueryOffsetMax = 10000;
+export const ListRecordsQueryParams = zod.strictObject({
+    credential_id: zod
+        .uuid()
+        .optional()
+        .describe("Which credential to use. When omitted, the credential is determined from the domain; see ZONE_AMBIGUOUS"),
+    name: zod
+        .string()
+        .max(listRecordsQueryNameMax)
+        .optional()
+        .describe("Return only record sets with this name, given relative to the domain. `@` denotes the domain itself"),
+    type: zod
+        .enum(["A", "AAAA", "CNAME", "TXT", "MX", "NS", "SRV", "CAA"])
+        .optional()
+        .describe("Return only record sets of this type"),
+    limit: zod
+        .int()
+        .min(1)
+        .max(listRecordsQueryLimitMax)
+        .default(listRecordsQueryLimitDefault)
+        .describe("Items returned in this page. Defaults to 50; at most 200."),
+    offset: zod
+        .int()
+        .min(listRecordsQueryOffsetMin)
+        .max(listRecordsQueryOffsetMax)
+        .default(listRecordsQueryOffsetDefault)
+        .describe("Items to skip. Defaults to 0; at most 10000."),
+});
+/**
+ * Returns `RECORD_SET_NOT_FOUND` when no record of this type exists under this name.
+ * @summary Get a record set
+ */
+export const getRecordSetPathZoneMax = 253;
+export const getRecordSetPathNameMax = 253;
+export const GetRecordSetParams = zod.strictObject({
+    zone: zod
+        .string()
+        .min(1)
+        .max(getRecordSetPathZoneMax)
+        .describe("The domain. A trailing dot is optional"),
+    name: zod
+        .string()
+        .min(1)
+        .max(getRecordSetPathNameMax)
+        .describe("The name, given relative to the domain. `@` denotes the domain itself and `*` a wildcard"),
+    type: zod
+        .enum(["A", "AAAA", "CNAME", "TXT", "MX", "NS", "SRV", "CAA"])
+        .describe("A DNS record type.\n\nThe listed types are those this API supports uniformly across every provider. HTTPS and\nSVCB are not yet available."),
+});
+/**
+ * **This replaces the entire record set.** After this request, the only records under this
+ * name and type are the ones listed in `values`; any value present beforehand and absent here
+ * is removed.
+ *
+ * The record set is created if it does not exist, so this operation both creates and replaces,
+ * and is idempotent.
+ *
+ * Two concurrent requests against the same domain conflict; the second receives `ZONE_BUSY`
+ * and may be retried.
+ *
+ * **Use `PATCH` to add or remove individual values.** Reading the set and submitting a
+ * modified list is a read-modify-write: values added by anything else between those two steps
+ * are stated to be absent, and are therefore removed, with both requests returning 200.
+ * @summary Replace a record set
+ */
+export const setRecordSetPathZoneMax = 253;
+export const setRecordSetPathNameMax = 253;
+export const SetRecordSetParams = zod.strictObject({
+    zone: zod
+        .string()
+        .min(1)
+        .max(setRecordSetPathZoneMax)
+        .describe("The domain. A trailing dot is optional"),
+    name: zod
+        .string()
+        .min(1)
+        .max(setRecordSetPathNameMax)
+        .describe("The name, given relative to the domain. `@` denotes the domain itself and `*` a wildcard"),
+    type: zod
+        .enum(["A", "AAAA", "CNAME", "TXT", "MX", "NS", "SRV", "CAA"])
+        .describe("A DNS record type.\n\nThe listed types are those this API supports uniformly across every provider. HTTPS and\nSVCB are not yet available."),
+});
+export const SetRecordSetQueryParams = zod.strictObject({
+    credential_id: zod
+        .uuid()
+        .optional()
+        .describe("Which credential to use. When omitted, the credential is determined from the domain; see ZONE_AMBIGUOUS"),
+});
+export const SetRecordSetBody = SetRecordSetRequestBody;
+/**
+ * **Names values to add and remove; anything not named is left in place.** Nothing is read
+ * first, so this is the only operation on a record set safe to issue concurrently. The set is
+ * created if it does not exist.
+ *
+ * Certificate issuance must use this operation for both the challenge record and its cleanup.
+ * `PUT` and `DELETE` state or remove the whole set, so a concurrent issuance's challenge
+ * record is discarded — with every request returning 2xx, and the failure surfacing as the
+ * second certificate failing validation.
+ *
+ * `add` is applied before `remove`, so a request carrying both changes a value without the
+ * name ever resolving without it: the set briefly holds one value too many rather than one too
+ * few. The reverse order, as two requests, leaves a window in which the value is absent — for
+ * a single-valued set, the name does not resolve at all — and an addition that then fails
+ * leaves it gone.
+ *
+ * A value appearing in both `add` and `remove` is rejected rather than resolved in one
+ * direction.
+ *
+ * Values in `remove` that are absent are skipped, so a retried cleanup reaches the same
+ * result. Values in `add` that are already present are rejected by the provider: a record set
+ * cannot hold the same value twice.
+ *
+ * Removing every value leaves an empty set, reported as `values: []`, not `RECORD_SET_NOT_FOUND`.
+ * @summary Add or remove values in a record set
+ */
+export const modifyRecordSetPathZoneMax = 253;
+export const modifyRecordSetPathNameMax = 253;
+export const ModifyRecordSetParams = zod.strictObject({
+    zone: zod
+        .string()
+        .min(1)
+        .max(modifyRecordSetPathZoneMax)
+        .describe("The domain. A trailing dot is optional"),
+    name: zod
+        .string()
+        .min(1)
+        .max(modifyRecordSetPathNameMax)
+        .describe("The name, given relative to the domain. `@` denotes the domain itself and `*` a wildcard"),
+    type: zod
+        .enum(["A", "AAAA", "CNAME", "TXT", "MX", "NS", "SRV", "CAA"])
+        .describe("A DNS record type.\n\nThe listed types are those this API supports uniformly across every provider. HTTPS and\nSVCB are not yet available."),
+});
+export const ModifyRecordSetQueryParams = zod.strictObject({
+    credential_id: zod
+        .uuid()
+        .optional()
+        .describe("Which credential to use. When omitted, the credential is determined from the domain; see ZONE_AMBIGUOUS"),
+});
+export const ModifyRecordSetBody = ModifyRecordSetRequestBody;
+/**
+ * Removes every record under this name and type. **To remove part of a set, use `PATCH`**,
+ * which is safe to issue concurrently; this operation and `PUT` are not.
+ *
+ * Providers reject removal of the last NS record set at the apex of a domain, which would
+ * withdraw the domain from DNS entirely.
+ * @summary Delete a record set
+ */
+export const deleteRecordSetPathZoneMax = 253;
+export const deleteRecordSetPathNameMax = 253;
+export const DeleteRecordSetParams = zod.strictObject({
+    zone: zod
+        .string()
+        .min(1)
+        .max(deleteRecordSetPathZoneMax)
+        .describe("The domain. A trailing dot is optional"),
+    name: zod
+        .string()
+        .min(1)
+        .max(deleteRecordSetPathNameMax)
+        .describe("The name, given relative to the domain. `@` denotes the domain itself and `*` a wildcard"),
+    type: zod
+        .enum(["A", "AAAA", "CNAME", "TXT", "MX", "NS", "SRV", "CAA"])
+        .describe("A DNS record type.\n\nThe listed types are those this API supports uniformly across every provider. HTTPS and\nSVCB are not yet available."),
+});
+export const DeleteRecordSetQueryParams = zod.strictObject({
+    credential_id: zod
+        .uuid()
+        .optional()
+        .describe("Which credential to use. When omitted, the credential is determined from the domain; see ZONE_AMBIGUOUS"),
+});

package/dist/dns/v1/generated/validators/aliDNSConfig.zod.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow DNS API
+ * Manage DNS records across supported providers through a single API. Register a provider
+ * credential, and every domain that credential can reach becomes readable and writable here.
+ *
+ * Reads and writes always reflect the current state at the provider. Records changed through the
+ * provider's own console, an ACME client, or any other automation are visible here immediately,
+ * and changes made here take effect there.
+ *
+ * ## Authentication
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme.
+ *
+ * **Neither the path nor the headers carry a `project_id`**: the current project is determined by
+ * the token.
+ *
+ * ## Conventions
+ *
+ * - **Records are addressed as record sets, not as individual records.** All records sharing a
+ *   name and a type form one set — for example, three A records pointing at three addresses. This
+ *   API exposes no per-record identifier, because provider-assigned identifiers are neither
+ *   portable across providers nor guaranteed to be stable within one.
+ * - **`PUT` replaces an entire record set; `PATCH` names individual values.** See below; this is
+ *   the single most consequential distinction in this API.
+ * - **Confirm which credential owns a domain before writing to it.** The same domain can exist in
+ *   more than one provider account — most commonly while a domain is being migrated and the old
+ *   account still holds it — and only one of them is actually serving queries.
+ * - **Changes do not take effect everywhere at once.** A write reaches the provider immediately,
+ *   but resolvers elsewhere continue serving the previous value until its TTL expires. Allow at
+ *   least one TTL before verifying a change by resolving the name.
+ * - **Credential material is never returned.** No operation, including the one that registers it,
+ *   returns the values that were submitted. A credential that was entered incorrectly must be
+ *   deleted and registered again.
+ *
+ * ## PUT or PATCH
+ *
+ * `PUT` states what a record set should contain. `PATCH` names values to add or remove and leaves
+ * the rest alone. The distinction is concurrency.
+ *
+ * Changing part of a set with `PUT` means reading it and submitting a modified list. That is a
+ * read-modify-write: a value added in between — by a concurrent certificate issuance, by another
+ * automation, or from the provider's own console — is absent from the submitted list and is
+ * therefore removed. Every request in that sequence returns 2xx.
+ *
+ * `PATCH` reads nothing. It is the only operation on a record set safe to issue concurrently, and
+ * the one certificate issuance must use.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const aliDNSConfigAccessKeyIdMax = 256;
+export declare const aliDNSConfigAccessKeySecretMax = 256;
+export declare const aliDNSConfigRegionIdMax = 64;
+export declare const AliDNSConfig: zod.ZodObject<{
+    access_key_id: zod.ZodString;
+    access_key_secret: zod.ZodString;
+    region_id: zod.ZodOptional<zod.ZodString>;
+}, zod.z.core.$strict>;
+export type AliDNSConfig = zod.input<typeof AliDNSConfig>;
+export type AliDNSConfigOutput = zod.output<typeof AliDNSConfig>;

package/dist/dns/v1/generated/validators/aliDNSConfig.zod.js

@@ -0,0 +1,65 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow DNS API
+ * Manage DNS records across supported providers through a single API. Register a provider
+ * credential, and every domain that credential can reach becomes readable and writable here.
+ *
+ * Reads and writes always reflect the current state at the provider. Records changed through the
+ * provider's own console, an ACME client, or any other automation are visible here immediately,
+ * and changes made here take effect there.
+ *
+ * ## Authentication
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme.
+ *
+ * **Neither the path nor the headers carry a `project_id`**: the current project is determined by
+ * the token.
+ *
+ * ## Conventions
+ *
+ * - **Records are addressed as record sets, not as individual records.** All records sharing a
+ *   name and a type form one set — for example, three A records pointing at three addresses. This
+ *   API exposes no per-record identifier, because provider-assigned identifiers are neither
+ *   portable across providers nor guaranteed to be stable within one.
+ * - **`PUT` replaces an entire record set; `PATCH` names individual values.** See below; this is
+ *   the single most consequential distinction in this API.
+ * - **Confirm which credential owns a domain before writing to it.** The same domain can exist in
+ *   more than one provider account — most commonly while a domain is being migrated and the old
+ *   account still holds it — and only one of them is actually serving queries.
+ * - **Changes do not take effect everywhere at once.** A write reaches the provider immediately,
+ *   but resolvers elsewhere continue serving the previous value until its TTL expires. Allow at
+ *   least one TTL before verifying a change by resolving the name.
+ * - **Credential material is never returned.** No operation, including the one that registers it,
+ *   returns the values that were submitted. A credential that was entered incorrectly must be
+ *   deleted and registered again.
+ *
+ * ## PUT or PATCH
+ *
+ * `PUT` states what a record set should contain. `PATCH` names values to add or remove and leaves
+ * the rest alone. The distinction is concurrency.
+ *
+ * Changing part of a set with `PUT` means reading it and submitting a modified list. That is a
+ * read-modify-write: a value added in between — by a concurrent certificate issuance, by another
+ * automation, or from the provider's own console — is absent from the submitted list and is
+ * therefore removed. Every request in that sequence returns 2xx.
+ *
+ * `PATCH` reads nothing. It is the only operation on a record set safe to issue concurrently, and
+ * the one certificate issuance must use.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export const aliDNSConfigAccessKeyIdMax = 256;
+export const aliDNSConfigAccessKeySecretMax = 256;
+export const aliDNSConfigRegionIdMax = 64;
+export const AliDNSConfig = zod
+    .strictObject({
+    access_key_id: zod.string().min(1).max(aliDNSConfigAccessKeyIdMax),
+    access_key_secret: zod.string().min(1).max(aliDNSConfigAccessKeySecretMax),
+    region_id: zod
+        .string()
+        .max(aliDNSConfigRegionIdMax)
+        .optional()
+        .describe("Defaults to cn-hangzhou"),
+})
+    .describe("Alibaba Cloud DNS credentials, created under RAM");

package/dist/dns/v1/generated/validators/cloudflareConfig.zod.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow DNS API
+ * Manage DNS records across supported providers through a single API. Register a provider
+ * credential, and every domain that credential can reach becomes readable and writable here.
+ *
+ * Reads and writes always reflect the current state at the provider. Records changed through the
+ * provider's own console, an ACME client, or any other automation are visible here immediately,
+ * and changes made here take effect there.
+ *
+ * ## Authentication
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme.
+ *
+ * **Neither the path nor the headers carry a `project_id`**: the current project is determined by
+ * the token.
+ *
+ * ## Conventions
+ *
+ * - **Records are addressed as record sets, not as individual records.** All records sharing a
+ *   name and a type form one set — for example, three A records pointing at three addresses. This
+ *   API exposes no per-record identifier, because provider-assigned identifiers are neither
+ *   portable across providers nor guaranteed to be stable within one.
+ * - **`PUT` replaces an entire record set; `PATCH` names individual values.** See below; this is
+ *   the single most consequential distinction in this API.
+ * - **Confirm which credential owns a domain before writing to it.** The same domain can exist in
+ *   more than one provider account — most commonly while a domain is being migrated and the old
+ *   account still holds it — and only one of them is actually serving queries.
+ * - **Changes do not take effect everywhere at once.** A write reaches the provider immediately,
+ *   but resolvers elsewhere continue serving the previous value until its TTL expires. Allow at
+ *   least one TTL before verifying a change by resolving the name.
+ * - **Credential material is never returned.** No operation, including the one that registers it,
+ *   returns the values that were submitted. A credential that was entered incorrectly must be
+ *   deleted and registered again.
+ *
+ * ## PUT or PATCH
+ *
+ * `PUT` states what a record set should contain. `PATCH` names values to add or remove and leaves
+ * the rest alone. The distinction is concurrency.
+ *
+ * Changing part of a set with `PUT` means reading it and submitting a modified list. That is a
+ * read-modify-write: a value added in between — by a concurrent certificate issuance, by another
+ * automation, or from the provider's own console — is absent from the submitted list and is
+ * therefore removed. Every request in that sequence returns 2xx.
+ *
+ * `PATCH` reads nothing. It is the only operation on a record set safe to issue concurrently, and
+ * the one certificate issuance must use.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const cloudflareConfigApiTokenMax = 512;
+export declare const cloudflareConfigZoneTokenMax = 512;
+export declare const CloudflareConfig: zod.ZodObject<{
+    api_token: zod.ZodString;
+    zone_token: zod.ZodOptional<zod.ZodString>;
+}, zod.z.core.$strict>;
+export type CloudflareConfig = zod.input<typeof CloudflareConfig>;
+export type CloudflareConfigOutput = zod.output<typeof CloudflareConfig>;

package/dist/dns/v1/generated/validators/cloudflareConfig.zod.js

@@ -0,0 +1,67 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow DNS API
+ * Manage DNS records across supported providers through a single API. Register a provider
+ * credential, and every domain that credential can reach becomes readable and writable here.
+ *
+ * Reads and writes always reflect the current state at the provider. Records changed through the
+ * provider's own console, an ACME client, or any other automation are visible here immediately,
+ * and changes made here take effect there.
+ *
+ * ## Authentication
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme.
+ *
+ * **Neither the path nor the headers carry a `project_id`**: the current project is determined by
+ * the token.
+ *
+ * ## Conventions
+ *
+ * - **Records are addressed as record sets, not as individual records.** All records sharing a
+ *   name and a type form one set — for example, three A records pointing at three addresses. This
+ *   API exposes no per-record identifier, because provider-assigned identifiers are neither
+ *   portable across providers nor guaranteed to be stable within one.
+ * - **`PUT` replaces an entire record set; `PATCH` names individual values.** See below; this is
+ *   the single most consequential distinction in this API.
+ * - **Confirm which credential owns a domain before writing to it.** The same domain can exist in
+ *   more than one provider account — most commonly while a domain is being migrated and the old
+ *   account still holds it — and only one of them is actually serving queries.
+ * - **Changes do not take effect everywhere at once.** A write reaches the provider immediately,
+ *   but resolvers elsewhere continue serving the previous value until its TTL expires. Allow at
+ *   least one TTL before verifying a change by resolving the name.
+ * - **Credential material is never returned.** No operation, including the one that registers it,
+ *   returns the values that were submitted. A credential that was entered incorrectly must be
+ *   deleted and registered again.
+ *
+ * ## PUT or PATCH
+ *
+ * `PUT` states what a record set should contain. `PATCH` names values to add or remove and leaves
+ * the rest alone. The distinction is concurrency.
+ *
+ * Changing part of a set with `PUT` means reading it and submitting a modified list. That is a
+ * read-modify-write: a value added in between — by a concurrent certificate issuance, by another
+ * automation, or from the provider's own console — is absent from the submitted list and is
+ * therefore removed. Every request in that sequence returns 2xx.
+ *
+ * `PATCH` reads nothing. It is the only operation on a record set safe to issue concurrently, and
+ * the one certificate issuance must use.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export const cloudflareConfigApiTokenMax = 512;
+export const cloudflareConfigZoneTokenMax = 512;
+export const CloudflareConfig = zod
+    .strictObject({
+    api_token: zod
+        .string()
+        .min(1)
+        .max(cloudflareConfigApiTokenMax)
+        .describe("An API token with the Zone.DNS edit permission"),
+    zone_token: zod
+        .string()
+        .max(cloudflareConfigZoneTokenMax)
+        .optional()
+        .describe("Optional, and required only when api_token is scoped to a single zone, in which case it is used to enumerate zones"),
+})
+    .describe("Cloudflare credentials, created under My Profile then API Tokens");