@wtfalch/edge 0.11.0 → 0.13.0

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import { type ClientOptions } from './transport.js';
-import type { AccessProviderView, AccessReadinessResponse, AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AdoptZonesRequest, AdoptZonesResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformGateRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, CreatePlatformZoneRequest, EnsureAccessProviderRequest, FindServiceTokenResponse, ListClaimsResponse, ListGatesResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListPlatformZonesRequest, ListPlatformZonesResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformGateView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerRouteView, PlatformWorkerScriptView, PlatformZoneView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, ReplacePlatformGateHostnamesRequest, SetGatePeopleResponse, SetPlatformWorkerSchedulesRequest, SetPlatformWorkerSchedulesResponse, SetPlatformWorkerSecretsRequest, SetPlatformWorkerSecretsResponse, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest } from './types.js';
+import type { AccessProviderView, AccessReadinessResponse, AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AdoptZonesRequest, AdoptZonesResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformGateRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformServiceTokenRequest, CreatePlatformServiceTokenResponse, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, CreatePlatformZoneRequest, EnsureAccessProviderRequest, FindServiceTokenResponse, ListClaimsResponse, ListGatesResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListPlatformZonesRequest, ListPlatformZonesResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OneTimePinProviderView, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformGateView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerRouteView, PlatformWorkerScriptView, PlatformZoneView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, ReplacePlatformGateHostnamesRequest, SetGatePeopleResponse, SetPlatformWorkerSchedulesRequest, SetPlatformWorkerSchedulesResponse, SetPlatformWorkerSecretsRequest, SetPlatformWorkerSecretsResponse, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest } from './types.js';
 export { EdgeApiError, type ClientOptions } from './transport.js';
 /** Called with an entry's key: the key carries its organisation and domain, so
  * no call names either. `setReservedLabels`, `mintKey` and `revokeKey` are
@@ -90,6 +90,18 @@ export declare function createEdgeClient(options: ClientOptions): {
             /** A service token's id by exact name; `token` is `null` when none has
              * it. Read-only: the secret is never returned. */
             findServiceToken: (name: string) => Promise<FindServiceTokenResponse>;
+            /** Makes a service token that never expires and returns its client id
+             * and secret, once; edge keeps neither. Rejects with `conflict` when a token of that name
+             * exists at Cloudflare. After a lost reply the token exists but the
+             * secret is gone: `findServiceToken(name)`, `removeServiceToken(id)`,
+             * then create again. */
+            createServiceToken: (input: CreatePlatformServiceTokenRequest) => Promise<CreatePlatformServiceTokenResponse>;
+            /** Deletes a service token edge made; any other rejects with `not_found`.
+             * One already gone at Cloudflare counts as deleted. */
+            removeServiceToken: (id: string) => Promise<void>;
+            /** The account's one-time-PIN identity provider, made when none exists.
+             * Safe to repeat. Its `id` goes in `allowedIdps` of `create`. */
+            oneTimePinProvider: () => Promise<OneTimePinProviderView>;
             /** Writes platform rows for the live apps named. Nothing is deleted or
              * recreated, and an app nobody names is left alone. */
             adopt: (input: AdoptAccessAppsRequest) => Promise<AdoptAccessAppsResponse>;

package/dist/client.js

@@ -95,6 +95,18 @@ export function createEdgeClient(options) {
                 /** A service token's id by exact name; `token` is `null` when none has
                  * it. Read-only: the secret is never returned. */
                 findServiceToken: (name) => call('GET', `/v1/platform/access/service-tokens?${new URLSearchParams({ name })}`),
+                /** Makes a service token that never expires and returns its client id
+                 * and secret, once; edge keeps neither. Rejects with `conflict` when a token of that name
+                 * exists at Cloudflare. After a lost reply the token exists but the
+                 * secret is gone: `findServiceToken(name)`, `removeServiceToken(id)`,
+                 * then create again. */
+                createServiceToken: (input) => call('POST', '/v1/platform/access/service-tokens', input),
+                /** Deletes a service token edge made; any other rejects with `not_found`.
+                 * One already gone at Cloudflare counts as deleted. */
+                removeServiceToken: (id) => call('DELETE', `/v1/platform/access/service-tokens/${encodeURIComponent(id)}`),
+                /** The account's one-time-PIN identity provider, made when none exists.
+                 * Safe to repeat. Its `id` goes in `allowedIdps` of `create`. */
+                oneTimePinProvider: () => call('GET', '/v1/platform/access/identity-providers/one-time-pin'),
                 /** Writes platform rows for the live apps named. Nothing is deleted or
                  * recreated, and an app nobody names is left alone. */
                 adopt: (input) => call('POST', '/v1/platform/access/apps/adopt', input),

package/dist/types.d.ts

@@ -314,6 +314,10 @@ export interface PlatformAccessAppView {
     /** The company the app serves; `'platform'` when none. `null` for an app with no row. */
     organisationId: string | null;
     state: 'pending' | 'active' | 'removing' | 'removed';
+    /** The identity providers the app accepts, as Cloudflare reports them. `[]` means Cloudflare lists none (it accepts any). */
+    allowedIdps: string[];
+    /** Whether a visitor goes straight to the one provider, as Cloudflare reports it. */
+    autoRedirectToIdentity: boolean;
 }
 export interface ListPlatformAccessAppsRequest {
     /** Only the app on exactly this domain. */
@@ -327,13 +331,15 @@ export interface ListPlatformAccessAppsResponse {
 /** Creates the app, or returns the one edge already made for that domain and name. */
 export interface CreatePlatformAccessAppRequest {
     name: string;
-    /** A lower-case hostname, optionally with a leading `*.`. */
+    /** A lower-case hostname, optionally with a leading `*.`, optionally followed by a path (`/api/prices`; a segment may be `*`). */
     domain: string;
     /** Only `self_hosted` is supported (the default). */
     type?: 'self_hosted';
     /** Like `30m` or `24h`. */
     sessionDuration?: string;
     autoRedirectToIdentity?: boolean;
+    /** Identity provider ids (1 to 20) the app accepts and nothing else; for the one-time PIN alone, `[(await platform.access.oneTimePinProvider()).id]`. Omit to leave Cloudflare's default. */
+    allowedIdps?: string[];
     /** The company the app serves. Omit for an app that serves none. */
     organisationId?: string;
 }
@@ -376,6 +382,10 @@ export interface AccessProviderView {
     id: string;
     name: string;
 }
+/** The account's one-time-PIN identity provider: its id is what `allowedIdps` takes. */
+export interface OneTimePinProviderView {
+    id: string;
+}
 /** Whether the Cloudflare token holds every Access right gates need. A token that lacks one, or an organisation with no team address, rejects with `not_configured`, naming each missing right. */
 export interface AccessReadinessResponse {
     ready: true;
@@ -443,6 +453,18 @@ export interface FindServiceTokenResponse {
         name: string;
     } | null;
 }
+export interface CreatePlatformServiceTokenRequest {
+    name: string;
+}
+/** `clientId` and `clientSecret` are shown once, here. Edge keeps neither and cannot return them again. */
+export interface CreatePlatformServiceTokenResponse {
+    token: {
+        id: string;
+        name: string;
+    };
+    clientId: string;
+    clientSecret: string;
+}
 export interface AdoptAccessAppEntry {
     name: string;
     /** Narrows several apps of one name. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/edge",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "type": "module",
   "license": "MIT",
   "description": "Public client SDK and API types for the edge service.",