@wtfalch/edge 0.12.0 → 0.13.0

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import { type ClientOptions } from './transport.js';
-import type { AccessProviderView, AccessReadinessResponse, AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AdoptZonesRequest, AdoptZonesResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformGateRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformServiceTokenRequest, CreatePlatformServiceTokenResponse, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, CreatePlatformZoneRequest, EnsureAccessProviderRequest, FindServiceTokenResponse, ListClaimsResponse, ListGatesResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListPlatformZonesRequest, ListPlatformZonesResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformGateView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerRouteView, PlatformWorkerScriptView, PlatformZoneView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, ReplacePlatformGateHostnamesRequest, SetGatePeopleResponse, SetPlatformWorkerSchedulesRequest, SetPlatformWorkerSchedulesResponse, SetPlatformWorkerSecretsRequest, SetPlatformWorkerSecretsResponse, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest } from './types.js';
+import type { AccessProviderView, AccessReadinessResponse, AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AdoptZonesRequest, AdoptZonesResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformGateRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformServiceTokenRequest, CreatePlatformServiceTokenResponse, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, CreatePlatformZoneRequest, EnsureAccessProviderRequest, FindServiceTokenResponse, ListClaimsResponse, ListGatesResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListPlatformZonesRequest, ListPlatformZonesResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OneTimePinProviderView, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformGateView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerRouteView, PlatformWorkerScriptView, PlatformZoneView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, ReplacePlatformGateHostnamesRequest, SetGatePeopleResponse, SetPlatformWorkerSchedulesRequest, SetPlatformWorkerSchedulesResponse, SetPlatformWorkerSecretsRequest, SetPlatformWorkerSecretsResponse, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest } from './types.js';
 export { EdgeApiError, type ClientOptions } from './transport.js';
 /** Called with an entry's key: the key carries its organisation and domain, so
  * no call names either. `setReservedLabels`, `mintKey` and `revokeKey` are
@@ -99,6 +99,9 @@ export declare function createEdgeClient(options: ClientOptions): {
             /** Deletes a service token edge made; any other rejects with `not_found`.
              * One already gone at Cloudflare counts as deleted. */
             removeServiceToken: (id: string) => Promise<void>;
+            /** The account's one-time-PIN identity provider, made when none exists.
+             * Safe to repeat. Its `id` goes in `allowedIdps` of `create`. */
+            oneTimePinProvider: () => Promise<OneTimePinProviderView>;
             /** Writes platform rows for the live apps named. Nothing is deleted or
              * recreated, and an app nobody names is left alone. */
             adopt: (input: AdoptAccessAppsRequest) => Promise<AdoptAccessAppsResponse>;

package/dist/client.js

@@ -104,6 +104,9 @@ export function createEdgeClient(options) {
                 /** Deletes a service token edge made; any other rejects with `not_found`.
                  * One already gone at Cloudflare counts as deleted. */
                 removeServiceToken: (id) => call('DELETE', `/v1/platform/access/service-tokens/${encodeURIComponent(id)}`),
+                /** The account's one-time-PIN identity provider, made when none exists.
+                 * Safe to repeat. Its `id` goes in `allowedIdps` of `create`. */
+                oneTimePinProvider: () => call('GET', '/v1/platform/access/identity-providers/one-time-pin'),
                 /** Writes platform rows for the live apps named. Nothing is deleted or
                  * recreated, and an app nobody names is left alone. */
                 adopt: (input) => call('POST', '/v1/platform/access/apps/adopt', input),

package/dist/types.d.ts

@@ -314,6 +314,10 @@ export interface PlatformAccessAppView {
     /** The company the app serves; `'platform'` when none. `null` for an app with no row. */
     organisationId: string | null;
     state: 'pending' | 'active' | 'removing' | 'removed';
+    /** The identity providers the app accepts, as Cloudflare reports them. `[]` means Cloudflare lists none (it accepts any). */
+    allowedIdps: string[];
+    /** Whether a visitor goes straight to the one provider, as Cloudflare reports it. */
+    autoRedirectToIdentity: boolean;
 }
 export interface ListPlatformAccessAppsRequest {
     /** Only the app on exactly this domain. */
@@ -327,13 +331,15 @@ export interface ListPlatformAccessAppsResponse {
 /** Creates the app, or returns the one edge already made for that domain and name. */
 export interface CreatePlatformAccessAppRequest {
     name: string;
-    /** A lower-case hostname, optionally with a leading `*.`. */
+    /** A lower-case hostname, optionally with a leading `*.`, optionally followed by a path (`/api/prices`; a segment may be `*`). */
     domain: string;
     /** Only `self_hosted` is supported (the default). */
     type?: 'self_hosted';
     /** Like `30m` or `24h`. */
     sessionDuration?: string;
     autoRedirectToIdentity?: boolean;
+    /** Identity provider ids (1 to 20) the app accepts and nothing else; for the one-time PIN alone, `[(await platform.access.oneTimePinProvider()).id]`. Omit to leave Cloudflare's default. */
+    allowedIdps?: string[];
     /** The company the app serves. Omit for an app that serves none. */
     organisationId?: string;
 }
@@ -376,6 +382,10 @@ export interface AccessProviderView {
     id: string;
     name: string;
 }
+/** The account's one-time-PIN identity provider: its id is what `allowedIdps` takes. */
+export interface OneTimePinProviderView {
+    id: string;
+}
 /** Whether the Cloudflare token holds every Access right gates need. A token that lacks one, or an organisation with no team address, rejects with `not_configured`, naming each missing right. */
 export interface AccessReadinessResponse {
     ready: true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/edge",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "type": "module",
   "license": "MIT",
   "description": "Public client SDK and API types for the edge service.",