@wtfalch/edge 0.12.0 → 0.14.0

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import { type ClientOptions } from './transport.js';
-import type { AccessProviderView, AccessReadinessResponse, AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AdoptZonesRequest, AdoptZonesResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformGateRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformServiceTokenRequest, CreatePlatformServiceTokenResponse, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, CreatePlatformZoneRequest, EnsureAccessProviderRequest, FindServiceTokenResponse, ListClaimsResponse, ListGatesResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListPlatformZonesRequest, ListPlatformZonesResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformGateView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerRouteView, PlatformWorkerScriptView, PlatformZoneView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, ReplacePlatformGateHostnamesRequest, SetGatePeopleResponse, SetPlatformWorkerSchedulesRequest, SetPlatformWorkerSchedulesResponse, SetPlatformWorkerSecretsRequest, SetPlatformWorkerSecretsResponse, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest } from './types.js';
+import type { AccessProviderView, AccessReadinessResponse, AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AdoptZonesRequest, AdoptZonesResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformGateRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformServiceTokenRequest, CreatePlatformServiceTokenResponse, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, CreatePlatformZoneRequest, EnsureAccessProviderRequest, EnsureRequestHeaderStripResponse, FindServiceTokenResponse, ListClaimsResponse, ListGatesResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListPlatformZonesRequest, ListPlatformZonesResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OneTimePinProviderView, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformGateView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerRouteView, PlatformWorkerScriptView, PlatformZoneView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, ReplacePlatformGateHostnamesRequest, RequestHeaderStripRule, SetGatePeopleResponse, SetPlatformWorkerSchedulesRequest, SetPlatformWorkerSchedulesResponse, SetPlatformWorkerSecretsRequest, SetPlatformWorkerSecretsResponse, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest } from './types.js';
 export { EdgeApiError, type ClientOptions } from './transport.js';
 /** Called with an entry's key: the key carries its organisation and domain, so
  * no call names either. `setReservedLabels`, `mintKey` and `revokeKey` are
@@ -99,6 +99,9 @@ export declare function createEdgeClient(options: ClientOptions): {
             /** Deletes a service token edge made; any other rejects with `not_found`.
              * One already gone at Cloudflare counts as deleted. */
             removeServiceToken: (id: string) => Promise<void>;
+            /** The account's one-time-PIN identity provider, made when none exists.
+             * Safe to repeat. Its `id` goes in `allowedIdps` of `create`. */
+            oneTimePinProvider: () => Promise<OneTimePinProviderView>;
             /** Writes platform rows for the live apps named. Nothing is deleted or
              * recreated, and an app nobody names is left alone. */
             adopt: (input: AdoptAccessAppsRequest) => Promise<AdoptAccessAppsResponse>;
@@ -135,6 +138,16 @@ export declare function createEdgeClient(options: ClientOptions): {
              * Cloudflare, and anything nobody names is left alone. */
             adopt: (input: AdoptRateLimitRulesRequest) => Promise<AdoptRateLimitRulesResponse>;
         };
+        /** Request-header Transform Rules in a zone. */
+        requestHeaders: {
+            /** Keeps one rule, named by `rule.description`, that removes `rule.headers`
+             * from requests matching `rule.expression` (the zone's
+             * `http_request_late_transform` phase). Creates the rule, or rewrites it
+             * when it exists; no other rule in the zone changes. Safe to repeat. Needs
+             * the platform credential. Rejects with `conflict` (reason
+             * `upstream_rejected`) when Cloudflare refuses the rule for good. */
+            ensureRequestHeaderStrip: (zoneId: string, rule: RequestHeaderStripRule) => Promise<EnsureRequestHeaderStripResponse>;
+        };
         /** Cloudflare zones the platform made or adopted. A zone is the root of a
          * company's domain, so there is no delete. A zone's `id` is Cloudflare's zone id. */
         zones: {

package/dist/client.js

@@ -104,6 +104,9 @@ export function createEdgeClient(options) {
                 /** Deletes a service token edge made; any other rejects with `not_found`.
                  * One already gone at Cloudflare counts as deleted. */
                 removeServiceToken: (id) => call('DELETE', `/v1/platform/access/service-tokens/${encodeURIComponent(id)}`),
+                /** The account's one-time-PIN identity provider, made when none exists.
+                 * Safe to repeat. Its `id` goes in `allowedIdps` of `create`. */
+                oneTimePinProvider: () => call('GET', '/v1/platform/access/identity-providers/one-time-pin'),
                 /** Writes platform rows for the live apps named. Nothing is deleted or
                  * recreated, and an app nobody names is left alone. */
                 adopt: (input) => call('POST', '/v1/platform/access/apps/adopt', input),
@@ -140,6 +143,21 @@ export function createEdgeClient(options) {
                  * Cloudflare, and anything nobody names is left alone. */
                 adopt: (input) => call('POST', '/v1/platform/ratelimits/adopt', input),
             },
+            /** Request-header Transform Rules in a zone. */
+            requestHeaders: {
+                /** Keeps one rule, named by `rule.description`, that removes `rule.headers`
+                 * from requests matching `rule.expression` (the zone's
+                 * `http_request_late_transform` phase). Creates the rule, or rewrites it
+                 * when it exists; no other rule in the zone changes. Safe to repeat. Needs
+                 * the platform credential. Rejects with `conflict` (reason
+                 * `upstream_rejected`) when Cloudflare refuses the rule for good. */
+                ensureRequestHeaderStrip: (zoneId, rule) => call('PUT', '/v1/platform/transforms/request-headers', {
+                    zoneId,
+                    description: rule.description,
+                    expression: rule.expression,
+                    headers: rule.headers,
+                }),
+            },
             /** Cloudflare zones the platform made or adopted. A zone is the root of a
              * company's domain, so there is no delete. A zone's `id` is Cloudflare's zone id. */
             zones: {

package/dist/types.d.ts

@@ -314,6 +314,10 @@ export interface PlatformAccessAppView {
     /** The company the app serves; `'platform'` when none. `null` for an app with no row. */
     organisationId: string | null;
     state: 'pending' | 'active' | 'removing' | 'removed';
+    /** The identity providers the app accepts, as Cloudflare reports them. `[]` means Cloudflare lists none (it accepts any). */
+    allowedIdps: string[];
+    /** Whether a visitor goes straight to the one provider, as Cloudflare reports it. */
+    autoRedirectToIdentity: boolean;
 }
 export interface ListPlatformAccessAppsRequest {
     /** Only the app on exactly this domain. */
@@ -327,13 +331,15 @@ export interface ListPlatformAccessAppsResponse {
 /** Creates the app, or returns the one edge already made for that domain and name. */
 export interface CreatePlatformAccessAppRequest {
     name: string;
-    /** A lower-case hostname, optionally with a leading `*.`. */
+    /** A lower-case hostname, optionally with a leading `*.`, optionally followed by a path (`/api/prices`; a segment may be `*`). */
     domain: string;
     /** Only `self_hosted` is supported (the default). */
     type?: 'self_hosted';
     /** Like `30m` or `24h`. */
     sessionDuration?: string;
     autoRedirectToIdentity?: boolean;
+    /** Identity provider ids (1 to 20) the app accepts and nothing else; for the one-time PIN alone, `[(await platform.access.oneTimePinProvider()).id]`. Omit to leave Cloudflare's default. */
+    allowedIdps?: string[];
     /** The company the app serves. Omit for an app that serves none. */
     organisationId?: string;
 }
@@ -376,6 +382,10 @@ export interface AccessProviderView {
     id: string;
     name: string;
 }
+/** The account's one-time-PIN identity provider: its id is what `allowedIdps` takes. */
+export interface OneTimePinProviderView {
+    id: string;
+}
 /** Whether the Cloudflare token holds every Access right gates need. A token that lacks one, or an organisation with no team address, rejects with `not_configured`, naming each missing right. */
 export interface AccessReadinessResponse {
     ready: true;
@@ -688,6 +698,19 @@ export interface CreatePlatformRateLimitRuleRequest {
     /** The company the rule serves. Omit for a rule that serves none. */
     organisationId?: string;
 }
+/** A rule that removes request headers from every request its expression matches. */
+export interface RequestHeaderStripRule {
+    /** Names the rule in the zone: the key that makes a repeat safe. 1 to 500 printable characters. */
+    description: string;
+    /** Cloudflare's rule expression, 1 to 4096 printable characters. */
+    expression: string;
+    /** 1 to 20 header names of letters, digits and hyphens. */
+    headers: readonly string[];
+}
+export interface EnsureRequestHeaderStripResponse {
+    /** Cloudflare's rule id. */
+    id: string;
+}
 export interface AdoptRateLimitRuleEntry {
     zoneId: string;
     /** Match the live rule by description, by id, or both. At least one is needed. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/edge",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "type": "module",
   "license": "MIT",
   "description": "Public client SDK and API types for the edge service.",