@wtfalch/edge 0.15.1 → 0.17.0

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import { type ClientOptions } from './transport.js';
-import type { AccessProviderView, AccessReadinessResponse, AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AdoptZonesRequest, AdoptZonesResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformGateRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformServiceTokenRequest, CreatePlatformServiceTokenResponse, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, CreatePlatformZoneRequest, EnsureAccessProviderRequest, EnsurePlatformWorkerContainerRequest, EnsureRequestHeaderStripResponse, FindServiceTokenResponse, ListClaimsResponse, ListGatesResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListPlatformZonesRequest, ListPlatformZonesResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OneTimePinProviderView, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformGateView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerContainerView, PlatformWorkerRouteView, PlatformWorkerScriptView, PlatformZoneView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, RemovePlatformWorkerContainerResponse, RemovePlatformWorkerSecretResponse, ReplacePlatformGateHostnamesRequest, RequestHeaderStripRule, SetGatePeopleResponse, SetPlatformWorkerSchedulesRequest, SetPlatformWorkerSchedulesResponse, SetPlatformWorkerSecretsRequest, SetPlatformWorkerSecretsResponse, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest } from './types.js';
+import type { AccessProviderView, AccessReadinessResponse, AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AdoptZonesRequest, AdoptZonesResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformGateRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformServiceTokenRequest, CreatePlatformServiceTokenResponse, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, CreatePlatformZoneRequest, EnsureAccessProviderRequest, EnsureCaCertificateRequest, EnsureCaCertificateResponse, EnsurePlatformWorkerContainerRequest, EnsureRequestHeaderStripResponse, FindServiceTokenResponse, ListClaimsResponse, ListGatesResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListPlatformZonesRequest, ListPlatformZonesResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OneTimePinProviderView, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformGateView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerContainerView, PlatformWorkerRouteView, PlatformWorkerScriptView, PlatformZoneView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, RemovePlatformWorkerContainerResponse, RemovePlatformWorkerSecretResponse, ReplacePlatformGateHostnamesRequest, RequestHeaderStripRule, SetGatePeopleResponse, SetPlatformWorkerSchedulesRequest, SetPlatformWorkerSchedulesResponse, SetPlatformWorkerSecretsRequest, SetPlatformWorkerSecretsResponse, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest, UpsertHyperdriveRequest, UpsertHyperdriveResponse } from './types.js';
 export { EdgeApiError, type ClientOptions } from './transport.js';
 /** Called with an entry's key: the key carries its organisation and domain, so
  * no call names either. `setReservedLabels`, `mintKey` and `revokeKey` are
@@ -138,6 +138,26 @@ export declare function createEdgeClient(options: ClientOptions): {
              * Cloudflare, and anything nobody names is left alone. */
             adopt: (input: AdoptRateLimitRulesRequest) => Promise<AdoptRateLimitRulesResponse>;
         };
+        /** Hyperdrive configs whose origin is a private database behind a Cloudflare Tunnel and an Access service token. */
+        hyperdrive: {
+            /** Creates the config, or rewrites the one of that name, so the same call
+             * twice leaves one config and the same id. Needs the platform credential.
+             * The password and Access secret go to Cloudflare and are not stored,
+             * returned or audited. A failure halfway (the config written, the audit
+             * not) throws with the config live; repeat the call. Rejects with
+             * `conflict` (reason `upstream_rejected`) when Cloudflare refuses it for good. */
+            upsert: (input: UpsertHyperdriveRequest) => Promise<UpsertHyperdriveResponse>;
+            /** Deletes the config of that name. One already gone counts as deleted. */
+            delete: (name: string) => Promise<void>;
+        };
+        /** Private CA certificates that a Hyperdrive origin's TLS certificate is checked against. */
+        caCertificates: {
+            /** Uploads the CA under that name, or returns the id of the one already
+             * uploaded under it (its PEM is not compared or replaced). Needs the
+             * platform credential. Rejects with `conflict` (reason `upstream_rejected`)
+             * when Cloudflare refuses it for good. */
+            ensure: (input: EnsureCaCertificateRequest) => Promise<EnsureCaCertificateResponse>;
+        };
         /** Request-header Transform Rules in a zone. */
         requestHeaders: {
             /** Keeps one rule, named by `rule.description`, that removes `rule.headers`

package/dist/client.js

@@ -143,6 +143,26 @@ export function createEdgeClient(options) {
                  * Cloudflare, and anything nobody names is left alone. */
                 adopt: (input) => call('POST', '/v1/platform/ratelimits/adopt', input),
             },
+            /** Hyperdrive configs whose origin is a private database behind a Cloudflare Tunnel and an Access service token. */
+            hyperdrive: {
+                /** Creates the config, or rewrites the one of that name, so the same call
+                 * twice leaves one config and the same id. Needs the platform credential.
+                 * The password and Access secret go to Cloudflare and are not stored,
+                 * returned or audited. A failure halfway (the config written, the audit
+                 * not) throws with the config live; repeat the call. Rejects with
+                 * `conflict` (reason `upstream_rejected`) when Cloudflare refuses it for good. */
+                upsert: (input) => call('PUT', '/v1/platform/hyperdrive/configs', input),
+                /** Deletes the config of that name. One already gone counts as deleted. */
+                delete: (name) => call('DELETE', `/v1/platform/hyperdrive/configs/${encodeURIComponent(name)}`),
+            },
+            /** Private CA certificates that a Hyperdrive origin's TLS certificate is checked against. */
+            caCertificates: {
+                /** Uploads the CA under that name, or returns the id of the one already
+                 * uploaded under it (its PEM is not compared or replaced). Needs the
+                 * platform credential. Rejects with `conflict` (reason `upstream_rejected`)
+                 * when Cloudflare refuses it for good. */
+                ensure: (input) => call('PUT', '/v1/platform/ca-certificates', input),
+            },
             /** Request-header Transform Rules in a zone. */
             requestHeaders: {
                 /** Keeps one rule, named by `rule.description`, that removes `rule.headers`

package/dist/types.d.ts

@@ -540,8 +540,14 @@ export interface WorkerDurableObjectBinding {
     /** The exported class name. */
     class_name: string;
 }
+/** A Hyperdrive config bound to the script as `name`; `id` is the id `platform.hyperdrive.upsert` returned (32 hex digits). It lives only as long as an upload lists it: send it on every deploy. */
+export interface WorkerHyperdriveBinding {
+    type: 'hyperdrive';
+    name: string;
+    id: string;
+}
 /** Everything `uploadScript` accepts in `bindings`. Secrets are not here: see `setSecrets`. */
-export type WorkerBinding = WorkerRateLimitBinding | WorkerKvBinding | WorkerPlainTextBinding | WorkerDurableObjectBinding;
+export type WorkerBinding = WorkerRateLimitBinding | WorkerKvBinding | WorkerPlainTextBinding | WorkerDurableObjectBinding | WorkerHyperdriveBinding;
 /** A Durable Object migration applied with the upload. `oldTag` is the tag the
  * live script holds now (omit for a script with none): Cloudflare refuses the
  * upload when it is not. Send only the steps not yet applied. */
@@ -776,6 +782,34 @@ export interface EnsureRequestHeaderStripResponse {
     /** Cloudflare's rule id. */
     id: string;
 }
+/** A Hyperdrive config's origin: a private database reached over a Cloudflare Tunnel hostname with an Access service token. */
+export interface HyperdriveOrigin {
+    /** The tunnel's public hostname, lower case, with no scheme, port or path. */
+    host: string;
+    /** 1 to 63 printable characters. */
+    database: string;
+    /** 1 to 63 printable characters. */
+    user: string;
+    /** Goes to Cloudflare and is never stored, returned, audited or logged. */
+    password: string;
+    /** The Access service token's client id. */
+    accessClientId: string;
+    /** The Access service token's secret. Goes to Cloudflare and is never stored, returned, audited or logged. */
+    accessClientSecret: string;
+    /** How Hyperdrive checks the database's TLS certificate. Leave out for no check. */
+    sslmode?: 'verify-ca' | 'verify-full';
+    /** The id `platform.caCertificates.ensure` returned: the private CA that signed the database's certificate. A lower-case UUID. Needs `sslmode`. */
+    caCertificateId?: string;
+}
+export interface UpsertHyperdriveRequest {
+    /** Names the config: the key that makes a repeat safe. 1 to 63 letters, digits, dashes or underscores, starting with a letter or digit. */
+    name: string;
+    origin: HyperdriveOrigin;
+}
+export interface UpsertHyperdriveResponse {
+    /** Cloudflare's config id: what a `hyperdrive` Worker binding takes. */
+    id: string;
+}
 export interface AdoptRateLimitRuleEntry {
     zoneId: string;
     /** Match the live rule by description, by id, or both. At least one is needed. */
@@ -848,3 +882,13 @@ export interface AdoptZonesResponse {
     }>;
     notFound: AdoptZoneEntry[];
 }
+export interface EnsureCaCertificateRequest {
+    /** Names the certificate: the key that makes a repeat safe. 1 to 63 letters, digits, dashes or underscores, starting with a letter or digit. */
+    name: string;
+    /** Exactly one PEM `CERTIFICATE` block, at most 8192 characters. */
+    pem: string;
+}
+export interface EnsureCaCertificateResponse {
+    /** Cloudflare's certificate id: what `HyperdriveOrigin.caCertificateId` takes. */
+    id: string;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/edge",
-  "version": "0.15.1",
+  "version": "0.17.0",
   "type": "module",
   "license": "MIT",
   "description": "Public client SDK and API types for the edge service.",