@wtfalch/edge 0.16.0 → 0.17.0

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import { type ClientOptions } from './transport.js';
-import type { AccessProviderView, AccessReadinessResponse, AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AdoptZonesRequest, AdoptZonesResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformGateRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformServiceTokenRequest, CreatePlatformServiceTokenResponse, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, CreatePlatformZoneRequest, EnsureAccessProviderRequest, EnsurePlatformWorkerContainerRequest, EnsureRequestHeaderStripResponse, FindServiceTokenResponse, ListClaimsResponse, ListGatesResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListPlatformZonesRequest, ListPlatformZonesResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OneTimePinProviderView, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformGateView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerContainerView, PlatformWorkerRouteView, PlatformWorkerScriptView, PlatformZoneView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, RemovePlatformWorkerContainerResponse, RemovePlatformWorkerSecretResponse, ReplacePlatformGateHostnamesRequest, RequestHeaderStripRule, SetGatePeopleResponse, SetPlatformWorkerSchedulesRequest, SetPlatformWorkerSchedulesResponse, SetPlatformWorkerSecretsRequest, SetPlatformWorkerSecretsResponse, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest, UpsertHyperdriveRequest, UpsertHyperdriveResponse } from './types.js';
+import type { AccessProviderView, AccessReadinessResponse, AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AdoptZonesRequest, AdoptZonesResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformGateRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformServiceTokenRequest, CreatePlatformServiceTokenResponse, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, CreatePlatformZoneRequest, EnsureAccessProviderRequest, EnsureCaCertificateRequest, EnsureCaCertificateResponse, EnsurePlatformWorkerContainerRequest, EnsureRequestHeaderStripResponse, FindServiceTokenResponse, ListClaimsResponse, ListGatesResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListPlatformZonesRequest, ListPlatformZonesResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OneTimePinProviderView, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformGateView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerContainerView, PlatformWorkerRouteView, PlatformWorkerScriptView, PlatformZoneView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, RemovePlatformWorkerContainerResponse, RemovePlatformWorkerSecretResponse, ReplacePlatformGateHostnamesRequest, RequestHeaderStripRule, SetGatePeopleResponse, SetPlatformWorkerSchedulesRequest, SetPlatformWorkerSchedulesResponse, SetPlatformWorkerSecretsRequest, SetPlatformWorkerSecretsResponse, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest, UpsertHyperdriveRequest, UpsertHyperdriveResponse } from './types.js';
 export { EdgeApiError, type ClientOptions } from './transport.js';
 /** Called with an entry's key: the key carries its organisation and domain, so
  * no call names either. `setReservedLabels`, `mintKey` and `revokeKey` are
@@ -150,6 +150,14 @@ export declare function createEdgeClient(options: ClientOptions): {
             /** Deletes the config of that name. One already gone counts as deleted. */
             delete: (name: string) => Promise<void>;
         };
+        /** Private CA certificates that a Hyperdrive origin's TLS certificate is checked against. */
+        caCertificates: {
+            /** Uploads the CA under that name, or returns the id of the one already
+             * uploaded under it (its PEM is not compared or replaced). Needs the
+             * platform credential. Rejects with `conflict` (reason `upstream_rejected`)
+             * when Cloudflare refuses it for good. */
+            ensure: (input: EnsureCaCertificateRequest) => Promise<EnsureCaCertificateResponse>;
+        };
         /** Request-header Transform Rules in a zone. */
         requestHeaders: {
             /** Keeps one rule, named by `rule.description`, that removes `rule.headers`

package/dist/client.js

@@ -155,6 +155,14 @@ export function createEdgeClient(options) {
                 /** Deletes the config of that name. One already gone counts as deleted. */
                 delete: (name) => call('DELETE', `/v1/platform/hyperdrive/configs/${encodeURIComponent(name)}`),
             },
+            /** Private CA certificates that a Hyperdrive origin's TLS certificate is checked against. */
+            caCertificates: {
+                /** Uploads the CA under that name, or returns the id of the one already
+                 * uploaded under it (its PEM is not compared or replaced). Needs the
+                 * platform credential. Rejects with `conflict` (reason `upstream_rejected`)
+                 * when Cloudflare refuses it for good. */
+                ensure: (input) => call('PUT', '/v1/platform/ca-certificates', input),
+            },
             /** Request-header Transform Rules in a zone. */
             requestHeaders: {
                 /** Keeps one rule, named by `rule.description`, that removes `rule.headers`

package/dist/types.d.ts

@@ -796,6 +796,10 @@ export interface HyperdriveOrigin {
     accessClientId: string;
     /** The Access service token's secret. Goes to Cloudflare and is never stored, returned, audited or logged. */
     accessClientSecret: string;
+    /** How Hyperdrive checks the database's TLS certificate. Leave out for no check. */
+    sslmode?: 'verify-ca' | 'verify-full';
+    /** The id `platform.caCertificates.ensure` returned: the private CA that signed the database's certificate. A lower-case UUID. Needs `sslmode`. */
+    caCertificateId?: string;
 }
 export interface UpsertHyperdriveRequest {
     /** Names the config: the key that makes a repeat safe. 1 to 63 letters, digits, dashes or underscores, starting with a letter or digit. */
@@ -878,3 +882,13 @@ export interface AdoptZonesResponse {
     }>;
     notFound: AdoptZoneEntry[];
 }
+export interface EnsureCaCertificateRequest {
+    /** Names the certificate: the key that makes a repeat safe. 1 to 63 letters, digits, dashes or underscores, starting with a letter or digit. */
+    name: string;
+    /** Exactly one PEM `CERTIFICATE` block, at most 8192 characters. */
+    pem: string;
+}
+export interface EnsureCaCertificateResponse {
+    /** Cloudflare's certificate id: what `HyperdriveOrigin.caCertificateId` takes. */
+    id: string;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/edge",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "type": "module",
   "license": "MIT",
   "description": "Public client SDK and API types for the edge service.",