@wtfalch/edge 0.16.0 → 0.18.0

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import { type ClientOptions } from './transport.js';
-import type { AccessProviderView, AccessReadinessResponse, AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AdoptZonesRequest, AdoptZonesResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformGateRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformServiceTokenRequest, CreatePlatformServiceTokenResponse, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, CreatePlatformZoneRequest, EnsureAccessProviderRequest, EnsurePlatformWorkerContainerRequest, EnsureRequestHeaderStripResponse, FindServiceTokenResponse, ListClaimsResponse, ListGatesResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListPlatformZonesRequest, ListPlatformZonesResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OneTimePinProviderView, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformGateView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerContainerView, PlatformWorkerRouteView, PlatformWorkerScriptView, PlatformZoneView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, RemovePlatformWorkerContainerResponse, RemovePlatformWorkerSecretResponse, ReplacePlatformGateHostnamesRequest, RequestHeaderStripRule, SetGatePeopleResponse, SetPlatformWorkerSchedulesRequest, SetPlatformWorkerSchedulesResponse, SetPlatformWorkerSecretsRequest, SetPlatformWorkerSecretsResponse, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest, UpsertHyperdriveRequest, UpsertHyperdriveResponse } from './types.js';
+import type { AccessProviderView, AccessReadinessResponse, AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AdoptZonesRequest, AdoptZonesResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformGateRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformServiceTokenRequest, CreatePlatformServiceTokenResponse, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, CreatePlatformZoneRequest, EnsureAccessProviderRequest, EnsureCaCertificateRequest, EnsureCaCertificateResponse, EnsurePlatformWorkerContainerRequest, EnsureRequestHeaderStripResponse, FindServiceTokenResponse, ListClaimsResponse, ListGatesResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListPlatformZonesRequest, ListPlatformZonesResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OneTimePinProviderView, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformGateView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerContainerView, PlatformWorkerRouteView, PlatformWorkerScriptView, PlatformZoneView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, RemovePlatformWorkerContainerResponse, RemovePlatformWorkerSecretResponse, ReplacePlatformGateHostnamesRequest, RequestHeaderStripRule, SetGatePeopleResponse, SetPlatformWorkerSchedulesRequest, SetPlatformWorkerSchedulesResponse, SetPlatformWorkerSecretsRequest, SetPlatformWorkerSecretsResponse, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest, UpsertHyperdriveRequest, UpsertHyperdriveResponse } from './types.js';
 export { EdgeApiError, type ClientOptions } from './transport.js';
 /** Called with an entry's key: the key carries its organisation and domain, so
  * no call names either. `setReservedLabels`, `mintKey` and `revokeKey` are
@@ -150,6 +150,14 @@ export declare function createEdgeClient(options: ClientOptions): {
             /** Deletes the config of that name. One already gone counts as deleted. */
             delete: (name: string) => Promise<void>;
         };
+        /** Private CA certificates that a Hyperdrive origin's TLS certificate is checked against. */
+        caCertificates: {
+            /** Uploads the CA under that name, or returns the id of the one already
+             * uploaded under it (its PEM is not compared or replaced). Needs the
+             * platform credential. Rejects with `conflict` (reason `upstream_rejected`)
+             * when Cloudflare refuses it for good. */
+            ensure: (input: EnsureCaCertificateRequest) => Promise<EnsureCaCertificateResponse>;
+        };
         /** Request-header Transform Rules in a zone. */
         requestHeaders: {
             /** Keeps one rule, named by `rule.description`, that removes `rule.headers`

package/dist/client.js

@@ -155,6 +155,14 @@ export function createEdgeClient(options) {
                 /** Deletes the config of that name. One already gone counts as deleted. */
                 delete: (name) => call('DELETE', `/v1/platform/hyperdrive/configs/${encodeURIComponent(name)}`),
             },
+            /** Private CA certificates that a Hyperdrive origin's TLS certificate is checked against. */
+            caCertificates: {
+                /** Uploads the CA under that name, or returns the id of the one already
+                 * uploaded under it (its PEM is not compared or replaced). Needs the
+                 * platform credential. Rejects with `conflict` (reason `upstream_rejected`)
+                 * when Cloudflare refuses it for good. */
+                ensure: (input) => call('PUT', '/v1/platform/ca-certificates', input),
+            },
             /** Request-header Transform Rules in a zone. */
             requestHeaders: {
                 /** Keeps one rule, named by `rule.description`, that removes `rule.headers`

package/dist/types.d.ts

@@ -579,6 +579,8 @@ export interface UploadPlatformWorkerScriptRequest {
     compatibilityFlags?: string[];
     /** Durable Object migrations to apply with this upload. */
     migrations?: WorkerMigrations;
+    /** Durable Object class names to mark container-enabled, so Cloudflare accepts a container application for them. Each must be a `durable_object_namespace` binding class or a class `migrations` creates in this upload. Omit or leave empty for none. */
+    containers?: string[];
     /** The company the script serves. Omit for a script that serves none. */
     organisationId?: string;
 }
@@ -796,6 +798,10 @@ export interface HyperdriveOrigin {
     accessClientId: string;
     /** The Access service token's secret. Goes to Cloudflare and is never stored, returned, audited or logged. */
     accessClientSecret: string;
+    /** How Hyperdrive checks the database's TLS certificate. Leave out for no check. */
+    sslmode?: 'verify-ca' | 'verify-full';
+    /** The id `platform.caCertificates.ensure` returned: the private CA that signed the database's certificate. A lower-case UUID. Needs `sslmode`. */
+    caCertificateId?: string;
 }
 export interface UpsertHyperdriveRequest {
     /** Names the config: the key that makes a repeat safe. 1 to 63 letters, digits, dashes or underscores, starting with a letter or digit. */
@@ -878,3 +884,13 @@ export interface AdoptZonesResponse {
     }>;
     notFound: AdoptZoneEntry[];
 }
+export interface EnsureCaCertificateRequest {
+    /** Names the certificate: the key that makes a repeat safe. 1 to 63 letters, digits, dashes or underscores, starting with a letter or digit. */
+    name: string;
+    /** Exactly one PEM `CERTIFICATE` block, at most 8192 characters. */
+    pem: string;
+}
+export interface EnsureCaCertificateResponse {
+    /** Cloudflare's certificate id: what `HyperdriveOrigin.caCertificateId` takes. */
+    id: string;
+}

package/dist/worker-app-port.d.ts

@@ -12,6 +12,8 @@ export interface WorkerAppUploadInput {
     compatibilityFlags: string[];
     bindings: WorkerBinding[];
     migrations?: WorkerMigrations;
+    /** Durable Object class names to mark container-enabled with the upload. */
+    containers?: string[];
 }
 export interface WorkerAppContainerInput {
     className: string;

package/dist/worker-app-port.js

@@ -247,6 +247,7 @@ export function createWorkerAppPort(workers, options) {
                     : {}),
                 bindings: input.bindings,
                 ...(input.migrations ? { migrations: input.migrations } : {}),
+                ...(input.containers?.length ? { containers: input.containers } : {}),
             });
         },
         async liveMigrationTag(name) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/edge",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "type": "module",
   "license": "MIT",
   "description": "Public client SDK and API types for the edge service.",