@wtfalch/edge 0.6.0 → 0.8.0

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import { type ClientOptions } from './transport.js';
-import type { AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformRecordRequest, CreatePlatformTunnelRequest, FindServiceTokenResponse, ListClaimsResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformRecordView, PlatformTunnelView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, TokenResponse, UpdatePlatformRecordRequest } from './types.js';
+import type { AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, FindServiceTokenResponse, ListClaimsResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerRouteView, PlatformWorkerScriptView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest } from './types.js';
 export { EdgeApiError, type ClientOptions } from './transport.js';
 /** Called with an entry's key: the key carries its organisation and domain, so
  * no call names either. `setReservedLabels`, `mintKey` and `revokeKey` are
@@ -85,6 +85,53 @@ export declare function createEdgeClient(options: ClientOptions): {
              * recreated, and an app nobody names is left alone. */
             adopt: (input: AdoptAccessAppsRequest) => Promise<AdoptAccessAppsResponse>;
         };
+        /** Cloudflare rate limiting rules the platform owns. A zone's rules share
+         * one ruleset, so each rule is owned on its own; a rule's `id` is
+         * Cloudflare's rule id. */
+        ratelimits: {
+            /** Every live rule in the zone with its owner (`null`: no row), optionally only one description. */
+            list: (filter: ListPlatformRateLimitRulesRequest) => Promise<ListPlatformRateLimitRulesResponse>;
+            /** Creates the rule, or returns the one edge already made for that zone
+             * and description (201 when new, 200 after). Rejects with `conflict` when
+             * a live rule with that description exists that nobody adopted (adopt it
+             * instead, reason `exists`) or another create of it is in progress
+             * (reason `busy`), and with `conflict` (reason `upstream_rejected`) when Cloudflare
+             * refuses the rule for good. */
+            create: (input: CreatePlatformRateLimitRuleRequest) => Promise<PlatformRateLimitRuleView>;
+            /** Deletes that one rule; returns the tombstone. Repeating it rejects with `not_found`. */
+            remove: (zoneId: string, id: string) => Promise<PlatformRateLimitRuleView>;
+            /** Writes platform rows for the rules named. Nothing is changed at
+             * Cloudflare, and anything nobody names is left alone. */
+            adopt: (input: AdoptRateLimitRulesRequest) => Promise<AdoptRateLimitRulesResponse>;
+        };
+        /** Cloudflare Workers scripts and routes the platform owns. A script's
+         * `id` is its name; a route's `id` is Cloudflare's route id. */
+        workers: {
+            /** Every live script with its owner (`null`: no row), optionally only the one named `name`. */
+            listScripts: (filter?: {
+                name?: string;
+            }) => Promise<ListPlatformWorkerScriptsResponse>;
+            /** Uploads the script (base64, at most 10 MB), or redeploys the one edge
+             * already owns (201 on the first upload, 200 after). Rejects with
+             * `conflict` when a live script of that name exists that nobody adopted
+             * (adopt it instead) or another upload of the name is in progress, and
+             * with `invalid_request` when the script is not base64 or its sha256
+             * differs from `artifactSha256`. */
+            uploadScript: (name: string, input: UploadPlatformWorkerScriptRequest) => Promise<PlatformWorkerScriptView>;
+            /** Deletes the script; returns the tombstone. Repeating it rejects with `not_found`. */
+            removeScript: (name: string) => Promise<PlatformWorkerScriptView>;
+            /** Every live route in the zone with its owner (`null`: no row), optionally only one pattern. */
+            listRoutes: (filter: ListPlatformWorkerRoutesRequest) => Promise<ListPlatformWorkerRoutesResponse>;
+            /** Creates the route, or returns the one edge already made for that
+             * zone, pattern and script. Rejects with `conflict` when a live route
+             * holds the pattern that nobody adopted (adopt it instead). */
+            createRoute: (input: CreatePlatformWorkerRouteRequest) => Promise<PlatformWorkerRouteView>;
+            /** Deletes the route in `zoneId`; returns the tombstone. Repeating it rejects with `not_found`. */
+            removeRoute: (zoneId: string, id: string) => Promise<PlatformWorkerRouteView>;
+            /** Writes platform rows for the scripts and routes named. Nothing is
+             * deleted or recreated, and anything nobody names is left alone. */
+            adopt: (input: AdoptWorkersRequest) => Promise<AdoptWorkersResponse>;
+        };
     };
     /** True when the name is free: not reserved, no record in the zone, not claimed. */
     available: (name: string) => Promise<AvailableResponse>;

package/dist/client.js

@@ -88,6 +88,51 @@ export function createEdgeClient(options) {
                  * recreated, and an app nobody names is left alone. */
                 adopt: (input) => call('POST', '/v1/platform/access/apps/adopt', input),
             },
+            /** Cloudflare rate limiting rules the platform owns. A zone's rules share
+             * one ruleset, so each rule is owned on its own; a rule's `id` is
+             * Cloudflare's rule id. */
+            ratelimits: {
+                /** Every live rule in the zone with its owner (`null`: no row), optionally only one description. */
+                list: (filter) => call('GET', `/v1/platform/ratelimits/rules?${new URLSearchParams(Object.entries(filter).filter((entry) => entry[1] !== undefined))}`),
+                /** Creates the rule, or returns the one edge already made for that zone
+                 * and description (201 when new, 200 after). Rejects with `conflict` when
+                 * a live rule with that description exists that nobody adopted (adopt it
+                 * instead, reason `exists`) or another create of it is in progress
+                 * (reason `busy`), and with `conflict` (reason `upstream_rejected`) when Cloudflare
+                 * refuses the rule for good. */
+                create: (input) => call('POST', '/v1/platform/ratelimits/rules', input),
+                /** Deletes that one rule; returns the tombstone. Repeating it rejects with `not_found`. */
+                remove: (zoneId, id) => call('DELETE', `/v1/platform/ratelimits/rules/${encodeURIComponent(id)}?${new URLSearchParams({ zoneId })}`),
+                /** Writes platform rows for the rules named. Nothing is changed at
+                 * Cloudflare, and anything nobody names is left alone. */
+                adopt: (input) => call('POST', '/v1/platform/ratelimits/adopt', input),
+            },
+            /** Cloudflare Workers scripts and routes the platform owns. A script's
+             * `id` is its name; a route's `id` is Cloudflare's route id. */
+            workers: {
+                /** Every live script with its owner (`null`: no row), optionally only the one named `name`. */
+                listScripts: (filter = {}) => call('GET', `/v1/platform/workers/scripts${filter.name === undefined ? '' : `?${new URLSearchParams({ name: filter.name })}`}`),
+                /** Uploads the script (base64, at most 10 MB), or redeploys the one edge
+                 * already owns (201 on the first upload, 200 after). Rejects with
+                 * `conflict` when a live script of that name exists that nobody adopted
+                 * (adopt it instead) or another upload of the name is in progress, and
+                 * with `invalid_request` when the script is not base64 or its sha256
+                 * differs from `artifactSha256`. */
+                uploadScript: (name, input) => call('PUT', `/v1/platform/workers/scripts/${encodeURIComponent(name)}`, input),
+                /** Deletes the script; returns the tombstone. Repeating it rejects with `not_found`. */
+                removeScript: (name) => call('DELETE', `/v1/platform/workers/scripts/${encodeURIComponent(name)}`),
+                /** Every live route in the zone with its owner (`null`: no row), optionally only one pattern. */
+                listRoutes: (filter) => call('GET', `/v1/platform/workers/routes?${new URLSearchParams(Object.entries(filter).filter((entry) => entry[1] !== undefined))}`),
+                /** Creates the route, or returns the one edge already made for that
+                 * zone, pattern and script. Rejects with `conflict` when a live route
+                 * holds the pattern that nobody adopted (adopt it instead). */
+                createRoute: (input) => call('POST', '/v1/platform/workers/routes', input),
+                /** Deletes the route in `zoneId`; returns the tombstone. Repeating it rejects with `not_found`. */
+                removeRoute: (zoneId, id) => call('DELETE', `/v1/platform/workers/routes/${encodeURIComponent(id)}?${new URLSearchParams({ zoneId })}`),
+                /** Writes platform rows for the scripts and routes named. Nothing is
+                 * deleted or recreated, and anything nobody names is left alone. */
+                adopt: (input) => call('POST', '/v1/platform/workers/adopt', input),
+            },
         },
         /** True when the name is free: not reserved, no record in the zone, not claimed. */
         available: (name) => call('GET', `/v1/names/available?${new URLSearchParams({ name })}`),

package/dist/types.d.ts

@@ -392,3 +392,178 @@ export interface AdoptAccessAppsResponse {
     /** Live apps no entry named. Reported, never touched. */
     unclaimed: PlatformAccessAppView[];
 }
+/** A Workers script seen with the platform credential. `id` is the script's
+ * name, which every platform script call takes. */
+export interface PlatformWorkerScriptView {
+    id: string;
+    name: string;
+    /** Who owns it: the platform, or `null` when no row exists (a live script
+     * nobody adopted: reported, never touched). */
+    owner: 'platform' | null;
+    /** The company the script serves; `'platform'` when none. `null` for a script with no row. */
+    organisationId: string | null;
+    state: 'pending' | 'active' | 'removing' | 'removed';
+}
+export interface ListPlatformWorkerScriptsResponse {
+    scripts: PlatformWorkerScriptView[];
+}
+/** One rate limiting binding, Cloudflare's own shape. */
+export interface WorkerRateLimitBinding {
+    type: 'ratelimit';
+    name: string;
+    namespace_id: string;
+    simple: {
+        limit: number;
+        period: number;
+    };
+}
+/** Uploads (or redeploys) a script. Edge fetches nothing: the caller sends the
+ * script, edge checks its size and sha256, and sends it to Cloudflare. The body
+ * is never stored or returned. */
+export interface UploadPlatformWorkerScriptRequest {
+    /** The script (one ES module) as base64 text, at most 10 MB decoded. */
+    script: string;
+    /** The script's sha256, 64 hex characters. A script with another digest is refused with `invalid_request`. */
+    artifactSha256: string;
+    /** Like `2026-10-01`. */
+    compatibilityDate: string;
+    bindings?: WorkerRateLimitBinding[];
+    /** The company the script serves. Omit for a script that serves none. */
+    organisationId?: string;
+}
+/** A Workers route seen with the platform credential. `id` is Cloudflare's
+ * route id, which every platform route call takes. */
+export interface PlatformWorkerRouteView {
+    id: string;
+    zoneId: string;
+    pattern: string;
+    /** The script it runs, or `null` for the "no Worker" route. */
+    script: string | null;
+    /** Who owns it: the platform, or `null` when no row exists. */
+    owner: 'platform' | null;
+    /** The company the route serves; `'platform'` when none. `null` for a route with no row. */
+    organisationId: string | null;
+    state: 'pending' | 'active' | 'removing' | 'removed';
+}
+export interface ListPlatformWorkerRoutesRequest {
+    zoneId: string;
+    /** Only the route on exactly this pattern. */
+    pattern?: string;
+}
+export interface ListPlatformWorkerRoutesResponse {
+    routes: PlatformWorkerRouteView[];
+}
+/** Creates the route, or returns the one edge already made for that zone,
+ * pattern and script. With no `script` it makes Cloudflare's "no Worker"
+ * route, which turns Workers off for the pattern. */
+export interface CreatePlatformWorkerRouteRequest {
+    zoneId: string;
+    pattern: string;
+    script?: string;
+    /** The company the route serves. Omit for a route that serves none. */
+    organisationId?: string;
+}
+export interface AdoptWorkerScriptEntry {
+    name: string;
+}
+export interface AdoptWorkerRouteEntry {
+    zoneId: string;
+    pattern: string;
+    /** Cloudflare's id, when the caller recorded it: the match must carry it. */
+    id?: string;
+}
+/** Name at least one script or route. */
+export interface AdoptWorkersRequest {
+    scripts?: AdoptWorkerScriptEntry[];
+    routes?: AdoptWorkerRouteEntry[];
+    /** The company the adopted items serve. Omit for none. */
+    organisationId?: string;
+}
+export interface AdoptWorkersResponse {
+    scripts: {
+        adopted: PlatformWorkerScriptView[];
+        alreadyAdopted: PlatformWorkerScriptView[];
+        /** Entries with no live script. Nothing is created for them. */
+        notFound: AdoptWorkerScriptEntry[];
+        /** Live scripts no entry named. Reported, never touched. */
+        unclaimed: PlatformWorkerScriptView[];
+    };
+    routes: {
+        adopted: PlatformWorkerRouteView[];
+        alreadyAdopted: PlatformWorkerRouteView[];
+        /** `taken`: a row for that zone and pattern exists. */
+        skipped: Array<{
+            route: PlatformWorkerRouteView;
+            reason: 'taken';
+        }>;
+        notFound: AdoptWorkerRouteEntry[];
+        /** Live routes in the named zones that no entry named. Reported, never touched. */
+        unclaimed: PlatformWorkerRouteView[];
+    };
+}
+/** A rate limiting rule seen with the platform credential. A zone's rules share
+ * one ruleset, so ownership is per rule. `id` is Cloudflare's rule id, which
+ * every platform rule call takes. */
+export interface PlatformRateLimitRuleView {
+    id: string;
+    zoneId: string;
+    /** `null` for a live rule that has no description. */
+    description: string | null;
+    /** Who owns it: the platform, or `null` when no row exists (a live rule
+     * nobody adopted: reported, never touched). */
+    owner: 'platform' | null;
+    /** The company the rule serves; `'platform'` when none. `null` for a rule with no row. */
+    organisationId: string | null;
+    state: 'pending' | 'active' | 'removing' | 'removed';
+}
+export interface ListPlatformRateLimitRulesRequest {
+    zoneId: string;
+    /** Only the rule with exactly this description. */
+    description?: string;
+}
+export interface ListPlatformRateLimitRulesResponse {
+    rules: PlatformRateLimitRuleView[];
+}
+/** Creates the rule, or returns the one edge already made for that zone and
+ * description. The rule is added on its own: no other rule in the zone's
+ * ruleset is read back or rewritten. Cloudflare's plan limits (such as one rule
+ * on the Free plan) are Cloudflare's to refuse. */
+export interface CreatePlatformRateLimitRuleRequest {
+    zoneId: string;
+    /** Names the rule in the zone: the key that makes a repeat safe. */
+    description: string;
+    expression: string;
+    /** Cloudflare's rule action, such as `block`. */
+    action: string;
+    ratelimit: {
+        characteristics: string[];
+        period: number;
+        requests_per_period: number;
+        mitigation_timeout?: number;
+    };
+    /** The company the rule serves. Omit for a rule that serves none. */
+    organisationId?: string;
+}
+export interface AdoptRateLimitRuleEntry {
+    zoneId: string;
+    /** Match the live rule by description, by id, or both. At least one is needed. */
+    description?: string;
+    id?: string;
+}
+export interface AdoptRateLimitRulesRequest {
+    rules: AdoptRateLimitRuleEntry[];
+    /** The company the adopted rules serve. Omit for none. */
+    organisationId?: string;
+}
+export interface AdoptRateLimitRulesResponse {
+    adopted: PlatformRateLimitRuleView[];
+    alreadyAdopted: PlatformRateLimitRuleView[];
+    /** `taken`: a row for that zone and description exists. */
+    skipped: Array<{
+        rule: PlatformRateLimitRuleView;
+        reason: 'taken';
+    }>;
+    notFound: AdoptRateLimitRuleEntry[];
+    /** Live rules in the named zones that no entry named. Reported, never touched. */
+    unclaimed: PlatformRateLimitRuleView[];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/edge",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "type": "module",
   "license": "MIT",
   "description": "Public client SDK and API types for the edge service.",