alchemy 0.49.1 → 0.51.0

package/lib/cloudflare/api-shield.js

@@ -0,0 +1,427 @@
+import fs from "node:fs/promises";
+import * as yaml from "yaml";
+import { Resource } from "../resource.js";
+import { handleApiError } from "./api-error.js";
+import { APIGatewayOperation } from "./api-gateway-operation.js";
+import { APISchema } from "./api-schema.js";
+import { createCloudflareApi, } from "./api.js";
+import { findZoneForHostname } from "./zone.js";
+/**
+ * Cloudflare Schema Validation protects your API endpoints by validating incoming requests
+ * against an OpenAPI v3 schema. It can log or block requests that don't match your schema,
+ * helping prevent malformed requests and potential security issues.
+ *
+ * @example
+ * ## Basic schema validation with inline YAML
+ *
+ * Enable schema validation with a simple OpenAPI schema as YAML string
+ *
+ * const apiSchema = await APISchema("my-schema", {
+ *   zone: myZone,
+ *   schema: `
+ *     openapi: 3.0.0
+ *     info:
+ *       title: My API
+ *       version: 1.0.0
+ *     servers:
+ *       - url: https://api.example.com
+ *     paths:
+ *       /users:
+ *         get:
+ *           operationId: getUsers
+ *           responses:
+ *             '200':
+ *               description: Success
+ *       /users/{id}:
+ *         get:
+ *           operationId: getUser
+ *           parameters:
+ *             - name: id
+ *               in: path
+ *               required: true
+ *               schema:
+ *                 type: string
+ *   `,
+ * });
+ *
+ * const shield = await APIShield("api-validation", {
+ *   zone: myZone,
+ *   schema: apiSchema,
+ *   defaultAction: "none"
+ * });
+ *
+ * @example
+ * ## API Shield with typed OpenAPI object
+ *
+ * Use strongly-typed OpenAPI v3 objects for better IDE support
+ *
+ * import type { OpenAPIV3 } from "openapi-types";
+ *
+ * const apiSchema: OpenAPIV3.Document = {
+ *   openapi: "3.0.0",
+ *   info: {
+ *     title: "My API",
+ *     version: "1.0.0",
+ *   },
+ *   servers: [
+ *     { url: "https://api.example.com" }
+ *   ],
+ *   paths: {
+ *     "/users": {
+ *       get: {
+ *         operationId: "getUsers",
+ *         responses: {
+ *           "200": {
+ *             description: "Success",
+ *             content: {
+ *               "application/json": {
+ *                 schema: {
+ *                   type: "array",
+ *                   items: {
+ *                     type: "object",
+ *                     properties: {
+ *                       id: { type: "string" },
+ *                       name: { type: "string" }
+ *                     }
+ *                   }
+ *                 }
+ *               }
+ *             }
+ *           }
+ *         }
+ *       }
+ *     }
+ *   }
+ * };
+ *
+ * const schema = await APISchema("my-schema", {
+ *   zone: myZone,
+ *   schema: apiSchema,
+ * });
+ *
+ * const shield = await APIShield("api-validation", {
+ *   zone: myZone,
+ *   schema: schema,
+ *   defaultAction: "none"
+ * });
+ *
+ * @example
+ * ## API Shield with file
+ *
+ * Load schema from an external file with custom settings
+ *
+ * const schema = await APISchema("my-schema", {
+ *   zone: "example.com",
+ *   schema: new URL("file:///path/to/openapi.yaml"),
+ *   name: "production-api-v2",
+ * });
+ *
+ * const shield = await APIShield("api-validation", {
+ *   zone: "example.com",
+ *   schema: schema,
+ *   defaultAction: "none",
+ *   mitigations: {
+ *     "/users": {
+ *       get: "none",        // No mitigation for read operations
+ *       post: "log",        // Log violations for writes (requires paid plan)
+ *     },
+ *     "/users/{id}": {
+ *       delete: "block"     // Block destructive operations (requires paid plan)
+ *     }
+ *   },
+ *   unknownOperationAction: "none"
+ * });
+ *
+ * @example
+ * ## Monitor API traffic without impact
+ *
+ * Use validation in monitoring mode to understand traffic patterns
+ *
+ * const schema = await APISchema("my-schema", {
+ *   zone: myZone,
+ *   schema: new URL("file:///path/to/api-schema.json"),
+ * });
+ *
+ * const monitoring = await APIShield("api-monitoring", {
+ *   zone: myZone,
+ *   schema: schema,
+ *   defaultAction: "none"
+ * });
+ *
+ * @example
+ * ## Log schema violations
+ *
+ * Track non-compliant requests without blocking (requires paid plan)
+ *
+ * const schema = await APISchema("my-schema", {
+ *   zone: myZone,
+ *   schema: new URL("file:///path/to/api-schema.json"),
+ * });
+ *
+ * const withLogging = await APIShield("api-logging", {
+ *   zone: myZone,
+ *   schema: schema,
+ *   defaultAction: "log"
+ * });
+ *
+ * @example
+ * ## Protect critical endpoints with blanket mitigations
+ *
+ * Apply mitigations to entire paths or specific methods (requires paid plan)
+ *
+ * const schema = await APISchema("my-schema", {
+ *   zone: myZone,
+ *   schema: new URL("file:///path/to/api-schema.json"),
+ * });
+ *
+ * const protection = await APIShield("api-protection", {
+ *   zone: myZone,
+ *   schema: schema,
+ *   defaultAction: "log",
+ *   mitigations: {
+ *     "/admin": "block",              // Block all methods on admin endpoints
+ *     "/payments": {
+ *       post: "block",                // Block payment creation
+ *       put: "block"                  // Block payment updates
+ *     },
+ *     "/users/{id}": {
+ *       delete: "block"               // Block user deletion
+ *     },
+ *     "/public": "none",              // Allow all methods on public endpoints
+ *     "/products": "none"             // Allow all methods on products
+ *   }
+ * });
+ *
+ * @see https://developers.cloudflare.com/api-shield/security/schema-validation/
+ */
+export async function APIShield(id, props) {
+    return (await _APIShield(id, {
+        ...props,
+        // resolve file URLs to documents prior to passing input to the resource
+        // so that updates to the schema trigger changes to the resource
+        schema: await loadSchemaContent(props.schema),
+    }));
+}
+const _APIShield = Resource("cloudflare::APIShield", {
+    // delete the api gateway operations in parallel
+    destroyStrategy: "parallel",
+}, async function (id, props) {
+    const api = await createCloudflareApi(props);
+    // Resolve zone ID and name
+    const zoneId = typeof props.zone === "string"
+        ? (await findZoneForHostname(api, props.zone)).zoneId
+        : props.zone.id;
+    if (this.phase === "delete") {
+        // Reset settings to default
+        await updateGlobalSettings(api, zoneId, {
+            validation_default_mitigation_action: "none",
+        });
+        return this.destroy();
+    }
+    // Update global settings
+    const defaultAction = props.defaultMitigation || "none";
+    await updateGlobalSettings(api, zoneId, {
+        validation_default_mitigation_action: defaultAction,
+        validation_override_mitigation_action: props.unknownOperationMitigation,
+    });
+    const schema = await APISchema("schema", {
+        schema: props.schema,
+        zone: props.zone,
+        name: props.name ?? id,
+        enabled: props.enabled,
+        accountId: props.accountId,
+        apiKey: props.apiKey,
+        apiToken: props.apiToken,
+        baseUrl: props.baseUrl,
+        email: props.email,
+    });
+    return this({
+        zoneId,
+        schema,
+        operations: await Promise.all(parseSchemaOperations(schema.schema).map(async (parsedOp) => {
+            let operationAction = defaultAction;
+            const method = parsedOp.method.toLowerCase();
+            if (props.mitigations) {
+                const pathActions = props.mitigations[parsedOp.endpoint];
+                if (typeof pathActions === "string") {
+                    // Blanket action for all methods on this path
+                    operationAction = pathActions;
+                }
+                else if (pathActions && typeof pathActions === "object") {
+                    // Per-method configuration
+                    const methodAction = pathActions[method];
+                    if (methodAction) {
+                        operationAction = methodAction;
+                    }
+                }
+            }
+            return APIGatewayOperation(
+            // Create a deterministic ID for the operation
+            `${id}-${method}-${parsedOp.endpoint.replace(/[^a-z0-9]/gi, "-")}`, {
+                zone: zoneId,
+                endpoint: parsedOp.endpoint,
+                host: parsedOp.host,
+                method: parsedOp.method,
+                mitigation: operationAction,
+            });
+        })),
+    });
+});
+// Helper functions for API calls
+async function getGlobalSettings(api, zoneId) {
+    const response = await api.get(`/zones/${zoneId}/api_gateway/settings/schema_validation`);
+    if (!response.ok) {
+        await handleApiError(response, "getting", "global settings");
+    }
+    const data = (await response.json());
+    return data.result;
+}
+async function updateGlobalSettings(api, zoneId, params) {
+    const response = await api.put(`/zones/${zoneId}/api_gateway/settings/schema_validation`, params);
+    if (!response.ok) {
+        await handleApiError(response, "updating", "global settings");
+    }
+}
+/**
+ * Get global schema validation settings for a zone
+ */
+export async function getGlobalSettingsForZone(api, zoneId) {
+    return getGlobalSettings(api, zoneId);
+}
+/**
+ * Extract operations from an OpenAPI schema
+ */
+export function parseSchemaOperations(schema) {
+    const operations = [];
+    if (!schema?.paths) {
+        return operations;
+    }
+    // Determine the host from servers
+    const defaultHost = extractHostFromSchema(schema);
+    // Extract operations from each path
+    for (const [path, pathItem] of Object.entries(schema.paths)) {
+        if (!pathItem || typeof pathItem !== "object")
+            continue;
+        // Check each HTTP method
+        for (const method of [
+            "get",
+            "post",
+            "put",
+            "patch",
+            "delete",
+            "head",
+            "options",
+            "trace",
+        ]) {
+            const operation = pathItem[method];
+            if (operation &&
+                typeof operation === "object" &&
+                !Array.isArray(operation)) {
+                // Determine host for this operation (operation-level servers override global)
+                const operationHost = operation.servers?.[0]?.url
+                    ? extractHostFromUrl(operation.servers[0].url)
+                    : defaultHost;
+                operations.push({
+                    method: method.toUpperCase(),
+                    endpoint: path,
+                    operationId: operation.operationId,
+                    host: operationHost,
+                });
+            }
+        }
+    }
+    return operations;
+}
+/**
+ * Extract host from OpenAPI schema servers
+ */
+function extractHostFromSchema(schema) {
+    if (schema.servers && schema.servers.length > 0) {
+        return extractHostFromUrl(schema.servers[0].url);
+    }
+    // Fallback to a default host
+    return "api.example.com";
+}
+/**
+ * Extract hostname from a URL
+ */
+function extractHostFromUrl(url) {
+    try {
+        const urlObj = new URL(url);
+        return urlObj.hostname;
+    }
+    catch {
+        // If URL parsing fails, return the URL as-is (might be relative)
+        return url;
+    }
+}
+/**
+ * Helper function to load schema content from various sources
+ */
+async function loadSchemaContent(schema) {
+    // Handle string content (YAML/JSON)
+    try {
+        if (typeof schema === "string") {
+            if (schema.startsWith("http://") || schema.startsWith("https://")) {
+                return loadSchemaContent(new URL(schema));
+            }
+            else if (schema.includes("\n")) {
+                // json or YAML
+                return tryParse(schema);
+            }
+            else {
+                try {
+                    return tryParse(await fs.readFile(schema, "utf-8"));
+                }
+                catch {
+                    // maybe minified JSON
+                    return tryParse(schema);
+                }
+            }
+        }
+        else if (schema instanceof URL) {
+            return yaml.parse(await fetchUrl(schema));
+        }
+        else if (typeof schema === "object") {
+            return schema;
+        }
+        else {
+            // should be unreachable
+            throw SchemaError(new Error(`Unsupported schema type: ${typeof schema}`));
+        }
+    }
+    catch (err) {
+        throw SchemaError(err);
+    }
+}
+const SchemaError = (cause) => new Error(`Invalid OpenAPI schema. Please provide a:
+1. a string containing OpenAPI v3.0 schema (in YAML or JSON format)
+2. a string path to a file containing OpenAPI v3.0 schema (in YAML or JSON format)
+3. a file://, http:// or https:// URL pointing to an OpenAPI v3.0 schema (in YAML or JSON format)
+4. a literal OpenAPI v3.0 schema object`, { cause });
+function tryParse(schema) {
+    try {
+        return yaml.parse(schema);
+    }
+    catch {
+        return JSON.parse(schema);
+    }
+}
+async function fetchUrl(url) {
+    if (url.protocol === "file:") {
+        // Read from local filesystem for file:// URLs
+        return await fs.readFile(url.pathname, "utf-8");
+    }
+    else if (url.protocol === "http:" || url.protocol === "https:") {
+        // Fetch from remote for http/https URLs
+        const response = await fetch(url.toString());
+        if (!response.ok) {
+            throw new Error(`Failed to fetch schema from URL: ${response.statusText}`);
+        }
+        return await response.text();
+    }
+    else {
+        throw new Error(`Unsupported URL protocol: ${url.protocol}. Only http:, https:, and file: are supported.`);
+    }
+}
+//# sourceMappingURL=api-shield.js.map

package/lib/cloudflare/api-shield.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-shield.js","sourceRoot":"","sources":["../../src/cloudflare/api-shield.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAElC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,mBAAmB,GAGpB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAwKhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2LG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,EAAU,EACV,KAAwB;IAExB,OAAO,CAAC,MAAM,UAAU,CAAC,EAAE,EAAE;QAC3B,GAAG,KAAK;QACR,wEAAwE;QACxE,gEAAgE;QAChE,MAAM,EAAE,MAAM,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC;KAC9C,CAAC,CAA+D,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,GAAG,QAAQ,CACzB,uBAAuB,EACvB;IACE,gDAAgD;IAChD,eAAe,EAAE,UAAU;CAC5B,EACD,KAAK,WAEH,EAAU,EACV,KAAwD;IAExD,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAE7C,2BAA2B;IAC3B,MAAM,MAAM,GACV,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC5B,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QACrD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAEpB,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5B,4BAA4B;QAC5B,MAAM,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE;YACtC,oCAAoC,EAAE,MAAM;SAC7C,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,yBAAyB;IACzB,MAAM,aAAa,GAAG,KAAK,CAAC,iBAAiB,IAAI,MAAM,CAAC;IACxD,MAAM,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE;QACtC,oCAAoC,EAAE,aAAa;QACnD,qCAAqC,EAAE,KAAK,CAAC,0BAA0B;KACxE,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE;QACvC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;QACV,MAAM;QACN,MAAM;QACN,UAAU,EAAE,MAAM,OAAO,CAAC,GAAG,CAC3B,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC1D,IAAI,eAAe,GAAG,aAAa,CAAC;YACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACzD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;oBACpC,8CAA8C;oBAC9C,eAAe,GAAG,WAAW,CAAC;gBAChC,CAAC;qBAAM,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;oBAC1D,2BAA2B;oBAC3B,MAAM,YAAY,GAChB,WAAW,CAAC,MAAkC,CAAC,CAAC;oBAClD,IAAI,YAAY,EAAE,CAAC;wBACjB,eAAe,GAAG,YAAY,CAAC;oBACjC,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,mBAAmB;YACxB,8CAA8C;YAC9C,GAAG,EAAE,IAAI,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,EAClE;gBACE,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU,EAAE,eAAe;aAC5B,CACF,CAAC;QACJ,CAAC,CAAC,CACH;KACF,CAAC,CAAC;AACL,CAAC,CACF,CAAC;AAEF,iCAAiC;AAEjC,KAAK,UAAU,iBAAiB,CAC9B,GAAkB,EAClB,MAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,CAC5B,UAAU,MAAM,yCAAyC,CAC1D,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyC,CAAC;IAC7E,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,GAAkB,EAClB,MAAc,EACd,MAAyC;IAEzC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,CAC5B,UAAU,MAAM,yCAAyC,EACzD,MAAM,CACP,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAkB,EAClB,MAAc;IAEd,OAAO,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AASD;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAM9D,MAAM,UAAU,GAKX,EAAE,CAAC;IAER,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QACnB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,kCAAkC;IAClC,MAAM,WAAW,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAElD,oCAAoC;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,SAAS;QAExD,yBAAyB;QACzB,KAAK,MAAM,MAAM,IAAI;YACnB,KAAK;YACL,MAAM;YACN,KAAK;YACL,OAAO;YACP,QAAQ;YACR,MAAM;YACN,SAAS;YACT,OAAO;SACR,EAAE,CAAC;YACF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAA+B,CAAC,CAAC;YAC5D,IACE,SAAS;gBACT,OAAO,SAAS,KAAK,QAAQ;gBAC7B,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EACzB,CAAC;gBACD,8EAA8E;gBAC9E,MAAM,aAAa,GAAI,SAAiB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;oBACxD,CAAC,CAAC,kBAAkB,CAAE,SAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;oBACvD,CAAC,CAAC,WAAW,CAAC;gBAEhB,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;oBAC5B,QAAQ,EAAE,IAAI;oBACd,WAAW,EAAG,SAAiB,CAAC,WAAW;oBAC3C,IAAI,EAAE,aAAa;iBACpB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,MAA0B;IACvD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;IAED,6BAA6B;IAC7B,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,iBAAiB,CAC9B,MAAyC;IAEzC,oCAAoC;IACpC,IAAI,CAAC;QACH,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClE,OAAO,iBAAiB,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5C,CAAC;iBAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,eAAe;gBACf,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;gBACtD,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;oBACtB,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,YAAY,GAAG,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,MAA4B,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,wBAAwB;YACxB,MAAM,WAAW,CAAC,IAAI,KAAK,CAAC,4BAA4B,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,KAAW,EAAE,EAAE,CAClC,IAAI,KAAK,CACP;;;;wCAIoC,EACpC,EAAE,KAAK,EAAE,CACV,CAAC;AAEJ,SAAS,QAAQ,CAAC,MAAc;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAQ;IAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7B,8CAA8C;QAC9C,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjE,wCAAwC;QACxC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,oCAAoC,QAAQ,CAAC,UAAU,EAAE,CAC1D,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CACb,6BAA6B,GAAG,CAAC,QAAQ,gDAAgD,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC"}

package/lib/cloudflare/bucket.d.ts

@@ -1,12 +1,10 @@
-import { AwsClient } from "aws4fetch";
 import { Resource } from "../resource.ts";
-import type { Secret } from "../secret.ts";
-import { type CloudflareApi } from "./api.ts";
+import { type CloudflareApi, type CloudflareApiOptions } from "./api.ts";
 import type { Bound } from "./bound.ts";
 /**
  * Properties for creating or updating an R2 Bucket
  */
-export interface BucketProps {
+export interface BucketProps extends CloudflareApiOptions {
     /**
      * Name of the bucket
      * Names can only contain lowercase letters (a-z), numbers (0-9), and hyphens (-)
@@ -20,6 +18,11 @@ export interface BucketProps {
      * Indicates the primary geographical location data will be accessed from
      */
     locationHint?: string;
+    /**
+     * Optional storage class for the bucket
+     * Indicates the storage class for the bucket
+     */
+    storageClass?: "Standard" | "InfrequentAccess";
     /**
      * Optional jurisdiction for the bucket
      * Determines the regulatory jurisdiction the bucket data falls under
@@ -42,34 +45,14 @@ export interface BucketProps {
      * @default false
      */
     empty?: boolean;
-    /**
-     * API Token to use for the bucket
-     */
-    apiToken?: Secret;
-    /**
-     * API Key to use for the bucket
-     */
-    apiKey?: Secret;
-    /**
-     * Email to use for the bucket
-     */
-    email?: string;
-    /**
-     * Account ID to use for the bucket
-     */
-    accountId?: string;
-    /**
-     * Access Key to use for the bucket
-     */
-    accessKey?: Secret;
-    /**
-     * Secret Access Key to use for the bucket
-     */
-    secretAccessKey?: Secret;
     /**
      * Whether to adopt an existing bucket
      */
     adopt?: boolean;
+    /**
+     * CORS rules for the bucket
+     */
+    cors?: R2BucketCORSRule[];
     /**
      * Whether to emulate the bucket locally when Alchemy is running in watch mode.
      */
@@ -81,6 +64,37 @@ export interface BucketProps {
         remote?: boolean;
     };
 }
+interface R2BucketCORSRule {
+    /**
+     * Identifier for this rule.
+     */
+    id?: string;
+    /**
+     * Object specifying allowed origins, methods and headers for this CORS rule.
+     */
+    allowed: {
+        /**
+         * Specifies the value for the Access-Control-Allow-Methods header R2 sets when requesting objects in a bucket from a browser.
+         */
+        methods: ("GET" | "PUT" | "POST" | "DELETE" | "HEAD")[];
+        /**
+         * Specifies the value for the Access-Control-Allow-Origin header R2 sets when requesting objects in a bucket from a browser.
+         */
+        origins: string[];
+        /**
+         * Specifies the value for the Access-Control-Allow-Headers header R2 sets when requesting objects in this bucket from a browser. Cross-origin requests that include custom headers (e.g. x-user-id) should specify these headers as AllowedHeaders.
+         */
+        headers?: string[];
+    };
+    /**
+     * Specifies the headers that can be exposed back, and accessed by, the JavaScript making the cross-origin request. If you need to access headers beyond the safelisted response headers, such as Content-Encoding or cf-cache-status, you must specify it here.
+     */
+    exposeHeaders?: string[];
+    /**
+     * Specifies the amount of time (in seconds) browsers are allowed to cache CORS preflight responses. Browsers may limit this to 2 hours or less, even if the maximum value (86400) is specified.
+     */
+    maxAgeSeconds?: number;
+}
 /**
  * Output returned after R2 Bucket creation/update
  */
@@ -101,6 +115,10 @@ export type R2BucketResource = Resource<"cloudflare::R2Bucket"> & Omit<BucketPro
      * Time at which the bucket was created
      */
     creationDate: Date;
+    /**
+     * The `r2.dev` subdomain for the bucket, if `allowPublicAccess` is true
+     */
+    domain: string | undefined;
 };
 export declare function isBucket(resource: Resource): resource is R2BucketResource;
 export type R2Bucket = R2BucketResource & Bound<R2BucketResource>;
@@ -150,40 +168,15 @@ export type R2Bucket = R2BucketResource & Bound<R2BucketResource>;
  */
 export declare function R2Bucket(name: string, props?: BucketProps): Promise<R2Bucket>;
 /**
- * Configuration for R2 client to connect to Cloudflare R2
+ * The bucket information returned from the Cloudflare REST API
+ * @see https://developers.cloudflare.com/api/node/resources/r2/subresources/buckets/models/bucket/#(schema)
  */
-export interface R2ClientConfig {
-    accountId: string;
-    accessKeyId?: Secret;
-    secretAccessKey?: Secret;
-    jurisdiction?: string;
-}
-type R2Client = AwsClient & {
-    accountId: string;
-};
-/**
- * Creates an aws4fetch client configured for Cloudflare R2
- *
- * @see https://developers.cloudflare.com/r2/examples/aws/aws-sdk-js-v3/
- */
-export declare function createR2Client(config?: R2ClientConfig): Promise<R2Client>;
-interface CloudflareBucketResponse {
-    /**
-     * The bucket information returned from the Cloudflare REST API
-     * @see https://developers.cloudflare.com/api/node/resources/r2/subresources/buckets/models/bucket/#(schema)
-     */
-    result: {
-        creation_date: string;
-        location?: "apac" | "eeur" | "enam" | "weur" | "wnam" | "oc";
-        name: string;
-        storage_class?: "Standard" | "InfrequentAccess";
-    };
-    success: boolean;
-    errors: Array<{
-        code: number;
-        message: string;
-    }>;
-    messages: string[];
+interface R2BucketResult {
+    creation_date: string;
+    location: "apac" | "eeur" | "enam" | "weur" | "wnam" | "oc";
+    name: string;
+    storage_class: "Standard" | "InfrequentAccess";
+    jurisdiction: "default" | "eu" | "fedramp";
 }
 /**
  * Adds jurisdiction header to the headers object if specified in props
@@ -192,64 +185,32 @@ interface CloudflareBucketResponse {
  * @param props Props or jurisdiction string
  * @returns Modified headers object
  */
-export declare function withJurisdiction(headers: Record<string, string>, props: BucketProps | {
+export declare function withJurisdiction(props: {
     jurisdiction?: string;
-} | string | undefined): Record<string, string>;
+}, headers?: Record<string, string>): Record<string, string>;
 /**
  * Get a bucket
  */
-export declare function getBucket(api: CloudflareApi, bucketName: string, props?: BucketProps): Promise<CloudflareBucketResponse>;
+export declare function getBucket(api: CloudflareApi, bucketName: string, props?: BucketProps): Promise<R2BucketResult>;
 /**
  * Create a new bucket
  */
-export declare function createBucket(api: CloudflareApi, bucketName: string, props?: BucketProps): Promise<CloudflareBucketResponse>;
+export declare function createBucket(api: CloudflareApi, bucketName: string, props?: BucketProps): Promise<R2BucketResult>;
 /**
  * Delete a bucket
  */
 export declare function deleteBucket(api: CloudflareApi, bucketName: string, props: BucketProps): Promise<void>;
 /**
- * List objects in an R2 bucket
- *
- * @param r2 R2Client instance
- * @param bucketName Name of the bucket
- * @param continuationToken Optional token for pagination
- * @param jurisdiction Optional jurisdiction for the bucket
- * @returns Object containing the list of objects and the next continuation token
- */
-export declare function listObjects(r2: R2Client, bucketName: string, continuationToken?: string, jurisdiction?: string): Promise<{
-    objects: {
-        Key: string;
-    }[];
-    continuationToken?: string;
-}>;
-/**
- * Helper function to empty a bucket by deleting all objects
- */
-export declare function emptyBucket(r2: R2Client, bucketName: string, jurisdiction?: string): Promise<void>;
-/**
- * Update public access setting for a bucket
- *
- * This operation is not available through the S3 API for R2,
- * so we still use the Cloudflare API directly.
- */
-export declare function updatePublicAccess(api: CloudflareApi, bucketName: string, allowPublicAccess: boolean, jurisdiction?: string): Promise<void>;
-/**
- * Set CORS configuration for a bucket using aws4fetch
+ * Update the managed domain setting for a bucket
  */
-export declare function setCorsConfiguration(r2: R2Client, bucketName: string, allowedOrigins?: string[], allowedMethods?: string[], allowedHeaders?: string[], maxAgeSeconds?: number, jurisdiction?: string): Promise<void>;
+export declare function putManagedDomain(api: CloudflareApi, bucketName: string, enabled: boolean, jurisdiction?: string): Promise<string | undefined>;
 /**
- * Information about an R2 bucket returned by list operations
+ * Returns an async iterable of all object keys in a bucket,
+ * handling pagination automatically.
  */
-export interface R2BucketInfo {
-    /**
-     * Name of the bucket
-     */
-    Name: string;
-    /**
-     * Creation date of the bucket
-     */
-    CreationDate: Date;
-}
+export declare function listObjects(api: CloudflareApi, bucketName: string, props: {
+    jurisdiction?: string;
+}, cursor?: string): AsyncGenerator<string>;
 /**
  * List all R2 buckets in an account
  *
@@ -263,6 +224,10 @@ export declare function listBuckets(api: CloudflareApi, options?: {
     cursor?: string;
     direction?: "asc" | "desc";
     jurisdiction?: string;
-}): Promise<R2BucketInfo[]>;
+}): Promise<{
+    name: string;
+    creation_date: string;
+}[]>;
+export declare function putBucketCORS(api: CloudflareApi, bucketName: string, props: BucketProps): Promise<void>;
 export {};
 //# sourceMappingURL=bucket.d.ts.map