alchemy 0.50.0 → 0.51.0

package/lib/cloudflare/api-schema.js

@@ -0,0 +1,197 @@
+import * as yaml from "yaml";
+import { Resource } from "../resource.js";
+import { CloudflareApiError, handleApiError } from "./api-error.js";
+import { createCloudflareApi, } from "./api.js";
+import { findZoneForHostname } from "./zone.js";
+/**
+ * Cloudflare API Gateway Schema manages OpenAPI v3 schemas for API validation.
+ *
+ * @example
+ * ## Basic schema upload with inline YAML
+ *
+ * const apiSchema = await APISchema("my-api-schema", {
+ *   zone: myZone,
+ *   name: "my-api-v1"
+ *   schema: `
+ *     openapi: 3.0.0
+ *     info:
+ *       title: My API
+ *       version: 1.0.0
+ *     servers:
+ *       - url: https://api.example.com
+ *     paths:
+ *       /users:
+ *         get:
+ *           operationId: getUsers
+ *           responses:
+ *             '200':
+ *               description: Success
+ *   `,
+ * });
+ *
+ * @example
+ * ## Schema upload from file
+ *
+ * const fileSchema = await APISchema("api-schema-from-file", {
+ *   zone: "example.com",
+ *   schemaFile: "./openapi.yaml",
+ *   name: "production-api-v2",
+ *   enabled: false  // Upload but don't enable validation yet
+ * });
+ *
+ * @example
+ * ## Schema with typed OpenAPI object
+ *
+ * import type { OpenAPIV3 } from "openapi-types";
+ *
+ * const typedSchema: OpenAPIV3.Document = {
+ *   openapi: "3.0.0",
+ *   info: { title: "Typed API", version: "1.0.0" },
+ *   paths: {
+ *     "/health": {
+ *       get: {
+ *         operationId: "healthCheck",
+ *         responses: { "200": { description: "OK" } }
+ *       }
+ *     }
+ *   }
+ * };
+ *
+ * const schema = await APISchema("typed-schema", {
+ *   zone: myZone,
+ *   schema: typedSchema
+ * });
+ */
+export const APISchema = Resource("cloudflare::APISchema", async function (id, props) {
+    const api = await createCloudflareApi(props);
+    // Resolve zone ID and name
+    const zoneId = typeof props.zone === "string"
+        ? (await findZoneForHostname(api, props.zone)).zoneId
+        : props.zone.id;
+    if (this.phase === "delete") {
+        if (this.output?.id) {
+            await deleteSchema(api, zoneId, this.output.id);
+        }
+        return this.destroy();
+    }
+    // Load schema content
+    const parsedSchema = props.schema;
+    let schemaDetails;
+    if (this.phase === "update" && this.output?.id) {
+        // Check if we need to replace due to name, schema content change, or disabling validation
+        if (props.name !== this.output.name ||
+            JSON.stringify(parsedSchema) !== JSON.stringify(this.output.schema) ||
+            (this.output.enabled === true && props.enabled === false)) {
+            // Name, schema content changed, or trying to disable validation - need to replace
+            this.replace();
+        }
+        // Update existing schema (can only update validation_enabled)
+        schemaDetails = await updateSchema(api, zoneId, this.output.id, {
+            validation_enabled: props.enabled !== false,
+        });
+    }
+    else {
+        // Create new schema
+        schemaDetails = await uploadSchema(api, zoneId, {
+            file: yaml.stringify(parsedSchema),
+            name: props.name || id,
+            validation_enabled: props.enabled !== false,
+        });
+    }
+    return this({
+        id: schemaDetails.id,
+        name: schemaDetails.name,
+        schema: parsedSchema,
+        source: schemaDetails.source,
+        enabled: schemaDetails.validationEnabled,
+    });
+});
+async function uploadSchema(api, zoneId, params) {
+    const body = {
+        source: params.file,
+        name: params.name,
+        kind: "openapi_v3",
+        validation_enabled: params.validation_enabled ?? true,
+    };
+    const response = await api.post(`/zones/${zoneId}/schema_validation/schemas`, body);
+    if (!response.ok) {
+        await handleApiError(response, "uploading", "schema", params.name);
+    }
+    const data = (await response.json());
+    return {
+        id: data.result.schema_id,
+        name: data.result.name,
+        source: data.result.source,
+        validationEnabled: data.result.validation_enabled,
+        createdAt: data.result.created_at,
+    };
+}
+async function updateSchema(api, zoneId, schemaId, params) {
+    const response = await api.patch(`/zones/${zoneId}/schema_validation/schemas/${schemaId}`, params);
+    if (!response.ok) {
+        await handleApiError(response, "updating", "schema", schemaId);
+    }
+    const data = (await response.json());
+    return {
+        id: data.result.schema_id,
+        name: data.result.name,
+        source: data.result.source,
+        validationEnabled: data.result.validation_enabled,
+        createdAt: data.result.created_at,
+    };
+}
+export async function deleteSchema(api, zoneId, schemaId) {
+    const response = await api.delete(`/zones/${zoneId}/schema_validation/schemas/${schemaId}`);
+    const data = (await response.json());
+    if (response.status === 404) {
+        return;
+    }
+    else if (response.status === 400 && data.errors[0].code === 19400) {
+        // Bad request: schema with this ID does not exist
+        return;
+    }
+    if (!response.ok) {
+        await handleApiError(response, "deleting", "schema", schemaId);
+    }
+    else if (!data.success) {
+        throw new CloudflareApiError(data.errors[0].message, response);
+    }
+}
+/**
+ * Get schema details
+ */
+export async function getSchema(api, zoneId, schemaId) {
+    const response = await api.get(`/zones/${zoneId}/schema_validation/schemas/${schemaId}`);
+    if (response.status === 404) {
+        return null;
+    }
+    if (!response.ok) {
+        await handleApiError(response, "getting", "schema", schemaId);
+    }
+    const data = (await response.json());
+    return {
+        id: data.result.schema_id,
+        name: data.result.name,
+        source: data.result.source,
+        validationEnabled: data.result.validation_enabled,
+        createdAt: data.result.created_at,
+    };
+}
+/**
+ * List all schemas in a zone
+ */
+export async function listSchemas(api, zoneId) {
+    const response = await api.get(`/zones/${zoneId}/schema_validation/schemas`);
+    if (!response.ok) {
+        await handleApiError(response, "listing", "schemas", zoneId);
+    }
+    const data = (await response.json());
+    return data.result.map((schema) => ({
+        id: schema.schema_id,
+        name: schema.name,
+        source: schema.source,
+        validationEnabled: schema.validation_enabled,
+        createdAt: schema.created_at,
+    }));
+}
+//# sourceMappingURL=api-schema.js.map

package/lib/cloudflare/api-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-schema.js","sourceRoot":"","sources":["../../src/cloudflare/api-schema.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EACL,mBAAmB,GAGpB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAmEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAC,uBAAuB,EAAE,KAAK,WAEjC,EAAU,EAAE,KAAwB;IAGjE,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAE7C,2BAA2B;IAC3B,MAAM,MAAM,GACV,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC5B,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QACrD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAEpB,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YACpB,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,sBAAsB;IACtB,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC;IAElC,IAAI,aAAsC,CAAC;IAE3C,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;QAC/C,0FAA0F;QAC1F,IACE,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI;YAC/B,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACnE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,EACzD,CAAC;YACD,kFAAkF;YAClF,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;QAED,8DAA8D;QAC9D,aAAa,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE;YAC9D,kBAAkB,EAAE,KAAK,CAAC,OAAO,KAAK,KAAK;SAC5C,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,oBAAoB;QACpB,aAAa,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE;YAC9C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;YACtB,kBAAkB,EAAE,KAAK,CAAC,OAAO,KAAK,KAAK;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;QACV,EAAE,EAAE,aAAa,CAAC,EAAE;QACpB,IAAI,EAAE,aAAa,CAAC,IAAI;QACxB,MAAM,EAAE,YAAmB;QAC3B,MAAM,EAAE,aAAa,CAAC,MAAM;QAC5B,OAAO,EAAE,aAAa,CAAC,iBAAiB;KACzC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAuBH,KAAK,UAAU,YAAY,CACzB,GAAkB,EAClB,MAAc,EACd,MAIC;IAED,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,YAAY;QAClB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,IAAI;KACtD,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAC7B,UAAU,MAAM,4BAA4B,EAC5C,IAAI,CACL,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAElC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;QACtB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;QAC1B,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;QACjD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;KAClC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,GAAkB,EAClB,MAAc,EACd,QAAgB,EAChB,MAEC;IAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAC9B,UAAU,MAAM,8BAA8B,QAAQ,EAAE,EACxD,MAAM,CACP,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiC,CAAC;IACrE,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;QACtB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;QAC1B,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;QACjD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAkB,EAClB,MAAc,EACd,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAC/B,UAAU,MAAM,8BAA8B,QAAQ,EAAE,CACzD,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAMlC,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACpE,kDAAkD;QAClD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;SAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAkB,EAClB,MAAc,EACd,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,CAC5B,UAAU,MAAM,8BAA8B,QAAQ,EAAE,CACzD,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiC,CAAC;IACrE,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;QACtB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;QAC1B,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;QACjD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;KAClC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAkB,EAClB,MAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,UAAU,MAAM,4BAA4B,CAAC,CAAC;IAE7E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAElC,CAAC;IAEF,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClC,EAAE,EAAE,MAAM,CAAC,SAAS;QACpB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,iBAAiB,EAAE,MAAM,CAAC,kBAAkB;QAC5C,SAAS,EAAE,MAAM,CAAC,UAAU;KAC7B,CAAC,CAAC,CAAC;AACN,CAAC"}

package/lib/cloudflare/api-shield.d.ts

@@ -0,0 +1,366 @@
+import type { OpenAPIV3 } from "openapi-types";
+import { Resource } from "../resource.ts";
+import { APIGatewayOperation } from "./api-gateway-operation.ts";
+import type { APIMitigation, APIMitigations } from "./api-mitigation.ts";
+import { APISchema } from "./api-schema.ts";
+import { type CloudflareApi, type CloudflareApiOptions } from "./api.ts";
+import type { Zone } from "./zone.ts";
+/**
+ * Properties for creating or updating Schema Validation
+ */
+export interface APIShieldProps<S extends string | URL | OpenAPIV3.Document> extends CloudflareApiOptions {
+    /**
+     * The zone to configure schema validation for
+     */
+    zone: string | Zone;
+    /**
+     * The name of the schema validation
+     *
+     * @default id
+     */
+    name?: string;
+    /**
+     * The schema resource to use for validation
+     *
+     * Can be one of:
+     * 1. a string containing OpenAPI v3 schema
+     * 2. a string path to a file containing OpenAPI v3 schema
+     * 3. a file://, http:// or https:// URL pointing to an OpenAPI v3 schema
+     * 4. a literal OpenAPI v3 schema object
+     *
+     * @example
+     * await APIShield("my-validation", {
+     *   zone: myZone,
+     *   schema: "path/to/openapi.yaml",
+     * });
+     *
+     * @example
+     * await APIShield("my-validation", {
+     *   zone: myZone,
+     *   schema: new URL("file:///path/to/openapi.yaml"),
+     * });
+     *
+     * @example
+     * await APIShield("my-validation", {
+     *   zone: myZone,
+     *   schema: new URL("https://api.example.com/openapi.yaml"),
+     * });
+     *
+     * @example
+     * await APIShield("my-validation", {
+     *   zone: myZone,
+     *   schema: `
+     *     openapi: 3.0.0
+     *     info:
+     *       title: My API
+     *       version: 1.0.0
+     *     paths:
+     *       /users:
+     *         get:
+     *           operationId: getUsers
+     *           responses:
+     *             '200':
+     *               description: Success
+     *   `,
+     * });
+     *
+     * @example
+     * await APIShield("my-validation", {
+     *   zone: myZone,
+     *   schema: `
+     *     openapi: 3.0.0
+     *     info:
+     *       title: My API
+     *       version: 1.0.0
+     *     paths:
+     *       /users:
+     *         get:
+     *           operationId: getUsers
+     *           responses:
+     *             '200':
+     *               description: Success
+     *   `
+     * });
+     */
+    schema: S;
+    /**
+     * Whether to enable the schema validation
+     *
+     * @default true
+     */
+    enabled?: boolean;
+    /**
+     * Per-operation validation overrides using OpenAPI-style path structure
+     *
+     * Can specify mitigations per HTTP method or a blanket action for all methods on a path:
+     *
+     * @example
+     * // Per-method configuration
+     * {
+     *   "/users": {
+     *     get: "none",
+     *     post: "block"
+     *   },
+     *   "/users/{id}": {
+     *     delete: "block"
+     *   }
+     * }
+     *
+     * @example
+     * // Blanket action for all methods on a path
+     * {
+     *   "/users": "none",
+     *   "/users/{id}": "block",
+     *   "/admin": "block"
+     * }
+     */
+    mitigations?: APIMitigations<S extends string | URL ? OpenAPIV3.Document : S>;
+    /**
+     * Default validation action for all operations
+     *
+     * @default "none"
+     */
+    defaultMitigation?: APIMitigation;
+    /**
+     * Action for requests that don't match any operation
+     * @default "none"
+     */
+    unknownOperationMitigation?: APIMitigation;
+}
+/**
+ * Global validation settings
+ */
+export interface ValidationSettings {
+    /**
+     * Default mitigation action
+     */
+    defaultMitigation: APIMitigation;
+    /**
+     * Override mitigation action for specific operations
+     */
+    overrideMitigation?: APIMitigation;
+}
+/**
+ * Schema Validation output
+ */
+export interface APIShield<S extends OpenAPIV3.Document = OpenAPIV3.Document> extends Resource<"cloudflare::APIShield"> {
+    /**
+     * The schema resource
+     */
+    schema: APISchema<S>;
+    /**
+     * Zone ID
+     */
+    zoneId: string;
+    /**
+     * The API Schema's API Gateway Operations (and their respective mitigation actions)
+     */
+    operations: APIGatewayOperation[];
+}
+/**
+ * Cloudflare Schema Validation protects your API endpoints by validating incoming requests
+ * against an OpenAPI v3 schema. It can log or block requests that don't match your schema,
+ * helping prevent malformed requests and potential security issues.
+ *
+ * @example
+ * ## Basic schema validation with inline YAML
+ *
+ * Enable schema validation with a simple OpenAPI schema as YAML string
+ *
+ * const apiSchema = await APISchema("my-schema", {
+ *   zone: myZone,
+ *   schema: `
+ *     openapi: 3.0.0
+ *     info:
+ *       title: My API
+ *       version: 1.0.0
+ *     servers:
+ *       - url: https://api.example.com
+ *     paths:
+ *       /users:
+ *         get:
+ *           operationId: getUsers
+ *           responses:
+ *             '200':
+ *               description: Success
+ *       /users/{id}:
+ *         get:
+ *           operationId: getUser
+ *           parameters:
+ *             - name: id
+ *               in: path
+ *               required: true
+ *               schema:
+ *                 type: string
+ *   `,
+ * });
+ *
+ * const shield = await APIShield("api-validation", {
+ *   zone: myZone,
+ *   schema: apiSchema,
+ *   defaultAction: "none"
+ * });
+ *
+ * @example
+ * ## API Shield with typed OpenAPI object
+ *
+ * Use strongly-typed OpenAPI v3 objects for better IDE support
+ *
+ * import type { OpenAPIV3 } from "openapi-types";
+ *
+ * const apiSchema: OpenAPIV3.Document = {
+ *   openapi: "3.0.0",
+ *   info: {
+ *     title: "My API",
+ *     version: "1.0.0",
+ *   },
+ *   servers: [
+ *     { url: "https://api.example.com" }
+ *   ],
+ *   paths: {
+ *     "/users": {
+ *       get: {
+ *         operationId: "getUsers",
+ *         responses: {
+ *           "200": {
+ *             description: "Success",
+ *             content: {
+ *               "application/json": {
+ *                 schema: {
+ *                   type: "array",
+ *                   items: {
+ *                     type: "object",
+ *                     properties: {
+ *                       id: { type: "string" },
+ *                       name: { type: "string" }
+ *                     }
+ *                   }
+ *                 }
+ *               }
+ *             }
+ *           }
+ *         }
+ *       }
+ *     }
+ *   }
+ * };
+ *
+ * const schema = await APISchema("my-schema", {
+ *   zone: myZone,
+ *   schema: apiSchema,
+ * });
+ *
+ * const shield = await APIShield("api-validation", {
+ *   zone: myZone,
+ *   schema: schema,
+ *   defaultAction: "none"
+ * });
+ *
+ * @example
+ * ## API Shield with file
+ *
+ * Load schema from an external file with custom settings
+ *
+ * const schema = await APISchema("my-schema", {
+ *   zone: "example.com",
+ *   schema: new URL("file:///path/to/openapi.yaml"),
+ *   name: "production-api-v2",
+ * });
+ *
+ * const shield = await APIShield("api-validation", {
+ *   zone: "example.com",
+ *   schema: schema,
+ *   defaultAction: "none",
+ *   mitigations: {
+ *     "/users": {
+ *       get: "none",        // No mitigation for read operations
+ *       post: "log",        // Log violations for writes (requires paid plan)
+ *     },
+ *     "/users/{id}": {
+ *       delete: "block"     // Block destructive operations (requires paid plan)
+ *     }
+ *   },
+ *   unknownOperationAction: "none"
+ * });
+ *
+ * @example
+ * ## Monitor API traffic without impact
+ *
+ * Use validation in monitoring mode to understand traffic patterns
+ *
+ * const schema = await APISchema("my-schema", {
+ *   zone: myZone,
+ *   schema: new URL("file:///path/to/api-schema.json"),
+ * });
+ *
+ * const monitoring = await APIShield("api-monitoring", {
+ *   zone: myZone,
+ *   schema: schema,
+ *   defaultAction: "none"
+ * });
+ *
+ * @example
+ * ## Log schema violations
+ *
+ * Track non-compliant requests without blocking (requires paid plan)
+ *
+ * const schema = await APISchema("my-schema", {
+ *   zone: myZone,
+ *   schema: new URL("file:///path/to/api-schema.json"),
+ * });
+ *
+ * const withLogging = await APIShield("api-logging", {
+ *   zone: myZone,
+ *   schema: schema,
+ *   defaultAction: "log"
+ * });
+ *
+ * @example
+ * ## Protect critical endpoints with blanket mitigations
+ *
+ * Apply mitigations to entire paths or specific methods (requires paid plan)
+ *
+ * const schema = await APISchema("my-schema", {
+ *   zone: myZone,
+ *   schema: new URL("file:///path/to/api-schema.json"),
+ * });
+ *
+ * const protection = await APIShield("api-protection", {
+ *   zone: myZone,
+ *   schema: schema,
+ *   defaultAction: "log",
+ *   mitigations: {
+ *     "/admin": "block",              // Block all methods on admin endpoints
+ *     "/payments": {
+ *       post: "block",                // Block payment creation
+ *       put: "block"                  // Block payment updates
+ *     },
+ *     "/users/{id}": {
+ *       delete: "block"               // Block user deletion
+ *     },
+ *     "/public": "none",              // Allow all methods on public endpoints
+ *     "/products": "none"             // Allow all methods on products
+ *   }
+ * });
+ *
+ * @see https://developers.cloudflare.com/api-shield/security/schema-validation/
+ */
+export declare function APIShield<S extends string | URL | OpenAPIV3.Document>(id: string, props: APIShieldProps<S>): Promise<APIShield<S extends string | URL ? OpenAPIV3.Document : S>>;
+/**
+ * Get global schema validation settings for a zone
+ */
+export declare function getGlobalSettingsForZone(api: CloudflareApi, zoneId: string): Promise<CloudflareGlobalSettings>;
+export interface CloudflareGlobalSettings {
+    validation_default_mitigation_action: APIMitigation;
+    validation_override_mitigation_action?: APIMitigation;
+}
+/**
+ * Extract operations from an OpenAPI schema
+ */
+export declare function parseSchemaOperations(schema: OpenAPIV3.Document): Array<{
+    method: string;
+    endpoint: string;
+    operationId?: string;
+    host: string;
+}>;
+//# sourceMappingURL=api-shield.d.ts.map

package/lib/cloudflare/api-shield.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-shield.d.ts","sourceRoot":"","sources":["../../src/cloudflare/api-shield.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC1B,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGtC;;GAEG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,QAAQ,CACzE,SAAQ,oBAAoB;IAC5B;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8DG;IACH,MAAM,EAAE,CAAC,CAAC;IAEV;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,CAAC,SAAS,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAE9E;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,aAAa,CAAC;IAElC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,aAAa,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,iBAAiB,EAAE,aAAa,CAAC;IAEjC;;OAEG;IACH,kBAAkB,CAAC,EAAE,aAAa,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,SAAS,CAAC,CAAC,SAAS,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAC1E,SAAQ,QAAQ,CAAC,uBAAuB,CAAC;IACzC;;OAEG;IACH,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAErB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2LG;AACH,wBAAsB,SAAS,CAAC,CAAC,SAAS,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,QAAQ,EACzE,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,GACvB,OAAO,CAAC,SAAS,CAAC,CAAC,SAAS,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAOrE;AAwHD;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,CAAC,CAEnC;AAID,MAAM,WAAW,wBAAwB;IACvC,oCAAoC,EAAE,aAAa,CAAC;IACpD,qCAAqC,CAAC,EAAE,aAAa,CAAC;CACvD;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,GAAG,KAAK,CAAC;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAmDD"}