cloudflare 6.2.0 → 6.4.0

package/src/resources/zero-trust/identity-providers/index.ts

@@ -16,4 +16,9 @@ export {
   type IdentityProviderDeleteParams,
   type IdentityProviderGetParams,
 } from './identity-providers';
+export {
+  SAMLCertificate,
+  type SAMLCertificateCreateResponse,
+  type SAMLCertificateCreateParams,
+} from './saml-certificate';
 export { SCIM } from './scim/index';

package/src/resources/zero-trust/identity-providers/saml-certificate.ts

@@ -0,0 +1,119 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../../resource';
+import * as Core from '../../../core';
+
+export class SAMLCertificate extends APIResource {
+  /**
+   * Creates a new SAML encryption certificate set and assigns it to the specified
+   * SAML Identity Provider. This endpoint is idempotent - if the IdP already has a
+   * certificate set assigned, the existing certificate set is returned with a 200
+   * status.
+   *
+   * **Workflow for enabling SAML encryption:**
+   *
+   * 1. Call this endpoint to create and assign a certificate set to the IdP
+   * 2. Update the IdP configuration (PUT `/identity_providers/{id}`) with:
+   *    - `config.enable_encryption: true`
+   *    - `saml_certificate_set_id: <uid from step 1>`
+   * 3. Configure the certificate's public key in your external SAML Identity
+   *    Provider
+   *
+   * @example
+   * ```ts
+   * const samlCertificate =
+   *   await client.zeroTrust.identityProviders.samlCertificate.create(
+   *     'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
+   *     { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
+   *   );
+   * ```
+   */
+  create(
+    identityProviderId: string,
+    params: SAMLCertificateCreateParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<SAMLCertificateCreateResponse> {
+    const { account_id } = params;
+    return (
+      this._client.post(
+        `/accounts/${account_id}/access/identity_providers/${identityProviderId}/saml_certificate`,
+        options,
+      ) as Core.APIPromise<{ result: SAMLCertificateCreateResponse }>
+    )._thenUnwrap((obj) => obj.result);
+  }
+}
+
+/**
+ * A SAML encryption certificate set containing current and optionally previous
+ * certificates for encryption key rotation.
+ */
+export interface SAMLCertificateCreateResponse {
+  /**
+   * Timestamp when the certificate set was created
+   */
+  created_at: string;
+
+  /**
+   * Unique identifier for the certificate set
+   */
+  uid: string;
+
+  /**
+   * Timestamp when the certificate set was last updated (e.g., during rotation)
+   */
+  updated_at: string;
+
+  /**
+   * The currently active certificate used for encrypting SAML assertions
+   */
+  current_certificate?: SAMLCertificateCreateResponse.CurrentCertificate;
+
+  /**
+   * The previous certificate, maintained during rotation to ensure continuity. Null
+   * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+   */
+  previous_certificate?: unknown | null;
+}
+
+export namespace SAMLCertificateCreateResponse {
+  /**
+   * The currently active certificate used for encrypting SAML assertions
+   */
+  export interface CurrentCertificate {
+    /**
+     * Indicates whether this is the currently active certificate
+     */
+    is_current: boolean;
+
+    /**
+     * Certificate expiration date. Certificates are automatically rotated 30 days
+     * before expiration.
+     */
+    not_after: string;
+
+    /**
+     * PEM-encoded X.509 certificate containing the public key. Configure this
+     * certificate in your external SAML Identity Provider to enable encryption.
+     */
+    public_certificate: string;
+
+    /**
+     * Unique identifier for the certificate
+     */
+    uid: string;
+  }
+}
+
+export interface SAMLCertificateCreateParams {
+  /**
+   * Identifier.
+   */
+  account_id: string;
+}
+
+export declare namespace SAMLCertificate {
+  export {
+    type SAMLCertificateCreateResponse as SAMLCertificateCreateResponse,
+    type SAMLCertificateCreateParams as SAMLCertificateCreateParams,
+  };
+}

package/src/resources/zero-trust/networks/hostname-routes.ts

@@ -159,6 +159,11 @@ export interface HostnameRoute {
    */
   hostname?: string;
 
+  /**
+   * The type of tunnel.
+   */
+  tun_type?: 'cfd_tunnel' | 'warp_connector' | 'warp' | 'magic' | 'ip_sec' | 'gre' | 'cni';
+
   /**
    * UUID of the tunnel.
    */

package/src/resources/zero-trust/organizations/organizations.ts

@@ -281,7 +281,9 @@ export interface Organization {
   /**
    * Determines whether global MFA settings apply to applications by default. The
    * organization must have MFA enabled with at least one authentication method and a
-   * session duration configured.
+   * session duration configured. Note: 'allowed_authenticators' cannot only contain
+   * 'ssh_piv_key' if the organization has any non-infrastructure applications
+   * because PIV keys are only compatible with infrastructure apps.
    */
   mfa_required_for_all_apps?: boolean;
 
@@ -481,7 +483,9 @@ export interface OrganizationCreateParams {
   /**
    * Body param: Determines whether global MFA settings apply to applications by
    * default. The organization must have MFA enabled with at least one authentication
-   * method and a session duration configured.
+   * method and a session duration configured. Note: 'allowed_authenticators' cannot
+   * only contain 'ssh_piv_key' if the organization has any non-infrastructure
+   * applications because PIV keys are only compatible with infrastructure apps.
    */
   mfa_required_for_all_apps?: boolean;
 
@@ -663,7 +667,9 @@ export interface OrganizationUpdateParams {
   /**
    * Body param: Determines whether global MFA settings apply to applications by
    * default. The organization must have MFA enabled with at least one authentication
-   * method and a session duration configured.
+   * method and a session duration configured. Note: 'allowed_authenticators' cannot
+   * only contain 'ssh_piv_key' if the organization has any non-infrastructure
+   * applications because PIV keys are only compatible with infrastructure apps.
    */
   mfa_required_for_all_apps?: boolean;
 

package/src/resources/zero-trust/tunnels/warp-connector/configurations.ts

@@ -0,0 +1,293 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../../../resource';
+import * as Core from '../../../../core';
+
+export class Configurations extends APIResource {
+  /**
+   * Adds or updates the high-availability configuration for a WARP Connector tunnel.
+   *
+   * @example
+   * ```ts
+   * const configuration =
+   *   await client.zeroTrust.tunnels.warpConnector.configurations.update(
+   *     'f70ff985-a4ef-4643-bbbc-4a0ed4fc8415',
+   *     {
+   *       account_id: '023e105f4ecef8ad9ca31a8372d0c353',
+   *       ha_mode: 'aws',
+   *     },
+   *   );
+   * ```
+   */
+  update(
+    tunnelId: string,
+    params: ConfigurationUpdateParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<ConfigurationUpdateResponse> {
+    const { account_id, ...body } = params;
+    return (
+      this._client.put(`/accounts/${account_id}/warp_connector/${tunnelId}/configurations`, {
+        body,
+        ...options,
+      }) as Core.APIPromise<{ result: ConfigurationUpdateResponse }>
+    )._thenUnwrap((obj) => obj.result);
+  }
+
+  /**
+   * Gets the high-availability configuration for a WARP Connector tunnel.
+   *
+   * @example
+   * ```ts
+   * const configuration =
+   *   await client.zeroTrust.tunnels.warpConnector.configurations.get(
+   *     'f70ff985-a4ef-4643-bbbc-4a0ed4fc8415',
+   *     { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
+   *   );
+   * ```
+   */
+  get(
+    tunnelId: string,
+    params: ConfigurationGetParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<ConfigurationGetResponse> {
+    const { account_id } = params;
+    return (
+      this._client.get(
+        `/accounts/${account_id}/warp_connector/${tunnelId}/configurations`,
+        options,
+      ) as Core.APIPromise<{ result: ConfigurationGetResponse }>
+    )._thenUnwrap((obj) => obj.result);
+  }
+}
+
+export interface ConfigurationUpdateResponse {
+  /**
+   * Monotonically increasing configuration version, incremented on each PUT.
+   */
+  configuration_version: number;
+
+  /**
+   * Timestamp of when the resource was created.
+   */
+  created_at: string;
+
+  /**
+   * High-availability mode for the WARP Connector tunnel. `none` means HA is enabled
+   * but no provider is configured yet (newly created tunnels default to this).
+   * `disabled` means HA is explicitly turned off. `aws` uses AWS ENI move for
+   * failover. `local` uses virtual IPs (VIPs) on the local interface.
+   */
+  ha_mode: 'none' | 'disabled' | 'aws' | 'local';
+
+  /**
+   * UUID of the tunnel.
+   */
+  tunnel_id: string;
+
+  /**
+   * Provider-specific configuration. Present for `aws` and `local` modes.
+   */
+  config?:
+    | ConfigurationUpdateResponse.TunnelMeshAwsConfig
+    | ConfigurationUpdateResponse.TunnelMeshLocalConfig
+    | null;
+
+  /**
+   * Timestamp of the last update. Null if never updated.
+   */
+  updated_at?: string | null;
+}
+
+export namespace ConfigurationUpdateResponse {
+  export interface TunnelMeshAwsConfig {
+    /**
+     * Floating Network Resource ID — the secondary ENI that is moved between nodes on
+     * failover.
+     */
+    fnr_id: string;
+  }
+
+  export interface TunnelMeshLocalConfig {
+    /**
+     * VIPs to assign on the CloudflareWARP interface.
+     */
+    vips: Array<TunnelMeshLocalConfig.Vip>;
+
+    /**
+     * VIPs to clean up on demotion or version drift.
+     */
+    vips_previous?: Array<TunnelMeshLocalConfig.VipsPrevious>;
+  }
+
+  export namespace TunnelMeshLocalConfig {
+    export interface Vip {
+      /**
+       * Virtual IP address (IPv4 or IPv6).
+       */
+      address: string;
+    }
+
+    export interface VipsPrevious {
+      /**
+       * Virtual IP address (IPv4 or IPv6).
+       */
+      address: string;
+    }
+  }
+}
+
+export interface ConfigurationGetResponse {
+  /**
+   * Monotonically increasing configuration version, incremented on each PUT.
+   */
+  configuration_version: number;
+
+  /**
+   * Timestamp of when the resource was created.
+   */
+  created_at: string;
+
+  /**
+   * High-availability mode for the WARP Connector tunnel. `none` means HA is enabled
+   * but no provider is configured yet (newly created tunnels default to this).
+   * `disabled` means HA is explicitly turned off. `aws` uses AWS ENI move for
+   * failover. `local` uses virtual IPs (VIPs) on the local interface.
+   */
+  ha_mode: 'none' | 'disabled' | 'aws' | 'local';
+
+  /**
+   * UUID of the tunnel.
+   */
+  tunnel_id: string;
+
+  /**
+   * Provider-specific configuration. Present for `aws` and `local` modes.
+   */
+  config?:
+    | ConfigurationGetResponse.TunnelMeshAwsConfig
+    | ConfigurationGetResponse.TunnelMeshLocalConfig
+    | null;
+
+  /**
+   * Timestamp of the last update. Null if never updated.
+   */
+  updated_at?: string | null;
+}
+
+export namespace ConfigurationGetResponse {
+  export interface TunnelMeshAwsConfig {
+    /**
+     * Floating Network Resource ID — the secondary ENI that is moved between nodes on
+     * failover.
+     */
+    fnr_id: string;
+  }
+
+  export interface TunnelMeshLocalConfig {
+    /**
+     * VIPs to assign on the CloudflareWARP interface.
+     */
+    vips: Array<TunnelMeshLocalConfig.Vip>;
+
+    /**
+     * VIPs to clean up on demotion or version drift.
+     */
+    vips_previous?: Array<TunnelMeshLocalConfig.VipsPrevious>;
+  }
+
+  export namespace TunnelMeshLocalConfig {
+    export interface Vip {
+      /**
+       * Virtual IP address (IPv4 or IPv6).
+       */
+      address: string;
+    }
+
+    export interface VipsPrevious {
+      /**
+       * Virtual IP address (IPv4 or IPv6).
+       */
+      address: string;
+    }
+  }
+}
+
+export interface ConfigurationUpdateParams {
+  /**
+   * Path param: Identifier.
+   */
+  account_id: string;
+
+  /**
+   * Body param: High-availability mode for the WARP Connector tunnel. `none` means
+   * HA is enabled but no provider is configured yet (newly created tunnels default
+   * to this). `disabled` means HA is explicitly turned off. `aws` uses AWS ENI move
+   * for failover. `local` uses virtual IPs (VIPs) on the local interface.
+   */
+  ha_mode: 'none' | 'disabled' | 'aws' | 'local';
+
+  /**
+   * Body param: Provider-specific configuration. Required shape depends on ha_mode.
+   * For `aws`, must contain `fnr_id`. For `local`, must contain `vips`. For `none`
+   * and `disabled`, must be empty or omitted.
+   */
+  config?:
+    | ConfigurationUpdateParams.TunnelMeshAwsConfig
+    | ConfigurationUpdateParams.TunnelMeshLocalConfig
+    | unknown
+    | null;
+}
+
+export namespace ConfigurationUpdateParams {
+  export interface TunnelMeshAwsConfig {
+    /**
+     * Floating Network Resource ID — the secondary ENI that is moved between nodes on
+     * failover.
+     */
+    fnr_id: string;
+  }
+
+  export interface TunnelMeshLocalConfig {
+    /**
+     * VIPs to assign on the CloudflareWARP interface.
+     */
+    vips: Array<TunnelMeshLocalConfig.Vip>;
+
+    /**
+     * VIPs to clean up on demotion or version drift.
+     */
+    vips_previous?: Array<TunnelMeshLocalConfig.VipsPrevious>;
+  }
+
+  export namespace TunnelMeshLocalConfig {
+    export interface Vip {
+      /**
+       * Virtual IP address (IPv4 or IPv6).
+       */
+      address: string;
+    }
+
+    export interface VipsPrevious {
+      /**
+       * Virtual IP address (IPv4 or IPv6).
+       */
+      address: string;
+    }
+  }
+}
+
+export interface ConfigurationGetParams {
+  /**
+   * Identifier.
+   */
+  account_id: string;
+}
+
+export declare namespace Configurations {
+  export {
+    type ConfigurationUpdateResponse as ConfigurationUpdateResponse,
+    type ConfigurationGetResponse as ConfigurationGetResponse,
+    type ConfigurationUpdateParams as ConfigurationUpdateParams,
+    type ConfigurationGetParams as ConfigurationGetParams,
+  };
+}

package/src/resources/zero-trust/tunnels/warp-connector/index.ts

@@ -1,5 +1,12 @@
 // File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
+export {
+  Configurations,
+  type ConfigurationUpdateResponse,
+  type ConfigurationGetResponse,
+  type ConfigurationUpdateParams,
+  type ConfigurationGetParams,
+} from './configurations';
 export {
   ConnectionGetResponsesSinglePage,
   Connections,

package/src/resources/zero-trust/tunnels/warp-connector/warp-connector.ts

@@ -2,6 +2,14 @@
 
 import { APIResource } from '../../../../resource';
 import * as Core from '../../../../core';
+import * as ConfigurationsAPI from './configurations';
+import {
+  ConfigurationGetParams,
+  ConfigurationGetResponse,
+  ConfigurationUpdateParams,
+  ConfigurationUpdateResponse,
+  Configurations,
+} from './configurations';
 import * as ConnectionsAPI from './connections';
 import {
   ConnectionGetParams,
@@ -22,6 +30,7 @@ export class WARPConnector extends APIResource {
   connections: ConnectionsAPI.Connections = new ConnectionsAPI.Connections(this._client);
   connectors: ConnectorsAPI.Connectors = new ConnectorsAPI.Connectors(this._client);
   failover: FailoverAPI.Failover = new FailoverAPI.Failover(this._client);
+  configurations: ConfigurationsAPI.Configurations = new ConfigurationsAPI.Configurations(this._client);
 
   /**
    * Creates a new Warp Connector Tunnel in an account.
@@ -841,6 +850,7 @@ WARPConnector.Connections = Connections;
 WARPConnector.ConnectionGetResponsesSinglePage = ConnectionGetResponsesSinglePage;
 WARPConnector.Connectors = Connectors;
 WARPConnector.Failover = Failover;
+WARPConnector.Configurations = Configurations;
 
 export declare namespace WARPConnector {
   export {
@@ -877,4 +887,12 @@ export declare namespace WARPConnector {
     type FailoverUpdateResponse as FailoverUpdateResponse,
     type FailoverUpdateParams as FailoverUpdateParams,
   };
+
+  export {
+    Configurations as Configurations,
+    type ConfigurationUpdateResponse as ConfigurationUpdateResponse,
+    type ConfigurationGetResponse as ConfigurationGetResponse,
+    type ConfigurationUpdateParams as ConfigurationUpdateParams,
+    type ConfigurationGetParams as ConfigurationGetParams,
+  };
 }

package/src/resources/zones/holds.ts

@@ -6,7 +6,7 @@ import * as Core from '../../core';
 export class Holds extends APIResource {
   /**
    * Enforce a zone hold on the zone, blocking the creation and activation of zones
-   * with this zone's hostname.
+   * with this zone's hostname. Zone holds cannot be enabled on CDN-only zones.
    *
    * @example
    * ```ts
@@ -28,6 +28,9 @@ export class Holds extends APIResource {
   /**
    * Stop enforcement of a zone hold on the zone, permanently or temporarily,
    * allowing the creation and activation of zones with this zone's hostname.
+   * Existing zone holds can be removed from CDN-only zones when `hold_after` is not
+   * provided. Active holds are automatically disabled when a zone transitions to
+   * CDN-only mode.
    *
    * @example
    * ```ts
@@ -49,6 +52,9 @@ export class Holds extends APIResource {
   /**
    * Update the `hold_after` and/or `include_subdomains` values on an existing zone
    * hold. The hold is enabled if the `hold_after` date-time value is in the past.
+   * Existing zone holds can be removed from CDN-only zones by setting `hold_after`
+   * to `null`. Other zone hold updates cannot be made on CDN-only zones. Active
+   * holds are automatically disabled when a zone transitions to CDN-only mode.
    *
    * @example
    * ```ts
@@ -118,6 +124,7 @@ export interface HoldDeleteParams {
    * Query param: If `hold_after` is provided, the hold will be temporarily disabled,
    * then automatically re-enabled by the system at the time specified in this
    * RFC3339-formatted timestamp. Otherwise, the hold will be disabled indefinitely.
+   * `hold_after` cannot be provided for CDN-only zones.
    */
   hold_after?: string;
 }
@@ -133,9 +140,10 @@ export interface HoldEditParams {
    * temporarily disabled, then automatically re-enabled by the system at the time
    * specified in this RFC3339-formatted timestamp. A past-dated `hold_after` value
    * will have no effect on an existing, enabled hold. Providing an empty string will
-   * set its value to the current time.
+   * set its value to the current time. Providing `null` will disable the hold
+   * indefinitely.
    */
-  hold_after?: string;
+  hold_after?: string | null;
 
   /**
    * Body param: If `true`, the zone hold will extend to block any subdomain of the

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = '6.2.0'; // x-release-please-version
+export const VERSION = '6.4.0'; // x-release-please-version

package/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "6.2.0";
+export declare const VERSION = "6.4.0";
 //# sourceMappingURL=version.d.ts.map

package/version.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
-exports.VERSION = '6.2.0'; // x-release-please-version
+exports.VERSION = '6.4.0'; // x-release-please-version
 //# sourceMappingURL=version.js.map

package/version.mjs

@@ -1,2 +1,2 @@
-export const VERSION = '6.2.0'; // x-release-please-version
+export const VERSION = '6.4.0'; // x-release-please-version
 //# sourceMappingURL=version.mjs.map