@codeam/shared 2.61.65 → 2.61.67

package/dist/index.d.mts

@@ -351,7 +351,7 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel' | 'supabase' | 'confluence';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel' | 'supabase' | 'confluence' | 'cloudflare';
 /**
  * `derived` = no link flow of its own: the credential is BORROWED live from a
  * connection the user already made elsewhere (see `derivedFrom`). The backend
@@ -469,6 +469,18 @@ interface IntegrationDefinition {
          *  resolves the credential by delegating to the source integration, and the
          *  client renders it as "part of <source>" with no Connect action of its own. */
         aliasOf?: IntegrationId;
+        /** SECONDARY api-key / PAT path for a PRIMARY OAuth integration. OAuth
+         *  (`kind`) stays the primary/preferred flow; this lets the user paste a
+         *  personal access token instead — a fallback while the vendor's OAuth app
+         *  is in review, or a permanent alternative (like GitHub OAuth + PAT).
+         *  ⚠️ The PAT often needs a DIFFERENT delivery env var than the OAuth token
+         *  (e.g. Figma: OAuth → `FIGMA_OAUTH_TOKEN`/Bearer, PAT →
+         *  `FIGMA_API_KEY`/`X-Figma-Token`), so it carries its OWN `envMapping` used
+         *  INSTEAD of `delivery.mcp.envMapping` when the credential was linked via PAT. */
+        apiKeyFallback?: {
+            fields: IntegrationApiKeyField[];
+            envMapping: Record<string, string>;
+        };
     };
     delivery: IntegrationDelivery;
 }
@@ -528,6 +540,11 @@ interface BrokeredIntegrationToken {
     secretKey?: string;
     /** Project/workspace id some analytics APIs require (Mixpanel project id). */
     projectId?: string;
+    /** Cloudflare account id — the Cloudflare MCP needs it alongside the OAuth
+     *  access token (`CLOUDFLARE_ACCOUNT_ID` + `CLOUDFLARE_API_TOKEN`) for
+     *  account-level operations. Captured at link time from `GET /accounts`.
+     *  Absent for non-Cloudflare integrations. */
+    accountId?: string;
 }
 
 /**
@@ -575,7 +592,7 @@ interface IntegrationBranding {
     logoSvg: string;
 }
 declare const INTEGRATION_BRANDING: Record<string, IntegrationBranding>;
-declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "figma", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
+declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
 declare function getIntegrationBranding(id: string): IntegrationBranding | null;
 
 /**

package/dist/index.d.ts

@@ -351,7 +351,7 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel' | 'supabase' | 'confluence';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel' | 'supabase' | 'confluence' | 'cloudflare';
 /**
  * `derived` = no link flow of its own: the credential is BORROWED live from a
  * connection the user already made elsewhere (see `derivedFrom`). The backend
@@ -469,6 +469,18 @@ interface IntegrationDefinition {
          *  resolves the credential by delegating to the source integration, and the
          *  client renders it as "part of <source>" with no Connect action of its own. */
         aliasOf?: IntegrationId;
+        /** SECONDARY api-key / PAT path for a PRIMARY OAuth integration. OAuth
+         *  (`kind`) stays the primary/preferred flow; this lets the user paste a
+         *  personal access token instead — a fallback while the vendor's OAuth app
+         *  is in review, or a permanent alternative (like GitHub OAuth + PAT).
+         *  ⚠️ The PAT often needs a DIFFERENT delivery env var than the OAuth token
+         *  (e.g. Figma: OAuth → `FIGMA_OAUTH_TOKEN`/Bearer, PAT →
+         *  `FIGMA_API_KEY`/`X-Figma-Token`), so it carries its OWN `envMapping` used
+         *  INSTEAD of `delivery.mcp.envMapping` when the credential was linked via PAT. */
+        apiKeyFallback?: {
+            fields: IntegrationApiKeyField[];
+            envMapping: Record<string, string>;
+        };
     };
     delivery: IntegrationDelivery;
 }
@@ -528,6 +540,11 @@ interface BrokeredIntegrationToken {
     secretKey?: string;
     /** Project/workspace id some analytics APIs require (Mixpanel project id). */
     projectId?: string;
+    /** Cloudflare account id — the Cloudflare MCP needs it alongside the OAuth
+     *  access token (`CLOUDFLARE_ACCOUNT_ID` + `CLOUDFLARE_API_TOKEN`) for
+     *  account-level operations. Captured at link time from `GET /accounts`.
+     *  Absent for non-Cloudflare integrations. */
+    accountId?: string;
 }
 
 /**
@@ -575,7 +592,7 @@ interface IntegrationBranding {
     logoSvg: string;
 }
 declare const INTEGRATION_BRANDING: Record<string, IntegrationBranding>;
-declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "figma", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
+declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
 declare function getIntegrationBranding(id: string): IntegrationBranding | null;
 
 /**

package/dist/index.js

@@ -1147,11 +1147,12 @@ var INTEGRATION_REGISTRY = {
     name: "Figma",
     icon: "figma",
     category: "design",
-    // DARK — pending Figma's OAuth-app review approval (submitted 2026-07-16).
-    // Figma OAuth apps do NOT exist publicly until review passes (authorize URL
-    // errors "OAuth app ... doesn't exist"). Backend provider + secrets are
-    // already deployed; flip to true once approved (bead codeagent-m4ix).
-    enabled: false,
+    // LIVE. OAuth is the PRIMARY flow (app pending Figma's review — until it
+    // passes the authorize URL errors "OAuth app doesn't exist"), so a PAT
+    // fallback (`apiKeyFallback`) ships alongside it and works TODAY: the user
+    // pastes a Figma personal access token. Same OAuth-primary + PAT-secondary
+    // shape as GitHub. Flip of the OAuth review is transparent (bead codeagent-m4ix).
+    enabled: true,
     auth: {
       kind: "oauth_redirect",
       // Granular READ-ONLY scopes (legacy `files:read` is deprecated for
@@ -1165,7 +1166,25 @@ var INTEGRATION_REGISTRY = {
         "file_metadata:read",
         "file_dev_resources:read",
         "library_content:read"
-      ]
+      ],
+      // SECONDARY: paste a Figma personal access token instead of OAuth. The
+      // PAT uses the `X-Figma-Token` header, so the delivery env var differs
+      // from OAuth (`FIGMA_API_KEY` vs `FIGMA_OAUTH_TOKEN`) — hence its own
+      // envMapping, used when the credential was linked via PAT.
+      apiKeyFallback: {
+        fields: [
+          {
+            key: "accessToken",
+            label: "Figma personal access token",
+            placeholder: "figd_\u2026",
+            secret: true,
+            help: "Figma \u2192 Settings \u2192 Security \u2192 Personal access tokens (read-only scopes)."
+          }
+        ],
+        envMapping: {
+          FIGMA_API_KEY: "accessToken"
+        }
+      }
     },
     delivery: {
       mcp: {
@@ -1513,6 +1532,92 @@ var INTEGRATION_REGISTRY = {
         staticEnv: { ATLASSIAN_OAUTH_ENABLE: "true" }
       }
     }
+  },
+  cloudflare: {
+    id: "cloudflare",
+    name: "Cloudflare",
+    icon: "cloudflare",
+    category: "deployment",
+    // LIVE — Cloudflare self-managed OAuth (dash.cloudflare.com OAuth server,
+    // the same one Wrangler uses). Confidential (Client Secret POST). The agent
+    // inspects/deploys Workers, Pages, DNS, KV, R2 + reads analytics/logs on the
+    // user's account. CLOUDFLARE_OAUTH_CLIENT_ID/SECRET/REDIRECT_URI in Secret
+    // Manager (prod+dev); the backend CloudflareOAuthProvider is config-gated (503).
+    enabled: true,
+    auth: {
+      kind: "oauth_redirect",
+      // Cloudflare OAuth scope IDs == API-token permission-group names (dot
+      // form, e.g. `workers-scripts.write`). ⚠️ MUST exactly match the scopes
+      // configured on the OAuth client (b2b4b87e…). `offline_access` → refresh.
+      scopes: [
+        // Developer Platform (Workers / Pages / KV / R2 / D1 / observability)
+        "d1.read",
+        "page.read",
+        "page.write",
+        "workers-ci.read",
+        "workers-ci.write",
+        "containers.read",
+        "containers.write",
+        "workers-kv-storage.read",
+        "workers-kv-storage.write",
+        "workers-observability.read",
+        "workers-observability-telemetry.write",
+        "workers-observability.write",
+        "r2-catalog.read",
+        "r2-catalog.write",
+        "r2-catalog-sql.read",
+        "workers-r2-bucket-item.read",
+        "workers-r2-bucket-item.write",
+        "workers-r2.read",
+        "workers-r2.write",
+        "workers-routes.read",
+        "workers-routes.write",
+        "workers-scripts.read",
+        "workers-scripts.write",
+        "workers-tail.read",
+        // DNS & Zones
+        "account-dns-settings.read",
+        "account-dns-settings.write",
+        "dns-firewall.read",
+        "dns-firewall.write",
+        "dns.read",
+        "dns-view.read",
+        "dns.write",
+        "registrar-domains.admin",
+        "registrar-sandbox-domains.admin",
+        "zone-dns-settings.read",
+        "zone-dns-settings.write",
+        "zone.read",
+        "zone-settings.read",
+        "zone-settings.write",
+        // Analytics & Logs
+        "account-analytics.read",
+        "analytics.read",
+        "account-logs.read",
+        "logs.read",
+        "radar.read",
+        // Account & Billing
+        "account-api-gateway.read",
+        "account-settings.read",
+        "memberships.read",
+        "notifications.read",
+        "user-details.read",
+        "offline_access"
+      ]
+    },
+    delivery: {
+      mcp: {
+        // Headless stdio Cloudflare MCP (Cloudflare API v4) — BYO token via env,
+        // the OAuth access token works as a Bearer against api.cloudflare.com.
+        // The account id is the discriminator for account-level ops. PINNED.
+        command: "npx",
+        args: ["-y", "@itunified.io/mcp-cloudflare@2026.4.10-1"],
+        envMapping: {
+          CLOUDFLARE_API_TOKEN: "accessToken",
+          CLOUDFLARE_ACCOUNT_ID: "accountId"
+        }
+      }
+    }
   }
 };
 function getEnabledIntegrations() {
@@ -1737,6 +1842,14 @@ var INTEGRATION_BRANDING = {
     brandColor: "#3FCF8E",
     logoSvg: '<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Supabase</title><path fill="#FFFFFF" d="M11.9 1.036c-.015-.986-1.26-1.41-1.874-.637L.764 12.05C-.33 13.427.65 15.455 2.409 15.455h9.579l.113 7.51c.014.985 1.259 1.408 1.873.636l9.262-11.653c1.093-1.375.113-3.403-1.645-3.403h-9.642z"/></svg>'
   },
+  cloudflare: {
+    id: "cloudflare",
+    name: "Cloudflare",
+    vendor: "Cloudflare",
+    tagline: "Workers, Pages, DNS & R2",
+    brandColor: "#F6821F",
+    logoSvg: '<svg role="img" viewBox="0 0 460 271.2" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><title>Cloudflare</title><path fill="#FBAD41" d="M328.6,125.6c-0.8,0-1.5,0.6-1.8,1.4l-4.8,16.7c-2.1,7.2-1.3,13.8,2.2,18.7c3.2,4.5,8.6,7.1,15.1,7.4l26.2,1.6c0.8,0,1.5,0.4,1.9,1c0.4,0.6,0.5,1.5,0.3,2.2c-0.4,1.2-1.6,2.1-2.9,2.2l-27.3,1.6c-14.8,0.7-30.7,12.6-36.3,27.2l-2,5.1c-0.4,1,0.3,2,1.4,2h93.8c1.1,0,2.1-0.7,2.4-1.8c1.6-5.8,2.5-11.9,2.5-18.2c0-37-30.2-67.2-67.3-67.2C330.9,125.5,329.7,125.5,328.6,125.6z"/><path fill="#F6821F" d="M292.8,204.4c2.1-7.2,1.3-13.8-2.2-18.7c-3.2-4.5-8.6-7.1-15.1-7.4l-123.1-1.6c-0.8,0-1.5-0.4-1.9-1s-0.5-1.4-0.3-2.2c0.4-1.2,1.6-2.1,2.9-2.2l124.2-1.6c14.7-0.7,30.7-12.6,36.3-27.2l7.1-18.5c0.3-0.8,0.4-1.6,0.2-2.4c-8-36.2-40.3-63.2-78.9-63.2c-35.6,0-65.8,23-76.6,54.9c-7-5.2-15.9-8-25.5-7.1c-17.1,1.7-30.8,15.4-32.5,32.5c-0.4,4.4-0.1,8.7,0.9,12.7c-27.9,0.8-50.2,23.6-50.2,51.7c0,2.5,0.2,5,0.5,7.5c0.2,1.2,1.2,2.1,2.4,2.1h227.2c1.3,0,2.5-0.9,2.9-2.2L292.8,204.4z"/></svg>'
+  },
   asana: {
     id: "asana",
     name: "Asana",
@@ -1812,7 +1925,6 @@ var INTEGRATION_BRANDING = {
 };
 var UPCOMING_INTEGRATION_IDS = [
   "gmail",
-  "figma",
   "asana",
   "stripe",
   "pendo",