@codeam/shared 2.61.65 → 2.61.67

package/dist/index.mjs

@@ -1065,11 +1065,12 @@ var INTEGRATION_REGISTRY = {
     name: "Figma",
     icon: "figma",
     category: "design",
-    // DARK — pending Figma's OAuth-app review approval (submitted 2026-07-16).
-    // Figma OAuth apps do NOT exist publicly until review passes (authorize URL
-    // errors "OAuth app ... doesn't exist"). Backend provider + secrets are
-    // already deployed; flip to true once approved (bead codeagent-m4ix).
-    enabled: false,
+    // LIVE. OAuth is the PRIMARY flow (app pending Figma's review — until it
+    // passes the authorize URL errors "OAuth app doesn't exist"), so a PAT
+    // fallback (`apiKeyFallback`) ships alongside it and works TODAY: the user
+    // pastes a Figma personal access token. Same OAuth-primary + PAT-secondary
+    // shape as GitHub. Flip of the OAuth review is transparent (bead codeagent-m4ix).
+    enabled: true,
     auth: {
       kind: "oauth_redirect",
       // Granular READ-ONLY scopes (legacy `files:read` is deprecated for
@@ -1083,7 +1084,25 @@ var INTEGRATION_REGISTRY = {
         "file_metadata:read",
         "file_dev_resources:read",
         "library_content:read"
-      ]
+      ],
+      // SECONDARY: paste a Figma personal access token instead of OAuth. The
+      // PAT uses the `X-Figma-Token` header, so the delivery env var differs
+      // from OAuth (`FIGMA_API_KEY` vs `FIGMA_OAUTH_TOKEN`) — hence its own
+      // envMapping, used when the credential was linked via PAT.
+      apiKeyFallback: {
+        fields: [
+          {
+            key: "accessToken",
+            label: "Figma personal access token",
+            placeholder: "figd_\u2026",
+            secret: true,
+            help: "Figma \u2192 Settings \u2192 Security \u2192 Personal access tokens (read-only scopes)."
+          }
+        ],
+        envMapping: {
+          FIGMA_API_KEY: "accessToken"
+        }
+      }
     },
     delivery: {
       mcp: {
@@ -1431,6 +1450,92 @@ var INTEGRATION_REGISTRY = {
         staticEnv: { ATLASSIAN_OAUTH_ENABLE: "true" }
       }
     }
+  },
+  cloudflare: {
+    id: "cloudflare",
+    name: "Cloudflare",
+    icon: "cloudflare",
+    category: "deployment",
+    // LIVE — Cloudflare self-managed OAuth (dash.cloudflare.com OAuth server,
+    // the same one Wrangler uses). Confidential (Client Secret POST). The agent
+    // inspects/deploys Workers, Pages, DNS, KV, R2 + reads analytics/logs on the
+    // user's account. CLOUDFLARE_OAUTH_CLIENT_ID/SECRET/REDIRECT_URI in Secret
+    // Manager (prod+dev); the backend CloudflareOAuthProvider is config-gated (503).
+    enabled: true,
+    auth: {
+      kind: "oauth_redirect",
+      // Cloudflare OAuth scope IDs == API-token permission-group names (dot
+      // form, e.g. `workers-scripts.write`). ⚠️ MUST exactly match the scopes
+      // configured on the OAuth client (b2b4b87e…). `offline_access` → refresh.
+      scopes: [
+        // Developer Platform (Workers / Pages / KV / R2 / D1 / observability)
+        "d1.read",
+        "page.read",
+        "page.write",
+        "workers-ci.read",
+        "workers-ci.write",
+        "containers.read",
+        "containers.write",
+        "workers-kv-storage.read",
+        "workers-kv-storage.write",
+        "workers-observability.read",
+        "workers-observability-telemetry.write",
+        "workers-observability.write",
+        "r2-catalog.read",
+        "r2-catalog.write",
+        "r2-catalog-sql.read",
+        "workers-r2-bucket-item.read",
+        "workers-r2-bucket-item.write",
+        "workers-r2.read",
+        "workers-r2.write",
+        "workers-routes.read",
+        "workers-routes.write",
+        "workers-scripts.read",
+        "workers-scripts.write",
+        "workers-tail.read",
+        // DNS & Zones
+        "account-dns-settings.read",
+        "account-dns-settings.write",
+        "dns-firewall.read",
+        "dns-firewall.write",
+        "dns.read",
+        "dns-view.read",
+        "dns.write",
+        "registrar-domains.admin",
+        "registrar-sandbox-domains.admin",
+        "zone-dns-settings.read",
+        "zone-dns-settings.write",
+        "zone.read",
+        "zone-settings.read",
+        "zone-settings.write",
+        // Analytics & Logs
+        "account-analytics.read",
+        "analytics.read",
+        "account-logs.read",
+        "logs.read",
+        "radar.read",
+        // Account & Billing
+        "account-api-gateway.read",
+        "account-settings.read",
+        "memberships.read",
+        "notifications.read",
+        "user-details.read",
+        "offline_access"
+      ]
+    },
+    delivery: {
+      mcp: {
+        // Headless stdio Cloudflare MCP (Cloudflare API v4) — BYO token via env,
+        // the OAuth access token works as a Bearer against api.cloudflare.com.
+        // The account id is the discriminator for account-level ops. PINNED.
+        command: "npx",
+        args: ["-y", "@itunified.io/mcp-cloudflare@2026.4.10-1"],
+        envMapping: {
+          CLOUDFLARE_API_TOKEN: "accessToken",
+          CLOUDFLARE_ACCOUNT_ID: "accountId"
+        }
+      }
+    }
   }
 };
 function getEnabledIntegrations() {
@@ -1655,6 +1760,14 @@ var INTEGRATION_BRANDING = {
     brandColor: "#3FCF8E",
     logoSvg: '<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Supabase</title><path fill="#FFFFFF" d="M11.9 1.036c-.015-.986-1.26-1.41-1.874-.637L.764 12.05C-.33 13.427.65 15.455 2.409 15.455h9.579l.113 7.51c.014.985 1.259 1.408 1.873.636l9.262-11.653c1.093-1.375.113-3.403-1.645-3.403h-9.642z"/></svg>'
   },
+  cloudflare: {
+    id: "cloudflare",
+    name: "Cloudflare",
+    vendor: "Cloudflare",
+    tagline: "Workers, Pages, DNS & R2",
+    brandColor: "#F6821F",
+    logoSvg: '<svg role="img" viewBox="0 0 460 271.2" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><title>Cloudflare</title><path fill="#FBAD41" d="M328.6,125.6c-0.8,0-1.5,0.6-1.8,1.4l-4.8,16.7c-2.1,7.2-1.3,13.8,2.2,18.7c3.2,4.5,8.6,7.1,15.1,7.4l26.2,1.6c0.8,0,1.5,0.4,1.9,1c0.4,0.6,0.5,1.5,0.3,2.2c-0.4,1.2-1.6,2.1-2.9,2.2l-27.3,1.6c-14.8,0.7-30.7,12.6-36.3,27.2l-2,5.1c-0.4,1,0.3,2,1.4,2h93.8c1.1,0,2.1-0.7,2.4-1.8c1.6-5.8,2.5-11.9,2.5-18.2c0-37-30.2-67.2-67.3-67.2C330.9,125.5,329.7,125.5,328.6,125.6z"/><path fill="#F6821F" d="M292.8,204.4c2.1-7.2,1.3-13.8-2.2-18.7c-3.2-4.5-8.6-7.1-15.1-7.4l-123.1-1.6c-0.8,0-1.5-0.4-1.9-1s-0.5-1.4-0.3-2.2c0.4-1.2,1.6-2.1,2.9-2.2l124.2-1.6c14.7-0.7,30.7-12.6,36.3-27.2l7.1-18.5c0.3-0.8,0.4-1.6,0.2-2.4c-8-36.2-40.3-63.2-78.9-63.2c-35.6,0-65.8,23-76.6,54.9c-7-5.2-15.9-8-25.5-7.1c-17.1,1.7-30.8,15.4-32.5,32.5c-0.4,4.4-0.1,8.7,0.9,12.7c-27.9,0.8-50.2,23.6-50.2,51.7c0,2.5,0.2,5,0.5,7.5c0.2,1.2,1.2,2.1,2.4,2.1h227.2c1.3,0,2.5-0.9,2.9-2.2L292.8,204.4z"/></svg>'
+  },
   asana: {
     id: "asana",
     name: "Asana",
@@ -1730,7 +1843,6 @@ var INTEGRATION_BRANDING = {
 };
 var UPCOMING_INTEGRATION_IDS = [
   "gmail",
-  "figma",
   "asana",
   "stripe",
   "pendo",