@codeam/shared 2.61.66 → 2.61.68

package/dist/index.d.mts

@@ -351,7 +351,7 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel' | 'supabase' | 'confluence';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel' | 'supabase' | 'confluence' | 'cloudflare';
 /**
  * `derived` = no link flow of its own: the credential is BORROWED live from a
  * connection the user already made elsewhere (see `derivedFrom`). The backend
@@ -380,7 +380,7 @@ type DerivedCredentialSource = 'github';
 /** Grouping used by category-driven surfaces (Start-from-Work-Item picker,
  *  catalog sections). A future tracker integration joins those features with
  *  ZERO feature code — they resolve sources from the registry by category. */
-type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' | 'docs' | 'observability' | 'deployment' | 'automation' | 'analytics' | 'api_tools' | 'database';
+type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' | 'docs' | 'observability' | 'infrastructure' | 'automation' | 'analytics' | 'api_tools' | 'database';
 /**
  * One user-entered field for an `api_key` integration (no browser OAuth — the
  * user pastes credentials directly, e.g. a PAT + an org URL). The mobile form
@@ -540,6 +540,11 @@ interface BrokeredIntegrationToken {
     secretKey?: string;
     /** Project/workspace id some analytics APIs require (Mixpanel project id). */
     projectId?: string;
+    /** Cloudflare account id — the Cloudflare MCP needs it alongside the OAuth
+     *  access token (`CLOUDFLARE_ACCOUNT_ID` + `CLOUDFLARE_API_TOKEN`) for
+     *  account-level operations. Captured at link time from `GET /accounts`.
+     *  Absent for non-Cloudflare integrations. */
+    accountId?: string;
 }
 
 /**

package/dist/index.d.ts

@@ -351,7 +351,7 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel' | 'supabase' | 'confluence';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel' | 'supabase' | 'confluence' | 'cloudflare';
 /**
  * `derived` = no link flow of its own: the credential is BORROWED live from a
  * connection the user already made elsewhere (see `derivedFrom`). The backend
@@ -380,7 +380,7 @@ type DerivedCredentialSource = 'github';
 /** Grouping used by category-driven surfaces (Start-from-Work-Item picker,
  *  catalog sections). A future tracker integration joins those features with
  *  ZERO feature code — they resolve sources from the registry by category. */
-type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' | 'docs' | 'observability' | 'deployment' | 'automation' | 'analytics' | 'api_tools' | 'database';
+type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' | 'docs' | 'observability' | 'infrastructure' | 'automation' | 'analytics' | 'api_tools' | 'database';
 /**
  * One user-entered field for an `api_key` integration (no browser OAuth — the
  * user pastes credentials directly, e.g. a PAT + an org URL). The mobile form
@@ -540,6 +540,11 @@ interface BrokeredIntegrationToken {
     secretKey?: string;
     /** Project/workspace id some analytics APIs require (Mixpanel project id). */
     projectId?: string;
+    /** Cloudflare account id — the Cloudflare MCP needs it alongside the OAuth
+     *  access token (`CLOUDFLARE_ACCOUNT_ID` + `CLOUDFLARE_API_TOKEN`) for
+     *  account-level operations. Captured at link time from `GET /accounts`.
+     *  Absent for non-Cloudflare integrations. */
+    accountId?: string;
 }
 
 /**

package/dist/index.js

@@ -1244,7 +1244,7 @@ var INTEGRATION_REGISTRY = {
     id: "vercel",
     name: "Vercel",
     icon: "vercel",
-    category: "deployment",
+    category: "infrastructure",
     // DARK — OAuth (PKCE public client). The user authorizes our registered
     // Vercel OAuth app; the access token calls Vercel's OFFICIAL hosted remote
     // MCP (mcp.vercel.com, Streamable HTTP) as a Bearer header — the SAME shim
@@ -1532,6 +1532,92 @@ var INTEGRATION_REGISTRY = {
         staticEnv: { ATLASSIAN_OAUTH_ENABLE: "true" }
       }
     }
+  },
+  cloudflare: {
+    id: "cloudflare",
+    name: "Cloudflare",
+    icon: "cloudflare",
+    category: "infrastructure",
+    // LIVE — Cloudflare self-managed OAuth (dash.cloudflare.com OAuth server,
+    // the same one Wrangler uses). Confidential (Client Secret POST). The agent
+    // inspects/deploys Workers, Pages, DNS, KV, R2 + reads analytics/logs on the
+    // user's account. CLOUDFLARE_OAUTH_CLIENT_ID/SECRET/REDIRECT_URI in Secret
+    // Manager (prod+dev); the backend CloudflareOAuthProvider is config-gated (503).
+    enabled: true,
+    auth: {
+      kind: "oauth_redirect",
+      // Cloudflare OAuth scope IDs == API-token permission-group names (dot
+      // form, e.g. `workers-scripts.write`). ⚠️ MUST exactly match the scopes
+      // configured on the OAuth client (b2b4b87e…). `offline_access` → refresh.
+      scopes: [
+        // Developer Platform (Workers / Pages / KV / R2 / D1 / observability)
+        "d1.read",
+        "page.read",
+        "page.write",
+        "workers-ci.read",
+        "workers-ci.write",
+        "containers.read",
+        "containers.write",
+        "workers-kv-storage.read",
+        "workers-kv-storage.write",
+        "workers-observability.read",
+        "workers-observability-telemetry.write",
+        "workers-observability.write",
+        "r2-catalog.read",
+        "r2-catalog.write",
+        "r2-catalog-sql.read",
+        "workers-r2-bucket-item.read",
+        "workers-r2-bucket-item.write",
+        "workers-r2.read",
+        "workers-r2.write",
+        "workers-routes.read",
+        "workers-routes.write",
+        "workers-scripts.read",
+        "workers-scripts.write",
+        "workers-tail.read",
+        // DNS & Zones
+        "account-dns-settings.read",
+        "account-dns-settings.write",
+        "dns-firewall.read",
+        "dns-firewall.write",
+        "dns.read",
+        "dns-view.read",
+        "dns.write",
+        "registrar-domains.admin",
+        "registrar-sandbox-domains.admin",
+        "zone-dns-settings.read",
+        "zone-dns-settings.write",
+        "zone.read",
+        "zone-settings.read",
+        "zone-settings.write",
+        // Analytics & Logs
+        "account-analytics.read",
+        "analytics.read",
+        "account-logs.read",
+        "logs.read",
+        "radar.read",
+        // Account & Billing
+        "account-api-gateway.read",
+        "account-settings.read",
+        "memberships.read",
+        "notifications.read",
+        "user-details.read",
+        "offline_access"
+      ]
+    },
+    delivery: {
+      mcp: {
+        // Headless stdio Cloudflare MCP (Cloudflare API v4) — BYO token via env,
+        // the OAuth access token works as a Bearer against api.cloudflare.com.
+        // The account id is the discriminator for account-level ops. PINNED.
+        command: "npx",
+        args: ["-y", "@itunified.io/mcp-cloudflare@2026.4.10-1"],
+        envMapping: {
+          CLOUDFLARE_API_TOKEN: "accessToken",
+          CLOUDFLARE_ACCOUNT_ID: "accountId"
+        }
+      }
+    }
   }
 };
 function getEnabledIntegrations() {
@@ -1756,6 +1842,14 @@ var INTEGRATION_BRANDING = {
     brandColor: "#3FCF8E",
     logoSvg: '<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Supabase</title><path fill="#FFFFFF" d="M11.9 1.036c-.015-.986-1.26-1.41-1.874-.637L.764 12.05C-.33 13.427.65 15.455 2.409 15.455h9.579l.113 7.51c.014.985 1.259 1.408 1.873.636l9.262-11.653c1.093-1.375.113-3.403-1.645-3.403h-9.642z"/></svg>'
   },
+  cloudflare: {
+    id: "cloudflare",
+    name: "Cloudflare",
+    vendor: "Cloudflare",
+    tagline: "Workers, Pages, DNS & R2",
+    brandColor: "#F6821F",
+    logoSvg: '<svg role="img" viewBox="0 0 460 271.2" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><title>Cloudflare</title><path fill="#FBAD41" d="M328.6,125.6c-0.8,0-1.5,0.6-1.8,1.4l-4.8,16.7c-2.1,7.2-1.3,13.8,2.2,18.7c3.2,4.5,8.6,7.1,15.1,7.4l26.2,1.6c0.8,0,1.5,0.4,1.9,1c0.4,0.6,0.5,1.5,0.3,2.2c-0.4,1.2-1.6,2.1-2.9,2.2l-27.3,1.6c-14.8,0.7-30.7,12.6-36.3,27.2l-2,5.1c-0.4,1,0.3,2,1.4,2h93.8c1.1,0,2.1-0.7,2.4-1.8c1.6-5.8,2.5-11.9,2.5-18.2c0-37-30.2-67.2-67.3-67.2C330.9,125.5,329.7,125.5,328.6,125.6z"/><path fill="#F6821F" d="M292.8,204.4c2.1-7.2,1.3-13.8-2.2-18.7c-3.2-4.5-8.6-7.1-15.1-7.4l-123.1-1.6c-0.8,0-1.5-0.4-1.9-1s-0.5-1.4-0.3-2.2c0.4-1.2,1.6-2.1,2.9-2.2l124.2-1.6c14.7-0.7,30.7-12.6,36.3-27.2l7.1-18.5c0.3-0.8,0.4-1.6,0.2-2.4c-8-36.2-40.3-63.2-78.9-63.2c-35.6,0-65.8,23-76.6,54.9c-7-5.2-15.9-8-25.5-7.1c-17.1,1.7-30.8,15.4-32.5,32.5c-0.4,4.4-0.1,8.7,0.9,12.7c-27.9,0.8-50.2,23.6-50.2,51.7c0,2.5,0.2,5,0.5,7.5c0.2,1.2,1.2,2.1,2.4,2.1h227.2c1.3,0,2.5-0.9,2.9-2.2L292.8,204.4z"/></svg>'
+  },
   asana: {
     id: "asana",
     name: "Asana",