@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.5

package/packages/connectors/cloudflare/src/families/token-validation.js

@@ -0,0 +1,95 @@
+/** Zone Token Validation (JWT) — real API. */
+import { receipt } from '../api-client.js';
+
+const CAP = 'cloudflare.token_validation';
+
+export async function tokenValidationStatus(client, zoneId) {
+  try {
+    const res = await client.request('GET', client.zonePath(zoneId, '/token_validation/config'), {
+      capabilityId: CAP,
+      operation: 'token_validation.config.list',
+    });
+    return receipt(CAP, 'status', {
+      ok: true,
+      availability: 'available',
+      authorized: true,
+      zone_id: zoneId,
+      configs: res.result || [],
+    });
+  } catch (err) {
+    if (err.code === 'cloudflare_permission_denied') {
+      return receipt(CAP, 'status', { ok: false, authorized: false, zone_id: zoneId, ...err.toJSON() });
+    }
+    throw err;
+  }
+}
+
+export async function tokenValidationListConfigs(client, zoneId) {
+  const res = await client.request('GET', client.zonePath(zoneId, '/token_validation/config'), {
+    capabilityId: CAP,
+    operation: 'token_validation.config.list',
+  });
+  return receipt(CAP, 'config.list', { ok: true, zone_id: zoneId, configs: res.result || [] });
+}
+
+export async function tokenValidationGetConfig(client, zoneId, configId) {
+  const res = await client.request(
+    'GET',
+    client.zonePath(zoneId, `/token_validation/config/${encodeURIComponent(configId)}`),
+    { capabilityId: CAP, operation: 'token_validation.config.get' },
+  );
+  return receipt(CAP, 'config.get', { ok: true, zone_id: zoneId, config: res.result });
+}
+
+export async function tokenValidationCreateConfig(client, zoneId, body) {
+  const res = await client.request('POST', client.zonePath(zoneId, '/token_validation/config'), {
+    capabilityId: CAP,
+    operation: 'token_validation.config.create',
+    body,
+  });
+  return receipt(CAP, 'config.create', { ok: true, zone_id: zoneId, config: res.result });
+}
+
+export async function tokenValidationEditConfig(client, zoneId, configId, body) {
+  const res = await client.request(
+    'PATCH',
+    client.zonePath(zoneId, `/token_validation/config/${encodeURIComponent(configId)}`),
+    { capabilityId: CAP, operation: 'token_validation.config.edit', body },
+  );
+  return receipt(CAP, 'config.edit', { ok: true, zone_id: zoneId, config: res.result });
+}
+
+export async function tokenValidationDeleteConfig(client, zoneId, configId) {
+  const res = await client.request(
+    'DELETE',
+    client.zonePath(zoneId, `/token_validation/config/${encodeURIComponent(configId)}`),
+    { capabilityId: CAP, operation: 'token_validation.config.delete' },
+  );
+  return receipt(CAP, 'config.delete', { ok: true, zone_id: zoneId, result: res.result });
+}
+
+export async function tokenValidationListRules(client, zoneId) {
+  const res = await client.request('GET', client.zonePath(zoneId, '/token_validation/rules'), {
+    capabilityId: CAP,
+    operation: 'token_validation.rules.list',
+  });
+  return receipt(CAP, 'rules.list', { ok: true, zone_id: zoneId, rules: res.result || [] });
+}
+
+export async function tokenValidationCreateRule(client, zoneId, body) {
+  const res = await client.request('POST', client.zonePath(zoneId, '/token_validation/rules'), {
+    capabilityId: CAP,
+    operation: 'token_validation.rules.create',
+    body,
+  });
+  return receipt(CAP, 'rules.create', { ok: true, zone_id: zoneId, rule: res.result });
+}
+
+export async function tokenValidationDeleteRule(client, zoneId, ruleId) {
+  const res = await client.request(
+    'DELETE',
+    client.zonePath(zoneId, `/token_validation/rules/${encodeURIComponent(ruleId)}`),
+    { capabilityId: CAP, operation: 'token_validation.rules.delete' },
+  );
+  return receipt(CAP, 'rules.delete', { ok: true, zone_id: zoneId, result: res.result });
+}

package/packages/connectors/cloudflare/src/families/workflows.js

@@ -0,0 +1,156 @@
+/** Cloudflare Workflows — real API: /accounts/{id}/workflows/... */
+import { receipt } from '../api-client.js';
+
+const CAP = 'cloudflare.workflows';
+
+export async function workflowsStatus(client) {
+  client.requireAccount('workflows.status');
+  try {
+    const res = await client.request('GET', client.accountPath('/workflows'), {
+      capabilityId: CAP,
+      operation: 'workflows.list',
+      query: { per_page: 1 },
+    });
+    return receipt(CAP, 'status', {
+      ok: true,
+      availability: 'available',
+      authorized: true,
+      account_id: client.accountId,
+      workflow_count_sample: Array.isArray(res.result) ? res.result.length : null,
+      result_info: res.result_info,
+    });
+  } catch (err) {
+    if (err.code === 'cloudflare_permission_denied') {
+      return receipt(CAP, 'status', {
+        ok: false,
+        availability: 'available',
+        authorized: false,
+        ...err.toJSON(),
+      });
+    }
+    throw err;
+  }
+}
+
+export async function workflowsList(client, { page, per_page } = {}) {
+  client.requireAccount('workflows.list');
+  const res = await client.request('GET', client.accountPath('/workflows'), {
+    capabilityId: CAP,
+    operation: 'workflows.list',
+    query: { page, per_page },
+  });
+  return receipt(CAP, 'list', {
+    ok: true,
+    workflows: res.result || [],
+    result_info: res.result_info,
+  });
+}
+
+export async function workflowsInspect(client, name) {
+  client.requireAccount('workflows.inspect');
+  const res = await client.request('GET', client.accountPath(`/workflows/${encodeURIComponent(name)}`), {
+    capabilityId: CAP,
+    operation: 'workflows.inspect',
+  });
+  return receipt(CAP, 'inspect', { ok: true, workflow: res.result });
+}
+
+export async function workflowsVersions(client, name) {
+  client.requireAccount('workflows.versions');
+  const res = await client.request('GET', client.accountPath(`/workflows/${encodeURIComponent(name)}/versions`), {
+    capabilityId: CAP,
+    operation: 'workflows.versions',
+  });
+  return receipt(CAP, 'versions', { ok: true, workflow: name, versions: res.result || [] });
+}
+
+export async function workflowsGraph(client, name, versionId) {
+  client.requireAccount('workflows.graph');
+  if (!versionId) throw Object.assign(new Error('version_id required'), { code: 'version_id_required' });
+  const res = await client.request(
+    'GET',
+    client.accountPath(`/workflows/${encodeURIComponent(name)}/versions/${encodeURIComponent(versionId)}/graph`),
+    { capabilityId: CAP, operation: 'workflows.graph' },
+  );
+  return receipt(CAP, 'graph', { ok: true, workflow: name, version_id: versionId, graph: res.result });
+}
+
+export async function workflowsRun(client, name, { instanceId, params } = {}) {
+  client.requireAccount('workflows.run');
+  const body = {};
+  if (instanceId) body.id = instanceId;
+  if (params != null) body.params = params;
+  const res = await client.request('POST', client.accountPath(`/workflows/${encodeURIComponent(name)}/instances`), {
+    capabilityId: CAP,
+    operation: 'workflows.run',
+    body: Object.keys(body).length ? body : {},
+  });
+  return receipt(CAP, 'run', { ok: true, workflow: name, instance: res.result });
+}
+
+export async function workflowsInstances(client, name, query = {}) {
+  client.requireAccount('workflows.instances');
+  const res = await client.request('GET', client.accountPath(`/workflows/${encodeURIComponent(name)}/instances`), {
+    capabilityId: CAP,
+    operation: 'workflows.instances',
+    query,
+  });
+  return receipt(CAP, 'instances', { ok: true, workflow: name, instances: res.result || [], result_info: res.result_info });
+}
+
+export async function workflowsInstance(client, name, instanceId) {
+  client.requireAccount('workflows.instance');
+  const res = await client.request(
+    'GET',
+    client.accountPath(`/workflows/${encodeURIComponent(name)}/instances/${encodeURIComponent(instanceId)}`),
+    { capabilityId: CAP, operation: 'workflows.instance' },
+  );
+  return receipt(CAP, 'instance', { ok: true, workflow: name, instance: res.result });
+}
+
+export async function workflowsStep(client, name, instanceId) {
+  client.requireAccount('workflows.step');
+  const res = await client.request(
+    'GET',
+    client.accountPath(`/workflows/${encodeURIComponent(name)}/instances/${encodeURIComponent(instanceId)}/step`),
+    { capabilityId: CAP, operation: 'workflows.step' },
+  );
+  return receipt(CAP, 'step', { ok: true, workflow: name, instance_id: instanceId, step: res.result });
+}
+
+export async function workflowsSetStatus(client, name, instanceId, status) {
+  client.requireAccount('workflows.status_edit');
+  const res = await client.request(
+    'PATCH',
+    client.accountPath(`/workflows/${encodeURIComponent(name)}/instances/${encodeURIComponent(instanceId)}/status`),
+    { capabilityId: CAP, operation: `workflows.${status}`, body: { status } },
+  );
+  return receipt(CAP, status, { ok: true, workflow: name, instance_id: instanceId, result: res.result });
+}
+
+export async function workflowsEvent(client, name, instanceId, eventType, payload = {}) {
+  client.requireAccount('workflows.event');
+  const res = await client.request(
+    'POST',
+    client.accountPath(
+      `/workflows/${encodeURIComponent(name)}/instances/${encodeURIComponent(instanceId)}/events/${encodeURIComponent(eventType)}`,
+    ),
+    { capabilityId: CAP, operation: 'workflows.event', body: payload },
+  );
+  return receipt(CAP, 'event', {
+    ok: true,
+    workflow: name,
+    instance_id: instanceId,
+    event_type: eventType,
+    result: res.result,
+  });
+}
+
+export async function workflowsDelete(client, name) {
+  client.requireAccount('workflows.delete');
+  const res = await client.request('DELETE', client.accountPath(`/workflows/${encodeURIComponent(name)}`), {
+    capabilityId: CAP,
+    operation: 'workflows.delete',
+  });
+  return receipt(CAP, 'delete', { ok: true, workflow: name, result: res.result });
+}

package/packages/connectors/cloudflare/src/index.js

@@ -10,222 +10,93 @@ export const CLOUDFLARE_FIXTURE_CLIENT_ID = 'sillynotreal';
 
 export const CLOUDFLARE_OAUTH_REVOKE_URL = 'https://dash.cloudflare.com/oauth2/revoke';
 
-/** Smallest useful scopes mapped to Cloudflare API token permission names. */
-export const CLOUDFLARE_CAPABILITY_SCOPES = Object.freeze({
-  workers_deploy: {
-    scopes: ['workers-scripts.write'],
-    why: 'Deploy Workers for the connected account (Workers Scripts Edit).',
-  },
-  d1_inspect: {
-    scopes: ['d1.read'],
-    why: 'Inspect D1 databases bound to the deployable.',
-  },
-  r2_inspect: {
-    scopes: ['workers-r2.read'],
-    why: 'Inspect R2 buckets bound to the deployable.',
-  },
-  worker_logs: {
-    scopes: ['workers-scripts.read'],
-    why: 'Read Worker script metadata/logs for postdeploy health.',
-  },
-});
+export {
+  CLOUDFLARE_BASELINE_SCOPES,
+  CLOUDFLARE_CAPABILITIES,
+  CLOUDFLARE_CAPABILITY_SCOPES,
+  CLOUDFLARE_FEATURE_PACKS,
+  CLOUDFLARE_PERMISSION_CATEGORY_LABELS,
+  CLOUDFLARE_PERMISSION_PRODUCTS,
+  listCloudflareCapabilities,
+  listCloudflareFeaturePacks,
+  listCloudflarePermissionProducts,
+  listCloudflarePermissionOptionsByCategory,
+  assertPermissionCatalogCoversAllScopes,
+  getCloudflareCapability,
+  getCloudflareFeaturePack,
+  scopesForCapabilities,
+  scopesForFeaturePacks,
+  assessCapabilityAuthorization,
+  capabilityAuthorizationMatrix,
+  cloudflarePermissionRemediation,
+} from './capabilities.js';
 
-// Full scope catalog for the AgentSam Local Studio OAuth client (182 total,
-// pasted directly from the Cloudflare dashboard's own scope picker). This is
-// what gets requested at mint time -- one authorize covers everything the
-// client is provisioned for, rather than a hand-curated subset that has to
-// be edited in code every time a new capability is used. CLOUDFLARE_CAPABILITY_SCOPES
-// above stays as documentation of which specific scopes each feature
-// actually touches -- it no longer restricts what's requested.
-export const CLOUDFLARE_ALL_SCOPES = Object.freeze([
-  'agent-memory.write',
-  'browser-rendering.read',
-  'browser-rendering.write',
-  'cf-agents.read',
-  'cf-agents.write',
-  'cloud-connector.read',
-  'cloud-connector.write',
-  'cloudchamber.read',
-  'cloudchamber.write',
-  'constellation.read',
-  'constellation.write',
-  'd1.read',
-  'd1.write',
-  'flagship.evaluate',
-  'flagship.read',
-  'flagship.write',
-  'query-cache.read',
-  'query-cache.write',
-  'k2.read',
-  'k2.write',
-  'k2.consume',
-  'k2.produce',
-  'mcp-portals.read',
-  'mcp-portals.write',
-  'messaging.edit',
-  'messaging.read',
-  'cfspeed.read',
-  'cfspeed.write',
-  'page.read',
-  'page.write',
-  'pipelines.read',
-  'pipelines.send',
-  'pipelines.write',
-  'pubsub.read',
-  'pubsub.write',
-  'queues.read',
-  'queues.write',
-  'realtime.write',
-  'realtime.admin',
-  'realtime.read',
-  'secrets-store.read',
-  'secrets-store.write',
-  'vectorize.read',
-  'vectorize.write',
-  'workers-ci.read',
-  'workers-ci.write',
-  'containers.read',
-  'containers.write',
-  'workers-kv-storage.read',
-  'workers-kv-storage.write',
-  'workers-observability.read',
-  'workers-observability-telemetry.write',
-  'workers-observability.write',
-  'r2-catalog.read',
-  'r2-catalog.write',
-  'r2-catalog-sql.read',
-  'workers-r2-bucket-item.read',
-  'workers-r2-bucket-item.write',
-  'workers-r2.read',
-  'workers-r2.write',
-  'workers-routes.read',
-  'workers-routes.write',
-  'workers-scripts.read',
-  'workers-scripts.write',
-  'workers-tail.read',
-  'aiaudit.read',
-  'aiaudit.write',
-  'aig.read',
-  'aig.run',
-  'aig.write',
-  'ai-search.index',
-  'ai-search.read',
-  'ai-search.run',
-  'ai-search.write',
-  'agw.read',
-  'agw.run',
-  'agw.write',
-  'rag.read',
-  'rag.write',
-  'rag.run',
-  'firewall-for-ai.read',
-  'firewall-for-ai.write',
-  'websearch.read',
-  'websearch.run',
-  'websearch.write',
-  'ai-model.read',
-  'ai-model.write',
-  'ai.read',
-  'ai.write',
-  'account-dns-settings.read',
-  'account-dns-settings.write',
-  'dns-firewall.read',
-  'dns-firewall.write',
-  'dns.read',
-  'dns-view.read',
-  'dns-view.write',
-  'dns.write',
-  'registrar-domains.admin',
-  'registrar-domains.read',
-  'registrar-sandbox-domains.admin',
-  'registrar-sandbox-domains.read',
-  'zone-custom-asset.read',
-  'zone-custom-asset.write',
-  'zone-dns-settings.read',
-  'zone-dns-settings.write',
-  'zone.read',
-  'zone-settings.read',
-  'zone-settings.write',
-  'zone-versioning.read',
-  'zone-versioning.write',
-  'zone.write',
-  'fraud-detection-pii.read',
-  'account-firewall-access-rules.read',
-  'account-firewall-access-rules.write',
-  'account-security-center-insights.read',
-  'account-security-center-insights.write',
-  'account-waf.read',
-  'account-waf.write',
-  'request-tracer.read',
-  'reports-application-security-report.read',
-  'bot-management-feedback.read',
-  'bot-management-feedback.write',
-  'bot-management.read',
-  'bot-management.write',
-  'http-applications.read',
-  'http-applications.write',
-  'http-ddos-managed-ruleset.read',
-  'http-ddos-managed-ruleset.write',
-  'tag.read',
-  'tag.write',
-  'url-scanner.read',
-  'url-scanner.write',
-  'zone-security-center-insights.read',
-  'zone-security-center-insights.write',
-  'zone-waf.read',
-  'zone-waf.write',
-  'account-custom-error-rules.read',
-  'account-custom-error-rules.write',
-  'account-custom-pages.read',
-  'account-custom-pages.write',
-  'account-rule-lists.read',
-  'account-rule-lists.write',
-  'account-rulesets.read',
-  'account-rulesets.write',
-  'config-settings.read',
-  'config-settings.write',
-  'custom-errors.read',
-  'custom-errors.write',
-  'custom-pages.read',
-  'custom-pages.write',
-  'dynamic-redirect.read',
-  'dynamic-redirect.write',
-  'managed-headers.read',
-  'managed-headers.write',
-  'mass-url-redirects.read',
-  'mass-url-redirects.write',
-  'origin.read',
-  'origin.write',
-  'payments-gateway.read',
-  'payments-gateway.write',
-  'account-ssl-and-certificates.read',
-  'account-ssl-and-certificates.write',
-  'cache.purge',
-  'cache-settings.read',
-  'cache-settings.write',
-  'ssl-and-certificates.read',
-  'ssl-and-certificates.write',
-  'account-api-gateway.write',
-  'account-api-gateway.read',
-  'account-custom-asset.read',
-  'account-custom-asset.write',
-  'account-settings.read',
-  'account-settings.write',
-  'apps.write',
-  'integration.write',
-  'memberships.read',
-  'memberships.write',
-  'notifications.read',
-  'notifications.write',
-  'scim-provisioning.write',
-  'user-details.read',
-  'offline_access'
-]);
+export {
+  upsertCloudflareUserOauthToken,
+  revokeCloudflareUserOauthTokens,
+  resolveCloudflareAccountId,
+  unionScopes,
+} from './oauth-persist.js';
 
-export function requestedCloudflareScopes() {
-  return [...CLOUDFLARE_ALL_SCOPES];
+export {
+  CloudflareApiClient,
+  CloudflareApiError,
+  resolveCloudflareApiAuth,
+  createCloudflareApiClient,
+  receipt as cloudflareReceipt,
+} from './api-client.js';
+
+export {
+  resolveCloudflareCredential,
+  credentialSafeMeta,
+  loadCloudflareFromUserOauthTokens,
+  loadCloudflareFromLegacyConnections,
+  loadCloudflareConnectionRecord,
+  mapCloudflareOauthRowToConnection,
+} from './credential.js';
+
+export * as workflows from './families/workflows.js';
+export * as scanner from './families/scanner.js';
+export * as tags from './families/tags.js';
+export * as tagGateway from './families/tag-gateway.js';
+export * as brandProtection from './families/brand-protection.js';
+export * as keyless from './families/keyless.js';
+export * as tokenValidation from './families/token-validation.js';
+export * as pages from './families/pages.js';
+export * as snippets from './families/snippets.js';
+
+import { scopesForCapabilities as _scopesForCapabilities, scopesForFeaturePacks as _scopesForFeaturePacks } from './capabilities.js';
+import { CLOUDFLARE_ALL_SCOPES as _CLOUDFLARE_ALL_SCOPES, isKnownCloudflareScope } from './scope-catalog.js';
+
+// Full Local Studio scope catalog — offerable via packs/products; pack `all` opts in wholesale.
+export const CLOUDFLARE_ALL_SCOPES = _CLOUDFLARE_ALL_SCOPES;
+export { isKnownCloudflareScope };
+
+/**
+ * Scopes requested at OAuth mint / re-authorize.
+ * Default: baseline only. Pass `capabilities` and/or `packs` to upgrade deliberately.
+ * Host apps supply their own default capability list — this package does not.
+ * Pass `{ all: true }` or pack `all` when the user explicitly wants every offerable scope.
+ * @param {{ capabilities?: string[], packs?: string[], all?: boolean }} [opts]
+ */
+export function requestedCloudflareScopes(opts = {}) {
+  if (opts && opts.all === true) return [...CLOUDFLARE_ALL_SCOPES];
+  const capabilities = Array.isArray(opts?.capabilities) ? opts.capabilities.filter(Boolean) : [];
+  const packs = Array.isArray(opts?.packs) ? opts.packs.filter(Boolean) : [];
+  if (packs.map((p) => String(p).toLowerCase()).includes('all')) {
+    return [...CLOUDFLARE_ALL_SCOPES];
+  }
+  if (packs.length) {
+    return _scopesForFeaturePacks(packs, capabilities);
+  }
+  return _scopesForCapabilities({
+    capabilities,
+    includeBaseline: true,
+    generallyAvailableOnly: true,
+  });
 }
 
+
 function clean(value) {
   return value == null ? '' : String(value).trim();
 }
@@ -303,61 +174,27 @@ export function assertConnectionOwner(connection, ownerId) {
   return connection;
 }
 
+/**
+ * LEGACY dual-read wrapper — now SSOT-only via user_oauth_tokens.
+ * Prefer resolveCloudflareCredential / createCloudflareApiClient.
+ */
 export async function loadCloudflareAccessToken(env, ownerId, options = {}) {
-  if (!env?.DB || !ownerId) return null;
-  const row = await env.DB.prepare(`
-    SELECT connection_id, owner_id, cloudflare_account_id, scopes, status,
-           access_token_encrypted, refresh_token_encrypted, expires_at
-    FROM agentsam_cloudflare_connections
-    WHERE owner_id = ? AND status = 'connected'
-    ORDER BY updated_at DESC LIMIT 1
-  `).bind(ownerId).first();
-  if (!row?.access_token_encrypted || row.owner_id !== ownerId) return null;
-  const { decryptSecret, sealToken } = await import('./vault.js');
-  const aad = `cloudflare-connection:${ownerId}`;
-  let accessToken = await decryptSecret(env, row.access_token_encrypted, aad);
-  let refreshToken = row.refresh_token_encrypted
-    ? await decryptSecret(env, row.refresh_token_encrypted, aad)
-    : '';
-  let expiresAt = Number(row.expires_at || 0) || null;
-  let scopes = row.scopes ? String(row.scopes).split(' ').filter(Boolean) : [];
-  const now = Math.floor(Date.now() / 1000);
-  if (expiresAt && expiresAt <= now + 60) {
-    if (!refreshToken) throw new Error('cloudflare_refresh_token_missing');
-    const refreshParams = new URLSearchParams({
-      grant_type: 'refresh_token',
-      refresh_token: refreshToken,
-      client_id: String(env.CLOUDFLARE_OAUTH_CLIENT_ID || ''),
-    });
-    const refreshResponse = await (options.fetchImpl || fetch)(CLOUDFLARE_OAUTH_TOKEN_URL, {
-      method: 'POST',
-      headers: { 'content-type': 'application/x-www-form-urlencoded' },
-      body: refreshParams,
-    });
-    if (!refreshResponse.ok) throw new Error(`cloudflare_token_refresh_failed:${refreshResponse.status}`);
-    const refreshed = await refreshResponse.json();
-    if (!refreshed?.access_token) throw new Error('cloudflare_token_refresh_missing_access_token');
-    accessToken = refreshed.access_token;
-    refreshToken = refreshed.refresh_token || refreshToken;
-    scopes = String(refreshed.scope || row.scopes || '').split(' ').filter(Boolean);
-    expiresAt = refreshed.expires_in ? now + Number(refreshed.expires_in) : null;
-    const [accessEncrypted, refreshEncrypted] = await Promise.all([
-      sealToken(env, accessToken, aad),
-      sealToken(env, refreshToken, aad),
-    ]);
-    await env.DB.prepare(`
-      UPDATE agentsam_cloudflare_connections
-      SET access_token_encrypted = ?, refresh_token_encrypted = ?, scopes = ?,
-          expires_at = ?, status = 'connected', updated_at = unixepoch()
-      WHERE connection_id = ? AND owner_id = ?
-    `).bind(accessEncrypted, refreshEncrypted, scopes.join(' '), expiresAt, row.connection_id, ownerId).run();
-  }
+  const { resolveCloudflareCredential } = await import('./credential.js');
+  const cred = await resolveCloudflareCredential({
+    env,
+    ownerId,
+    authMode: 'oauth',
+    decryptUserOauthToken: options.decryptUserOauthToken,
+    ...options,
+  });
+  if (!cred?.bearerToken) return null;
   return {
-    accessToken,
-    connectionId: row.connection_id,
-    accountId: row.cloudflare_account_id || null,
-    scopes,
-    expiresAt,
+    accessToken: cred.bearerToken,
+    connectionId: cred.connectionId,
+    accountId: cred.accountId,
+    scopes: cred.grantedScopes || [],
+    expiresAt: cred.expiresAt,
+    source: cred.source,
   };
 }