@jini-ai/agent-plugins 0.6.17 → 0.6.19

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.6.19
+
+- A plugin's state lock left by a killed boot no longer keeps that plugin off on every later boot after the machine's hostname spelling changed (macOS `.lan`/`.local`): the node process port records the kernel boot (`bootIdentity`), so the platform lock can prove the holder was this machine's and reclaim it once its pid is dead.
+- Tests: the hosting plugins' identical `vitest-compat.mjs` (3 copies) and `fake-deploy-host-kit.mjs` (4 copies) are one shared test-only copy each under `packages/agent-plugins/__tests__/` (never published). Cloudflare's doubled DNS-marker and Pages-config comments are merged.
+- Google Workspace: a Sheets `batchUpdate` with more than one request is never replayed after an unknown outcome. Each request was judged replay-safe alone, but Google applies them in order, so a retry of "copy A1 to B1, then set A1" changed B1.
+- Security: reinstalling a plugin whose digest directory already exists compares that directory's bytes with the verified archive before reusing it. A same-build reseed used to keep an operator-edited bundled revision selected as shipped code; a modified copy is now kept aside under a `.modified-*` name (never indexed or selected) and the verified bytes are reinstalled.
+- Railway's deploy-config generator refuses an `env` value containing a newline or control character (C0, DEL, C1) with an error naming the variable. Before, it printed the raw LF or NUL into the copy-paste `railway variables set` command. The error never echoes the value.
+- Add the portable Shopify catalog and checkout skill under `@jini-ai/agent-plugins/shopify`; host collection tools, markup and domain routing stay in the host overlay.
+- Pin Fly's portable template safety settings: operator placeholders, secret-free app configuration, single-machine defaults, serialized deploys and repository-secret token wiring.
+- `charts-recharts` and `charts-echarts` declare `provides: ["chart"]` (the kind their provider draws), so capability lookup and automatic-use ranking find the chart faces.
+- Plugin-folder suites (`<id>/**/__tests__/*.test.mjs`) are node:test files: the root `test:agent-plugins:content` script runs them and this package's vitest config no longer collects them. Shipped plugin `.mjs` modules are under the root `complexity:strict` gate.
+- Every Jini agent plugin now ships in this package as a subpath: `@jini-ai/agent-plugins/<id>`
+  resolves to `<id>/plugin.json` and `@jini-ai/agent-plugins/<id>/*` to its files (ui-ux-design,
+  slide-design, the hosting, mail, search, login, workspace, media and chart faces, and the
+  posthog/sentry/opentelemetry setup faces). There are no per-plugin `@jini-ai/plugin-*` packages
+  for agent plugins; `__tests__/` folders are not published.
+- Bundled seeding no longer prunes other revisions of a plugin. Reseeding kept deleting an
+  operator-edited, uploaded or older bundled same-name copy; every copy now survives and the
+  bundled-digests ledger selects the build's revision. `installAgentPlugin` takes
+  `{ pruneSupersededRevisions: false }`; explicit install, update and replace keep pruning.
+- `zipCustomizedAgentPluginFolder` gives the fork `local/<name>` under every host key that
+  declared an id (and under the requesting host's key even when none existed), and removes
+  `renamedFrom` and `supersedes` from every key, not only the requesting host's.
+- README documents the extension-namespace policy: one `extensions` key per host.
+- slide-design review checklist matches the chart guide: a compact legend is fine when direct
+  labels would collide, and only magnitude bars and columns must start at zero (waterfall change
+  bars float).
+
 ## 0.6.17
 
 ### Patch Changes
@@ -18,7 +46,7 @@
 
 - Breaking package-surface change for the fixed 0.6.15 release: remove the bundled
   ui-ux-design files and wildcard export from @jini-ai/agent-plugins. Hosts must
-  explicitly install @jini-ai/plugin-ui-ux-design and resolve its ./plugin.json
+  use @jini-ai/agent-plugins/ui-ux-design to resolve its plugin.json
   export, stage that payload and seed through the existing Agent Plugin lifecycle.
   The lifecycle implementation remains in @jini-ai/agent-plugins. Inner plugin
   version 0.4.6, deterministic packing, digest selection and operator activation

package/NOTICE

@@ -0,0 +1,14 @@
+Jini UI/UX Design Agent Plugin
+Copyright 2026 Leona Burime
+
+Portable skill sources remain at packages/agent-plugins/ui-ux-design.
+Originally assembled from AI-Dev-Shop's Web Design skill trees; the ADS-specific
+agent persona and routing implementation are not included.
+
+Source notes and attribution are retained in the generated skills tree, including
+skills/interface-design/ORIGINAL.md (Dammyjay93/interface-design) and
+skills/gstack-design/references/upstream-notes.md (garrytan/gstack).
+The skill references retain their original source links and attribution.
+
+This distribution does not include the provider-plugin aggregate or its Open SaaS
+Stripe adaptations. See LICENSE for the Apache License, Version 2.0.

package/README.md

@@ -29,7 +29,7 @@ decides its own install mechanism, permission model, and sandboxing.
 
 ## What a plugin looks like on disk
 
-A plugin is a directory. Example (`@jini-ai/plugin-ui-ux-design` publishes this payload):
+A plugin is a directory. Example (this package publishes it as `@jini-ai/agent-plugins/ui-ux-design`):
 
 ```
 ui-ux-design/
@@ -150,19 +150,22 @@ package supports. Do not confuse the two — "agent plugins" (this package, a
 public spec) and "Jini plugins" (`@jini-ai/plugins`'s `./host`, Jini's own unbuilt format) share
 the word "plugin" and nothing else.
 
-## Independently packaged plugins
+## Plugins as subpaths
 
-Starting with the breaking 0.6.17 release, this library ships manifest and lifecycle code only.
-Install `@jini-ai/plugin-ui-ux-design` explicitly for the design payload. Resolve
-`@jini-ai/plugin-ui-ux-design/plugin.json`; its containing directory holds the portable assets.
-Stage that directory beneath the host's bundled-source root, then call the existing
+Every Jini agent plugin ships inside this package as its own folder and subpath:
+`@jini-ai/agent-plugins/<id>` resolves to `<id>/plugin.json`, and `@jini-ai/agent-plugins/<id>/*`
+reaches any file in that folder. Resolve the manifest (`require.resolve` or
+`import.meta.resolve('@jini-ai/agent-plugins/vercel')`); its containing directory holds the
+portable assets. Stage that directory beneath the host's bundled-source root, then call the existing
 `seedBundledAgentPlugins({ layout, workspaceId, sourceRoot })`. Read contributions through trusted
 installed-package readers. Seeding preserves digest selection and operator activation decisions.
 
-The editable design source remains at `ui-ux-design/` here, outside `src/`: its `.tsx` examples
-are illustrative skill content and must not enter the TypeScript compile root. Assembly generates
-only the standalone package's payload. The old `@jini-ai/agent-plugins/ui-ux-design/*` export is
-removed; product-specific assets remain owned by their product.
+A plugin folder imports nothing from a sibling plugin folder (`scripts/check-agent-plugin-content.ts`
+and the packed-isolation gate refuse it), so resolving one subpath never loads another plugin's
+files. Plugin folders sit outside `src/`: their `.tsx` examples are illustrative skill content and
+must not enter the TypeScript compile root. `__tests__/` folders are not published. Provider
+runtime code (charts, analytics, observability, payments) is not here; it ships as provider
+plugins (`@jini-ai/provider-plugins/<provider>/*`).
 
 ## Scripts
 
@@ -177,10 +180,11 @@ translated to Vitest registration, preserving per-test timeouts and platform ski
 
 ## Adding another plugin
 
-Create a separate `@jini-ai/plugin-<id>` workspace package with its own reviewed manifest,
-README, LICENSE and NOTICE. Generate only that plugin's payload; do not add plugin assets or
-plugin dependencies to this lifecycle library. Keep skill trees outside TypeScript compile roots,
-validate the plugin manifest and test installation through this package's existing lifecycle.
+Create `packages/agent-plugins/<id>/` with its `plugin.json` (name `<id>`), add its row to
+`scripts/lib/agent-plugin-packages.ts`, and add `./<id>`, `./<id>/*` (exports and `jini.entries`)
+and `<id>` (`files`) here. Shipped `.mjs` may import only `node:*`, same-folder files and
+`@jini-ai/*` contracts; tests live in `<id>/**/__tests__/*.test.mjs` (node:test). Validate the
+manifest and test installation through this package's existing lifecycle.
 
 ## Lifecycle API and ports
 
@@ -262,6 +266,23 @@ For a host that needs only activation, use `createAgentPluginActivations` with
 ports. Retain one returned object for the process lifetime. See `API.md` for the
 object-shaped reads, filters and optional legacy metadata reader.
 
+### Extension namespaces
+
+`extensions` keys in `plugin.json` are **host keys**. A plugin declares one entry per host it
+supports, for example `"tovu": { "id": "tovu/stock" }` beside `"open-marketing": { "id": "tovu/stock" }`.
+
+- A host reads only its own key, the `extensionNamespace` it passes to the lifecycle.
+- Without a host namespace, exported parsers and validators read `jini`, falling back to the legacy
+  `tovu` key only when `jini` is absent. A present malformed `jini` entry is refused, never bypassed.
+  Passing a namespace explicitly reads only that key, with no fallback to another host.
+- Publisher ids stay as declared. There is no alias between keys and no content rewrite.
+- A customized fork (`zipCustomizedAgentPluginFolder`) gets `local/<name>` under every host key
+  that declared an id, and loses every `renamedFrom` and `supersedes` claim, so no host sees the
+  fork answer for, or retire, the package it was copied from.
+- Bundled seeding never prunes other revisions of a plugin, so an operator-edited or uploaded
+  same-name copy survives every boot. The bundled-digests ledger selects the build's revision; the
+  other copies stay installed and unselected. Explicit install, update and replace still prune.
+
 ### Persistent plugin state (Layout B)
 
 `@jini-ai/agent-plugins/persistent-state` is a build-free Node entry with declarations.

package/charts-echarts/plugin.json

@@ -0,0 +1,39 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+  "name": "charts-echarts",
+  "version": "0.1.0",
+  "description": "Teaches the assistant to draw bar, stacked bar, line, area, pie, donut and scatter charts in chat with the Apache ECharts chart provider: finding the chart components with search_components, the data shape each one takes, several series in one chart through the generic chart.spec entry, axis names and number formats, and what falls back to a table. Know-how only: no code, no MCP server; the ECharts provider plugin (charts-echarts) draws the charts and switches this plugin on and off.",
+  "license": "Apache-2.0",
+  "extensions": {
+    "tovu": {
+      "id": "jini/charts-echarts-agent",
+      "displayName": "ECharts",
+      "summary": "Lets the assistant draw bar, stacked bar, line, area, pie, donut and scatter charts in chat, with several series. Ask for a chart of your data.",
+      "providerPlugin": "charts-echarts",
+      "provides": ["chart"]
+    }
+  },
+  "keywords": [
+    "chart",
+    "charts",
+    "graph",
+    "plot",
+    "bar-chart",
+    "stacked-bar-chart",
+    "line-chart",
+    "area-chart",
+    "pie-chart",
+    "donut-chart",
+    "scatter-plot",
+    "data-visualization",
+    "visualization",
+    "trend",
+    "breakdown",
+    "comparison",
+    "correlation",
+    "multi-series",
+    "chart-spec",
+    "echarts",
+    "charts-echarts"
+  ]
+}

package/charts-echarts/skills/charts-echarts/SKILL.md

@@ -0,0 +1,110 @@
+---
+name: charts-echarts
+version: 0.1.0
+last_updated: 2026-11-02
+description: Use when the user asks for a chart, graph or plot of data (comparisons, trends, shares of a whole, stacked totals, correlations) and the ECharts chart provider is enabled. Covers finding the chart components, the data each takes, several series in one chart, axis names and number formats, and what falls back to a table.
+---
+
+# Skill: Charts with ECharts
+
+The ECharts provider draws charts the host shows in chat or on a canvas. You never write chart
+code. You pick a chart component from the host's component catalog and hand it data as props.
+
+## Find the components first
+
+1. Call `search_components` with `"chart"` (or the shape you need, such as "stacked bar of revenue
+   and cost by month" or "scatter of height against weight").
+2. Call `describe_component` on the one or two ids that fit, to read the exact props schema.
+3. Render through the host's UI-rendering tool (the one that takes a component tree). Put the chart
+   inside a layout component if the tool needs a root.
+
+The catalog is the source of truth. Ids and schemas below are what it lists today; if the catalog
+differs, follow the catalog.
+
+## Which kind
+
+| Question the chart answers | Kind |
+|---|---|
+| How do categories compare (posts by status, sales by region)? | `bar` |
+| How do parts add up per category (revenue split by product, per month)? | `stacked-bar` |
+| How did a value change over time (sign-ups per month)? | `line` |
+| How did a volume change over time, filled to the axis? | `area` |
+| What share of a whole does each part take (pages vs posts)? | `pie` or `donut` |
+| Do two measures move together (price against rating)? | `scatter` |
+
+ECharts draws `bar`, `line`, `area`, `pie`, `donut`, `scatter` and `stacked-bar` only.
+
+## The components and their data
+
+**One series, simplest props** (`bar`, `line` and `pie` keep the shared single-series shapes):
+
+- `plugin.echarts.bar-chart`, `plugin.echarts.line-chart`:
+  `{ data: [rows], categoryKey, valueKey, valueLabel?, color? }`.
+- `plugin.echarts.pie-chart`: `{ data: [{ name, value }], color? }`. One row per slice.
+
+**Every other kind, and any chart with several series: `{ spec }`**
+
+`plugin.echarts.area-chart`, `.donut-chart`, `.scatter-chart` and `.stacked-bar-chart` take
+`{ spec }` with that `spec.kind`. `chart.spec` takes the same `{ spec }` for any kind:
+
+```json
+{ "spec": {
+  "kind": "stacked-bar",
+  "categoryKey": "month",
+  "series": [{ "key": "revenue", "label": "Revenue" }, { "key": "cost", "label": "Cost" }],
+  "data": [{ "month": "Jan", "revenue": 120, "cost": 80 }, { "month": "Feb", "revenue": 150, "cost": null }],
+  "title": "Revenue and cost by month",
+  "axes": { "y": { "label": "USD", "format": { "notation": "compact" } } },
+  "provider": "plugin.echarts"
+} }
+```
+
+- Every row carries the category and a number (or `null` for a gap) for every series key.
+- Series keys are unique. There is at least one row and one series.
+- `spec.provider: "plugin.echarts"` asks for ECharts when several chart providers are enabled.
+- `axes.x.label` / `axes.y.label` name the axes. `format` (or `axes.x.format` / `axes.y.format`,
+  which win) takes `{ locale?, notation? }`, with `notation` `"standard"` or `"compact"` (1.5K).
+
+## Kind rules
+
+- `pie` and `donut`: exactly **one** series of numbers that are zero or more, with a total above
+  zero. `categoryKey` names the slices. No gaps.
+- `scatter`: `categoryKey` is the numeric **x** of every point; each series is a **y**. Points with
+  a `null` y are left out.
+- `bar`, `stacked-bar`, `line`, `area`: any number of series; `null` leaves a gap.
+
+## What falls back
+
+ECharts draws a spec only when the kind is one of its seven, there is a `categoryKey`, at least
+one row and series, every value is a finite number or `null` (at least one is a number), the kind
+rules above hold and any `locale` is a valid language tag. Anything else goes to another enabled
+provider that accepts it, or shows as a table. Nothing is lost, but tell the user when you know
+the result will be a table.
+
+## Making it read well
+
+- Aggregate first. Send the counts or totals to plot, not raw records.
+- Bars: about 12 categories or fewer. Sort by value unless the order means something (months,
+  stages). In narrow spaces some category labels are skipped; the tooltip keeps every value.
+- Stacked bars: 2 to 5 series, in a fixed order the user would read top to bottom.
+- Lines and areas: time in order, oldest first; up to about 5 series.
+- Pies and donuts: 6 slices or fewer, values that add up to a meaningful whole. Merge the small
+  ones into "Other". Use a bar chart when the user needs to compare similar values.
+- Whole-number data (counts) gets whole-number axis ticks automatically.
+- Leave `color` out unless the user asks. The host theme colours the chart.
+- Give a short title that states what is shown, and a description when the chart makes a point
+  the title doesn't. Keep labels short and human: "Published", not `post_status_published`.
+
+## Never
+
+- Never paste ECharts, SVG or HTML chart code into the chat, a page or a file to draw a chart.
+  The provider owns the drawing; your job is the data and the component choice.
+- Never invent data. If you can't get the numbers, say so and ask.
+- Never claim a chart rendered when the host reported a refusal. Read the error, fix the props
+  (usually a missing key or a string where a number belongs), and try once more.
+
+## When charts are off
+
+If the chart entries `search_components` returns all report provider `core.table`, no chart
+provider is enabled. The data will show as a table; say so, and tell the user an administrator can
+turn the ECharts chart provider on.

package/charts-recharts/plugin.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+  "name": "charts-recharts",
+  "version": "0.1.0",
+  "description": "Teaches the assistant to draw bar, line and pie charts in chat with the Recharts chart provider: finding the chart components with search_components, the data shape each one takes, what Recharts draws and what falls back to a table, and the generic chart.spec entry for several series. Know-how only: no code, no MCP server; the Recharts provider plugin (charts-recharts) draws the charts and switches this plugin on and off.",
+  "license": "Apache-2.0",
+  "extensions": {
+    "tovu": {
+      "id": "jini/charts-recharts-agent",
+      "displayName": "Recharts",
+      "summary": "Lets the assistant draw bar, line and pie charts in chat. Ask for a chart of your data.",
+      "providerPlugin": "charts-recharts",
+      "provides": ["chart"]
+    }
+  },
+  "keywords": [
+    "chart",
+    "charts",
+    "graph",
+    "plot",
+    "bar-chart",
+    "line-chart",
+    "pie-chart",
+    "data-visualization",
+    "visualization",
+    "trend",
+    "breakdown",
+    "chart-spec",
+    "recharts",
+    "charts-recharts"
+  ]
+}

package/charts-recharts/skills/charts-recharts/SKILL.md

@@ -0,0 +1,108 @@
+---
+name: charts-recharts
+version: 0.1.0
+last_updated: 2026-11-02
+description: Use when the user asks for a chart, graph or plot of data (counts, totals, trends over time, shares of a whole) and the Recharts chart provider is enabled. Covers finding the chart components, the data each takes, what Recharts draws, and when to use the generic chart.spec entry.
+---
+
+# Skill: Charts with Recharts
+
+The Recharts provider draws charts the host shows in chat or on a canvas. You never write chart
+code. You pick a chart component from the host's component catalog and hand it data as props.
+
+## Find the components first
+
+1. Call `search_components` with `"chart"` (or the shape you need, such as "bar chart of counts by
+   category" or "trend over months").
+2. Call `describe_component` on the one or two ids that fit, to read the exact props schema.
+3. Render through the host's UI-rendering tool (the one that takes a component tree). Put the chart
+   inside a layout component if the tool needs a root.
+
+The catalog is the source of truth. Ids and schemas below are what it lists today; if the catalog
+differs, follow the catalog.
+
+## Which kind
+
+| Question the chart answers | Kind |
+|---|---|
+| How do categories compare (posts by status, sales by region)? | `bar` |
+| How did a value change over time (sign-ups per month)? | `line` |
+| What share of a whole does each part take (pages vs posts)? | `pie` |
+
+Recharts draws `bar`, `line` and `pie` only. For any other kind (area, scatter, stacked bars), check
+`search_components "chart"` for another provider; if none draws it, the data shows as a table.
+
+## The components and their data
+
+**One series, simplest props** (bar and line share one schema):
+
+- `recharts.bar-chart`, `recharts.line-chart`:
+  `{ data: [rows], categoryKey, valueKey, valueLabel?, color? }`.
+  Every row has the category (`categoryKey`) and a number (`valueKey`).
+  `valueLabel` is the human name shown in the legend and tooltip ("Sign-ups"). Set it whenever
+  the key is not already readable.
+- `recharts.pie-chart`: `{ data: [{ name, value }], color? }`. One row per slice.
+
+The catalog may also list `plugin.recharts.bar-chart` and similar ids. They take the same props and
+always ask Recharts by name.
+
+**Any kind, one or more series: `chart.spec`**
+
+```json
+{ "spec": {
+  "kind": "bar",
+  "categoryKey": "month",
+  "series": [{ "key": "signups", "label": "Sign-ups" }],
+  "data": [{ "month": "Jan", "signups": 12 }, { "month": "Feb", "signups": 19 }],
+  "title": "Sign-ups by month"
+} }
+```
+
+- Every row carries the category and a number (or `null` for a gap) for every series key.
+- Series keys are unique. There is at least one row and one series.
+- For a pie, `categoryKey` names the slices and the single series holds the values.
+- `spec.provider: "plugin.recharts"` asks for Recharts when several providers are enabled.
+- `chart.spec` is always in the catalog. With no provider enabled, it shows the data as a table.
+
+## What Recharts draws, and what falls back
+
+Recharts draws a spec only when all of these hold:
+
+- the kind is `bar`, `line` or `pie`;
+- there is exactly **one** series and a `categoryKey`;
+- every value is a finite number (no `null` gaps);
+- the spec sets no `axes` or `format`.
+
+Anything else goes to another enabled provider that accepts it, or shows as a table. Nothing is
+lost, but tell the user when you know the result will be a table (for example two series with only
+Recharts enabled). Offer one chart per series instead.
+
+## Making it read well
+
+- Aggregate first. Send the counts or totals to plot, not raw records.
+- Bars: about 12 categories or fewer. Sort by value unless the order means something (months,
+  stages). Long labels wrap onto up to three lines; in narrow spaces some labels are skipped, and
+  the full label stays in the tooltip.
+- Lines: time in order, oldest first. Long series are fine; the axis thins its own labels.
+- Pies: 6 slices or fewer, values that add up to a meaningful whole. Merge the small ones into
+  "Other". Use a bar chart when the user needs to compare similar values.
+- Whole-number data (counts) gets whole-number axis ticks automatically. Do not round other data
+  to force it.
+- Leave `color` out unless the user asks. The host theme colours the chart.
+- Give a short title that states what is shown ("Posts by status"), and a description when the
+  chart makes a point the title doesn't.
+- Keep labels short and human: "Published", not `post_status_published`.
+
+## Never
+
+- Never paste Recharts, React, SVG or HTML chart code into the chat, a page or a file to draw a
+  chart. The provider owns the drawing; your job is the data and the component choice.
+- Never invent data. If you can't get the numbers, say so and ask.
+- Never claim a chart rendered when the host reported a refusal. Read the error, fix the props
+  (usually a missing key or a string where a number belongs), and try once more.
+
+## When charts are off
+
+If the chart entries `search_components` returns all report provider `core.table`, no chart
+provider is enabled. The data will show as a table; say so, and tell the user an administrator can
+turn the Recharts chart provider on.

package/cloudflare/NOTES.md

@@ -0,0 +1,16 @@
+# Cloudflare — implementation notes
+
+Host-specific notes moved out of the host's core comments (2026-10-22, vendor-to-plugins). The host describes these
+behaviours generically; the vendor detail lives here.
+
+- **Credentials.** `accountId` is HARD required for Pages publishes; a credential missing it fails with a
+  `DeployError` naming the field. The optional Zone ID may be submitted blank, meaning "not provided".
+- **Stored `projectName`.** Accepted and stored although, when written, the Pages target derived its project
+  name from the publish call's label, not from stored config.
+- **Account label.** No reviewed account field is read from the verify response; the account-label heal
+  skips these credentials.
+- **Security headers.** Root `_headers` is applied only when sent as its own upload field, never as an asset
+  (see `lib/pages-upload.mjs`, `skills/cloudflare/references/pages.md`).
+- **Forms receiver hides the sent form.** On 2026-10-19 a theme's `.oh-form form{display:grid}` kept a sent
+  form on screen after the Cloudflare Worker's script set `hidden` on it; the host's form CSS now forces
+  `[hidden]{display:none!important}`.

package/cloudflare/form-destinations/cloudflare-d1.mjs

@@ -0,0 +1,9 @@
+import { acknowledgeFormSubmissions, pullFormSubmissions } from '../lib/forms.mjs';
+
+/** Form destination `cloudflare-d1`, co-hosted on Cloudflare Workers: publishing to Workers installs
+ * the receiver and its D1 database in the site's own Worker (`lib/target.mjs`); this module only
+ * reads and acknowledges what that receiver stored. */
+export default {
+  pull: pullFormSubmissions,
+  ack: acknowledgeFormSubmissions,
+};

package/cloudflare/lib/api.mjs

@@ -0,0 +1,96 @@
+/** Cloudflare-only HTTP owner. All network effects use the injected, traced host transport. */
+export const API_ROOT = 'https://api.cloudflare.com/client/v4';
+export const segment = ({ value }, _options = {}) => encodeURIComponent(value);
+/** Cloudflare rejects `per_page` above 10 on the Pages projects list (error 8000024, HTTP 400). */
+export const PAGES_PROJECTS_PAGING = { perPage: 10, maxPages: 11 };
+/** Cloudflare caps `per_page` at 50 on the zones list (the default 100 is refused). */
+export const ZONES_PAGING = { perPage: 50, maxPages: 20 };
+
+/** Safe, stable refusal; upstream bodies can contain credentials and never cross this boundary. */
+export function refusal({ kit, code, message, status = 400 }, _options = {}) {
+  const error = new kit.DeployError(`${code}: ${message}`, status, { errorCode: code });
+  error.code = code;
+  return error;
+}
+
+function nextStep({ status }, _options = {}) {
+  if (status === 401 || status === 403) return 'Check the token permissions and account/zone scope in the Cloudflare skill, then preview again.';
+  if (status === 429) return 'Cloudflare is rate limiting this account. Wait, then preview again.';
+  return 'Check the named resource in Cloudflare, then preview again.';
+}
+
+/** Bind credential and HTTP once. Requests never follow redirects with a bearer token. */
+export function createApi({ credential, kit }, _options = {}) {
+  if (!credential.token || !credential.accountId) throw refusal({ kit, code: 'CLOUDFLARE_CREDENTIAL_REQUIRED', message: 'Save a Cloudflare API token and Account ID in the secure connection form.' });
+  const accountPath = `/accounts/${segment({ value: credential.accountId })}`;
+  async function response({ path, method = 'GET', body, jwt }, options = {}) {
+    const init = requestInit({ method, body, token: jwt ?? credential.token });
+    let resp;
+    try { resp = await kit.fetch(`${API_ROOT}${path}`, init, { timeoutMs: options.timeoutMs ?? kit.timeouts.QUICK }); }
+    catch { throw refusal({ kit, code: 'CLOUDFLARE_UNREACHABLE', message: `${method} ${path} could not reach Cloudflare. Check your connection and retry.`, status: 502 }); }
+    if (options.allowMissing && resp.status === 404) return { missing: true };
+    return decodeResponse({ resp, method, path, kit });
+  }
+  async function request(input, options = {}) {
+    const json = await response(input, options);
+    if (json.missing) return null;
+    return json.result ?? json;
+  }
+  async function list({ path }, { maxPages = 100, perPage = 100 } = {}) {
+    const items = [];
+    let pagination = { count: 0, pages: 0 };
+    for (let page = 1; page <= maxPages; page += 1) {
+      const separator = path.includes('?') ? '&' : '?';
+      const json = await response({ path: `${path}${separator}page=${page}&per_page=${perPage}` });
+      if (!Array.isArray(json.result)) throw refusal({ kit, code: 'CLOUDFLARE_INVENTORY_UNKNOWN', message: `${path} did not return a complete list. Check read permissions and preview again.`, status: 502 });
+      items.push(...json.result);
+      pagination = paginationState({ previous: pagination, info: json.result_info });
+      if (items.length > maxPages * perPage) throw refusal({ kit, code: 'CLOUDFLARE_INVENTORY_UNKNOWN', message: `${path} exceeded the inventory item limit. Narrow the account and preview again.`, status: 409 });
+      const more = hasNextPage({ info: json.result_info, page, perPage, count: json.result.length });
+      assertCompletePage({ kit, path, pagination, itemCount: items.length, lastCount: json.result.length, more });
+      if (!more) return items;
+    }
+    throw refusal({ kit, code: 'CLOUDFLARE_INVENTORY_UNKNOWN', message: `${path} exceeded the ${maxPages}-page inventory limit. Narrow the account scope or contact support; no domain changes are safe.`, status: 409 });
+  }
+  return { request, list, accountPath, accountId: credential.accountId, zoneId: credential.zoneId, kit };
+}
+
+function paginationState({ previous, info }, _options = {}) {
+  return { count: Math.max(previous.count, Number(info?.total_count) || 0), pages: Math.max(previous.pages, Number(info?.total_pages) || 0) };
+}
+function assertCompletePage({ kit, path, pagination, itemCount, lastCount, more }, _options = {}) {
+  if ((!more && itemCount < pagination.count) || (lastCount === 0 && pagination.pages > 1)) throw refusal({ kit, code: 'CLOUDFLARE_INVENTORY_UNKNOWN', message: `${path} returned an incomplete inventory page. Refresh read permissions and preview again; no domain changes are safe.`, status: 409 });
+}
+
+async function decodeResponse({ resp, method, path, kit }, _options = {}) {
+  let json;
+  try { json = await resp.json(); }
+  catch { throw refusal({ kit, code: 'CLOUDFLARE_INVALID_RESPONSE', message: `${method} ${path} returned unreadable data. Retry; if it persists check Cloudflare status.`, status: 502 }); }
+  if (json === null || typeof json !== 'object') throw refusal({ kit, code: 'CLOUDFLARE_INVALID_RESPONSE', message: `${method} ${path} returned no usable response object. Retry the request and check Cloudflare status.`, status: 502 });
+  if (!resp.ok || json?.success === false) throw apiFailure({ kit, json, method, path, status: resp.status });
+  return json;
+}
+
+function apiFailure({ kit, json, method, path, status }, _options = {}) {
+  const error = refusal({ kit, code: 'CLOUDFLARE_API_ERROR', message: `${method} ${path} failed (HTTP ${status}). ${nextStep({ status })}`, status });
+  // Classify duplicate creation races without returning Cloudflare's potentially secret-bearing text.
+  const errors = Array.isArray(json.errors) ? json.errors : [];
+  error.details.alreadyExists = errors.some(item => /already exist|already bound|already been taken|already in use|duplicate/i.test(String(item?.message)));
+  return error;
+}
+
+function requestInit({ method, body, token }, _options = {}) {
+  const headers = { Authorization: `Bearer ${token}` };
+  const init = { method, headers, redirect: 'error' };
+  if (body === undefined) return init;
+  if (body instanceof FormData) init.body = body;
+  else { headers['Content-Type'] = 'application/json'; init.body = JSON.stringify(body); }
+  return init;
+}
+
+/** Empty pages before a reported end are incomplete, not evidence of absence. */
+function hasNextPage({ info, page, perPage, count }, _options = {}) {
+  if (Number.isFinite(info?.total_pages)) return page < info.total_pages;
+  if (Number.isFinite(info?.total_count)) return page * (info.per_page ?? perPage) < info.total_count;
+  return count >= perPage;
+}

package/cloudflare/lib/assets.mjs

@@ -0,0 +1,65 @@
+import { createHash } from 'node:crypto';
+import { refusal } from './api.mjs';
+
+/** Stable Pages/Workers dedup key; native crypto avoids a native/WASM dependency.
+ * Retains Pages' historical data+extension hash so existing uploads stay deduplicated. */
+/**
+   * Deterministic content hash used purely as Cloudflare Pages' per-asset
+   * dedup key (the direct-upload protocol needs a stable 32-hex-char key per
+   * file, not a specific algorithm). Swapped from the OD origin's
+   * `blake3-wasm` to Node's built-in `crypto` so this package carries no
+   * native/WASM dependency — see `source-map.md`.
+   */
+export function assetHash({ file, data }, _options = {}) {
+  const extension = file.includes('.') ? file.slice(file.lastIndexOf('.') + 1) : '';
+  return createHash('sha256').update(`${Buffer.from(data).toString('base64')}${extension}`).digest('hex').slice(0, 32);
+}
+
+/** Root _headers/_redirects are configuration, never public assets. A nested copy remains an asset.
+ * Host security headers replace the site's root _headers because they are host policy.
+ * @complexity O(n + bytes) time and space; n is capped by the selected hosting plan. */
+export function prepareAssets({ files, responseHeaders, kit }, { maxFiles = 20_000 } = {}) {
+  const normalized = files.map(file => ({ ...file, file: file.file.replaceAll('\\', '/').replace(/^\.\//, '') }));
+  const headers = responseHeaders && Object.keys(responseHeaders).length > 0;
+  const supplied = headers ? [...normalized.filter(file => file.file !== '_headers'), { file: '_headers', data: renderHeaders({ headers: responseHeaders }) }] : normalized;
+  if (supplied.length > maxFiles) throw refusal({ kit, code: 'CLOUDFLARE_ASSET_COUNT_LIMIT', message: `${supplied.length} files exceed this destination's ${maxFiles}-file limit (including generated files). Reduce the export or explicitly select a supported paid Workers plan.` });
+  const manifest = {};
+  const byHash = new Map();
+  const config = {};
+  for (const file of supplied) addAsset({ file, manifest, byHash, config, kit });
+  return { manifest, byHash, config };
+}
+
+function addAsset({ file, manifest, byHash, config, kit }, _options = {}) {
+  if (!file.file || file.file.startsWith('/') || file.file.split('/').includes('..')) throw refusal({ kit, code: 'CLOUDFLARE_ASSET_PATH', message: `Export path ${file.file} must be relative without '..'. Fix the export and retry.` });
+  const data = Buffer.from(file.data);
+  if (data.length > 25 * 1024 * 1024) throw refusal({ kit, code: 'CLOUDFLARE_ASSET_SIZE_LIMIT', message: `${file.file} exceeds 25 MiB. Resize the file and export again.` });
+  if (file.file === '_headers' || file.file === '_redirects') { config[file.file] = data.toString('utf8'); return; }
+  const path = `/${file.file}`;
+  if (Object.hasOwn(manifest, path)) throw refusal({ kit, code: 'CLOUDFLARE_ASSET_PATH', message: `Duplicate export path ${path}. Fix the export and retry.` });
+  const hash = assetHash({ file: file.file, data });
+  manifest[path] = { hash, size: data.length };
+  byHash.set(hash, { hash, data, contentType: file.contentType ?? 'application/octet-stream' });
+}
+
+export function renderHeaders({ headers }, _options = {}) {
+  const lines = Object.entries(headers).map(([name, value]) => `  ${name}: ${value}`).join('\n');
+  return `/*\n${lines}\n`;
+}
+
+/** Respect both Pages limits. A single oversize request is refused before any upload.
+ * @complexity O(n) over unique missing assets; at most 100 per request. */
+export function chunkUploads({ files }, { maxFiles = 100, maxBytes = 75 * 1024 * 1024 } = {}) {
+  const chunks = [];
+  let chunk = [];
+  let bytes = 2; // JSON array brackets.
+  for (const file of files) {
+    const size = Math.ceil(file.data.length / 3) * 4 + Buffer.byteLength(file.contentType) + file.hash.length + 128;
+    if (size + 2 > maxBytes) throw new Error('CLOUDFLARE_UPLOAD_LIMIT: One asset cannot fit in the upload request. Reduce its size.');
+    if (chunk.length >= maxFiles || bytes + size > maxBytes) { chunks.push(chunk); chunk = []; bytes = 2; }
+    chunk.push(file);
+    bytes += size;
+  }
+  if (chunk.length) chunks.push(chunk);
+  return chunks;
+}