@jini-ai/agent-plugins 0.6.17 → 0.6.19

package/cloudflare/lib/target.mjs

@@ -0,0 +1,165 @@
+import { createHash } from 'node:crypto';
+import { API_ROOT, createApi, refusal, segment, PAGES_PROJECTS_PAGING } from './api.mjs';
+import { prepareAssets } from './assets.mjs';
+import { previewDomains, assertDomainApproval, applyDomains } from './domains.mjs';
+import { normalizeDomain } from './zones.mjs';
+import { pagesAddress } from './pages-upload.mjs';
+import { formPageRoutes, formsWorkerParts, normalizeForms, previewForms, provisionForms } from './forms.mjs';
+
+const WORKERS_TARGET_ID = 'cloudflare-workers';
+
+/** Stable jini-<project> identity, retained for Pages; an explicitly recorded remote name wins. */
+/**
+   * Derives a stable, Cloudflare-Pages-safe project name from the caller's
+   * `projectName` label. Deterministic (no random suffix) so repeated
+   * publishes of the same logical site land on the same Cloudflare Pages
+   * project — replaces the OD origin's `od-${projectId}-${hash}` convention,
+   * which relied on an OD project id this package has no concept of.
+   */
+export function resourceName({ projectName, config, kit }, _options = {}) {
+  if (config.resourceName) {
+    if (!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(config.resourceName)) throw refusal({ kit, code: 'CLOUDFLARE_RESOURCE_NAME', message: 'The remote resource name is invalid. Use the exact existing Cloudflare project/script name.' });
+    return config.resourceName;
+  }
+  const label = kit.safeDnsLabel(projectName) || 'site';
+  return kit.safeDnsLabel(`jini-${label}`).slice(0, 63);
+}
+
+/** Read-only resource and domain inspection through the plugin-owned API. */
+export async function previewTarget({ credential, config, kit, projectName, targetId, formDestination }, _options = {}) {
+  const api = createApi({ credential, kit });
+  const name = resourceName({ projectName, config, kit });
+  const domain = config.customDomain ? normalizeDomain({ domain: config.customDomain, kit }) : undefined;
+  try { return await inspectTarget({ api, config, kit, targetId, name, domain, formDestination }); }
+  catch (error) {
+    if (!domain) throw error;
+    return { resourceName: name, targetId, hostingChanges: [], domains: { inventoryStatus: 'unknown', changes: [],
+      errorCode: 'CLOUDFLARE_INVENTORY_UNKNOWN', hostnames: [domain, `www.${domain}`].map(hostname => ({ hostname, status: 'unknown' })),
+      message: `Cannot safely inspect ${domain}. ${error.message} Complete the named read permission or setup step, then preview again.` } };
+  }
+}
+
+async function inspectTarget({ api, config, kit, targetId, name, domain, formDestination }, _options = {}) {
+  const path = targetId === WORKERS_TARGET_ID ? `${api.accountPath}/workers/scripts` : `${api.accountPath}/pages/projects`;
+  const resources = await api.list({ path }, targetId === WORKERS_TARGET_ID ? {} : PAGES_PROJECTS_PAGING);
+  // Workers scripts are identified by `id`, Pages projects by `name`.
+  const existing = resources.find(resource => resource.id === name || resource.name === name);
+  const hostingChanges = [{ action: existing ? 'update' : 'create', targetId, resourceName: name }];
+  if (targetId === WORKERS_TARGET_ID) {
+    await workersAddress({ api, kit, resourceName: name });
+    hostingChanges.push({ action: 'enable-workers-dev', targetId, resourceName: name });
+  }
+  const domains = domain ? await previewDomains({ api, kit, targetId, resourceName: name, domain, zoneId: config.zoneId }) : undefined;
+  const formSubmissions = await previewForms({ api, kit, resourceName: name, targetId, formDestination });
+  return { resourceName: name, targetId, hostingChanges, ...(domains ? { domains } : {}), ...(formSubmissions ? { formSubmissions } : {}) };
+}
+
+/** Read workers.dev from Cloudflare. Never manufacture an account subdomain or register one. */
+export async function workersAddress({ api, kit, resourceName }, _options = {}) {
+  const result = await api.request({ path: `${api.accountPath}/workers/subdomain` }, { allowMissing: true });
+  if (typeof result?.subdomain !== 'string' || !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(result.subdomain)) throw refusal({ kit, code: 'CLOUDFLARE_SUBDOMAIN_REQUIRED', message: `Worker ${resourceName} needs this account's workers.dev subdomain. Open Workers & Pages in the Cloudflare dashboard, set it up, then preview again.` });
+  return `https://${resourceName}.${result.subdomain}.workers.dev`;
+}
+
+/** One lifecycle shared by both hosting variants. The transport-specific uploader is injected.
+ * Consent/stale checks precede ALL remote writes, including provisioning and upload sessions. */
+export function createTarget({ credential, config, kit, targetId, upload }, _options = {}) {
+  const api = createApi({ credential, kit });
+  return {
+    id: targetId,
+    /** Read-only address resolution, sharing each variant's existing address owner. */
+    resolvePublicUrl: ({ projectName }, _options = {}) => {
+      const name = resourceName({ projectName, config, kit });
+      return targetId === WORKERS_TARGET_ID ? workersAddress({ api, kit, resourceName: name }) : Promise.resolve(pagesAddress({ resourceName: name }));
+    },
+    async publish(input, options = {}) {
+      const merged = { ...input, ...options };
+      const name = resourceName({ projectName: input.projectName, config, kit });
+      const requestedDomain = config.customDomain ?? merged.metadata?.customDomain;
+      const domainInput = { api, kit, targetId, resourceName: name, domain: requestedDomain, zoneId: config.zoneId, approval: merged.metadata?.domainApproval };
+      const plan = requestedDomain ? await assertDomainApproval(domainInput) : undefined;
+      const prepared = preparePublish({ input: merged, kit, config, plan, targetId });
+      const forms = await prepareForms({ api, kit, targetId, resourceName: name, formDestination: merged.metadata?.formDestination, files: merged.files });
+      const hosting = await upload({ api, kit, resourceName: name, prepared: prepared.assets, ...(forms ? { forms: forms.parts } : {}) });
+      const link = await kit.waitForReachableDeploymentUrl([hosting.url], { providerLabel: targetId });
+      const hostnames = plan ? await applyDomains({ api, kit, plan, proof: prepared.proof }) : [];
+      return publishResult({ targetId, name, accountId: api.accountId, hosting, link, hostnames, plan, forms });
+    },
+    checkReachability: url => kit.checkDeploymentUrl(url),
+  };
+}
+
+/** The publish outcome: hosting status, unfinished custom domains, and safe provider metadata (never a key). */
+function publishResult({ targetId, name, accountId, hosting, link, hostnames, plan, forms }, _options = {}) {
+  const complete = hostnames.every(hostname => hostname.status === 'ready' && !hostname.operationFailed);
+  return { targetId, url: hosting.url, deploymentId: hosting.deploymentId, status: complete ? link.status : 'link-delayed',
+    statusMessage: complete ? link.statusMessage : `Hosting is ${link.status}; custom domains are unfinished. ${hostnames.filter(host => host.status !== 'ready' || host.operationFailed).map(host => host.message).join(' ')}`,
+    providerMetadata: { resourceName: name, projectName: name, accountId, hosting: { ...link, url: hosting.url }, hostnames, ...(plan ? { domainChanges: plan.changes, zoneId: plan.zone.id } : {}),
+      ...(forms ? { formSubmissions: forms.summary } : {}) } };
+}
+
+/** Workers with active forms: provision D1 and build the receiver parts. Pages and form-less sites keep assets only.
+ * Runs after consent checks and before the upload session, so a failed provision changes no script. */
+async function prepareForms({ api, kit, targetId, resourceName, formDestination, files }, _options = {}) {
+  if (targetId !== WORKERS_TARGET_ID) return undefined;
+  const normalized = normalizeForms({ formDestination, kit });
+  if (!normalized) return undefined;
+  const database = await provisionForms({ api, kit, resourceName });
+  const parts = await formsWorkerParts({ manifest: normalized, secret: normalized.secret, databaseId: database.databaseId }, { pageRoutes: formPageRoutes({ files }) });
+  return { parts, summary: { forms: normalized.forms.length, databaseId: database.databaseId, databaseName: database.databaseName } };
+}
+
+function preparePublish({ input, kit, config, plan, targetId }, _options = {}) {
+  const maxFiles = targetId === WORKERS_TARGET_ID && config.assetPlan === 'paid' ? 100_000 : 20_000;
+  const assets = prepareAssets({ files: input.files, responseHeaders: input.responseHeaders, kit }, { maxFiles });
+  if (!plan) return { assets };
+  const expected = createHash('sha256').update(JSON.stringify({ manifest: assets.manifest, config: assets.config })).digest('hex');
+  const path = `/.well-known/tovu-deployment-${expected}.txt`;
+  const proofFile = { file: path.slice(1), data: expected, contentType: 'text/plain' };
+  return { assets: prepareAssets({ files: [...input.files, proofFile], responseHeaders: input.responseHeaders, kit }, { maxFiles }), proof: { path, expected } };
+}
+
+/** Verify active status with the account endpoint when an account is supplied. User-owned
+ * tokens may require the user endpoint; a scope mismatch alone must not be called rejection.
+ * No identity or provider body crosses this boundary. At most two bounded read-only requests.
+ * @complexity O(1) requests and response processing (transport bounds response size).
+ */
+export async function verifyCredential({ credential, kit }, _options = {}) {
+  const paths = credential.accountId
+    ? [`/accounts/${segment({ value: credential.accountId })}/tokens/verify`, '/user/tokens/verify']
+    : ['/user/tokens/verify'];
+  return verifyAt({ credential, kit, paths, index: 0 });
+}
+
+/** One verify endpoint; a scope-shaped refusal falls through to the next endpoint when there is one.
+ * A bounded recursion (at most `paths.length` requests) rather than a loop, so every path ends in a
+ * return and there is no unreachable loop exit. */
+async function verifyAt({ credential, kit, paths, index }) {
+  let resp;
+  try {
+    resp = await kit.fetch(`${API_ROOT}${paths[index]}`, { method: 'GET', headers: { Authorization: `Bearer ${credential.token}` }, redirect: 'error' }, { timeoutMs: kit.timeouts.QUICK });
+  } catch { return { ok: false, reason: 'unreachable' }; }
+  if (!resp.ok && index + 1 < paths.length && [400, 401, 403, 404].includes(resp.status)) return verifyAt({ credential, kit, paths, index: index + 1 });
+  return verifyVerdict({ resp });
+}
+
+/** The verdict of the last endpoint tried: only 401/403 or a disabled/expired token is `rejected`. */
+async function verifyVerdict({ resp }) {
+  if (!resp.ok) return { ok: false, reason: resp.status === 401 || resp.status === 403 ? 'rejected' : 'unreachable', statusCode: resp.status };
+  let json;
+  try { json = await resp.json(); }
+  catch { return { ok: false, reason: 'unreachable', statusCode: resp.status }; }
+  return tokenStatusVerdict({ json, statusCode: resp.status });
+}
+
+/** A readable verify body: `active` is ok, `disabled`/`expired` rejected, anything else unreachable. */
+function tokenStatusVerdict({ json, statusCode }) {
+  if (json?.success === true && json.result?.status === 'active') return { ok: true };
+  if (json?.success === true && ['disabled', 'expired'].includes(json.result?.status)) return { ok: false, reason: 'rejected', statusCode };
+  return { ok: false, reason: 'unreachable', statusCode };
+}
+
+export function validateConfig(config, _options = {}) {
+  if (config.assetPlan && !['free', 'paid'].includes(config.assetPlan)) return 'assetPlan must be free or paid. Select the actual Workers account plan.';
+  return null;
+}

package/cloudflare/lib/workers-upload.mjs

@@ -0,0 +1,48 @@
+import { refusal, segment } from './api.mjs';
+import { workersAddress } from './target.mjs';
+
+/** Pinned protocol date: advance with release acceptance, never silently use today's date. */
+export const COMPATIBILITY_DATE = '2026-10-01';
+const MODULE = 'export default { fetch(request, env) { return env.ASSETS.fetch(request); } };';
+
+/** Server buckets are authoritative. Sequential upload bounds concurrency to one request.
+ * @complexity O(files + bytes) hashing/encoding and one request per nonempty server bucket. */
+export async function uploadWorker({ api, kit, resourceName, prepared, forms }, _options = {}) {
+  const url = await workersAddress({ api, kit, resourceName });
+  const scriptPath = `${api.accountPath}/workers/scripts/${segment({ value: resourceName })}`;
+  const session = await api.request({ path: `${scriptPath}/assets-upload-session`, method: 'POST', body: { manifest: prepared.manifest } });
+  if (!session.jwt || !Array.isArray(session.buckets) || session.buckets.some(bucket => !Array.isArray(bucket))) throw refusal({ kit, code: 'CLOUDFLARE_ASSET_BUCKET_INVALID', message: `Worker ${resourceName} returned an invalid upload session. Preview and retry.`, status: 502 });
+  const jwt = await uploadBuckets({ api, kit, session, prepared });
+  const form = scriptForm({ jwt, config: prepared.config, forms });
+  const result = await api.request({ path: scriptPath, method: 'PUT', body: form }, { timeoutMs: kit.timeouts.DEPLOY });
+  await api.request({ path: `${scriptPath}/subdomain`, method: 'POST', body: { enabled: true, previews_enabled: false } });
+  return { url, deploymentId: result.id };
+}
+
+/** Assets-only script, or (with `forms`) the receiver modules, D1 and key bindings, and Worker-first form routes. */
+export function scriptForm({ jwt, config, forms }, _options = {}) {
+  const modules = forms?.modules ?? [{ name: 'index.mjs', source: MODULE }];
+  const assetsConfig = { html_handling: 'auto-trailing-slash', not_found_handling: '404-page', ...config, ...(forms ? { run_worker_first: forms.runWorkerFirst } : {}) };
+  const form = new FormData();
+  form.append('metadata', JSON.stringify({ main_module: 'index.mjs', compatibility_date: COMPATIBILITY_DATE, bindings: [{ type: 'assets', name: 'ASSETS' }, ...(forms?.bindings ?? [])], assets: { jwt, config: assetsConfig } }));
+  for (const module of modules) form.append(module.name, new File([module.source], module.name, { type: 'application/javascript+module' }));
+  return form;
+}
+
+async function uploadBuckets({ api, kit, session, prepared }, _options = {}) {
+  const nonempty = session.buckets.filter(bucket => bucket.length > 0);
+  if (nonempty.length === 0) return session.jwt;
+  let completion;
+  for (const bucket of nonempty) {
+    const form = new FormData();
+    for (const hash of bucket) {
+      const file = prepared.byHash.get(hash);
+      if (!file) throw refusal({ kit, code: 'CLOUDFLARE_ASSET_BUCKET_INVALID', message: `Cloudflare requested unknown asset hash ${hash}. Do not upload; preview and retry.`, status: 502 });
+      form.append(hash, new File([file.data.toString('base64')], hash, { type: file.contentType }));
+    }
+    const result = await api.request({ path: `${api.accountPath}/workers/assets/upload?base64=true`, method: 'POST', jwt: session.jwt, body: form }, { timeoutMs: kit.timeouts.UPLOAD });
+    if (result.jwt) completion = result.jwt;
+  }
+  if (!completion) throw refusal({ kit, code: 'CLOUDFLARE_UPLOAD_INCOMPLETE', message: 'Worker asset upload returned no completion token. Retry publishing; the script has not been changed.', status: 502 });
+  return completion;
+}

package/cloudflare/lib/zones.mjs

@@ -0,0 +1,25 @@
+import { refusal, segment, ZONES_PAGING } from './api.mjs';
+
+/** Hostname validation is deliberately strict: no URL, wildcard, port or inferred parent zone. */
+export function normalizeDomain({ domain, kit }, _options = {}) {
+  const name = String(domain).trim().toLowerCase().replace(/\.$/, '');
+  if (name.length > 253 || !name.includes('.') || !name.split('.').every(label => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))) {
+    throw refusal({ kit, code: 'CLOUDFLARE_INVALID_DOMAIN', message: 'Enter the apex domain as a hostname (without https://, www prefix, port or path), then preview again.' });
+  }
+  return name;
+}
+
+/** Absorbs the old Pages zone discovery; verifies active full zone AND exact account ownership. */
+export async function resolveZone({ api, domain, zoneId }, _options = {}) {
+  const zones = zoneId ? [{ id: zoneId }] : await api.list({ path: `/zones?account.id=${segment({ value: api.accountId })}` }, ZONES_PAGING);
+  const selected = zoneId ? zones[0] : zones.find(zone => zone.name === domain);
+  if (!selected?.id) throw refusal({ kit: api.kit, code: 'CLOUDFLARE_ZONE_REQUIRED', message: `No accessible zone matches ${domain}. Add it to this Cloudflare account or select its Zone ID and grant Zone Read.` });
+  const zone = await api.request({ path: `/zones/${segment({ value: selected.id })}` });
+  assertSelectedZone({ api, zone, selected, domain });
+  return { id: selected.id, name: zone.name };
+}
+
+function assertSelectedZone({ api, zone, selected, domain }, _options = {}) {
+  if (zone?.name !== domain || zone.account?.id !== api.accountId) throw refusal({ kit: api.kit, code: 'CLOUDFLARE_ZONE_MISMATCH', message: `${domain} does not match zone ${selected.id} in account ${api.accountId}. Select the correct domain, account and Zone ID.` });
+  if (zone.status !== 'active' || zone.type !== 'full') throw refusal({ kit: api.kit, code: 'CLOUDFLARE_ZONE_INACTIVE', message: `${domain} needs an active full Cloudflare DNS zone. Finish nameserver setup in Cloudflare, then preview again.` });
+}

package/cloudflare/mcp.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
+  "mcpServers": {}
+}

package/cloudflare/plugin.json

@@ -0,0 +1,96 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+  "name": "cloudflare",
+  "version": "0.3.1",
+  "description": "Publishes static exports to Cloudflare Workers or Pages and attaches reviewed custom domains using your saved Cloudflare connection. Workers sites with active forms store submissions in a D1 database in your Cloudflare account for the host to pull. Preview reads current infrastructure; domain changes require human confirmation.",
+  "author": "Tovu",
+  "license": "Apache-2.0",
+  "extensions": {
+    "tovu": {
+      "vendorAliases": ["pages.dev", "workers.dev"],
+      "displayName": "Cloudflare",
+      "summary": "Publish static exports with Workers or Pages and review apex/www domain changes before applying them.",
+      "id": "tovu/cloudflare",
+      "provides": [
+        "deploy-target:cloudflare-workers",
+        "deploy-target:cloudflare-pages",
+        "form-destination:cloudflare-d1"
+      ],
+      "supersedes": {
+        "packages": [
+          "cloudflare-pages"
+        ],
+        "contributions": [
+          {
+            "fromPlugins": [
+              "deploy",
+              "cloudflare-pages"
+            ],
+            "descriptorId": "cloudflare-pages",
+            "label": "deploy target"
+          }
+        ]
+      },
+      "credentialCards": [
+        {
+          "target": "cloudflare-workers",
+          "title": "Connect Cloudflare Workers",
+          "label": "Cloudflare Workers connection",
+          "category": "hosting",
+          "intro": "Connect Cloudflare Workers to publish this site, with optional forms and approved custom-domain changes.",
+          "usedFor": [
+            "Publishes your website on Cloudflare Workers",
+            "Collects your site's form submissions",
+            "Checks your domain and applies domain changes you approve"
+          ],
+          "keyHint": "Scope to the selected account: Account → Workers Scripts → Edit. Forms also need D1 → Edit. Custom domains need Zone, DNS, Workers Routes, Workers Scripts and Cloudflare Pages reads; certificate polling needs SSL and Certificates → Read. Grant DNS or Workers Routes edit only for the corresponding approved changes.",
+          "saveKind": "publish-host",
+          "helpUrl": "https://dash.cloudflare.com/profile/api-tokens",
+          "helpLabel": "Create a token",
+          "baseUrl": "https://api.cloudflare.com"
+        },
+        {
+          "target": "cloudflare-pages",
+          "title": "Connect Cloudflare Pages",
+          "label": "Cloudflare Pages connection",
+          "category": "hosting",
+          "intro": "Connect Cloudflare Pages to publish this site, with optional approved custom-domain changes.",
+          "usedFor": [
+            "Publishes your website on Cloudflare Pages",
+            "Checks your domain and applies domain changes you approve"
+          ],
+          "keyHint": "Scope to the selected account: Account → Cloudflare Pages → Edit. Custom domains need Zone, DNS, Workers Routes and Workers Scripts reads; attaching a domain needs DNS → Edit. Grant Workers Scripts or Workers Routes edit only for corresponding approved transfers.",
+          "saveKind": "publish-host",
+          "helpUrl": "https://dash.cloudflare.com/profile/api-tokens",
+          "helpLabel": "Create a token",
+          "baseUrl": "https://api.cloudflare.com"
+        }
+      ],
+      "publicDnsResolver": {
+        "url": "https://cloudflare-dns.com/dns-query",
+        "format": "dns-json"
+      }
+    }
+  },
+  "keywords": [
+    "cloudflare-pages",
+    "cloudflare",
+    "deploy",
+    "publish",
+    "hosting",
+    "static-site",
+    "static-export",
+    "go-live",
+    "website",
+    "deploy-target:cloudflare-pages",
+    "workers",
+    "deploy-target:cloudflare-workers",
+    "custom-domain",
+    "dns",
+    "pages",
+    "cloudflare-workers",
+    "custom domain",
+    "apex",
+    "www"
+  ]
+}

package/cloudflare/skills/cloudflare/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: cloudflare
+description: Publish a site's static exports to Cloudflare Workers or Pages and attach apex plus www domains after a human reviews the exact current infrastructure and changes. Explains token permissions, limits and partial results.
+---
+
+# Cloudflare
+
+## Connection card
+
+Choose the card yourself from its `usedFor` list. Reuse a saved key or working sign-in for that
+task. Never offer a replacement unless the person asks.
+
+Open the plugin’s own card for the selected destination: `credential_save {kind:"plugin-provider",target:"cloudflare-workers"}` or `credential_save {kind:"plugin-provider",target:"cloudflare-pages"}`. Each card explains its permissions and collects the Account ID and optional Zone ID along with the masked token. Read `references/permissions.md` before requesting custom-domain access.
+
+Use `deployment_get_static_publish_capabilities` → `deployment_preview_static_publish` →
+`deployment_execute_static_publish`. Prefer **Workers** (`cloudflare-workers`) for a **new** destination.
+Keep **Pages** (`cloudflare-pages`) for existing Pages history/bindings or an explicit Pages choice.
+A plugin upgrade never moves an existing site between products. Use `lastPublish` and the exact
+`resourceName` from its config. Never guess a workers.dev account subdomain.
+
+This hosts **static exports only**, including exported HTML, CSS, JavaScript and media. It does not run
+the host's server, database, admin, dynamic forms, authentication or server rendering.
+
+Load [permissions](references/permissions.md) before requesting a connection, and
+[domains](references/domains.md) before any domain change. Load [Workers](references/workers.md) or
+[Pages](references/pages.md) for the selected target, and [troubleshooting](references/troubleshooting.md)
+when a check fails.
+
+A preview with authenticated inspection needs `projectName`, using the SAME label as execute, plus
+`target`, optional `credentialId`, and the descriptor's config fields. It issues authenticated **GETs
+only**. Secrets are resolved server-side, never returned. Domain input is `customDomain` (apex only,
+e.g. the person's actual domain) and optional `zoneId`. Both apex and www are inspected and attached.
+Never invent an account, domain or project name for the person.
+
+The execute tool shows the exact current records/bindings/routes and changes in a human confirmation
+card. Only the person's click authorizes domain cutover. A model-supplied `confirmed:true`, opaque
+request flag or chat assertion is not approval. Unknown/incomplete inventory refuses domain changes.
+If state or the credential changes, preview and confirm again. The current HTTP publish route cannot
+approve domains; guide the person to the existing chat confirmation card until the domain UI lands.
+
+Keep one saved vendor connection: kind `vendor`, vendor `cloudflare`, encrypted
+`{token, accountId, zoneId?}`. Open `credential_save` with kind `plugin-provider` and the selected target;
+people enter secrets in its secure form, never chat. Keep existing Pages-only `worksFor` compatibility.
+To add Workers/DNS capabilities, the person must explicitly update permissions/compatibility on that
+same credential. Token active status alone proves no capability's permissions.
+If the person asks to replace a token, list the exact permissions needed for the requested
+operation from the permissions table and limit it to the selected account/zones. For a
+Workers-only static publish, request Workers Scripts: Edit; add D1: Edit only for active forms.
+For Pages-only publishing, request Cloudflare Pages: Edit. Add domain permissions only when needed.
+Offer to help enable workers.dev when the chosen deployment needs it. If the account has no
+subdomain, guide the person through Workers & Pages setup; never invent one or enable it silently.
+
+Hosting accepted plus unfinished requested domains is `ok:"partial"` (tools: `published:true`,
+`reachable:false`). Report every hostname's state and next step. Never say the requested site is live
+until both hostnames have active validation/certificates and serve the deployed content over HTTPS.
+There is no automatic rollback or step journal. For a partial cutover, inspect the current state and
+confirm a fresh preview before retrying; do not blindly restore old DNS.

package/cloudflare/skills/cloudflare/references/domains.md

@@ -0,0 +1,31 @@
+# Apex and www
+
+Supply the apex hostname as `customDomain` and optional `zoneId`; the plugin never discovers a zone
+by removing the first hostname label. It enumerates zones and verifies the exact active full zone,
+account and apex match. The preview reads all DNS records, Worker Custom Domains, Worker routes
+(including disabled/no-script and wildcard/path routes), and every accessible Pages project's domains.
+Permissions denied, malformed responses or bounded inventory exhaustion mean **unknown** and refuse
+all domain changes.
+
+Review both hostnames' current records, bindings, routes and the exact change list. Existing address
+records (A/AAAA/CNAME) and other product bindings may be replaced only through the human's card.
+Identical bindings/CNAMEs are reused. Pages-created CNAMEs keep the historical `jini-deploy:` ownership
+marker; an unmarked but identical CNAME may be reused. Existing MX/TXT/CAA are preserved. Relevant
+wildcards and inherited CAA are displayed. Exact records override wildcard DNS, so wildcard DNS is
+preserved. An overlapping Worker route is removed as a WHOLE only when its wider impact was displayed
+and confirmed; automatic splitting is not supported.
+
+Workers uses Custom Domains separately for apex and www; Cloudflare manages their DNS and
+certificates. Pages first associates each project domain, then creates its CNAME to the project's
+pages.dev address (Cloudflare flattens the apex). Apex zone and Pages project must be in the same
+account.
+
+Execution rechecks the credential and approved state before writes, and checks domain state again
+immediately before cutover. It polls validation/certificate state with bounded delays, then probes a
+content-addressed proof file over guarded HTTPS on BOTH hosts. HTTP 200 from an old site does not
+count. A delayed certificate, validation error or content mismatch remains partial with per-host
+states. Retry with a fresh preview; unrelated records are never cleanup targets.
+
+Both names initially serve content; no canonical-host redirect is added automatically. DNS/binding
+cutover is not atomic. The review warns of interruption and broader wildcard impact. There is no
+automatic rollback: inspect current infrastructure before any manual recovery.

package/cloudflare/skills/cloudflare/references/pages.md

@@ -0,0 +1,18 @@
+# Pages compatibility
+
+The target ID remains `cloudflare-pages`, while its containing plugin is now `cloudflare`.
+Existing site history, credential IDs/ciphertext/defaults, environment variables, URLs and
+`jini-<project>` names retain their meanings. Use Pages again when history/bindings say Pages, or
+when explicitly requested. A rename alone never migrates infrastructure or broadens `worksFor`.
+
+The account credential needs `token` and `accountId`; optional `zoneId` is a default selection.
+Environment fallback still reads `CLOUDFLARE_TOKEN` / `CLOUDFLARE_API_TOKEN` and
+`CLOUDFLARE_ACCOUNT_ID` only in the existing allowed execution modes.
+
+Pages retains project lookup/create, upload-token, check-missing, deduplicated upload batches,
+upsert-hashes and deployments. Root `_headers` and `_redirects` are deployment form fields, never
+manifest assets; a nested copy remains an ordinary file. Host headers replace the site's root
+_headers because they are host policy. Limits: 25 MiB/file, 20,000 files including generated files,
+at most 100 files and 75 MiB encoded JSON in each upload batch.
+
+Official domain setup: https://developers.cloudflare.com/pages/configuration/custom-domains/

package/cloudflare/skills/cloudflare/references/permissions.md

@@ -0,0 +1,29 @@
+# Token permissions to tick
+
+Create a custom API token at Cloudflare → My Profile → API Tokens. Scope Account permissions to the
+chosen account and Zone permissions to the selected zones. Request only the chosen capabilities:
+
+| Capability | Cloudflare permission checkboxes |
+|---|---|
+| Workers publish | **Account → Workers Scripts → Edit** |
+| Pages publish | **Account → Cloudflare Pages → Edit** |
+| Form submissions (Workers sites with active forms) | **Account → D1 → Edit** in addition to Workers publish |
+| Preview custom domains, either target | **Zone → Zone → Read**, **Zone → DNS → Read**, **Zone → Workers Routes → Read**, **Account → Workers Scripts → Read**, **Account → Cloudflare Pages → Read** |
+| Workers Custom Domain attachment | **Account → Workers Scripts → Edit**; **Zone → SSL and Certificates → Read** for certificate polling |
+| Pages domain attachment | **Account → Cloudflare Pages → Edit**, **Zone → DNS → Edit** |
+| Approved removal of conflicting DNS | **Zone → DNS → Edit** |
+| Approved removal of another Worker's binding | **Account → Workers Scripts → Edit** |
+| Approved removal of another Pages project's binding | **Account → Cloudflare Pages → Edit** |
+| Approved removal of an overlapping route | **Zone → Workers Routes → Edit** |
+
+Edit includes the corresponding reads. Cross-product inspection needs both Workers and Pages reads
+even when only one product is the destination. A 403 on either inventory means **unknown**, not clear.
+If the person cannot grant full inspection, publishing without a custom domain remains available.
+
+`GET /accounts/{account_id}/tokens/verify` checks account-owned tokens; user-owned tokens use
+`GET /user/tokens/verify`. The save check tries the account endpoint first and, on a possible scope
+mismatch, the user endpoint. Both check active token status only. A green token check is not proof that
+Workers upload, Pages upload, zone discovery, DNS changes, route transfer or certificate reads work.
+The authenticated preview names the first denied operation and its account/zone resource.
+
+Compatibility must explicitly include `cloudflare-workers` for Workers. Historical `worksFor:["cloudflare"]` and `worksFor:["cloudflare-pages"]` stay Pages-only. After granting the required permissions, explicitly update the same connection to include both target IDs if it should serve both products. No background rewrite expands a saved grant.

package/cloudflare/skills/cloudflare/references/troubleshooting.md

@@ -0,0 +1,20 @@
+# What failed and the next step
+
+| Code/result | Plain explanation | Next step |
+|---|---|---|
+| `CLOUDFLARE_CREDENTIAL_REQUIRED` | The connection lacks a token or Account ID. | Update it in the secure connection form. |
+| `CLOUDFLARE_API_ERROR` HTTP 401/403 | The named account/zone/project operation was denied. | Check that operation's checkboxes and account/zone scope; keep the same connection ID. |
+| `CLOUDFLARE_API_ERROR` HTTP 429 | Cloudflare is limiting requests. | Wait and preview again. Do not replace a working token. |
+| `CLOUDFLARE_UNREACHABLE` / `CLOUDFLARE_INVALID_RESPONSE` | The provider or network did not return usable data. | Check the connection and Cloudflare status, then retry. |
+| `CLOUDFLARE_SUBDOMAIN_REQUIRED` | This account has no workers.dev address configured. | Finish Workers & Pages setup in the Cloudflare dashboard. |
+| `CLOUDFLARE_ASSET_COUNT_LIMIT` / `CLOUDFLARE_ASSET_SIZE_LIMIT` | The named export exceeds a hosting limit. | Reduce the export/file; choose paid Workers only if the actual account has that plan. |
+| `CLOUDFLARE_ASSET_PATH` | The export contains an invalid or duplicate path. | Fix the named path and export again. |
+| `CLOUDFLARE_ASSET_BUCKET_INVALID` / `CLOUDFLARE_UPLOAD_INCOMPLETE` | The upload session could not complete safely. | Retry publishing; no new script was uploaded after this failure. |
+| `CLOUDFLARE_ZONE_REQUIRED` / `CLOUDFLARE_ZONE_MISMATCH` | Zone, domain and account do not match. | Select the actual apex and Zone ID in the correct account. |
+| `CLOUDFLARE_ZONE_INACTIVE` | The zone is not an active full Cloudflare zone. | Finish nameserver setup, then preview again. |
+| `CLOUDFLARE_INVENTORY_UNKNOWN` / `DOMAIN_INVENTORY_UNKNOWN` | Some current records/bindings/routes could not be inspected. | Complete all inventory read permissions or narrow the account; no domain changes are safe yet. |
+| `CLOUDFLARE_DOMAIN_CONFIRMATION_REQUIRED` / `DOMAIN_CONFIRMATION_REQUIRED` | This call has no authenticated human approval of the exact domain changes. | Run execute through chat and answer its review card. Request flags cannot confirm it. |
+| `CLOUDFLARE_DOMAIN_PLAN_STALE` / `PLAN_STALE` / `CREDENTIAL_CHANGED` | Infrastructure or the selected connection changed after review. | Preview and confirm the new state. |
+| `ok:"partial"`, `reachable:false`, pending hostname | Hosting was uploaded but one or both domains lack validation, certificate or expected content. | Report the hostnames separately, inspect Cloudflare DNS/TLS/CAA status and retry a fresh preview. Never claim live. |
+
+Never include a token or raw upstream error body in an explanation.

package/cloudflare/skills/cloudflare/references/workers.md

@@ -0,0 +1,42 @@
+# Workers static assets
+
+Stable script name: `jini-<project-name>`, unless `resourceName` supplies the exact existing name.
+The plugin reads the account's workers.dev subdomain. If absent, open Workers & Pages in the
+Cloudflare dashboard and finish workers.dev setup; do not invent or register a subdomain automatically.
+Preview discloses script creation/update and enabling its workers.dev endpoint.
+
+Publishing creates an asset upload session, uploads exactly the nonempty server buckets with the
+session JWT, then uses the completion JWT in script metadata. Empty buckets need no upload.
+A minimal module delegates to `env.ASSETS.fetch`; its `ASSETS` binding owns the static files.
+Root `_headers`/`_redirects` go through assets config and are never public assets. Nested copies are
+ordinary assets. Host security headers replace any root site-supplied `_headers` because they are
+host policy.
+
+Each file is at most 25 MiB. Default/free limit is 20,000 files, paid is 100,000; `assetPlan:"paid"`
+must describe the real Workers account plan. Generated configuration/content-proof files count.
+Uploads run sequentially to bound memory and concurrency. The compatibility date is pinned in code
+and should advance only after release acceptance.
+
+## Form submissions
+
+When the site has at least one active form, the same Worker also receives `POST /forms/:slug/submit`
+(the path the host's forms already post to, so exported HTML is unchanged and there is no CORS). Publishing
+finds or creates D1 database `tovu-forms-<script name>`, applies the plugin's forward-only migrations
+(`schema_migrations`), binds it as `TOVU_FORMS`, installs the per-site receiver key as secret
+`TOVU_FORMS_SECRET`, and routes `/forms/*` and `/_tovu/*` to the Worker before static assets. The
+database is never dropped or recreated. The receiver checks only the compact manifest the host supplies
+(slugs, field names, required, max length), honours the host's `_hp` honeypot and rate-limits to 5 valid
+submissions per IP per form per 60 seconds; the host re-validates on pull. No file uploads. The host pulls
+pending rows through `GET /_tovu/forms/pending` and `POST /_tovu/forms/ack` with the receiver key.
+After a submission the visitor returns to the page with `?form=<slug>&form_status=success`. Pages
+that contain a form are also routed to the Worker first (exact paths only; assets and other pages stay
+on the free static path), which hides the form and shows the host's own success message, or one plain
+"Thanks, your submission was received." line when the page has none.
+Needs **Account → D1 → Edit** on the saved token; preview names it when missing. Pages sites with
+forms are not supported yet; preview says so.
+The receiver is form destination `cloudflare-d1` (co-hosted on Workers); the site's `core.forms`
+`receiver` setting keeps it on with `auto` (the default) and turns it off with `none`.
+
+Official protocol: https://developers.cloudflare.com/workers/static-assets/direct-upload/
+
+A self-hosted operator may explicitly configure `CLOUDFLARE_WORKERS_TOKEN` with `CLOUDFLARE_ACCOUNT_ID`. Historical `CLOUDFLARE_TOKEN` / `CLOUDFLARE_API_TOKEN` environment credentials remain Pages-only; the new target never silently reuses them. A saved compatible connection still takes precedence under the existing resolver.

package/cloudflare/targets/cloudflare-pages.mjs

@@ -0,0 +1,12 @@
+import { createTarget, previewTarget, validateConfig, verifyCredential } from '../lib/target.mjs';
+import { uploadPages } from '../lib/pages-upload.mjs';
+
+export const CLOUDFLARE_PAGES_TARGET_ID = 'cloudflare-pages';
+
+export default {
+  destinationConfig: ({ providerMetadata }, _options = {}) => typeof providerMetadata?.resourceName === 'string' ? { resourceName: providerMetadata.resourceName } : {},
+  validateConfig,
+  verifyCredential,
+  preview: (input, options = {}) => previewTarget({ ...input, targetId: CLOUDFLARE_PAGES_TARGET_ID }, options),
+  create: (context, options = {}) => createTarget({ ...context, targetId: CLOUDFLARE_PAGES_TARGET_ID, upload: uploadPages }, options),
+};

package/cloudflare/targets/cloudflare-workers.mjs

@@ -0,0 +1,17 @@
+import { createTarget, previewTarget, validateConfig, verifyCredential } from '../lib/target.mjs';
+import { uploadWorker } from '../lib/workers-upload.mjs';
+
+/** Workers serves static exports only; the host's own server stays where it runs today.
+ * A site with active forms also gets the bundled submissions receiver (D1) on the same Worker; pulling
+ * what it stored is form destination `cloudflare-d1` (`form-destinations/cloudflare-d1.mjs`). */
+export default {
+  defaultForNewDestination: true,
+  // Historical worksFor:[cloudflare] meant Pages only. Adding Workers must not expand that grant.
+  defaultCredentialWorksFor: ['cloudflare-workers'],
+  acceptsCredential: ({ worksFor }, _options = {}) => worksFor.includes('cloudflare-workers'),
+  destinationConfig: ({ providerMetadata }, _options = {}) => typeof providerMetadata?.resourceName === 'string' ? { resourceName: providerMetadata.resourceName } : {},
+  validateConfig,
+  verifyCredential,
+  preview: (input, options = {}) => previewTarget({ ...input, targetId: 'cloudflare-workers' }, options),
+  create: (context, options = {}) => createTarget({ ...context, targetId: 'cloudflare-workers', upload: uploadWorker }, options),
+};

package/cloudflare/tovu-consent.json

@@ -0,0 +1,6 @@
+{
+  "schemaVersion": 2,
+  "contributions": [
+    { "kind": "region-resolver", "id": "cloudflare", "header": "cf-ipcountry" }
+  ]
+}