@openclaw/cloudflare-ai-gateway-provider 0.0.0 → 2026.6.9

package/README.md

@@ -1,3 +1,12 @@
-# @openclaw/cloudflare-ai-gateway-provider
+# OpenClaw Cloudflare AI Gateway Provider
 
-Reserved placeholder for the official OpenClaw plugin package. Use a published release version instead.
+Official OpenClaw provider plugin for Cloudflare AI Gateway.
+
+Install from OpenClaw:
+
+```bash
+openclaw plugins install @openclaw/cloudflare-ai-gateway-provider
+openclaw gateway restart
+```
+
+See <https://docs.openclaw.ai/providers/cloudflare-ai-gateway> for setup and configuration.

package/dist/api.js

@@ -0,0 +1,4 @@
+import { CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_ID, CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, CLOUDFLARE_AI_GATEWAY_PROVIDER_ID, buildCloudflareAiGatewayModelDefinition, resolveCloudflareAiGatewayBaseUrl } from "./models.js";
+import { buildCloudflareAiGatewayCatalogProvider } from "./catalog-provider.js";
+import { applyCloudflareAiGatewayConfig, applyCloudflareAiGatewayProviderConfig, buildCloudflareAiGatewayConfigPatch } from "./onboard.js";
+export { CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_ID, CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, CLOUDFLARE_AI_GATEWAY_PROVIDER_ID, applyCloudflareAiGatewayConfig, applyCloudflareAiGatewayProviderConfig, buildCloudflareAiGatewayCatalogProvider, buildCloudflareAiGatewayConfigPatch, buildCloudflareAiGatewayModelDefinition, resolveCloudflareAiGatewayBaseUrl };

package/dist/catalog-provider.js

@@ -0,0 +1,45 @@
+import { buildCloudflareAiGatewayModelDefinition, resolveCloudflareAiGatewayBaseUrl } from "./models.js";
+import { coerceSecretRef, resolveNonEnvSecretRefApiKeyMarker } from "openclaw/plugin-sdk/provider-auth";
+import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+//#region extensions/cloudflare-ai-gateway/catalog-provider.ts
+/**
+* Builds runtime model catalog entries from stored Cloudflare AI Gateway auth
+* profiles.
+*/
+function resolveCloudflareAiGatewayApiKey(cred) {
+	if (!cred || cred.type !== "api_key") return;
+	const keyRef = coerceSecretRef(cred.keyRef);
+	const keyRefId = normalizeOptionalString(keyRef?.id);
+	if (keyRef && keyRefId) return keyRef.source === "env" ? keyRefId : resolveNonEnvSecretRefApiKeyMarker(keyRef.source);
+	return normalizeOptionalString(cred.key);
+}
+function resolveCloudflareAiGatewayMetadata(cred) {
+	if (!cred || cred.type !== "api_key") return {};
+	return {
+		accountId: normalizeOptionalString(cred.metadata?.accountId),
+		gatewayId: normalizeOptionalString(cred.metadata?.gatewayId)
+	};
+}
+/**
+* Returns a provider catalog entry when credentials and Gateway metadata are
+* complete enough to construct an Anthropic-compatible base URL.
+*/
+function buildCloudflareAiGatewayCatalogProvider(params) {
+	const apiKey = normalizeOptionalString(params.envApiKey) ?? resolveCloudflareAiGatewayApiKey(params.credential);
+	if (!apiKey) return null;
+	const { accountId, gatewayId } = resolveCloudflareAiGatewayMetadata(params.credential);
+	if (!accountId || !gatewayId) return null;
+	const baseUrl = resolveCloudflareAiGatewayBaseUrl({
+		accountId,
+		gatewayId
+	});
+	if (!baseUrl) return null;
+	return {
+		baseUrl,
+		api: "anthropic-messages",
+		apiKey,
+		models: [buildCloudflareAiGatewayModelDefinition()]
+	};
+}
+//#endregion
+export { buildCloudflareAiGatewayCatalogProvider };

package/dist/index.js

@@ -0,0 +1,169 @@
+import { CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF } from "./models.js";
+import { buildCloudflareAiGatewayCatalogProvider } from "./catalog-provider.js";
+import { applyCloudflareAiGatewayConfig, buildCloudflareAiGatewayConfigPatch } from "./onboard.js";
+import { wrapCloudflareAiGatewayProviderStream } from "./stream-wrappers.js";
+import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
+import { applyAuthProfileConfig, buildApiKeyCredential, ensureApiKeyFromOptionEnvOrPrompt, ensureAuthProfileStore, listProfilesForProvider, normalizeApiKeyInput, normalizeOptionalSecretInput, upsertAuthProfileWithLock, validateApiKeyInput } from "openclaw/plugin-sdk/provider-auth";
+import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+//#region extensions/cloudflare-ai-gateway/index.ts
+/**
+* Bundled provider plugin entry for Cloudflare AI Gateway setup, catalog
+* discovery, failover classification, and stream wrapping.
+*/
+const PROVIDER_ID = "cloudflare-ai-gateway";
+const PROVIDER_ENV_VAR = "CLOUDFLARE_AI_GATEWAY_API_KEY";
+const PROFILE_ID = "cloudflare-ai-gateway:default";
+async function upsertAuthProfileWithLockOrThrow(params) {
+	if (!await upsertAuthProfileWithLock(params)) throw new Error("Failed to update auth profile store; the auth store lock may be busy. Wait a moment and retry.");
+}
+function readRequiredTextInput(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+async function resolveCloudflareGatewayMetadataInteractive(ctx) {
+	let accountId = normalizeOptionalString(ctx.accountId) ?? "";
+	let gatewayId = normalizeOptionalString(ctx.gatewayId) ?? "";
+	if (!accountId) accountId = readRequiredTextInput(await ctx.prompter.text({
+		message: "Enter Cloudflare Account ID",
+		validate: (val) => readRequiredTextInput(val) ? void 0 : "Account ID is required"
+	}));
+	if (!gatewayId) gatewayId = readRequiredTextInput(await ctx.prompter.text({
+		message: "Enter Cloudflare AI Gateway ID",
+		validate: (val) => readRequiredTextInput(val) ? void 0 : "Gateway ID is required"
+	}));
+	return {
+		accountId,
+		gatewayId
+	};
+}
+var cloudflare_ai_gateway_default = definePluginEntry({
+	id: PROVIDER_ID,
+	name: "Cloudflare AI Gateway Provider",
+	description: "Bundled Cloudflare AI Gateway provider plugin",
+	register(api) {
+		api.registerProvider({
+			id: PROVIDER_ID,
+			label: "Cloudflare AI Gateway",
+			docsPath: "/providers/cloudflare-ai-gateway",
+			envVars: ["CLOUDFLARE_AI_GATEWAY_API_KEY"],
+			auth: [{
+				id: "api-key",
+				label: "Cloudflare AI Gateway",
+				hint: "Account ID + Gateway ID + API key",
+				kind: "api_key",
+				wizard: {
+					choiceId: "cloudflare-ai-gateway-api-key",
+					choiceLabel: "Cloudflare AI Gateway",
+					choiceHint: "Account ID + Gateway ID + API key",
+					groupId: "cloudflare-ai-gateway",
+					groupLabel: "Cloudflare AI Gateway",
+					groupHint: "Account ID + Gateway ID + API key"
+				},
+				run: async (ctx) => {
+					const metadata = await resolveCloudflareGatewayMetadataInteractive({
+						accountId: normalizeOptionalSecretInput(ctx.opts?.cloudflareAiGatewayAccountId),
+						gatewayId: normalizeOptionalSecretInput(ctx.opts?.cloudflareAiGatewayGatewayId),
+						prompter: ctx.prompter
+					});
+					let capturedSecretInput = "";
+					let capturedCredential = false;
+					let capturedMode;
+					await ensureApiKeyFromOptionEnvOrPrompt({
+						token: normalizeOptionalSecretInput(ctx.opts?.cloudflareAiGatewayApiKey),
+						tokenProvider: "cloudflare-ai-gateway",
+						secretInputMode: ctx.allowSecretRefPrompt === false ? ctx.secretInputMode ?? "plaintext" : ctx.secretInputMode,
+						config: ctx.config,
+						expectedProviders: [PROVIDER_ID],
+						provider: PROVIDER_ID,
+						envLabel: PROVIDER_ENV_VAR,
+						promptMessage: "Enter Cloudflare AI Gateway API key",
+						normalize: normalizeApiKeyInput,
+						validate: validateApiKeyInput,
+						prompter: ctx.prompter,
+						setCredential: async (apiKey, mode) => {
+							capturedSecretInput = apiKey;
+							capturedCredential = true;
+							capturedMode = mode;
+						}
+					});
+					if (!capturedCredential) throw new Error("Missing Cloudflare AI Gateway API key.");
+					return {
+						profiles: [{
+							profileId: PROFILE_ID,
+							credential: buildApiKeyCredential(PROVIDER_ID, capturedSecretInput ?? "", {
+								accountId: metadata.accountId,
+								gatewayId: metadata.gatewayId
+							}, capturedMode ? { secretInputMode: capturedMode } : void 0)
+						}],
+						configPatch: buildCloudflareAiGatewayConfigPatch(metadata),
+						defaultModel: CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF
+					};
+				},
+				runNonInteractive: async (ctx) => {
+					const authStore = ensureAuthProfileStore(ctx.agentDir, { allowKeychainPrompt: false });
+					const storedMetadata = authStore.profiles[PROFILE_ID]?.type === "api_key" ? {
+						accountId: normalizeOptionalString(authStore.profiles[PROFILE_ID]?.metadata?.accountId),
+						gatewayId: normalizeOptionalString(authStore.profiles[PROFILE_ID]?.metadata?.gatewayId)
+					} : {};
+					const accountId = normalizeOptionalSecretInput(ctx.opts.cloudflareAiGatewayAccountId) ?? storedMetadata.accountId;
+					const gatewayId = normalizeOptionalSecretInput(ctx.opts.cloudflareAiGatewayGatewayId) ?? storedMetadata.gatewayId;
+					if (!accountId || !gatewayId) {
+						ctx.runtime.error("Cloudflare AI Gateway setup requires --cloudflare-ai-gateway-account-id and --cloudflare-ai-gateway-gateway-id.");
+						ctx.runtime.exit(1);
+						return null;
+					}
+					const resolved = await ctx.resolveApiKey({
+						provider: PROVIDER_ID,
+						flagValue: normalizeOptionalSecretInput(ctx.opts.cloudflareAiGatewayApiKey),
+						flagName: "--cloudflare-ai-gateway-api-key",
+						envVar: PROVIDER_ENV_VAR
+					});
+					if (!resolved) return null;
+					if (resolved.source !== "profile") {
+						const credential = ctx.toApiKeyCredential({
+							provider: PROVIDER_ID,
+							resolved,
+							metadata: {
+								accountId,
+								gatewayId
+							}
+						});
+						if (!credential) return null;
+						await upsertAuthProfileWithLockOrThrow({
+							profileId: PROFILE_ID,
+							credential,
+							agentDir: ctx.agentDir
+						});
+					}
+					return applyCloudflareAiGatewayConfig(applyAuthProfileConfig(ctx.config, {
+						profileId: PROFILE_ID,
+						provider: PROVIDER_ID,
+						mode: "api_key"
+					}), {
+						accountId,
+						gatewayId
+					});
+				}
+			}],
+			catalog: {
+				order: "late",
+				run: async (ctx) => {
+					const authStore = ensureAuthProfileStore(ctx.agentDir, { allowKeychainPrompt: false });
+					const envManagedApiKey = normalizeOptionalString(ctx.env[PROVIDER_ENV_VAR]) ? PROVIDER_ENV_VAR : void 0;
+					for (const profileId of listProfilesForProvider(authStore, PROVIDER_ID)) {
+						const provider = buildCloudflareAiGatewayCatalogProvider({
+							credential: authStore.profiles[profileId],
+							envApiKey: envManagedApiKey
+						});
+						if (!provider) continue;
+						return { provider };
+					}
+					return null;
+				}
+			},
+			classifyFailoverReason: ({ errorMessage }) => /\bworkers?_ai\b.*\b(?:rate|limit|quota)\b/i.test(errorMessage) ? "rate_limit" : void 0,
+			wrapStreamFn: wrapCloudflareAiGatewayProviderStream
+		});
+	}
+});
+//#endregion
+export { cloudflare_ai_gateway_default as default };

package/dist/models.js

@@ -0,0 +1,42 @@
+//#region extensions/cloudflare-ai-gateway/models.ts
+/** Provider id used in model refs and auth profiles. */
+const CLOUDFLARE_AI_GATEWAY_PROVIDER_ID = "cloudflare-ai-gateway";
+/** Default Cloudflare AI Gateway model id exposed by the bundled provider. */
+const CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_ID = "claude-sonnet-4-6";
+/** Fully-qualified default model ref used by onboarding. */
+const CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF = `${CLOUDFLARE_AI_GATEWAY_PROVIDER_ID}/${CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_ID}`;
+const CLOUDFLARE_AI_GATEWAY_DEFAULT_CONTEXT_WINDOW = 2e5;
+const CLOUDFLARE_AI_GATEWAY_DEFAULT_MAX_TOKENS = 64e3;
+const CLOUDFLARE_AI_GATEWAY_DEFAULT_COST = {
+	input: 3,
+	output: 15,
+	cacheRead: .3,
+	cacheWrite: 3.75
+};
+/**
+* Builds a provider model definition, allowing tests/catalog code to override
+* the model id while preserving Cloudflare defaults.
+*/
+function buildCloudflareAiGatewayModelDefinition(params) {
+	return {
+		id: params?.id?.trim() || "claude-sonnet-4-6",
+		name: params?.name ?? "Claude Sonnet 4.6",
+		reasoning: params?.reasoning ?? true,
+		input: params?.input ?? ["text", "image"],
+		cost: CLOUDFLARE_AI_GATEWAY_DEFAULT_COST,
+		contextWindow: CLOUDFLARE_AI_GATEWAY_DEFAULT_CONTEXT_WINDOW,
+		maxTokens: CLOUDFLARE_AI_GATEWAY_DEFAULT_MAX_TOKENS
+	};
+}
+/**
+* Constructs the Anthropic Messages base URL for a Cloudflare account/gateway
+* pair, returning an empty string for incomplete metadata.
+*/
+function resolveCloudflareAiGatewayBaseUrl(params) {
+	const accountId = params.accountId.trim();
+	const gatewayId = params.gatewayId.trim();
+	if (!accountId || !gatewayId) return "";
+	return `https://gateway.ai.cloudflare.com/v1/${accountId}/${gatewayId}/anthropic`;
+}
+//#endregion
+export { CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_ID, CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, CLOUDFLARE_AI_GATEWAY_PROVIDER_ID, buildCloudflareAiGatewayModelDefinition, resolveCloudflareAiGatewayBaseUrl };

package/dist/onboard.js

@@ -0,0 +1,60 @@
+import { CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, buildCloudflareAiGatewayModelDefinition, resolveCloudflareAiGatewayBaseUrl } from "./models.js";
+import { applyAgentDefaultModelPrimary, applyProviderConfigWithDefaultModel } from "openclaw/plugin-sdk/provider-onboard";
+//#region extensions/cloudflare-ai-gateway/onboard.ts
+/**
+* Config patch helpers used by Cloudflare AI Gateway interactive and
+* non-interactive onboarding flows.
+*/
+/**
+* Builds the minimal config patch for provider setup and default model aliasing.
+*/
+function buildCloudflareAiGatewayConfigPatch(params) {
+	return {
+		models: { providers: { "cloudflare-ai-gateway": {
+			baseUrl: resolveCloudflareAiGatewayBaseUrl(params),
+			api: "anthropic-messages",
+			models: [buildCloudflareAiGatewayModelDefinition()]
+		} } },
+		agents: { defaults: { models: { [CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF]: { alias: "Cloudflare AI Gateway" } } } }
+	};
+}
+/**
+* Applies provider model config while preserving existing agent model aliases.
+*/
+function applyCloudflareAiGatewayProviderConfig(cfg, params) {
+	const models = { ...cfg.agents?.defaults?.models };
+	models[CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF] = {
+		...models[CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF],
+		alias: models[CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF]?.alias ?? "Cloudflare AI Gateway"
+	};
+	const existingProvider = cfg.models?.providers?.["cloudflare-ai-gateway"];
+	const baseUrl = params?.accountId && params?.gatewayId ? resolveCloudflareAiGatewayBaseUrl({
+		accountId: params.accountId,
+		gatewayId: params.gatewayId
+	}) : typeof existingProvider?.baseUrl === "string" ? existingProvider.baseUrl : void 0;
+	if (!baseUrl) return {
+		...cfg,
+		agents: {
+			...cfg.agents,
+			defaults: {
+				...cfg.agents?.defaults,
+				models
+			}
+		}
+	};
+	return applyProviderConfigWithDefaultModel(cfg, {
+		agentModels: models,
+		providerId: "cloudflare-ai-gateway",
+		api: "anthropic-messages",
+		baseUrl,
+		defaultModel: buildCloudflareAiGatewayModelDefinition()
+	});
+}
+/**
+* Applies Cloudflare AI Gateway config and makes its default model primary.
+*/
+function applyCloudflareAiGatewayConfig(cfg, params) {
+	return applyAgentDefaultModelPrimary(applyCloudflareAiGatewayProviderConfig(cfg, params), CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF);
+}
+//#endregion
+export { applyCloudflareAiGatewayConfig, applyCloudflareAiGatewayProviderConfig, buildCloudflareAiGatewayConfigPatch };

package/dist/stream-wrappers.js

@@ -0,0 +1,30 @@
+import { createAnthropicThinkingPrefillPayloadWrapper } from "openclaw/plugin-sdk/provider-stream-shared";
+import { createSubsystemLogger } from "openclaw/plugin-sdk/runtime-env";
+//#region extensions/cloudflare-ai-gateway/stream-wrappers.ts
+const log = createSubsystemLogger("cloudflare-ai-gateway-stream");
+function shouldPatchAnthropicMessagesPayload(model) {
+	return model?.api === void 0 || model.api === "anthropic-messages";
+}
+/**
+* Creates a wrapper that removes trailing assistant prefill messages before
+* extended-thinking Anthropic requests are sent through Cloudflare.
+*/
+function createCloudflareAiGatewayAnthropicThinkingPrefillWrapper(baseStreamFn) {
+	return createAnthropicThinkingPrefillPayloadWrapper(baseStreamFn, (stripped) => {
+		log.warn(`removed ${stripped} trailing assistant prefill message${stripped === 1 ? "" : "s"} because Anthropic extended thinking requires conversations to end with a user turn`);
+	});
+}
+/**
+* Applies the Anthropic payload wrapper only for Anthropic-compatible models.
+*/
+function wrapCloudflareAiGatewayProviderStream(ctx) {
+	if (!shouldPatchAnthropicMessagesPayload(ctx.model)) return ctx.streamFn;
+	return createCloudflareAiGatewayAnthropicThinkingPrefillWrapper(ctx.streamFn);
+}
+/** Test-only access to wrapper decisions and logger injection points. */
+const testing = {
+	log,
+	shouldPatchAnthropicMessagesPayload
+};
+//#endregion
+export { testing as __testing, testing, createCloudflareAiGatewayAnthropicThinkingPrefillWrapper, wrapCloudflareAiGatewayProviderStream };

package/npm-shrinkwrap.json

@@ -0,0 +1,12 @@
+{
+  "name": "@openclaw/cloudflare-ai-gateway-provider",
+  "version": "2026.6.9",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "@openclaw/cloudflare-ai-gateway-provider",
+      "version": "2026.6.9"
+    }
+  }
+}

package/openclaw.plugin.json

@@ -0,0 +1,49 @@
+{
+  "id": "cloudflare-ai-gateway",
+  "activation": {
+    "onStartup": false
+  },
+  "enabledByDefault": true,
+  "providers": ["cloudflare-ai-gateway"],
+  "modelPricing": {
+    "providers": {
+      "cloudflare-ai-gateway": {
+        "openRouter": {
+          "passthroughProviderModel": true
+        },
+        "liteLLM": {
+          "passthroughProviderModel": true
+        }
+      }
+    }
+  },
+  "setup": {
+    "providers": [
+      {
+        "id": "cloudflare-ai-gateway",
+        "envVars": ["CLOUDFLARE_AI_GATEWAY_API_KEY"]
+      }
+    ]
+  },
+  "providerAuthChoices": [
+    {
+      "provider": "cloudflare-ai-gateway",
+      "method": "api-key",
+      "choiceId": "cloudflare-ai-gateway-api-key",
+      "choiceLabel": "Cloudflare AI Gateway",
+      "choiceHint": "Account ID + Gateway ID + API key",
+      "groupId": "cloudflare-ai-gateway",
+      "groupLabel": "Cloudflare AI Gateway",
+      "groupHint": "Account ID + Gateway ID + API key",
+      "optionKey": "cloudflareAiGatewayApiKey",
+      "cliFlag": "--cloudflare-ai-gateway-api-key",
+      "cliOption": "--cloudflare-ai-gateway-api-key <key>",
+      "cliDescription": "Cloudflare AI Gateway API key"
+    }
+  ],
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {}
+  }
+}

package/package.json

@@ -1,14 +1,50 @@
 {
   "name": "@openclaw/cloudflare-ai-gateway-provider",
-  "version": "0.0.0",
-  "description": "Reserved package name for an official OpenClaw plugin.",
-  "license": "MIT",
+  "version": "2026.6.9",
+  "description": "OpenClaw Cloudflare AI Gateway provider plugin.",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/openclaw/openclaw.git"
+    "url": "https://github.com/openclaw/openclaw"
   },
-  "publishConfig": {
-    "access": "public",
-    "tag": "placeholder"
-  }
+  "type": "module",
+  "openclaw": {
+    "extensions": [
+      "./index.ts"
+    ],
+    "install": {
+      "clawhubSpec": "clawhub:@openclaw/cloudflare-ai-gateway-provider",
+      "npmSpec": "@openclaw/cloudflare-ai-gateway-provider",
+      "defaultChoice": "npm",
+      "minHostVersion": ">=2026.6.8"
+    },
+    "compat": {
+      "pluginApi": ">=2026.6.9"
+    },
+    "build": {
+      "openclawVersion": "2026.6.9",
+      "bundledDist": false
+    },
+    "release": {
+      "publishToClawHub": true,
+      "publishToNpm": true
+    },
+    "runtimeExtensions": [
+      "./dist/index.js"
+    ]
+  },
+  "files": [
+    "dist/**",
+    "openclaw.plugin.json",
+    "npm-shrinkwrap.json",
+    "README.md"
+  ],
+  "peerDependencies": {
+    "openclaw": ">=2026.6.9"
+  },
+  "peerDependenciesMeta": {
+    "openclaw": {
+      "optional": true
+    }
+  },
+  "bundledDependencies": []
 }