@volter/twin-cloudflare 0.1.0

package/src/cloudflare-capabilities.ts

@@ -0,0 +1,1107 @@
+// Honest top-down Cloudflare denominator: exactly one capability per HTTP operation
+// in Cloudflare's first-party OpenAPI 4.0.0 document, plus an explicitly separate
+// connector surface. The operation census is
+// generated from cloudflare/api-schemas commit 2ac8369e9b63dccacee1a2284e95bb819f05b307.
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { checkCapabilities, type CapabilityReport, type CapabilitySpec, verifyBoundary } from '@volter/world-tooling';
+import { applyTwinWrite, deployableEntries, projectResources } from '@volter/world-core';
+import { handleCloudflareTwinRequest, type CloudflareResponse } from './cloudflare-twin.ts';
+import {
+  pullCloudflareState,
+  performCloudflareAction,
+  syncCloudflareFromReal,
+  type CloudflareExecute,
+} from './cloudflare-connector.ts';
+import { CloudflareBudget, CloudflareBudgetError, CLOUDFLARE_BUDGET_CEILING, cloudflareCallWeight } from './cloudflare-budget.ts';
+import { CLOUDFLARE_OPENAPI_OPERATIONS } from './cloudflare-openapi-operations.ts';
+
+// Independent official SDK namespace census. It is not used as a denominator: the
+// finer and complete OpenAPI method+path inventory below is the one manifest granularity.
+export const CLOUDFLARE_OFFICIAL_AREAS = [
+  'abuse-reports', 'accounts', 'acm', 'addressing', 'ai', 'ai-audit', 'ai-gateway', 'ai-security', 'aisearch',
+  'alerting', 'analytics-query', 'api-gateway', 'argo', 'audit-logs', 'billing', 'bot-management', 'botnet-feed',
+  'brand-protection', 'browser-rendering', 'cache', 'calls', 'certificate-authorities', 'client-certificates',
+  'cloud-connector', 'cloudforce-one', 'connectivity', 'content-scanning', 'csam-scanner', 'custom-certificates',
+  'custom-csrs', 'custom-hostnames', 'custom-nameservers', 'custom-pages', 'd1', 'dcv-delegation', 'ddos-protection',
+  'diagnostics', 'dls', 'dns', 'dns-firewall', 'durable-objects', 'email-auth', 'email-routing', 'email-security',
+  'email-sending', 'filters', 'firewall', 'flagship', 'fraud', 'google-tag-gateway', 'healthchecks', 'hostnames',
+  'hyperdrive', 'iam', 'images', 'intel', 'ips', 'keyless-certificates', 'kv', 'leaked-credential-checks',
+  'load-balancers', 'logpush', 'logs', 'magic-cloud-networking', 'magic-network-monitoring', 'magic-transit',
+  'managed-transforms', 'memberships', 'moq', 'mtls-certificates', 'network-interconnects', 'organizations',
+  'origin-ca-certificates', 'origin-post-quantum-encryption', 'origin-tls-client-auth', 'origin-tls-compliance-modes',
+  'page-rules', 'page-shield', 'pages', 'pipelines', 'precursor', 'queues', 'r2', 'r2-data-catalog', 'radar',
+  'rate-limits', 'realtime-kit', 'registrar', 'registrar-sandbox', 'request-tracers', 'resource-sharing',
+  'resource-tagging', 'rules', 'rulesets', 'rum', 'schema-validation', 'secrets-store', 'security-center',
+  'security-txt', 'snippets', 'spectrum', 'speed', 'ssl', 'stream', 'tenant-custom-nameservers', 'tenants',
+  'token-validation', 'turnstile', 'url-normalization', 'url-scanner', 'user', 'vectorize', 'vulnerability-scanner',
+  'waiting-rooms', 'web3', 'workers', 'workers-for-platforms', 'workflows', 'zaraz', 'zero-trust', 'zones',
+] as const;
+
+export const CLOUDFLARE_OPENAPI_AREAS = [...new Set(CLOUDFLARE_OPENAPI_OPERATIONS.map((operation) => operation.area))].sort();
+export const CLOUDFLARE_AREAS = [...new Set([...CLOUDFLARE_OPENAPI_AREAS, 'connector'])].sort();
+
+const AT = '2026-08-21T00:00:00.000Z';
+const ACCOUNT = 'a'.repeat(32);
+const ZONE = 'b'.repeat(32);
+const VENDOR_TUNNEL = '11111111-2222-4333-a444-555555555555';
+type Step = { m: string; p: string; b?: unknown; raw?: string; ct?: string; auth?: boolean; bearer?: string | undefined };
+type Body = Record<string, any>;
+type Verify = NonNullable<CapabilitySpec['verify']>;
+type Call = (step: Step) => Promise<CloudflareResponse>;
+
+async function withRoot(fn: (call: Call, root: string) => Promise<boolean>): Promise<boolean> {
+  const root = mkdtempSync(join(tmpdir(), 'cloudflare-cap-'));
+  const call = (step: Step) => handleCloudflareTwinRequest({
+    root,
+    method: step.m,
+    path: step.p,
+    occurredAt: AT,
+    headers: {
+      ...(step.auth === false ? {} : { authorization: `Bearer ${step.bearer ?? 'local-certification-token'}` }),
+      ...(step.ct ? { 'content-type': step.ct } : {}),
+    },
+    ...(step.raw !== undefined ? { body: step.raw } : step.b === undefined ? {} : { body: JSON.stringify(step.b) }),
+  });
+  try { return await verifyBoundary('cloudflare.withRoot', () => fn(call, root)); }
+  finally { rmSync(root, { recursive: true, force: true }); }
+}
+
+async function seed(call: Call): Promise<void> {
+  await call({ m: 'POST', p: '/twin/bootstrap', b: {
+    accounts: [{ id: ACCOUNT, name: 'Acme' }],
+    zones: [{ id: ZONE, account_id: ACCOUNT, name: 'example.test' }],
+  } });
+}
+
+/** The head's loop, in miniature (protocol 2): perform each entry the twin appended through the connector,
+ *  remembering the vendor's id for the ones it minted so a later entry names the vendor's id, not ours. */
+async function performAll(
+  root: string,
+  execute: (request: { method: string; path: string; headers?: Record<string, string>; body?: string | Uint8Array }) => Promise<{ status: number; headers: Record<string, string>; body: string }>,
+  adopted: Map<string, string> = new Map(),
+  done: Set<string> = new Set(),
+): Promise<{ performed: number; failed: string | null; adopted: Map<string, string>; done: Set<string> }> {
+  const ctx = { resolve: (type: string, id: string) => adopted.get(`${type}:${id}`) ?? id, service: 'cloudflare', root };
+  let performed = 0;
+  for (const entry of deployableEntries('cloudflare', root)) {
+    if (done.has(entry.id)) continue; // the head confirms what it performed; this harness remembers instead
+    try {
+      const outcome = await performCloudflareAction(execute, entry, ctx as never);
+      adopted.set(`${entry.subject.type}:${entry.subject.id}`, outcome.externalId);
+      done.add(entry.id);
+      performed += 1;
+    } catch (error) {
+      return { performed, failed: error instanceof Error ? error.message : String(error), adopted, done };
+    }
+  }
+  return { performed, failed: null, adopted, done };
+}
+/** A vendor answering the API v4 envelope, as the kernel's executor hands it over: JSON in, JSON out. */
+function vendor(reply: (method: string, path: string, body: Record<string, unknown> | undefined) => { status: number; body: unknown }) {
+  const seen: Array<{ method: string; path: string; body?: Record<string, unknown> }> = [];
+  const execute = async (request: { method: string; path: string; body?: string | Uint8Array }) => {
+    const body = request.body ? (JSON.parse(typeof request.body === 'string' ? request.body : new TextDecoder().decode(request.body)) as Record<string, unknown>) : undefined;
+    const path = request.path.replace(/^\/client\/v4/, '');
+    seen.push({ method: request.method, path, ...(body ? { body } : {}) });
+    const answer = reply(request.method, path, body);
+    return { status: answer.status, headers: {}, body: JSON.stringify(answer.body) };
+  };
+  return { execute, seen };
+}
+async function tunnel(call: Call, name = 'local-cert'): Promise<string> {
+  const response = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/cfd_tunnel`, b: { name, config_src: 'cloudflare' } });
+  return String((response.body as Body).result?.id ?? '');
+}
+
+/** Build the exact multipart body an unmodified SDK/wrangler-shaped deploy emits: a JSON
+ *  `metadata` part plus named module file parts. */
+function moduleUpload(metadata: Body, files: Record<string, string> = { 'worker.js': 'export default { fetch() { return new Response("ok"); } };' }): Step {
+  const boundary = 'twin-cap-boundary';
+  const parts = [
+    `--${boundary}\r\nContent-Disposition: form-data; name="metadata"\r\nContent-Type: application/json\r\n\r\n${JSON.stringify(metadata)}\r\n`,
+    ...Object.entries(files).map(([name, content]) =>
+      `--${boundary}\r\nContent-Disposition: form-data; name="files[]"; filename="${name}"\r\nContent-Type: application/javascript+module\r\n\r\n${content}\r\n`),
+  ];
+  return { m: 'PUT', p: '', raw: `${parts.join('')}--${boundary}--\r\n`, ct: `multipart/form-data; boundary=${boundary}` };
+}
+
+async function deployWorker(call: Call, name = 'cert-worker', metadata: Body = { main_module: 'worker.js' }): Promise<CloudflareResponse> {
+  const upload = moduleUpload(metadata);
+  return call({ ...upload, p: `/accounts/${ACCOUNT}/workers/scripts/${name}` });
+}
+
+async function seedQueue(call: Call, name = 'cert-queue'): Promise<string> {
+  const response = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues`, b: { queue_name: name } });
+  return String((response.body as Body).result?.queue_id ?? '');
+}
+
+const HD_ORIGIN = { scheme: 'postgres', database: 'app', user: 'launch', password: 'secret-launch-pass', host: 'db.internal.test', port: 5432 };
+async function seedHyperdrive(call: Call, name = 'cert-hd'): Promise<string> {
+  const response = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/hyperdrive/configs`, b: { name, origin: HD_ORIGIN } });
+  return String((response.body as Body).result?.id ?? '');
+}
+
+const operationVerifiers = new Map<string, Verify>([
+  ['GET /accounts', () => withRoot(async (call) => {
+    await seed(call);
+    const denied = await call({ m: 'GET', p: '/accounts', auth: false });
+    const response = await call({ m: 'GET', p: '/accounts?name=Acme&per_page=1' });
+    return denied.status === 403 && (denied.body as Body).errors?.[0]?.code === 10000
+      && response.status === 200 && (response.body as Body).result?.[0]?.id === ACCOUNT
+      && (response.body as Body).result_info?.total_count === 1;
+  })],
+  ['GET /accounts/{account_id}', () => withRoot(async (call) => {
+    await seed(call); const response = await call({ m: 'GET', p: `/accounts/${ACCOUNT}` });
+    return response.status === 200 && (response.body as Body).result?.name === 'Acme';
+  })],
+  ['GET /zones', () => withRoot(async (call) => {
+    await seed(call); const response = await call({ m: 'GET', p: `/zones?name=example.test&account.id=${ACCOUNT}` });
+    return response.status === 200 && (response.body as Body).result?.[0]?.account?.id === ACCOUNT;
+  })],
+  ['GET /zones/{zone_id}', () => withRoot(async (call) => {
+    await seed(call); const response = await call({ m: 'GET', p: `/zones/${ZONE}` });
+    return response.status === 200 && (response.body as Body).result?.name === 'example.test';
+  })],
+  ['POST /accounts/{account_id}/cfd_tunnel', () => withRoot(async (call) => {
+    await seed(call);
+    const invalid = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/cfd_tunnel`, b: { name: 'bad', tunnel_secret: 'not-base64' } });
+    const id = await tunnel(call);
+    return invalid.status === 400 && /^[0-9a-f-]{36}$/.test(id);
+  })],
+  ['GET /accounts/{account_id}/cfd_tunnel', () => withRoot(async (call) => {
+    await seed(call); const first = await tunnel(call, 'first'); await tunnel(call, 'second');
+    await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/cfd_tunnel/${first}` });
+    const all = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/cfd_tunnel` });
+    const active = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/cfd_tunnel?is_deleted=false` });
+    const deleted = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/cfd_tunnel?is_deleted=true` });
+    return (all.body as Body).result?.length === 2 && (active.body as Body).result?.length === 1
+      && (deleted.body as Body).result?.[0]?.deleted_at !== null;
+  })],
+  ['GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}', () => withRoot(async (call) => {
+    await seed(call); const id = await tunnel(call); const response = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/cfd_tunnel/${id}` });
+    return response.status === 200 && (response.body as Body).result?.id === id;
+  })],
+  ['PATCH /accounts/{account_id}/cfd_tunnel/{tunnel_id}', () => withRoot(async (call) => {
+    await seed(call); const first = await tunnel(call, 'first'); await tunnel(call, 'second');
+    const conflict = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/cfd_tunnel/${first}`, b: { name: 'second' } });
+    const invalid = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/cfd_tunnel/${first}`, b: { tunnel_secret: 'not-base64' } });
+    const validSecret = Buffer.alloc(32, 7).toString('base64');
+    const edited = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/cfd_tunnel/${first}`, b: { name: 'renamed', tunnel_secret: validSecret } });
+    return conflict.status === 409 && invalid.status === 400 && (edited.body as Body).result?.name === 'renamed';
+  })],
+  ['DELETE /accounts/{account_id}/cfd_tunnel/{tunnel_id}', () => withRoot(async (call) => {
+    await seed(call); const id = await tunnel(call); const response = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/cfd_tunnel/${id}` });
+    return response.status === 200 && (response.body as Body).result?.id === id
+      && typeof (response.body as Body).result?.deleted_at === 'string'
+      && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/cfd_tunnel/${id}` })).status === 404;
+  })],
+  ['PUT /accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations', () => withRoot(async (call) => {
+    await seed(call); const id = await tunnel(call);
+    const response = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/cfd_tunnel/${id}/configurations`, b: { config: { ingress: [{ hostname: '*', service: 'http_status:404' }] } } });
+    return response.status === 200 && (response.body as Body).result?.tunnel_id === id && (response.body as Body).result?.version === 1;
+  })],
+  ['GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations', () => withRoot(async (call) => {
+    await seed(call); const id = await tunnel(call);
+    await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/cfd_tunnel/${id}/configurations`, b: { config: { ingress: [{ hostname: '*', service: 'http_status:404' }] } } });
+    const response = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/cfd_tunnel/${id}/configurations` });
+    return response.status === 200 && (response.body as Body).result?.config?.ingress?.[0]?.service === 'http_status:404';
+  })],
+  ['GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}/token', () => withRoot(async (call) => {
+    await seed(call); const id = await tunnel(call);
+    const first = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/cfd_tunnel/${id}/token` });
+    const second = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/cfd_tunnel/${id}/token` });
+    return typeof (first.body as Body).result === 'string' && (first.body as Body).result === (second.body as Body).result;
+  })],
+  ['POST /zones/{zone_id}/dns_records', () => withRoot(async (call) => {
+    await seed(call);
+    const caa = await call({ m: 'POST', p: `/zones/${ZONE}/dns_records`, b: {
+      type: 'CAA', name: 'example.test', ttl: 60, data: { flags: 0, tag: 'issue', value: 'letsencrypt.org' },
+    } });
+    return caa.status === 200 && (caa.body as Body).result?.type === 'CAA'
+      && (caa.body as Body).result?.data?.value === 'letsencrypt.org'
+      && !Object.hasOwn((caa.body as Body).result, 'content');
+  })],
+  ['GET /zones/{zone_id}/dns_records', () => withRoot(async (call) => {
+    await seed(call); await call({ m: 'POST', p: `/zones/${ZONE}/dns_records`, b: { type: 'CNAME', name: 'app.example.test', content: 'target.example.test', ttl: 1 } });
+    const response = await call({ m: 'GET', p: `/zones/${ZONE}/dns_records?type=CNAME&name=app.example.test` });
+    return response.status === 200 && (response.body as Body).result?.length === 1;
+  })],
+  ['GET /zones/{zone_id}/dns_records/{dns_record_id}', () => withRoot(async (call) => {
+    await seed(call); const created = await call({ m: 'POST', p: `/zones/${ZONE}/dns_records`, b: { type: 'A', name: 'a.example.test', content: '192.0.2.1', ttl: 60 } });
+    return (await call({ m: 'GET', p: `/zones/${ZONE}/dns_records/${(created.body as Body).result.id}` })).status === 200;
+  })],
+  ['PUT /zones/{zone_id}/dns_records/{dns_record_id}', () => withRoot(async (call) => {
+    await seed(call); const created = await call({ m: 'POST', p: `/zones/${ZONE}/dns_records`, b: { type: 'A', name: 'a.example.test', content: '192.0.2.1', ttl: 60, comment: 'old', tags: ['owner:test'], settings: { ipv4_only: true } } });
+    const id = (created.body as Body).result.id;
+    const partial = await call({ m: 'PUT', p: `/zones/${ZONE}/dns_records/${id}`, b: { content: '192.0.2.2' } });
+    const replaced = await call({ m: 'PUT', p: `/zones/${ZONE}/dns_records/${id}`, b: { type: 'CAA', name: 'example.test', ttl: 120, data: { flags: 0, tag: 'issue', value: 'pki.goog' } } });
+    const value = (replaced.body as Body).result;
+    return partial.status === 400 && replaced.status === 200 && value.type === 'CAA' && value.data?.value === 'pki.goog'
+      && !Object.hasOwn(value, 'content') && value.comment === null && value.tags?.length === 0
+      && Object.keys(value.settings ?? {}).length === 0;
+  })],
+  ['PATCH /zones/{zone_id}/dns_records/{dns_record_id}', () => withRoot(async (call) => {
+    await seed(call); const created = await call({ m: 'POST', p: `/zones/${ZONE}/dns_records`, b: { type: 'TXT', name: 'txt.example.test', content: 'one', ttl: 60, comment: 'keep', tags: ['owner:test'] } });
+    const response = await call({ m: 'PATCH', p: `/zones/${ZONE}/dns_records/${(created.body as Body).result.id}`, b: { content: 'two' } });
+    const value = (response.body as Body).result;
+    return response.status === 200 && value.content === 'two' && value.name === 'txt.example.test' && value.comment === 'keep' && value.tags?.[0] === 'owner:test';
+  })],
+  ['DELETE /zones/{zone_id}/dns_records/{dns_record_id}', () => withRoot(async (call) => {
+    await seed(call); const created = await call({ m: 'POST', p: `/zones/${ZONE}/dns_records`, b: { type: 'TXT', name: 'txt.example.test', content: 'one', ttl: 60 } });
+    const id = (created.body as Body).result.id;
+    return (await call({ m: 'DELETE', p: `/zones/${ZONE}/dns_records/${id}` })).status === 200
+      && (await call({ m: 'GET', p: `/zones/${ZONE}/dns_records/${id}` })).status === 404;
+  })],
+]);
+
+// Workers / R2 / Hyperdrive / Queues provisioning verifiers. Every verify starts from a
+// fresh root, seeds through the twin's own write path, asserts response VALUES, and drives
+// the negative 4xx path its operation implies. Merged into operationVerifiers below.
+const provisioningVerifiers = new Map<string, Verify>([
+  ['GET /accounts/{account_id}/workers/scripts', () => withRoot(async (call) => {
+    await seed(call);
+    const uploaded = await deployWorker(call, 'list-me', { main_module: 'worker.js', compatibility_date: '2026-08-01', tags: ['launch'] });
+    // A service binding to a Worker that does not exist must be rejected, and the rejected
+    // upload must not appear in the list (round-two N4).
+    const svcGhost = await deployWorker(call, 'svc-ghost', { main_module: 'worker.js', bindings: [{ type: 'service', name: 'SVC', service: 'never-uploaded' }] });
+    const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts` });
+    const item = (listed.body as Body).result?.[0];
+    return uploaded.status === 200 && svcGhost.status === 400 && listed.status === 200
+      && item?.id === 'list-me' && item?.etag === (uploaded.body as Body).result?.etag
+      && item?.compatibility_date === '2026-08-01' && item?.tags?.[0] === 'launch'
+      && (listed.body as Body).result_info?.total_count === 1;
+  })],
+  ['GET /accounts/{account_id}/workers/scripts/{script_name}', () => withRoot(async (call) => {
+    await seed(call);
+    await deployWorker(call, 'download-me', { main_module: 'worker.js' });
+    const download = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/download-me` });
+    const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/never-uploaded` });
+    // A single-module module-syntax Worker still downloads as multipart/form-data (not raw JS).
+    return download.status === 200 && download.raw === true
+      && (download.headers?.['content-type'] ?? '').includes('multipart/form-data')
+      && String(download.body).includes('return new Response("ok")')
+      && missing.status === 404 && (missing.body as Body).errors?.[0]?.code === 10007;
+  })],
+  ['DELETE /accounts/{account_id}/workers/scripts/{script_name}', () => withRoot(async (call) => {
+    await seed(call);
+    // Dirty-state cell: upload with a DO class AND distinctive metadata, prove no-force delete
+    // is BLOCKED by the namespace (the pinned OpenAPI force contract), force-delete, then
+    // recreate the same name with BARE metadata and assert none of the deleted script's fields
+    // resurrect through the kernel tombstone merge (finding-3).
+    await deployWorker(call, 'delete-me', {
+      main_module: 'worker.js', usage_model: 'unbound', logpush: true, tags: ['old-tag'],
+      compatibility_date: '2026-01-01', migrations: { new_tag: 'v9', new_classes: ['Session'] },
+    });
+    const blocked = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/workers/scripts/delete-me` });
+    const forced = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/workers/scripts/delete-me?force=true` });
+    const gone = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/delete-me` });
+    const namespaces = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/durable_objects/namespaces` });
+    const recreated = await deployWorker(call, 'delete-me', { main_module: 'worker.js' });
+    const fresh = (recreated.body as Body).result;
+    return blocked.status === 400 && forced.status === 200 && (forced.body as Body).result === null
+      && gone.status === 404
+      && (namespaces.body as Body).result?.length === 0
+      && recreated.status === 200 && fresh?.id === 'delete-me'
+      && fresh?.usage_model === 'standard' && fresh?.logpush === false
+      && !Object.hasOwn(fresh ?? {}, 'compatibility_date') && (fresh?.tags?.length ?? 0) === 0
+      && !Object.hasOwn(fresh ?? {}, 'migration_tag')
+      && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/delete-me` })).status === 200;
+  })],
+  ['GET /accounts/{account_id}/workers/scripts/{script_name}/schedules', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/schedules`, b: [{ cron: '*/30 * * * *' }] });
+    const response = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/schedules` });
+    const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/never-uploaded/schedules` });
+    return response.status === 200 && (response.body as Body).result?.schedules?.[0]?.cron === '*/30 * * * *'
+      && typeof (response.body as Body).result?.schedules?.[0]?.created_on === 'string'
+      && missing.status === 404;
+  })],
+  ['PUT /accounts/{account_id}/workers/scripts/{script_name}/schedules', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    const invalid = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/schedules`, b: [{ cron: 'not a cron' }] });
+    // Garbage that happens to have 5 whitespace tokens must still be rejected field-by-field.
+    const garbageFields = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/schedules`, b: [{ cron: 'zz zz zz zz zz' }] });
+    const outOfRange = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/schedules`, b: [{ cron: '99 * * * *' }] });
+    const replaced = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/schedules`, b: [{ cron: '0 3 * * MON' }, { cron: '*/5 9-17 * jan-mar 1,3,5' }] });
+    const emptied = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/schedules`, b: [] });
+    return invalid.status === 400 && garbageFields.status === 400 && outOfRange.status === 400 && replaced.status === 200
+      && (replaced.body as Body).result?.schedules?.map((item: Body) => item.cron).join(',') === '0 3 * * MON,*/5 9-17 * jan-mar 1,3,5'
+      && emptied.status === 200 && (emptied.body as Body).result?.schedules?.length === 0;
+  })],
+  ['GET /accounts/{account_id}/workers/scripts/{script_name}/subdomain', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    const before = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/subdomain` });
+    await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/subdomain`, b: { enabled: true, previews_enabled: true } });
+    const after = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/subdomain` });
+    return (before.body as Body).result?.enabled === false && after.status === 200
+      && (after.body as Body).result?.enabled === true && (after.body as Body).result?.previews_enabled === true;
+  })],
+  ['POST /accounts/{account_id}/workers/scripts/{script_name}/subdomain', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    const invalid = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/subdomain`, b: {} });
+    const enabled = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/subdomain`, b: { enabled: true } });
+    return invalid.status === 400 && enabled.status === 200 && (enabled.body as Body).result?.enabled === true;
+  })],
+  ['DELETE /accounts/{account_id}/workers/scripts/{script_name}/subdomain', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/subdomain`, b: { enabled: true, previews_enabled: true } });
+    const disabled = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/subdomain` });
+    const after = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/subdomain` });
+    return disabled.status === 200 && (disabled.body as Body).result?.enabled === false
+      && (after.body as Body).result?.previews_enabled === false;
+  })],
+  ['GET /accounts/{account_id}/workers/subdomain', () => withRoot(async (call) => {
+    await seed(call);
+    const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/subdomain` });
+    await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/subdomain`, b: { subdomain: 'launch-team' } });
+    const after = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/subdomain` });
+    return missing.status === 404 && after.status === 200 && (after.body as Body).result?.subdomain === 'launch-team';
+  })],
+  ['PUT /accounts/{account_id}/workers/subdomain', () => withRoot(async (call) => {
+    await seed(call);
+    const invalid = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/subdomain`, b: {} });
+    const badLabel = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/subdomain`, b: { subdomain: 'not a label!' } });
+    const created = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/subdomain`, b: { subdomain: 'Launch-Team' } });
+    return invalid.status === 400 && badLabel.status === 400
+      && created.status === 200 && (created.body as Body).result?.subdomain === 'launch-team';
+  })],
+  ['DELETE /accounts/{account_id}/workers/subdomain', () => withRoot(async (call) => {
+    await seed(call);
+    await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/subdomain`, b: { subdomain: 'launch-team' } });
+    const deleted = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/workers/subdomain` });
+    const after = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/subdomain` });
+    // 204 with no body per the pinned OpenAPI; a later PUT can re-create over the tombstone.
+    const recreated = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/subdomain`, b: { subdomain: 'launch-team' } });
+    return deleted.status === 204 && after.status === 404
+      && recreated.status === 200 && (recreated.body as Body).result?.subdomain === 'launch-team';
+  })],
+  ['GET /accounts/{account_id}/workers/domains', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/domains`, b: { hostname: 'api.example.test', service: 'cert-worker' } });
+    const all = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/domains` });
+    const filtered = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/domains?hostname=api.example.test` });
+    const none = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/domains?hostname=other.example.test` });
+    // The documented `environment` filter is honored: production matches, anything else empties.
+    const prod = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/domains?environment=production` });
+    const staging = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/domains?environment=staging` });
+    return all.status === 200 && (all.body as Body).result?.[0]?.service === 'cert-worker'
+      && (filtered.body as Body).result?.length === 1 && (none.body as Body).result?.length === 0
+      && (prod.body as Body).result?.length === 1 && (staging.body as Body).result?.length === 0;
+  })],
+  ['PUT /accounts/{account_id}/workers/domains', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    const outside = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/domains`, b: { hostname: 'api.unrelated.test', service: 'cert-worker' } });
+    const noWorker = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/domains`, b: { hostname: 'api.example.test', service: 'never-uploaded' } });
+    const badZoneName = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/domains`, b: { hostname: 'api.example.test', service: 'cert-worker', zone_name: 'wrong.test' } });
+    const attached = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/domains`, b: { hostname: 'API.example.test', service: 'cert-worker' } });
+    const value = (attached.body as Body).result;
+    return outside.status === 400 && noWorker.status === 400 && badZoneName.status === 400 && attached.status === 200
+      && value?.hostname === 'api.example.test' && value?.zone_id === ZONE && value?.zone_name === 'example.test'
+      && typeof value?.cert_id === 'string' && value.cert_id.length > 0;
+  })],
+  ['GET /accounts/{account_id}/workers/domains/{domain_id}', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    const attached = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/domains`, b: { hostname: 'api.example.test', service: 'cert-worker' } });
+    const id = (attached.body as Body).result?.id;
+    const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/domains/${id}` });
+    const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/domains/${'f'.repeat(32)}` });
+    return fetched.status === 200 && (fetched.body as Body).result?.id === id && missing.status === 404;
+  })],
+  ['DELETE /accounts/{account_id}/workers/domains/{domain_id}', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    const attached = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/domains`, b: { hostname: 'api.example.test', service: 'cert-worker' } });
+    const id = (attached.body as Body).result?.id;
+    const detached = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/workers/domains/${id}` });
+    // Pinned workers_api-response-common envelope: no `result` member.
+    return detached.status === 200 && (detached.body as Body).success === true
+      && !Object.hasOwn(detached.body as Body, 'result')
+      && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/domains/${id}` })).status === 404;
+  })],
+  ['GET /accounts/{account_id}/workers/durable_objects/namespaces', () => withRoot(async (call) => {
+    await seed(call);
+    await deployWorker(call, 'do-worker', { main_module: 'worker.js', migrations: { new_tag: 'v1', new_sqlite_classes: ['Session'], new_classes: ['Legacy'] } });
+    // A REJECTED upload (a DO binding referencing a class the migration does not create) must
+    // leave NO orphan namespace and no script — migrations are planned, not applied, until all
+    // validation passes (round-two N5).
+    const rejected = await deployWorker(call, 'ghost-worker', {
+      main_module: 'worker.js',
+      bindings: [{ type: 'durable_object_namespace', name: 'DO', class_name: 'Missing' }],
+      migrations: { new_tag: 'v1', new_sqlite_classes: ['Present'] },
+    });
+    const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/durable_objects/namespaces` });
+    const classes = ((listed.body as Body).result ?? []).map((item: Body) => `${item.class}:${item.use_sqlite}:${item.script}`).sort();
+    return rejected.status === 400
+      && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/ghost-worker` })).status === 404
+      && listed.status === 200 && classes.join(',') === 'Legacy:false:do-worker,Session:true:do-worker'
+      && (listed.body as Body).result_info?.total_count === 2;
+  })],
+  ['GET /zones/{zone_id}/workers/routes', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    await call({ m: 'POST', p: `/zones/${ZONE}/workers/routes`, b: { pattern: 'example.test/api/*', script: 'cert-worker' } });
+    const listed = await call({ m: 'GET', p: `/zones/${ZONE}/workers/routes` });
+    const badZone = await call({ m: 'GET', p: `/zones/${'9'.repeat(32)}/workers/routes` });
+    return listed.status === 200 && (listed.body as Body).result?.[0]?.pattern === 'example.test/api/*'
+      && (listed.body as Body).result?.[0]?.script === 'cert-worker' && badZone.status === 404;
+  })],
+  ['POST /zones/{zone_id}/workers/routes', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    const invalid = await call({ m: 'POST', p: `/zones/${ZONE}/workers/routes`, b: {} });
+    // A route naming a script that is not a Worker on the zone's account must 400 (finding-5).
+    const ghostScript = await call({ m: 'POST', p: `/zones/${ZONE}/workers/routes`, b: { pattern: 'example.test/ghost/*', script: 'never-uploaded' } });
+    const created = await call({ m: 'POST', p: `/zones/${ZONE}/workers/routes`, b: { pattern: 'example.test/api/*', script: 'cert-worker' } });
+    const duplicate = await call({ m: 'POST', p: `/zones/${ZONE}/workers/routes`, b: { pattern: 'example.test/api/*' } });
+    return invalid.status === 400 && ghostScript.status === 400 && (ghostScript.body as Body).errors?.[0]?.code === 10007
+      && created.status === 200
+      && /^[0-9a-f]{32}$/.test(String((created.body as Body).result?.id)) && duplicate.status === 409;
+  })],
+  ['GET /zones/{zone_id}/workers/routes/{route_id}', () => withRoot(async (call) => {
+    await seed(call);
+    const created = await call({ m: 'POST', p: `/zones/${ZONE}/workers/routes`, b: { pattern: 'example.test/*' } });
+    const id = (created.body as Body).result?.id;
+    const fetched = await call({ m: 'GET', p: `/zones/${ZONE}/workers/routes/${id}` });
+    const missing = await call({ m: 'GET', p: `/zones/${ZONE}/workers/routes/${'f'.repeat(32)}` });
+    return fetched.status === 200 && (fetched.body as Body).result?.pattern === 'example.test/*'
+      && !Object.hasOwn((fetched.body as Body).result ?? {}, 'script') && missing.status === 404;
+  })],
+  ['PUT /zones/{zone_id}/workers/routes/{route_id}', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    const created = await call({ m: 'POST', p: `/zones/${ZONE}/workers/routes`, b: { pattern: 'example.test/api/*', script: 'cert-worker' } });
+    const id = (created.body as Body).result?.id;
+    const invalid = await call({ m: 'PUT', p: `/zones/${ZONE}/workers/routes/${id}`, b: {} });
+    const ghostScript = await call({ m: 'PUT', p: `/zones/${ZONE}/workers/routes/${id}`, b: { pattern: 'example.test/v2/*', script: 'never-uploaded' } });
+    const updated = await call({ m: 'PUT', p: `/zones/${ZONE}/workers/routes/${id}`, b: { pattern: 'example.test/v2/*', script: 'cert-worker' } });
+    return invalid.status === 400 && ghostScript.status === 400 && (ghostScript.body as Body).errors?.[0]?.code === 10007
+      && updated.status === 200 && (updated.body as Body).result?.pattern === 'example.test/v2/*';
+  })],
+  ['DELETE /zones/{zone_id}/workers/routes/{route_id}', () => withRoot(async (call) => {
+    await seed(call);
+    const created = await call({ m: 'POST', p: `/zones/${ZONE}/workers/routes`, b: { pattern: 'example.test/*' } });
+    const id = (created.body as Body).result?.id;
+    const deleted = await call({ m: 'DELETE', p: `/zones/${ZONE}/workers/routes/${id}` });
+    return deleted.status === 200 && (deleted.body as Body).result?.id === id
+      && (await call({ m: 'GET', p: `/zones/${ZONE}/workers/routes/${id}` })).status === 404;
+  })],
+  ['GET /accounts/{account_id}/r2/buckets', () => withRoot(async (call) => {
+    await seed(call);
+    await call({ m: 'POST', p: `/accounts/${ACCOUNT}/r2/buckets`, b: { name: 'launch-artifacts' } });
+    await call({ m: 'POST', p: `/accounts/${ACCOUNT}/r2/buckets`, b: { name: 'launch-logs' } });
+    const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/r2/buckets` });
+    const filtered = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/r2/buckets?name_contains=logs` });
+    const after = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/r2/buckets?start_after=launch-artifacts` });
+    return listed.status === 200
+      && (listed.body as Body).result?.buckets?.map((item: Body) => item.name).join(',') === 'launch-artifacts,launch-logs'
+      && (filtered.body as Body).result?.buckets?.length === 1
+      && (after.body as Body).result?.buckets?.[0]?.name === 'launch-logs';
+  })],
+  ['POST /accounts/{account_id}/r2/buckets', () => withRoot(async (call) => {
+    await seed(call);
+    const invalid = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/r2/buckets`, b: { name: 'UPPER_CASE' } });
+    const created = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/r2/buckets`, b: { name: 'launch-artifacts', locationHint: 'wnam', storageClass: 'Standard' } });
+    const duplicate = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/r2/buckets`, b: { name: 'launch-artifacts' } });
+    const value = (created.body as Body).result;
+    return invalid.status === 400 && created.status === 200
+      && value?.name === 'launch-artifacts' && value?.location === 'wnam' && value?.storage_class === 'Standard'
+      && typeof value?.creation_date === 'string'
+      && duplicate.status === 409 && (duplicate.body as Body).errors?.[0]?.code === 10004;
+  })],
+  ['GET /accounts/{account_id}/r2/buckets/{bucket_name}', () => withRoot(async (call) => {
+    await seed(call);
+    await call({ m: 'POST', p: `/accounts/${ACCOUNT}/r2/buckets`, b: { name: 'launch-artifacts' } });
+    const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/r2/buckets/launch-artifacts` });
+    const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/r2/buckets/never-created` });
+    return fetched.status === 200 && (fetched.body as Body).result?.name === 'launch-artifacts'
+      && missing.status === 404 && (missing.body as Body).errors?.[0]?.code === 10006;
+  })],
+  ['DELETE /accounts/{account_id}/r2/buckets/{bucket_name}', () => withRoot(async (call) => {
+    await seed(call);
+    // Dirty-state cell: create → delete → recreate the same bucket name must yield a live bucket.
+    await call({ m: 'POST', p: `/accounts/${ACCOUNT}/r2/buckets`, b: { name: 'launch-artifacts' } });
+    const deleted = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/r2/buckets/launch-artifacts` });
+    const gone = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/r2/buckets/launch-artifacts` });
+    const recreated = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/r2/buckets`, b: { name: 'launch-artifacts' } });
+    const alive = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/r2/buckets/launch-artifacts` });
+    // Pinned r2_v4_response REQUIRES a `result` member (unlike the queue delete envelope).
+    return deleted.status === 200 && Object.hasOwn(deleted.body as Body, 'result')
+      && gone.status === 404 && recreated.status === 200
+      && alive.status === 200 && (alive.body as Body).result?.name === 'launch-artifacts';
+  })],
+  ['GET /accounts/{account_id}/hyperdrive/configs', () => withRoot(async (call) => {
+    await seed(call);
+    const id = await seedHyperdrive(call);
+    const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/hyperdrive/configs` });
+    const value = (listed.body as Body).result?.[0];
+    return listed.status === 200 && value?.id === id && value?.origin?.host === 'db.internal.test'
+      && !Object.hasOwn(value?.origin ?? {}, 'password')
+      && (listed.body as Body).result_info?.total_count === 1;
+  })],
+  ['POST /accounts/{account_id}/hyperdrive/configs', () => withRoot(async (call) => {
+    await seed(call);
+    const invalid = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/hyperdrive/configs`, b: { name: 'bad', origin: { scheme: 'postgres', database: 'app', user: 'u', password: 'p', host: 'db.test' } } });
+    const created = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/hyperdrive/configs`, b: { name: 'cert-hd', origin: HD_ORIGIN, caching: { disabled: false }, origin_connection_limit: 25 } });
+    const value = (created.body as Body).result;
+    // The origin connection is recorded as configuration — the password is writeOnly in the
+    // vendor schema and must never be echoed; the origin is never dialed.
+    return invalid.status === 400 && created.status === 200
+      && /^[0-9a-f]{32}$/.test(String(value?.id)) && value?.origin?.port === 5432
+      && !Object.hasOwn(value?.origin ?? {}, 'password')
+      && value?.caching?.disabled === false && value?.origin_connection_limit === 25;
+  })],
+  ['GET /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}', () => withRoot(async (call) => {
+    await seed(call);
+    const id = await seedHyperdrive(call);
+    const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}` });
+    const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${'f'.repeat(32)}` });
+    return fetched.status === 200 && (fetched.body as Body).result?.name === 'cert-hd' && missing.status === 404;
+  })],
+  ['PUT /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}', () => withRoot(async (call) => {
+    await seed(call);
+    const id = await seedHyperdrive(call);
+    const invalid = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}`, b: { name: 'renamed' } });
+    const replaced = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}`, b: { name: 'renamed', origin: { ...HD_ORIGIN, host: 'db2.internal.test' } } });
+    const value = (replaced.body as Body).result;
+    return invalid.status === 400 && replaced.status === 200
+      && value?.name === 'renamed' && value?.origin?.host === 'db2.internal.test'
+      && !Object.hasOwn(value ?? {}, 'caching');
+  })],
+  ['PATCH /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}', () => withRoot(async (call) => {
+    await seed(call);
+    const id = await seedHyperdrive(call);
+    const patched = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}`, b: { caching: { disabled: true } } });
+    const value = (patched.body as Body).result;
+    // The vendor's edit-origin is a TYPED PARTIAL: a {host,port}-only PATCH must be accepted and
+    // MERGED over the existing origin (scheme/database/user preserved), not rejected (finding-4).
+    const partialOrigin = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}`, b: { origin: { host: 'db2.internal.test', port: 5433 } } });
+    const merged = (partialOrigin.body as Body).result?.origin;
+    // An unmodeled caching key must still be rejected, not recorded-and-echoed.
+    const badCaching = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}`, b: { caching: { bogus: 1 } } });
+    const badOrigin = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}`, b: { origin: { scheme: 'oracle' } } });
+    // A partial PATCH must not merge into an INCOHERENT origin the create path could never make:
+    // adding a `port` to an Access origin is rejected (round-two N1).
+    const access = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/hyperdrive/configs`, b: {
+      name: 'access-hd',
+      origin: { scheme: 'postgres', database: 'app', user: 'u', password: 'p', access_client_id: 'cid', access_client_secret: 'csec', host: 'access.test' },
+    } });
+    const accessID = (access.body as Body).result?.id;
+    const incoherent = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${accessID}`, b: { origin: { port: 5432 } } });
+    return patched.status === 200 && value?.name === 'cert-hd' && value?.caching?.disabled === true
+      && value?.origin?.host === 'db.internal.test'
+      && partialOrigin.status === 200 && merged?.host === 'db2.internal.test' && merged?.port === 5433
+      && merged?.scheme === 'postgres' && merged?.database === 'app'
+      && badCaching.status === 400 && badOrigin.status === 400
+      && access.status === 200 && incoherent.status === 400;
+  })],
+  ['DELETE /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}', () => withRoot(async (call) => {
+    await seed(call);
+    const id = await seedHyperdrive(call);
+    const deleted = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}` });
+    return deleted.status === 200 && (deleted.body as Body).result === null
+      && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}` })).status === 404;
+  })],
+  ['GET /accounts/{account_id}/queues', () => withRoot(async (call) => {
+    await seed(call);
+    const id = await seedQueue(call);
+    await deployWorker(call, 'producer-worker', { main_module: 'worker.js', bindings: [{ type: 'queue', name: 'Q', queue_name: 'cert-queue' }] });
+    const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues` });
+    const value = (listed.body as Body).result?.[0];
+    // Producer bindings recorded on a Worker upload surface as the queue's producers.
+    return listed.status === 200 && value?.queue_id === id && value?.queue_name === 'cert-queue'
+      && value?.producers?.[0]?.script === 'producer-worker' && value?.producers_total_count === 1;
+  })],
+  ['POST /accounts/{account_id}/queues', () => withRoot(async (call) => {
+    await seed(call);
+    const invalid = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues`, b: {} });
+    const created = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues`, b: { queue_name: 'cert-queue' } });
+    const duplicate = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues`, b: { queue_name: 'cert-queue' } });
+    const value = (created.body as Body).result;
+    return invalid.status === 400 && created.status === 200
+      && /^[0-9a-f]{32}$/.test(String(value?.queue_id)) && value?.queue_name === 'cert-queue'
+      && value?.consumers_total_count === 0 && duplicate.status === 400;
+  })],
+  ['GET /accounts/{account_id}/queues/{queue_id}', () => withRoot(async (call) => {
+    await seed(call);
+    const id = await seedQueue(call);
+    const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${id}` });
+    const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${'f'.repeat(32)}` });
+    return fetched.status === 200 && (fetched.body as Body).result?.queue_name === 'cert-queue' && missing.status === 404;
+  })],
+  ['DELETE /accounts/{account_id}/queues/{queue_id}', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    const id = await seedQueue(call);
+    const consumer = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'worker', script_name: 'cert-worker' } });
+    const deleted = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/queues/${id}` });
+    const gone = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${id}` });
+    const consumerGone = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${(consumer.body as Body).result?.consumer_id}` });
+    // Pinned QueueDeleteResponse envelope carries no `result` member (finding-8).
+    return deleted.status === 200 && (deleted.body as Body).success === true
+      && !Object.hasOwn(deleted.body as Body, 'result')
+      && gone.status === 404 && consumerGone.status === 404;
+  })],
+  ['GET /accounts/{account_id}/queues/{queue_id}/consumers', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    const id = await seedQueue(call);
+    await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'worker', script_name: 'cert-worker' } });
+    const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${id}/consumers` });
+    const value = (listed.body as Body).result?.[0];
+    return listed.status === 200 && value?.type === 'worker' && value?.script_name === 'cert-worker'
+      && value?.queue_name === 'cert-queue';
+  })],
+  ['POST /accounts/{account_id}/queues/{queue_id}/consumers', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    const id = await seedQueue(call);
+    const badType = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'lambda' } });
+    const noScript = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'worker', script_name: 'never-uploaded' } });
+    const worker = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'worker', script_name: 'cert-worker', settings: { batch_size: 10, max_retries: 3 } } });
+    // A queue has at most one consumer — a second POST must be rejected until the first is gone.
+    const second = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'http_pull' } });
+    await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${(worker.body as Body).result?.consumer_id}` });
+    // The vendor documents max_concurrency:null ("opt into the platform maximum") — must be accepted.
+    const pull = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'http_pull', settings: { visibility_timeout_ms: 6000 } } });
+    return badType.status === 400 && noScript.status === 400
+      && worker.status === 200 && (worker.body as Body).result?.settings?.batch_size === 10
+      && second.status === 400
+      && pull.status === 200 && (pull.body as Body).result?.type === 'http_pull'
+      && !Object.hasOwn((pull.body as Body).result ?? {}, 'script_name');
+  })],
+  ['GET /accounts/{account_id}/queues/{queue_id}/consumers/{consumer_id}', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    const id = await seedQueue(call);
+    const created = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'worker', script_name: 'cert-worker' } });
+    const consumerID = (created.body as Body).result?.consumer_id;
+    const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${consumerID}` });
+    const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${'f'.repeat(32)}` });
+    return fetched.status === 200 && (fetched.body as Body).result?.consumer_id === consumerID && missing.status === 404;
+  })],
+  ['PUT /accounts/{account_id}/queues/{queue_id}/consumers/{consumer_id}', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    const id = await seedQueue(call);
+    await seedQueue(call, 'dlq'); // a dead_letter_queue must reference a real queue on the account
+    const created = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'worker', script_name: 'cert-worker' } });
+    const consumerID = (created.body as Body).result?.consumer_id;
+    const badSetting = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${consumerID}`, b: { type: 'http_pull', settings: { max_concurrency: 2 } } });
+    const ghostDlq = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${consumerID}`, b: { type: 'worker', script_name: 'cert-worker', dead_letter_queue: 'nope-queue' } });
+    const badNull = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${consumerID}`, b: { type: 'worker', script_name: 'cert-worker', settings: { batch_size: null } } });
+    // The vendor's recommended max_concurrency:null ("platform maximum") must be accepted;
+    // batch_size:null must NOT (only max_concurrency is nullable).
+    const updated = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${consumerID}`, b: { type: 'worker', script_name: 'cert-worker', dead_letter_queue: 'dlq', settings: { batch_size: 25, max_concurrency: null } } });
+    const value = (updated.body as Body).result;
+    // max_concurrency is a worker-consumer setting; the http_pull union does not carry it.
+    return badSetting.status === 400 && ghostDlq.status === 400 && badNull.status === 400 && updated.status === 200
+      && value?.dead_letter_queue === 'dlq' && value?.settings?.batch_size === 25
+      && value?.settings?.max_concurrency === null;
+  })],
+  ['DELETE /accounts/{account_id}/queues/{queue_id}/consumers/{consumer_id}', () => withRoot(async (call) => {
+    await seed(call); await deployWorker(call);
+    const id = await seedQueue(call);
+    const created = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'worker', script_name: 'cert-worker' } });
+    const consumerID = (created.body as Body).result?.consumer_id;
+    const deleted = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${consumerID}` });
+    // Pinned ConsumerDeleteResponse envelope carries no `result` member (finding-8).
+    return deleted.status === 200 && (deleted.body as Body).success === true
+      && !Object.hasOwn(deleted.body as Body, 'result')
+      && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${consumerID}` })).status === 404
+      && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${id}` })).status === 200;
+  })],
+]);
+// Account members: the built-in roles, a member added with role ids and removed, and a bootstrapped member's user
+// two-factor state (Cloudflare's record of the person, which no account API sets).
+const memberSeed = async (call: Call) => {
+  await seed(call);
+  await call({ m: 'POST', p: '/twin/bootstrap', b: { members: [{ account_id: ACCOUNT, email: 'ana@example.test', roles: ['Super Administrator - All Privileges'], two_factor: true }] } });
+  return (((await call({ m: 'GET', p: `/accounts/${ACCOUNT}/roles` })).body as Body).result as { id: string; name: string }[]);
+};
+const memberVerifiers = new Map<string, Verify>([
+  ['GET /accounts/{account_id}/roles', () => withRoot(async (call) => { const roles = await memberSeed(call); return roles.some((r) => r.name === 'Administrator') && roles.every((r) => /^[a-f0-9]{32}$/.test(r.id)); })],
+  ['GET /accounts/{account_id}/members', () => withRoot(async (call) => {
+    await memberSeed(call);
+    const list = ((await call({ m: 'GET', p: `/accounts/${ACCOUNT}/members` })).body as Body).result as any[];
+    return list.length === 1 && list[0].user.email === 'ana@example.test' && list[0].user.two_factor_authentication_enabled === true && list[0].status === 'accepted' && list[0].roles[0].name === 'Super Administrator - All Privileges';
+  })],
+  ['POST /accounts/{account_id}/members', () => withRoot(async (call) => {
+    const roles = await memberSeed(call);
+    const admin = roles.find((r) => r.name === 'Administrator')!.id;
+    const added = (await call({ m: 'POST', p: `/accounts/${ACCOUNT}/members`, b: { email: 'ben@example.test', roles: [admin] } })).body as Body;
+    const bad = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/members`, b: { email: 'carol@example.test', roles: ['nope'] } });
+    const dup = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/members`, b: { email: 'ben@example.test', roles: [admin] } });
+    return added.success === true && added.result.status === 'pending' && added.result.user.two_factor_authentication_enabled === false && bad.status === 400 && dup.status === 400;
+  })],
+  ['GET /accounts/{account_id}/members/{member_id}', () => withRoot(async (call) => {
+    await memberSeed(call);
+    const id = (((await call({ m: 'GET', p: `/accounts/${ACCOUNT}/members` })).body as Body).result as any[])[0].id;
+    return ((await call({ m: 'GET', p: `/accounts/${ACCOUNT}/members/${id}` })).body as Body).result.email === 'ana@example.test'
+      && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/members/${'f'.repeat(32)}` })).status === 404;
+  })],
+  ['DELETE /accounts/{account_id}/members/{member_id}', () => withRoot(async (call) => {
+    await memberSeed(call);
+    const id = (((await call({ m: 'GET', p: `/accounts/${ACCOUNT}/members` })).body as Body).result as any[])[0].id;
+    await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/members/${id}` });
+    return (((await call({ m: 'GET', p: `/accounts/${ACCOUNT}/members` })).body as Body).result as any[]).length === 0;
+  })],
+]);
+// The account audit log: a user's API token created, a zone setting changed with it and a member removed are logged
+// newest first; the token and the setting are attributed to that user (the setting with its old and new value), the
+// removal (a token no one owns) to no one.
+operationVerifiers.set('GET /accounts/{account_id}/audit_logs', () => withRoot(async (call) => {
+  await memberSeed(call);
+  const token = ((await call({ m: 'POST', p: '/twin/users/ana@example.test/tokens' })).body as Body).result.token as string;
+  await call({ m: 'PATCH', p: `/zones/${ZONE}/settings/always_use_https`, b: { value: 'on' }, bearer: token });
+  const id = (((await call({ m: 'GET', p: `/accounts/${ACCOUNT}/members` })).body as Body).result as any[])[0].id;
+  await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/members/${id}` });
+  const log = ((await call({ m: 'GET', p: `/accounts/${ACCOUNT}/audit_logs` })).body as Body).result as any[];
+  return log.length === 3 && log[2].action.type === 'create' && log[2].resource.type === 'token' && log[2].actor.email === 'ana@example.test'
+    && log[1].actor.email === 'ana@example.test' && log[1].resource.type === 'zone_setting' && log[1].oldValue === 'off' && log[1].newValue === 'on'
+    && log[0].action.type === 'delete' && log[0].actor.email === ''
+    && (((await call({ m: 'GET', p: `/accounts/${ACCOUNT}/audit_logs?before=2000-01-01T00:00:00Z` })).body as Body).result as any[]).length === 0;
+}));
+for (const [key, verify] of memberVerifiers) operationVerifiers.set(key, verify);
+for (const [key, verify] of provisioningVerifiers) operationVerifiers.set(key, verify);
+
+// The Workers deploy plane an unmodified `wrangler deploy` drives beyond the script upload:
+// static-assets upload sessions and bucketed uploads, versions, deployments, script settings,
+// and secrets listing. Same discipline: fresh root, response VALUES, and the negative path.
+const ASSET_A = 'a1'.repeat(16);
+const ASSET_B = 'b2'.repeat(16);
+const ASSET_MANIFEST = { '/index.html': { hash: ASSET_A, size: 5 }, '/app.js': { hash: ASSET_B, size: 3 } };
+function tokenPayload(jwt: unknown): Body {
+  try { return JSON.parse(Buffer.from(String(jwt).split('.')[1] ?? '', 'base64url').toString('utf8')) as Body; } catch { return {}; }
+}
+/** One bulk asset upload exactly as wrangler sends it: parts named by hash, base64 content. */
+function assetUpload(jwt: string, files: Record<string, { type: string; content: string }>): Step {
+  const boundary = 'twin-asset-boundary';
+  const parts = Object.entries(files).map(([hash, file]) =>
+    `--${boundary}\r\nContent-Disposition: form-data; name="${hash}"; filename="${hash}"\r\nContent-Type: ${file.type}\r\n\r\n${Buffer.from(file.content).toString('base64')}\r\n`);
+  return { m: 'POST', p: `/accounts/${ACCOUNT}/workers/assets/upload?base64=true`, raw: `${parts.join('')}--${boundary}--\r\n`, ct: `multipart/form-data; boundary=${boundary}`, bearer: jwt };
+}
+/** Session → upload every bucket → the completion token (the whole wrangler asset sync). */
+async function syncAssets(call: Call, name = 'cert-worker'): Promise<string> {
+  const session = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/${name}/assets-upload-session`, b: { manifest: ASSET_MANIFEST } });
+  const jwt = String((session.body as Body).result?.jwt ?? '');
+  if (((session.body as Body).result?.buckets ?? []).length === 0) return jwt;
+  const done = await call(assetUpload(jwt, { [ASSET_A]: { type: 'text/html', content: 'hello' }, [ASSET_B]: { type: 'text/javascript', content: '1+1' } }));
+  return String((done.body as Body).result?.jwt ?? '');
+}
+async function deployVersion(call: Call, name = 'cert-worker', metadata: Body = { main_module: 'worker.js' }, body = 'export default {};'): Promise<CloudflareResponse> {
+  const upload = moduleUpload(metadata, { 'worker.js': body });
+  return call({ ...upload, m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/${name}/versions` });
+}
+
+const deployPlaneVerifiers = new Map<string, Verify>([
+  ['POST /accounts/{account_id}/workers/scripts/{script_name}/assets-upload-session', () => withRoot(async (call) => {
+    await seed(call);
+    const invalid = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/assets-upload-session`, b: { manifest: { 'no-slash': { hash: ASSET_A, size: 1 } } } });
+    const first = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/assets-upload-session`, b: { manifest: ASSET_MANIFEST } });
+    const buckets = ((first.body as Body).result?.buckets ?? []).flat().sort().join(',');
+    await syncAssets(call);
+    // Once the account holds both hashes, a new session names no buckets and its jwt already completes.
+    const again = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/assets-upload-session`, b: { manifest: ASSET_MANIFEST } });
+    return invalid.status === 400 && first.status === 200
+      && buckets === [ASSET_A, ASSET_B].sort().join(',') && tokenPayload((first.body as Body).result?.jwt).purpose === 'upload'
+      && again.status === 200 && (again.body as Body).result?.buckets?.length === 0
+      && tokenPayload((again.body as Body).result?.jwt).purpose === 'completion';
+  })],
+  ['POST /accounts/{account_id}/workers/assets/upload', () => withRoot(async (call) => {
+    await seed(call);
+    const session = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/assets-upload-session`, b: { manifest: ASSET_MANIFEST } });
+    const jwt = String((session.body as Body).result?.jwt);
+    // The API token is not the session token; a size that disagrees with the manifest is refused.
+    const apiToken = await call({ ...assetUpload(jwt, { [ASSET_A]: { type: 'text/html', content: 'hello' } }), bearer: undefined });
+    const wrongSize = await call(assetUpload(jwt, { [ASSET_A]: { type: 'text/html', content: 'hello world' } }));
+    const partial = await call(assetUpload(jwt, { [ASSET_A]: { type: 'text/html', content: 'hello' } }));
+    const complete = await call(assetUpload(jwt, { [ASSET_B]: { type: 'text/javascript', content: '1+1' } }));
+    const completion = String((complete.body as Body).result?.jwt ?? '');
+    // The completion token is redeemed by the script upload; an assets binding with no assets is refused.
+    const noAssets = await deployWorker(call, 'cert-worker', { main_module: 'worker.js', bindings: [{ type: 'assets', name: 'ASSETS' }] });
+    const withAssets = await deployWorker(call, 'cert-worker', { main_module: 'worker.js', bindings: [{ type: 'assets', name: 'ASSETS' }], assets: { jwt: completion, config: { run_worker_first: true } } });
+    return apiToken.status === 401 && wrongSize.status === 400
+      && partial.status === 200 && !Object.hasOwn((partial.body as Body).result ?? {}, 'jwt')
+      && complete.status === 200 && tokenPayload(completion).purpose === 'completion'
+      && noAssets.status === 400 && withAssets.status === 200 && (withAssets.body as Body).result?.has_assets === true;
+  })],
+  ['GET /accounts/{account_id}/workers/scripts/{script_name}/versions', () => withRoot(async (call) => {
+    await seed(call);
+    await deployWorker(call);
+    const second = await deployWorker(call, 'cert-worker', { main_module: 'worker.js', compatibility_date: '2026-09-01' });
+    const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/versions` });
+    const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/never-uploaded/versions` });
+    const items = (listed.body as Body).result?.items ?? [];
+    return listed.status === 200 && items.length === 2 && items[0]?.number === 2 && items[1]?.number === 1
+      && items[0]?.id === (second.body as Body).result?.deployment_id
+      && items[0]?.resources?.script_runtime?.compatibility_date === '2026-09-01'
+      && missing.status === 404 && (missing.body as Body).errors?.[0]?.code === 10007;
+  })],
+  ['GET /accounts/{account_id}/workers/scripts/{script_name}/versions/{version_id}', () => withRoot(async (call) => {
+    await seed(call);
+    const uploaded = await deployWorker(call, 'cert-worker', { main_module: 'worker.js', bindings: [{ type: 'secret_text', name: 'API_KEY', text: 'shh' }] });
+    const id = (uploaded.body as Body).result?.deployment_id;
+    const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/versions/${id}` });
+    const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/versions/${'0'.repeat(8)}-0000-4000-a000-${'0'.repeat(12)}` });
+    const value = (fetched.body as Body).result;
+    return fetched.status === 200 && value?.id === id && value?.number === 1
+      && value?.resources?.script?.etag === (uploaded.body as Body).result?.etag
+      && value?.resources?.bindings?.[0]?.name === 'API_KEY' && !Object.hasOwn(value?.resources?.bindings?.[0] ?? {}, 'text')
+      && missing.status === 404;
+  })],
+  ['GET /accounts/{account_id}/workers/scripts/{script_name}/deployments', () => withRoot(async (call) => {
+    await seed(call);
+    const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/deployments` });
+    const uploaded = await deployWorker(call);
+    const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/deployments` });
+    const latest = (listed.body as Body).result?.deployments?.[0];
+    return missing.status === 404 && (missing.body as Body).errors?.[0]?.code === 10007
+      && listed.status === 200 && latest?.strategy === 'percentage'
+      && latest?.versions?.[0]?.version_id === (uploaded.body as Body).result?.deployment_id && latest?.versions?.[0]?.percentage === 100;
+  })],
+  ['POST /accounts/{account_id}/workers/scripts/{script_name}/deployments', () => withRoot(async (call) => {
+    await seed(call);
+    const first = await deployWorker(call);
+    // A version upload does not change the live Worker until a deployment routes traffic to it.
+    const version = await deployVersion(call, 'cert-worker', { main_module: 'worker.js' }, 'export default { v: 2 };');
+    const versionID = (version.body as Body).result?.id;
+    const before = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/settings` });
+    const badSum = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/deployments`, b: { strategy: 'percentage', versions: [{ version_id: versionID, percentage: 60 }, { version_id: (first.body as Body).result?.deployment_id, percentage: 50 }] } });
+    const unknown = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/deployments`, b: { strategy: 'percentage', versions: [{ version_id: 'not-a-version', percentage: 100 }] } });
+    const deployed = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/deployments`, b: { strategy: 'percentage', versions: [{ version_id: versionID, percentage: 100 }], annotations: { 'workers/message': 'ship v2' } } });
+    const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/deployments` });
+    const download = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker` });
+    return version.status === 200 && before.status === 200 && badSum.status === 400 && unknown.status === 400
+      && deployed.status === 200 && (deployed.body as Body).result?.annotations?.['workers/message'] === 'ship v2'
+      && (listed.body as Body).result?.deployments?.[0]?.id === (deployed.body as Body).result?.id
+      && String(download.body).includes('v: 2');
+  })],
+  ['GET /accounts/{account_id}/workers/scripts/{script_name}/script-settings', () => withRoot(async (call) => {
+    await seed(call);
+    await deployWorker(call, 'cert-worker', { main_module: 'worker.js', logpush: true, tags: ['launch'] });
+    const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/script-settings` });
+    const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/never-uploaded/script-settings` });
+    const value = (fetched.body as Body).result;
+    return fetched.status === 200 && value?.logpush === true && value?.tags?.[0] === 'launch' && missing.status === 404;
+  })],
+  ['PATCH /accounts/{account_id}/workers/scripts/{script_name}/script-settings', () => withRoot(async (call) => {
+    await seed(call);
+    await deployWorker(call);
+    const invalid = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/script-settings`, b: { logpush: 'yes' } });
+    const patched = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/script-settings`, b: { observability: { enabled: true, head_sampling_rate: 0.5 }, tags: ['env:prod'] } });
+    const after = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/script-settings` });
+    const value = (after.body as Body).result;
+    return invalid.status === 400 && patched.status === 200
+      && value?.observability?.enabled === true && value?.observability?.head_sampling_rate === 0.5
+      && value?.tags?.[0] === 'env:prod' && value?.logpush === false;
+  })],
+  ['GET /accounts/{account_id}/workers/scripts/{script_name}/settings', () => withRoot(async (call) => {
+    await seed(call);
+    await deployWorker(call, 'cert-worker', { main_module: 'worker.js', compatibility_date: '2026-09-01', bindings: [
+      { type: 'plain_text', name: 'MODE', text: 'prod' }, { type: 'secret_text', name: 'API_KEY', text: 'shh' },
+    ] });
+    const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/settings` });
+    const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/never-uploaded/settings` });
+    const bindings = (fetched.body as Body).result?.bindings ?? [];
+    const secret = bindings.find((item: Body) => item.name === 'API_KEY');
+    return fetched.status === 200 && (fetched.body as Body).result?.compatibility_date === '2026-09-01'
+      && bindings.find((item: Body) => item.name === 'MODE')?.text === 'prod'
+      && secret?.type === 'secret_text' && !Object.hasOwn(secret ?? {}, 'text')
+      && missing.status === 404 && (missing.body as Body).errors?.[0]?.code === 10007;
+  })],
+  ['GET /accounts/{account_id}/workers/scripts/{script_name}/secrets', () => withRoot(async (call) => {
+    await seed(call);
+    await deployWorker(call, 'cert-worker', { main_module: 'worker.js', bindings: [
+      { type: 'plain_text', name: 'MODE', text: 'prod' }, { type: 'secret_text', name: 'API_KEY', text: 'shh' },
+    ] });
+    const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/secrets` });
+    const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/never-uploaded/secrets` });
+    const result = (listed.body as Body).result ?? [];
+    return listed.status === 200 && result.length === 1 && result[0]?.name === 'API_KEY' && result[0]?.type === 'secret_text'
+      && !Object.hasOwn(result[0] ?? {}, 'text')
+      && missing.status === 404 && (missing.body as Body).errors?.[0]?.code === 10007;
+  })],
+  ['GET /accounts/{account_id}/workers/scripts/{script_name}/secrets/{secret_name}', () => withRoot(async (call) => {
+    await seed(call);
+    await deployWorker(call, 'cert-worker', { main_module: 'worker.js', bindings: [{ type: 'secret_text', name: 'API_KEY', text: 'shh' }] });
+    const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/secrets/API_KEY` });
+    const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/secrets/NOPE` });
+    return fetched.status === 200 && (fetched.body as Body).result?.name === 'API_KEY'
+      && !Object.hasOwn((fetched.body as Body).result ?? {}, 'text') && missing.status === 404;
+  })],
+]);
+for (const [key, verify] of deployPlaneVerifiers) operationVerifiers.set(key, verify);
+
+// These official operations contain broad unions/nested schemas. The twin deliberately
+// supports the certification-needed slices (ingress; CNAME/A/CAA records; the multipart
+// module upload with the deploy-critical binding kinds and Durable Object migrations), but
+// each whole vendor operation stays todo until every official variant is schema-faithful.
+const INCOMPLETE_OPERATION_UNIONS = new Set([
+  'PUT /accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations',
+  'POST /zones/{zone_id}/dns_records',
+  'PUT /zones/{zone_id}/dns_records/{dns_record_id}',
+  'PATCH /zones/{zone_id}/dns_records/{dns_record_id}',
+  // Served and exercised by every worker-seeding verify above, but the full multipart metadata
+  // union (38 binding kinds, assets, placement, limits, observability) is far broader than the
+  // implemented deploy slice — the whole vendor operation honestly stays todo.
+  'PUT /accounts/{account_id}/workers/scripts/{script_name}',
+  // The versions upload carries the same multipart metadata union as the script PUT above.
+  'POST /accounts/{account_id}/workers/scripts/{script_name}/versions',
+]);
+
+const operationCapabilities: CapabilitySpec[] = CLOUDFLARE_OPENAPI_OPERATIONS.map((operation) => {
+  const operationKey = `${operation.method} ${operation.path}`;
+  const verify = INCOMPLETE_OPERATION_UNIONS.has(operationKey) ? undefined : operationVerifiers.get(operationKey);
+  return {
+    id: operation.id,
+    area: operation.area,
+    title: `${operation.method} ${operation.path} — ${operation.summary}`,
+    dimension: 'api',
+    tier: operation.tier,
+    expected: verify ? 'done' : 'todo',
+    ...(verify ? { verify } : {}),
+  };
+});
+
+const doneConnector = (id: string, title: string, tier: CapabilitySpec['tier'], verify: Verify): CapabilitySpec => ({
+  id, area: 'connector', title, dimension: 'connector', tier, expected: 'done', verify,
+});
+
+const connectorCapabilities: CapabilitySpec[] = [
+  doneConnector('cloudflare.connector.pull_complete_pagination', 'Pull walks every result_info page across the account graph', 'core', async () => {
+    const calls: string[] = [];
+    const execute: CloudflareExecute = async (_method, path) => {
+      calls.push(path);
+      const page = Number(new URL(path, 'https://x.invalid').searchParams.get('page') ?? 1);
+      if (path.startsWith('/accounts?')) return { status: 200, body: { success: true, result: [{ id: page === 1 ? ACCOUNT : 'c'.repeat(32), name: `A${page}` }], result_info: { page, total_pages: 2 } } };
+      if (path.startsWith('/zones?')) return { status: 200, body: { success: true, result: [{ id: ZONE, name: 'example.test', account: { id: ACCOUNT } }], result_info: { page, total_pages: 1 } } };
+      return { status: 200, body: { success: true, result: [], result_info: { page, total_pages: 1 } } };
+    };
+    const result = await pullCloudflareState(execute);
+    return result.length === 3 && calls.includes('/accounts?per_page=50&page=2');
+  }),
+  doneConnector('cloudflare.connector.pull_idempotent', 'Repeated identical pull is idempotent in the projection', 'core', () => withRoot(async (_call, root) => {
+    const execute: CloudflareExecute = async (_method, path) => ({ status: 200, body: { success: true, result: path.startsWith('/accounts?') ? [{ id: ACCOUNT, name: 'Acme' }] : [] } });
+    const first = await syncCloudflareFromReal(execute, { root, occurredAt: AT });
+    const second = await syncCloudflareFromReal(execute, { root, occurredAt: AT });
+    return first.deltasAppended === 1 && second.deltasAppended === 0;
+  })),
+  doneConnector('cloudflare.connector.pull_refuses_invalid_envelope', 'Pull requires a valid success:true envelope and refuses transport failures', 'core', async () => {
+    for (const response of [{ status: 200, body: {} }, { status: 403, body: { success: false, errors: [{ message: 'denied' }] } }]) {
+      try { await pullCloudflareState(async () => response); return false; } catch (error) { if (!String(error).includes('refused')) return false; }
+    }
+    return true;
+  }),
+  doneConnector('cloudflare.connector.pull_deletion_convergence', 'A complete later pull tombstones vendor-observed resources that disappeared', 'core', () => withRoot(async (_call, root) => {
+    let present = true;
+    const execute: CloudflareExecute = async (_method, path) => ({ status: 200, body: {
+      success: true,
+      result: path.startsWith('/accounts?') && present ? [{ id: ACCOUNT, name: 'Acme' }] : [],
+      result_info: { page: 1, total_pages: 1 },
+    } });
+    await syncCloudflareFromReal(execute, { root, occurredAt: AT }); present = false;
+    await syncCloudflareFromReal(execute, { root, occurredAt: '2026-08-21T00:00:01.000Z' });
+    return projectResources('cloudflare', root).find((resource) => resource.id === ACCOUNT)?.deleted === true;
+  })),
+  doneConnector('cloudflare.connector.pull_incomplete_inventory_safe', 'A metadata-free partial inventory cannot tombstone unseen vendor resources', 'core', () => withRoot(async (_call, root) => {
+    let includeSecond = true;
+    const secondID = 'c'.repeat(32);
+    const execute: CloudflareExecute = async (_method, path) => ({ status: 200, body: {
+      success: true,
+      result: path.startsWith('/accounts?') ? [{ id: ACCOUNT, name: 'A' }, ...(includeSecond ? [{ id: secondID, name: 'B' }] : [])] : [],
+    } });
+    await syncCloudflareFromReal(execute, { root, occurredAt: AT }); includeSecond = false;
+    await syncCloudflareFromReal(execute, { root, occurredAt: '2026-08-21T00:00:01.000Z' });
+    // the row is still there and still live: an inventory that never said it was complete cannot erase it
+    const unseen = projectResources('cloudflare', root).find((resource) => resource.id === secondID);
+    return unseen !== undefined && unseen.deleted !== true;
+  })),
+  doneConnector('cloudflare.connector.pull_tunnel_deletion_timestamp', 'Complete pull tunnel tombstones expose the observation timestamp', 'common', () => withRoot(async (_call, root) => {
+    let present = true;
+    const execute: CloudflareExecute = async (_method, path) => {
+      if (path.endsWith('/configurations')) return { status: 404, body: { success: false, result: null, errors: [] } };
+      const result = path.startsWith('/accounts?') ? [{ id: ACCOUNT, name: 'A' }]
+        : path.startsWith('/zones?') ? []
+          : path.includes('/cfd_tunnel?') && present ? [{ id: VENDOR_TUNNEL, account_tag: ACCOUNT, name: 't', config_src: 'cloudflare' }] : [];
+      return { status: 200, body: { success: true, result, result_info: { page: 1, total_pages: 1 } } };
+    };
+    await syncCloudflareFromReal(execute, { root, occurredAt: AT }); present = false;
+    const deletedAt = '2026-08-21T00:00:01.000Z';
+    await syncCloudflareFromReal(execute, { root, occurredAt: deletedAt });
+    const value = projectResources('cloudflare', root).find((resource) => resource.id === VENDOR_TUNNEL);
+    return value?.deleted === true && value.deleted_at === deletedAt;
+  })),
+  doneConnector('cloudflare.connector.mapper_schema_validation', 'Pull rejects malformed vendor fixtures before folding impossible identities', 'common', async () => {
+    try { await pullCloudflareState(async () => ({ status: 200, body: { success: true, result: [{}] } })); return false; }
+    catch (error) { return String(error).includes('id must be a nonempty string'); }
+  }),
+  doneConnector('cloudflare.connector.configuration_identity', 'Pulled and locally-updated configuration converge on one account+tunnel identity', 'core', () => withRoot(async (call, root) => {
+    await seed(call);
+    await applyTwinWrite('cloudflare', { operation: 'tunnel.observe', subjectType: 'cloudflare_tunnel', subjectId: VENDOR_TUNNEL, fields: { account_id: ACCOUNT, name: 't', config_src: 'cloudflare', status: 'inactive', _deleted: false }, occurredAt: AT, actor: { kind: 'system' } }, root);
+    await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/cfd_tunnel/${VENDOR_TUNNEL}/configurations`, b: { config: { ingress: [{ hostname: '*', service: 'http_status:503' }] } } });
+    const execute: CloudflareExecute = async (_method, path) => ({ status: 200, body: { success: true, result: path.startsWith('/accounts?') ? [{ id: ACCOUNT, name: 'Acme' }] : path.startsWith('/zones?') ? [] : path.includes('/cfd_tunnel?') ? [{ id: VENDOR_TUNNEL, account_tag: ACCOUNT, name: 't', config_src: 'cloudflare' }] : { account_id: ACCOUNT, tunnel_id: VENDOR_TUNNEL, config: { ingress: [{ hostname: '*', service: 'http_status:404' }] } } } });
+    await syncCloudflareFromReal(execute, { root, occurredAt: '2026-08-21T00:00:01.000Z' });
+    return projectResources('cloudflare', root).filter((value) => value.type === 'tunnel_configuration').length === 1;
+  })),
+  doneConnector('cloudflare.connector.pull_call_conservation', 'Pull fetches configuration only for remotely-managed tunnels', 'common', async () => {
+    const paths: string[] = [];
+    const execute: CloudflareExecute = async (_method, path) => { paths.push(path); return { status: 200, body: { success: true, result: path.startsWith('/accounts?') ? [{ id: ACCOUNT, name: 'Acme' }] : path.includes('/cfd_tunnel?') ? [{ id: VENDOR_TUNNEL, name: 'local', config_src: 'local', account_tag: ACCOUNT }] : [] } }; };
+    await pullCloudflareState(execute);
+    return paths.length === 3 && !paths.some((path) => path.endsWith('/configurations'));
+  }),
+  doneConnector('cloudflare.connector.push', 'performCloudflareAction carries each entry across through the kernel\'s executor: the tunnel create answers Cloudflare\'s own id, and the configuration that follows is addressed to THAT id, not the local one (protocol 2)', 'core', () => withRoot(async (call, root) => {
+    await seed(call); const localTunnel = await tunnel(call, 'push-me');
+    await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/cfd_tunnel/${localTunnel}/configurations`, b: { config: { ingress: [{ hostname: '*', service: 'http_status:404' }] } } });
+    let failConfiguration = true;
+    const { execute, seen } = vendor((method, _path, body) => {
+      if (method === 'POST') return { status: 200, body: { success: true, result: { id: VENDOR_TUNNEL, account_tag: ACCOUNT, name: 'push-me', config_src: 'cloudflare' } } };
+      if (failConfiguration) return { status: 500, body: { success: false, errors: [{ message: 'retry' }], result: null } };
+      return { status: 200, body: { success: true, result: { account_id: ACCOUNT, tunnel_id: VENDOR_TUNNEL, config: body?.config } } };
+    });
+    // the vendor refuses the configuration once: the create is already across, and the dependent entry stops the batch
+    const first = await performAll(root, execute);
+    if (first.failed === null || !first.failed.includes('retry')) return false;
+    if (first.adopted.get(`cloudflare_tunnel:${localTunnel}`) !== VENDOR_TUNNEL) return false;
+    failConfiguration = false;
+    const again = await performAll(root, execute, first.adopted, first.done);
+    const configurations = seen.filter((request) => request.path.includes('/configurations'));
+    return again.failed === null && configurations.length > 0
+      && configurations.every((request) => request.path.includes(VENDOR_TUNNEL) && !request.path.includes(localTunnel));
+  })),
+  doneConnector('cloudflare.connector.push_confirmation_shape', 'A perform refuses an HTTP 200 body without success:true and the result identity Cloudflare owes — the entry stays undeployed rather than being marked across on a shapeless answer', 'core', () => withRoot(async (call, root) => {
+    await seed(call); await tunnel(call, 'do-not-confirm');
+    const before = deployableEntries('cloudflare', root).filter((entry) => entry.operation === 'tunnel.create').length;
+    const shapeless = vendor(() => ({ status: 200, body: {} }));
+    const refused = await performAll(root, shapeless.execute);
+    if (refused.failed === null || before === 0) return false;
+    // the same seam confirms a well-shaped answer, so the refusal was the SHAPE and not the seam
+    const proper = vendor(() => ({ status: 200, body: { success: true, result: { id: VENDOR_TUNNEL } } }));
+    const accepted = await performAll(root, proper.execute);
+    return accepted.failed === null && accepted.adopted.size > 0;
+  })),
+  doneConnector('cloudflare.connector.push_dns_replace', 'A local DNS PUT stays a vendor PUT, addressed to the adopted record id, and omits the fields the replacement cleared', 'common', () => withRoot(async (call, root) => {
+    await seed(call);
+    const created = await call({ m: 'POST', p: `/zones/${ZONE}/dns_records`, b: {
+      type: 'A', name: 'replace.example.test', ttl: 60, content: '192.0.2.1', private_routing: true,
+    } });
+    const localID = String((created.body as Body).result?.id);
+    const vendorID = 'e'.repeat(32);
+    const first = vendor(() => ({ status: 200, body: { success: true, result: { id: vendorID } } }));
+    const after = await performAll(root, first.execute);
+    if (after.failed !== null || after.adopted.get(`dns_record:${localID}`) !== vendorID) return false;
+    await call({ m: 'PUT', p: `/zones/${ZONE}/dns_records/${localID}`, b: {
+      type: 'CAA', name: 'replace.example.test', ttl: 120, data: { flags: 0, tag: 'issue', value: 'pki.goog' },
+    } });
+    const second = vendor(() => ({ status: 200, body: { success: true, result: { id: vendorID } } }));
+    const replay = await performAll(root, second.execute, after.adopted, after.done);
+    const observed = second.seen.at(-1);
+    return replay.failed === null && observed?.method === 'PUT' && observed.path.endsWith(`/dns_records/${vendorID}`)
+      && observed.body?.type === 'CAA' && !Object.hasOwn(observed.body ?? {}, 'content')
+      && !Object.hasOwn(observed.body ?? {}, 'private_routing');
+  })),
+  doneConnector('cloudflare.connector.budget_weights', 'Budget weights reads at 2 and mutations at 3', 'core', () => cloudflareCallWeight('GET', '/zones') === 2 && cloudflareCallWeight('POST', '/zones/x/dns_records') === 3),
+  doneConnector('cloudflare.connector.budget_ceiling', 'Budget rejects calls above the conservative 60-unit minute', 'core', () => {
+    const root = mkdtempSync(join(tmpdir(), 'cloudflare-budget-cap-'));
+    try { const budget = new CloudflareBudget({ root, token: 'cap' }); budget.recordCall(CLOUDFLARE_BUDGET_CEILING); try { budget.checkBudget(1); return false; } catch (error) { return error instanceof CloudflareBudgetError; } }
+    finally { rmSync(root, { recursive: true, force: true }); }
+  }),
+];
+
+export const CLOUDFLARE_CAPABILITIES: CapabilitySpec[] = [...operationCapabilities, ...connectorCapabilities];
+
+export async function cloudflareCapabilities(): Promise<CapabilityReport> {
+  return checkCapabilities('cloudflare', CLOUDFLARE_CAPABILITIES);
+}