@volter/twin-cloudflare 0.1.0

package/src/cloudflare-common.ts

@@ -0,0 +1,183 @@
+// Shared Cloudflare twin plumbing: the API v4 envelope, kernel row projection/minting, and
+// request parsing helpers used by both the core slice (accounts/zones/tunnels/DNS in
+// cloudflare-twin.ts) and the provisioning slice (Workers/R2/Hyperdrive/Queues in
+// cloudflare-provisioning.ts). Pure helpers over the @volter/world-core kernel — no routes here.
+import { createHash } from 'node:crypto';
+import { applyTwinWrite, projectResources } from '@volter/world-core';
+
+export const SERVICE = 'cloudflare';
+
+export const CLOUDFLARE_RESOURCE_TYPES = [
+  'account',
+  'zone',
+  'cloudflare_tunnel',
+  'tunnel_configuration',
+  'dns_record',
+  'worker_script',
+  'worker_route',
+  'worker_domain',
+  'workers_subdomain',
+  'durable_object_namespace',
+  'r2_bucket',
+  'r2_object',
+  'r2_custom_domain',
+  'hyperdrive_config',
+  'queue',
+  'queue_consumer',
+  'worker_asset_upload_session',
+  'worker_asset',
+  'worker_version',
+  'account_member',
+  'zone_setting',
+  'user_token',
+  'audit_log',
+] as const;
+export type CloudflareResourceType = (typeof CLOUDFLARE_RESOURCE_TYPES)[number];
+
+export type CloudflareRequest = {
+  method: string;
+  path: string;
+  body?: string;
+  headers?: Record<string, string>;
+  occurredAt?: string;
+  root?: string;
+  readOnly?: boolean;
+};
+/** `raw: true` responses send `body` verbatim (or an empty body when null) with the given
+ *  content-type headers — used by Worker script download, which is not JSON-enveloped. */
+export type CloudflareResponse = { status: number; body: unknown; headers?: Record<string, string>; raw?: boolean };
+
+export type Row = Record<string, unknown> & { id: string; type: string };
+
+export function headers(input?: Record<string, string>): Record<string, string> {
+  return Object.fromEntries(Object.entries(input ?? {}).map(([key, value]) => [key.toLowerCase(), value]));
+}
+
+export function success(result: unknown, resultInfo?: Record<string, unknown>): CloudflareResponse {
+  return {
+    status: 200,
+    body: {
+      success: true,
+      errors: [],
+      messages: [],
+      result,
+      ...(resultInfo ? { result_info: resultInfo } : {}),
+    },
+  };
+}
+
+export function failure(status: number, code: number, message: string): CloudflareResponse {
+  return {
+    status,
+    body: { success: false, errors: [{ code, message }], messages: [], result: null },
+  };
+}
+
+export function parseBody(req: CloudflareRequest): Record<string, unknown> | CloudflareResponse {
+  try {
+    const value = req.body ? JSON.parse(req.body) : {};
+    if (!value || typeof value !== 'object' || Array.isArray(value)) return failure(400, 1004, 'Invalid request body');
+    return value as Record<string, unknown>;
+  } catch {
+    return failure(400, 1004, 'Invalid request body');
+  }
+}
+
+export function isResponse(value: unknown): value is CloudflareResponse {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+    && typeof (value as CloudflareResponse).status === 'number'
+    && 'body' in (value as Record<string, unknown>);
+}
+
+/** The rows of a type (protocol 2: a subject's id is the vendor's, with no type prefix, and a delete is the
+ *  kernel's tombstone `deleted: true` — which the subject's next write clears). */
+export function rows(type: CloudflareResourceType, root?: string, includeDeleted = false): Row[] {
+  return projectResources(SERVICE, root)
+    .filter((item) => item.type === type && (includeDeleted || (item as Row).deleted !== true))
+    .map((item) => ({ ...(item as Row) }));
+}
+
+export function row(type: CloudflareResourceType, id: string, root?: string, includeDeleted = false): Row | undefined {
+  return rows(type, root, includeDeleted).find((item) => item.id === id);
+}
+
+export function deterministicHex(label: string, length: number): string {
+  let out = '';
+  for (let i = 0; out.length < length; i++) out += createHash('sha256').update(`${label}:${i}`).digest('hex');
+  return out.slice(0, length);
+}
+
+export function uuidFrom(label: string): string {
+  const hex = deterministicHex(label, 32);
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-a${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+}
+
+/** Mint a fresh id for `type`, scanning the id-SET already in state (tombstones included) so
+ *  delete/recreate and pulled-vendor ids can never collide with a local mint. */
+export function mint(type: CloudflareResourceType, label: string, root?: string): string {
+  const taken = new Set(rows(type, root, true).map((item) => item.id));
+  for (let salt = 0; ; salt++) {
+    const id = type === 'cloudflare_tunnel' || type === 'worker_version' ? uuidFrom(`${label}:${salt}`) : deterministicHex(`${label}:${salt}`, 32);
+    if (!taken.has(id)) return id;
+  }
+}
+
+export async function write(
+  type: CloudflareResourceType,
+  id: string,
+  operation: string,
+  fields: Record<string, unknown>,
+  req: CloudflareRequest,
+): Promise<void> {
+  await applyTwinWrite(
+    SERVICE,
+    {
+      operation,
+      subjectType: type,
+      subjectId: id, // protocol 2: the subject's id is the vendor's, the type is the subject's own
+      fields,
+      ...(req.occurredAt ? { occurredAt: req.occurredAt } : {}),
+      actor: { kind: 'agent' },
+    },
+    req.root,
+  );
+}
+
+export function paginate<T>(items: T[], url: URL, defaultPerPage = 20, maxPerPage = 50): { result: T[]; info: Record<string, number> } {
+  const page = Math.max(1, Number(url.searchParams.get('page') ?? 1) || 1);
+  const perPage = Math.min(maxPerPage, Math.max(1, Number(url.searchParams.get('per_page') ?? defaultPerPage) || defaultPerPage));
+  const start = (page - 1) * perPage;
+  const result = items.slice(start, start + perPage);
+  return {
+    result,
+    info: { page, per_page: perPage, count: result.length, total_count: items.length, total_pages: Math.max(1, Math.ceil(items.length / perPage)) },
+  };
+}
+
+export function readOnly(req: CloudflareRequest): CloudflareResponse | null {
+  return req.readOnly ? failure(405, 1000, 'Method not allowed in read-only mode') : null;
+}
+
+export function scopeMissing(kind: 'account' | 'zone' | 'tunnel', id: string): CloudflareResponse {
+  return failure(404, 7003, `Could not route to /${kind}/${id}, perhaps your object identifier is invalid?`);
+}
+
+export function noRoute(): CloudflareResponse {
+  return failure(404, 7000, 'No route for that URI');
+}
+
+/** The user a request's API token belongs to (a token minted at POST /twin/users/{email}/tokens); empty for any other. */
+export function callerEmail(req: CloudflareRequest): string {
+  const bearer = /^Bearer\s+(\S+)$/i.exec(headers(req.headers).authorization ?? '')?.[1] ?? '';
+  return bearer ? String(rows('user_token', req.root).find((t) => t.token === bearer)?.email ?? '') : '';
+}
+
+/** One entry in an account's audit log, attributed to the calling token's user. */
+export async function audit(req: CloudflareRequest, accountID: string, entry: { type: string; resource: { type: string; id: string }; oldValue?: unknown; newValue?: unknown; metadata?: Record<string, unknown> }): Promise<void> {
+  const when = req.occurredAt ?? new Date().toISOString();
+  const id = deterministicHex(`audit:${accountID}:${when}:${entry.resource.type}:${entry.resource.id}:${rows('audit_log', req.root).length}`, 32);
+  const email = callerEmail(req);
+  await write('audit_log', id, 'audit_log.record', { account_id: accountID, when, action: { type: entry.type, result: true, info: '' },
+    actor: { email, id: email ? deterministicHex(`user:${email}`, 32) : '', ip: '', type: email ? 'user' : 'token' },
+    interface: 'API', resource: entry.resource, oldValue: entry.oldValue ?? null, newValue: entry.newValue ?? null, metadata: entry.metadata ?? {}, owner: { id: accountID } }, req);
+}

package/src/cloudflare-conformance.ts

@@ -0,0 +1,204 @@
+// Dev-only conformance probe. Expected paths are literal (not imported from the router),
+// and every claimed modeled endpoint is exercised against a fresh kernel root with a real
+// request asserting the outcome a live handler produces (status + body predicate).
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { CLOUDFLARE_ROUTER_SURFACE, handleCloudflareTwinRequest } from './cloudflare-twin.ts';
+
+export type CloudflareConformanceReport = { ok: boolean; endpointsChecked: number; violations: string[] };
+
+const EXPECTED = [
+  'POST /twin/bootstrap', 'GET /accounts', 'GET /accounts/{account_id}', 'GET /zones', 'GET /zones/{zone_id}',
+  'GET /accounts/{account_id}/cfd_tunnel', 'POST /accounts/{account_id}/cfd_tunnel',
+  'GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}', 'PATCH /accounts/{account_id}/cfd_tunnel/{tunnel_id}',
+  'DELETE /accounts/{account_id}/cfd_tunnel/{tunnel_id}', 'GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}/token',
+  'GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations', 'PUT /accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations',
+  'GET /zones/{zone_id}/dns_records', 'POST /zones/{zone_id}/dns_records', 'GET /zones/{zone_id}/dns_records/{dns_record_id}',
+  'PUT /zones/{zone_id}/dns_records/{dns_record_id}', 'PATCH /zones/{zone_id}/dns_records/{dns_record_id}',
+  'DELETE /zones/{zone_id}/dns_records/{dns_record_id}',
+  // Workers / R2 / Hyperdrive / Queues provisioning control plane.
+  'GET /accounts/{account_id}/workers/scripts',
+  'PUT /accounts/{account_id}/workers/scripts/{script_name}',
+  'GET /accounts/{account_id}/workers/scripts/{script_name}',
+  'DELETE /accounts/{account_id}/workers/scripts/{script_name}',
+  'GET /accounts/{account_id}/workers/scripts/{script_name}/schedules',
+  'PUT /accounts/{account_id}/workers/scripts/{script_name}/schedules',
+  'GET /accounts/{account_id}/workers/scripts/{script_name}/subdomain',
+  'POST /accounts/{account_id}/workers/scripts/{script_name}/subdomain',
+  'DELETE /accounts/{account_id}/workers/scripts/{script_name}/subdomain',
+  'GET /accounts/{account_id}/workers/subdomain',
+  'PUT /accounts/{account_id}/workers/subdomain',
+  'DELETE /accounts/{account_id}/workers/subdomain',
+  'GET /accounts/{account_id}/workers/domains',
+  'PUT /accounts/{account_id}/workers/domains',
+  'GET /accounts/{account_id}/workers/domains/{domain_id}',
+  'DELETE /accounts/{account_id}/workers/domains/{domain_id}',
+  'GET /accounts/{account_id}/workers/durable_objects/namespaces',
+  'GET /zones/{zone_id}/workers/routes',
+  'POST /zones/{zone_id}/workers/routes',
+  'GET /zones/{zone_id}/workers/routes/{route_id}',
+  'PUT /zones/{zone_id}/workers/routes/{route_id}',
+  'DELETE /zones/{zone_id}/workers/routes/{route_id}',
+  'GET /accounts/{account_id}/r2/buckets',
+  'POST /accounts/{account_id}/r2/buckets',
+  'GET /accounts/{account_id}/r2/buckets/{bucket_name}',
+  'DELETE /accounts/{account_id}/r2/buckets/{bucket_name}',
+  'GET /accounts/{account_id}/hyperdrive/configs',
+  'POST /accounts/{account_id}/hyperdrive/configs',
+  'GET /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}',
+  'PUT /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}',
+  'PATCH /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}',
+  'DELETE /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}',
+  'GET /accounts/{account_id}/queues',
+  'POST /accounts/{account_id}/queues',
+  'GET /accounts/{account_id}/queues/{queue_id}',
+  'DELETE /accounts/{account_id}/queues/{queue_id}',
+  'GET /accounts/{account_id}/queues/{queue_id}/consumers',
+  'POST /accounts/{account_id}/queues/{queue_id}/consumers',
+  'GET /accounts/{account_id}/queues/{queue_id}/consumers/{consumer_id}',
+  'PUT /accounts/{account_id}/queues/{queue_id}/consumers/{consumer_id}',
+  'DELETE /accounts/{account_id}/queues/{queue_id}/consumers/{consumer_id}',
+] as const;
+
+export async function checkCloudflareConformance(): Promise<CloudflareConformanceReport> {
+  const violations: string[] = [];
+  const actual = new Set(CLOUDFLARE_ROUTER_SURFACE);
+  for (const endpoint of EXPECTED) if (!actual.has(endpoint)) violations.push(`router missing literal claim ${endpoint}`);
+  for (const endpoint of actual) if (!(EXPECTED as readonly string[]).includes(endpoint)) violations.push(`router serves unclaimed surface ${endpoint}`);
+
+  const root = mkdtempSync(join(tmpdir(), 'cloudflare-conformance-'));
+  const account = 'a'.repeat(32);
+  const zone = 'b'.repeat(32);
+  let tick = 0;
+  const call = (method: string, path: string, body?: unknown, headers?: Record<string, string>) => handleCloudflareTwinRequest({
+    root, method, path,
+    headers: { authorization: 'Bearer conformance', ...(headers ?? {}) },
+    occurredAt: `2026-08-23T00:00:${String(tick++ % 60).padStart(2, '0')}.${String(Math.floor(tick / 60)).padStart(3, '0')}Z`,
+    ...(body !== undefined ? { body: typeof body === 'string' ? body : JSON.stringify(body) } : {}),
+  });
+  try {
+    const seeded = await call('POST', '/twin/bootstrap', { accounts: [{ id: account, name: 'A' }], zones: [{ id: zone, account_id: account, name: 'example.test' }] });
+    if (seeded.status !== 200 || (seeded.body as any).result.accounts !== 1) violations.push('bootstrap probe failed');
+    const accounts = await call('GET', '/accounts');
+    if (accounts.status !== 200 || (accounts.body as any).result[0]?.id !== account) violations.push('accounts list probe failed');
+    const accountGet = await call('GET', `/accounts/${account}`);
+    if ((accountGet.body as any).result?.name !== 'A') violations.push('account get probe failed');
+    const zones = await call('GET', '/zones');
+    if ((zones.body as any).result[0]?.id !== zone) violations.push('zones list probe failed');
+    const zoneGet = await call('GET', `/zones/${zone}`);
+    if ((zoneGet.body as any).result?.name !== 'example.test') violations.push('zone get probe failed');
+
+    const created = await call('POST', `/accounts/${account}/cfd_tunnel`, { name: 'conformance', config_src: 'cloudflare' });
+    const tunnelID = (created.body as any).result?.id as string;
+    if (created.status !== 200 || !tunnelID) violations.push('tunnel create probe failed');
+    const tunnelList = await call('GET', `/accounts/${account}/cfd_tunnel`);
+    if ((tunnelList.body as any).result[0]?.name !== 'conformance') violations.push('tunnel list probe failed');
+    if ((await call('GET', `/accounts/${account}/cfd_tunnel/${tunnelID}`)).status !== 200) violations.push('tunnel get probe failed');
+    if ((await call('PATCH', `/accounts/${account}/cfd_tunnel/${tunnelID}`, { name: 'renamed' })).body && (await call('GET', `/accounts/${account}/cfd_tunnel/${tunnelID}`)).body && ((await call('GET', `/accounts/${account}/cfd_tunnel/${tunnelID}`)).body as any).result?.name !== 'renamed') violations.push('tunnel edit probe failed');
+    if (typeof ((await call('GET', `/accounts/${account}/cfd_tunnel/${tunnelID}/token`)).body as any).result !== 'string') violations.push('tunnel token probe failed');
+    const config = await call('PUT', `/accounts/${account}/cfd_tunnel/${tunnelID}/configurations`, { config: { ingress: [{ hostname: 'app.example.test', service: 'http://127.0.0.1:8787' }] } });
+    if ((config.body as any).result?.version !== 1) violations.push('configuration put probe failed');
+    if ((await call('GET', `/accounts/${account}/cfd_tunnel/${tunnelID}/configurations`)).status !== 200) violations.push('configuration get probe failed');
+
+    const record = await call('POST', `/zones/${zone}/dns_records`, { type: 'CNAME', name: 'app.example.test', content: `${tunnelID}.cfargotunnel.com`, ttl: 1 });
+    const recordID = (record.body as any).result?.id as string;
+    if (!recordID) violations.push('DNS create probe failed');
+    if ((await call('GET', `/zones/${zone}/dns_records`)).body && ((await call('GET', `/zones/${zone}/dns_records`)).body as any).result[0]?.id !== recordID) violations.push('DNS list probe failed');
+    if ((await call('GET', `/zones/${zone}/dns_records/${recordID}`)).status !== 200) violations.push('DNS get probe failed');
+    if ((await call('PUT', `/zones/${zone}/dns_records/${recordID}`, { type: 'CNAME', name: 'app.example.test', content: 'put.cfargotunnel.com', ttl: 1 })).status !== 200) violations.push('DNS put probe failed');
+    if ((await call('PATCH', `/zones/${zone}/dns_records/${recordID}`, { content: 'patch.cfargotunnel.com' })).status !== 200) violations.push('DNS patch probe failed');
+    if ((await call('DELETE', `/zones/${zone}/dns_records/${recordID}`)).status !== 200) violations.push('DNS delete probe failed');
+    if ((await call('DELETE', `/accounts/${account}/cfd_tunnel/${tunnelID}`)).status !== 200) violations.push('tunnel delete probe failed');
+
+    // ── provisioning slice ──
+    const bucket = await call('POST', `/accounts/${account}/r2/buckets`, { name: 'conformance-bucket' });
+    if (bucket.status !== 200 || (bucket.body as any).result?.name !== 'conformance-bucket') violations.push('R2 create probe failed');
+    if (((await call('GET', `/accounts/${account}/r2/buckets`)).body as any).result?.buckets?.[0]?.name !== 'conformance-bucket') violations.push('R2 list probe failed');
+    if (((await call('GET', `/accounts/${account}/r2/buckets/conformance-bucket`)).body as any).result?.name !== 'conformance-bucket') violations.push('R2 get probe failed');
+
+    const hyperdrive = await call('POST', `/accounts/${account}/hyperdrive/configs`, {
+      name: 'conformance-hd',
+      origin: { scheme: 'postgres', database: 'app', user: 'u', password: 'p', host: 'db.example.test', port: 5432 },
+    });
+    const hyperdriveID = (hyperdrive.body as any).result?.id as string;
+    if (hyperdrive.status !== 200 || !hyperdriveID) violations.push('hyperdrive create probe failed');
+    if (((await call('GET', `/accounts/${account}/hyperdrive/configs`)).body as any).result?.[0]?.id !== hyperdriveID) violations.push('hyperdrive list probe failed');
+    if (((await call('GET', `/accounts/${account}/hyperdrive/configs/${hyperdriveID}`)).body as any).result?.name !== 'conformance-hd') violations.push('hyperdrive get probe failed');
+    if (((await call('PUT', `/accounts/${account}/hyperdrive/configs/${hyperdriveID}`, {
+      name: 'conformance-hd-2',
+      origin: { scheme: 'postgres', database: 'app', user: 'u', password: 'p', host: 'db2.example.test', port: 5432 },
+    })).body as any).result?.name !== 'conformance-hd-2') violations.push('hyperdrive put probe failed');
+    if (((await call('PATCH', `/accounts/${account}/hyperdrive/configs/${hyperdriveID}`, { name: 'conformance-hd-3' })).body as any).result?.name !== 'conformance-hd-3') violations.push('hyperdrive patch probe failed');
+
+    const queue = await call('POST', `/accounts/${account}/queues`, { queue_name: 'conformance-queue' });
+    const queueID = (queue.body as any).result?.queue_id as string;
+    if (queue.status !== 200 || !queueID) violations.push('queue create probe failed');
+    if (((await call('GET', `/accounts/${account}/queues`)).body as any).result?.[0]?.queue_id !== queueID) violations.push('queue list probe failed');
+    if (((await call('GET', `/accounts/${account}/queues/${queueID}`)).body as any).result?.queue_name !== 'conformance-queue') violations.push('queue get probe failed');
+
+    const metadata = {
+      main_module: 'worker.js',
+      compatibility_date: '2026-08-01',
+      bindings: [
+        { type: 'r2_bucket', name: 'BUCKET', bucket_name: 'conformance-bucket' },
+        { type: 'queue', name: 'QUEUE', queue_name: 'conformance-queue' },
+        { type: 'hyperdrive', name: 'HYPERDRIVE', id: hyperdriveID },
+        { type: 'durable_object_namespace', name: 'DO', class_name: 'Conformance' },
+      ],
+      migrations: { new_tag: 'v1', new_sqlite_classes: ['Conformance'] },
+    };
+    const boundary = 'conformance-boundary';
+    const upload = await call('PUT', `/accounts/${account}/workers/scripts/conformance-worker`,
+      `--${boundary}\r\nContent-Disposition: form-data; name="metadata"\r\nContent-Type: application/json\r\n\r\n${JSON.stringify(metadata)}\r\n--${boundary}\r\nContent-Disposition: form-data; name="files[]"; filename="worker.js"\r\nContent-Type: application/javascript+module\r\n\r\nexport default { fetch() { return new Response("ok"); } };\r\n--${boundary}--\r\n`,
+      { 'content-type': `multipart/form-data; boundary=${boundary}` });
+    if (upload.status !== 200 || (upload.body as any).result?.id !== 'conformance-worker') violations.push('worker upload probe failed');
+    if (((await call('GET', `/accounts/${account}/workers/scripts`)).body as any).result?.[0]?.id !== 'conformance-worker') violations.push('worker list probe failed');
+    const download = await call('GET', `/accounts/${account}/workers/scripts/conformance-worker`);
+    if (download.status !== 200 || typeof download.body !== 'string' || !download.body.includes('fetch()')) violations.push('worker download probe failed');
+    if (((await call('GET', `/accounts/${account}/workers/durable_objects/namespaces`)).body as any).result?.[0]?.class !== 'Conformance') violations.push('DO namespace list probe failed');
+
+    if (((await call('PUT', `/accounts/${account}/workers/scripts/conformance-worker/schedules`, [{ cron: '*/5 * * * *' }])).body as any).result?.schedules?.[0]?.cron !== '*/5 * * * *') violations.push('schedules put probe failed');
+    if (((await call('GET', `/accounts/${account}/workers/scripts/conformance-worker/schedules`)).body as any).result?.schedules?.length !== 1) violations.push('schedules get probe failed');
+
+    if (((await call('PUT', `/accounts/${account}/workers/subdomain`, { subdomain: 'conformance-team' })).body as any).result?.subdomain !== 'conformance-team') violations.push('account subdomain put probe failed');
+    if (((await call('GET', `/accounts/${account}/workers/subdomain`)).body as any).result?.subdomain !== 'conformance-team') violations.push('account subdomain get probe failed');
+    if (((await call('POST', `/accounts/${account}/workers/scripts/conformance-worker/subdomain`, { enabled: true, previews_enabled: true })).body as any).result?.enabled !== true) violations.push('script subdomain post probe failed');
+    if (((await call('GET', `/accounts/${account}/workers/scripts/conformance-worker/subdomain`)).body as any).result?.enabled !== true) violations.push('script subdomain get probe failed');
+    if (((await call('DELETE', `/accounts/${account}/workers/scripts/conformance-worker/subdomain`)).body as any).result?.enabled !== false) violations.push('script subdomain delete probe failed');
+
+    const route = await call('POST', `/zones/${zone}/workers/routes`, { pattern: 'example.test/api/*', script: 'conformance-worker' });
+    const routeID = (route.body as any).result?.id as string;
+    if (route.status !== 200 || !routeID) violations.push('route create probe failed');
+    if (((await call('GET', `/zones/${zone}/workers/routes`)).body as any).result?.[0]?.id !== routeID) violations.push('route list probe failed');
+    if (((await call('GET', `/zones/${zone}/workers/routes/${routeID}`)).body as any).result?.pattern !== 'example.test/api/*') violations.push('route get probe failed');
+    if (((await call('PUT', `/zones/${zone}/workers/routes/${routeID}`, { pattern: 'example.test/v2/*', script: 'conformance-worker' })).body as any).result?.pattern !== 'example.test/v2/*') violations.push('route put probe failed');
+
+    const domain = await call('PUT', `/accounts/${account}/workers/domains`, { hostname: 'api.example.test', service: 'conformance-worker' });
+    const domainID = (domain.body as any).result?.id as string;
+    if (domain.status !== 200 || (domain.body as any).result?.zone_id !== zone) violations.push('domain attach probe failed');
+    if (((await call('GET', `/accounts/${account}/workers/domains`)).body as any).result?.[0]?.id !== domainID) violations.push('domain list probe failed');
+    if (((await call('GET', `/accounts/${account}/workers/domains/${domainID}`)).body as any).result?.hostname !== 'api.example.test') violations.push('domain get probe failed');
+
+    const consumer = await call('POST', `/accounts/${account}/queues/${queueID}/consumers`, { type: 'worker', script_name: 'conformance-worker' });
+    const consumerID = (consumer.body as any).result?.consumer_id as string;
+    if (consumer.status !== 200 || !consumerID) violations.push('consumer create probe failed');
+    if (((await call('GET', `/accounts/${account}/queues/${queueID}/consumers`)).body as any).result?.[0]?.consumer_id !== consumerID) violations.push('consumer list probe failed');
+    if (((await call('GET', `/accounts/${account}/queues/${queueID}/consumers/${consumerID}`)).body as any).result?.type !== 'worker') violations.push('consumer get probe failed');
+    if (((await call('PUT', `/accounts/${account}/queues/${queueID}/consumers/${consumerID}`, { type: 'worker', script_name: 'conformance-worker', settings: { batch_size: 5 } })).body as any).result?.settings?.batch_size !== 5) violations.push('consumer put probe failed');
+    if ((await call('DELETE', `/accounts/${account}/queues/${queueID}/consumers/${consumerID}`)).status !== 200) violations.push('consumer delete probe failed');
+
+    // teardown probes (delete endpoints)
+    if ((await call('DELETE', `/accounts/${account}/workers/domains/${domainID}`)).status !== 200) violations.push('domain delete probe failed');
+    if ((await call('DELETE', `/zones/${zone}/workers/routes/${routeID}`)).status !== 200) violations.push('route delete probe failed');
+    if ((await call('DELETE', `/accounts/${account}/workers/subdomain`)).status !== 204) violations.push('account subdomain delete probe failed');
+    if ((await call('DELETE', `/accounts/${account}/workers/scripts/conformance-worker`)).status !== 400) violations.push('worker delete without force should be blocked by its Durable Object namespace');
+    if ((await call('DELETE', `/accounts/${account}/workers/scripts/conformance-worker?force=true`)).status !== 200) violations.push('worker force delete probe failed');
+    if ((await call('DELETE', `/accounts/${account}/queues/${queueID}`)).status !== 200) violations.push('queue delete probe failed');
+    if ((await call('DELETE', `/accounts/${account}/hyperdrive/configs/${hyperdriveID}`)).status !== 200) violations.push('hyperdrive delete probe failed');
+    if ((await call('DELETE', `/accounts/${account}/r2/buckets/conformance-bucket`)).status !== 200) violations.push('R2 delete probe failed');
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+  return { ok: violations.length === 0, endpointsChecked: EXPECTED.length, violations };
+}