@volter/twin-cloudflare 0.1.0

package/dist/src/cloudflare-capabilities.js

@@ -0,0 +1,1161 @@
+// Honest top-down Cloudflare denominator: exactly one capability per HTTP operation
+// in Cloudflare's first-party OpenAPI 4.0.0 document, plus an explicitly separate
+// connector surface. The operation census is
+// generated from cloudflare/api-schemas commit 2ac8369e9b63dccacee1a2284e95bb819f05b307.
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { checkCapabilities, verifyBoundary } from '@volter/world-tooling';
+import { applyTwinWrite, deployableEntries, projectResources } from '@volter/world-core';
+import { handleCloudflareTwinRequest } from "./cloudflare-twin.js";
+import { pullCloudflareState, performCloudflareAction, syncCloudflareFromReal, } from "./cloudflare-connector.js";
+import { CloudflareBudget, CloudflareBudgetError, CLOUDFLARE_BUDGET_CEILING, cloudflareCallWeight } from "./cloudflare-budget.js";
+import { CLOUDFLARE_OPENAPI_OPERATIONS } from "./cloudflare-openapi-operations.js";
+// Independent official SDK namespace census. It is not used as a denominator: the
+// finer and complete OpenAPI method+path inventory below is the one manifest granularity.
+export const CLOUDFLARE_OFFICIAL_AREAS = [
+    'abuse-reports', 'accounts', 'acm', 'addressing', 'ai', 'ai-audit', 'ai-gateway', 'ai-security', 'aisearch',
+    'alerting', 'analytics-query', 'api-gateway', 'argo', 'audit-logs', 'billing', 'bot-management', 'botnet-feed',
+    'brand-protection', 'browser-rendering', 'cache', 'calls', 'certificate-authorities', 'client-certificates',
+    'cloud-connector', 'cloudforce-one', 'connectivity', 'content-scanning', 'csam-scanner', 'custom-certificates',
+    'custom-csrs', 'custom-hostnames', 'custom-nameservers', 'custom-pages', 'd1', 'dcv-delegation', 'ddos-protection',
+    'diagnostics', 'dls', 'dns', 'dns-firewall', 'durable-objects', 'email-auth', 'email-routing', 'email-security',
+    'email-sending', 'filters', 'firewall', 'flagship', 'fraud', 'google-tag-gateway', 'healthchecks', 'hostnames',
+    'hyperdrive', 'iam', 'images', 'intel', 'ips', 'keyless-certificates', 'kv', 'leaked-credential-checks',
+    'load-balancers', 'logpush', 'logs', 'magic-cloud-networking', 'magic-network-monitoring', 'magic-transit',
+    'managed-transforms', 'memberships', 'moq', 'mtls-certificates', 'network-interconnects', 'organizations',
+    'origin-ca-certificates', 'origin-post-quantum-encryption', 'origin-tls-client-auth', 'origin-tls-compliance-modes',
+    'page-rules', 'page-shield', 'pages', 'pipelines', 'precursor', 'queues', 'r2', 'r2-data-catalog', 'radar',
+    'rate-limits', 'realtime-kit', 'registrar', 'registrar-sandbox', 'request-tracers', 'resource-sharing',
+    'resource-tagging', 'rules', 'rulesets', 'rum', 'schema-validation', 'secrets-store', 'security-center',
+    'security-txt', 'snippets', 'spectrum', 'speed', 'ssl', 'stream', 'tenant-custom-nameservers', 'tenants',
+    'token-validation', 'turnstile', 'url-normalization', 'url-scanner', 'user', 'vectorize', 'vulnerability-scanner',
+    'waiting-rooms', 'web3', 'workers', 'workers-for-platforms', 'workflows', 'zaraz', 'zero-trust', 'zones',
+];
+export const CLOUDFLARE_OPENAPI_AREAS = [...new Set(CLOUDFLARE_OPENAPI_OPERATIONS.map((operation) => operation.area))].sort();
+export const CLOUDFLARE_AREAS = [...new Set([...CLOUDFLARE_OPENAPI_AREAS, 'connector'])].sort();
+const AT = '2026-08-21T00:00:00.000Z';
+const ACCOUNT = 'a'.repeat(32);
+const ZONE = 'b'.repeat(32);
+const VENDOR_TUNNEL = '11111111-2222-4333-a444-555555555555';
+async function withRoot(fn) {
+    const root = mkdtempSync(join(tmpdir(), 'cloudflare-cap-'));
+    const call = (step) => handleCloudflareTwinRequest({
+        root,
+        method: step.m,
+        path: step.p,
+        occurredAt: AT,
+        headers: {
+            ...(step.auth === false ? {} : { authorization: `Bearer ${step.bearer ?? 'local-certification-token'}` }),
+            ...(step.ct ? { 'content-type': step.ct } : {}),
+        },
+        ...(step.raw !== undefined ? { body: step.raw } : step.b === undefined ? {} : { body: JSON.stringify(step.b) }),
+    });
+    try {
+        return await verifyBoundary('cloudflare.withRoot', () => fn(call, root));
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+}
+async function seed(call) {
+    await call({ m: 'POST', p: '/twin/bootstrap', b: {
+            accounts: [{ id: ACCOUNT, name: 'Acme' }],
+            zones: [{ id: ZONE, account_id: ACCOUNT, name: 'example.test' }],
+        } });
+}
+/** The head's loop, in miniature (protocol 2): perform each entry the twin appended through the connector,
+ *  remembering the vendor's id for the ones it minted so a later entry names the vendor's id, not ours. */
+async function performAll(root, execute, adopted = new Map(), done = new Set()) {
+    const ctx = { resolve: (type, id) => adopted.get(`${type}:${id}`) ?? id, service: 'cloudflare', root };
+    let performed = 0;
+    for (const entry of deployableEntries('cloudflare', root)) {
+        if (done.has(entry.id))
+            continue; // the head confirms what it performed; this harness remembers instead
+        try {
+            const outcome = await performCloudflareAction(execute, entry, ctx);
+            adopted.set(`${entry.subject.type}:${entry.subject.id}`, outcome.externalId);
+            done.add(entry.id);
+            performed += 1;
+        }
+        catch (error) {
+            return { performed, failed: error instanceof Error ? error.message : String(error), adopted, done };
+        }
+    }
+    return { performed, failed: null, adopted, done };
+}
+/** A vendor answering the API v4 envelope, as the kernel's executor hands it over: JSON in, JSON out. */
+function vendor(reply) {
+    const seen = [];
+    const execute = async (request) => {
+        const body = request.body ? JSON.parse(typeof request.body === 'string' ? request.body : new TextDecoder().decode(request.body)) : undefined;
+        const path = request.path.replace(/^\/client\/v4/, '');
+        seen.push({ method: request.method, path, ...(body ? { body } : {}) });
+        const answer = reply(request.method, path, body);
+        return { status: answer.status, headers: {}, body: JSON.stringify(answer.body) };
+    };
+    return { execute, seen };
+}
+async function tunnel(call, name = 'local-cert') {
+    const response = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/cfd_tunnel`, b: { name, config_src: 'cloudflare' } });
+    return String(response.body.result?.id ?? '');
+}
+/** Build the exact multipart body an unmodified SDK/wrangler-shaped deploy emits: a JSON
+ *  `metadata` part plus named module file parts. */
+function moduleUpload(metadata, files = { 'worker.js': 'export default { fetch() { return new Response("ok"); } };' }) {
+    const boundary = 'twin-cap-boundary';
+    const parts = [
+        `--${boundary}\r\nContent-Disposition: form-data; name="metadata"\r\nContent-Type: application/json\r\n\r\n${JSON.stringify(metadata)}\r\n`,
+        ...Object.entries(files).map(([name, content]) => `--${boundary}\r\nContent-Disposition: form-data; name="files[]"; filename="${name}"\r\nContent-Type: application/javascript+module\r\n\r\n${content}\r\n`),
+    ];
+    return { m: 'PUT', p: '', raw: `${parts.join('')}--${boundary}--\r\n`, ct: `multipart/form-data; boundary=${boundary}` };
+}
+async function deployWorker(call, name = 'cert-worker', metadata = { main_module: 'worker.js' }) {
+    const upload = moduleUpload(metadata);
+    return call({ ...upload, p: `/accounts/${ACCOUNT}/workers/scripts/${name}` });
+}
+async function seedQueue(call, name = 'cert-queue') {
+    const response = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues`, b: { queue_name: name } });
+    return String(response.body.result?.queue_id ?? '');
+}
+const HD_ORIGIN = { scheme: 'postgres', database: 'app', user: 'launch', password: 'secret-launch-pass', host: 'db.internal.test', port: 5432 };
+async function seedHyperdrive(call, name = 'cert-hd') {
+    const response = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/hyperdrive/configs`, b: { name, origin: HD_ORIGIN } });
+    return String(response.body.result?.id ?? '');
+}
+const operationVerifiers = new Map([
+    ['GET /accounts', () => withRoot(async (call) => {
+            await seed(call);
+            const denied = await call({ m: 'GET', p: '/accounts', auth: false });
+            const response = await call({ m: 'GET', p: '/accounts?name=Acme&per_page=1' });
+            return denied.status === 403 && denied.body.errors?.[0]?.code === 10000
+                && response.status === 200 && response.body.result?.[0]?.id === ACCOUNT
+                && response.body.result_info?.total_count === 1;
+        })],
+    ['GET /accounts/{account_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const response = await call({ m: 'GET', p: `/accounts/${ACCOUNT}` });
+            return response.status === 200 && response.body.result?.name === 'Acme';
+        })],
+    ['GET /zones', () => withRoot(async (call) => {
+            await seed(call);
+            const response = await call({ m: 'GET', p: `/zones?name=example.test&account.id=${ACCOUNT}` });
+            return response.status === 200 && response.body.result?.[0]?.account?.id === ACCOUNT;
+        })],
+    ['GET /zones/{zone_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const response = await call({ m: 'GET', p: `/zones/${ZONE}` });
+            return response.status === 200 && response.body.result?.name === 'example.test';
+        })],
+    ['POST /accounts/{account_id}/cfd_tunnel', () => withRoot(async (call) => {
+            await seed(call);
+            const invalid = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/cfd_tunnel`, b: { name: 'bad', tunnel_secret: 'not-base64' } });
+            const id = await tunnel(call);
+            return invalid.status === 400 && /^[0-9a-f-]{36}$/.test(id);
+        })],
+    ['GET /accounts/{account_id}/cfd_tunnel', () => withRoot(async (call) => {
+            await seed(call);
+            const first = await tunnel(call, 'first');
+            await tunnel(call, 'second');
+            await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/cfd_tunnel/${first}` });
+            const all = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/cfd_tunnel` });
+            const active = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/cfd_tunnel?is_deleted=false` });
+            const deleted = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/cfd_tunnel?is_deleted=true` });
+            return all.body.result?.length === 2 && active.body.result?.length === 1
+                && deleted.body.result?.[0]?.deleted_at !== null;
+        })],
+    ['GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const id = await tunnel(call);
+            const response = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/cfd_tunnel/${id}` });
+            return response.status === 200 && response.body.result?.id === id;
+        })],
+    ['PATCH /accounts/{account_id}/cfd_tunnel/{tunnel_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const first = await tunnel(call, 'first');
+            await tunnel(call, 'second');
+            const conflict = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/cfd_tunnel/${first}`, b: { name: 'second' } });
+            const invalid = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/cfd_tunnel/${first}`, b: { tunnel_secret: 'not-base64' } });
+            const validSecret = Buffer.alloc(32, 7).toString('base64');
+            const edited = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/cfd_tunnel/${first}`, b: { name: 'renamed', tunnel_secret: validSecret } });
+            return conflict.status === 409 && invalid.status === 400 && edited.body.result?.name === 'renamed';
+        })],
+    ['DELETE /accounts/{account_id}/cfd_tunnel/{tunnel_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const id = await tunnel(call);
+            const response = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/cfd_tunnel/${id}` });
+            return response.status === 200 && response.body.result?.id === id
+                && typeof response.body.result?.deleted_at === 'string'
+                && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/cfd_tunnel/${id}` })).status === 404;
+        })],
+    ['PUT /accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations', () => withRoot(async (call) => {
+            await seed(call);
+            const id = await tunnel(call);
+            const response = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/cfd_tunnel/${id}/configurations`, b: { config: { ingress: [{ hostname: '*', service: 'http_status:404' }] } } });
+            return response.status === 200 && response.body.result?.tunnel_id === id && response.body.result?.version === 1;
+        })],
+    ['GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations', () => withRoot(async (call) => {
+            await seed(call);
+            const id = await tunnel(call);
+            await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/cfd_tunnel/${id}/configurations`, b: { config: { ingress: [{ hostname: '*', service: 'http_status:404' }] } } });
+            const response = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/cfd_tunnel/${id}/configurations` });
+            return response.status === 200 && response.body.result?.config?.ingress?.[0]?.service === 'http_status:404';
+        })],
+    ['GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}/token', () => withRoot(async (call) => {
+            await seed(call);
+            const id = await tunnel(call);
+            const first = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/cfd_tunnel/${id}/token` });
+            const second = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/cfd_tunnel/${id}/token` });
+            return typeof first.body.result === 'string' && first.body.result === second.body.result;
+        })],
+    ['POST /zones/{zone_id}/dns_records', () => withRoot(async (call) => {
+            await seed(call);
+            const caa = await call({ m: 'POST', p: `/zones/${ZONE}/dns_records`, b: {
+                    type: 'CAA', name: 'example.test', ttl: 60, data: { flags: 0, tag: 'issue', value: 'letsencrypt.org' },
+                } });
+            return caa.status === 200 && caa.body.result?.type === 'CAA'
+                && caa.body.result?.data?.value === 'letsencrypt.org'
+                && !Object.hasOwn(caa.body.result, 'content');
+        })],
+    ['GET /zones/{zone_id}/dns_records', () => withRoot(async (call) => {
+            await seed(call);
+            await call({ m: 'POST', p: `/zones/${ZONE}/dns_records`, b: { type: 'CNAME', name: 'app.example.test', content: 'target.example.test', ttl: 1 } });
+            const response = await call({ m: 'GET', p: `/zones/${ZONE}/dns_records?type=CNAME&name=app.example.test` });
+            return response.status === 200 && response.body.result?.length === 1;
+        })],
+    ['GET /zones/{zone_id}/dns_records/{dns_record_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const created = await call({ m: 'POST', p: `/zones/${ZONE}/dns_records`, b: { type: 'A', name: 'a.example.test', content: '192.0.2.1', ttl: 60 } });
+            return (await call({ m: 'GET', p: `/zones/${ZONE}/dns_records/${created.body.result.id}` })).status === 200;
+        })],
+    ['PUT /zones/{zone_id}/dns_records/{dns_record_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const created = await call({ m: 'POST', p: `/zones/${ZONE}/dns_records`, b: { type: 'A', name: 'a.example.test', content: '192.0.2.1', ttl: 60, comment: 'old', tags: ['owner:test'], settings: { ipv4_only: true } } });
+            const id = created.body.result.id;
+            const partial = await call({ m: 'PUT', p: `/zones/${ZONE}/dns_records/${id}`, b: { content: '192.0.2.2' } });
+            const replaced = await call({ m: 'PUT', p: `/zones/${ZONE}/dns_records/${id}`, b: { type: 'CAA', name: 'example.test', ttl: 120, data: { flags: 0, tag: 'issue', value: 'pki.goog' } } });
+            const value = replaced.body.result;
+            return partial.status === 400 && replaced.status === 200 && value.type === 'CAA' && value.data?.value === 'pki.goog'
+                && !Object.hasOwn(value, 'content') && value.comment === null && value.tags?.length === 0
+                && Object.keys(value.settings ?? {}).length === 0;
+        })],
+    ['PATCH /zones/{zone_id}/dns_records/{dns_record_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const created = await call({ m: 'POST', p: `/zones/${ZONE}/dns_records`, b: { type: 'TXT', name: 'txt.example.test', content: 'one', ttl: 60, comment: 'keep', tags: ['owner:test'] } });
+            const response = await call({ m: 'PATCH', p: `/zones/${ZONE}/dns_records/${created.body.result.id}`, b: { content: 'two' } });
+            const value = response.body.result;
+            return response.status === 200 && value.content === 'two' && value.name === 'txt.example.test' && value.comment === 'keep' && value.tags?.[0] === 'owner:test';
+        })],
+    ['DELETE /zones/{zone_id}/dns_records/{dns_record_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const created = await call({ m: 'POST', p: `/zones/${ZONE}/dns_records`, b: { type: 'TXT', name: 'txt.example.test', content: 'one', ttl: 60 } });
+            const id = created.body.result.id;
+            return (await call({ m: 'DELETE', p: `/zones/${ZONE}/dns_records/${id}` })).status === 200
+                && (await call({ m: 'GET', p: `/zones/${ZONE}/dns_records/${id}` })).status === 404;
+        })],
+]);
+// Workers / R2 / Hyperdrive / Queues provisioning verifiers. Every verify starts from a
+// fresh root, seeds through the twin's own write path, asserts response VALUES, and drives
+// the negative 4xx path its operation implies. Merged into operationVerifiers below.
+const provisioningVerifiers = new Map([
+    ['GET /accounts/{account_id}/workers/scripts', () => withRoot(async (call) => {
+            await seed(call);
+            const uploaded = await deployWorker(call, 'list-me', { main_module: 'worker.js', compatibility_date: '2026-08-01', tags: ['launch'] });
+            // A service binding to a Worker that does not exist must be rejected, and the rejected
+            // upload must not appear in the list (round-two N4).
+            const svcGhost = await deployWorker(call, 'svc-ghost', { main_module: 'worker.js', bindings: [{ type: 'service', name: 'SVC', service: 'never-uploaded' }] });
+            const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts` });
+            const item = listed.body.result?.[0];
+            return uploaded.status === 200 && svcGhost.status === 400 && listed.status === 200
+                && item?.id === 'list-me' && item?.etag === uploaded.body.result?.etag
+                && item?.compatibility_date === '2026-08-01' && item?.tags?.[0] === 'launch'
+                && listed.body.result_info?.total_count === 1;
+        })],
+    ['GET /accounts/{account_id}/workers/scripts/{script_name}', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call, 'download-me', { main_module: 'worker.js' });
+            const download = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/download-me` });
+            const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/never-uploaded` });
+            // A single-module module-syntax Worker still downloads as multipart/form-data (not raw JS).
+            return download.status === 200 && download.raw === true
+                && (download.headers?.['content-type'] ?? '').includes('multipart/form-data')
+                && String(download.body).includes('return new Response("ok")')
+                && missing.status === 404 && missing.body.errors?.[0]?.code === 10007;
+        })],
+    ['DELETE /accounts/{account_id}/workers/scripts/{script_name}', () => withRoot(async (call) => {
+            await seed(call);
+            // Dirty-state cell: upload with a DO class AND distinctive metadata, prove no-force delete
+            // is BLOCKED by the namespace (the pinned OpenAPI force contract), force-delete, then
+            // recreate the same name with BARE metadata and assert none of the deleted script's fields
+            // resurrect through the kernel tombstone merge (finding-3).
+            await deployWorker(call, 'delete-me', {
+                main_module: 'worker.js', usage_model: 'unbound', logpush: true, tags: ['old-tag'],
+                compatibility_date: '2026-01-01', migrations: { new_tag: 'v9', new_classes: ['Session'] },
+            });
+            const blocked = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/workers/scripts/delete-me` });
+            const forced = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/workers/scripts/delete-me?force=true` });
+            const gone = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/delete-me` });
+            const namespaces = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/durable_objects/namespaces` });
+            const recreated = await deployWorker(call, 'delete-me', { main_module: 'worker.js' });
+            const fresh = recreated.body.result;
+            return blocked.status === 400 && forced.status === 200 && forced.body.result === null
+                && gone.status === 404
+                && namespaces.body.result?.length === 0
+                && recreated.status === 200 && fresh?.id === 'delete-me'
+                && fresh?.usage_model === 'standard' && fresh?.logpush === false
+                && !Object.hasOwn(fresh ?? {}, 'compatibility_date') && (fresh?.tags?.length ?? 0) === 0
+                && !Object.hasOwn(fresh ?? {}, 'migration_tag')
+                && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/delete-me` })).status === 200;
+        })],
+    ['GET /accounts/{account_id}/workers/scripts/{script_name}/schedules', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/schedules`, b: [{ cron: '*/30 * * * *' }] });
+            const response = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/schedules` });
+            const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/never-uploaded/schedules` });
+            return response.status === 200 && response.body.result?.schedules?.[0]?.cron === '*/30 * * * *'
+                && typeof response.body.result?.schedules?.[0]?.created_on === 'string'
+                && missing.status === 404;
+        })],
+    ['PUT /accounts/{account_id}/workers/scripts/{script_name}/schedules', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            const invalid = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/schedules`, b: [{ cron: 'not a cron' }] });
+            // Garbage that happens to have 5 whitespace tokens must still be rejected field-by-field.
+            const garbageFields = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/schedules`, b: [{ cron: 'zz zz zz zz zz' }] });
+            const outOfRange = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/schedules`, b: [{ cron: '99 * * * *' }] });
+            const replaced = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/schedules`, b: [{ cron: '0 3 * * MON' }, { cron: '*/5 9-17 * jan-mar 1,3,5' }] });
+            const emptied = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/schedules`, b: [] });
+            return invalid.status === 400 && garbageFields.status === 400 && outOfRange.status === 400 && replaced.status === 200
+                && replaced.body.result?.schedules?.map((item) => item.cron).join(',') === '0 3 * * MON,*/5 9-17 * jan-mar 1,3,5'
+                && emptied.status === 200 && emptied.body.result?.schedules?.length === 0;
+        })],
+    ['GET /accounts/{account_id}/workers/scripts/{script_name}/subdomain', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            const before = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/subdomain` });
+            await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/subdomain`, b: { enabled: true, previews_enabled: true } });
+            const after = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/subdomain` });
+            return before.body.result?.enabled === false && after.status === 200
+                && after.body.result?.enabled === true && after.body.result?.previews_enabled === true;
+        })],
+    ['POST /accounts/{account_id}/workers/scripts/{script_name}/subdomain', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            const invalid = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/subdomain`, b: {} });
+            const enabled = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/subdomain`, b: { enabled: true } });
+            return invalid.status === 400 && enabled.status === 200 && enabled.body.result?.enabled === true;
+        })],
+    ['DELETE /accounts/{account_id}/workers/scripts/{script_name}/subdomain', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/subdomain`, b: { enabled: true, previews_enabled: true } });
+            const disabled = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/subdomain` });
+            const after = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/subdomain` });
+            return disabled.status === 200 && disabled.body.result?.enabled === false
+                && after.body.result?.previews_enabled === false;
+        })],
+    ['GET /accounts/{account_id}/workers/subdomain', () => withRoot(async (call) => {
+            await seed(call);
+            const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/subdomain` });
+            await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/subdomain`, b: { subdomain: 'launch-team' } });
+            const after = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/subdomain` });
+            return missing.status === 404 && after.status === 200 && after.body.result?.subdomain === 'launch-team';
+        })],
+    ['PUT /accounts/{account_id}/workers/subdomain', () => withRoot(async (call) => {
+            await seed(call);
+            const invalid = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/subdomain`, b: {} });
+            const badLabel = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/subdomain`, b: { subdomain: 'not a label!' } });
+            const created = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/subdomain`, b: { subdomain: 'Launch-Team' } });
+            return invalid.status === 400 && badLabel.status === 400
+                && created.status === 200 && created.body.result?.subdomain === 'launch-team';
+        })],
+    ['DELETE /accounts/{account_id}/workers/subdomain', () => withRoot(async (call) => {
+            await seed(call);
+            await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/subdomain`, b: { subdomain: 'launch-team' } });
+            const deleted = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/workers/subdomain` });
+            const after = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/subdomain` });
+            // 204 with no body per the pinned OpenAPI; a later PUT can re-create over the tombstone.
+            const recreated = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/subdomain`, b: { subdomain: 'launch-team' } });
+            return deleted.status === 204 && after.status === 404
+                && recreated.status === 200 && recreated.body.result?.subdomain === 'launch-team';
+        })],
+    ['GET /accounts/{account_id}/workers/domains', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/domains`, b: { hostname: 'api.example.test', service: 'cert-worker' } });
+            const all = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/domains` });
+            const filtered = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/domains?hostname=api.example.test` });
+            const none = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/domains?hostname=other.example.test` });
+            // The documented `environment` filter is honored: production matches, anything else empties.
+            const prod = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/domains?environment=production` });
+            const staging = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/domains?environment=staging` });
+            return all.status === 200 && all.body.result?.[0]?.service === 'cert-worker'
+                && filtered.body.result?.length === 1 && none.body.result?.length === 0
+                && prod.body.result?.length === 1 && staging.body.result?.length === 0;
+        })],
+    ['PUT /accounts/{account_id}/workers/domains', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            const outside = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/domains`, b: { hostname: 'api.unrelated.test', service: 'cert-worker' } });
+            const noWorker = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/domains`, b: { hostname: 'api.example.test', service: 'never-uploaded' } });
+            const badZoneName = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/domains`, b: { hostname: 'api.example.test', service: 'cert-worker', zone_name: 'wrong.test' } });
+            const attached = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/domains`, b: { hostname: 'API.example.test', service: 'cert-worker' } });
+            const value = attached.body.result;
+            return outside.status === 400 && noWorker.status === 400 && badZoneName.status === 400 && attached.status === 200
+                && value?.hostname === 'api.example.test' && value?.zone_id === ZONE && value?.zone_name === 'example.test'
+                && typeof value?.cert_id === 'string' && value.cert_id.length > 0;
+        })],
+    ['GET /accounts/{account_id}/workers/domains/{domain_id}', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            const attached = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/domains`, b: { hostname: 'api.example.test', service: 'cert-worker' } });
+            const id = attached.body.result?.id;
+            const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/domains/${id}` });
+            const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/domains/${'f'.repeat(32)}` });
+            return fetched.status === 200 && fetched.body.result?.id === id && missing.status === 404;
+        })],
+    ['DELETE /accounts/{account_id}/workers/domains/{domain_id}', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            const attached = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/workers/domains`, b: { hostname: 'api.example.test', service: 'cert-worker' } });
+            const id = attached.body.result?.id;
+            const detached = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/workers/domains/${id}` });
+            // Pinned workers_api-response-common envelope: no `result` member.
+            return detached.status === 200 && detached.body.success === true
+                && !Object.hasOwn(detached.body, 'result')
+                && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/domains/${id}` })).status === 404;
+        })],
+    ['GET /accounts/{account_id}/workers/durable_objects/namespaces', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call, 'do-worker', { main_module: 'worker.js', migrations: { new_tag: 'v1', new_sqlite_classes: ['Session'], new_classes: ['Legacy'] } });
+            // A REJECTED upload (a DO binding referencing a class the migration does not create) must
+            // leave NO orphan namespace and no script — migrations are planned, not applied, until all
+            // validation passes (round-two N5).
+            const rejected = await deployWorker(call, 'ghost-worker', {
+                main_module: 'worker.js',
+                bindings: [{ type: 'durable_object_namespace', name: 'DO', class_name: 'Missing' }],
+                migrations: { new_tag: 'v1', new_sqlite_classes: ['Present'] },
+            });
+            const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/durable_objects/namespaces` });
+            const classes = (listed.body.result ?? []).map((item) => `${item.class}:${item.use_sqlite}:${item.script}`).sort();
+            return rejected.status === 400
+                && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/ghost-worker` })).status === 404
+                && listed.status === 200 && classes.join(',') === 'Legacy:false:do-worker,Session:true:do-worker'
+                && listed.body.result_info?.total_count === 2;
+        })],
+    ['GET /zones/{zone_id}/workers/routes', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            await call({ m: 'POST', p: `/zones/${ZONE}/workers/routes`, b: { pattern: 'example.test/api/*', script: 'cert-worker' } });
+            const listed = await call({ m: 'GET', p: `/zones/${ZONE}/workers/routes` });
+            const badZone = await call({ m: 'GET', p: `/zones/${'9'.repeat(32)}/workers/routes` });
+            return listed.status === 200 && listed.body.result?.[0]?.pattern === 'example.test/api/*'
+                && listed.body.result?.[0]?.script === 'cert-worker' && badZone.status === 404;
+        })],
+    ['POST /zones/{zone_id}/workers/routes', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            const invalid = await call({ m: 'POST', p: `/zones/${ZONE}/workers/routes`, b: {} });
+            // A route naming a script that is not a Worker on the zone's account must 400 (finding-5).
+            const ghostScript = await call({ m: 'POST', p: `/zones/${ZONE}/workers/routes`, b: { pattern: 'example.test/ghost/*', script: 'never-uploaded' } });
+            const created = await call({ m: 'POST', p: `/zones/${ZONE}/workers/routes`, b: { pattern: 'example.test/api/*', script: 'cert-worker' } });
+            const duplicate = await call({ m: 'POST', p: `/zones/${ZONE}/workers/routes`, b: { pattern: 'example.test/api/*' } });
+            return invalid.status === 400 && ghostScript.status === 400 && ghostScript.body.errors?.[0]?.code === 10007
+                && created.status === 200
+                && /^[0-9a-f]{32}$/.test(String(created.body.result?.id)) && duplicate.status === 409;
+        })],
+    ['GET /zones/{zone_id}/workers/routes/{route_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const created = await call({ m: 'POST', p: `/zones/${ZONE}/workers/routes`, b: { pattern: 'example.test/*' } });
+            const id = created.body.result?.id;
+            const fetched = await call({ m: 'GET', p: `/zones/${ZONE}/workers/routes/${id}` });
+            const missing = await call({ m: 'GET', p: `/zones/${ZONE}/workers/routes/${'f'.repeat(32)}` });
+            return fetched.status === 200 && fetched.body.result?.pattern === 'example.test/*'
+                && !Object.hasOwn(fetched.body.result ?? {}, 'script') && missing.status === 404;
+        })],
+    ['PUT /zones/{zone_id}/workers/routes/{route_id}', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            const created = await call({ m: 'POST', p: `/zones/${ZONE}/workers/routes`, b: { pattern: 'example.test/api/*', script: 'cert-worker' } });
+            const id = created.body.result?.id;
+            const invalid = await call({ m: 'PUT', p: `/zones/${ZONE}/workers/routes/${id}`, b: {} });
+            const ghostScript = await call({ m: 'PUT', p: `/zones/${ZONE}/workers/routes/${id}`, b: { pattern: 'example.test/v2/*', script: 'never-uploaded' } });
+            const updated = await call({ m: 'PUT', p: `/zones/${ZONE}/workers/routes/${id}`, b: { pattern: 'example.test/v2/*', script: 'cert-worker' } });
+            return invalid.status === 400 && ghostScript.status === 400 && ghostScript.body.errors?.[0]?.code === 10007
+                && updated.status === 200 && updated.body.result?.pattern === 'example.test/v2/*';
+        })],
+    ['DELETE /zones/{zone_id}/workers/routes/{route_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const created = await call({ m: 'POST', p: `/zones/${ZONE}/workers/routes`, b: { pattern: 'example.test/*' } });
+            const id = created.body.result?.id;
+            const deleted = await call({ m: 'DELETE', p: `/zones/${ZONE}/workers/routes/${id}` });
+            return deleted.status === 200 && deleted.body.result?.id === id
+                && (await call({ m: 'GET', p: `/zones/${ZONE}/workers/routes/${id}` })).status === 404;
+        })],
+    ['GET /accounts/{account_id}/r2/buckets', () => withRoot(async (call) => {
+            await seed(call);
+            await call({ m: 'POST', p: `/accounts/${ACCOUNT}/r2/buckets`, b: { name: 'launch-artifacts' } });
+            await call({ m: 'POST', p: `/accounts/${ACCOUNT}/r2/buckets`, b: { name: 'launch-logs' } });
+            const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/r2/buckets` });
+            const filtered = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/r2/buckets?name_contains=logs` });
+            const after = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/r2/buckets?start_after=launch-artifacts` });
+            return listed.status === 200
+                && listed.body.result?.buckets?.map((item) => item.name).join(',') === 'launch-artifacts,launch-logs'
+                && filtered.body.result?.buckets?.length === 1
+                && after.body.result?.buckets?.[0]?.name === 'launch-logs';
+        })],
+    ['POST /accounts/{account_id}/r2/buckets', () => withRoot(async (call) => {
+            await seed(call);
+            const invalid = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/r2/buckets`, b: { name: 'UPPER_CASE' } });
+            const created = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/r2/buckets`, b: { name: 'launch-artifacts', locationHint: 'wnam', storageClass: 'Standard' } });
+            const duplicate = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/r2/buckets`, b: { name: 'launch-artifacts' } });
+            const value = created.body.result;
+            return invalid.status === 400 && created.status === 200
+                && value?.name === 'launch-artifacts' && value?.location === 'wnam' && value?.storage_class === 'Standard'
+                && typeof value?.creation_date === 'string'
+                && duplicate.status === 409 && duplicate.body.errors?.[0]?.code === 10004;
+        })],
+    ['GET /accounts/{account_id}/r2/buckets/{bucket_name}', () => withRoot(async (call) => {
+            await seed(call);
+            await call({ m: 'POST', p: `/accounts/${ACCOUNT}/r2/buckets`, b: { name: 'launch-artifacts' } });
+            const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/r2/buckets/launch-artifacts` });
+            const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/r2/buckets/never-created` });
+            return fetched.status === 200 && fetched.body.result?.name === 'launch-artifacts'
+                && missing.status === 404 && missing.body.errors?.[0]?.code === 10006;
+        })],
+    ['DELETE /accounts/{account_id}/r2/buckets/{bucket_name}', () => withRoot(async (call) => {
+            await seed(call);
+            // Dirty-state cell: create → delete → recreate the same bucket name must yield a live bucket.
+            await call({ m: 'POST', p: `/accounts/${ACCOUNT}/r2/buckets`, b: { name: 'launch-artifacts' } });
+            const deleted = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/r2/buckets/launch-artifacts` });
+            const gone = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/r2/buckets/launch-artifacts` });
+            const recreated = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/r2/buckets`, b: { name: 'launch-artifacts' } });
+            const alive = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/r2/buckets/launch-artifacts` });
+            // Pinned r2_v4_response REQUIRES a `result` member (unlike the queue delete envelope).
+            return deleted.status === 200 && Object.hasOwn(deleted.body, 'result')
+                && gone.status === 404 && recreated.status === 200
+                && alive.status === 200 && alive.body.result?.name === 'launch-artifacts';
+        })],
+    ['GET /accounts/{account_id}/hyperdrive/configs', () => withRoot(async (call) => {
+            await seed(call);
+            const id = await seedHyperdrive(call);
+            const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/hyperdrive/configs` });
+            const value = listed.body.result?.[0];
+            return listed.status === 200 && value?.id === id && value?.origin?.host === 'db.internal.test'
+                && !Object.hasOwn(value?.origin ?? {}, 'password')
+                && listed.body.result_info?.total_count === 1;
+        })],
+    ['POST /accounts/{account_id}/hyperdrive/configs', () => withRoot(async (call) => {
+            await seed(call);
+            const invalid = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/hyperdrive/configs`, b: { name: 'bad', origin: { scheme: 'postgres', database: 'app', user: 'u', password: 'p', host: 'db.test' } } });
+            const created = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/hyperdrive/configs`, b: { name: 'cert-hd', origin: HD_ORIGIN, caching: { disabled: false }, origin_connection_limit: 25 } });
+            const value = created.body.result;
+            // The origin connection is recorded as configuration — the password is writeOnly in the
+            // vendor schema and must never be echoed; the origin is never dialed.
+            return invalid.status === 400 && created.status === 200
+                && /^[0-9a-f]{32}$/.test(String(value?.id)) && value?.origin?.port === 5432
+                && !Object.hasOwn(value?.origin ?? {}, 'password')
+                && value?.caching?.disabled === false && value?.origin_connection_limit === 25;
+        })],
+    ['GET /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const id = await seedHyperdrive(call);
+            const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}` });
+            const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${'f'.repeat(32)}` });
+            return fetched.status === 200 && fetched.body.result?.name === 'cert-hd' && missing.status === 404;
+        })],
+    ['PUT /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const id = await seedHyperdrive(call);
+            const invalid = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}`, b: { name: 'renamed' } });
+            const replaced = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}`, b: { name: 'renamed', origin: { ...HD_ORIGIN, host: 'db2.internal.test' } } });
+            const value = replaced.body.result;
+            return invalid.status === 400 && replaced.status === 200
+                && value?.name === 'renamed' && value?.origin?.host === 'db2.internal.test'
+                && !Object.hasOwn(value ?? {}, 'caching');
+        })],
+    ['PATCH /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const id = await seedHyperdrive(call);
+            const patched = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}`, b: { caching: { disabled: true } } });
+            const value = patched.body.result;
+            // The vendor's edit-origin is a TYPED PARTIAL: a {host,port}-only PATCH must be accepted and
+            // MERGED over the existing origin (scheme/database/user preserved), not rejected (finding-4).
+            const partialOrigin = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}`, b: { origin: { host: 'db2.internal.test', port: 5433 } } });
+            const merged = partialOrigin.body.result?.origin;
+            // An unmodeled caching key must still be rejected, not recorded-and-echoed.
+            const badCaching = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}`, b: { caching: { bogus: 1 } } });
+            const badOrigin = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}`, b: { origin: { scheme: 'oracle' } } });
+            // A partial PATCH must not merge into an INCOHERENT origin the create path could never make:
+            // adding a `port` to an Access origin is rejected (round-two N1).
+            const access = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/hyperdrive/configs`, b: {
+                    name: 'access-hd',
+                    origin: { scheme: 'postgres', database: 'app', user: 'u', password: 'p', access_client_id: 'cid', access_client_secret: 'csec', host: 'access.test' },
+                } });
+            const accessID = access.body.result?.id;
+            const incoherent = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${accessID}`, b: { origin: { port: 5432 } } });
+            return patched.status === 200 && value?.name === 'cert-hd' && value?.caching?.disabled === true
+                && value?.origin?.host === 'db.internal.test'
+                && partialOrigin.status === 200 && merged?.host === 'db2.internal.test' && merged?.port === 5433
+                && merged?.scheme === 'postgres' && merged?.database === 'app'
+                && badCaching.status === 400 && badOrigin.status === 400
+                && access.status === 200 && incoherent.status === 400;
+        })],
+    ['DELETE /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const id = await seedHyperdrive(call);
+            const deleted = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}` });
+            return deleted.status === 200 && deleted.body.result === null
+                && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/hyperdrive/configs/${id}` })).status === 404;
+        })],
+    ['GET /accounts/{account_id}/queues', () => withRoot(async (call) => {
+            await seed(call);
+            const id = await seedQueue(call);
+            await deployWorker(call, 'producer-worker', { main_module: 'worker.js', bindings: [{ type: 'queue', name: 'Q', queue_name: 'cert-queue' }] });
+            const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues` });
+            const value = listed.body.result?.[0];
+            // Producer bindings recorded on a Worker upload surface as the queue's producers.
+            return listed.status === 200 && value?.queue_id === id && value?.queue_name === 'cert-queue'
+                && value?.producers?.[0]?.script === 'producer-worker' && value?.producers_total_count === 1;
+        })],
+    ['POST /accounts/{account_id}/queues', () => withRoot(async (call) => {
+            await seed(call);
+            const invalid = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues`, b: {} });
+            const created = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues`, b: { queue_name: 'cert-queue' } });
+            const duplicate = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues`, b: { queue_name: 'cert-queue' } });
+            const value = created.body.result;
+            return invalid.status === 400 && created.status === 200
+                && /^[0-9a-f]{32}$/.test(String(value?.queue_id)) && value?.queue_name === 'cert-queue'
+                && value?.consumers_total_count === 0 && duplicate.status === 400;
+        })],
+    ['GET /accounts/{account_id}/queues/{queue_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const id = await seedQueue(call);
+            const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${id}` });
+            const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${'f'.repeat(32)}` });
+            return fetched.status === 200 && fetched.body.result?.queue_name === 'cert-queue' && missing.status === 404;
+        })],
+    ['DELETE /accounts/{account_id}/queues/{queue_id}', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            const id = await seedQueue(call);
+            const consumer = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'worker', script_name: 'cert-worker' } });
+            const deleted = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/queues/${id}` });
+            const gone = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${id}` });
+            const consumerGone = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${consumer.body.result?.consumer_id}` });
+            // Pinned QueueDeleteResponse envelope carries no `result` member (finding-8).
+            return deleted.status === 200 && deleted.body.success === true
+                && !Object.hasOwn(deleted.body, 'result')
+                && gone.status === 404 && consumerGone.status === 404;
+        })],
+    ['GET /accounts/{account_id}/queues/{queue_id}/consumers', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            const id = await seedQueue(call);
+            await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'worker', script_name: 'cert-worker' } });
+            const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${id}/consumers` });
+            const value = listed.body.result?.[0];
+            return listed.status === 200 && value?.type === 'worker' && value?.script_name === 'cert-worker'
+                && value?.queue_name === 'cert-queue';
+        })],
+    ['POST /accounts/{account_id}/queues/{queue_id}/consumers', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            const id = await seedQueue(call);
+            const badType = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'lambda' } });
+            const noScript = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'worker', script_name: 'never-uploaded' } });
+            const worker = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'worker', script_name: 'cert-worker', settings: { batch_size: 10, max_retries: 3 } } });
+            // A queue has at most one consumer — a second POST must be rejected until the first is gone.
+            const second = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'http_pull' } });
+            await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${worker.body.result?.consumer_id}` });
+            // The vendor documents max_concurrency:null ("opt into the platform maximum") — must be accepted.
+            const pull = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'http_pull', settings: { visibility_timeout_ms: 6000 } } });
+            return badType.status === 400 && noScript.status === 400
+                && worker.status === 200 && worker.body.result?.settings?.batch_size === 10
+                && second.status === 400
+                && pull.status === 200 && pull.body.result?.type === 'http_pull'
+                && !Object.hasOwn(pull.body.result ?? {}, 'script_name');
+        })],
+    ['GET /accounts/{account_id}/queues/{queue_id}/consumers/{consumer_id}', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            const id = await seedQueue(call);
+            const created = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'worker', script_name: 'cert-worker' } });
+            const consumerID = created.body.result?.consumer_id;
+            const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${consumerID}` });
+            const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${'f'.repeat(32)}` });
+            return fetched.status === 200 && fetched.body.result?.consumer_id === consumerID && missing.status === 404;
+        })],
+    ['PUT /accounts/{account_id}/queues/{queue_id}/consumers/{consumer_id}', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            const id = await seedQueue(call);
+            await seedQueue(call, 'dlq'); // a dead_letter_queue must reference a real queue on the account
+            const created = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'worker', script_name: 'cert-worker' } });
+            const consumerID = created.body.result?.consumer_id;
+            const badSetting = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${consumerID}`, b: { type: 'http_pull', settings: { max_concurrency: 2 } } });
+            const ghostDlq = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${consumerID}`, b: { type: 'worker', script_name: 'cert-worker', dead_letter_queue: 'nope-queue' } });
+            const badNull = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${consumerID}`, b: { type: 'worker', script_name: 'cert-worker', settings: { batch_size: null } } });
+            // The vendor's recommended max_concurrency:null ("platform maximum") must be accepted;
+            // batch_size:null must NOT (only max_concurrency is nullable).
+            const updated = await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${consumerID}`, b: { type: 'worker', script_name: 'cert-worker', dead_letter_queue: 'dlq', settings: { batch_size: 25, max_concurrency: null } } });
+            const value = updated.body.result;
+            // max_concurrency is a worker-consumer setting; the http_pull union does not carry it.
+            return badSetting.status === 400 && ghostDlq.status === 400 && badNull.status === 400 && updated.status === 200
+                && value?.dead_letter_queue === 'dlq' && value?.settings?.batch_size === 25
+                && value?.settings?.max_concurrency === null;
+        })],
+    ['DELETE /accounts/{account_id}/queues/{queue_id}/consumers/{consumer_id}', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            const id = await seedQueue(call);
+            const created = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/queues/${id}/consumers`, b: { type: 'worker', script_name: 'cert-worker' } });
+            const consumerID = created.body.result?.consumer_id;
+            const deleted = await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${consumerID}` });
+            // Pinned ConsumerDeleteResponse envelope carries no `result` member (finding-8).
+            return deleted.status === 200 && deleted.body.success === true
+                && !Object.hasOwn(deleted.body, 'result')
+                && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${id}/consumers/${consumerID}` })).status === 404
+                && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/queues/${id}` })).status === 200;
+        })],
+]);
+// Account members: the built-in roles, a member added with role ids and removed, and a bootstrapped member's user
+// two-factor state (Cloudflare's record of the person, which no account API sets).
+const memberSeed = async (call) => {
+    await seed(call);
+    await call({ m: 'POST', p: '/twin/bootstrap', b: { members: [{ account_id: ACCOUNT, email: 'ana@example.test', roles: ['Super Administrator - All Privileges'], two_factor: true }] } });
+    return (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/roles` })).body.result;
+};
+const memberVerifiers = new Map([
+    ['GET /accounts/{account_id}/roles', () => withRoot(async (call) => { const roles = await memberSeed(call); return roles.some((r) => r.name === 'Administrator') && roles.every((r) => /^[a-f0-9]{32}$/.test(r.id)); })],
+    ['GET /accounts/{account_id}/members', () => withRoot(async (call) => {
+            await memberSeed(call);
+            const list = (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/members` })).body.result;
+            return list.length === 1 && list[0].user.email === 'ana@example.test' && list[0].user.two_factor_authentication_enabled === true && list[0].status === 'accepted' && list[0].roles[0].name === 'Super Administrator - All Privileges';
+        })],
+    ['POST /accounts/{account_id}/members', () => withRoot(async (call) => {
+            const roles = await memberSeed(call);
+            const admin = roles.find((r) => r.name === 'Administrator').id;
+            const added = (await call({ m: 'POST', p: `/accounts/${ACCOUNT}/members`, b: { email: 'ben@example.test', roles: [admin] } })).body;
+            const bad = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/members`, b: { email: 'carol@example.test', roles: ['nope'] } });
+            const dup = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/members`, b: { email: 'ben@example.test', roles: [admin] } });
+            return added.success === true && added.result.status === 'pending' && added.result.user.two_factor_authentication_enabled === false && bad.status === 400 && dup.status === 400;
+        })],
+    ['GET /accounts/{account_id}/members/{member_id}', () => withRoot(async (call) => {
+            await memberSeed(call);
+            const id = (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/members` })).body.result[0].id;
+            return (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/members/${id}` })).body.result.email === 'ana@example.test'
+                && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/members/${'f'.repeat(32)}` })).status === 404;
+        })],
+    ['DELETE /accounts/{account_id}/members/{member_id}', () => withRoot(async (call) => {
+            await memberSeed(call);
+            const id = (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/members` })).body.result[0].id;
+            await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/members/${id}` });
+            return (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/members` })).body.result.length === 0;
+        })],
+]);
+// The account audit log: a user's API token created, a zone setting changed with it and a member removed are logged
+// newest first; the token and the setting are attributed to that user (the setting with its old and new value), the
+// removal (a token no one owns) to no one.
+operationVerifiers.set('GET /accounts/{account_id}/audit_logs', () => withRoot(async (call) => {
+    await memberSeed(call);
+    const token = (await call({ m: 'POST', p: '/twin/users/ana@example.test/tokens' })).body.result.token;
+    await call({ m: 'PATCH', p: `/zones/${ZONE}/settings/always_use_https`, b: { value: 'on' }, bearer: token });
+    const id = (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/members` })).body.result[0].id;
+    await call({ m: 'DELETE', p: `/accounts/${ACCOUNT}/members/${id}` });
+    const log = (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/audit_logs` })).body.result;
+    return log.length === 3 && log[2].action.type === 'create' && log[2].resource.type === 'token' && log[2].actor.email === 'ana@example.test'
+        && log[1].actor.email === 'ana@example.test' && log[1].resource.type === 'zone_setting' && log[1].oldValue === 'off' && log[1].newValue === 'on'
+        && log[0].action.type === 'delete' && log[0].actor.email === ''
+        && (await call({ m: 'GET', p: `/accounts/${ACCOUNT}/audit_logs?before=2000-01-01T00:00:00Z` })).body.result.length === 0;
+}));
+for (const [key, verify] of memberVerifiers)
+    operationVerifiers.set(key, verify);
+for (const [key, verify] of provisioningVerifiers)
+    operationVerifiers.set(key, verify);
+// The Workers deploy plane an unmodified `wrangler deploy` drives beyond the script upload:
+// static-assets upload sessions and bucketed uploads, versions, deployments, script settings,
+// and secrets listing. Same discipline: fresh root, response VALUES, and the negative path.
+const ASSET_A = 'a1'.repeat(16);
+const ASSET_B = 'b2'.repeat(16);
+const ASSET_MANIFEST = { '/index.html': { hash: ASSET_A, size: 5 }, '/app.js': { hash: ASSET_B, size: 3 } };
+function tokenPayload(jwt) {
+    try {
+        return JSON.parse(Buffer.from(String(jwt).split('.')[1] ?? '', 'base64url').toString('utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+/** One bulk asset upload exactly as wrangler sends it: parts named by hash, base64 content. */
+function assetUpload(jwt, files) {
+    const boundary = 'twin-asset-boundary';
+    const parts = Object.entries(files).map(([hash, file]) => `--${boundary}\r\nContent-Disposition: form-data; name="${hash}"; filename="${hash}"\r\nContent-Type: ${file.type}\r\n\r\n${Buffer.from(file.content).toString('base64')}\r\n`);
+    return { m: 'POST', p: `/accounts/${ACCOUNT}/workers/assets/upload?base64=true`, raw: `${parts.join('')}--${boundary}--\r\n`, ct: `multipart/form-data; boundary=${boundary}`, bearer: jwt };
+}
+/** Session → upload every bucket → the completion token (the whole wrangler asset sync). */
+async function syncAssets(call, name = 'cert-worker') {
+    const session = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/${name}/assets-upload-session`, b: { manifest: ASSET_MANIFEST } });
+    const jwt = String(session.body.result?.jwt ?? '');
+    if ((session.body.result?.buckets ?? []).length === 0)
+        return jwt;
+    const done = await call(assetUpload(jwt, { [ASSET_A]: { type: 'text/html', content: 'hello' }, [ASSET_B]: { type: 'text/javascript', content: '1+1' } }));
+    return String(done.body.result?.jwt ?? '');
+}
+async function deployVersion(call, name = 'cert-worker', metadata = { main_module: 'worker.js' }, body = 'export default {};') {
+    const upload = moduleUpload(metadata, { 'worker.js': body });
+    return call({ ...upload, m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/${name}/versions` });
+}
+const deployPlaneVerifiers = new Map([
+    ['POST /accounts/{account_id}/workers/scripts/{script_name}/assets-upload-session', () => withRoot(async (call) => {
+            await seed(call);
+            const invalid = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/assets-upload-session`, b: { manifest: { 'no-slash': { hash: ASSET_A, size: 1 } } } });
+            const first = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/assets-upload-session`, b: { manifest: ASSET_MANIFEST } });
+            const buckets = (first.body.result?.buckets ?? []).flat().sort().join(',');
+            await syncAssets(call);
+            // Once the account holds both hashes, a new session names no buckets and its jwt already completes.
+            const again = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/assets-upload-session`, b: { manifest: ASSET_MANIFEST } });
+            return invalid.status === 400 && first.status === 200
+                && buckets === [ASSET_A, ASSET_B].sort().join(',') && tokenPayload(first.body.result?.jwt).purpose === 'upload'
+                && again.status === 200 && again.body.result?.buckets?.length === 0
+                && tokenPayload(again.body.result?.jwt).purpose === 'completion';
+        })],
+    ['POST /accounts/{account_id}/workers/assets/upload', () => withRoot(async (call) => {
+            await seed(call);
+            const session = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/assets-upload-session`, b: { manifest: ASSET_MANIFEST } });
+            const jwt = String(session.body.result?.jwt);
+            // The API token is not the session token; a size that disagrees with the manifest is refused.
+            const apiToken = await call({ ...assetUpload(jwt, { [ASSET_A]: { type: 'text/html', content: 'hello' } }), bearer: undefined });
+            const wrongSize = await call(assetUpload(jwt, { [ASSET_A]: { type: 'text/html', content: 'hello world' } }));
+            const partial = await call(assetUpload(jwt, { [ASSET_A]: { type: 'text/html', content: 'hello' } }));
+            const complete = await call(assetUpload(jwt, { [ASSET_B]: { type: 'text/javascript', content: '1+1' } }));
+            const completion = String(complete.body.result?.jwt ?? '');
+            // The completion token is redeemed by the script upload; an assets binding with no assets is refused.
+            const noAssets = await deployWorker(call, 'cert-worker', { main_module: 'worker.js', bindings: [{ type: 'assets', name: 'ASSETS' }] });
+            const withAssets = await deployWorker(call, 'cert-worker', { main_module: 'worker.js', bindings: [{ type: 'assets', name: 'ASSETS' }], assets: { jwt: completion, config: { run_worker_first: true } } });
+            return apiToken.status === 401 && wrongSize.status === 400
+                && partial.status === 200 && !Object.hasOwn(partial.body.result ?? {}, 'jwt')
+                && complete.status === 200 && tokenPayload(completion).purpose === 'completion'
+                && noAssets.status === 400 && withAssets.status === 200 && withAssets.body.result?.has_assets === true;
+        })],
+    ['GET /accounts/{account_id}/workers/scripts/{script_name}/versions', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            const second = await deployWorker(call, 'cert-worker', { main_module: 'worker.js', compatibility_date: '2026-09-01' });
+            const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/versions` });
+            const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/never-uploaded/versions` });
+            const items = listed.body.result?.items ?? [];
+            return listed.status === 200 && items.length === 2 && items[0]?.number === 2 && items[1]?.number === 1
+                && items[0]?.id === second.body.result?.deployment_id
+                && items[0]?.resources?.script_runtime?.compatibility_date === '2026-09-01'
+                && missing.status === 404 && missing.body.errors?.[0]?.code === 10007;
+        })],
+    ['GET /accounts/{account_id}/workers/scripts/{script_name}/versions/{version_id}', () => withRoot(async (call) => {
+            await seed(call);
+            const uploaded = await deployWorker(call, 'cert-worker', { main_module: 'worker.js', bindings: [{ type: 'secret_text', name: 'API_KEY', text: 'shh' }] });
+            const id = uploaded.body.result?.deployment_id;
+            const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/versions/${id}` });
+            const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/versions/${'0'.repeat(8)}-0000-4000-a000-${'0'.repeat(12)}` });
+            const value = fetched.body.result;
+            return fetched.status === 200 && value?.id === id && value?.number === 1
+                && value?.resources?.script?.etag === uploaded.body.result?.etag
+                && value?.resources?.bindings?.[0]?.name === 'API_KEY' && !Object.hasOwn(value?.resources?.bindings?.[0] ?? {}, 'text')
+                && missing.status === 404;
+        })],
+    ['GET /accounts/{account_id}/workers/scripts/{script_name}/deployments', () => withRoot(async (call) => {
+            await seed(call);
+            const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/deployments` });
+            const uploaded = await deployWorker(call);
+            const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/deployments` });
+            const latest = listed.body.result?.deployments?.[0];
+            return missing.status === 404 && missing.body.errors?.[0]?.code === 10007
+                && listed.status === 200 && latest?.strategy === 'percentage'
+                && latest?.versions?.[0]?.version_id === uploaded.body.result?.deployment_id && latest?.versions?.[0]?.percentage === 100;
+        })],
+    ['POST /accounts/{account_id}/workers/scripts/{script_name}/deployments', () => withRoot(async (call) => {
+            await seed(call);
+            const first = await deployWorker(call);
+            // A version upload does not change the live Worker until a deployment routes traffic to it.
+            const version = await deployVersion(call, 'cert-worker', { main_module: 'worker.js' }, 'export default { v: 2 };');
+            const versionID = version.body.result?.id;
+            const before = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/settings` });
+            const badSum = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/deployments`, b: { strategy: 'percentage', versions: [{ version_id: versionID, percentage: 60 }, { version_id: first.body.result?.deployment_id, percentage: 50 }] } });
+            const unknown = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/deployments`, b: { strategy: 'percentage', versions: [{ version_id: 'not-a-version', percentage: 100 }] } });
+            const deployed = await call({ m: 'POST', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/deployments`, b: { strategy: 'percentage', versions: [{ version_id: versionID, percentage: 100 }], annotations: { 'workers/message': 'ship v2' } } });
+            const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/deployments` });
+            const download = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker` });
+            return version.status === 200 && before.status === 200 && badSum.status === 400 && unknown.status === 400
+                && deployed.status === 200 && deployed.body.result?.annotations?.['workers/message'] === 'ship v2'
+                && listed.body.result?.deployments?.[0]?.id === deployed.body.result?.id
+                && String(download.body).includes('v: 2');
+        })],
+    ['GET /accounts/{account_id}/workers/scripts/{script_name}/script-settings', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call, 'cert-worker', { main_module: 'worker.js', logpush: true, tags: ['launch'] });
+            const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/script-settings` });
+            const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/never-uploaded/script-settings` });
+            const value = fetched.body.result;
+            return fetched.status === 200 && value?.logpush === true && value?.tags?.[0] === 'launch' && missing.status === 404;
+        })],
+    ['PATCH /accounts/{account_id}/workers/scripts/{script_name}/script-settings', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call);
+            const invalid = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/script-settings`, b: { logpush: 'yes' } });
+            const patched = await call({ m: 'PATCH', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/script-settings`, b: { observability: { enabled: true, head_sampling_rate: 0.5 }, tags: ['env:prod'] } });
+            const after = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/script-settings` });
+            const value = after.body.result;
+            return invalid.status === 400 && patched.status === 200
+                && value?.observability?.enabled === true && value?.observability?.head_sampling_rate === 0.5
+                && value?.tags?.[0] === 'env:prod' && value?.logpush === false;
+        })],
+    ['GET /accounts/{account_id}/workers/scripts/{script_name}/settings', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call, 'cert-worker', { main_module: 'worker.js', compatibility_date: '2026-09-01', bindings: [
+                    { type: 'plain_text', name: 'MODE', text: 'prod' }, { type: 'secret_text', name: 'API_KEY', text: 'shh' },
+                ] });
+            const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/settings` });
+            const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/never-uploaded/settings` });
+            const bindings = fetched.body.result?.bindings ?? [];
+            const secret = bindings.find((item) => item.name === 'API_KEY');
+            return fetched.status === 200 && fetched.body.result?.compatibility_date === '2026-09-01'
+                && bindings.find((item) => item.name === 'MODE')?.text === 'prod'
+                && secret?.type === 'secret_text' && !Object.hasOwn(secret ?? {}, 'text')
+                && missing.status === 404 && missing.body.errors?.[0]?.code === 10007;
+        })],
+    ['GET /accounts/{account_id}/workers/scripts/{script_name}/secrets', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call, 'cert-worker', { main_module: 'worker.js', bindings: [
+                    { type: 'plain_text', name: 'MODE', text: 'prod' }, { type: 'secret_text', name: 'API_KEY', text: 'shh' },
+                ] });
+            const listed = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/secrets` });
+            const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/never-uploaded/secrets` });
+            const result = listed.body.result ?? [];
+            return listed.status === 200 && result.length === 1 && result[0]?.name === 'API_KEY' && result[0]?.type === 'secret_text'
+                && !Object.hasOwn(result[0] ?? {}, 'text')
+                && missing.status === 404 && missing.body.errors?.[0]?.code === 10007;
+        })],
+    ['GET /accounts/{account_id}/workers/scripts/{script_name}/secrets/{secret_name}', () => withRoot(async (call) => {
+            await seed(call);
+            await deployWorker(call, 'cert-worker', { main_module: 'worker.js', bindings: [{ type: 'secret_text', name: 'API_KEY', text: 'shh' }] });
+            const fetched = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/secrets/API_KEY` });
+            const missing = await call({ m: 'GET', p: `/accounts/${ACCOUNT}/workers/scripts/cert-worker/secrets/NOPE` });
+            return fetched.status === 200 && fetched.body.result?.name === 'API_KEY'
+                && !Object.hasOwn(fetched.body.result ?? {}, 'text') && missing.status === 404;
+        })],
+]);
+for (const [key, verify] of deployPlaneVerifiers)
+    operationVerifiers.set(key, verify);
+// These official operations contain broad unions/nested schemas. The twin deliberately
+// supports the certification-needed slices (ingress; CNAME/A/CAA records; the multipart
+// module upload with the deploy-critical binding kinds and Durable Object migrations), but
+// each whole vendor operation stays todo until every official variant is schema-faithful.
+const INCOMPLETE_OPERATION_UNIONS = new Set([
+    'PUT /accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations',
+    'POST /zones/{zone_id}/dns_records',
+    'PUT /zones/{zone_id}/dns_records/{dns_record_id}',
+    'PATCH /zones/{zone_id}/dns_records/{dns_record_id}',
+    // Served and exercised by every worker-seeding verify above, but the full multipart metadata
+    // union (38 binding kinds, assets, placement, limits, observability) is far broader than the
+    // implemented deploy slice — the whole vendor operation honestly stays todo.
+    'PUT /accounts/{account_id}/workers/scripts/{script_name}',
+    // The versions upload carries the same multipart metadata union as the script PUT above.
+    'POST /accounts/{account_id}/workers/scripts/{script_name}/versions',
+]);
+const operationCapabilities = CLOUDFLARE_OPENAPI_OPERATIONS.map((operation) => {
+    const operationKey = `${operation.method} ${operation.path}`;
+    const verify = INCOMPLETE_OPERATION_UNIONS.has(operationKey) ? undefined : operationVerifiers.get(operationKey);
+    return {
+        id: operation.id,
+        area: operation.area,
+        title: `${operation.method} ${operation.path} — ${operation.summary}`,
+        dimension: 'api',
+        tier: operation.tier,
+        expected: verify ? 'done' : 'todo',
+        ...(verify ? { verify } : {}),
+    };
+});
+const doneConnector = (id, title, tier, verify) => ({
+    id, area: 'connector', title, dimension: 'connector', tier, expected: 'done', verify,
+});
+const connectorCapabilities = [
+    doneConnector('cloudflare.connector.pull_complete_pagination', 'Pull walks every result_info page across the account graph', 'core', async () => {
+        const calls = [];
+        const execute = async (_method, path) => {
+            calls.push(path);
+            const page = Number(new URL(path, 'https://x.invalid').searchParams.get('page') ?? 1);
+            if (path.startsWith('/accounts?'))
+                return { status: 200, body: { success: true, result: [{ id: page === 1 ? ACCOUNT : 'c'.repeat(32), name: `A${page}` }], result_info: { page, total_pages: 2 } } };
+            if (path.startsWith('/zones?'))
+                return { status: 200, body: { success: true, result: [{ id: ZONE, name: 'example.test', account: { id: ACCOUNT } }], result_info: { page, total_pages: 1 } } };
+            return { status: 200, body: { success: true, result: [], result_info: { page, total_pages: 1 } } };
+        };
+        const result = await pullCloudflareState(execute);
+        return result.length === 3 && calls.includes('/accounts?per_page=50&page=2');
+    }),
+    doneConnector('cloudflare.connector.pull_idempotent', 'Repeated identical pull is idempotent in the projection', 'core', () => withRoot(async (_call, root) => {
+        const execute = async (_method, path) => ({ status: 200, body: { success: true, result: path.startsWith('/accounts?') ? [{ id: ACCOUNT, name: 'Acme' }] : [] } });
+        const first = await syncCloudflareFromReal(execute, { root, occurredAt: AT });
+        const second = await syncCloudflareFromReal(execute, { root, occurredAt: AT });
+        return first.deltasAppended === 1 && second.deltasAppended === 0;
+    })),
+    doneConnector('cloudflare.connector.pull_refuses_invalid_envelope', 'Pull requires a valid success:true envelope and refuses transport failures', 'core', async () => {
+        for (const response of [{ status: 200, body: {} }, { status: 403, body: { success: false, errors: [{ message: 'denied' }] } }]) {
+            try {
+                await pullCloudflareState(async () => response);
+                return false;
+            }
+            catch (error) {
+                if (!String(error).includes('refused'))
+                    return false;
+            }
+        }
+        return true;
+    }),
+    doneConnector('cloudflare.connector.pull_deletion_convergence', 'A complete later pull tombstones vendor-observed resources that disappeared', 'core', () => withRoot(async (_call, root) => {
+        let present = true;
+        const execute = async (_method, path) => ({ status: 200, body: {
+                success: true,
+                result: path.startsWith('/accounts?') && present ? [{ id: ACCOUNT, name: 'Acme' }] : [],
+                result_info: { page: 1, total_pages: 1 },
+            } });
+        await syncCloudflareFromReal(execute, { root, occurredAt: AT });
+        present = false;
+        await syncCloudflareFromReal(execute, { root, occurredAt: '2026-08-21T00:00:01.000Z' });
+        return projectResources('cloudflare', root).find((resource) => resource.id === ACCOUNT)?.deleted === true;
+    })),
+    doneConnector('cloudflare.connector.pull_incomplete_inventory_safe', 'A metadata-free partial inventory cannot tombstone unseen vendor resources', 'core', () => withRoot(async (_call, root) => {
+        let includeSecond = true;
+        const secondID = 'c'.repeat(32);
+        const execute = async (_method, path) => ({ status: 200, body: {
+                success: true,
+                result: path.startsWith('/accounts?') ? [{ id: ACCOUNT, name: 'A' }, ...(includeSecond ? [{ id: secondID, name: 'B' }] : [])] : [],
+            } });
+        await syncCloudflareFromReal(execute, { root, occurredAt: AT });
+        includeSecond = false;
+        await syncCloudflareFromReal(execute, { root, occurredAt: '2026-08-21T00:00:01.000Z' });
+        // the row is still there and still live: an inventory that never said it was complete cannot erase it
+        const unseen = projectResources('cloudflare', root).find((resource) => resource.id === secondID);
+        return unseen !== undefined && unseen.deleted !== true;
+    })),
+    doneConnector('cloudflare.connector.pull_tunnel_deletion_timestamp', 'Complete pull tunnel tombstones expose the observation timestamp', 'common', () => withRoot(async (_call, root) => {
+        let present = true;
+        const execute = async (_method, path) => {
+            if (path.endsWith('/configurations'))
+                return { status: 404, body: { success: false, result: null, errors: [] } };
+            const result = path.startsWith('/accounts?') ? [{ id: ACCOUNT, name: 'A' }]
+                : path.startsWith('/zones?') ? []
+                    : path.includes('/cfd_tunnel?') && present ? [{ id: VENDOR_TUNNEL, account_tag: ACCOUNT, name: 't', config_src: 'cloudflare' }] : [];
+            return { status: 200, body: { success: true, result, result_info: { page: 1, total_pages: 1 } } };
+        };
+        await syncCloudflareFromReal(execute, { root, occurredAt: AT });
+        present = false;
+        const deletedAt = '2026-08-21T00:00:01.000Z';
+        await syncCloudflareFromReal(execute, { root, occurredAt: deletedAt });
+        const value = projectResources('cloudflare', root).find((resource) => resource.id === VENDOR_TUNNEL);
+        return value?.deleted === true && value.deleted_at === deletedAt;
+    })),
+    doneConnector('cloudflare.connector.mapper_schema_validation', 'Pull rejects malformed vendor fixtures before folding impossible identities', 'common', async () => {
+        try {
+            await pullCloudflareState(async () => ({ status: 200, body: { success: true, result: [{}] } }));
+            return false;
+        }
+        catch (error) {
+            return String(error).includes('id must be a nonempty string');
+        }
+    }),
+    doneConnector('cloudflare.connector.configuration_identity', 'Pulled and locally-updated configuration converge on one account+tunnel identity', 'core', () => withRoot(async (call, root) => {
+        await seed(call);
+        await applyTwinWrite('cloudflare', { operation: 'tunnel.observe', subjectType: 'cloudflare_tunnel', subjectId: VENDOR_TUNNEL, fields: { account_id: ACCOUNT, name: 't', config_src: 'cloudflare', status: 'inactive', _deleted: false }, occurredAt: AT, actor: { kind: 'system' } }, root);
+        await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/cfd_tunnel/${VENDOR_TUNNEL}/configurations`, b: { config: { ingress: [{ hostname: '*', service: 'http_status:503' }] } } });
+        const execute = async (_method, path) => ({ status: 200, body: { success: true, result: path.startsWith('/accounts?') ? [{ id: ACCOUNT, name: 'Acme' }] : path.startsWith('/zones?') ? [] : path.includes('/cfd_tunnel?') ? [{ id: VENDOR_TUNNEL, account_tag: ACCOUNT, name: 't', config_src: 'cloudflare' }] : { account_id: ACCOUNT, tunnel_id: VENDOR_TUNNEL, config: { ingress: [{ hostname: '*', service: 'http_status:404' }] } } } });
+        await syncCloudflareFromReal(execute, { root, occurredAt: '2026-08-21T00:00:01.000Z' });
+        return projectResources('cloudflare', root).filter((value) => value.type === 'tunnel_configuration').length === 1;
+    })),
+    doneConnector('cloudflare.connector.pull_call_conservation', 'Pull fetches configuration only for remotely-managed tunnels', 'common', async () => {
+        const paths = [];
+        const execute = async (_method, path) => { paths.push(path); return { status: 200, body: { success: true, result: path.startsWith('/accounts?') ? [{ id: ACCOUNT, name: 'Acme' }] : path.includes('/cfd_tunnel?') ? [{ id: VENDOR_TUNNEL, name: 'local', config_src: 'local', account_tag: ACCOUNT }] : [] } }; };
+        await pullCloudflareState(execute);
+        return paths.length === 3 && !paths.some((path) => path.endsWith('/configurations'));
+    }),
+    doneConnector('cloudflare.connector.push', 'performCloudflareAction carries each entry across through the kernel\'s executor: the tunnel create answers Cloudflare\'s own id, and the configuration that follows is addressed to THAT id, not the local one (protocol 2)', 'core', () => withRoot(async (call, root) => {
+        await seed(call);
+        const localTunnel = await tunnel(call, 'push-me');
+        await call({ m: 'PUT', p: `/accounts/${ACCOUNT}/cfd_tunnel/${localTunnel}/configurations`, b: { config: { ingress: [{ hostname: '*', service: 'http_status:404' }] } } });
+        let failConfiguration = true;
+        const { execute, seen } = vendor((method, _path, body) => {
+            if (method === 'POST')
+                return { status: 200, body: { success: true, result: { id: VENDOR_TUNNEL, account_tag: ACCOUNT, name: 'push-me', config_src: 'cloudflare' } } };
+            if (failConfiguration)
+                return { status: 500, body: { success: false, errors: [{ message: 'retry' }], result: null } };
+            return { status: 200, body: { success: true, result: { account_id: ACCOUNT, tunnel_id: VENDOR_TUNNEL, config: body?.config } } };
+        });
+        // the vendor refuses the configuration once: the create is already across, and the dependent entry stops the batch
+        const first = await performAll(root, execute);
+        if (first.failed === null || !first.failed.includes('retry'))
+            return false;
+        if (first.adopted.get(`cloudflare_tunnel:${localTunnel}`) !== VENDOR_TUNNEL)
+            return false;
+        failConfiguration = false;
+        const again = await performAll(root, execute, first.adopted, first.done);
+        const configurations = seen.filter((request) => request.path.includes('/configurations'));
+        return again.failed === null && configurations.length > 0
+            && configurations.every((request) => request.path.includes(VENDOR_TUNNEL) && !request.path.includes(localTunnel));
+    })),
+    doneConnector('cloudflare.connector.push_confirmation_shape', 'A perform refuses an HTTP 200 body without success:true and the result identity Cloudflare owes — the entry stays undeployed rather than being marked across on a shapeless answer', 'core', () => withRoot(async (call, root) => {
+        await seed(call);
+        await tunnel(call, 'do-not-confirm');
+        const before = deployableEntries('cloudflare', root).filter((entry) => entry.operation === 'tunnel.create').length;
+        const shapeless = vendor(() => ({ status: 200, body: {} }));
+        const refused = await performAll(root, shapeless.execute);
+        if (refused.failed === null || before === 0)
+            return false;
+        // the same seam confirms a well-shaped answer, so the refusal was the SHAPE and not the seam
+        const proper = vendor(() => ({ status: 200, body: { success: true, result: { id: VENDOR_TUNNEL } } }));
+        const accepted = await performAll(root, proper.execute);
+        return accepted.failed === null && accepted.adopted.size > 0;
+    })),
+    doneConnector('cloudflare.connector.push_dns_replace', 'A local DNS PUT stays a vendor PUT, addressed to the adopted record id, and omits the fields the replacement cleared', 'common', () => withRoot(async (call, root) => {
+        await seed(call);
+        const created = await call({ m: 'POST', p: `/zones/${ZONE}/dns_records`, b: {
+                type: 'A', name: 'replace.example.test', ttl: 60, content: '192.0.2.1', private_routing: true,
+            } });
+        const localID = String(created.body.result?.id);
+        const vendorID = 'e'.repeat(32);
+        const first = vendor(() => ({ status: 200, body: { success: true, result: { id: vendorID } } }));
+        const after = await performAll(root, first.execute);
+        if (after.failed !== null || after.adopted.get(`dns_record:${localID}`) !== vendorID)
+            return false;
+        await call({ m: 'PUT', p: `/zones/${ZONE}/dns_records/${localID}`, b: {
+                type: 'CAA', name: 'replace.example.test', ttl: 120, data: { flags: 0, tag: 'issue', value: 'pki.goog' },
+            } });
+        const second = vendor(() => ({ status: 200, body: { success: true, result: { id: vendorID } } }));
+        const replay = await performAll(root, second.execute, after.adopted, after.done);
+        const observed = second.seen.at(-1);
+        return replay.failed === null && observed?.method === 'PUT' && observed.path.endsWith(`/dns_records/${vendorID}`)
+            && observed.body?.type === 'CAA' && !Object.hasOwn(observed.body ?? {}, 'content')
+            && !Object.hasOwn(observed.body ?? {}, 'private_routing');
+    })),
+    doneConnector('cloudflare.connector.budget_weights', 'Budget weights reads at 2 and mutations at 3', 'core', () => cloudflareCallWeight('GET', '/zones') === 2 && cloudflareCallWeight('POST', '/zones/x/dns_records') === 3),
+    doneConnector('cloudflare.connector.budget_ceiling', 'Budget rejects calls above the conservative 60-unit minute', 'core', () => {
+        const root = mkdtempSync(join(tmpdir(), 'cloudflare-budget-cap-'));
+        try {
+            const budget = new CloudflareBudget({ root, token: 'cap' });
+            budget.recordCall(CLOUDFLARE_BUDGET_CEILING);
+            try {
+                budget.checkBudget(1);
+                return false;
+            }
+            catch (error) {
+                return error instanceof CloudflareBudgetError;
+            }
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    }),
+];
+export const CLOUDFLARE_CAPABILITIES = [...operationCapabilities, ...connectorCapabilities];
+export async function cloudflareCapabilities() {
+    return checkCapabilities('cloudflare', CLOUDFLARE_CAPABILITIES);
+}