@volter/twin-cloudflare 0.1.0

package/dist/src/cloudflare-common.d.ts

@@ -0,0 +1,59 @@
+export declare const SERVICE = "cloudflare";
+export declare const CLOUDFLARE_RESOURCE_TYPES: readonly ["account", "zone", "cloudflare_tunnel", "tunnel_configuration", "dns_record", "worker_script", "worker_route", "worker_domain", "workers_subdomain", "durable_object_namespace", "r2_bucket", "r2_object", "r2_custom_domain", "hyperdrive_config", "queue", "queue_consumer", "worker_asset_upload_session", "worker_asset", "worker_version", "account_member", "zone_setting", "user_token", "audit_log"];
+export type CloudflareResourceType = (typeof CLOUDFLARE_RESOURCE_TYPES)[number];
+export type CloudflareRequest = {
+    method: string;
+    path: string;
+    body?: string;
+    headers?: Record<string, string>;
+    occurredAt?: string;
+    root?: string;
+    readOnly?: boolean;
+};
+/** `raw: true` responses send `body` verbatim (or an empty body when null) with the given
+ *  content-type headers — used by Worker script download, which is not JSON-enveloped. */
+export type CloudflareResponse = {
+    status: number;
+    body: unknown;
+    headers?: Record<string, string>;
+    raw?: boolean;
+};
+export type Row = Record<string, unknown> & {
+    id: string;
+    type: string;
+};
+export declare function headers(input?: Record<string, string>): Record<string, string>;
+export declare function success(result: unknown, resultInfo?: Record<string, unknown>): CloudflareResponse;
+export declare function failure(status: number, code: number, message: string): CloudflareResponse;
+export declare function parseBody(req: CloudflareRequest): Record<string, unknown> | CloudflareResponse;
+export declare function isResponse(value: unknown): value is CloudflareResponse;
+/** The rows of a type (protocol 2: a subject's id is the vendor's, with no type prefix, and a delete is the
+ *  kernel's tombstone `deleted: true` — which the subject's next write clears). */
+export declare function rows(type: CloudflareResourceType, root?: string, includeDeleted?: boolean): Row[];
+export declare function row(type: CloudflareResourceType, id: string, root?: string, includeDeleted?: boolean): Row | undefined;
+export declare function deterministicHex(label: string, length: number): string;
+export declare function uuidFrom(label: string): string;
+/** Mint a fresh id for `type`, scanning the id-SET already in state (tombstones included) so
+ *  delete/recreate and pulled-vendor ids can never collide with a local mint. */
+export declare function mint(type: CloudflareResourceType, label: string, root?: string): string;
+export declare function write(type: CloudflareResourceType, id: string, operation: string, fields: Record<string, unknown>, req: CloudflareRequest): Promise<void>;
+export declare function paginate<T>(items: T[], url: URL, defaultPerPage?: number, maxPerPage?: number): {
+    result: T[];
+    info: Record<string, number>;
+};
+export declare function readOnly(req: CloudflareRequest): CloudflareResponse | null;
+export declare function scopeMissing(kind: 'account' | 'zone' | 'tunnel', id: string): CloudflareResponse;
+export declare function noRoute(): CloudflareResponse;
+/** The user a request's API token belongs to (a token minted at POST /twin/users/{email}/tokens); empty for any other. */
+export declare function callerEmail(req: CloudflareRequest): string;
+/** One entry in an account's audit log, attributed to the calling token's user. */
+export declare function audit(req: CloudflareRequest, accountID: string, entry: {
+    type: string;
+    resource: {
+        type: string;
+        id: string;
+    };
+    oldValue?: unknown;
+    newValue?: unknown;
+    metadata?: Record<string, unknown>;
+}): Promise<void>;

package/dist/src/cloudflare-common.js

@@ -0,0 +1,142 @@
+// Shared Cloudflare twin plumbing: the API v4 envelope, kernel row projection/minting, and
+// request parsing helpers used by both the core slice (accounts/zones/tunnels/DNS in
+// cloudflare-twin.ts) and the provisioning slice (Workers/R2/Hyperdrive/Queues in
+// cloudflare-provisioning.ts). Pure helpers over the @volter/world-core kernel — no routes here.
+import { createHash } from 'node:crypto';
+import { applyTwinWrite, projectResources } from '@volter/world-core';
+export const SERVICE = 'cloudflare';
+export const CLOUDFLARE_RESOURCE_TYPES = [
+    'account',
+    'zone',
+    'cloudflare_tunnel',
+    'tunnel_configuration',
+    'dns_record',
+    'worker_script',
+    'worker_route',
+    'worker_domain',
+    'workers_subdomain',
+    'durable_object_namespace',
+    'r2_bucket',
+    'r2_object',
+    'r2_custom_domain',
+    'hyperdrive_config',
+    'queue',
+    'queue_consumer',
+    'worker_asset_upload_session',
+    'worker_asset',
+    'worker_version',
+    'account_member',
+    'zone_setting',
+    'user_token',
+    'audit_log',
+];
+export function headers(input) {
+    return Object.fromEntries(Object.entries(input ?? {}).map(([key, value]) => [key.toLowerCase(), value]));
+}
+export function success(result, resultInfo) {
+    return {
+        status: 200,
+        body: {
+            success: true,
+            errors: [],
+            messages: [],
+            result,
+            ...(resultInfo ? { result_info: resultInfo } : {}),
+        },
+    };
+}
+export function failure(status, code, message) {
+    return {
+        status,
+        body: { success: false, errors: [{ code, message }], messages: [], result: null },
+    };
+}
+export function parseBody(req) {
+    try {
+        const value = req.body ? JSON.parse(req.body) : {};
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            return failure(400, 1004, 'Invalid request body');
+        return value;
+    }
+    catch {
+        return failure(400, 1004, 'Invalid request body');
+    }
+}
+export function isResponse(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        && typeof value.status === 'number'
+        && 'body' in value;
+}
+/** The rows of a type (protocol 2: a subject's id is the vendor's, with no type prefix, and a delete is the
+ *  kernel's tombstone `deleted: true` — which the subject's next write clears). */
+export function rows(type, root, includeDeleted = false) {
+    return projectResources(SERVICE, root)
+        .filter((item) => item.type === type && (includeDeleted || item.deleted !== true))
+        .map((item) => ({ ...item }));
+}
+export function row(type, id, root, includeDeleted = false) {
+    return rows(type, root, includeDeleted).find((item) => item.id === id);
+}
+export function deterministicHex(label, length) {
+    let out = '';
+    for (let i = 0; out.length < length; i++)
+        out += createHash('sha256').update(`${label}:${i}`).digest('hex');
+    return out.slice(0, length);
+}
+export function uuidFrom(label) {
+    const hex = deterministicHex(label, 32);
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-a${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+}
+/** Mint a fresh id for `type`, scanning the id-SET already in state (tombstones included) so
+ *  delete/recreate and pulled-vendor ids can never collide with a local mint. */
+export function mint(type, label, root) {
+    const taken = new Set(rows(type, root, true).map((item) => item.id));
+    for (let salt = 0;; salt++) {
+        const id = type === 'cloudflare_tunnel' || type === 'worker_version' ? uuidFrom(`${label}:${salt}`) : deterministicHex(`${label}:${salt}`, 32);
+        if (!taken.has(id))
+            return id;
+    }
+}
+export async function write(type, id, operation, fields, req) {
+    await applyTwinWrite(SERVICE, {
+        operation,
+        subjectType: type,
+        subjectId: id, // protocol 2: the subject's id is the vendor's, the type is the subject's own
+        fields,
+        ...(req.occurredAt ? { occurredAt: req.occurredAt } : {}),
+        actor: { kind: 'agent' },
+    }, req.root);
+}
+export function paginate(items, url, defaultPerPage = 20, maxPerPage = 50) {
+    const page = Math.max(1, Number(url.searchParams.get('page') ?? 1) || 1);
+    const perPage = Math.min(maxPerPage, Math.max(1, Number(url.searchParams.get('per_page') ?? defaultPerPage) || defaultPerPage));
+    const start = (page - 1) * perPage;
+    const result = items.slice(start, start + perPage);
+    return {
+        result,
+        info: { page, per_page: perPage, count: result.length, total_count: items.length, total_pages: Math.max(1, Math.ceil(items.length / perPage)) },
+    };
+}
+export function readOnly(req) {
+    return req.readOnly ? failure(405, 1000, 'Method not allowed in read-only mode') : null;
+}
+export function scopeMissing(kind, id) {
+    return failure(404, 7003, `Could not route to /${kind}/${id}, perhaps your object identifier is invalid?`);
+}
+export function noRoute() {
+    return failure(404, 7000, 'No route for that URI');
+}
+/** The user a request's API token belongs to (a token minted at POST /twin/users/{email}/tokens); empty for any other. */
+export function callerEmail(req) {
+    const bearer = /^Bearer\s+(\S+)$/i.exec(headers(req.headers).authorization ?? '')?.[1] ?? '';
+    return bearer ? String(rows('user_token', req.root).find((t) => t.token === bearer)?.email ?? '') : '';
+}
+/** One entry in an account's audit log, attributed to the calling token's user. */
+export async function audit(req, accountID, entry) {
+    const when = req.occurredAt ?? new Date().toISOString();
+    const id = deterministicHex(`audit:${accountID}:${when}:${entry.resource.type}:${entry.resource.id}:${rows('audit_log', req.root).length}`, 32);
+    const email = callerEmail(req);
+    await write('audit_log', id, 'audit_log.record', { account_id: accountID, when, action: { type: entry.type, result: true, info: '' },
+        actor: { email, id: email ? deterministicHex(`user:${email}`, 32) : '', ip: '', type: email ? 'user' : 'token' },
+        interface: 'API', resource: entry.resource, oldValue: entry.oldValue ?? null, newValue: entry.newValue ?? null, metadata: entry.metadata ?? {}, owner: { id: accountID } }, req);
+}

package/dist/src/cloudflare-conformance.d.ts

@@ -0,0 +1,6 @@
+export type CloudflareConformanceReport = {
+    ok: boolean;
+    endpointsChecked: number;
+    violations: string[];
+};
+export declare function checkCloudflareConformance(): Promise<CloudflareConformanceReport>;

package/dist/src/cloudflare-conformance.js

@@ -0,0 +1,251 @@
+// Dev-only conformance probe. Expected paths are literal (not imported from the router),
+// and every claimed modeled endpoint is exercised against a fresh kernel root with a real
+// request asserting the outcome a live handler produces (status + body predicate).
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { CLOUDFLARE_ROUTER_SURFACE, handleCloudflareTwinRequest } from "./cloudflare-twin.js";
+const EXPECTED = [
+    'POST /twin/bootstrap', 'GET /accounts', 'GET /accounts/{account_id}', 'GET /zones', 'GET /zones/{zone_id}',
+    'GET /accounts/{account_id}/cfd_tunnel', 'POST /accounts/{account_id}/cfd_tunnel',
+    'GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}', 'PATCH /accounts/{account_id}/cfd_tunnel/{tunnel_id}',
+    'DELETE /accounts/{account_id}/cfd_tunnel/{tunnel_id}', 'GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}/token',
+    'GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations', 'PUT /accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations',
+    'GET /zones/{zone_id}/dns_records', 'POST /zones/{zone_id}/dns_records', 'GET /zones/{zone_id}/dns_records/{dns_record_id}',
+    'PUT /zones/{zone_id}/dns_records/{dns_record_id}', 'PATCH /zones/{zone_id}/dns_records/{dns_record_id}',
+    'DELETE /zones/{zone_id}/dns_records/{dns_record_id}',
+    // Workers / R2 / Hyperdrive / Queues provisioning control plane.
+    'GET /accounts/{account_id}/workers/scripts',
+    'PUT /accounts/{account_id}/workers/scripts/{script_name}',
+    'GET /accounts/{account_id}/workers/scripts/{script_name}',
+    'DELETE /accounts/{account_id}/workers/scripts/{script_name}',
+    'GET /accounts/{account_id}/workers/scripts/{script_name}/schedules',
+    'PUT /accounts/{account_id}/workers/scripts/{script_name}/schedules',
+    'GET /accounts/{account_id}/workers/scripts/{script_name}/subdomain',
+    'POST /accounts/{account_id}/workers/scripts/{script_name}/subdomain',
+    'DELETE /accounts/{account_id}/workers/scripts/{script_name}/subdomain',
+    'GET /accounts/{account_id}/workers/subdomain',
+    'PUT /accounts/{account_id}/workers/subdomain',
+    'DELETE /accounts/{account_id}/workers/subdomain',
+    'GET /accounts/{account_id}/workers/domains',
+    'PUT /accounts/{account_id}/workers/domains',
+    'GET /accounts/{account_id}/workers/domains/{domain_id}',
+    'DELETE /accounts/{account_id}/workers/domains/{domain_id}',
+    'GET /accounts/{account_id}/workers/durable_objects/namespaces',
+    'GET /zones/{zone_id}/workers/routes',
+    'POST /zones/{zone_id}/workers/routes',
+    'GET /zones/{zone_id}/workers/routes/{route_id}',
+    'PUT /zones/{zone_id}/workers/routes/{route_id}',
+    'DELETE /zones/{zone_id}/workers/routes/{route_id}',
+    'GET /accounts/{account_id}/r2/buckets',
+    'POST /accounts/{account_id}/r2/buckets',
+    'GET /accounts/{account_id}/r2/buckets/{bucket_name}',
+    'DELETE /accounts/{account_id}/r2/buckets/{bucket_name}',
+    'GET /accounts/{account_id}/hyperdrive/configs',
+    'POST /accounts/{account_id}/hyperdrive/configs',
+    'GET /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}',
+    'PUT /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}',
+    'PATCH /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}',
+    'DELETE /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}',
+    'GET /accounts/{account_id}/queues',
+    'POST /accounts/{account_id}/queues',
+    'GET /accounts/{account_id}/queues/{queue_id}',
+    'DELETE /accounts/{account_id}/queues/{queue_id}',
+    'GET /accounts/{account_id}/queues/{queue_id}/consumers',
+    'POST /accounts/{account_id}/queues/{queue_id}/consumers',
+    'GET /accounts/{account_id}/queues/{queue_id}/consumers/{consumer_id}',
+    'PUT /accounts/{account_id}/queues/{queue_id}/consumers/{consumer_id}',
+    'DELETE /accounts/{account_id}/queues/{queue_id}/consumers/{consumer_id}',
+];
+export async function checkCloudflareConformance() {
+    const violations = [];
+    const actual = new Set(CLOUDFLARE_ROUTER_SURFACE);
+    for (const endpoint of EXPECTED)
+        if (!actual.has(endpoint))
+            violations.push(`router missing literal claim ${endpoint}`);
+    for (const endpoint of actual)
+        if (!EXPECTED.includes(endpoint))
+            violations.push(`router serves unclaimed surface ${endpoint}`);
+    const root = mkdtempSync(join(tmpdir(), 'cloudflare-conformance-'));
+    const account = 'a'.repeat(32);
+    const zone = 'b'.repeat(32);
+    let tick = 0;
+    const call = (method, path, body, headers) => handleCloudflareTwinRequest({
+        root, method, path,
+        headers: { authorization: 'Bearer conformance', ...(headers ?? {}) },
+        occurredAt: `2026-08-23T00:00:${String(tick++ % 60).padStart(2, '0')}.${String(Math.floor(tick / 60)).padStart(3, '0')}Z`,
+        ...(body !== undefined ? { body: typeof body === 'string' ? body : JSON.stringify(body) } : {}),
+    });
+    try {
+        const seeded = await call('POST', '/twin/bootstrap', { accounts: [{ id: account, name: 'A' }], zones: [{ id: zone, account_id: account, name: 'example.test' }] });
+        if (seeded.status !== 200 || seeded.body.result.accounts !== 1)
+            violations.push('bootstrap probe failed');
+        const accounts = await call('GET', '/accounts');
+        if (accounts.status !== 200 || accounts.body.result[0]?.id !== account)
+            violations.push('accounts list probe failed');
+        const accountGet = await call('GET', `/accounts/${account}`);
+        if (accountGet.body.result?.name !== 'A')
+            violations.push('account get probe failed');
+        const zones = await call('GET', '/zones');
+        if (zones.body.result[0]?.id !== zone)
+            violations.push('zones list probe failed');
+        const zoneGet = await call('GET', `/zones/${zone}`);
+        if (zoneGet.body.result?.name !== 'example.test')
+            violations.push('zone get probe failed');
+        const created = await call('POST', `/accounts/${account}/cfd_tunnel`, { name: 'conformance', config_src: 'cloudflare' });
+        const tunnelID = created.body.result?.id;
+        if (created.status !== 200 || !tunnelID)
+            violations.push('tunnel create probe failed');
+        const tunnelList = await call('GET', `/accounts/${account}/cfd_tunnel`);
+        if (tunnelList.body.result[0]?.name !== 'conformance')
+            violations.push('tunnel list probe failed');
+        if ((await call('GET', `/accounts/${account}/cfd_tunnel/${tunnelID}`)).status !== 200)
+            violations.push('tunnel get probe failed');
+        if ((await call('PATCH', `/accounts/${account}/cfd_tunnel/${tunnelID}`, { name: 'renamed' })).body && (await call('GET', `/accounts/${account}/cfd_tunnel/${tunnelID}`)).body && (await call('GET', `/accounts/${account}/cfd_tunnel/${tunnelID}`)).body.result?.name !== 'renamed')
+            violations.push('tunnel edit probe failed');
+        if (typeof (await call('GET', `/accounts/${account}/cfd_tunnel/${tunnelID}/token`)).body.result !== 'string')
+            violations.push('tunnel token probe failed');
+        const config = await call('PUT', `/accounts/${account}/cfd_tunnel/${tunnelID}/configurations`, { config: { ingress: [{ hostname: 'app.example.test', service: 'http://127.0.0.1:8787' }] } });
+        if (config.body.result?.version !== 1)
+            violations.push('configuration put probe failed');
+        if ((await call('GET', `/accounts/${account}/cfd_tunnel/${tunnelID}/configurations`)).status !== 200)
+            violations.push('configuration get probe failed');
+        const record = await call('POST', `/zones/${zone}/dns_records`, { type: 'CNAME', name: 'app.example.test', content: `${tunnelID}.cfargotunnel.com`, ttl: 1 });
+        const recordID = record.body.result?.id;
+        if (!recordID)
+            violations.push('DNS create probe failed');
+        if ((await call('GET', `/zones/${zone}/dns_records`)).body && (await call('GET', `/zones/${zone}/dns_records`)).body.result[0]?.id !== recordID)
+            violations.push('DNS list probe failed');
+        if ((await call('GET', `/zones/${zone}/dns_records/${recordID}`)).status !== 200)
+            violations.push('DNS get probe failed');
+        if ((await call('PUT', `/zones/${zone}/dns_records/${recordID}`, { type: 'CNAME', name: 'app.example.test', content: 'put.cfargotunnel.com', ttl: 1 })).status !== 200)
+            violations.push('DNS put probe failed');
+        if ((await call('PATCH', `/zones/${zone}/dns_records/${recordID}`, { content: 'patch.cfargotunnel.com' })).status !== 200)
+            violations.push('DNS patch probe failed');
+        if ((await call('DELETE', `/zones/${zone}/dns_records/${recordID}`)).status !== 200)
+            violations.push('DNS delete probe failed');
+        if ((await call('DELETE', `/accounts/${account}/cfd_tunnel/${tunnelID}`)).status !== 200)
+            violations.push('tunnel delete probe failed');
+        // ── provisioning slice ──
+        const bucket = await call('POST', `/accounts/${account}/r2/buckets`, { name: 'conformance-bucket' });
+        if (bucket.status !== 200 || bucket.body.result?.name !== 'conformance-bucket')
+            violations.push('R2 create probe failed');
+        if ((await call('GET', `/accounts/${account}/r2/buckets`)).body.result?.buckets?.[0]?.name !== 'conformance-bucket')
+            violations.push('R2 list probe failed');
+        if ((await call('GET', `/accounts/${account}/r2/buckets/conformance-bucket`)).body.result?.name !== 'conformance-bucket')
+            violations.push('R2 get probe failed');
+        const hyperdrive = await call('POST', `/accounts/${account}/hyperdrive/configs`, {
+            name: 'conformance-hd',
+            origin: { scheme: 'postgres', database: 'app', user: 'u', password: 'p', host: 'db.example.test', port: 5432 },
+        });
+        const hyperdriveID = hyperdrive.body.result?.id;
+        if (hyperdrive.status !== 200 || !hyperdriveID)
+            violations.push('hyperdrive create probe failed');
+        if ((await call('GET', `/accounts/${account}/hyperdrive/configs`)).body.result?.[0]?.id !== hyperdriveID)
+            violations.push('hyperdrive list probe failed');
+        if ((await call('GET', `/accounts/${account}/hyperdrive/configs/${hyperdriveID}`)).body.result?.name !== 'conformance-hd')
+            violations.push('hyperdrive get probe failed');
+        if ((await call('PUT', `/accounts/${account}/hyperdrive/configs/${hyperdriveID}`, {
+            name: 'conformance-hd-2',
+            origin: { scheme: 'postgres', database: 'app', user: 'u', password: 'p', host: 'db2.example.test', port: 5432 },
+        })).body.result?.name !== 'conformance-hd-2')
+            violations.push('hyperdrive put probe failed');
+        if ((await call('PATCH', `/accounts/${account}/hyperdrive/configs/${hyperdriveID}`, { name: 'conformance-hd-3' })).body.result?.name !== 'conformance-hd-3')
+            violations.push('hyperdrive patch probe failed');
+        const queue = await call('POST', `/accounts/${account}/queues`, { queue_name: 'conformance-queue' });
+        const queueID = queue.body.result?.queue_id;
+        if (queue.status !== 200 || !queueID)
+            violations.push('queue create probe failed');
+        if ((await call('GET', `/accounts/${account}/queues`)).body.result?.[0]?.queue_id !== queueID)
+            violations.push('queue list probe failed');
+        if ((await call('GET', `/accounts/${account}/queues/${queueID}`)).body.result?.queue_name !== 'conformance-queue')
+            violations.push('queue get probe failed');
+        const metadata = {
+            main_module: 'worker.js',
+            compatibility_date: '2026-08-01',
+            bindings: [
+                { type: 'r2_bucket', name: 'BUCKET', bucket_name: 'conformance-bucket' },
+                { type: 'queue', name: 'QUEUE', queue_name: 'conformance-queue' },
+                { type: 'hyperdrive', name: 'HYPERDRIVE', id: hyperdriveID },
+                { type: 'durable_object_namespace', name: 'DO', class_name: 'Conformance' },
+            ],
+            migrations: { new_tag: 'v1', new_sqlite_classes: ['Conformance'] },
+        };
+        const boundary = 'conformance-boundary';
+        const upload = await call('PUT', `/accounts/${account}/workers/scripts/conformance-worker`, `--${boundary}\r\nContent-Disposition: form-data; name="metadata"\r\nContent-Type: application/json\r\n\r\n${JSON.stringify(metadata)}\r\n--${boundary}\r\nContent-Disposition: form-data; name="files[]"; filename="worker.js"\r\nContent-Type: application/javascript+module\r\n\r\nexport default { fetch() { return new Response("ok"); } };\r\n--${boundary}--\r\n`, { 'content-type': `multipart/form-data; boundary=${boundary}` });
+        if (upload.status !== 200 || upload.body.result?.id !== 'conformance-worker')
+            violations.push('worker upload probe failed');
+        if ((await call('GET', `/accounts/${account}/workers/scripts`)).body.result?.[0]?.id !== 'conformance-worker')
+            violations.push('worker list probe failed');
+        const download = await call('GET', `/accounts/${account}/workers/scripts/conformance-worker`);
+        if (download.status !== 200 || typeof download.body !== 'string' || !download.body.includes('fetch()'))
+            violations.push('worker download probe failed');
+        if ((await call('GET', `/accounts/${account}/workers/durable_objects/namespaces`)).body.result?.[0]?.class !== 'Conformance')
+            violations.push('DO namespace list probe failed');
+        if ((await call('PUT', `/accounts/${account}/workers/scripts/conformance-worker/schedules`, [{ cron: '*/5 * * * *' }])).body.result?.schedules?.[0]?.cron !== '*/5 * * * *')
+            violations.push('schedules put probe failed');
+        if ((await call('GET', `/accounts/${account}/workers/scripts/conformance-worker/schedules`)).body.result?.schedules?.length !== 1)
+            violations.push('schedules get probe failed');
+        if ((await call('PUT', `/accounts/${account}/workers/subdomain`, { subdomain: 'conformance-team' })).body.result?.subdomain !== 'conformance-team')
+            violations.push('account subdomain put probe failed');
+        if ((await call('GET', `/accounts/${account}/workers/subdomain`)).body.result?.subdomain !== 'conformance-team')
+            violations.push('account subdomain get probe failed');
+        if ((await call('POST', `/accounts/${account}/workers/scripts/conformance-worker/subdomain`, { enabled: true, previews_enabled: true })).body.result?.enabled !== true)
+            violations.push('script subdomain post probe failed');
+        if ((await call('GET', `/accounts/${account}/workers/scripts/conformance-worker/subdomain`)).body.result?.enabled !== true)
+            violations.push('script subdomain get probe failed');
+        if ((await call('DELETE', `/accounts/${account}/workers/scripts/conformance-worker/subdomain`)).body.result?.enabled !== false)
+            violations.push('script subdomain delete probe failed');
+        const route = await call('POST', `/zones/${zone}/workers/routes`, { pattern: 'example.test/api/*', script: 'conformance-worker' });
+        const routeID = route.body.result?.id;
+        if (route.status !== 200 || !routeID)
+            violations.push('route create probe failed');
+        if ((await call('GET', `/zones/${zone}/workers/routes`)).body.result?.[0]?.id !== routeID)
+            violations.push('route list probe failed');
+        if ((await call('GET', `/zones/${zone}/workers/routes/${routeID}`)).body.result?.pattern !== 'example.test/api/*')
+            violations.push('route get probe failed');
+        if ((await call('PUT', `/zones/${zone}/workers/routes/${routeID}`, { pattern: 'example.test/v2/*', script: 'conformance-worker' })).body.result?.pattern !== 'example.test/v2/*')
+            violations.push('route put probe failed');
+        const domain = await call('PUT', `/accounts/${account}/workers/domains`, { hostname: 'api.example.test', service: 'conformance-worker' });
+        const domainID = domain.body.result?.id;
+        if (domain.status !== 200 || domain.body.result?.zone_id !== zone)
+            violations.push('domain attach probe failed');
+        if ((await call('GET', `/accounts/${account}/workers/domains`)).body.result?.[0]?.id !== domainID)
+            violations.push('domain list probe failed');
+        if ((await call('GET', `/accounts/${account}/workers/domains/${domainID}`)).body.result?.hostname !== 'api.example.test')
+            violations.push('domain get probe failed');
+        const consumer = await call('POST', `/accounts/${account}/queues/${queueID}/consumers`, { type: 'worker', script_name: 'conformance-worker' });
+        const consumerID = consumer.body.result?.consumer_id;
+        if (consumer.status !== 200 || !consumerID)
+            violations.push('consumer create probe failed');
+        if ((await call('GET', `/accounts/${account}/queues/${queueID}/consumers`)).body.result?.[0]?.consumer_id !== consumerID)
+            violations.push('consumer list probe failed');
+        if ((await call('GET', `/accounts/${account}/queues/${queueID}/consumers/${consumerID}`)).body.result?.type !== 'worker')
+            violations.push('consumer get probe failed');
+        if ((await call('PUT', `/accounts/${account}/queues/${queueID}/consumers/${consumerID}`, { type: 'worker', script_name: 'conformance-worker', settings: { batch_size: 5 } })).body.result?.settings?.batch_size !== 5)
+            violations.push('consumer put probe failed');
+        if ((await call('DELETE', `/accounts/${account}/queues/${queueID}/consumers/${consumerID}`)).status !== 200)
+            violations.push('consumer delete probe failed');
+        // teardown probes (delete endpoints)
+        if ((await call('DELETE', `/accounts/${account}/workers/domains/${domainID}`)).status !== 200)
+            violations.push('domain delete probe failed');
+        if ((await call('DELETE', `/zones/${zone}/workers/routes/${routeID}`)).status !== 200)
+            violations.push('route delete probe failed');
+        if ((await call('DELETE', `/accounts/${account}/workers/subdomain`)).status !== 204)
+            violations.push('account subdomain delete probe failed');
+        if ((await call('DELETE', `/accounts/${account}/workers/scripts/conformance-worker`)).status !== 400)
+            violations.push('worker delete without force should be blocked by its Durable Object namespace');
+        if ((await call('DELETE', `/accounts/${account}/workers/scripts/conformance-worker?force=true`)).status !== 200)
+            violations.push('worker force delete probe failed');
+        if ((await call('DELETE', `/accounts/${account}/queues/${queueID}`)).status !== 200)
+            violations.push('queue delete probe failed');
+        if ((await call('DELETE', `/accounts/${account}/hyperdrive/configs/${hyperdriveID}`)).status !== 200)
+            violations.push('hyperdrive delete probe failed');
+        if ((await call('DELETE', `/accounts/${account}/r2/buckets/conformance-bucket`)).status !== 200)
+            violations.push('R2 delete probe failed');
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+    return { ok: violations.length === 0, endpointsChecked: EXPECTED.length, violations };
+}

package/dist/src/cloudflare-connector.d.ts

@@ -0,0 +1,53 @@
+import type { PerformContext, PushOutcome, RemoteExecute, SyncResource, TwinAction } from '@volter/world-core';
+import { CloudflareBudget, type CloudflareBudgetOptions } from './cloudflare-budget.js';
+export type CloudflareExecute = (method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', path: string, body?: Record<string, unknown>) => Promise<{
+    status: number;
+    body: any;
+    headers?: Record<string, string>;
+}>;
+export type LiveCloudflareOptions = {
+    fetchImpl?: typeof fetch;
+    budget?: CloudflareBudget;
+    budgetOptions?: CloudflareBudgetOptions;
+};
+/** The single live Cloudflare call site. It is budgeted before fetch and records 429/Retry-After. */
+export declare function liveCloudflareExecute(token: string, base?: string, opts?: LiveCloudflareOptions): CloudflareExecute;
+export declare function mapCloudflareAccount(value: Record<string, unknown>): SyncResource;
+export declare function mapCloudflareZone(value: Record<string, unknown>): SyncResource;
+export declare function mapCloudflareTunnel(value: Record<string, unknown>): SyncResource;
+export declare function mapCloudflareConfiguration(value: Record<string, unknown>): SyncResource;
+export declare function mapCloudflareDnsRecord(value: Record<string, unknown>): SyncResource;
+export declare function pullCloudflareState(execute: CloudflareExecute): Promise<SyncResource[]>;
+/** D7 pull entry point. Defaults to a moving timestamp so A→B→A observations cannot dedupe. */
+export declare function syncCloudflareFromReal(execute: CloudflareExecute, opts?: {
+    root?: string;
+    occurredAt?: string;
+}): Promise<{
+    observed: number;
+    deltasAppended: number;
+}>;
+/** The pack's executor over the kernel's: the same API v4 call, carried by the head. */
+export declare function cloudflareExecuteOver(execute: RemoteExecute): CloudflareExecute;
+/** The refresh adapter: pull the account's control plane through the executor and fold it into the root. */
+export declare function syncCloudflareFromRemote(execute: RemoteExecute, opts?: {
+    root?: string;
+    origin?: string;
+    occurredAt?: string;
+}): Promise<{
+    observed: number;
+    deltasAppended: number;
+}>;
+type PushRequest = {
+    method: 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    path: string;
+    body?: Record<string, unknown>;
+};
+/** The one wire request an entry becomes, or null when the entry is the twin's own (an observation, a
+ *  locally-authored provisioning record) and crosses nothing. `resolve` is the kernel's: a local id that a
+ *  landing already adopted answers as the vendor's, so Cloudflare is asked about its own id, never ours. */
+export declare function cloudflareRequestForAction(action: TwinAction, resolve?: (type: string, localId: string) => string): PushRequest | null;
+/** The perform adapter: one entry crosses to Cloudflare through the executor, and the vendor's own id for what
+ *  it made comes back as the externalId (the kernel adopts it and every declared reference follows). An entry the
+ *  vendor has nothing to write for — an observation, a provisioning record — crosses nothing and keeps its id. */
+export declare function performCloudflareAction(execute: RemoteExecute, action: TwinAction, ctx: PerformContext): Promise<PushOutcome>;
+export {};