@zackbart/connecta 0.15.0 → 0.15.1

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 All notable changes to this package are documented here.
 
+## 0.15.1 — 2026-08-12
+
+The Cloudflare connection now supports legacy user-scoped Global API Keys as
+an explicit authentication mode. Scoped API tokens remain the default. The
+three guarded raw tools still cover the full v4 path space without adding one
+tool per endpoint, and ordinary JSON responses such as GraphQL results now
+survive that path intact.
+
+Nothing breaks for existing deployments. They keep their current API token,
+credential form, verification tool, and 55-tool surface. A deployment that
+needs the legacy scheme opts in and stores the Cloudflare user email and Global
+API Key as separate encrypted fields.
+
+### Added
+
+- **Legacy Cloudflare Global API Key authentication.** Set
+  `authentication: "globalApiKey"` to send operator-managed `X-Auth-Email` and
+  `X-Auth-Key` headers. `verify_global_api_key` checks the pair through
+  Cloudflare's authenticated user endpoint, and raw calls cannot replace either
+  connector-owned header.
+
+### Fixed
+
+- **Raw Cloudflare calls preserve non-envelope JSON.** Endpoints such as
+  `/graphql` return their complete JSON document instead of an undefined
+  `result`.
+
 ## 0.15.0 — 2026-08-10
 
 Discovery now keeps strong action/object near-matches visible beside complete

package/dist/providers/cloudflare.d.ts

@@ -1,6 +1,8 @@
 import type { Connector, ConnectorCredentialConfig } from "../types.js";
 /** Cloudflare's v4 REST base. Override only for a proxy or a test double. */
 export declare const CLOUDFLARE_API_BASE = "https://api.cloudflare.com/client/v4";
+/** Authentication schemes accepted by Cloudflare's v4 API. */
+export type CloudflareAuthentication = "apiToken" | "globalApiKey";
 /**
  * Every DNS record type the records API accepts, for filtering a list.
  * Enumerated in the schema so an agent picks a legal type without reading
@@ -40,7 +42,9 @@ export interface CloudflareOptions {
     zoneId?: string;
     /** API base override for a proxy or a test double. Defaults to the v4 API. */
     baseUrl?: string;
-    /** Credential presentation override; the token is always operator-managed. */
+    /** Authentication scheme. Defaults to the recommended scoped API token. */
+    authentication?: CloudflareAuthentication;
+    /** Credential presentation override; credentials are always operator-managed. */
     credential?: ConnectorCredentialConfig;
     /** Account-specific conventions appended to the maintained provider guide. */
     instructions?: string;

package/dist/providers/cloudflare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/providers/cloudflare.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,SAAS,EAGT,yBAAyB,EAE1B,MAAM,aAAa,CAAC;AAErB,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,yCAAyC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,kLAsB9B,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mCAAmC,yEAStC,CAAC;AAEX,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AA0jHD,mDAAmD;AACnD,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,SAAS,CAiD5E"}
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/providers/cloudflare.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,SAAS,EAGT,yBAAyB,EAE1B,MAAM,aAAa,CAAC;AAErB,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,yCAAyC,CAAC;AAE1E,8DAA8D;AAC9D,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,cAAc,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,kLAsB9B,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mCAAmC,yEAStC,CAAC;AAEX,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,iFAAiF;IACjF,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAmsHD,mDAAmD;AACnD,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,SAAS,CAuG5E"}

package/dist/providers/cloudflare.js

@@ -91,11 +91,52 @@ function admissionPolicy(maxConcurrency) {
         ],
     };
 }
-const DEFAULT_CREDENTIAL = {
+const API_TOKEN_CREDENTIAL = {
     label: "Cloudflare API token",
     description: "A scoped API token (My Profile → API Tokens → Create Token), not a Global API Key. Grant only the permissions the deployment needs: zone-scoped \"Zone Read\", \"Zone Settings Write\", \"DNS Write\", \"Cache Purge\", and the phase-specific Rules product Read permissions as needed; account-scoped \"Workers Scripts Read/Write\", \"Workers KV Storage Read/Write\", \"Workers R2 Storage Read/Write\", or \"Cloudflare Pages Read/Write\" for the platform tools.",
     placeholder: "Paste API token",
 };
+const GLOBAL_API_KEY_CREDENTIAL = {
+    label: "Cloudflare Global API Key",
+    description: "Legacy user-scoped authentication. The key has the same access as its Cloudflare user across every account and zone that user can reach. Prefer a scoped API token when possible.",
+    fields: [
+        {
+            name: "email",
+            label: "Account email",
+            description: "The verified email address for the Cloudflare user that owns the Global API Key.",
+            placeholder: "you@example.com",
+            inputType: "email",
+        },
+        {
+            name: "apiKey",
+            label: "Global API Key",
+            description: "The legacy Global API Key from My Profile → API Tokens.",
+            placeholder: "Paste Global API Key",
+            inputType: "password",
+        },
+    ],
+};
+function credentialConfig(authentication, override) {
+    if (authentication === "apiToken") {
+        const credential = override ?? API_TOKEN_CREDENTIAL;
+        if (credential.fields?.length) {
+            throw new Error("cloudflare() API token authentication requires a single-value credential.");
+        }
+        return credential;
+    }
+    const credential = override
+        ? {
+            ...GLOBAL_API_KEY_CREDENTIAL,
+            ...override,
+            fields: override.fields ?? GLOBAL_API_KEY_CREDENTIAL.fields,
+        }
+        : GLOBAL_API_KEY_CREDENTIAL;
+    const fields = credential.fields?.map((field) => field.name).sort();
+    if (fields?.join(",") !== "apiKey,email") {
+        throw new Error('cloudflare() Global API Key authentication requires credential fields named "email" and "apiKey".');
+    }
+    return credential;
+}
 function asRecord(value) {
     return value && typeof value === "object" && !Array.isArray(value)
         ? value
@@ -188,7 +229,7 @@ function failureFor(status, headers, errors) {
     }
     const authCoded = [...codes].some((code) => AUTH_ERROR_CODES.has(code));
     if (status === 401 || status === 403 || authCoded) {
-        return new ConnectorCallError("auth_required", `Cloudflare rejected the API token (HTTP ${status}). ${detail} Check that the token is valid and carries the permission this call needs.`);
+        return new ConnectorCallError("auth_required", `Cloudflare rejected the configured credential (HTTP ${status}). ${detail} Check that it is valid and has permission to access this resource.`);
     }
     if (status === 400 || status === 409 || status === 422) {
         return new ConnectorCallError("invalid_args", `Cloudflare rejected the request (HTTP ${status}). ${detail}`);
@@ -201,12 +242,25 @@ function failureFor(status, headers, errors) {
     }
     return new ConnectorCallError("connector_call_failed", `Cloudflare request failed (HTTP ${status}). ${detail}`);
 }
-async function readToken(ctx) {
+const AUTHENTICATION_CONTEXT = Symbol("cloudflareAuthentication");
+function withAuthentication(ctx, authentication) {
+    return { ...ctx, [AUTHENTICATION_CONTEXT]: authentication };
+}
+async function readAuthenticationHeaders(ctx) {
+    if (ctx[AUTHENTICATION_CONTEXT] === "globalApiKey") {
+        const values = await ctx.credential?.getAll();
+        const email = values?.["email"];
+        const apiKey = values?.["apiKey"];
+        if (!email || !apiKey) {
+            throw new ConnectorCallError("auth_required", "No Cloudflare Global API Key and account email are configured for this connector. An operator must add both before any call can run.");
+        }
+        return { "X-Auth-Email": email, "X-Auth-Key": apiKey };
+    }
     const token = await ctx.credential?.get();
     if (!token) {
         throw new ConnectorCallError("auth_required", "No Cloudflare API token is configured for this connector. An operator must add one before any call can run.");
     }
-    return token;
+    return { Authorization: `Bearer ${token}` };
 }
 function buildUrl(base, spec) {
     const url = new URL(`${base.replace(/\/+$/, "")}${spec.path}`);
@@ -218,7 +272,7 @@ function buildUrl(base, spec) {
     return url.toString();
 }
 async function fetchCloudflare(base, spec, ctx) {
-    const token = await readToken(ctx);
+    const authenticationHeaders = await readAuthenticationHeaders(ctx);
     if (spec.body !== undefined && spec.rawBody !== undefined) {
         throw new Error("A Cloudflare request cannot have both JSON and raw bodies.");
     }
@@ -227,7 +281,7 @@ async function fetchCloudflare(base, spec, ctx) {
         response = await fetch(buildUrl(base, spec), {
             method: spec.method,
             headers: {
-                Authorization: `Bearer ${token}`,
+                ...authenticationHeaders,
                 Accept: "application/json",
                 ...(spec.body !== undefined
                     ? { "Content-Type": "application/json" }
@@ -263,9 +317,16 @@ async function callCloudflare(base, spec, ctx) {
     if (!response.ok || envelope.success === false) {
         throw failureFor(response.status, response.headers, errors);
     }
+    const isV4Envelope = "success" in envelope ||
+        "result" in envelope ||
+        "result_info" in envelope ||
+        "messages" in envelope;
     return {
-        result: envelope.result,
-        resultInfo: envelope.result_info,
+        // `/graphql` and a small number of product APIs return ordinary JSON
+        // instead of the standard v4 envelope. Preserve that document whole so
+        // the raw tools cover them too.
+        result: isV4Envelope ? envelope.result : envelope,
+        resultInfo: isV4Envelope ? envelope.result_info : undefined,
     };
 }
 function base64FromBytes(bytes) {
@@ -787,6 +848,8 @@ function headersFromArgs(value) {
     const headers = {};
     const forbidden = new Set([
         "authorization",
+        "x-auth-email",
+        "x-auth-key",
         "cookie",
         "host",
         "content-length",
@@ -924,53 +987,82 @@ const R2_OBJECT_SCHEMA = {
     },
     required: ["key"],
 };
-function buildTools(scope) {
+function buildTools(scope, authentication) {
     const { base } = scope;
     const zoneArg = (args) => requireScope(args["zoneId"], scope.zoneId, "zoneId");
     const accountArg = (args) => requireScope(args["accountId"], scope.accountId, "accountId");
     const readOnly = { readOnlyHint: true, destructiveHint: false };
-    return [
-        {
-            name: "verify_api_token",
-            description: "Verify the configured Cloudflare API token and report its status. Use this first when any other tool fails with an authentication error, to separate a bad token from a missing permission.",
-            annotations: readOnly,
-            inputSchema: {
-                type: "object",
-                properties: {},
-                required: [],
-                additionalProperties: false,
-            },
-            outputSchema: {
-                type: "object",
-                properties: {
-                    id: { type: "string" },
-                    status: {
-                        type: "string",
-                        description: "\"active\" for a usable token.",
+    const tools = [
+        authentication === "apiToken"
+            ? {
+                name: "verify_api_token",
+                description: "Verify the configured Cloudflare API token and report its status. Use this first when any other tool fails with an authentication error, to separate a bad token from a missing permission.",
+                annotations: readOnly,
+                inputSchema: {
+                    type: "object",
+                    properties: {},
+                    required: [],
+                    additionalProperties: false,
+                },
+                outputSchema: {
+                    type: "object",
+                    properties: {
+                        id: { type: "string" },
+                        status: {
+                            type: "string",
+                            description: "\"active\" for a usable token.",
+                        },
+                        notBefore: { type: "string" },
+                        expiresOn: { type: "string" },
+                    },
+                    required: ["status"],
+                },
+                handler: async (_args, ctx) => {
+                    const { result } = await callCloudflare(base, { method: "GET", path: "/user/tokens/verify" }, ctx);
+                    const token = asRecord(result);
+                    return {
+                        id: token["id"],
+                        status: token["status"],
+                        ...(token["not_before"] !== undefined
+                            ? { notBefore: token["not_before"] }
+                            : {}),
+                        ...(token["expires_on"] !== undefined
+                            ? { expiresOn: token["expires_on"] }
+                            : {}),
+                    };
+                },
+            }
+            : {
+                name: "verify_global_api_key",
+                description: "Verify the configured Cloudflare Global API Key and account email by retrieving the authenticated user. Use this first when another tool fails with an authentication error.",
+                annotations: readOnly,
+                inputSchema: {
+                    type: "object",
+                    properties: {},
+                    required: [],
+                    additionalProperties: false,
+                },
+                outputSchema: {
+                    type: "object",
+                    properties: {
+                        id: { type: "string" },
+                        email: { type: "string" },
+                        status: {
+                            type: "string",
+                            description: "\"active\" when Cloudflare accepts the email and key.",
+                        },
                     },
-                    notBefore: { type: "string" },
-                    expiresOn: { type: "string" },
+                    required: ["email", "status"],
+                },
+                handler: async (_args, ctx) => {
+                    const { result } = await callCloudflare(base, { method: "GET", path: "/user" }, ctx);
+                    const user = asRecord(result);
+                    return { id: user["id"], email: user["email"], status: "active" };
                 },
-                required: ["status"],
-            },
-            handler: async (_args, ctx) => {
-                const { result } = await callCloudflare(base, { method: "GET", path: "/user/tokens/verify" }, ctx);
-                const token = asRecord(result);
-                return {
-                    id: token["id"],
-                    status: token["status"],
-                    ...(token["not_before"] !== undefined
-                        ? { notBefore: token["not_before"] }
-                        : {}),
-                    ...(token["expires_on"] !== undefined
-                        ? { expiresOn: token["expires_on"] }
-                        : {}),
-                };
             },
-        },
         {
             name: "cloudflare_api_get",
-            description: "Call any GET endpoint under Cloudflare's v4 API with this connector's token. Use a named tool when one exists; use this read-only escape hatch for Images, Stream, Email Routing, D1, Queues, Access, Tunnels, Analytics, and newer product endpoints the curated surface does not yet name.",
+            description: "Call any GET endpoint under Cloudflare's v4 API with this connector's credential. Use a named tool when one exists; use this read-only escape hatch for Images, Stream, Email Routing, D1, Queues, Access, Tunnels, Analytics, and newer product endpoints the curated surface does not yet name.",
             annotations: readOnly,
             inputSchema: {
                 type: "object",
@@ -1030,7 +1122,7 @@ function buildTools(scope) {
         },
         {
             name: "cloudflare_api_mutate",
-            description: "Call any JSON POST, PUT, PATCH, or DELETE endpoint under Cloudflare's v4 API with this connector's token. This is the approval-gated escape hatch for managing Cloudflare products without waiting for a named tool. It does not support multipart or binary uploads.",
+            description: "Call any JSON POST, PUT, PATCH, or DELETE endpoint under Cloudflare's v4 API with this connector's credential. This is the approval-gated escape hatch for managing Cloudflare products without waiting for a named tool. It does not support multipart or binary uploads.",
             annotations: { readOnlyHint: false, destructiveHint: true },
             inputSchema: {
                 type: "object",
@@ -3132,8 +3224,12 @@ function buildTools(scope) {
             },
         },
     ];
+    return tools.map((tool) => ({
+        ...tool,
+        handler: (args, ctx) => tool.handler(args, withAuthentication(ctx, authentication)),
+    }));
 }
-function usageGuide(purpose, scope, instructions) {
+function usageGuide(purpose, scope, instructions, authentication) {
     const accountInstructions = instructions?.trim();
     const zoneLine = scope.zoneId
         ? `This connector defaults to zone \`${scope.zoneId}\`; omit \`zoneId\` unless the request names a different domain.`
@@ -3141,6 +3237,9 @@ function usageGuide(purpose, scope, instructions) {
     const accountLine = scope.accountId
         ? `It defaults to account \`${scope.accountId}\`; omit \`accountId\` unless the request names a different account.`
         : "It declares no default account. `list_accounts` supplies the `accountId` the Workers, KV, R2, and Pages tools need.";
+    const authenticationLine = authentication === "apiToken"
+        ? "The API token is operator-managed and scoped by permission. An `auth_required` failure means the token is missing, invalid, or lacks that call's permission. Call `verify_api_token` first."
+        : "The Global API Key and account email are operator-managed. The key has the same access as its Cloudflare user. An `auth_required` failure means one field is missing, the pair is invalid, or the user lacks access. Call `verify_global_api_key` first.";
     return `# Cloudflare usage
 
 Account purpose: ${purpose}
@@ -3148,11 +3247,11 @@ Account purpose: ${purpose}
 - ${zoneLine}
 - ${accountLine}
 - Prefer a named tool: its schema is complete, projected, and enough to call it without provider documentation. For an operation without a named tool, use \`cloudflare_api_get\` for GET, \`cloudflare_api_mutate\` for JSON POST/PUT/PATCH/DELETE, or \`cloudflare_api_upload\` for raw and multipart content. Raw tools take a path below \`/client/v4\`; their argument schemas are complete, but endpoint-specific query, header, and body fields come from Cloudflare's API reference. Use \`headers\` for endpoint-specific controls such as \`cf-r2-jurisdiction\`, ETags, and object metadata; authentication, host, content type, and request framing remain connector-owned.
-- The raw tools cover the wider control plane without weakening routing: GET is explicitly read-only; every mutation and upload is destructive and must cross the host's approval boundary. The API token remains the hard provider-side permission boundary. Absolute URLs, traversal, and query strings embedded in \`path\` are refused locally.
+- The raw tools cover the wider control plane without weakening routing: GET is explicitly read-only; every mutation and upload is destructive and must cross the host's approval boundary. The configured Cloudflare credential remains the hard provider-side permission boundary. Absolute URLs, traversal, and query strings embedded in \`path\` are refused locally.
 - Useful raw paths include \`/accounts/{accountId}/images/v1\` (Images), \`/accounts/{accountId}/stream\` (Stream), \`/zones/{zoneId}/email/routing/rules\` (Email Routing), \`/accounts/{accountId}/d1/database\` (D1), and \`/accounts/{accountId}/queues\` (Queues). On GET, use \`responseType: "text"\` or \`"base64"\` for non-JSON content. Direct-upload endpoints can issue upload URLs; \`cloudflare_api_upload\` can also send explicit text, base64 bytes, or multipart fields/files.
 - Lists paginate with \`page\` and \`perPage\` and return a \`page\` object; request the next page only when \`page.hasMore\` is true. \`list_zone_rulesets\`, \`list_r2_buckets\`, \`list_r2_objects\`, and \`list_kv_keys\` instead return \`nextCursor\`; \`list_worker_scripts\` is unpaginated.
 - Results are projected to the fields that identify and describe a resource. Pass \`raw: true\` on a read when you genuinely need a field the projection drops.
-- The API token is operator-managed and scoped by permission, not by role. An \`auth_required\` failure means the token is missing, invalid, or lacks that call's permission — it is never fixed by retrying. Call \`verify_api_token\` to tell a dead token from a missing permission, then report which permission is needed rather than trying other tools.
+- ${authenticationLine}
 - A \`rate_limited\` failure carries the wait window. Cloudflare's limit is 1,200 requests per five minutes per user, counted across the dashboard and every token, so do not fan out speculatively; filter server-side with \`name\`, \`type\`, and \`content\` instead of listing everything and filtering locally.
 - Named creates that only add a resource are write-routed without claiming destruction. Updates, overwrites, deletes, rollbacks, cache purges, \`cloudflare_api_mutate\`, and \`cloudflare_api_upload\` are destructive. Read current state before changing it, and prefer a targeted \`purge_cache\` over \`everything\`.
 ${accountInstructions
@@ -3169,6 +3268,10 @@ export function cloudflare(id, options) {
     if (!Number.isInteger(maxConcurrency) || maxConcurrency < 1) {
         throw new Error("cloudflare() maxConcurrency must be a positive integer.");
     }
+    const authentication = options.authentication ?? "apiToken";
+    if (authentication !== "apiToken" && authentication !== "globalApiKey") {
+        throw new Error('cloudflare() authentication must be "apiToken" or "globalApiKey".');
+    }
     const scope = {
         base: options.baseUrl?.trim() || CLOUDFLARE_API_BASE,
         accountId: options.accountId?.trim() || undefined,
@@ -3177,34 +3280,64 @@ export function cloudflare(id, options) {
     return api(id, {
         title: options.title ?? "Cloudflare",
         description: `Cloudflare control-plane access for zones, DNS, Workers, KV, R2, Pages, media, email, and other v4 APIs — ${purpose}`,
-        credential: options.credential ?? DEFAULT_CREDENTIAL,
+        credential: credentialConfig(authentication, options.credential),
         callAdmission: admissionPolicy(maxConcurrency),
-        usageGuide: usageGuide(purpose, scope, options.instructions),
+        usageGuide: usageGuide(purpose, scope, options.instructions, authentication),
         // The schemas are hand-written and closed; a schema that cannot be
         // enforced is a bug in this file, not input to pass through.
         strictValidation: true,
         ...(options.maxResultBytes !== undefined
             ? { maxResultBytes: options.maxResultBytes }
             : {}),
-        tools: buildTools(scope),
-        async testCredential(value, ctx) {
-            try {
-                const { result } = await callCloudflare(scope.base, { method: "GET", path: "/user/tokens/verify" }, {
-                    ...ctx,
-                    credential: { get: async () => value, getAll: async () => ({ value }) },
-                });
-                const status = asRecord(result)["status"];
-                return status === "active"
-                    ? { ok: true, message: "Token verified: active." }
-                    : { ok: false, message: `Token status is "${String(status)}".` };
-            }
-            catch (error) {
-                return {
-                    ok: false,
-                    message: error instanceof Error ? error.message : String(error),
-                };
+        tools: buildTools(scope, authentication),
+        ...(authentication === "apiToken"
+            ? {
+                async testCredential(value, ctx) {
+                    try {
+                        const { result } = await callCloudflare(scope.base, { method: "GET", path: "/user/tokens/verify" }, withAuthentication({
+                            ...ctx,
+                            credential: {
+                                get: async () => value,
+                                getAll: async () => ({ value }),
+                            },
+                        }, authentication));
+                        const status = asRecord(result)["status"];
+                        return status === "active"
+                            ? { ok: true, message: "Token verified: active." }
+                            : { ok: false, message: `Token status is "${String(status)}".` };
+                    }
+                    catch (error) {
+                        return {
+                            ok: false,
+                            message: error instanceof Error ? error.message : String(error),
+                        };
+                    }
+                },
             }
-        },
+            : {
+                async testCredentials(values, ctx) {
+                    try {
+                        const { result } = await callCloudflare(scope.base, { method: "GET", path: "/user" }, withAuthentication({
+                            ...ctx,
+                            credential: {
+                                get: async (field) => field ? values[field] ?? null : null,
+                                getAll: async () => values,
+                            },
+                        }, authentication));
+                        const email = asRecord(result)["email"];
+                        return {
+                            ok: true,
+                            message: `Global API Key verified for ${String(email)}.`,
+                        };
+                    }
+                    catch (error) {
+                        return {
+                            ok: false,
+                            message: error instanceof Error ? error.message : String(error),
+                        };
+                    }
+                },
+            }),
     });
 }
 //# sourceMappingURL=cloudflare.js.map