@zackbart/connecta 0.34.0 → 0.35.0

package/dist/providers/cloudflare/index.d.ts

@@ -1,9 +1,6 @@
-import type { ConnectorCallAdmissionPolicy } from "../../types.js";
-import { type CloudflarePin } from "./rest.js";
-export { CLOUDFLARE_API_BASE } from "./rest.js";
-export type { CloudflarePin } from "./rest.js";
-/** Cloudflare's official whole-API hosted MCP endpoint. */
-export declare const CLOUDFLARE_MCP_ENDPOINT = "https://mcp.cloudflare.com/mcp";
+import type { CloudflarePin } from "./lib/config.js";
+export { CLOUDFLARE_API_BASE } from "./lib/config.js";
+export type { CloudflarePin } from "./lib/config.js";
 interface CloudflareCommonOptions {
     /** Human-readable display name; defaults identify the implementation. */
     title?: string;
@@ -15,14 +12,8 @@ interface CloudflareCommonOptions {
     instructions?: string;
     /** Connector-specific inline result limit; omit to inherit the deployment. */
     maxResultBytes?: number;
-}
-/** Cloudflare's hosted MCP server (`search` and `execute`) over OAuth. */
-export interface CloudflareOAuthOptions extends CloudflareCommonOptions {
-    auth: {
-        type: "oauth";
-    };
-    /** Optional per-runtime downstream call-admission policy. */
-    callAdmission?: ConnectorCallAdmissionPolicy;
+    /** Serve only read-classified tools on every endpoint. Defaults to false. */
+    readOnly?: boolean;
 }
 interface CloudflareKeyOptions extends CloudflareCommonOptions {
     /**
@@ -62,12 +53,6 @@ export interface CloudflareGlobalApiKeyOptions extends CloudflareKeyOptions {
     /** Accept every account and zone the key's user can reach. */
     unpinned?: true;
 }
-export type CloudflareOptions = CloudflareOAuthOptions | CloudflareApiTokenOptions | CloudflareGlobalApiKeyOptions;
-/**
- * A maintained Cloudflare connection. `auth` selects the implementation:
- * OAuth reaches Cloudflare's hosted MCP server; an API token or a Global API
- * Key reaches Connecta's REST connector to the v4 API.
- */
+export type CloudflareOptions = CloudflareApiTokenOptions | CloudflareGlobalApiKeyOptions;
+/** Maintained API connection. Hosted MCP uses a separate generic remoteMcp entry. */
 export declare const cloudflare: import("../../provider.js").ProviderFactory<CloudflareOptions>;
-/** @deprecated Read `cloudflare.definition.classify` instead. Kept for existing imports. */
-export declare const CLOUDFLARE_MCP_VETTED_CATALOG: import("../../catalog-drift.js").VettedCatalog;

package/dist/providers/cloudflare/index.js

@@ -1,22 +1,11 @@
 import { skill } from "./skill.generated.js";
-/**
- * No official `cloudflare` SDK on purpose. Cloudflare's v4 API is
- * authenticated `fetch` over a uniform `{ success, errors, result,
- * result_info }` envelope, and the key connector validates every call against
- * a pinned operation index instead of typed wrappers, so Web APIs alone keep
- * this provider Workers-clean. `test/package-surface.node.test.ts` pins it: no
- * `cloudflare` package in any dependency field, every import relative.
- */
-import { apiConnector } from "../../connectors/api-connector.js";
-import { reviewedCatalog } from "../../catalog-drift.js";
 import { keys, optionsOf, variants } from "../../config-schema.js";
-import { CALL_ADMISSION, defineProvider } from "../../provider.js";
-import { byAuth, hostedOAuth } from "../_shared/rest/dispatch.js";
-import { restTools } from "../_shared/rest/tools.js";
-import { CLOUDFLARE_API_BASE, cloudflareRest } from "./rest.js";
-export { CLOUDFLARE_API_BASE } from "./rest.js";
-/** Cloudflare's official whole-API hosted MCP endpoint. */
-export const CLOUDFLARE_MCP_ENDPOINT = "https://mcp.cloudflare.com/mcp";
+import { CALL_ADMISSION } from "../../provider.js";
+import { defineApiProvider } from "../../http/provider.js";
+import { CloudflareApi, authenticate, cloudflareErrors, cloudflareRuntime, MAX_RESPONSE_BYTES, READ_CAP_MS, safety, result, describeProbe, settings, cloudflareIndex, WRITE_STEPS, UPLOADS, } from "./api.js";
+import { cloudflareTools } from "./tools.js";
+import { CLOUDFLARE_VERDICTS, CLOUDFLARE_PAGES, CLOUDFLARE_HEADERS, cloudflareBinding } from "./lib/hatch.js";
+export { CLOUDFLARE_API_BASE } from "./lib/config.js";
 /**
  * Cloudflare documents a global limit of 1,200 requests per five minutes per
  * user, counted cumulatively across the dashboard, API keys, and API tokens
@@ -61,71 +50,12 @@ const GLOBAL_API_KEY_CREDENTIAL = {
         },
     ],
 };
-/**
- * Reviewed in #705's provider audit against https://developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/.
- * Classifies the hosted OAuth catalog only; the REST connector annotates
- * each tool it authors.
- */
-const CLOUDFLARE_MCP_CLASSIFICATION = {
-    tools: {
-        search: {
-            verdict: "read",
-            reason: "Searches the Cloudflare OpenAPI contract without executing API methods.",
-        },
-        execute: {
-            verdict: "destructive",
-            reason: "Can mix HTTP methods across the Cloudflare API; no input schema proves a program only reads.",
-        },
-    },
-};
-function instructionsSection(instructions) {
-    const text = instructions?.trim();
-    return text ? `\n## ${skill.instructionsHeading}\n\n${text}\n` : "";
-}
-function oauthUsageGuide(purpose, instructions) {
-    const { oauth, shared, oauth_tail } = skill.fragments;
-    return `# Cloudflare usage
-
-Hosted MCP over OAuth: \`search\` and \`execute\`. Connector purpose: ${purpose}${oauth}${shared}${oauth_tail}${instructionsSection(instructions)}`;
-}
-function idList(ids) {
-    return ids?.length ? ids.map((id) => `\`${id}\``).join(", ") : "none";
-}
-function keyUsageGuide(auth, options) {
-    const { key, global_warning, shared, key_tail } = skill.fragments;
-    const scheme = auth === "apiToken" ? "a scoped API token" : "a Global API Key";
-    const pinned = options.pin
-        ? [
-            options.pin.accountIds?.length ? `accounts ${idList(options.pin.accountIds)} and every zone in them` : "",
-            options.pin.zoneIds?.length ? `zones ${idList(options.pin.zoneIds)}` : "",
-        ].filter(Boolean)
-        : [];
-    const pin = options.pin
-        ? `\n\nPinned to ${pinned.join(", plus ")}. Calls naming any other account or zone are refused before they are sent, and so is every operation that names neither, except the credential's own user, the filtered account, zone, and membership lists, zone creation in a pinned account, and public data.`
-        : auth === "globalApiKey"
-            ? "\n\nUnpinned: this connector reaches every account and zone the key's user can."
-            : "";
-    const defaults = [
-        options.accountId ? `\`{account_id}\` in a path fills with \`${options.accountId}\`` : "",
-        options.zoneId ? `\`{zone_id}\` fills with \`${options.zoneId}\`` : "",
-    ].filter(Boolean);
-    const defaultLine = defaults.length
-        ? `\n\nDefaults: ${defaults.join("; ")}. Pass another id in the path when the request names a different one.`
-        : "";
-    return `# Cloudflare usage
-
-REST with ${scheme}. Connector purpose: ${options.purpose}${auth === "globalApiKey" ? global_warning.trimEnd() : ""}${pin}${defaultLine}${key}${shared}${key_tail}${instructionsSection(options.instructions)}`;
-}
-const COMMON = keys("title", "authScope", "purpose", "instructions", "maxResultBytes");
+const COMMON = keys("title", "authScope", "purpose", "instructions", "maxResultBytes", "readOnly");
 const KEY_COMMON = keys("accountId", "zoneId", "baseUrl", "maxConcurrency");
 const PIN = optionsOf()(keys("accountIds", "zoneIds"));
 /** The closed options cloudflare() accepts, selected by `auth.type`; see `assertKnownOptions`. */
 const CLOUDFLARE_OPTIONS = variants(["auth", "type"], {
-    oauth: optionsOf()({
-        ...COMMON,
-        callAdmission: CALL_ADMISSION,
-        auth: optionsOf()(keys("type")),
-    }).shape,
+    oauth: { ...COMMON, callAdmission: CALL_ADMISSION, auth: optionsOf()(keys("type")) },
     apiToken: optionsOf()({
         ...COMMON,
         ...KEY_COMMON,
@@ -139,130 +69,86 @@ const CLOUDFLARE_OPTIONS = variants(["auth", "type"], {
         pin: PIN,
         auth: optionsOf()(keys("type")),
     }).shape,
-});
-function cloudflareOAuth(id, options, provider) {
-    return hostedOAuth(id, provider, {
-        url: CLOUDFLARE_MCP_ENDPOINT,
-        title: options.title ?? "Cloudflare (MCP)",
-        description: `Cloudflare's official whole-API MCP interface: ${options.purpose.trim()}`,
-        ...(options.callAdmission !== undefined ? { callAdmission: options.callAdmission } : {}),
-        usageGuide: {
-            content: oauthUsageGuide(options.purpose.trim(), options.instructions),
-            summary: "Hosted MCP over OAuth. Search the OpenAPI document; execute programs always classify as writes.",
-            required: true,
-        },
-    });
-}
-function idsOf(id, value, path) {
-    if (value === undefined)
-        return undefined;
-    if (!Array.isArray(value) ||
-        value.length === 0 ||
-        !value.every((item) => typeof item === "string" && item.trim() !== "")) {
-        throw new Error(`cloudflare("${id}") ${path} must be a non-empty list of ids.`);
-    }
-    return value.map((item) => item.trim());
-}
-function optionalId(id, value, path) {
-    if (value === undefined)
-        return undefined;
-    if (typeof value !== "string" || value.trim() === "" || /[/?#\s]/.test(value.trim())) {
-        throw new Error(`cloudflare("${id}") ${path} must be a Cloudflare id.`);
-    }
-    return value.trim();
-}
-function cloudflareKey(auth) {
-    return (id, options, provider) => {
-        const maxConcurrency = options.maxConcurrency ?? 6;
-        if (!Number.isInteger(maxConcurrency) || maxConcurrency < 1) {
-            throw new Error(`cloudflare("${id}") maxConcurrency must be a positive integer.`);
-        }
-        let pin;
-        if (options.pin !== undefined) {
-            const accountIds = idsOf(id, options.pin.accountIds, "pin.accountIds");
-            const zoneIds = idsOf(id, options.pin.zoneIds, "pin.zoneIds");
-            if (!accountIds && !zoneIds)
-                throw new Error(`cloudflare("${id}") pin names accountIds, zoneIds, or both.`);
-            pin = {
-                ...(accountIds ? { accountIds } : {}),
-                ...(zoneIds ? { zoneIds } : {}),
-            };
-        }
-        if (auth === "globalApiKey") {
-            const unpinned = options.unpinned;
-            if (unpinned !== undefined && unpinned !== true) {
-                throw new Error(`cloudflare("${id}") unpinned must be true when set.`);
-            }
-            if (pin && unpinned)
-                throw new Error(`cloudflare("${id}") takes pin or unpinned: true, not both.`);
-            if (!pin && !unpinned) {
-                throw new Error(`cloudflare("${id}") requires pin: { accountIds, zoneIds } with globalApiKey auth, or unpinned: true: a Global API Key reaches every account and zone its user can.`);
-            }
-        }
-        const accountId = optionalId(id, options.accountId, "accountId");
-        const zoneId = optionalId(id, options.zoneId, "zoneId");
-        if (pin && accountId && pin.accountIds && !pin.accountIds.includes(accountId)) {
-            throw new Error(`cloudflare("${id}") accountId ${accountId} is outside its pin.`);
-        }
-        if (pin && zoneId && pin.zoneIds && !pin.accountIds && !pin.zoneIds.includes(zoneId)) {
-            throw new Error(`cloudflare("${id}") zoneId ${zoneId} is outside its pin.`);
-        }
-        const purpose = options.purpose.trim();
-        const rest = cloudflareRest({
-            auth,
-            baseUrl: options.baseUrl?.trim() || CLOUDFLARE_API_BASE,
-            accountId,
-            zoneId,
-            pin,
-        });
-        return apiConnector(id, {
-            ...provider.connectorOptions,
-            title: options.title ?? (auth === "globalApiKey" ? "Cloudflare (Global API Key)" : "Cloudflare"),
-            description: `Cloudflare v4 API over REST (${auth === "globalApiKey" ? "Global API Key" : "API token"}${pin ? ", pinned" : ""}) — ${purpose}`,
-            credential: auth === "globalApiKey" ? GLOBAL_API_KEY_CREDENTIAL : API_TOKEN_CREDENTIAL,
+}, undefined, ["oauth"]);
+function usageGuide(options) {
+    const { auth, accountId, zoneId, pin } = settings(options);
+    return {
+        heading: "Cloudflare usage",
+        summary: "Configured Cloudflare REST credential: resolve domain/account ids, then inspect DNS, Workers, R2, KV or analytics.",
+        context: [
+            `Connector purpose: ${options.purpose}`,
+            `This connection already has an operator-configured ${auth === "apiToken" ? "scoped API token" : "Global API Key"}; there is no sign-in step.`,
             ...(auth === "globalApiKey"
-                ? { testCredentials: rest.testCredentials }
-                : { testCredential: rest.testCredential }),
-            callAdmission: admissionPolicy(maxConcurrency),
-            usageGuide: {
-                content: keyUsageGuide(auth, {
-                    purpose,
-                    ...(accountId ? { accountId } : {}),
-                    ...(zoneId ? { zoneId } : {}),
-                    ...(pin ? { pin } : {}),
-                    ...(options.instructions !== undefined ? { instructions: options.instructions } : {}),
-                }),
-                summary: auth === "globalApiKey"
-                    ? "GLOBAL API KEY: the user's whole estate, limited by pin. Search operations, read details, then read or write."
-                    : "Scoped API token over REST. Search operations, read details, then read or write; uploads and GraphQL are named tools.",
-            },
-            tools: [...restTools(rest.vendor), ...rest.tools],
-        });
+                ? [
+                    "A Global API Key acts as its user across the user's estate. R2 requires an API token; user-setting and membership writes are refused.",
+                ]
+                : []),
+            ...(pin
+                ? [
+                    `Pin: account ids ${pin.accountIds?.join(", ") || "none"}; zone ids ${pin.zoneIds?.join(", ") || "none"}. A pinned account includes its zones. Calls outside this boundary are refused.`,
+                ]
+                : ["No additional deployment pin: the credential's vendor permissions define its reachable estate."]),
+            ...(accountId ? [`Default account id: ${accountId}.`] : []),
+            ...(zoneId ? [`Default zone id: ${zoneId}.`] : []),
+            ...(options.readOnly ? ["This connection is read-only: every write is refused."] : []),
+        ],
+        required: true,
     };
 }
-/**
- * A maintained Cloudflare connection. `auth` selects the implementation:
- * OAuth reaches Cloudflare's hosted MCP server; an API token or a Global API
- * Key reaches Connecta's REST connector to the v4 API.
- */
-export const cloudflare = defineProvider({
+/** Maintained API connection. Hosted MCP uses a separate generic remoteMcp entry. */
+export const cloudflare = defineApiProvider({
     name: "cloudflare",
     title: "Cloudflare",
-    kind: "dual",
     readme: "Cloudflare",
     bundle: {
-        baselineGzip: 334055,
-        maxGzip: 394055,
-        note: "./providers/cloudflare remeasures at 334,055 B gzip (#801), from 151,186 B on main: auth now selects the implementation, so the entry carries the hosted MCP client and Connecta's REST connector (api(), the schema validator, the shared REST module, about 22 KB gzip as in ./providers/stripe) plus the pinned Cloudflare operation index: 3,336 non-deprecated operations from a 27 MB document. The index was shrunk before the cap moved, from 157 KB to 125 KB gzip as source: request details to depth 2 without descriptions or enums over 50 values, no operation ids (they restate summaries), no plain-string path parameters (the template names them), and a 6,000-character per-operation budget that lowers one sprawling operation's depth. Depth 1 would save about 18 KB more at the cost of nested validation such as DNS record alternatives. Removing 23 hand-written reads offsets part of the growth; the reviewed value-safety table adds about 12 KB. The value-safety consolidation (#801) moved the spec-derived candidate record out of the index and grew the table by 259 verdicts, a net +3,646 B (337,701 B), inside the cap. The cap uses the existing baseline + 60,000 B policy.",
+        baselineGzip: 597127,
+        note: "./providers/cloudflare merged GitHub/Cloudflare/CCB step-2 snapshot measures 597,127 B gzip standalone before recording these bundle facts, versus 528,947 B on main ce0c7492 (Node 26.12.0, zlib-ng 1.3.1, gzip level 9). The standard hatch, response-field metadata, retained 120-character parameter descriptions and numeric bounds account for this reviewed growth. The shared Effect kit is paid once per deployment; provider entries are report-only, not capped (#899).",
     },
     skill,
     options: CLOUDFLARE_OPTIONS,
-    classify: CLOUDFLARE_MCP_CLASSIFICATION,
-    create: byAuth({
-        oauth: cloudflareOAuth,
-        apiToken: cloudflareKey("apiToken"),
-        globalApiKey: cloudflareKey("globalApiKey"),
-    }),
+    vendor: CloudflareApi,
+    baseUrl: (options) => settings(options).baseUrl,
+    displayTitle: (options) => (options.auth.type === "globalApiKey" ? "Cloudflare (Global API Key)" : "Cloudflare"),
+    description: (options) => `Cloudflare v4 API over REST (${options.auth.type === "globalApiKey" ? "Global API Key" : "API token"}${settings(options).pin ? ", pinned" : ""}) — ${options.purpose}`,
+    maxResponseBytes: MAX_RESPONSE_BYTES,
+    timeoutMs: READ_CAP_MS,
+    defaultCallAdmission: (options) => admissionPolicy(options.maxConcurrency ?? 6),
+    credential: (options) => (options.auth.type === "globalApiKey" ? GLOBAL_API_KEY_CREDENTIAL : API_TOKEN_CREDENTIAL),
+    authenticate,
+    errors: cloudflareErrors,
+    inBandRefusals: true,
+    idempotencyKey: false,
+    pageSize: { default: 20, max: 50 },
+    safety,
+    result,
+    probe: {
+        run: (connection, options) => cloudflareRuntime(connection, settings(options)).verify(),
+        describe: describeProbe,
+    },
+    guide: usageGuide,
+    hatch: {
+        name: "cloudflare",
+        title: "Cloudflare",
+        index: cloudflareIndex,
+        verdicts: CLOUDFLARE_VERDICTS,
+        named: {
+            ...Object.fromEntries(UPLOADS.map(([method, path]) => [`${method} ${path}`, "cloudflare_api_upload"])),
+            "GET /accounts": "list_accounts",
+            "GET /zones": "list_zones",
+            "GET /user/tokens/verify": "verify_credential",
+        },
+        fieldsRoot: "result",
+        pageCursor: "parameter",
+        headers: CLOUDFLARE_HEADERS,
+        textBodies: true,
+        writeSteps: WRITE_STEPS,
+        pages: CLOUDFLARE_PAGES,
+        binding: cloudflareBinding,
+        pathExample: "/zones/023e105f4ecef8ad9ca31a8372d0c353/dns_records",
+        notes: () => ({
+            read: 'DNS records, zones, Workers scripts, R2 buckets and objects, KV namespaces and keys are covered. Data retains the Cloudflare envelope; use fields:["result.id","result.name"]. Pass page.nextCursor in page.param within page.in, preserving the other arguments. Text/SQL reads take a string body.',
+            write: "Create, update or delete DNS records, purge cache URLs, deploy Workers and change KV/R2 state here. Reviewed uploads use cloudflare_api_upload; JSON, text/SQL and NDJSON writes retain their documented wire formats.",
+        }),
+    },
+    tools: cloudflareTools,
 });
-/** @deprecated Read `cloudflare.definition.classify` instead. Kept for existing imports. */
-export const CLOUDFLARE_MCP_VETTED_CATALOG = reviewedCatalog(cloudflare.definition.classify, 'defineProvider("cloudflare")');

package/dist/providers/cloudflare/lib/config.d.ts

@@ -0,0 +1,16 @@
+/** Cloudflare's v4 REST base. Override only for a proxy or a test double. */
+export declare const CLOUDFLARE_API_BASE = "https://api.cloudflare.com/client/v4";
+/** The two key schemes Cloudflare's v4 API accepts. */
+export type CloudflareKeyAuth = "apiToken" | "globalApiKey";
+/** Accounts and zones a connector may touch; everything else is refused. */
+export interface CloudflarePin {
+    accountIds?: readonly string[];
+    zoneIds?: readonly string[];
+}
+export interface CloudflareRestOptions {
+    auth: CloudflareKeyAuth;
+    baseUrl: string;
+    accountId: string | undefined;
+    zoneId: string | undefined;
+    pin: CloudflarePin | undefined;
+}

package/dist/providers/cloudflare/lib/config.js

@@ -0,0 +1,2 @@
+/** Cloudflare's v4 REST base. Override only for a proxy or a test double. */
+export const CLOUDFLARE_API_BASE = "https://api.cloudflare.com/client/v4";

package/dist/providers/cloudflare/lib/discovery.js

@@ -0,0 +1,29 @@
+// Reviewed workflow synonyms supplement, rather than replace, every pinned action/resource word.
+const summaries = {
+    "GET /zones": "Find domains and zones by name or account",
+    "GET /zones/{zone_id}": "Get zone details and domain configuration",
+    "GET /accounts/{account_id}/r2/buckets": "List R2 buckets for an account",
+    "PATCH /zones/{zone_id}/dns_records/{dns_record_id}": "Update DNS record: set DNS TTL, content, name or proxy status",
+    "POST /zones/{zone_id}/purge_cache": "Clear cache for a file or URL: purge cache files, tags, hosts or prefixes",
+    "PUT /accounts/{account_id}/workers/scripts/{script_name}": "Deploy a Worker script: upload source and bindings",
+    "GET /accounts/{account_id}/storage/kv/namespaces/{namespace_id}/keys": "List KV keys and expiration metadata by prefix",
+};
+export function cloudflareDiscovery(data) {
+    const tags = [...data.tags];
+    return {
+        ...data,
+        tags,
+        ops: data.ops.map(([method, path, id, summary, tag, server]) => {
+            const reviewed = summaries[`${method} ${path}`];
+            const combined = reviewed ? `${reviewed} (${summary})` : summary;
+            // The vendor calls deployment "upload"; keep that action and add the
+            // reviewed deployment category beside the original resource category.
+            const category = method === "PUT" && path === "/accounts/{account_id}/workers/scripts/{script_name}"
+                ? tags.push(`${data.tags[tag]} (Worker deploy)`) - 1
+                : tag;
+            return server === undefined
+                ? [method, path, id, combined, category]
+                : [method, path, id, combined, category, server];
+        }),
+    };
+}

package/dist/providers/cloudflare/{graphql.js → lib/graphql.js}

@@ -4,7 +4,7 @@
 // definitions are walked, so a `mutation` hidden in a string, a comment, or
 // after an anonymous query is still found, and anything that is not a query
 // or a fragment is refused. Nothing here does I/O.
-import { ConnectorCallError } from "../../errors.js";
+import { ConnectorCallError } from "../../../errors.js";
 const SCOPED_FIELDS = new Set(["accounts", "zones"]);
 function refuse(message) {
     throw new ConnectorCallError("invalid_args", message);

package/dist/providers/cloudflare/lib/hatch.js

@@ -0,0 +1,103 @@
+// Cloudflare's reviewed standard hatch binding; the kit owns discovery and admission.
+import { Effect } from "effect";
+import { ConnectorCallError } from "../../../errors.js";
+import { cloudflarePage } from "../../../http/hatch-paging.js";
+import { cloudflareIndex, SAFETY, READ_POSTS, HEADERS, cloudflareRuntime, settings, record, invalid } from "../api.js";
+import { withholdEmbeddedUrlsIn } from "../../_shared/rest/value-safety.js";
+export const CLOUDFLARE_VERDICTS = Object.fromEntries(cloudflareIndex.ops.map((op) => [
+    `${op.method} ${op.path}`,
+    SAFETY.refusal(op.method, op.path) || op.server
+        ? "refuse"
+        : op.method === "GET" || READ_POSTS.some(([method, path]) => method === op.method && path === op.path)
+            ? "read"
+            : "destructive",
+]));
+const badPage = (message) => {
+    throw new ConnectorCallError("connector_call_failed", message, { retryable: false });
+};
+const tokenPage = (param) => ({
+    param,
+    in: "query",
+    cursorInputMessage: `Pass page.nextCursor as cursor in query.${param}; do not send the vendor raw cursor.`,
+    decode: (value) => typeof value === "string" && value ? value : invalid("This paging cursor contains no valid Cloudflare token."),
+    next(data) {
+        const info = record(record(data)["result_info"]);
+        const value = info["cursor"] ?? record(info["cursors"])["after"];
+        if (value === undefined && !("cursor" in info) && !("cursors" in info))
+            return undefined;
+        if (info["is_truncated"] === false || info["is_truncated"] === "false")
+            return null;
+        if (value === null || value === undefined || value === "") {
+            if (info["is_truncated"] === true || info["is_truncated"] === "true")
+                badPage("Cloudflare reported another page without a cursor.");
+            return null;
+        }
+        if (typeof value !== "string")
+            return badPage("Cloudflare returned invalid cursor metadata.");
+        if (withholdEmbeddedUrlsIn(value) !== value || /\[redacted\]/i.test(value))
+            return { hasMore: true };
+        return value;
+    },
+});
+export const CLOUDFLARE_PAGES = Object.fromEntries(cloudflareIndex.ops.flatMap((op) => {
+    if (CLOUDFLARE_VERDICTS[`${op.method} ${op.path}`] !== "read")
+        return [];
+    const params = cloudflareIndex.contract(op).parameters.filter((p) => p.in === "query");
+    const token = params.find((p) => p.name === "cursor" || p.name === "after");
+    // Only bind a continuation whose response envelope and query location are
+    // established by the pin. Mixed page/cursor APIs can use nonstandard
+    // pagination envelopes; retain their vendor query protocol until reviewed.
+    if (!cloudflareIndex.responseRoots(op)?.has("result_info") || (token && params.some((p) => p.name === "page")))
+        return [];
+    const adapter = token
+        ? tokenPage(token.name)
+        : params.some((p) => p.name === "page")
+            ? {
+                ...cloudflarePage,
+                cursorInputMessage: "Omit page on the first call; to continue, pass page.nextCursor unchanged as the cursor in query.page.",
+            }
+            : undefined;
+    return adapter ? [[`${op.method} ${op.path}`, adapter]] : [];
+}));
+export const CLOUDFLARE_HEADERS = Object.fromEntries(Object.entries(HEADERS).map(([key, description]) => [
+    key,
+    {
+        description,
+        values: key === "cf-r2-jurisdiction"
+            ? ["default", "eu", "us", "fedramp", "fedramp-high"]
+            : ["Standard", "InfrequentAccess"],
+    },
+]));
+export function cloudflareBinding({ connection, options, }) {
+    const runtime = cloudflareRuntime(connection, settings(options));
+    return {
+        review: "Cloudflare's indexed text, SQL, NDJSON and SCIM framing, closed R2 headers and configured defaults retain the same confined Connection, scoped admission and value safety.",
+        allowOtherBodyTypes: true,
+        path: runtime.fillDefaults,
+        prepareBody: (body, op) => runtime.scope({ method: op.method, path: op.path, op, params: {}, query: {}, body }).body,
+        refusal: (op) => SAFETY.refusal(op.method, op.path) ?? runtime.checkServer(op.server),
+        refuse: (call) => {
+            runtime.scope(call);
+            for (const parameter of cloudflareIndex.contract(call.op).parameters) {
+                if (parameter.in !== "query" ||
+                    !["page", "per_page", "limit"].includes(parameter.name) ||
+                    !["integer", "number"].includes(String(parameter.schema.type)))
+                    continue;
+                const value = call.query[parameter.name];
+                if (value === undefined)
+                    continue;
+                if (!(typeof value === "number" && Number.isSafeInteger(value) && value >= 0) &&
+                    !(typeof value === "string" && /^\d+$/.test(value) && Number.isSafeInteger(Number(value))))
+                    invalid(`${parameter.name} must be a whole number within the operation's declared bounds.`);
+            }
+            const policy = SAFETY.refusal(call.method, call.op.path);
+            if (policy)
+                return policy;
+            const type = cloudflareIndex.bodyType(call.op)?.toLowerCase() ?? "";
+            if (/multipart|octet-stream|image\//.test(type))
+                return "Use cloudflare_api_upload for this reviewed binary or multipart operation.";
+            return SAFETY.refusal(call.method, call.op.path) ?? runtime.checkServer(call.op.server) ?? runtime.refuse(call);
+        },
+        send: (call) => runtime.sendEnvelope(runtime.scope(call)).pipe(Effect.map(({ status, data }) => ({ status, data }))),
+    };
+}

package/dist/providers/cloudflare/lib/path-bounds.js

@@ -0,0 +1,28 @@
+// Exact pin 843eae2f: these 16 integer path parameters declare minimum: 0
+// with exclusiveMinimum: true. Enforce the strict bound locally; the pin and
+// compiled index remain unchanged.
+export const EXCLUSIVE_PATH_IDS = {
+    "POST /accounts/{account_id}/cloudforce-one/v2/brand-protection/queries/{query_id}/matches/{domain_id}/dismiss": [
+        "query_id",
+        "domain_id",
+    ],
+    "POST /accounts/{account_id}/cloudforce-one/v2/brand-protection/queries/{query_id}/matches/{domain_id}/undismiss": [
+        "query_id",
+        "domain_id",
+    ],
+    "DELETE /accounts/{account_id}/cloudforce-one/v2/brand-protection/takedown-notices/{notice_id}": ["notice_id"],
+    "GET /accounts/{account_id}/cloudforce-one/v2/brand-protection/takedown-notices/{notice_id}": ["notice_id"],
+    "PUT /accounts/{account_id}/cloudforce-one/v2/brand-protection/takedown-notices/{notice_id}": ["notice_id"],
+    "GET /accounts/{account_id}/cloudforce-one/v2/brand-protection/takedown-notices/{notice_id}/letters": ["notice_id"],
+    "POST /accounts/{account_id}/cloudforce-one/v2/brand-protection/takedown-notices/{notice_id}/letters": ["notice_id"],
+    "DELETE /accounts/{account_id}/cloudforce-one/v2/brand-protection/takedown-notices/{notice_id}/letters/{letter_id}": [
+        "notice_id",
+        "letter_id",
+    ],
+    "GET /accounts/{account_id}/cloudforce-one/v2/brand-protection/takedown-notices/{notice_id}/letters/{letter_id}": [
+        "notice_id",
+        "letter_id",
+    ],
+    "GET /accounts/{account_id}/cloudforce-one/v2/brand-protection/takedown-notices/{notice_id}/letters/{letter_id}/pdf": ["notice_id", "letter_id"],
+    "DELETE /accounts/{account_id}/cloudforce-one/v2/credential-monitor/domains/{id}": ["id"],
+};

package/dist/providers/cloudflare/lib/response-media.js

@@ -0,0 +1,75 @@
+// Reviewed non-JSON success media from evidence/openapi.json.
+// Reproduce against the exact pin with scripts/audit-provider-media.mjs.
+export const RESPONSE_MEDIA = {
+    "GET /accounts/{account_id}/access/saml_certificates/{saml_cert_set_id}/pem": ["application/x-pem-file"],
+    "GET /accounts/{account_id}/addressing/loa_documents/{loa_document_id}/download": ["application/pdf"],
+    "GET /accounts/{account_id}/ai-search/namespaces/{namespace}/instances/{id}/items/{item_id}/download": [
+        "application/octet-stream",
+    ],
+    "GET /accounts/{account_id}/alerting/v3/policies/{policy_id}/email/unsubscribe": ["text/html"],
+    "POST /accounts/{account_id}/alerting/v3/policies/{policy_id}/email/unsubscribe": ["text/html"],
+    "GET /accounts/{account_id}/analytics_engine/sql": ["application/x-ndjson"],
+    "POST /accounts/{account_id}/analytics_engine/sql": ["application/x-ndjson"],
+    "GET /accounts/{account_id}/artifacts/namespaces/{namespace}/repos/{name}/blob/{hash}": ["application/octet-stream"],
+    "GET /accounts/{account_id}/artifacts/namespaces/{namespace}/repos/{name}/file": ["application/octet-stream"],
+    "GET /accounts/{account_id}/artifacts/namespaces/{namespace}/repos/{name}/raw/{ref}/{path}": [
+        "application/octet-stream",
+        "text/html",
+        "text/plain",
+    ],
+    "POST /accounts/{account_id}/browser-rendering/pdf": ["application/pdf"],
+    "POST /accounts/{account_id}/browser-rendering/screenshot": ["image/jpg", "image/png", "image/webp", "text/plain"],
+    "POST /accounts/{account_id}/cloudforce-one/v2/brand-protection/letter/generate": ["application/pdf"],
+    "GET /accounts/{account_id}/cloudforce-one/v2/brand-protection/takedown-notices/{notice_id}/letters/{letter_id}/pdf": ["application/pdf"],
+    "GET /accounts/{account_id}/cloudforce-one/v2/collections/{collection_id}/export": [
+        "application/x-ndjson",
+        "text/csv",
+        "text/markdown",
+    ],
+    "GET /accounts/{account_id}/cloudforce-one/v2/requests/{project_type}/{request_id}/assets/{asset_id}/download": [
+        "application/octet-stream",
+    ],
+    "GET /accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/content": [
+        "text/html",
+        "text/plain",
+    ],
+    "GET /accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/raw": ["application/xml", "text/plain"],
+    "GET /accounts/{account_id}/dex/commands/{command_id}/downloads/{filename}": ["application/zip"],
+    "GET /accounts/{account_id}/email/sending/messages/{message_id}": ["message/rfc822"],
+    "GET /accounts/{account_id}/images/v1/{image_id}/blob": ["image/*"],
+    "GET /accounts/{account_id}/intel/indicator-feeds/{feed_id}/data": ["text/csv"],
+    "POST /accounts/{account_id}/magic/cloud/onramps/{onramp_id}/export": ["application/zip"],
+    "GET /accounts/{account_id}/magic/cloud/resources/export": ["application/octet-stream"],
+    "GET /accounts/{account_id}/pcaps/{pcap_id}/download": ["application/vnd.tcpdump.pcap"],
+    "GET /accounts/{account_id}/queues/{queue_id}/metrics": ["text/event-stream"],
+    "GET /accounts/{account_id}/r2/buckets/{bucket_name}/objects/{object_key}": ["application/octet-stream"],
+    "GET /accounts/{account_id}/receipts/{receipt_id}/pdf": ["application/pdf"],
+    "GET /accounts/{account_id}/security-center/partners/{partner}/shadow-zones": ["text/csv"],
+    "GET /accounts/{account_id}/security-center/partners/{partner}/shadow-zones/{domain}/hosts": ["text/csv"],
+    "GET /accounts/{account_id}/storage/kv/namespaces/{namespace_id}/values/{key_name}": ["application/octet-stream"],
+    "GET /accounts/{account_id}/stream/{identifier}/captions/{language}/vtt": ["text/vtt"],
+    "GET /accounts/{account_id}/stream/{identifier}/embed": ["text/html"],
+    "GET /accounts/{account_id}/urlscanner/response/{response_id}": ["text/plain"],
+    "GET /accounts/{account_id}/urlscanner/scan/{scan_id}/screenshot": ["image/png"],
+    "GET /accounts/{account_id}/urlscanner/v2/dom/{scan_id}": ["text/plain"],
+    "GET /accounts/{account_id}/urlscanner/v2/responses/{response_id}": ["text/plain"],
+    "GET /accounts/{account_id}/urlscanner/v2/screenshots/{scan_id}.png": ["image/png"],
+    "GET /accounts/{account_id}/workers/dispatch/namespaces/{dispatch_namespace}/scripts/{script_name}/content": [
+        "string",
+    ],
+    "GET /accounts/{account_id}/workers/scripts/{script_name}": ["application/javascript", "multipart/form-data"],
+    "GET /accounts/{account_id}/workers/scripts/{script_name}/content/v2": ["string"],
+    "GET /accounts/{account_id}/workers/services/{service_name}/environments/{environment_name}/content": ["string"],
+    "POST /accounts/{account_id}/workers/workers/{worker_id}/versions/{version_id}/profile": [
+        "application/vnd.google.protobuf",
+    ],
+    "GET /accounts/{account_id}/workflows/{workflow_name}/instances/{instance_id}/step": ["application/octet-stream"],
+    "GET /accounts/{account_tag}/analytics/sql": ["application/x-ndjson", "text/tab-separated-values"],
+    "POST /accounts/{account_tag}/analytics/sql": ["application/x-ndjson", "text/tab-separated-values"],
+    "GET /analytics/sql": ["application/x-ndjson", "text/tab-separated-values"],
+    "POST /analytics/sql": ["application/x-ndjson", "text/tab-separated-values"],
+    "GET /radar/datasets/{alias}": ["text/csv"],
+    "GET /zones/{zone_id}/dns_records/export": ["text/plain"],
+    "GET /zones/{zone_id}/security-center/partners/{partner}/shadow-hosts": ["text/csv"],
+    "GET /zones/{zone_id}/snippets/{snippet_name}/content": ["multipart/form-data"],
+};