pi-cloudflare 0.1.0

package/skills/turnstile-spin/references/sveltekit.md

@@ -0,0 +1,191 @@
+# SvelteKit
+
+For SvelteKit projects. The widget renders in the page; siteverify is called from a SvelteKit form action (or a `+server.ts` endpoint) server-side.
+
+```svelte title="src/routes/signup/+page.svelte"
+<script>
+	import { enhance } from "$app/forms";
+	import { onMount } from "svelte";
+
+	let turnstileContainer;
+	let signupWidgetId;
+
+	onMount(() => {
+		const render = () => {
+			signupWidgetId = window.turnstile.render(turnstileContainer, {
+				sitekey: "YOUR_SITEKEY",
+				action: "signup",
+			});
+			delete window.onSignupTurnstileLoad;
+		};
+
+		if (window.turnstile) {
+			render();
+			return;
+		}
+
+		window.onSignupTurnstileLoad = render;
+		const script = document.createElement("script");
+		script.src =
+			"https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onSignupTurnstileLoad&render=explicit";
+		script.async = true;
+		document.head.appendChild(script);
+
+		return () => {
+			delete window.onSignupTurnstileLoad;
+		};
+	});
+</script>
+
+<form
+	method="POST"
+	use:enhance={() => {
+		return async ({ result, update }) => {
+			try {
+				await update();
+			} finally {
+				if (result.type !== "redirect" && signupWidgetId !== undefined) {
+					window.turnstile.reset(signupWidgetId);
+				}
+			}
+		};
+	}}
+>
+	<input name="email" type="email" required />
+	<div bind:this={turnstileContainer}></div>
+	<button type="submit">Sign up</button>
+</form>
+```
+
+Form action (canonical siteverify):
+
+```ts title="src/routes/signup/+page.server.ts"
+import type { Actions } from "./$types";
+import { fail } from "@sveltejs/kit";
+import { TURNSTILE_SECRET, TURNSTILE_HOSTNAMES } from "$env/static/private";
+
+const expectedHostnames = new Set(
+	(TURNSTILE_HOSTNAMES ?? "")
+		.split(",")
+		.map((h) => h.trim())
+		.filter(Boolean),
+);
+
+export const actions: Actions = {
+	default: async ({ request, getClientAddress }) => {
+		const data = await request.formData();
+		const token = data.get("cf-turnstile-response");
+		if (typeof token !== "string" || expectedHostnames.size === 0) {
+			return fail(403, { error: "Verification failed" });
+		}
+
+		const verify = await fetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				secret: TURNSTILE_SECRET,
+				response: token,
+				remoteip: getClientAddress(),
+			}),
+		});
+		const result = await verify.json();
+		if (
+			verify.ok !== true ||
+			result.success !== true ||
+			result.action !== "signup" ||
+			!expectedHostnames.has(result.hostname)
+		) {
+			return fail(403, { error: "Verification failed" });
+		}
+
+		// process signup
+		return { ok: true };
+	},
+};
+```
+
+`signup` is the stable action for this surface. Preserve an existing custom migration action and compare the returned action to the same value. Siteverify is mandatory for every widget mode, including pre-clearance. Set `TURNSTILE_HOSTNAMES` to the deployment-specific frontend hostnames; a production value must not include `localhost` or `127.0.0.1`.
+
+In `.env`:
+
+```text
+TURNSTILE_SECRET=YOUR_SECRET
+```
+
+The `$env/static/private` import enforces that the secret never reaches the client bundle.
+
+## Variant: client-side fetch to an endpoint
+
+If you need a JSON API rather than progressive-enhancement form post, use `+server.ts`:
+
+```ts title="src/routes/api/signup/+server.ts"
+import type { RequestHandler } from "./$types";
+import { TURNSTILE_SECRET, TURNSTILE_HOSTNAMES } from "$env/static/private";
+
+const expectedHostnames = new Set(
+	(TURNSTILE_HOSTNAMES ?? "")
+		.split(",")
+		.map((h) => h.trim())
+		.filter(Boolean),
+);
+
+export const POST: RequestHandler = async ({ request, getClientAddress }) => {
+	const { token } = await request.json();
+	if (expectedHostnames.size === 0) {
+		return new Response("forbidden", { status: 403 });
+	}
+	const verify = await fetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			secret: TURNSTILE_SECRET,
+			response: token,
+			remoteip: getClientAddress(),
+		}),
+	});
+	const result = await verify.json();
+	if (
+		verify.ok !== true ||
+		result.success !== true ||
+		result.action !== "signup" ||
+		!expectedHostnames.has(result.hostname)
+	) {
+		return new Response("forbidden", { status: 403 });
+	}
+	// process signup
+	return new Response(JSON.stringify({ ok: true }), { status: 200 });
+};
+```
+
+The explicit renderer above retains `signupWidgetId`. Reset it in `finally` when calling this endpoint so every completion path gets a fresh token:
+
+```svelte
+<script>
+	async function submit(e) {
+		e.preventDefault();
+		try {
+			const token = new FormData(e.currentTarget).get("cf-turnstile-response");
+			const res = await fetch("/api/signup", {
+				method: "POST",
+				body: JSON.stringify({ token }),
+			});
+			const result = await res.json();
+			if (!res.ok || result.ok !== true) throw new Error("Submission failed");
+			// proceed
+		} catch {
+			// surface error
+		} finally {
+			if (signupWidgetId !== undefined) {
+				window.turnstile.reset(signupWidgetId);
+			}
+		}
+	}
+</script>
+```
+
+## Substitutions
+
+| Placeholder         | Replace with                                                         |
+| ------------------- | -------------------------------------------------------------------- |
+| `YOUR_SITEKEY`      | The widget site key from Step 8                                      |
+| `YOUR_SECRET`       | The secret captured in Step 8. Stays in env, never inlined.          |

package/skills/turnstile-spin/references/vanilla-html.md

@@ -0,0 +1,157 @@
+# Vanilla HTML
+
+For static sites or any project without a JS framework. The widget renders client-side; the form submits to whatever backend handles your form (a Node/PHP/Ruby/Go server, a Cloudflare Worker, a Pages Function, a third-party form host that supports server-side hooks, etc.).
+
+```html
+<!doctype html>
+<html>
+	<head>
+		<script
+			src="https://challenges.cloudflare.com/turnstile/v0/api.js"
+			async
+			defer
+		></script>
+	</head>
+	<body>
+		<form action="/api/subscribe" method="POST">
+			<input name="email" type="email" required />
+			<div
+				class="cf-turnstile"
+				data-sitekey="YOUR_SITEKEY"
+				data-action="subscribe"
+			></div>
+			<button type="submit">Subscribe</button>
+		</form>
+	</body>
+</html>
+```
+
+When the form submits, the browser includes `cf-turnstile-response` automatically. Your backend reads it and calls canonical siteverify.
+
+## Backend (any language)
+
+Add this to your existing `/api/subscribe` handler before the rest of its logic:
+
+```js
+// Node / fetch idiom
+const expectedHostnames = new Set(
+	(process.env.TURNSTILE_HOSTNAMES ?? '')
+		.split(',')
+		.map((h) => h.trim())
+		.filter(Boolean),
+);
+if (expectedHostnames.size === 0) return res.status(403).end();
+
+const token = req.body['cf-turnstile-response'];
+const r = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
+	method: 'POST',
+	headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+	body: new URLSearchParams({
+		secret: process.env.TURNSTILE_SECRET,
+		response: token,
+		remoteip: req.ip,
+	}),
+});
+const result = await r.json();
+if (
+	r.ok !== true ||
+	result.success !== true ||
+	result.action !== 'subscribe' ||
+	!expectedHostnames.has(result.hostname)
+) {
+	return res.status(403).end();
+}
+// existing handler logic runs here
+```
+
+Equivalent calls in other backend languages (each also compares `result.hostname` to a `TURNSTILE_HOSTNAMES` allowlist):
+
+```ruby
+# Ruby
+require 'net/http'; require 'uri'; require 'json'; require 'set'
+expected_hostnames = (ENV['TURNSTILE_HOSTNAMES'] || '').split(',').map(&:strip).reject(&:empty?).to_set
+halt 403 if expected_hostnames.empty?
+res = Net::HTTP.post_form(URI('https://challenges.cloudflare.com/turnstile/v0/siteverify'),
+  secret: ENV['TURNSTILE_SECRET'], response: params['cf-turnstile-response'], remoteip: request.ip)
+result = JSON.parse(res.body)
+halt 403 unless res.is_a?(Net::HTTPSuccess) && result['success'] == true && result['action'] == 'subscribe' && expected_hostnames.include?(result['hostname'])
+```
+
+```python
+# Python (requests)
+expected_hostnames = {h.strip() for h in os.environ.get('TURNSTILE_HOSTNAMES', '').split(',') if h.strip()}
+if not expected_hostnames:
+    return '', 403
+r = requests.post('https://challenges.cloudflare.com/turnstile/v0/siteverify',
+    data={'secret': os.environ['TURNSTILE_SECRET'],
+          'response': form['cf-turnstile-response'],
+          'remoteip': request.remote_addr})
+result = r.json()
+if (not r.ok or result.get('success') is not True or result.get('action') != 'subscribe'
+        or result.get('hostname') not in expected_hostnames):
+    return '', 403
+```
+
+`subscribe` is the stable action for this surface. Preserve an existing custom migration action and compare the returned action to the same value. Siteverify is mandatory for every widget mode, including pre-clearance. Set `TURNSTILE_HOSTNAMES` to the deployment-specific frontend hostnames; a production value must not include `localhost` or `127.0.0.1`.
+
+## Variant: AJAX submit instead of form action
+
+For an AJAX flow, replace the native form and API script with explicit rendering. Keep this surface's widget ID and reset it in `finally`, which covers network, JSON, validation, and server failures as well as successful same-page completion.
+
+```html
+<form id="subscribe-form">
+	<input name="email" type="email" required />
+	<div id="subscribe-turnstile"></div>
+	<button type="submit">Subscribe</button>
+</form>
+<script>
+	let subscribeWidgetId;
+
+	window.onSubscribeTurnstileLoad = () => {
+		subscribeWidgetId = window.turnstile.render("#subscribe-turnstile", {
+			sitekey: "YOUR_SITEKEY",
+			action: "subscribe",
+		});
+	};
+
+	document.getElementById("subscribe-form").addEventListener("submit", async (event) => {
+		event.preventDefault();
+		try {
+			const res = await fetch("/api/subscribe", {
+				method: "POST",
+				body: new FormData(event.currentTarget),
+			});
+			const json = await res.json();
+			if (!res.ok || json.ok !== true) throw new Error("Submission failed");
+			// proceed
+		} catch {
+			// surface the error
+		} finally {
+			if (subscribeWidgetId !== undefined) {
+				window.turnstile.reset(subscribeWidgetId);
+			}
+		}
+	});
+</script>
+<script
+	src="https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onSubscribeTurnstileLoad&render=explicit"
+	async
+	defer
+></script>
+```
+
+## No backend?
+
+If your project is pure-static (no server-side handler — just HTML served from a CDN), Spin doesn't apply. Siteverify is server-side by design. Options:
+
+- Add a Cloudflare Pages Function (`functions/api/subscribe.js`) to host the siteverify call.
+- Deploy a tiny Cloudflare Worker that does siteverify against your existing form host.
+- Use a third-party form host that exposes a server-side webhook where you can wire siteverify.
+
+## Substitutions
+
+| Placeholder         | Replace with                                                         |
+| ------------------- | -------------------------------------------------------------------- |
+| `YOUR_SITEKEY`      | The widget site key from Step 8                                      |
+| `/api/subscribe`    | The path to your existing form-handling endpoint                     |
+| `TURNSTILE_SECRET`  | Env-var name. Value is the secret captured in Step 8, kept off disk. |

package/skills/turnstile-spin/scripts/auth-probe.sh

@@ -0,0 +1,285 @@
+#!/usr/bin/env bash
+# Probes Cloudflare API auth state for the Turnstile Spin agent.
+#
+# Reads:
+#   $CLOUDFLARE_API_TOKEN  (required)
+#   $CLOUDFLARE_ACCOUNT_ID (optional; if set, must be one of the token's accounts)
+#
+# Requires: bash, curl, python3. Optional: a user-approved WRANGLER_BIN for account enumeration.
+#
+# Outputs JSON to stdout, always exits 0. The agent reads `status`:
+#   "ok"                ; selected account passed the Turnstile Edit-scope probe
+#   "missing_token"     ; no token set, python3 unavailable, or account enumeration failed
+#   "missing_scope"     ; token lacks Account.Turnstile:Edit on the selected account
+#   "multiple_accounts" ; token covers >1 accounts and $CLOUDFLARE_ACCOUNT_ID is unset
+#   "account_mismatch"  ; $CLOUDFLARE_ACCOUNT_ID is set but is not in the token's accounts list
+#   "network_failure"   ; the Edit-scope probe could not reach the Cloudflare API
+#   "upstream_failure"  ; the Edit-scope probe returned an unexpected upstream response
+#
+# Account enumeration uses `WRANGLER_BIN whoami --json` only when WRANGLER_BIN is
+# an approved canonical absolute path outside PROJECT_ROOT and WRANGLER_VERSION
+# matches it exactly. Otherwise the caller must supply $CLOUDFLARE_ACCOUNT_ID.
+#
+# Human-readable diagnostics go to stderr.
+
+set +x
+set -uo pipefail
+
+emit() {
+  echo "$1"
+  exit 0
+}
+
+if ! command -v python3 >/dev/null 2>&1; then
+  echo "auth-probe: python3 is required but not found in PATH." >&2
+  emit '{"status":"missing_token","reason":"python3_not_available"}'
+fi
+
+token="${CLOUDFLARE_API_TOKEN:-}"
+unset CLOUDFLARE_API_TOKEN
+declared_account="${CLOUDFLARE_ACCOUNT_ID:-}"
+
+if [ -z "$token" ]; then
+  echo "auth-probe: \$CLOUDFLARE_API_TOKEN is not set." >&2
+  emit '{"status":"missing_token","reason":"no_env_var"}'
+fi
+if [[ ! "$token" =~ ^[A-Za-z0-9_-]+$ ]]; then
+  echo "auth-probe: CLOUDFLARE_API_TOKEN has an invalid format." >&2
+  emit '{"status":"missing_token","reason":"invalid_token_format"}'
+fi
+
+accounts_json=""
+account_count=0
+
+if [ -n "${WRANGLER_BIN:-}" ]; then
+  if [[ "$WRANGLER_BIN" != /* || ! -x "$WRANGLER_BIN" ]]; then
+    echo "auth-probe: WRANGLER_BIN must be an executable absolute path." >&2
+    emit '{"status":"missing_token","reason":"invalid_wrangler_path"}'
+  fi
+
+  wrangler_bin=$(python3 -I -c 'import os,sys; print(os.path.realpath(sys.argv[1]))' "$WRANGLER_BIN")
+  if [ "$wrangler_bin" != "$WRANGLER_BIN" ]; then
+    echo "auth-probe: WRANGLER_BIN must be canonical, without symlinks." >&2
+    emit '{"status":"missing_token","reason":"noncanonical_wrangler_path"}'
+  fi
+  if [ -n "${PROJECT_ROOT:-}" ]; then
+    project_root=$(python3 -I -c 'import os,sys; print(os.path.realpath(sys.argv[1]))' "$PROJECT_ROOT")
+    if [[ "$wrangler_bin" == "$project_root" || "$wrangler_bin" == "$project_root/"* ]]; then
+      echo "auth-probe: WRANGLER_BIN must be outside PROJECT_ROOT." >&2
+      emit '{"status":"missing_token","reason":"project_local_wrangler"}'
+    fi
+  fi
+  if [ -z "${WRANGLER_VERSION:-}" ]; then
+    echo "auth-probe: WRANGLER_VERSION is required with WRANGLER_BIN." >&2
+    emit '{"status":"missing_token","reason":"missing_wrangler_version"}'
+  fi
+
+  actual_version=$(
+    "$wrangler_bin" --version 2>/dev/null |
+      python3 -I -c 'import re,sys; m=re.search(r"\b(\d+\.\d+\.\d+)\b", sys.stdin.read()); print(m.group(1) if m else "")'
+  )
+  if [ "$actual_version" != "$WRANGLER_VERSION" ]; then
+    echo "auth-probe: WRANGLER_BIN version does not match WRANGLER_VERSION." >&2
+    emit '{"status":"missing_token","reason":"wrangler_version_mismatch"}'
+  fi
+
+  whoami_json=$(CLOUDFLARE_API_TOKEN="$token" "$wrangler_bin" whoami --json 2>/dev/null || true)
+  if [ -n "$whoami_json" ] && [ "$(printf '%s' "$whoami_json" | head -c 1)" = "{" ]; then
+    accounts_json=$(printf '%s' "$whoami_json" | python3 -I -c '
+import json, sys
+try:
+    d = json.load(sys.stdin)
+    print(json.dumps(d.get("accounts") or []))
+except Exception:
+    print("[]")
+')
+    account_count=$(printf '%s' "$accounts_json" | python3 -I -c '
+import json, sys
+try:
+    print(len(json.load(sys.stdin)))
+except Exception:
+    print(0)
+')
+  fi
+fi
+
+if [ "$account_count" = "0" ] && [ -n "$declared_account" ]; then
+  # No wrangler, but user gave us an account. Trust it and skip enumeration.
+  accounts_json="[{\"id\":$(python3 -I -c 'import json, sys; print(json.dumps(sys.argv[1]))' "$declared_account")}]"
+  account_count=1
+fi
+
+if [ "$account_count" = "0" ]; then
+  echo "auth-probe: could not enumerate accounts. Export CLOUDFLARE_ACCOUNT_ID or provide an approved WRANGLER_BIN and WRANGLER_VERSION." >&2
+  emit '{"status":"missing_token","reason":"no_accounts"}'
+fi
+
+if [ -n "$declared_account" ]; then
+  in_list=$(printf '%s' "$accounts_json" | python3 -I -c '
+import json, sys
+target = sys.argv[1]
+try:
+    accounts = json.load(sys.stdin)
+except Exception:
+    print("false"); sys.exit(0)
+print("true" if any((a or {}).get("id") == target for a in accounts) else "false")
+' "$declared_account")
+  if [ "$in_list" != "true" ]; then
+    echo "auth-probe: \$CLOUDFLARE_ACCOUNT_ID ($declared_account) is not one of the token's accounts." >&2
+    emit "$(python3 -I -c '
+import json, sys
+declared, accounts_raw = sys.argv[1], sys.argv[2]
+try:
+    accounts = json.loads(accounts_raw)
+except Exception:
+    accounts = []
+print(json.dumps({"status":"account_mismatch","declared":declared,"accounts":accounts}))
+' "$declared_account" "$accounts_json")"
+  fi
+  account_id="$declared_account"
+elif [ "$account_count" = "1" ]; then
+  account_id=$(printf '%s' "$accounts_json" | python3 -I -c '
+import json, sys
+try:
+    print(json.load(sys.stdin)[0]["id"])
+except Exception:
+    print("")
+')
+  if [ -z "$account_id" ]; then
+    echo "auth-probe: accounts list had one entry but no id field." >&2
+    emit '{"status":"missing_token","reason":"malformed_accounts"}'
+  fi
+else
+  echo "auth-probe: token covers $account_count accounts; ask the user to pick one, then export \$CLOUDFLARE_ACCOUNT_ID and re-run." >&2
+  emit "$(python3 -I -c '
+import json, sys
+try:
+    accounts = json.loads(sys.argv[1])
+except Exception:
+    accounts = []
+print(json.dumps({"status":"multiple_accounts","accounts":accounts}))
+' "$accounts_json")"
+fi
+
+# Edit-scope probe. A GET /challenges/widgets would authorize a Read-only
+# token; to verify Edit specifically, POST with an intentionally invalid
+# payload and interpret the response:
+#   401 or 403                                  → token lacks Edit
+#   200 with success:false, errors[0].code=10000 → token lacks Edit
+#   400/422 or 200 with validation error codes  → Edit scope OK
+#
+# The API rejects the empty-name/empty-domains payload with 400 today, so
+# no widget is created. If validation ever loosens and the probe accidentally
+# creates one, we detect the returned sitekey and DELETE it as a safety net
+# so the probe stays side-effect-free.
+account_enc=$(python3 -I -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$account_id")
+
+if ! probe_response="$(
+  printf 'header = "Authorization: Bearer %s"\n' "$token" |
+    curl --disable --config - --silent --show-error --write-out $'\n%{http_code}' -X POST \
+      "https://api.cloudflare.com/client/v4/accounts/$account_enc/challenges/widgets" \
+      -H "Content-Type: application/json" \
+      --data '{"name":"","domains":[]}'
+)"; then
+  echo "auth-probe: network failure probing Edit scope on account $account_id." >&2
+  emit '{"status":"network_failure","account_id":"'"$account_id"'"}'
+fi
+
+edit_code="${probe_response##*$'\n'}"
+probe_body="${probe_response%$'\n'*}"
+probe_output=$(printf '%s' "$probe_body" | python3 -I -c '
+import json, sys
+http_code = sys.argv[1]
+verdict = "unknown"
+created_sitekey = ""
+try:
+    raw = sys.stdin.read()
+    data = json.loads(raw) if raw else {}
+except Exception:
+    data = None
+if isinstance(data, dict):
+    errors = data.get("errors") or []
+    if not isinstance(errors, list):
+        errors = []
+    first = (errors[0] or {}) if errors else {}
+    if not isinstance(first, dict):
+        first = {}
+    first_code = first.get("code", 0)
+    if http_code in ("401", "403"):
+        verdict = "missing_scope"
+    elif http_code == "200" and data.get("success") is False and first_code == 10000:
+        verdict = "missing_scope"
+    elif http_code in ("400", "422"):
+        verdict = "scope_ok"
+    elif http_code == "200":
+        # Any 200 that got past auth means scope is fine (whether success or not).
+        verdict = "scope_ok"
+    else:
+        verdict = f"unexpected_{http_code}"
+    # Detect accidental widget creation (safety net if API validation ever
+    # accepts the empty-name/empty-domains probe payload).
+    result = data.get("result")
+    if isinstance(result, dict) and data.get("success") is True:
+        sk = result.get("sitekey", "")
+        if isinstance(sk, str) and sk:
+            created_sitekey = sk
+print(f"{verdict}|{created_sitekey}")
+' "$edit_code")
+unset probe_body probe_response
+verdict="${probe_output%%|*}"
+created_sitekey="${probe_output#*|}"
+[ "$created_sitekey" = "$probe_output" ] && created_sitekey=""
+
+# If the probe unexpectedly created a widget (API validation loosened),
+# DELETE it so the probe stays side-effect-free.
+if [ -n "$created_sitekey" ]; then
+  echo "auth-probe: probe unexpectedly created widget $created_sitekey; cleaning up..." >&2
+  sk_enc=$(python3 -I -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$created_sitekey")
+  cleanup_code=$(
+    printf 'header = "Authorization: Bearer %s"\n' "$token" |
+      curl --disable --config - --silent --show-error --output /dev/null --write-out "%{http_code}" -X DELETE \
+        "https://api.cloudflare.com/client/v4/accounts/$account_enc/challenges/widgets/$sk_enc" || echo "000"
+  )
+  case "$cleanup_code" in
+    2*) echo "auth-probe: cleanup DELETE for widget $created_sitekey succeeded (HTTP $cleanup_code)." >&2 ;;
+    *)  echo "auth-probe: cleanup DELETE for widget $created_sitekey FAILED (HTTP $cleanup_code). Please remove it from the Turnstile dashboard manually." >&2 ;;
+  esac
+fi
+
+case "$verdict" in
+  scope_ok)
+    emit "$(python3 -I -c '
+import json, sys
+account_id, accounts_raw = sys.argv[1], sys.argv[2]
+try:
+    accounts = json.loads(accounts_raw)
+except Exception:
+    accounts = []
+print(json.dumps({"status":"ok","account_id":account_id,"accounts":accounts}))
+' "$account_id" "$accounts_json")"
+    ;;
+  missing_scope)
+    echo "auth-probe: token cannot write /challenges/widgets on account $account_id (HTTP $edit_code). Missing Account.Turnstile:Edit." >&2
+    emit "$(python3 -I -c '
+import json, sys
+account_id, http_code = sys.argv[1], sys.argv[2]
+try:
+    code_num = int(http_code)
+except ValueError:
+    code_num = 0
+print(json.dumps({"status":"missing_scope","account_id":account_id,"http_code":code_num}))
+' "$account_id" "$edit_code")"
+    ;;
+  *)
+    echo "auth-probe: unexpected response probing Edit scope on account $account_id (HTTP $edit_code)." >&2
+    emit "$(python3 -I -c '
+import json, sys
+account_id, http_code = sys.argv[1], sys.argv[2]
+try:
+    code_num = int(http_code)
+except ValueError:
+    code_num = 0
+print(json.dumps({"status":"upstream_failure","account_id":account_id,"http_code":code_num}))
+' "$account_id" "$edit_code")"
+    ;;
+esac