Cloudflare/pages

2026.08.28.2

Hardened codegen: instance names sanitized against path traversal; 429 rate-limit retry with Retry-After; string schema patterns emit regex validation; output schemas passthrough unknown fields; apiToken now optional and vault-wireable with CLOUDFLARE_API_TOKEN env fallback.

2026.08.28.1

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.26.2

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.2

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.25.1

Changed: Updated labels for improved extension discoverability. Added cross-cutting category labels (security, observability, finops, infrastructure, networking, compliance, devops, ai, incident-response) where applicable.

2026.08.24.1

Added: Output metadata attributes for observability.

• durationMs: Method execution duration in milliseconds.
• collectedBy: Extension name that produced the data.
• fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).

2026.08.21.3

Changed:

• Errors raised when a Cloudflare API call fails now name the HTTP method and path that was attempted (e.g. Cloudflare API POST /accounts/.../pages/projects failed with HTTP 400 ...) instead of a bare Cloudflare API error: .... Network-level failures (DNS, connection reset, timeout) are now also caught and wrapped with the same operation context instead of surfacing a raw fetch error.
• create_project now rejects an empty name or production_branch before making a request, instead of letting Cloudflare reject the request with a less specific error.

No breaking changes. Existing calls that already supplied a non-empty name and production_branch are unaffected.

2026.08.21.2

Changed: Added .describe() and .min(1) to the identifier arguments used across most methods — project_name, deployment_id, domain_name, and tail_id. No behavioral changes.

2026.08.21.1

Fixed: Regenerated with three cloudflare-codegen fixes: (1) discriminated-union request bodies with a sibling top-level discriminator property (e.g. gateway proxy_endpoints kind) now correctly build the body from the full oneOf variant instead of silently dropping it to undefined; (2) DELETE methods with a request body (e.g. r2 delete_objects bulk-delete-by-list) now send that body instead of ignoring it; (3) oneOf/anyOf request body variants that are $ref (e.g. r2 sippy config) are now resolved to their real schema instead of collapsing to z.unknown(). Same generator fix as workers-scripts in #352, now caught up for these 7 services.

Changed: create_deployment was removed — it is no longer present in the upstream Cloudflare API spec this extension is generated from.

2026.08.21.1

Fixed: Regenerated with three cloudflare-codegen fixes: (1) discriminated-union request bodies with a sibling top-level discriminator property (e.g. gateway proxy_endpoints kind) now correctly build the body from the full oneOf variant instead of silently dropping it to undefined; (2) DELETE methods with a request body (e.g. r2 delete_objects bulk-delete-by-list) now send that body instead of ignoring it; (3) oneOf/anyOf request body variants that are $ref (e.g. r2 sippy config) are now resolved to their real schema instead of collapsing to z.unknown(). Same generator fix as workers-scripts in #352, now caught up for these 7 services.

Changed: create_deployment was removed — it is no longer present in the upstream Cloudflare API spec this extension is generated from.

2026.07.27.1

Fixed: Regenerated from scripts/cloudflare-codegen after two generator bugs were repaired (webframp/swamp-extensions#284).

1. Methods referencing an undeclared path parameter did not compile. The generator derived a method's arguments schema and execute signature from the OpenAPI parameters list, but built the request URL from the path template. Where the Cloudflare spec omits a declaration for a {placeholder} — which it does in several places — the result was a method with arguments: z.object({}) and an unused _args parameter whose body still interpolated args.<name>. Those methods failed type checking and were uncallable even if they had compiled, because the argument was never declared. Path-template placeholders are now unioned into the declared parameters, so the schema, the signature, and the body agree.

2. Generated tests could request a URL the mock server did not serve. Test arguments merged the request-body fixture over the path-parameter values, so a body property sharing a name with a path parameter (commonly id) substituted its own example value into the URL. The request then missed the mock and failed with Cloudflare API error: Not found. Path parameters now take precedence, matching what the generated model already does by excluding path-parameter names from the request body.

Upgrade note: No API surface change and no method was added or removed. If this extension type-checked and tested cleanly before, its behavior is unchanged and only the version moved. Extensions that previously failed deno check or deno task test now pass.

2026.07.19.1

Added: Initial code-generated release of @webframp/cloudflare/pages with 23 methods covering the Cloudflare pages API surface.