2 Commits

Include renames

Author	SHA1	Message	Date
Juan DenisandClaude Fable 5	665d6775e4	cutover(cloudflare-ops): the last in-place flagship leaves the tree (plan 52 Phase 2) ... builtin-extensions/serverkit-cloudflare-ops + the tracked frontend live copy removed; FLAGSHIP_SLUGS is now empty (machinery kept); plugins-manifest.json empties; the bundled registry entry flips to bundled:false with the local zip's sha256. cloudflare_ops_bridge resolves the copy-installed package FIRST so a registry install works without the builtin registration path. Tests: new conftest.mount_sibling_extension mirrors a real install from the sibling checkout (the _wp_support.ensure_plugin analogue) and a cf_extension fixture forces a private app; the zone-settings and round2 suites mount it autouse (74/74 green), the extraction suite pins the lean-panel shape, and the flagship-era onboarding tests prove the machinery with a fabricated member instead. OPERATOR: publish jhd3197/serverkit-cloudflare-ops, sign, sync-registry-index.sh. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-29 14:51:17 -04:00
Juan DenisandClaude Opus 4.8	b9ee243ba2	feat(cloudflare): restore Round 2 engine — DNSSEC, Origin CA, rules, activity (plan 42 ph2) ... Restore the plan-36 Cloudflare Round 2 backend lost in the rebuild (migrations 073/074 survived; the engine + test_cloudflare_round2.py did not): - CfOpsChange model (verbatim from clean pyc dump, matches mig 074) + CfOpsChangeService.record (never-raises) / list. - Core client (dns/cloudflare.py): get/set_dnssec; create/list/revoke Origin certificates; X-Auth-User-Service-Key header mode (origin_ca_key, mig 073). - Extension service: DNSSEC get/set; Origin CA issue (panel-side CSR, key never leaves the box, proxied-hostname warning, scoped-cred 400 not 502) /list/revoke + Linux-guarded install via upload_custom_cert; Redirect+Transform rules (RULE_PHASES/ACTIONS/PRESETS reusing _find_custom_ruleset + injection guard); best-effort _record wired into every mutating method; scope_check probe; list_activity. - Extension routes: /zones/<id>/dnssec, origin-ca, /rules/<slug>, /activity, /scope-check (admin-gated, CloudflareError->400, provider->502). - ssl_service.list_certificates walks /etc/ssl/serverkit + "Origin CA (proxy-only)" badge; fixed certbot-branch early-return hiding custom certs. Also registers EmailBounceState (plan 42 ph3) in models/__init__ (shared file). Deviation: origin_ca_key implemented as the Fernet Origin CA *service key* (plan Decision 3), not mig-073's docstring "generated private key" — the generated key is used inline for install and never persisted. R2 preset backend-untouched (it lives in the storage-provider + frontend layers). Verified: 83 passed (round2 30 + zone_settings 42 + extraction 8 + ssl 3), no regression. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-09 05:02:54 -04:00