git:20261017.7124864 to git:20261019.89dfcfa

20 added, 40 removed. Audit A to A.

---

name: cloudflare

- description: "Everything Cloudflare through the official `cf` CLI (no Wrangler, no raw API calls): domains, DNS records, Workers (dev, build, deploy, secrets, routes, crons), custom domains, KV, D1, R2 buckets and file uploads, Pages, Queues, Tunnels, SSL, WAF, cache purge, Zero Trust, email routing, analytics. Use when the user mentions Cloudflare, cf, DNS, a domain, deploy, workers, KV, D1, R2, CDN, SSL or cache."

+ description: Run every Cloudflare job through the official `cf` CLI - domains, DNS, Workers deploys, secrets and custom domains, KV, D1, R2, WAF, SSL and cache. Use when the user mentions Cloudflare, cf, DNS, a domain, deploy, Workers, KV, D1, R2, CDN, SSL or cache.

---

- # Cloudflare (via `cf`)

- Every Cloudflare action uses the official `cf` CLI (`npm i -g cf`, binary `cf`). Never Wrangler, never an S3 SDK script, never raw calls to api.cloudflare.com. If the user's machine already has the official Cloudflare connector in Claude, it can help for reads, but `cf` stays the tool for changes.

- ## Setup and auth

+ Use the official `cf` CLI (`npm i -g cf`) for every Cloudflare action. Never Wrangler, an S3 SDK script or raw calls to api.cloudflare.com; if `cf` cannot do something, say so and stop. The Cloudflare connector in Claude can help for reads, but changes go through `cf`.

```bash

cf --version # missing: npm i -g cf

cf auth whoami # must say "authenticated": true

- cf auth login # OAuth in the browser, the user approves (grant every scope, sensitive ones included)

+ cf auth login # OAuth in the browser, the user grants every scope, sensitive ones included

```

- - If several accounts are visible, `cf` stops with "More than one account available": run `cf accounts list` (or `cf cli search "list accounts"`), then `export CLOUDFLARE_ACCOUNT_ID=<id>` for the session.

- - Zone-scoped commands take `-z <domain or zone id>`.

- - Never print tokens or read the `cf` config file.

+ When `cf` stops with "More than one account available", run `cf accounts list` and `export CLOUDFLARE_ACCOUNT_ID=<id>` for the session. Zone commands take `-z <domain or zone id>`. Never print tokens or read the `cf` config file.

- ## Find the right command

+ Find any command instead of guessing it, with generic queries (action + resource type, no names or ids):

```bash

- cf cli search "<what you want to do, generic words>" # JSON matches

- cf <discovered command> --help # flags of that one command

- cf schema <same command without the leading cf> # exact API request body

+ cf cli search "<what you want to do>" # JSON matches

+ cf <discovered command> --help # flags of that command

+ cf schema <command without the leading cf> # exact API request body

```

- Every mutating command accepts `--dry-run`. Deletes ask for confirmation: pass `--force` only after the user said yes.

- ## Common jobs

- | job | command |

- | --- | --- |

- | zones (domains) | `cf zones list` |

- | DNS list / add | `cf dns records list -z <domain>` · `cf dns records create -z <domain> --body '{"type":"CNAME","name":"www","content":"target","proxied":true}'` |

- | DNS update / delete | `cf cli search "update dns record"` |

- | Worker project | `cf init <dir>` · `cf dev` · `cf build` · `cf deploy` |

- | custom domain on a Worker | `cf cli search "worker custom domain"` |

- | Worker secrets, routes, crons | `cf cli search "worker secret"` / `"worker routes"` / `"cron triggers"` |

- | KV | `cf cli search "kv namespace"` / `"write kv value"` |

- | D1 | `cf cli search "d1 query"` |

- | R2 | `cf r2 buckets list` · `cf r2 objects put <key> --bucket-name <bucket> --file <path> --content-type <mime>` |

- | cache purge | `cf cli search "purge cache"` |

- | SSL, WAF, Access, email routing, DNSSEC, analytics | `cf cli search "<job>"` |

- | local simulation | add `--local` (KV, D1, R2 objects) |

- Exact subcommand names follow the CLI release: if a command above errors, `cf cli search` it.

+ The commands used most:

- ## DNS records given by another service

+ ```bash

+ cf zones list

+ cf dns records list -z <domain>

+ cf dns records create -z <domain> --body '{"type":"CNAME","name":"www","content":"target","proxied":true}'

+ cf init <dir> && cf dev # then cf build, cf deploy

+ cf r2 buckets list

+ cf r2 objects put <key> --bucket-name <bucket> --file <path> --content-type <mime>

+ ```

- When a service (Lumail, Stripe, Google, a mail provider) shows DNS records to add, create each one exactly as given (type, name, content, priority, TTL), keep mail and verification records unproxied (`"proxied": false`), then list the zone to confirm they exist.

+ Everything else (DNS update or delete, Worker custom domain, secrets, routes, crons, KV, D1, cache purge, SSL, WAF, Access, email routing, DNSSEC, analytics) goes through `cf cli search "<job>"`. Add `--local` to simulate KV, D1 and R2 objects. Subcommand names follow the CLI release: if one errors, search it.

- ## Rules

+ Every mutating command accepts `--dry-run`. Confirm with the user before anything destructive (DNS deletes, zone changes, purges), and pass `--force` only after their yes.

- - `cf` only. If `cf` cannot do something, say so and stop.

- - Confirm before anything destructive (DNS deletes, zone changes, purges).

- - Keep `cf cli search` queries generic (action + resource type, no names or ids).

+ When another service (Lumail, Stripe, Google, a mail provider) shows DNS records to add, create each one exactly as given (type, name, content, priority, TTL), keep mail and verification records unproxied (`"proxied": false`), then list the zone to confirm they exist.