Secure any API.
Harden any edge.

# Read current WAF rules via API
ZONE_ID="$CF_ZONE_ID"
curl -s "https://api.cloudflare.com/client/v4/\
  zones/${ZONE_ID}/rulesets" \
  -H "Authorization: Bearer ${CF_API_TOKEN}"

# Deploy bot mitigation + rate limiting
curl -s -X PATCH "https://api.cloudflare.com/client/v4/\
  zones/${ZONE_ID}/settings/security_level" \
  --data '{"value":"high"}'

# Verify change + collect evidence
sha256sum evidence/post-state.json
e3b0c44298fc1c14...a495991b7852b855
# Every change hashed. Every step reversible.

# agent/cloudflare_hardening.py
import httpx
from studioascode.evidence import collect

class CloudflareAgent:
    """Read-Change-Verify pattern."""

    def harden_zone(self, zone_id):
        # 1. Read current state
        pre = self.read_waf_rules(zone_id)
        collect.snapshot(pre, "pre-state")

        # 2. Apply changes via API
        self.deploy_bot_rules(zone_id)
        self.set_rate_limits(zone_id)

        # 3. Verify + hash evidence
        post = self.read_waf_rules(zone_id)
        collect.verify(pre, post)
        # SHA-256 hashed. Rollback ready.