@impeccable/reviews 0.1.5 → 0.1.7

package/dist/cloudflare.js

@@ -1,11 +1,14 @@
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { cloudflarePreviewsFact, cloudflarePreviewsPage } from './host-previews.js';
 import { commandRunner } from './netlify.js';
-import { ownFolder } from './sandbox.js';
+import { ownFolder, ownNpmCache } from './sandbox.js';
 /**
  * Cloudflare Pages: the preview deployments this repository's pull requests
  * get, from GitHub's record and from cf, Cloudflare's CLI, on this machine
- * when it is signed in (read only), and whether cf is signed in. Cloudflare's
+ * when it is signed in (read only), whether cf is signed in, whether the
+ * project built from this repository builds previews of pull requests at all,
+ * and the one change that turns them on as the person (host-previews.ts). Cloudflare's
  * GitHub app records no deployment and no commit status: its record is a
  * check run on each commit it built and a comment on the pull request, both
  * naming the deployment's address (https://<id>.<project>.pages.dev) and the
@@ -30,9 +33,11 @@ const sha = (value) => typeof value === 'string' && /^[0-9a-f]{40}$/.test(value)
 const branchName = (value) => /^[A-Za-z0-9][A-Za-z0-9._/-]{0,254}$/.test(value) && !value.includes('..') && !value.endsWith('/') && !value.endsWith('.');
 /** A branch, as GitHub names it in a check run's summary or cf in a deployment: git's characters, and not too long to be one. */
 const branchOf = (value) => (typeof value === 'string' && branchName(value) ? value : undefined);
-/** The project a Pages address belongs to; null for any other address. */
+/** The project's own address, https://<project>.pages.dev. */
+const PAGES_SITE = new RegExp(`^https://(${LABEL})\\.pages\\.dev$`);
+/** The project a Pages address belongs to, a deployment's, a branch's alias or the project's own; null for any other address. */
 export function pagesProject(url) {
-    return PAGES_ADDRESS.exec(url)?.[2] ?? null;
+    return PAGES_ADDRESS.exec(url)?.[2] ?? PAGES_SITE.exec(url)?.[1] ?? null;
 }
 /** The deployment's address and the branch's alias, as the app's table names them, else the first two Pages links in order; a page mentions each once. */
 function addresses(html) {
@@ -70,6 +75,8 @@ async function fromGitHub(owner, repo, gh, only, branch) {
         }
     }
     const found = [];
+    /** The Workers Builds check run on the newest head that has one: Cloudflare building a Worker from the repository, with no preview address. */
+    let worker;
     // Cloudflare posts its check run once the build ended, so a head with none is still building, or was never built.
     const runs = await Promise.all(heads.map((head) => read(get(`${base}/commits/${head.sha}/check-runs?per_page=100`), null)));
     runs.forEach((result, i) => {
@@ -77,6 +84,12 @@ async function fromGitHub(owner, repo, gh, only, branch) {
         for (const run of list(record(result)?.check_runs)) {
             if (!isApp(record(run.app)?.slug))
                 continue;
+            const script = typeof run.name === 'string' ? /^Workers Builds: (\S+)$/.exec(run.name)?.[1] : undefined;
+            if (script) {
+                if (!worker || head.at > worker.at)
+                    worker = { script, build: run.status === 'completed' ? stateOf(run.conclusion) : 'building', at: head.at };
+                continue;
+            }
             const { url, alias } = addresses(String(record(run.output)?.summary ?? ''));
             if (!url)
                 continue;
@@ -101,15 +114,19 @@ async function fromGitHub(owner, repo, gh, only, branch) {
             found.push({ pullRequest: issue, ...(head.branch ? { branch: head.branch } : {}), sha: head.sha, url, ...(alias ? { alias } : {}), state: stateOf(/Status:<\/strong>[\s\S]{0,120}?<\/td>/.exec(comment.body)?.[0]), from: 'bot comment', at: when(comment.updated_at) || head.at });
         }
     }
-    return { previews: found, heads, failed };
+    return { previews: found, heads, failed, ...(worker ? { worker: { script: worker.script, build: worker.build } } : {}) };
 }
-/** The Pages project the checkout's wrangler config names: only a config with a Pages output directory is a Pages project's, since a Worker's config names a Worker. */
-export async function configuredProject(cwd) {
+/**
+ * What the checkout's wrangler config is for: a Pages project, when it has a Pages output directory, or a Worker, when
+ * it names a script (`main`) or static assets instead; and the name it gives. A config with neither says nothing.
+ */
+export async function wranglerConfig(cwd) {
     const name = (value) => (typeof value === 'string' && new RegExp(`^${LABEL}$`).test(value) ? value : undefined);
     try {
         const toml = await readFile(join(cwd, 'wrangler.toml'), 'utf8');
-        if (/^\s*pages_build_output_dir\s*=/m.test(toml))
-            return name(/^\s*name\s*=\s*"([^"\n]+)"/m.exec(toml)?.[1]);
+        const kind = /^\s*pages_build_output_dir\s*=/m.test(toml) ? 'pages' : /^\s*(?:main\s*=|\[assets\]|assets\s*=)/m.test(toml) ? 'worker' : undefined;
+        if (kind)
+            return { kind, name: name(/^\s*name\s*=\s*"([^"\n]+)"/m.exec(toml)?.[1]) };
     }
     catch {
         // No TOML config: the JSON ones next.
@@ -118,8 +135,9 @@ export async function configuredProject(cwd) {
         try {
             // A jsonc config may carry comments, on their own lines or after a value, and trailing commas.
             const config = record(JSON.parse(plainJson(await readFile(join(cwd, file), 'utf8'))));
-            if (typeof config?.pages_build_output_dir === 'string')
-                return name(config.name);
+            const kind = typeof config?.pages_build_output_dir === 'string' ? 'pages' : typeof config?.main === 'string' || record(config?.assets) ? 'worker' : undefined;
+            if (kind)
+                return { kind, name: name(config?.name) };
         }
         catch {
             // Not there, or not readable as JSON.
@@ -127,6 +145,67 @@ export async function configuredProject(cwd) {
     }
     return undefined;
 }
+/** The Pages project the checkout's wrangler config names: only a config with a Pages output directory is a Pages project's, since a Worker's config names a Worker. */
+export async function configuredProject(cwd) {
+    const config = await wranglerConfig(cwd);
+    return config?.kind === 'pages' ? config.name : undefined;
+}
+/** The Cloudflare addresses the README names: the hosts under pages.dev (a project's own, `<subdomain>.pages.dev`, or a deployment's) and the first under workers.dev. */
+export async function readmeAddresses(cwd) {
+    for (const file of ['README.md', 'readme.md', 'README']) {
+        let text;
+        try {
+            text = await readFile(join(cwd, file), 'utf8');
+        }
+        catch {
+            continue;
+        }
+        const pages = [...new Set((text.match(new RegExp(`https://(?:${LABEL}\\.)+pages\\.dev`, 'g')) ?? []).map((url) => new URL(url).host))];
+        const workers = new RegExp(`https://${LABEL}\\.${LABEL}\\.workers\\.dev`).exec(text)?.[0];
+        return { pages, ...(workers ? { workers } : {}) };
+    }
+    return { pages: [] };
+}
+/** How many pages of an organization's app installations are read, a hundred each, before the app's absence is unknown. */
+const INSTALLATION_PAGES = 5;
+/** The page where the person installs Cloudflare's GitHub app, or configures its installation on an account: GitHub's own, which asks which account and repositories. */
+export const CLOUDFLARE_APP_PAGE = 'https://github.com/apps/cloudflare-workers-and-pages/installations/new';
+/**
+ * Cloudflare's GitHub app on the repository's owner, as gh reads it as the person: an organization's installations
+ * name the app, its id and whether it covers all or selected repositories; a user's own installations gh cannot list
+ * (that endpoint takes a GitHub App's token), and neither can a member who is no owner of the organization.
+ */
+export async function readGitHubApp(owner, repo, gh) {
+    const get = async (route) => JSON.parse(await gh(['api', '--hostname', 'github.com', '--method', 'GET', route]));
+    const unknown = { installed: 'unknown', page: CLOUDFLARE_APP_PAGE };
+    let repository;
+    try {
+        repository = record(await get(`/repos/${owner}/${repo}`));
+    }
+    catch {
+        return unknown;
+    }
+    if (record(repository?.owner)?.type !== 'Organization')
+        return unknown;
+    // The organization's installations a page at a time until the app or the list's end: a list read only in part says nothing of an app missing from it.
+    let app;
+    for (let page = 1; !app; page++) {
+        let installations;
+        try {
+            installations = list(record(await get(`/orgs/${owner}/installations?per_page=100&page=${page}`))?.installations);
+        }
+        catch {
+            return unknown;
+        }
+        app = installations.find((i) => isApp(i.app_slug));
+        if (!app && installations.length < 100)
+            return { installed: false, page: CLOUDFLARE_APP_PAGE };
+        if (!app && page === INSTALLATION_PAGES)
+            return unknown;
+    }
+    const selection = app.repository_selection === 'all' ? 'all' : app.repository_selection === 'selected' ? 'selected' : undefined;
+    return { installed: true, ...(selection ? { repositories: selection } : {}), page: positive(app.id) ? `https://github.com/organizations/${owner}/settings/installations/${app.id}` : CLOUDFLARE_APP_PAGE };
+}
 /** JSON with comments as JSON: line and block comments outside strings go, and so does a comma before a closing bracket. */
 export function plainJson(text) {
     let out = '';
@@ -155,15 +234,17 @@ export function plainJson(text) {
     return out.replace(/,(\s*[}\]])/g, '$1');
 }
 /** cf, Cloudflare's CLI, at the version this command is built against, run through npx, which installs it on first use. */
-export const CF_PACKAGE = 'cf@1.0.0-beta.8';
+export const CF_PACKAGE = 'cf@1.0.0-beta.13';
 /**
  * cf here: its JSON uncoloured, and an account's command given its account, which cf otherwise asks the person to pick
  * when they have several. `browser` lets its sign-in open one. npx runs it from a folder of the command's own, never the
  * checkout, whose node_modules and .npmrc would choose which cf runs as the person, outside the sandbox: every cf
- * command names its project or its account, so none needs the checkout.
+ * command names its project or its account, so none needs the checkout. It fetches cf through a cache of the command's
+ * own, never ~/.npm, where a sandboxed install could have planted a cf under the registry's live ETag; the registry is
+ * asked afresh, and no install script of cf's runs, which it does without.
  */
 export function cfRunner(opts = {}, runner = commandRunner) {
-    return (args, { account, signal } = {}) => runner('npx', ownFolder(), { timeoutMs: 120_000, ...opts, signal, env: { NO_COLOR: '1', ...(account ? { CLOUDFLARE_ACCOUNT_ID: account } : {}) } })(['--yes', CF_PACKAGE, ...args]);
+    return (args, { account, signal } = {}) => runner('npx', ownFolder(), { timeoutMs: 120_000, ...opts, signal, env: { NO_COLOR: '1', ...(account ? { CLOUDFLARE_ACCOUNT_ID: account } : {}) } })(['--yes', '--cache', ownNpmCache(), '--prefer-online', '--ignore-scripts', CF_PACKAGE, ...args]);
 }
 /** The status of the API call a cf command failed on, which its error box names on a line of its own ("│ 403 Forbidden", "│ 404 Not Found · HTTP /accounts/…"); null when it names none. */
 export function cfFailure(err) {
@@ -202,12 +283,41 @@ const PAGES = 4;
  * a project of the same name, a page at a time, until the list ends or every head has its build; a deployment Cloudflare
  * built from another repository is not this one's.
  */
-async function fromCf(project, cf, repository, signal) {
+async function fromCf(named, cf, repository, settings, signal) {
     const { cli, scopes, accounts } = await cfStatus(cf, signal);
     const pages = !scopes || scopes.includes('pages:read') || scopes.includes('pages:write');
-    if (cli !== 'signed-in' || !project || !pages)
+    if (cli !== 'signed-in' || !pages)
         return { cli, rows: [], failed: cli === 'unknown' };
     const same = (value, name) => typeof value === 'string' && value.toLowerCase() === name.toLowerCase();
+    // The project built from this repository, as the accounts' project lists name it by its source, and what its settings say of pull-request previews: read once, with the evidence, never while a build is waited for.
+    // A project of the name the checkout gives but built from another repository is not this one's: its settings are never the fact, so no yes changes it.
+    let project = named;
+    let pullRequestPreviews;
+    let found = accounts;
+    let account;
+    let subdomain;
+    if (settings) {
+        const listed = await listCloudflareProjects(cf, accounts, signal);
+        const built = listed.filter(({ project: p }) => {
+            const source = record(record(p.source)?.config);
+            return same(source?.owner, repository.owner) && same(source?.repo_name, repository.repo);
+        });
+        // Of several projects built from this repository, the one the addresses or the config name; else one that builds the pull requests, since any that does previews them; else the first.
+        // A project the checkout names (its config, or the README's pages.dev address) that is connected to no repository at all is this one's to connect; one built from another repository is not.
+        const unconnected = ({ project: p }) => !record(p.source) && ((named !== undefined && p.name === named) || (typeof p.subdomain === 'string' && repository.readme.includes(p.subdomain)));
+        const ours = built.find(({ project: p }) => named !== undefined && p.name === named) ?? built.find(({ project: p }) => cloudflarePreviewsFact(p).enabled === true) ?? built[0] ?? listed.find(unconnected);
+        if (ours) {
+            project = typeof ours.project.name === 'string' ? ours.project.name : project;
+            pullRequestPreviews = cloudflarePreviewsFact(ours.project);
+            found = [ours.account];
+            account = ours.account;
+            // The project's own host as Cloudflare named it, which a taken name suffixes (crewline-x1y.pages.dev).
+            subdomain = typeof ours.project.subdomain === 'string' && new RegExp(`^${LABEL}\\.pages\\.dev$`).test(ours.project.subdomain) ? ours.project.subdomain : undefined;
+        }
+    }
+    const settled = { ...(pullRequestPreviews ? { pullRequestPreviews } : {}), ...(account ? { account } : {}), ...(subdomain ? { subdomain } : {}) };
+    if (!project)
+        return { cli, rows: [], failed: false, ...settled };
     const ours = (d) => {
         const source = record(record(d.source)?.config);
         return !source || (same(source.owner, repository.owner) && same(source.repo_name, repository.repo));
@@ -215,7 +325,7 @@ async function fromCf(project, cf, repository, signal) {
     const rows = [];
     const built = () => repository.heads.every((sha) => rows.some((row) => row.sha && sha.startsWith(row.sha)));
     let failed = false;
-    for (const account of accounts.length ? accounts : [undefined]) {
+    for (const account of found.length ? found : [undefined]) {
         if (rows.length && built())
             break;
         for (let page = 1; page <= PAGES; page++) {
@@ -242,7 +352,31 @@ async function fromCf(project, cf, repository, signal) {
                 break;
         }
     }
-    return { cli, rows, failed };
+    return { cli, project, rows, failed, ...settled };
+}
+/** A page of cf's list of an account's Pages projects (ten is the most Cloudflare's API allows), and how many pages it reads at most. */
+const PROJECTS_PER_PAGE = 10;
+const PROJECT_PAGES = 10;
+/** The Pages projects of each account the sign-in reaches, as `cf pages list` prints them, each with its source: an account that could not be read lists none. */
+async function listCloudflareProjects(cf, accounts, signal) {
+    const projects = [];
+    for (const account of accounts) {
+        for (let page = 1; page <= PROJECT_PAGES; page++) {
+            let listed;
+            try {
+                const printed = await cf(['pages', 'list', '--page', String(page), '--per-page', String(PROJECTS_PER_PAGE)], { account, signal });
+                listed = list(JSON.parse(printed.slice(printed.indexOf('['), printed.lastIndexOf(']') + 1)));
+            }
+            catch {
+                break;
+            }
+            for (const project of listed)
+                projects.push({ account, project });
+            if (listed.length < PROJECTS_PER_PAGE)
+                break;
+        }
+    }
+    return projects;
 }
 /**
  * Whether this repository's pull requests get Cloudflare Pages previews: the newest, as GitHub and cf have them;
@@ -254,10 +388,22 @@ export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
         return unread();
     if (deps.branch !== undefined && !branchName(deps.branch))
         return unread();
-    const github = await fromGitHub(owner, repo, deps.gh ?? commandRunner('gh', cwd, { signal: deps.signal }), deps.pull, deps.branch);
-    const project = github.previews.map((p) => pagesProject(p.url)).find(Boolean) ?? (await configuredProject(cwd));
-    // cf installs itself through npx on a machine without it, which takes a while the first time.
-    const cf = await fromCf(project, deps.cf ?? cfRunner(), { owner, repo, heads: github.heads.map((h) => h.sha) }, deps.signal);
+    const gh = deps.gh ?? commandRunner('gh', cwd, { signal: deps.signal });
+    const plain = deps.pull === undefined && deps.branch === undefined;
+    const github = await fromGitHub(owner, repo, gh, deps.pull, deps.branch);
+    const config = await wranglerConfig(cwd);
+    const readme = plain ? await readmeAddresses(cwd) : { pages: [] };
+    const named = github.previews.map((p) => pagesProject(p.url)).find(Boolean) ?? (config?.kind === 'pages' ? config.name : undefined);
+    // cf installs itself through npx on a machine without it, which takes a while the first time. The project's settings are read with the plain evidence, not while a build is waited for.
+    const cf = await fromCf(named, deps.cf ?? cfRunner(), { owner, repo, heads: github.heads.map((h) => h.sha), readme: readme.pages }, plain, deps.signal);
+    const project = cf.project ?? named;
+    // A Worker built from the repository: its check runs, the config or the README say so, and the check runs say how its newest build went.
+    const script = github.worker?.script ?? (config?.kind === 'worker' ? config.name : undefined);
+    const worker = github.worker || config?.kind === 'worker' || readme.workers
+        ? { ...(script ? { script } : {}), build: github.worker?.build ?? 'none', ...(readme.workers ? { address: readme.workers } : {}) }
+        : undefined;
+    // Read once the repository is on Cloudflare by the evidence (a Pages project found or named, or a Worker), with the plain evidence alone.
+    const githubApp = plain && (cf.pullRequestPreviews || worker || project) ? await readGitHubApp(owner, repo, gh) : undefined;
     // A row is the head's when its commit is the head's; the pull request's heads say which. A wait for a pushed branch takes its head's rows alone.
     const head = (row) => github.heads.find((h) => row.sha && h.sha.startsWith(row.sha) && (deps.branch === undefined || h.branch === deps.branch));
     const rows = cf.rows.flatMap((row) => {
@@ -281,11 +427,167 @@ export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
     // The most recently updated pull request's first; a branch with no pull request among them last, as cf lists it.
     previews.sort((a, b) => (b.pullRequest ? 1 : 0) - (a.pullRequest ? 1 : 0) || b.at - a.at);
     return {
-        ...(project ? { project } : {}),
+        ...(project ? { project, production: `https://${cf.subdomain ?? `${project}.pages.dev`}` } : {}),
         previews: previews.slice(0, deps.branch !== undefined ? previews.length : NEWEST).map(({ at, ...preview }) => preview),
         cli: cf.cli,
         ...(github.failed || cf.failed
             ? { error: "Some of Cloudflare's previews could not be read: what is missing is unknown, not absent.", unread: [...(github.failed ? ['GitHub'] : []), ...(cf.failed ? ['cf'] : [])] }
             : {}),
+        ...(cf.pullRequestPreviews ? { pullRequestPreviews: cf.pullRequestPreviews } : {}),
+        ...(cf.account ? { account: cf.account } : {}),
+        ...(worker ? { worker } : {}),
+        ...(githubApp ? { githubApp } : {}),
+    };
+}
+/** The Pages project as `cf pages get` prints it, in the first of the sign-in's accounts that holds one of that name; null when none does, or cf could not read it. */
+export async function readCloudflareProject(cf, project, accounts, signal) {
+    for (const account of accounts) {
+        try {
+            const printed = await cf(['pages', 'get', project], { account, signal });
+            const read = record(JSON.parse(printed.slice(printed.indexOf('{'), printed.lastIndexOf('}') + 1)));
+            if (read?.name === project)
+                return { account, project: read };
+        }
+        catch (err) {
+            if (cfFailure(err) !== 404)
+                return null;
+        }
+    }
+    return null;
+}
+/** The project's source with the test drive's branch allowed: None becomes every non-production branch, Cloudflare's default; Custom branches keep their rules and gain `impeccable/*`. */
+export function cloudflarePreviewsBody(project) {
+    const source = record(project.source);
+    const config = record(source?.config);
+    if (!source || !config)
+        return null;
+    const includes = Array.isArray(config.preview_branch_includes) ? config.preview_branch_includes.filter((v) => typeof v === 'string') : [];
+    if (config.preview_deployment_setting === 'custom')
+        return { source: { ...source, config: { ...config, preview_branch_includes: [...includes, 'impeccable/*'] } } };
+    return { source: { ...source, config: { ...config, preview_deployment_setting: 'all' } } };
+}
+/**
+ * Turns a Pages project's pull-request previews on through cf signed in as the person, where the preview branch control
+ * is the one setting in the way and the sign-in holds pages:write, and reads the project back. `cf pages edit` sends
+ * the whole source as read, with the setting changed, so the Git connection stays as it is.
+ */
+export async function enableCloudflarePreviews(cf, project, status, signal) {
+    const unread = (reason) => ({ fact: { project, enabled: 'unknown', reason }, page: cloudflarePreviewsPage(status.accounts[0] ?? '', project), changed: false, reason });
+    if (status.cli !== 'signed-in')
+        return unread("cf, Cloudflare's CLI, is not signed in here.");
+    const read = await readCloudflareProject(cf, project, status.accounts, signal);
+    if (!read)
+        return unread(`cf could not read the Pages project ${project} in the accounts it reaches.`);
+    const page = cloudflarePreviewsPage(read.account, project);
+    const fact = cloudflarePreviewsFact(read.project);
+    if (fact.enabled !== false)
+        return { fact, page, changed: false };
+    if (fact.cause !== 'previews')
+        return { fact, page, changed: false, reason: `The run changes the preview branch control alone. ${fact.reason}` };
+    // An exclude rule is the person's, and excludes are evaluated first, so an include added beside it would change nothing.
+    if (/exclude rule/.test(fact.reason ?? ''))
+        return { fact, page, changed: false, reason: `The run adds to the include rules alone. ${fact.reason}` };
+    if (status.scopes && !status.scopes.includes('pages:write'))
+        return { fact, page, changed: false, reason: 'cf is signed in here without pages:write, so it cannot change the project.' };
+    const body = cloudflarePreviewsBody(read.project);
+    if (!body)
+        return { fact, page, changed: false, reason: 'The project has no Git source to change.' };
+    try {
+        await cf(['pages', 'edit', project, '--body', JSON.stringify(body)], { account: read.account, signal });
+    }
+    catch {
+        return { fact, page, changed: false, reason: 'Cloudflare refused the change: the role may not allow it.' };
+    }
+    const after = await readCloudflareProject(cf, project, [read.account], signal);
+    const afterFact = after ? cloudflarePreviewsFact(after.project) : fact;
+    return { fact: afterFact, page, changed: afterFact.enabled === true };
+}
+/** A Pages project's name for the repository: lowercase letters, digits and hyphens, as Cloudflare takes them. */
+export function pagesProjectName(repo) {
+    return repo.toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 58).replace(/-+$/, '') || 'site';
+}
+/** The source body `cf pages source connect` takes: the repository as GitHub identifies it, every branch but production a preview, as Cloudflare's dashboard connects one. */
+export function cloudflareSourceBody(repository) {
+    return {
+        type: 'github',
+        config: {
+            owner: repository.owner,
+            owner_id: String(repository.ownerId),
+            repo_name: repository.name,
+            repo_id: String(repository.id),
+            production_branch: repository.defaultBranch,
+            deployments_enabled: true,
+            production_deployments_enabled: true,
+            preview_deployment_setting: 'all',
+            preview_branch_includes: ['*'],
+            preview_branch_excludes: [],
+            pr_comments_enabled: true,
+            path_includes: ['*'],
+            path_excludes: [],
+        },
     };
 }
+/**
+ * Connects the repository to a Pages project through cf signed in as the person, the way the dashboard does: the
+ * project of that name in the account when it exists with no Git source, else one created for the repository with the
+ * build the checkout runs (`create`); then `cf pages source connect` with the repository as gh identifies it, so that
+ * Cloudflare builds the production branch and every other branch as a preview; then the project read back.
+ */
+export async function connectCloudflareProject(cf, gh, status, repository, plan, signal) {
+    const { project } = plan;
+    const refused = (reason) => ({ status: 'refused', project, reason });
+    if (status.cli !== 'signed-in')
+        return refused("cf, Cloudflare's CLI, is not signed in here.");
+    if (status.scopes && !status.scopes.includes('pages:write'))
+        return refused('cf is signed in here without pages:write, so it cannot change the account.');
+    const account = plan.account ?? status.accounts[0];
+    if (!account)
+        return refused('The Cloudflare sign-in reaches no account.');
+    let github;
+    try {
+        github = record(JSON.parse(await gh(['api', '--hostname', 'github.com', '--method', 'GET', `/repos/${repository.owner}/${repository.repo}`])));
+    }
+    catch {
+        github = undefined;
+    }
+    const owner = record(github?.owner);
+    const defaultBranch = github?.default_branch;
+    if (!github || !positive(github.id) || !owner || !positive(owner.id) || typeof owner.login !== 'string' || typeof github.name !== 'string' || typeof defaultBranch !== 'string' || !branchName(defaultBranch))
+        return refused('GitHub did not answer for the repository.');
+    const existing = await readCloudflareProject(cf, project, [account], signal);
+    let created = false;
+    if (!existing) {
+        if (!plan.create)
+            return refused(`cf could not read the Pages project ${project} in the account.`);
+        const build = { ...(plan.create.command ? { build_command: plan.create.command } : {}), ...(plan.create.outputDir ? { destination_dir: plan.create.outputDir } : {}) };
+        try {
+            await cf(['pages', 'create', '--body', JSON.stringify({ name: project, production_branch: defaultBranch, ...(Object.keys(build).length ? { build_config: build } : {}) })], { account, signal });
+        }
+        catch (err) {
+            const code = cfFailure(err);
+            return refused(code === 409 || code === 400 ? `Cloudflare refused creating the Pages project ${project}: the name may be taken in the account.` : `Cloudflare refused creating the Pages project ${project}.`);
+        }
+        created = true;
+    }
+    else if (record(existing.project.source)) {
+        const config = record(record(existing.project.source)?.config);
+        const same = typeof config?.owner === 'string' && typeof config.repo_name === 'string' && config.owner.toLowerCase() === repository.owner.toLowerCase() && config.repo_name.toLowerCase() === repository.repo.toLowerCase();
+        return same
+            ? { status: 'connected', project, created: false, ...(typeof existing.project.subdomain === 'string' ? { subdomain: existing.project.subdomain } : {}), fact: cloudflarePreviewsFact(existing.project), reason: 'The project is connected to the repository already.' }
+            : refused(`The Pages project ${project} is connected to another repository.`);
+    }
+    try {
+        await cf(['pages', 'source', 'connect', project, '--body', JSON.stringify(cloudflareSourceBody({ owner: owner.login, ownerId: owner.id, name: github.name, id: github.id, defaultBranch }))], { account, signal });
+    }
+    catch {
+        return refused(created ? `The Pages project ${project} was created, but Cloudflare refused connecting the repository to it: Cloudflare's GitHub app may not be installed for ${owner.login}.` : `Cloudflare refused connecting the repository to the Pages project ${project}: Cloudflare's GitHub app may not be installed for ${owner.login}.`);
+    }
+    const after = await readCloudflareProject(cf, project, [account], signal);
+    if (!after)
+        return refused(`The Pages project ${project} could not be read back.`);
+    const fact = cloudflarePreviewsFact(after.project);
+    const config = record(record(after.project.source)?.config);
+    if (fact.cause === 'source' || typeof config?.repo_name !== 'string' || config.repo_name.toLowerCase() !== repository.repo.toLowerCase())
+        return refused(`Cloudflare did not keep the repository on the Pages project ${project}.`);
+    return { status: 'connected', project, created, ...(typeof after.project.subdomain === 'string' ? { subdomain: after.project.subdomain } : {}), productionBranch: defaultBranch, fact };
+}