@omega.js/manager 0.1.0

package/dist/services/edge/ensure/rules-configuration.js

@@ -0,0 +1,98 @@
+/**
+ * Ensure configuration rules match `edge.providers.cloudflare.rules.configuration`.
+ *
+ * 1. Reads the http_config_settings entrypoint ruleset (or notes it needs creating).
+ * 2. Diffs each configured rule by description — creates missing, updates stale, removes unconfigured.
+ * 3. POSTs a new ruleset if missing; PUTs the merged ruleset if updating.
+ */
+const chalk = require('chalk').default;
+const { cacheRead } = require('../lib/read-cache.js');
+const { fetchRuleset, applyRuleset, getZoneId, zoneGate } = require('../lib/ruleset-helper.js');
+
+module.exports = async function ensureRulesConfiguration(context) {
+  const { cloudflareApi: api, brandRoot, brandConfig, options = {} } = context;
+  const zoneId = getZoneId(context);
+  const gated = zoneGate(context, 'rulesConfiguration');
+  if (gated) return gated;
+
+  // === READ ===
+  const { ruleset, needsCreate } = await fetchRuleset(api, zoneId, 'http_config_settings');
+  const readCount = ruleset?.rules?.length || 0;
+  console.log(`      ${chalk.green('✓')} Read ${chalk.dim(`(${readCount} items)`)}`);
+  cacheRead(brandRoot, 'rules-configuration', { count: readCount, ruleset, needsCreate });
+
+  // === DIFF ===
+  const configRulesConfig = brandConfig?.edge?.providers?.cloudflare?.rules?.configuration;
+  if (!configRulesConfig || !Array.isArray(configRulesConfig) || configRulesConfig.length === 0) {
+    console.log(`      ${chalk.dim('⊘ No changes needed')}`);
+    return;
+  }
+
+  const modifiedRules = ruleset?.rules ? [...ruleset.rules] : [];
+  let hasChanges = false;
+
+  for (const configRule of configRulesConfig) {
+    const ruleName = configRule.name;
+    const ruleIndex = modifiedRules.findIndex((rule) => rule.description === ruleName);
+    const currentRule = ruleIndex >= 0 ? modifiedRules[ruleIndex] : null;
+
+    const expectedRule = {
+      ...(currentRule || {}),
+      action: 'set_config',
+      action_parameters: configRule.settings || {},
+      expression: configRule.expression || currentRule?.expression,
+      description: ruleName,
+      enabled: configRule.enabled !== undefined ? configRule.enabled : (currentRule?.enabled ?? true),
+    };
+
+    if (!currentRule) {
+      console.log(`      ${chalk.dim('·')} create ${chalk.cyan(`"${ruleName}"`)}`);
+      modifiedRules.push(expectedRule);
+      hasChanges = true;
+      continue;
+    }
+
+    const currentParams = JSON.stringify(currentRule.action_parameters || {});
+    const needsUpdate =
+      currentParams !== JSON.stringify(expectedRule.action_parameters)
+      || currentRule.expression !== expectedRule.expression
+      || currentRule.enabled !== expectedRule.enabled;
+
+    if (needsUpdate) {
+      console.log(`      ${chalk.dim('·')} update ${chalk.cyan(`"${ruleName}"`)}`);
+      modifiedRules[ruleIndex] = expectedRule;
+      hasChanges = true;
+    }
+  }
+
+  // Remove stale rules (in Cloudflare but not in config)
+  const configNames = new Set(configRulesConfig.map((r) => r.name));
+  const staleIndices = [];
+  for (let i = modifiedRules.length - 1; i >= 0; i--) {
+    if (modifiedRules[i].description && !configNames.has(modifiedRules[i].description)) {
+      console.log(`      ${chalk.dim('·')} remove ${chalk.cyan(`"${modifiedRules[i].description}"`)}`);
+      staleIndices.push(i);
+      hasChanges = true;
+    }
+  }
+  for (const i of staleIndices) modifiedRules.splice(i, 1);
+
+  if (!hasChanges && !needsCreate) {
+    console.log(`      ${chalk.dim('⊘ No changes needed')}`);
+    return;
+  }
+
+  // === WRITE ===
+  const output = await applyRuleset(api, zoneId, {
+    ruleset,
+    needsCreate,
+    rules: modifiedRules,
+    phase: 'http_config_settings',
+    name: 'Configuration Rules',
+    description: 'Configuration rules managed by Omega Manager',
+    label: 'Configuration rules',
+    dryRun: options.dryRun,
+  });
+
+  return { output: { configuration: output } };
+};

package/dist/services/edge/ensure/rules-managed-transforms.js

@@ -0,0 +1,101 @@
+/**
+ * Ensure Managed Transforms match `edge.providers.cloudflare.rules.managedTransforms`.
+ *
+ * 1. Reads the current managed_request_headers + managed_response_headers state.
+ * 2. Diffs against the config (enable/disable each Cloudflare-named transform).
+ * 3. PATCHes the combined updated lists in one call.
+ */
+const chalk = require('chalk').default;
+const { cacheRead } = require('../lib/read-cache.js');
+const { getZoneId, zoneGate } = require('../lib/ruleset-helper.js');
+const { dryRunPlan } = require('../../../lib/run-gates.js');
+
+const REQUEST_HEADERS_MAP = {
+  addClientCertificateHeaders: 'add_client_certificate_headers',
+  addVisitorLocationHeaders: 'add_visitor_location_headers',
+  removeVisitorIpHeaders: 'remove_visitor_ip_headers',
+  addWafCredentialCheckStatusHeader: 'add_waf_credential_check_status_header',
+};
+
+const RESPONSE_HEADERS_MAP = {
+  removeXPoweredByHeader: 'remove_x-powered-by_header',
+  addSecurityHeaders: 'add_security_headers',
+};
+
+module.exports = async function ensureManagedTransforms(context) {
+  const { cloudflareApi: api, brandRoot, brandConfig, options = {} } = context;
+  const zoneId = getZoneId(context);
+  const gated = zoneGate(context, 'rulesManagedTransforms');
+  if (gated) return gated;
+
+  // === READ ===
+  const data = await api.makeRequest(`/zones/${zoneId}/managed_headers`);
+  const managedRequestHeaders = data.result.managed_request_headers || [];
+  const managedResponseHeaders = data.result.managed_response_headers || [];
+
+  console.log(`      ${chalk.green('✓')} Read`);
+  cacheRead(brandRoot, 'rules-managed-transforms', { managedRequestHeaders, managedResponseHeaders });
+
+  // === DIFF ===
+  const managedTransformsConfig = brandConfig?.edge?.providers?.cloudflare?.rules?.managedTransforms;
+  if (!managedTransformsConfig) {
+    console.log(`      ${chalk.dim('⊘ No changes needed')}`);
+    return;
+  }
+
+  let hasChanges = false;
+  const updatedRequestHeaders = [...managedRequestHeaders];
+  const updatedResponseHeaders = [...managedResponseHeaders];
+
+  const applyDiff = (configSection, map, headersList) => {
+    if (!configSection) return;
+    for (const [configKey, apiId] of Object.entries(map)) {
+      const targetEnabled = configSection[configKey];
+      if (targetEnabled === null || targetEnabled === undefined) continue;
+
+      const headerIndex = headersList.findIndex((h) => h.id === apiId);
+      const currentEnabled = headerIndex >= 0 ? headersList[headerIndex].enabled : false;
+
+      if (currentEnabled !== targetEnabled) {
+        console.log(`      ${chalk.dim('·')} ${apiId}: ${chalk.dim(currentEnabled)} => ${chalk.cyan(targetEnabled)}`);
+        hasChanges = true;
+        if (headerIndex >= 0) {
+          headersList[headerIndex] = { ...headersList[headerIndex], enabled: targetEnabled };
+        } else {
+          headersList.push({ id: apiId, enabled: targetEnabled });
+        }
+      }
+    }
+  };
+
+  applyDiff(managedTransformsConfig.request, REQUEST_HEADERS_MAP, updatedRequestHeaders);
+  applyDiff(managedTransformsConfig.response, RESPONSE_HEADERS_MAP, updatedResponseHeaders);
+
+  if (!hasChanges) {
+    console.log(`      ${chalk.dim('⊘ No changes needed')}`);
+    return;
+  }
+
+  if (options.dryRun) {
+    return dryRunPlan('update Managed Transforms', { status: 'success', output: { managedTransforms: { planned: true } } });
+  }
+
+  // === WRITE ===
+  const output = { updated: false };
+  try {
+    await api.makeRequest(`/zones/${zoneId}/managed_headers`, {
+      method: 'PATCH',
+      body: JSON.stringify({
+        managed_request_headers: updatedRequestHeaders,
+        managed_response_headers: updatedResponseHeaders,
+      }),
+    });
+    output.updated = true;
+    console.log(`      ${chalk.green('✓')} Managed Transforms updated`);
+  } catch (error) {
+    output.error = error.message;
+    console.error(`      ${chalk.red('✗')} Managed Transforms failed${chalk.dim(`: ${error.message}`)}`);
+  }
+
+  return { output: { managedTransforms: output } };
+};

package/dist/services/edge/ensure/rules-redirect.js

@@ -0,0 +1,107 @@
+/**
+ * Ensure redirect rules match `edge.providers.cloudflare.rules.redirect`.
+ *
+ * 1. Reads the http_request_dynamic_redirect entrypoint ruleset (or notes it needs creating).
+ * 2. Diffs each configured rule by description — creates missing, updates stale, removes unconfigured.
+ * 3. POSTs a new ruleset if missing; PUTs the merged ruleset if updating.
+ */
+const chalk = require('chalk').default;
+const { cacheRead } = require('../lib/read-cache.js');
+const { fetchRuleset, applyRuleset, getZoneId, zoneGate } = require('../lib/ruleset-helper.js');
+
+module.exports = async function ensureRulesRedirect(context) {
+  const { cloudflareApi: api, brandRoot, brandConfig, options = {} } = context;
+  const zoneId = getZoneId(context);
+  const gated = zoneGate(context, 'rulesRedirect');
+  if (gated) return gated;
+
+  // === READ ===
+  const { ruleset, needsCreate } = await fetchRuleset(api, zoneId, 'http_request_dynamic_redirect');
+  const readCount = ruleset?.rules?.length || 0;
+  console.log(`      ${chalk.green('✓')} Read ${chalk.dim(`(${readCount} items)`)}`);
+  cacheRead(brandRoot, 'rules-redirect', { count: readCount, ruleset, needsCreate });
+
+  // === DIFF ===
+  const redirectRulesConfig = brandConfig?.edge?.providers?.cloudflare?.rules?.redirect;
+  if (!redirectRulesConfig || !Array.isArray(redirectRulesConfig) || redirectRulesConfig.length === 0) {
+    console.log(`      ${chalk.dim('⊘ No changes needed')}`);
+    return;
+  }
+
+  const modifiedRules = ruleset?.rules ? [...ruleset.rules] : [];
+  let hasChanges = false;
+
+  for (const configRule of redirectRulesConfig) {
+    const ruleName = configRule.name;
+    const ruleIndex = modifiedRules.findIndex((rule) => rule.description === ruleName);
+    const currentRule = ruleIndex >= 0 ? modifiedRules[ruleIndex] : null;
+
+    const expectedRule = {
+      ...(currentRule || {}),
+      action: 'redirect',
+      action_parameters: {
+        from_value: {
+          status_code: configRule.statusCode || 301,
+          preserve_query_string: configRule.preserveQueryString !== undefined ? configRule.preserveQueryString : true,
+          target_url: configRule.targetUrl || currentRule?.action_parameters?.from_value?.target_url,
+        },
+      },
+      expression: configRule.expression || currentRule?.expression,
+      description: ruleName,
+      enabled: configRule.enabled !== undefined ? configRule.enabled : (currentRule?.enabled ?? true),
+    };
+
+    if (!currentRule) {
+      console.log(`      ${chalk.dim('·')} create ${chalk.cyan(`"${ruleName}"`)}`);
+      modifiedRules.push(expectedRule);
+      hasChanges = true;
+      continue;
+    }
+
+    const currentParams = currentRule.action_parameters?.from_value || {};
+    const expectedParams = expectedRule.action_parameters.from_value;
+    const needsUpdate =
+      currentParams.status_code !== expectedParams.status_code
+      || currentParams.preserve_query_string !== expectedParams.preserve_query_string
+      || JSON.stringify(currentParams.target_url) !== JSON.stringify(expectedParams.target_url)
+      || currentRule.expression !== expectedRule.expression
+      || currentRule.enabled !== expectedRule.enabled;
+
+    if (needsUpdate) {
+      console.log(`      ${chalk.dim('·')} update ${chalk.cyan(`"${ruleName}"`)}`);
+      modifiedRules[ruleIndex] = expectedRule;
+      hasChanges = true;
+    }
+  }
+
+  // Remove stale rules (in Cloudflare but not in config)
+  const configNames = new Set(redirectRulesConfig.map((r) => r.name));
+  const staleIndices = [];
+  for (let i = modifiedRules.length - 1; i >= 0; i--) {
+    if (modifiedRules[i].description && !configNames.has(modifiedRules[i].description)) {
+      console.log(`      ${chalk.dim('·')} remove ${chalk.cyan(`"${modifiedRules[i].description}"`)}`);
+      staleIndices.push(i);
+      hasChanges = true;
+    }
+  }
+  for (const i of staleIndices) modifiedRules.splice(i, 1);
+
+  if (!hasChanges && !needsCreate) {
+    console.log(`      ${chalk.dim('⊘ No changes needed')}`);
+    return;
+  }
+
+  // === WRITE ===
+  const output = await applyRuleset(api, zoneId, {
+    ruleset,
+    needsCreate,
+    rules: modifiedRules,
+    phase: 'http_request_dynamic_redirect',
+    name: 'Redirect Rules',
+    description: 'Redirect rules managed by Omega Manager',
+    label: 'Redirect rules',
+    dryRun: options.dryRun,
+  });
+
+  return { output: { redirect: output } };
+};

package/dist/services/edge/ensure/rules-response-headers.js

@@ -0,0 +1,90 @@
+/**
+ * Ensure response header transform rules match `edge.providers.cloudflare.rules.responseHeaders`.
+ *
+ * Different from other ruleset operations: always uses PUT, but targets either
+ * the existing ruleset's ID or the phase's entrypoint URL when it doesn't yet
+ * exist.
+ */
+const chalk = require('chalk').default;
+const { cacheRead } = require('../lib/read-cache.js');
+const { fetchRuleset, getZoneId, zoneGate } = require('../lib/ruleset-helper.js');
+const { dryRunPlan } = require('../../../lib/run-gates.js');
+
+const PHASE = 'http_response_headers_transform';
+
+module.exports = async function ensureRulesResponseHeaders(context) {
+  const { cloudflareApi: api, brandRoot, brandConfig, options = {} } = context;
+  const zoneId = getZoneId(context);
+  const gated = zoneGate(context, 'rulesResponseHeaders');
+  if (gated) return gated;
+
+  // === READ ===
+  const { ruleset } = await fetchRuleset(api, zoneId, PHASE);
+  const readCount = ruleset?.rules?.length || 0;
+  console.log(`      ${chalk.green('✓')} Read`);
+  cacheRead(brandRoot, 'rules-response-headers', {
+    responseTransform: { count: readCount, ruleset },
+  });
+
+  // === DIFF ===
+  const responseHeadersConfig = brandConfig?.edge?.providers?.cloudflare?.rules?.responseHeaders;
+  if (!responseHeadersConfig || responseHeadersConfig.length === 0) {
+    console.log(`      ${chalk.dim('⊘ No changes needed')}`);
+    return;
+  }
+
+  const existingRules = ruleset?.rules || [];
+  const configuredRules = responseHeadersConfig.map((rule) => ({
+    description: rule.name,
+    expression: rule.expression,
+    action: 'rewrite',
+    action_parameters: {
+      headers: Object.fromEntries(
+        Object.entries(rule.headers).map(([name, value]) => [name, { operation: 'set', value }]),
+      ),
+    },
+    enabled: rule.enabled,
+  }));
+
+  // Compare ignoring Cloudflare metadata (id, ref, version, last_updated)
+  const normalize = (rule) => ({
+    description: rule.description,
+    expression: rule.expression,
+    action: rule.action,
+    action_parameters: rule.action_parameters,
+    enabled: rule.enabled,
+  });
+  const rulesChanged = JSON.stringify(existingRules.map(normalize)) !== JSON.stringify(configuredRules.map(normalize));
+
+  if (!rulesChanged) {
+    console.log(`      ${chalk.dim('⊘ No changes needed')}`);
+    return;
+  }
+
+  console.log(`      ${chalk.dim('·')} ${chalk.bold(configuredRules.length)} rules`);
+
+  if (options.dryRun) {
+    return dryRunPlan('update response header rules', { status: 'success', output: { responseHeaders: { planned: configuredRules.length } } });
+  }
+
+  // === WRITE ===
+  const output = { updated: false };
+  try {
+    const endpoint = ruleset?.id
+      ? `/zones/${zoneId}/rulesets/${ruleset.id}`
+      : `/zones/${zoneId}/rulesets/phases/${PHASE}/entrypoint`;
+
+    const body = ruleset?.id
+      ? { rules: configuredRules, phase: PHASE }
+      : { rules: configuredRules };
+
+    await api.makeRequest(endpoint, { method: 'PUT', body: JSON.stringify(body) });
+    output.updated = true;
+    console.log(`      ${chalk.green('✓')} Response header transform rules updated`);
+  } catch (error) {
+    output.error = error.message;
+    console.error(`      ${chalk.red('✗')} Response header transform rules failed${chalk.dim(`: ${error.message}`)}`);
+  }
+
+  return { output: { responseHeaders: output } };
+};

package/dist/services/edge/ensure/rules-security.js

@@ -0,0 +1,142 @@
+/**
+ * Ensure custom firewall rules match `edge.providers.cloudflare.rules.security`.
+ *
+ * 1. Reads the http_request_firewall_custom entrypoint ruleset (and managed for cache only).
+ * 2. Diffs each configured rule by description (name) — creates/updates `skip`-style rules.
+ * 3. PUTs the merged ruleset, or PUT to the phase entrypoint if it doesn't exist yet.
+ */
+const chalk = require('chalk').default;
+const { cacheRead } = require('../lib/read-cache.js');
+const { fetchRuleset, getZoneId, zoneGate } = require('../lib/ruleset-helper.js');
+const { dryRunPlan } = require('../../../lib/run-gates.js');
+
+const PHASE = 'http_request_firewall_custom';
+const MANAGED_PHASE = 'http_request_firewall_managed';
+
+module.exports = async function ensureRulesSecurity(context) {
+  const { cloudflareApi: api, brandRoot, brandConfig, options = {} } = context;
+  const zoneId = getZoneId(context);
+  const gated = zoneGate(context, 'rulesSecurity');
+  if (gated) return gated;
+
+  // === READ ===
+  const { ruleset: customRuleset } = await fetchRuleset(api, zoneId, PHASE);
+  const { ruleset: managedRuleset } = await fetchRuleset(api, zoneId, MANAGED_PHASE);
+  console.log(`      ${chalk.green('✓')} Read`);
+  cacheRead(brandRoot, 'rules-security', {
+    customRules: { count: customRuleset?.rules?.length || 0, ruleset: customRuleset },
+    managedRules: { count: managedRuleset?.rules?.length || 0, ruleset: managedRuleset },
+  });
+
+  // === DIFF ===
+  const securityRulesConfig = brandConfig?.edge?.providers?.cloudflare?.rules?.security;
+  if (!securityRulesConfig || !Array.isArray(securityRulesConfig) || securityRulesConfig.length === 0) {
+    console.log(`      ${chalk.dim('⊘ No changes needed')}`);
+    return;
+  }
+
+  const modifiedRules = customRuleset?.rules ? [...customRuleset.rules] : [];
+  let hasChanges = false;
+
+  for (const configRule of securityRulesConfig) {
+    const ruleName = configRule.name;
+    const ruleIndex = modifiedRules.findIndex((rule) => rule.description === ruleName);
+    const currentRule = ruleIndex >= 0 ? modifiedRules[ruleIndex] : null;
+
+    const actionParameters = {
+      products: configRule.skipProducts || currentRule?.action_parameters?.products || [],
+    };
+    if (configRule.skipPhases) {
+      actionParameters.phases = configRule.skipPhases;
+    } else if (currentRule?.action_parameters?.phases) {
+      actionParameters.phases = currentRule.action_parameters.phases;
+    }
+    if (configRule.skipRuleset) {
+      actionParameters.ruleset = configRule.skipRuleset;
+    } else if (currentRule?.action_parameters?.ruleset) {
+      actionParameters.ruleset = currentRule.action_parameters.ruleset;
+    }
+
+    const expectedRule = {
+      ...(currentRule || {}),
+      action: configRule.action || 'skip',
+      action_parameters: actionParameters,
+      expression: configRule.expression || currentRule?.expression,
+      description: ruleName,
+      enabled: configRule.enabled !== undefined ? configRule.enabled : (currentRule?.enabled ?? true),
+      logging: {
+        enabled: configRule.logging !== undefined ? configRule.logging : (currentRule?.logging?.enabled ?? false),
+      },
+    };
+
+    if (!currentRule) {
+      console.log(`      ${chalk.dim('·')} create ${chalk.cyan(`"${ruleName}"`)}`);
+      modifiedRules.push(expectedRule);
+      hasChanges = true;
+      continue;
+    }
+
+    const currentProducts = JSON.stringify(currentRule.action_parameters?.products || []);
+    const currentPhases = JSON.stringify(currentRule.action_parameters?.phases || []);
+    const needsUpdate =
+      currentRule.action !== expectedRule.action
+      || currentProducts !== JSON.stringify(expectedRule.action_parameters.products)
+      || currentPhases !== JSON.stringify(expectedRule.action_parameters.phases || [])
+      || currentRule.action_parameters?.ruleset !== expectedRule.action_parameters.ruleset
+      || currentRule.expression !== expectedRule.expression
+      || currentRule.enabled !== expectedRule.enabled
+      || (currentRule.logging?.enabled ?? false) !== expectedRule.logging.enabled;
+
+    if (needsUpdate) {
+      console.log(`      ${chalk.dim('·')} update ${chalk.cyan(`"${ruleName}"`)}`);
+      modifiedRules[ruleIndex] = expectedRule;
+      hasChanges = true;
+    }
+  }
+
+  // Remove stale rules (in Cloudflare but not in config)
+  const configNames = new Set(securityRulesConfig.map((r) => r.name));
+  const staleIndices = [];
+  for (let i = modifiedRules.length - 1; i >= 0; i--) {
+    if (modifiedRules[i].description && !configNames.has(modifiedRules[i].description)) {
+      console.log(`      ${chalk.dim('·')} remove ${chalk.cyan(`"${modifiedRules[i].description}"`)}`);
+      staleIndices.push(i);
+      hasChanges = true;
+    }
+  }
+  for (const i of staleIndices) modifiedRules.splice(i, 1);
+
+  if (!hasChanges) {
+    console.log(`      ${chalk.dim('⊘ No changes needed')}`);
+    return;
+  }
+
+  if (options.dryRun) {
+    return dryRunPlan('update security rules', { status: 'success', output: { security: { planned: modifiedRules.length } } });
+  }
+
+  // === WRITE ===
+  const output = { updated: false };
+  try {
+    const description = customRuleset?.description || '';
+    if (customRuleset?.id) {
+      await api.makeRequest(`/zones/${zoneId}/rulesets/${customRuleset.id}`, {
+        method: 'PUT',
+        body: JSON.stringify({ rules: modifiedRules, description }),
+      });
+      console.log(`      ${chalk.green('✓')} Security rules updated`);
+    } else {
+      await api.makeRequest(`/zones/${zoneId}/rulesets/phases/${PHASE}/entrypoint`, {
+        method: 'PUT',
+        body: JSON.stringify({ rules: modifiedRules, description }),
+      });
+      console.log(`      ${chalk.green('✓')} Security rules created`);
+    }
+    output.updated = true;
+  } catch (error) {
+    output.error = error.message;
+    console.error(`      ${chalk.red('✗')} Security rules failed${chalk.dim(`: ${error.message}`)}`);
+  }
+
+  return { output: { security: output } };
+};

package/dist/services/edge/ensure/speed-scheduled-tests.js

@@ -0,0 +1,98 @@
+/**
+ * Ensure a Cloudflare Speed Test schedule for the brand homepage matches
+ * `edge.providers.cloudflare.speedTest`.
+ *
+ * 1. Reads all currently-tested pages + their schedules.
+ * 2. Locates the homepage schedule (compared loosely — Cloudflare returns mixed URL formats).
+ * 3. POSTs the schedule (create-or-replace endpoint).
+ */
+const chalk = require('chalk').default;
+const { cacheRead } = require('../lib/read-cache.js');
+const { getZoneId, zoneGate } = require('../lib/ruleset-helper.js');
+const { dryRunPlan } = require('../../../lib/run-gates.js');
+
+module.exports = async function ensureSpeedScheduledTests(context) {
+  const { cloudflareApi: api, brandRoot, brandConfig, domain, options = {} } = context;
+  const zoneId = getZoneId(context);
+  const gated = zoneGate(context, 'speedScheduledTests');
+  if (gated) return gated;
+
+  // === READ ===
+  // The Speed API rejects zones that aren't active yet (nameservers pending)
+  // with 401 speed.errors.zone_not_active — skip until the zone activates
+  let pagesData;
+  try {
+    pagesData = await api.makeRequest(`/zones/${zoneId}/speed_api/pages`);
+  } catch (error) {
+    if (error.message.includes('zone_not_active')) {
+      console.log(`      ${chalk.dim('⊘ Zone not active yet (nameservers pending) — skipping until activation')}`);
+      return { status: 'skipped' };
+    }
+    throw error;
+  }
+  const pages = pagesData.result || [];
+
+  const schedules = [];
+  for (const page of pages) {
+    try {
+      const scheduleData = await api.makeRequest(`/zones/${zoneId}/speed_api/schedule/${encodeURIComponent(page.url)}`);
+      if (scheduleData.result) {
+        schedules.push({ url: page.url, schedule: scheduleData.result });
+      }
+    } catch (error) {
+      if (!error.message.includes('404')) {
+        console.warn(`      ${chalk.yellow('⚠')} Failed to get schedule for ${chalk.cyan(page.url)}${chalk.dim(`: ${error.message}`)}`);
+      }
+    }
+  }
+
+  console.log(`      ${chalk.green('✓')} Read`);
+  cacheRead(brandRoot, 'speed-scheduled-tests', { schedules });
+
+  // === DIFF ===
+  const speedTestConfig = brandConfig?.edge?.providers?.cloudflare?.speedTest;
+  if (!speedTestConfig) {
+    console.log(`      ${chalk.dim('⊘ No changes needed')}`);
+    return;
+  }
+
+  const homepageUrl = `https://${domain}`;
+  const normalizeUrl = (url) => url.replace(/^https?:\/\//, '').replace(/\/$/, '');
+  const normalizedHomepage = normalizeUrl(homepageUrl);
+  const existingSchedule = schedules.find((s) => normalizeUrl(s.url) === normalizedHomepage);
+
+  const targetFrequency = speedTestConfig.frequency;
+  const targetRegion = speedTestConfig.region;
+
+  if (existingSchedule) {
+    const current = existingSchedule.schedule;
+    if (current.frequency === targetFrequency && current.region === targetRegion) {
+      console.log(`      ${chalk.dim('⊘ No changes needed')}`);
+      return;
+    }
+    console.log(`      ${chalk.dim('·')} update ${chalk.cyan(homepageUrl)}: ${chalk.dim(`${current.frequency}/${current.region}`)} => ${chalk.cyan(`${targetFrequency}/${targetRegion}`)}`);
+  } else {
+    console.log(`      ${chalk.dim('·')} create ${chalk.cyan(homepageUrl)}: ${chalk.cyan(`${targetFrequency} in ${targetRegion}`)}`);
+  }
+
+  if (options.dryRun) {
+    return dryRunPlan(`${existingSchedule ? 'update' : 'create'} the speed test schedule`, { status: 'success', output: { speedTest: { planned: existingSchedule ? 'update' : 'create' } } });
+  }
+
+  // === WRITE ===
+  const output = { updated: false };
+  const action = existingSchedule ? 'updated' : 'created';
+  try {
+    await api.makeRequest(`/zones/${zoneId}/speed_api/schedule/${encodeURIComponent(homepageUrl)}`, {
+      method: 'POST',
+      body: JSON.stringify({ frequency: targetFrequency, region: targetRegion }),
+    });
+    output.updated = true;
+    console.log(`      ${chalk.green('✓')} Speed Test Schedule ${action}: ${chalk.cyan(homepageUrl)} (${chalk.cyan(`${targetFrequency}, ${targetRegion}`)})`);
+  } catch (error) {
+    output.error = error.message;
+    console.error(`      ${chalk.red('✗')} Speed Test Schedule failed for ${chalk.cyan(homepageUrl)}${chalk.dim(`: ${error.message}`)}`);
+  }
+
+  return { output: { speedTest: output } };
+};