@phnx-labs/agents-cli 1.22.114 → 1.22.115

package/dist/lib/share/http-error.js

@@ -1,65 +0,0 @@
-/**
- * ONE bounded extractor for the share Worker's error responses.
- *
- * Every share HTTP call (publish PUT, list/revisions GET, delete DELETE)
- * previously threw on `!ok` with only the status code, discarding the JSON error
- * body the Worker actually returns (`{"error":"…"}` for a 400/413/429, plus a
- * `Retry-After` on a 429). The result: a rate-limited or quota-exceeded publish
- * surfaced as a bare "Publish failed (429)" with no reason. This pulls the
- * server's own `error` string and preserves the status + `Retry-After`, so the
- * user sees why.
- *
- * Bounded and safe by construction: it parses at most {@link MAX_ERROR_BODY_BYTES}
- * of the body, only lifts a string `error` field, caps its length, and NEVER
- * surfaces an arbitrary body — a non-JSON or oversized body yields no message,
- * so an HTML error page or a huge payload can't leak into a CLI error string.
- */
-/** Never parse more than this many chars of a body — a legitimate `{"error":"…"}`
- * is tiny; a larger body is an HTML page or noise we deliberately don't surface. */
-export const MAX_ERROR_BODY_BYTES = 4096;
-/** Cap the surfaced message so even a pathological (but valid-JSON) `error`
- * string can't blow up the CLI output. */
-export const MAX_ERROR_MESSAGE_CHARS = 300;
-/**
- * Extract the bounded error facts from a share Worker response. Pulls a string
- * `error` field from a small JSON body, preserves status + `Retry-After`, and
- * never surfaces an arbitrary body.
- */
-export function extractShareHttpError(res) {
-    const out = { status: res.status };
-    const retryAfter = res.retryAfter?.trim();
-    if (retryAfter)
-        out.retryAfter = retryAfter;
-    const raw = res.body;
-    if (raw && raw.length <= MAX_ERROR_BODY_BYTES) {
-        try {
-            const parsed = JSON.parse(raw);
-            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
-                const err = parsed.error;
-                if (typeof err === 'string' && err.trim()) {
-                    out.serverMessage = err.trim().slice(0, MAX_ERROR_MESSAGE_CHARS);
-                }
-            }
-        }
-        catch {
-            // Not JSON (an HTML error page, a proxy body, truncated bytes) — deliberately
-            // surface nothing rather than dump an arbitrary body into the CLI error.
-        }
-    }
-    return out;
-}
-/**
- * A one-line suffix summarizing the server's structured error, or `''` when the
- * response carried nothing extractable. Appended after the status-bearing prefix
- * a caller already builds, e.g.:
- *   `Publish failed (429) for <url>` + `formatShareHttpErrorDetail(err)`
- *   → `Publish failed (429) for <url> — rate limit exceeded; retry after 37s`
- */
-export function formatShareHttpErrorDetail(err) {
-    const parts = [];
-    if (err.serverMessage)
-        parts.push(err.serverMessage);
-    if (err.retryAfter)
-        parts.push(`retry after ${err.retryAfter}s`);
-    return parts.length ? ` — ${parts.join('; ')}` : '';
-}

package/dist/lib/share/og.d.ts

@@ -1,26 +0,0 @@
-/**
- * Open Graph / Twitter card meta for a shared HTML page.
- *
- * `deriveMeta` pulls a title + description out of the document (its `<title>`/`<h1>`
- * and first real paragraph or existing `<meta name=description>`); `injectOgMeta`
- * splices the social tags into `<head>` (idempotent — it strips any tags we
- * previously added before re-inserting). Pure string work so it's unit-testable
- * without a browser or network.
- */
-interface OgFields {
-    title: string;
-    description: string;
-    imageUrl: string;
-    pageUrl: string;
-    /** Actual pixel dimensions of the served image (defaults to the 1200×630 OG card). */
-    imageWidth?: number;
-    imageHeight?: number;
-}
-/** Pull a sensible title + description out of a plan/document's HTML. */
-export declare function deriveMeta(html: string, fallbackTitle?: string): {
-    title: string;
-    description: string;
-};
-/** Splice OG + Twitter tags into `<head>` (or prepend if there's no head). Idempotent. */
-export declare function injectOgMeta(html: string, f: OgFields): string;
-export {};

package/dist/lib/share/og.js

@@ -1,84 +0,0 @@
-/**
- * Open Graph / Twitter card meta for a shared HTML page.
- *
- * `deriveMeta` pulls a title + description out of the document (its `<title>`/`<h1>`
- * and first real paragraph or existing `<meta name=description>`); `injectOgMeta`
- * splices the social tags into `<head>` (idempotent — it strips any tags we
- * previously added before re-inserting). Pure string work so it's unit-testable
- * without a browser or network.
- */
-const OG_MARK_OPEN = '<!-- agents-share:og -->';
-const OG_MARK_CLOSE = '<!-- /agents-share:og -->';
-function escapeAttr(s) {
-    return s
-        .replace(/&/g, '&amp;')
-        .replace(/"/g, '&quot;')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;');
-}
-function stripTags(s) {
-    return s
-        .replace(/<[^>]+>/g, ' ')
-        .replace(/&nbsp;/g, ' ')
-        .replace(/\s+/g, ' ')
-        .trim();
-}
-/** Pull a sensible title + description out of a plan/document's HTML. */
-export function deriveMeta(html, fallbackTitle = 'agents-cli') {
-    const titleMatch = /<title[^>]*>([\s\S]*?)<\/title>/i.exec(html);
-    const h1Match = /<h1[^>]*>([\s\S]*?)<\/h1>/i.exec(html);
-    const title = stripTags(titleMatch?.[1] ?? h1Match?.[1] ?? '') || fallbackTitle;
-    let description = '';
-    const metaDesc = /<meta[^>]+name=["']description["'][^>]+content=["']([^"']*)["']/i.exec(html);
-    if (metaDesc) {
-        description = metaDesc[1].trim();
-    }
-    else {
-        for (const m of html.matchAll(/<p[^>]*>([\s\S]*?)<\/p>/gi)) {
-            const t = stripTags(m[1]);
-            if (t.length > 40) {
-                description = t;
-                break;
-            }
-        }
-    }
-    if (description.length > 198)
-        description = description.slice(0, 197).trimEnd() + '…';
-    return { title, description };
-}
-/** Remove a previously-injected block so re-publishing doesn't stack duplicate tags. */
-function stripPrevious(html) {
-    const re = new RegExp(`${OG_MARK_OPEN}[\\s\\S]*?${OG_MARK_CLOSE}\\n?`, 'g');
-    return html.replace(re, '');
-}
-/** Splice OG + Twitter tags into `<head>` (or prepend if there's no head). Idempotent. */
-export function injectOgMeta(html, f) {
-    const cleaned = stripPrevious(html);
-    const t = escapeAttr(f.title);
-    const d = escapeAttr(f.description);
-    const w = f.imageWidth ?? 1200;
-    const h = f.imageHeight ?? 630;
-    const block = `${OG_MARK_OPEN}\n` +
-        `<meta property="og:type" content="website">\n` +
-        `<meta property="og:site_name" content="agents-cli">\n` +
-        `<meta property="og:title" content="${t}">\n` +
-        `<meta property="og:description" content="${d}">\n` +
-        `<meta property="og:url" content="${escapeAttr(f.pageUrl)}">\n` +
-        `<meta property="og:image" content="${escapeAttr(f.imageUrl)}">\n` +
-        `<meta property="og:image:width" content="${w}">\n` +
-        `<meta property="og:image:height" content="${h}">\n` +
-        `<meta name="twitter:card" content="summary_large_image">\n` +
-        `<meta name="twitter:title" content="${t}">\n` +
-        `<meta name="twitter:description" content="${d}">\n` +
-        `<meta name="twitter:image" content="${escapeAttr(f.imageUrl)}">\n` +
-        `${OG_MARK_CLOSE}\n`;
-    const headClose = cleaned.search(/<\/head>/i);
-    if (headClose !== -1)
-        return cleaned.slice(0, headClose) + block + cleaned.slice(headClose);
-    const headOpen = /<head[^>]*>/i.exec(cleaned);
-    if (headOpen) {
-        const at = headOpen.index + headOpen[0].length;
-        return cleaned.slice(0, at) + '\n' + block + cleaned.slice(at);
-    }
-    return block + cleaned;
-}

package/dist/lib/share/provision.d.ts

@@ -1,127 +0,0 @@
-import type { WorkerBundle } from './worker-template.js';
-export declare const SHARE_LIFECYCLE_RULE_ID = "agents-share-expire-objects";
-export declare const SHARE_LIFECYCLE_RETENTION_DAYS = 366;
-interface R2LifecycleRule {
-    id: string;
-    enabled: boolean;
-    conditions: {
-        prefix: string;
-    };
-    deleteObjectsTransition?: {
-        condition: {
-            type: 'Age';
-            maxAge: number;
-        } | {
-            type: 'Date';
-            date: string;
-        };
-    };
-    abortMultipartUploadsTransition?: {
-        condition?: {
-            type: 'Age';
-            maxAge: number;
-        };
-    };
-    storageClassTransitions?: Array<{
-        condition: {
-            type: 'Age';
-            maxAge: number;
-        } | {
-            type: 'Date';
-            date: string;
-        };
-        storageClass: 'InfrequentAccess';
-    }>;
-}
-export interface CloudflareRequest {
-    apiToken: string;
-    method: string;
-    pathname: string;
-    body?: unknown;
-    form?: FormData;
-}
-export type CloudflareRequester = <T = unknown>(request: CloudflareRequest) => Promise<T>;
-interface ProvisionOptions {
-    request?: CloudflareRequester;
-}
-/** Create the R2 bucket (idempotent). */
-export declare function createBucket(apiToken: string, accountId: string, name: string, opts?: ProvisionOptions): Promise<void>;
-export declare function buildShareLifecycleRule(days?: number): R2LifecycleRule;
-export declare function mergeShareLifecycleRule(existing?: R2LifecycleRule[], rule?: R2LifecycleRule): R2LifecycleRule[];
-/** Ensure the share bucket self-cleans old objects. Exact per-link expiry is enforced by the Worker. */
-export declare function configureBucketLifecycle(apiToken: string, accountId: string, bucketName: string, opts?: ProvisionOptions): Promise<void>;
-/** Upload the module Worker with an R2 binding (`BUCKET`). Secrets are set via the Workers Secrets API. */
-export declare function deployWorker(apiToken: string, accountId: string, workerName: string, worker: string | WorkerBundle, bucketName: string, opts?: ProvisionOptions): Promise<void>;
-/** sha256 of the rendered Worker script, so a deployed endpoint can be compared
- * against the current `worker-template.ts` without redeploying to find out. */
-export declare function hashWorkerScript(script: string): string;
-interface UpdateWorkerResult {
-    /** sha256 of `script` (the hash the endpoint now matches, whether or not this
-     * call actually redeployed). */
-    templateHash: string;
-    /** True when the upload was skipped because `previousHash` already matched. */
-    skipped: boolean;
-}
-/** Cloudflare `secret_text` name the Worker reads as `env.PHOENIX_ID_BASE`. */
-export declare const WORKER_PHOENIX_ID_BASE_SECRET = "PHOENIX_ID_BASE";
-/** Cloudflare `secret_text` name the Worker reads as `env.PRIX_ARTIFACT_COLLAB_BASE`. */
-export declare const WORKER_COLLAB_BASE_SECRET = "PRIX_ARTIFACT_COLLAB_BASE";
-/** Cloudflare `secret_text` name the Worker reads as `env.ARTIFACT_COLLAB_SERVICE_TOKEN`. */
-export declare const WORKER_COLLAB_SERVICE_TOKEN_SECRET = "ARTIFACT_COLLAB_SERVICE_TOKEN";
-type UpdateWorkerOpts = ProvisionOptions & {
-    force?: boolean;
-    /**
-     * Phoenix ID base URL to bind as `PHOENIX_ID_BASE` after the script upload.
-     * Pass this for a managed deployment; omit it for a pure-BYO Worker (which
-     * authenticates only via WRITE_TOKEN). An empty string is a caller bug and
-     * fails loud — do not pass a blank to "skip".
-     */
-    phoenixIdBase?: string;
-    /**
-     * Managed collaboration backend (PHNX-3835). BOTH must be present to enable
-     * `/__collab`; pass neither to leave the surface disabled (the Worker fails it
-     * closed). The service token rides Cloudflare's Secrets API, never rendered
-     * HTML or browser JS. Applied like `phoenixIdBase` — only when defined.
-     */
-    collabBase?: string;
-    collabServiceToken?: string;
-};
-/**
- * Re-deploy the Worker script against an ALREADY-provisioned endpoint (same
- * account/worker/bucket `deployWorker` was first called with) and idempotently
- * no-op when the template hasn't changed.
- *
- * Cloudflare's script-upload endpoint (`deployWorker`, above) replaces the
- * Worker's bindings/secrets wholesale on every call — there is no documented,
- * reliable way to tell it "keep the existing secret" (the `keep_bindings`
- * metadata field some third-party guides mention is absent from Cloudflare's
- * current Multipart upload metadata reference, and the community has reported
- * it not preventing binding loss even when present:
- * https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/,
- * https://community.cloudflare.com/t/upload-worker-module-endpoint-removes-existing-bindings-despite-keep-bindings/766447).
- * So instead this immediately re-applies WRITE_TOKEN via the documented Secrets
- * API right after the upload — the same two-call sequence first-time
- * provisioning already uses (`deployWorker` then `setWorkerSecret`), except
- * `writeToken` here is the caller's EXISTING token, never a freshly generated
- * one. A managed deploy also re-applies `PHOENIX_ID_BASE` the same way (the
- * Worker reads it to verify Phoenix bearers); a pure-BYO deploy omits it.
- * Cloudflare's own docs describe exactly this "secrets survive a
- * subsequent write" contract for the sibling `wrangler versions upload
- * --secrets-file` flow ("Secrets not included in the file are preserved from
- * the previous version" —
- * https://developers.cloudflare.com/workers/configuration/secrets/#upload-secrets-alongside-code);
- * re-setting the secret to its own value after every deploy gets the same
- * outcome without depending on an unverified upload-time flag.
- */
-export declare function updateWorker(apiToken: string, accountId: string, workerName: string, bucketName: string, worker: string | WorkerBundle, writeToken: string, previousHash: string | undefined, opts?: UpdateWorkerOpts): Promise<UpdateWorkerResult>;
-/** Add/update a secret_text binding using Cloudflare's Workers Secrets API. */
-export declare function putWorkerSecret(apiToken: string, accountId: string, workerName: string, name: string, text: string, opts?: ProvisionOptions): Promise<void>;
-/** Add/update the WRITE_TOKEN binding using Cloudflare's Workers Secrets API. */
-export declare function setWorkerSecret(apiToken: string, accountId: string, workerName: string, writeToken: string, opts?: ProvisionOptions): Promise<void>;
-/** Enable the free `*.workers.dev` route for the script, and return the account subdomain. */
-export declare function enableWorkersDev(apiToken: string, accountId: string, workerName: string, opts?: ProvisionOptions): Promise<string>;
-/** Resolve a zone id for a domain the token can see, or null if not owned/visible. */
-export declare function findZoneId(apiToken: string, domain: string, opts?: ProvisionOptions): Promise<string | null>;
-/** Map a custom hostname (e.g. `share.getrush.ai`) to the Worker via Workers Custom Domains. */
-export declare function addCustomDomain(apiToken: string, accountId: string, workerName: string, zoneId: string, hostname: string, opts?: ProvisionOptions): Promise<void>;
-export {};

package/dist/lib/share/provision.js

@@ -1,285 +0,0 @@
-// Cloudflare provisioning for `agents artifacts setup` — plain `fetch` against the CF
-// REST API (the repo has no CF wrapper). Creates the R2 bucket, configures its
-// lifecycle, uploads the Worker (with an R2 binding), sets the WRITE_TOKEN secret,
-// enables the free `*.workers.dev` subdomain, and — when the token owns the zone —
-// maps a custom domain.
-import { createHash } from 'node:crypto';
-const CF_API = 'https://api.cloudflare.com/client/v4';
-export const SHARE_LIFECYCLE_RULE_ID = 'agents-share-expire-objects';
-export const SHARE_LIFECYCLE_RETENTION_DAYS = 366;
-const SECONDS_PER_DAY = 86400;
-async function cf(apiToken, method, pathname, body, form) {
-    const headers = { authorization: `Bearer ${apiToken}` };
-    let payload;
-    if (form) {
-        payload = form; // fetch sets multipart boundary
-    }
-    else if (body !== undefined) {
-        headers['content-type'] = 'application/json';
-        payload = JSON.stringify(body);
-    }
-    const res = await fetch(`${CF_API}${pathname}`, { method, headers, body: payload });
-    const json = (await res.json().catch(() => ({})));
-    if (!res.ok || json.success === false) {
-        const msg = (json.errors ?? []).map((e) => `${e.code ?? ''} ${e.message ?? ''}`.trim()).join('; ') ||
-            res.statusText;
-        throw new Error(`Cloudflare ${method} ${pathname} failed (${res.status}): ${msg}`);
-    }
-    return json.result;
-}
-const defaultCloudflareRequester = (request) => cf(request.apiToken, request.method, request.pathname, request.body, request.form);
-/** True if the CF error looks like "the thing already exists" (idempotent create). */
-function isAlreadyExists(e) {
-    return /already exists|duplicate|10004|10014/i.test(String(e));
-}
-/** Create the R2 bucket (idempotent). */
-export async function createBucket(apiToken, accountId, name, opts = {}) {
-    const request = opts.request ?? defaultCloudflareRequester;
-    try {
-        await request({
-            apiToken,
-            method: 'POST',
-            pathname: `/accounts/${accountId}/r2/buckets`,
-            body: { name },
-        });
-    }
-    catch (e) {
-        if (!isAlreadyExists(e))
-            throw e;
-    }
-}
-export function buildShareLifecycleRule(days = SHARE_LIFECYCLE_RETENTION_DAYS) {
-    return {
-        id: SHARE_LIFECYCLE_RULE_ID,
-        enabled: true,
-        conditions: { prefix: '' },
-        deleteObjectsTransition: {
-            condition: { type: 'Age', maxAge: days * SECONDS_PER_DAY },
-        },
-    };
-}
-export function mergeShareLifecycleRule(existing = [], rule = buildShareLifecycleRule()) {
-    return [...existing.filter((r) => r.id !== SHARE_LIFECYCLE_RULE_ID), rule];
-}
-/** Ensure the share bucket self-cleans old objects. Exact per-link expiry is enforced by the Worker. */
-export async function configureBucketLifecycle(apiToken, accountId, bucketName, opts = {}) {
-    const request = opts.request ?? defaultCloudflareRequester;
-    const lifecycle = await request({
-        apiToken,
-        method: 'GET',
-        pathname: `/accounts/${accountId}/r2/buckets/${bucketName}/lifecycle`,
-    });
-    await request({
-        apiToken,
-        method: 'PUT',
-        pathname: `/accounts/${accountId}/r2/buckets/${bucketName}/lifecycle`,
-        body: { rules: mergeShareLifecycleRule(lifecycle.rules ?? []) },
-    });
-}
-/** Upload the module Worker with an R2 binding (`BUCKET`). Secrets are set via the Workers Secrets API. */
-export async function deployWorker(apiToken, accountId, workerName, worker, bucketName, opts = {}) {
-    const request = opts.request ?? defaultCloudflareRequester;
-    const metadata = {
-        main_module: 'worker.js',
-        compatibility_date: '2024-11-06',
-        bindings: [
-            { type: 'r2_bucket', name: 'BUCKET', bucket_name: bucketName },
-        ],
-    };
-    const form = new FormData();
-    form.set('metadata', new Blob([JSON.stringify(metadata)], { type: 'application/json' }));
-    const bundle = typeof worker === 'string' ? { script: worker, modules: [] } : worker;
-    form.set('worker.js', new Blob([bundle.script], { type: 'application/javascript+module' }), 'worker.js');
-    for (const module of bundle.modules) {
-        form.set(module.name, new Blob([module.contents], { type: module.contentType }), module.name);
-    }
-    await request({
-        apiToken,
-        method: 'PUT',
-        pathname: `/accounts/${accountId}/workers/scripts/${workerName}`,
-        form,
-    });
-}
-/** sha256 of the rendered Worker script, so a deployed endpoint can be compared
- * against the current `worker-template.ts` without redeploying to find out. */
-export function hashWorkerScript(script) {
-    return createHash('sha256').update(script, 'utf8').digest('hex');
-}
-/** Cloudflare `secret_text` name the Worker reads as `env.PHOENIX_ID_BASE`. */
-export const WORKER_PHOENIX_ID_BASE_SECRET = 'PHOENIX_ID_BASE';
-/** Cloudflare `secret_text` name the Worker reads as `env.PRIX_ARTIFACT_COLLAB_BASE`. */
-export const WORKER_COLLAB_BASE_SECRET = 'PRIX_ARTIFACT_COLLAB_BASE';
-/** Cloudflare `secret_text` name the Worker reads as `env.ARTIFACT_COLLAB_SERVICE_TOKEN`. */
-export const WORKER_COLLAB_SERVICE_TOKEN_SECRET = 'ARTIFACT_COLLAB_SERVICE_TOKEN';
-/**
- * Re-deploy the Worker script against an ALREADY-provisioned endpoint (same
- * account/worker/bucket `deployWorker` was first called with) and idempotently
- * no-op when the template hasn't changed.
- *
- * Cloudflare's script-upload endpoint (`deployWorker`, above) replaces the
- * Worker's bindings/secrets wholesale on every call — there is no documented,
- * reliable way to tell it "keep the existing secret" (the `keep_bindings`
- * metadata field some third-party guides mention is absent from Cloudflare's
- * current Multipart upload metadata reference, and the community has reported
- * it not preventing binding loss even when present:
- * https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/,
- * https://community.cloudflare.com/t/upload-worker-module-endpoint-removes-existing-bindings-despite-keep-bindings/766447).
- * So instead this immediately re-applies WRITE_TOKEN via the documented Secrets
- * API right after the upload — the same two-call sequence first-time
- * provisioning already uses (`deployWorker` then `setWorkerSecret`), except
- * `writeToken` here is the caller's EXISTING token, never a freshly generated
- * one. A managed deploy also re-applies `PHOENIX_ID_BASE` the same way (the
- * Worker reads it to verify Phoenix bearers); a pure-BYO deploy omits it.
- * Cloudflare's own docs describe exactly this "secrets survive a
- * subsequent write" contract for the sibling `wrangler versions upload
- * --secrets-file` flow ("Secrets not included in the file are preserved from
- * the previous version" —
- * https://developers.cloudflare.com/workers/configuration/secrets/#upload-secrets-alongside-code);
- * re-setting the secret to its own value after every deploy gets the same
- * outcome without depending on an unverified upload-time flag.
- */
-export async function updateWorker(apiToken, accountId, workerName, bucketName, worker, writeToken, previousHash, opts = {}) {
-    const script = typeof worker === 'string' ? worker : worker.script;
-    const templateHash = hashWorkerScript(script);
-    if (!opts.force && previousHash === templateHash) {
-        // Script is current so we skip the upload (which would wipe secrets). A
-        // managed Worker still needs PHOENIX_ID_BASE present — a prior upload from
-        // a CLI that never set it left the secret missing, and this is the heal
-        // that does not require --force or a dummy template bump.
-        if (opts.phoenixIdBase !== undefined) {
-            await applyPhoenixIdBaseSecret(apiToken, accountId, workerName, opts.phoenixIdBase, opts);
-        }
-        await applyCollabSecrets(apiToken, accountId, workerName, opts);
-        return { templateHash, skipped: true };
-    }
-    await deployWorker(apiToken, accountId, workerName, worker, bucketName, opts);
-    // Script upload clears bindings/secrets (see JSDoc above). If re-applying
-    // WRITE_TOKEN fails here, the live Worker has no write token — every
-    // `agents artifacts share` publish/delete 401s until a re-run of `agents artifacts share update`
-    // completes both steps. Surface that explicitly instead of the raw CF error.
-    try {
-        await setWorkerSecret(apiToken, accountId, workerName, writeToken, opts);
-    }
-    catch (e) {
-        const detail = e instanceof Error ? e.message : String(e);
-        throw new Error(`Worker deployed but the write token failed to re-apply — re-run \`agents artifacts share update\` to fix this before publishing/deleting anything. (${detail})`);
-    }
-    if (opts.phoenixIdBase !== undefined) {
-        try {
-            await applyPhoenixIdBaseSecret(apiToken, accountId, workerName, opts.phoenixIdBase, opts);
-        }
-        catch (e) {
-            const detail = e instanceof Error ? e.message : String(e);
-            throw new Error(`Worker deployed but PHOENIX_ID_BASE failed to re-apply — Phoenix-bearer publishes will 401 until you re-run \`agents artifacts share update\`. (${detail})`);
-        }
-    }
-    // The script upload wiped bindings/secrets (see JSDoc above), so re-apply the
-    // collaboration secrets too — but only when the caller provided them. An
-    // ordinary deploy with collaboration still dormant passes neither and the
-    // Worker keeps failing `/__collab` closed.
-    try {
-        await applyCollabSecrets(apiToken, accountId, workerName, opts);
-    }
-    catch (e) {
-        const detail = e instanceof Error ? e.message : String(e);
-        throw new Error(`Worker deployed but the collaboration secrets failed to re-apply — \`/__collab\` stays disabled until you re-run \`agents artifacts share update\`. (${detail})`);
-    }
-    return { templateHash, skipped: false };
-}
-/**
- * Bind the managed collaboration secrets (PHNX-3835) — both or neither. A no-op
- * when the caller passed neither (collaboration dormant), so a plain managed
- * deploy never touches them; fails loud on a half-config (one without the other).
- */
-async function applyCollabSecrets(apiToken, accountId, workerName, opts) {
-    if (opts.collabBase === undefined && opts.collabServiceToken === undefined)
-        return;
-    if (opts.collabBase === undefined || opts.collabServiceToken === undefined) {
-        throw new Error('Managed collaboration needs BOTH PRIX_ARTIFACT_COLLAB_BASE and ARTIFACT_COLLAB_SERVICE_TOKEN — set both or neither.');
-    }
-    await putWorkerSecret(apiToken, accountId, workerName, WORKER_COLLAB_BASE_SECRET, opts.collabBase, opts);
-    await putWorkerSecret(apiToken, accountId, workerName, WORKER_COLLAB_SERVICE_TOKEN_SECRET, opts.collabServiceToken, opts);
-}
-/** Add/update a secret_text binding using Cloudflare's Workers Secrets API. */
-export async function putWorkerSecret(apiToken, accountId, workerName, name, text, opts = {}) {
-    const request = opts.request ?? defaultCloudflareRequester;
-    await request({
-        apiToken,
-        method: 'PUT',
-        pathname: `/accounts/${accountId}/workers/scripts/${workerName}/secrets`,
-        body: { name, text, type: 'secret_text' },
-    });
-}
-/** Add/update the WRITE_TOKEN binding using Cloudflare's Workers Secrets API. */
-export async function setWorkerSecret(apiToken, accountId, workerName, writeToken, opts = {}) {
-    await putWorkerSecret(apiToken, accountId, workerName, 'WRITE_TOKEN', writeToken, opts);
-}
-function normalizePhoenixIdBase(phoenixIdBase) {
-    const base = phoenixIdBase.replace(/\/+$/, '').trim();
-    if (!base) {
-        throw new Error('Managed share deploy requires a non-empty PHOENIX_ID_BASE so the Worker can verify Phoenix bearers. Set the PHOENIX_ID_BASE env var.');
-    }
-    return base;
-}
-async function applyPhoenixIdBaseSecret(apiToken, accountId, workerName, phoenixIdBase, opts = {}) {
-    await putWorkerSecret(apiToken, accountId, workerName, WORKER_PHOENIX_ID_BASE_SECRET, normalizePhoenixIdBase(phoenixIdBase), opts);
-}
-/** Enable the free `*.workers.dev` route for the script, and return the account subdomain. */
-export async function enableWorkersDev(apiToken, accountId, workerName, opts = {}) {
-    const request = opts.request ?? defaultCloudflareRequester;
-    await request({
-        apiToken,
-        method: 'POST',
-        pathname: `/accounts/${accountId}/workers/scripts/${workerName}/subdomain`,
-        body: {
-            enabled: true,
-            previews_enabled: false,
-        },
-    });
-    const sub = await request({
-        apiToken,
-        method: 'GET',
-        pathname: `/accounts/${accountId}/workers/subdomain`,
-    });
-    if (!sub?.subdomain) {
-        throw new Error('No workers.dev subdomain on this account yet — register one at dash.cloudflare.com → Workers → Subdomain, then re-run.');
-    }
-    return sub.subdomain;
-}
-/** Resolve a zone id for a domain the token can see, or null if not owned/visible. */
-export async function findZoneId(apiToken, domain, opts = {}) {
-    const request = opts.request ?? defaultCloudflareRequester;
-    // Try the exact name, then the registrable parent (share.getrush.ai -> getrush.ai).
-    const candidates = [domain, domain.split('.').slice(-2).join('.')];
-    for (const name of candidates) {
-        const zones = await request({
-            apiToken,
-            method: 'GET',
-            pathname: `/zones?name=${encodeURIComponent(name)}`,
-        }).catch(() => []);
-        if (zones?.length)
-            return zones[0].id;
-    }
-    return null;
-}
-/** Map a custom hostname (e.g. `share.getrush.ai`) to the Worker via Workers Custom Domains. */
-export async function addCustomDomain(apiToken, accountId, workerName, zoneId, hostname, opts = {}) {
-    const request = opts.request ?? defaultCloudflareRequester;
-    try {
-        await request({
-            apiToken,
-            method: 'PUT',
-            pathname: `/accounts/${accountId}/workers/domains`,
-            body: {
-                zone_id: zoneId,
-                hostname,
-                service: workerName,
-                environment: 'production',
-            },
-        });
-    }
-    catch (e) {
-        if (!isAlreadyExists(e))
-            throw e;
-    }
-}