@pithy-sh/cli 0.1.0

package/src/commands/seed.ts

@@ -0,0 +1,229 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import { CloudflareClients } from "@pithy-sh/cloudflare/src/client/clients";
+import type { Capability } from "@pithy-sh/core/src/capability/capability";
+import { defineCommand } from "citty";
+import { type CliAuditEmit, createRemoteCliAudit } from "../audit/cliAudit";
+import { type CloudflareAccountSelection, cloudflareEnv } from "../cloudflare/config";
+import { renderDevSecretsNotes } from "../devSecrets/report";
+import { type DevSecretsSeedReport, seedProjectDevSecrets } from "../devSecrets/seed";
+import { type ResetPreviewEntry, resolveWorkerScopes } from "../migrations/run";
+import { loadProject, loadProjectCloudflare, requireProjectName } from "../project/config";
+import { ENV_ARG, requireEnvironment } from "../project/environment";
+import { type SeedRunReport, type SeedWorkerReport, seedProject } from "../seed/run";
+import { PRODUCTION_CONFIRM_PHRASE, resetConfirmPhrase } from "../seed/safety";
+import { formatDone, formatJsonLine, withErrorReporting } from "../terminal/output";
+import { saffron } from "../terminal/style";
+
+/** One line per set: what it wrote, per backend (docs/CLI.md §3). Empty backends are omitted. */
+function describeSet(set: {
+  name: string;
+  d1: { rows: number }[];
+  kv: { entries: number }[];
+  r2: unknown[];
+  media: unknown[];
+}): string {
+  const rows = set.d1.reduce((sum, entry) => sum + entry.rows, 0);
+  const entries = set.kv.reduce((sum, entry) => sum + entry.entries, 0);
+  const parts: string[] = [];
+  if (rows > 0) parts.push(`${rows} row${rows === 1 ? "" : "s"}`);
+  if (entries > 0) parts.push(`${entries} entr${entries === 1 ? "y" : "ies"}`);
+  if (set.r2.length > 0) parts.push(`${set.r2.length} object${set.r2.length === 1 ? "" : "s"}`);
+  if (set.media.length > 0) parts.push(`${set.media.length} asset${set.media.length === 1 ? "" : "s"}`);
+  return `${set.name}: ${parts.length > 0 ? parts.join(", ") : "nothing to seed"}.`;
+}
+
+/** One line per reset database: schema dropped and recreated, or (dry run) what would be (docs/CLI.md §3). */
+function describeReset(entry: ResetPreviewEntry, dryRun: boolean): string {
+  const migrations = `${entry.migrations} migration${entry.migrations === 1 ? "" : "s"}`;
+  return dryRun
+    ? `Would reset ${entry.database} (${entry.binding}): ${migrations}.`
+    : `Reset ${entry.database} (${entry.binding}): ${migrations} rolled back and reapplied.`;
+}
+
+/**
+ * One worker's block of the run report: its sets, then what it skipped and why. A worker is named on
+ * every line so a fan-out over several workers reads as one list, not several interleaved ones.
+ */
+function describeWorker(worker: SeedWorkerReport, env: string, width: number): string[] {
+  const name = worker.worker.padEnd(width);
+  const lines: string[] = [];
+  for (const key of worker.skippedByEnv) lines.push(`${name}  skipped ${key}: not allowed in ${env}.`);
+  for (const key of worker.shared) lines.push(`${name}  ${key}: already seeded by another worker.`);
+  for (const set of worker.sets) lines.push(`${name}  ${describeSet(set)}`);
+  return lines;
+}
+
+/**
+ * The whole human report for one seed run, as a pure function of its result — the peer of
+ * `renderDoctorText`, and for the same reason: `docs/CLI.md` §8.2 and §8.5 paste these transcripts, so
+ * they have to be a value a test can render and compare against the document (`seedDocs.test.ts`).
+ * Assembling them across inline `process.stdout.write` calls made that impossible, and the blocks
+ * rotted. The command writes what this returns, plus the trailing newline.
+ *
+ * The order is the run's own: what the reset destroyed, then what each Worker wrote, then the dry-run
+ * reminder, then `Done.` The `DESTRUCTIVE.` banner leads a real reset only — a preview dropped nothing.
+ */
+export function renderSeedText(report: SeedRunReport): string {
+  const reset = report.reset ?? [];
+  const lines: string[] = [];
+
+  if (reset.length > 0 && !report.dryRun) {
+    lines.push(`DESTRUCTIVE${saffron(".")} Every table in ${report.env} was dropped and recreated.`);
+  }
+  for (const entry of reset) lines.push(describeReset(entry, report.dryRun));
+
+  if (report.workers.every((worker) => worker.sets.length === 0)) {
+    lines.push(`Nothing to seed for ${report.env}.`);
+  }
+  // One column width across the whole fan-out, so every Worker's lines align into one list.
+  const width = Math.max(0, ...report.workers.map((worker) => worker.worker.length));
+  for (const worker of report.workers) lines.push(...describeWorker(worker, report.env, width));
+
+  if (report.dryRun) lines.push("Dry run. Nothing written.");
+  lines.push(formatDone());
+  return lines.join("\n");
+}
+
+/**
+ * The audit emitter for a seed run, or a no-op when auditing is unavailable. A `--redo` schema reset is
+ * the most destructive thing the seeder does, so it must leave a record of who reset which environment.
+ */
+async function buildSeedAudit(
+  projectDir: string,
+  env: string,
+  capabilities: readonly Capability[],
+  account: CloudflareAccountSelection | null,
+): Promise<CliAuditEmit> {
+  const vars = cloudflareEnv({ account });
+  const accountId = vars.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const apiToken = vars.CLOUDFLARE_API_TOKEN ?? "";
+  if (!accountId || !apiToken) return async () => {};
+  // Data-plane: a `dev` seed or reset only touches local Miniflare, so it is not audited.
+  return createRemoteCliAudit({
+    projectDir,
+    env,
+    capabilities,
+    clients: new CloudflareClients({ accountId, apiToken }),
+    apiToken,
+  });
+}
+
+/** The interactive reset-confirm prompt. Names the destruction plainly before asking for the phrase. */
+function resetPrompt(env: string): () => Promise<string> {
+  return async () => {
+    const { isCancel, text } = await import("@clack/prompts");
+    const answer = await text({
+      message: `DESTRUCTIVE: this drops every table in ${env} and all data is lost. Type "${resetConfirmPhrase(env)}" to confirm:`,
+    });
+    return isCancel(answer) ? "" : answer;
+  };
+}
+
+/** The interactive production-confirm prompt: an `@clack/prompts` text field asking for the exact phrase. */
+function productionPrompt(): () => Promise<string> {
+  return async () => {
+    const { isCancel, text } = await import("@clack/prompts");
+    const answer = await text({
+      message: `This writes to production. Type "${PRODUCTION_CONFIRM_PHRASE}" to confirm:`,
+    });
+    return isCancel(answer) ? "" : answer;
+  };
+}
+
+export default defineCommand({
+  meta: { name: "seed", description: "Seed an environment from your Zod-typed fixtures" },
+  args: {
+    env: ENV_ARG,
+    worker: { type: "string", description: "Seed one worker instead of every worker in apps/" },
+    json: { type: "boolean", default: false, description: "Machine-readable output" },
+    "dry-run": { type: "boolean", default: false, description: "Print the write plan; change nothing" },
+    redo: {
+      type: "boolean",
+      default: false,
+      description: "DESTRUCTIVE: drop every table and recreate the schema before seeding. All data is lost",
+    },
+    "confirm-reset": {
+      type: "string",
+      description: 'Unlock a non-dev reset non-interactively: "yes, i really want to reset <env>"',
+    },
+    yes: { type: "boolean", default: false, description: "Confirm a non-dev environment" },
+    "confirm-production": {
+      type: "string",
+      description: `Unlock production non-interactively: "${PRODUCTION_CONFIRM_PHRASE}"`,
+    },
+  },
+  run: ({ args }) =>
+    withErrorReporting(args.json, async () => {
+      const env = requireEnvironment(args.env);
+      const projectDir = process.cwd();
+      const config = await loadProject(projectDir);
+      // The account this project belongs to, resolved from the config just loaded. Used by the seed run
+      // itself and by the audit emitter — one answer, so the two can never disagree about whose D1 was
+      // written and whose trail records it (#234).
+      const account = loadProjectCloudflare(config) ?? null;
+      const dryRun = args["dry-run"];
+      const interactive = !args.json && Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
+
+      // Resolved once: the fan-out seeds these workers, and the audit emitter needs their capabilities
+      // to know whether the project composes `audit` at all.
+      const workers = await resolveWorkerScopes({
+        projectDir,
+        ...(args.worker !== undefined ? { worker: args.worker } : {}),
+      });
+
+      // Dev secrets first, and only for `dev`. The dev secrets file is machine-local — there is no staging
+      // copy of it, and a deployed environment's secrets come from `pithy secrets create` through the
+      // manager Workflow. Before the fixtures, because a fixture that signs a token or a link needs the
+      // key that signs it to already be in the store.
+      //
+      // Never fatal to a `--dry-run`, and never run by one: a dry run writes nothing, and seeding a
+      // secret is a write.
+      const devSecrets =
+        env === "dev" && !dryRun ? await seedProjectDevSecrets({ projectDir }) : (null as DevSecretsSeedReport | null);
+      if (devSecrets && !args.json) {
+        for (const line of renderDevSecretsNotes(devSecrets)) process.stdout.write(`${line}\n`);
+      }
+      // A `.dev.vars` pithy did not generate is never overwritten and never merged (#154) — so a Worker
+      // that was supposed to get one has not got one, and that is a failed run. The lines above already
+      // name the file and point at `.dev.vars.local`; this is what makes a script notice. Not a throw:
+      // the fixtures below are the rest of the run and they are worth doing.
+      if (devSecrets && (devSecrets.devVarsRefused ?? []).length > 0) process.exitCode = 1;
+
+      const report = await seedProject({
+        projectDir,
+        // `requireProjectName`, never `resolveProjectName`: a fixture can mint Images/Stream assets, and
+        // this name is the owner stamped into their metadata — the only handle a later sweep has on them.
+        project: requireProjectName(config),
+        // The account this project names, or `null` when it names none. Not the default credentials file:
+        // a non-`dev` seed writes rows into a real D1 and objects into a real R2 (#234).
+        account,
+        workers,
+        env,
+        includeExamples: config.seed?.includeExamples ?? false,
+        dryRun,
+        redo: args.redo,
+        yes: args.yes,
+        json: args.json,
+        confirmProduction: args["confirm-production"],
+        confirmReset: args["confirm-reset"],
+        productionEnvironments: config.seed?.productionEnvironments,
+        prompt: interactive ? productionPrompt() : undefined,
+        promptReset: interactive ? resetPrompt(env) : undefined,
+        audit: await buildSeedAudit(
+          projectDir,
+          env,
+          workers.flatMap((worker) => worker.capabilities),
+          account,
+        ),
+      });
+
+      if (args.json) {
+        process.stdout.write(`${formatJsonLine({ ...report, devSecrets })}\n`);
+        return;
+      }
+
+      process.stdout.write(`${renderSeedText(report)}\n`);
+    }),
+});

package/src/commands/storage.ts

@@ -0,0 +1,309 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { CloudflareClients } from "@pithy-sh/cloudflare/src/client/clients";
+import { ValidationError } from "@pithy-sh/core/src/error/pithyError";
+import { managerWorkerName } from "@pithy-sh/secrets/src/provision/resolveManagerConfig";
+import type { ManagedEnvironment } from "@pithy-sh/secrets/src/scope";
+import { defineCommand } from "citty";
+import { parse } from "comment-json";
+import { createProjectCliAudit } from "../audit/cliAudit";
+import { resolveR2Credentials } from "../capabilities/r2Bucket";
+import { buildSecretDispatcher } from "../capabilities/secretsDispatcher";
+import {
+  CloudflareStorageDeprovisioner,
+  CloudflareStorageProvisioner,
+  loadStorage,
+  type StorageEnvResources,
+} from "../capabilities/storageProvisioner";
+import { type ConfirmedAccount, findOnConfirmedAccount } from "../cloudflare/accountAnswer";
+import { type CloudflareAccountSelection, cloudflareAccountConfirmation, cloudflareEnv } from "../cloudflare/config";
+import { applyAppBindings, appWorkflowBindings } from "../project/appBindings";
+import { loadProject, loadProjectEnvironments, projectCloudflareAccount, requireProjectName } from "../project/config";
+import { projectCapabilities, resolveWorkers } from "../project/workerScope";
+import { formatDone, formatJsonLine, withErrorReporting } from "../terminal/output";
+
+/**
+ * `pithy storage provision` / `deprovision`.
+ *
+ * `pithy add storage` writes bindings and touches no Cloudflare account. This command stands up what
+ * those bindings point at: the per-environment R2 bucket, the `storage-r2-credentials` secret, and the
+ * prebuilt sweep worker that hosts the daily orphan reconciliation.
+ *
+ * **The R2 key pair is supplied, not minted.** Cloudflare exposes no API for creating an R2 S3
+ * access-key pair, so it comes from flags or `R2_CREDENTIALS` in `.dev.vars` and is written into the
+ * secret as given. Make the pair under R2 → Manage API tokens.
+ */
+
+/**
+ * The audit emitter for a storage command. Provisioning spans every managed environment at once, so
+ * there is no single target env to key the audit database on — `"dev"` is the fallback (mirrors
+ * `pithy media`'s convention for env-spanning commands). A no-op when creds or the audit capability
+ * aren't there.
+ */
+async function buildAudit(projectDir: string, accountId: string, apiToken: string) {
+  // `env` selects the audit database only, and defaults to `dev`: this command spans environments, so no
+  // single value is true for the run; each event states the environment it acted on.
+  return createProjectCliAudit({ projectDir, accountId, apiToken });
+}
+
+/** Load the storage capability's resolved config from `pithy.config.ts`. */
+async function loadStorageConfig(projectDir: string) {
+  const { isStorageCapability } = await loadStorage();
+  // Capabilities live in each Worker's `apps/<name>/pithy.config.ts`; provisioning is one
+  // project-wide decision, so the first Worker composing this capability provides it.
+  const capability = (await resolveWorkers({ projectDir }).then(projectCapabilities)).find(isStorageCapability);
+  if (!capability) {
+    throw new ValidationError({
+      message: "The storage capability is not configured.",
+      action: "Add `storage({ ... })` to pithy.config.ts (run `pithy add storage`).",
+    });
+  }
+  return capability.storageConfig;
+}
+
+/**
+ * The Cloudflare credentials this command provisions with, for **the account the project belongs to**.
+ *
+ * The account is a parameter rather than an ambient, so this cannot resolve before something has
+ * established which account the project is for (#206).
+ *
+ * It also carries **what vouches for the account** (#378). A bare id is what every destructive and
+ * creative site here used to hold, and an id alone cannot tell "this account has no such Worker" from
+ * "I asked an account nothing claims" — the two arrive as one empty listing.
+ */
+function loadCloudflareCreds(account: CloudflareAccountSelection | null): {
+  account: ConfirmedAccount;
+  accountId: string;
+  apiToken: string;
+  storeId: string;
+  r2Raw: string | undefined;
+} {
+  const vars = cloudflareEnv({ account });
+  const confirmation = cloudflareAccountConfirmation({ account });
+  const accountId = vars.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const apiToken = vars.CLOUDFLARE_API_TOKEN ?? "";
+  const storeId = vars.SECRETS_STORE_ID ?? "";
+  if (!accountId || !apiToken) {
+    throw new ValidationError({
+      message: "Cloudflare credentials are missing.",
+      action: "Run pithy init to record CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN, or export them.",
+    });
+  }
+  if (!storeId) {
+    throw new ValidationError({
+      message: "The CF Secrets Store id is missing.",
+      action: "Run pithy add secrets to record SECRETS_STORE_ID (the sweep worker decrypts its credentials from it).",
+    });
+  }
+  return { account: { accountId, confirmation }, accountId, apiToken, storeId, r2Raw: vars.R2_CREDENTIALS };
+}
+
+/** A wrangler env stanza — only the fields the sweep worker deploy reads from the project's config. */
+interface WranglerStanza {
+  d1_databases?: { binding: string; database_id?: string }[];
+  env?: Record<string, WranglerStanza | undefined>;
+}
+
+/**
+ * Resolve the per-environment resources the sweep worker binds, from the project's `wrangler.jsonc`
+ * (the app `DB` id per env) and a live lookup of the env's secrets database. Each missing value throws
+ * an actionable error rather than deploying a half-wired worker.
+ */
+function buildResolveEnv(
+  projectDir: string,
+  cf: CloudflareClients,
+  /**
+   * The project name the secrets database is found by — `<project>-<env>-secrets`. Resolved once by the
+   * caller via `requireProjectName`, never guessed: the lookup is by name, so a wrong one either reports
+   * a database that "does not exist" or binds another project's secrets store.
+   */
+  project: string,
+  /**
+   * The account the secrets database is looked for on, and what vouches for it (#378).
+   *
+   * The refusal below reads a missing database as "provision it first". Against an account nothing
+   * claims, that database is missing because this run asked the wrong account — and the sentence sends
+   * an operator to run a provisioning command they have already run.
+   */
+  account: ConfirmedAccount,
+): (env: ManagedEnvironment) => Promise<StorageEnvResources> {
+  return async (env) => {
+    const config = parse(await readFile(join(projectDir, "wrangler.jsonc"), "utf8")) as unknown as WranglerStanza;
+    const stanza = config.env?.[env];
+    if (!stanza) {
+      throw new ValidationError({
+        message: `wrangler.jsonc has no env.${env} stanza.`,
+        action: `Add the ${env} environment to wrangler.jsonc with its DB binding.`,
+      });
+    }
+    const appDatabaseId = stanza.d1_databases?.find((db) => db.binding === "DB")?.database_id;
+    if (!appDatabaseId) {
+      throw new ValidationError({
+        message: `wrangler.jsonc env.${env} has no DB database_id.`,
+        action: `Provision the ${env} app database and set its id on the DB binding.`,
+      });
+    }
+    const secretsDb = await findOnConfirmedAccount({
+      ...account,
+      what: `the ${managerWorkerName(project, env)} database`,
+      find: () => cf.d1Provisioner().findDatabaseByName(managerWorkerName(project, env)),
+    });
+    if (!secretsDb) {
+      throw new ValidationError({
+        message: `The ${env} secrets database (${managerWorkerName(project, env)}) does not exist.`,
+        action: "Run `pithy secrets provision` first — the sweep worker reads its credentials from it.",
+      });
+    }
+    return { appDatabaseId, secretsDatabaseId: secretsDb.uuid };
+  };
+}
+
+const provision = defineCommand({
+  meta: {
+    name: "provision",
+    description: "Create the storage buckets, write the R2 credentials, and deploy the sweep workers",
+  },
+  args: {
+    "api-token": {
+      type: "string",
+      description:
+        "Cloudflare API token carried alongside the R2 key pair, so the object store can prove bucket access. Defaults to CLOUDFLARE_API_TOKEN from .dev.vars — a broad token; supply an R2-scoped one for production.",
+    },
+    "r2-access-key-id": {
+      type: "string",
+      description:
+        "R2 S3 access key id the Worker presigns uploads and downloads with. Create the pair under R2 → Manage API tokens. Falls back to R2_CREDENTIALS in the account config.",
+    },
+    "r2-secret-access-key": {
+      type: "string",
+      description:
+        "R2 S3 secret access key, paired with --r2-access-key-id. Falls back to R2_CREDENTIALS in the account config.",
+    },
+    json: { type: "boolean", default: false, description: "Machine-readable output" },
+  },
+  run: ({ args }) =>
+    withErrorReporting(args.json, async () => {
+      const projectDir = process.cwd();
+      // The leading segment of every name this run creates — the bucket, the sweep worker, the
+      // Workflow. `requireProjectName` refuses to guess, because `deprovision` recomputes these same
+      // names to find what to delete (docs/NAMING.md).
+      const config = await loadProject(projectDir);
+      const project = requireProjectName(config);
+      // The project's own environment set (#241): what this command fans out across, rather than a
+      // pair the CLI assumed. A project declaring `live` gets `live` provisioned and torn down too.
+      const environments = loadProjectEnvironments(config);
+      const { provisionStorage } = await loadStorage();
+      const { account, accountId, apiToken, storeId, r2Raw } = loadCloudflareCreds(
+        await projectCloudflareAccount(projectDir),
+      );
+      const storageConfig = await loadStorageConfig(projectDir);
+      const r2Credentials = resolveR2Credentials(args["r2-access-key-id"], args["r2-secret-access-key"], r2Raw);
+      const cf = new CloudflareClients({ accountId, apiToken });
+      const provisioner = new CloudflareStorageProvisioner({
+        cf,
+        project,
+        environments,
+        account,
+        apiToken,
+        storeId,
+        storageApiToken: args["api-token"] ?? apiToken,
+        r2Credentials,
+        storageConfig,
+        dispatcher: buildSecretDispatcher(accountId, apiToken, project),
+        resolveEnv: buildResolveEnv(projectDir, cf, project, account),
+        audit: await buildAudit(projectDir, accountId, apiToken),
+      });
+
+      const result = await provisionStorage(provisioner, environments);
+
+      // Only now can the sweep's Workflow binding be written. `pithy add storage` cannot: wrangler
+      // requires a `name` and a `class_name` on every `workflows` entry, and the deployed Workflow name
+      // is per project and environment (`<project>-<env>-storage-sweep`). An entry short of either field fails the whole
+      // config, so `add` emits none and this completes it — see capabilities/add.ts.
+      const { storageWorkflowRegistry, STORAGE_CAPABILITY } = await loadStorage();
+      for (const entry of result.environments) {
+        await applyAppBindings(projectDir, entry.env, {
+          workflows: appWorkflowBindings(storageWorkflowRegistry, {
+            project,
+            capability: STORAGE_CAPABILITY,
+            env: entry.env,
+          }),
+        });
+      }
+
+      if (args.json) {
+        process.stdout.write(`${formatJsonLine({ command: "storage provision", ...result })}\n`);
+        return;
+      }
+      for (const entry of result.environments) {
+        process.stdout.write(`${entry.env}: bucket ${entry.bucketName} ready, sweep worker deployed.\n`);
+      }
+      process.stdout.write(`${formatDone()}\n`);
+    }),
+});
+
+const deprovision = defineCommand({
+  meta: { name: "deprovision", description: "Remove the sweep workers (and optionally the buckets)" },
+  args: {
+    storage: {
+      type: "boolean",
+      default: false,
+      description: "Also delete the R2 buckets and every file in them (irreversible)",
+    },
+    "r2-access-key-id": {
+      type: "string",
+      description:
+        "R2 S3 access key id, required with --storage: a bucket must be emptied over the S3 protocol before R2 will delete it. Falls back to R2_CREDENTIALS in the account config.",
+    },
+    "r2-secret-access-key": {
+      type: "string",
+      description:
+        "R2 S3 secret access key, paired with --r2-access-key-id. Falls back to R2_CREDENTIALS in the account config.",
+    },
+    json: { type: "boolean", default: false, description: "Machine-readable output" },
+  },
+  run: ({ args }) =>
+    withErrorReporting(args.json, async () => {
+      const projectDir = process.cwd();
+      // Teardown finds resources by recomputing their names, so this must be the same name
+      // `provision` used. A guess would match nothing, delete nothing, and still exit 0.
+      const config = await loadProject(projectDir);
+      const project = requireProjectName(config);
+      // The project's own environment set (#241): what this command fans out across, rather than a
+      // pair the CLI assumed. A project declaring `live` gets `live` provisioned and torn down too.
+      const environments = loadProjectEnvironments(config);
+      const { deprovisionStorage } = await loadStorage();
+      const { account, accountId, apiToken, r2Raw } = loadCloudflareCreds(await projectCloudflareAccount(projectDir));
+      // Resolve the key pair up front, before a single worker comes down. A bucket cannot be deleted
+      // without it, so discovering it is missing at the bucket step would leave the sweep workers gone
+      // and the buckets standing — a half-torn-down environment for a mistake we can catch here.
+      const r2Credentials = args.storage
+        ? resolveR2Credentials(args["r2-access-key-id"], args["r2-secret-access-key"], r2Raw)
+        : undefined;
+      const cf = new CloudflareClients({ accountId, apiToken });
+      const deprovisioner = new CloudflareStorageDeprovisioner({
+        account,
+        cf,
+        project,
+        r2Credentials,
+        audit: await buildAudit(projectDir, accountId, apiToken),
+      });
+
+      await deprovisionStorage(deprovisioner, environments, { deleteStorage: args.storage });
+
+      if (args.json) {
+        process.stdout.write(`${formatJsonLine({ command: "storage deprovision", storageDeleted: args.storage })}\n`);
+        return;
+      }
+      process.stdout.write(`Sweep workers removed${args.storage ? ", including the buckets and their files" : ""}.\n`);
+      process.stdout.write(`${formatDone()}\n`);
+    }),
+});
+
+export default defineCommand({
+  meta: { name: "storage", description: "Provision and manage the storage infrastructure" },
+  subCommands: { provision, deprovision },
+});