@smoothbricks/cli 0.10.7 → 0.10.8

package/src/wrangler/cloudflare.ts

@@ -0,0 +1,289 @@
+import typia from 'typia';
+import type { LiveKvNamespace } from './environment.js';
+
+export interface R2Bucket {
+  name: string;
+}
+
+export interface WorkerScript {
+  id: string;
+}
+
+export interface WorkerRoute {
+  id: string;
+  pattern: string;
+  script?: string;
+}
+
+export interface WorkerDomain {
+  id: string;
+  hostname: string;
+  service?: string;
+}
+
+export interface CloudflareZone {
+  id: string;
+  name: string;
+}
+
+export interface DnsRecord {
+  id: string;
+  name: string;
+  type: string;
+  content: string;
+  proxied?: boolean;
+}
+
+export interface CloudflareClient {
+  listKvNamespaces(): Promise<LiveKvNamespace[]>;
+  createKvNamespace(title: string): Promise<LiveKvNamespace>;
+  deleteKvNamespace(id: string): Promise<void>;
+  listR2Buckets(): Promise<R2Bucket[]>;
+  createR2Bucket(name: string): Promise<void>;
+  listR2Objects(bucket: string): Promise<string[]>;
+  deleteR2Object(bucket: string, key: string): Promise<void>;
+  deleteR2Bucket(name: string): Promise<void>;
+  listWorkerScripts(): Promise<WorkerScript[]>;
+  deleteWorkerScript(name: string): Promise<void>;
+  listWorkerDomains(): Promise<WorkerDomain[]>;
+  createWorkerDomain(hostname: string, workerName: string, zoneId: string): Promise<void>;
+  deleteWorkerDomain(id: string): Promise<void>;
+  listZones(): Promise<CloudflareZone[]>;
+  listWorkerRoutes(zoneId: string): Promise<WorkerRoute[]>;
+  createWorkerRoute(zoneId: string, pattern: string, workerName: string): Promise<void>;
+  deleteWorkerRoute(zoneId: string, routeId: string): Promise<void>;
+  listDnsRecords(zoneId: string): Promise<DnsRecord[]>;
+  createDnsRecord(zoneId: string, name: string, content: string): Promise<void>;
+  deleteDnsRecord(zoneId: string, recordId: string): Promise<void>;
+}
+
+interface CloudflareEnvelope {
+  success: boolean;
+  result?: unknown;
+  errors?: Array<{ code?: number; message?: string }>;
+  result_info?: {
+    page?: number;
+    total_pages?: number;
+    cursor?: string;
+    is_truncated?: boolean;
+  };
+}
+
+const isCloudflareEnvelope = typia.createIs<CloudflareEnvelope>();
+const isKvNamespaces = typia.createIs<LiveKvNamespace[]>();
+const isR2Buckets = typia.createIs<R2Bucket[]>();
+const isWorkerScripts = typia.createIs<WorkerScript[]>();
+const isWorkerDomains = typia.createIs<WorkerDomain[]>();
+const isCloudflareZones = typia.createIs<CloudflareZone[]>();
+const isWorkerRoutes = typia.createIs<WorkerRoute[]>();
+const isDnsRecords = typia.createIs<DnsRecord[]>();
+const isR2Objects = typia.createIs<Array<{ key: string }>>();
+const isR2BucketPage = typia.createIs<{ buckets: R2Bucket[] }>();
+const isR2ObjectPage = typia.createIs<{ objects: Array<{ key: string }> }>();
+const isCreatedKvNamespace = typia.createIs<LiveKvNamespace>();
+
+export class CloudflareApiError extends Error {
+  constructor(
+    message: string,
+    readonly status: number,
+    readonly codes: number[],
+  ) {
+    super(message);
+  }
+}
+
+export class CloudflareRestClient implements CloudflareClient {
+  private readonly accountPath: string;
+
+  constructor(
+    accountId: string,
+    private readonly apiToken: string,
+    private readonly fetcher: typeof fetch = fetch,
+  ) {
+    if (!accountId || !apiToken) {
+      throw new Error('CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN are required.');
+    }
+    this.accountPath = `/accounts/${encodeURIComponent(accountId)}`;
+  }
+
+  listKvNamespaces(): Promise<LiveKvNamespace[]> {
+    return this.listPageItems(`${this.accountPath}/storage/kv/namespaces`, isKvNamespaces);
+  }
+
+  async createKvNamespace(title: string): Promise<LiveKvNamespace> {
+    const result = await this.result(`${this.accountPath}/storage/kv/namespaces`, {
+      method: 'POST',
+      body: JSON.stringify({ title }),
+    });
+    if (!isCreatedKvNamespace(result)) {
+      throw new Error(`Cloudflare returned an invalid KV namespace after creating ${title}.`);
+    }
+    return result;
+  }
+
+  async deleteKvNamespace(id: string): Promise<void> {
+    await this.result(`${this.accountPath}/storage/kv/namespaces/${encodeURIComponent(id)}`, { method: 'DELETE' });
+  }
+
+  async listR2Buckets(): Promise<R2Bucket[]> {
+    const buckets: R2Bucket[] = [];
+    let page = 1;
+    for (;;) {
+      const envelope = await this.request(`${this.accountPath}/r2/buckets?per_page=1000&page=${page}`);
+      let rows: R2Bucket[];
+      if (isR2Buckets(envelope.result)) rows = envelope.result;
+      else if (isR2BucketPage(envelope.result)) rows = envelope.result.buckets;
+      else throw new Error('Cloudflare returned an invalid R2 bucket listing.');
+      buckets.push(...rows);
+      const totalPages = envelope.result_info?.total_pages ?? page;
+      if (page >= totalPages) break;
+      page += 1;
+    }
+    return buckets;
+  }
+
+  async createR2Bucket(name: string): Promise<void> {
+    await this.result(`${this.accountPath}/r2/buckets`, { method: 'POST', body: JSON.stringify({ name }) });
+  }
+
+  async listR2Objects(bucket: string): Promise<string[]> {
+    const keys: string[] = [];
+    let cursor: string | undefined;
+    do {
+      const query = new URLSearchParams({ per_page: '1000' });
+      if (cursor) query.set('cursor', cursor);
+      const envelope = await this.request(
+        `${this.accountPath}/r2/buckets/${encodeURIComponent(bucket)}/objects?${query.toString()}`,
+      );
+      let rows: Array<{ key: string }>;
+      if (isR2Objects(envelope.result)) rows = envelope.result;
+      else if (isR2ObjectPage(envelope.result)) rows = envelope.result.objects;
+      else throw new Error(`Cloudflare returned an invalid object listing for R2 bucket ${bucket}.`);
+      keys.push(...rows.map((row) => row.key));
+      cursor = envelope.result_info?.is_truncated === true ? envelope.result_info.cursor : undefined;
+    } while (cursor);
+    return keys;
+  }
+
+  async deleteR2Object(bucket: string, key: string): Promise<void> {
+    const objectPath = key.split('/').map(encodeURIComponent).join('/');
+    await this.result(`${this.accountPath}/r2/buckets/${encodeURIComponent(bucket)}/objects/${objectPath}`, {
+      method: 'DELETE',
+    });
+  }
+
+  async deleteR2Bucket(name: string): Promise<void> {
+    await this.result(`${this.accountPath}/r2/buckets/${encodeURIComponent(name)}`, { method: 'DELETE' });
+  }
+
+  listWorkerScripts(): Promise<WorkerScript[]> {
+    return this.listPageItems(`${this.accountPath}/workers/scripts`, isWorkerScripts);
+  }
+
+  async deleteWorkerScript(name: string): Promise<void> {
+    await this.result(`${this.accountPath}/workers/scripts/${encodeURIComponent(name)}`, { method: 'DELETE' });
+  }
+
+  listWorkerDomains(): Promise<WorkerDomain[]> {
+    return this.listPageItems(`${this.accountPath}/workers/domains`, isWorkerDomains);
+  }
+
+  async createWorkerDomain(hostname: string, workerName: string, zoneId: string): Promise<void> {
+    await this.result(`${this.accountPath}/workers/domains`, {
+      method: 'PUT',
+      body: JSON.stringify({ hostname, service: workerName, zone_id: zoneId }),
+    });
+  }
+
+  async deleteWorkerDomain(id: string): Promise<void> {
+    await this.result(`${this.accountPath}/workers/domains/${encodeURIComponent(id)}`, { method: 'DELETE' });
+  }
+
+  listZones(): Promise<CloudflareZone[]> {
+    return this.listPageItems('/zones', isCloudflareZones);
+  }
+
+  listWorkerRoutes(zoneId: string): Promise<WorkerRoute[]> {
+    return this.listPageItems(`/zones/${encodeURIComponent(zoneId)}/workers/routes`, isWorkerRoutes);
+  }
+
+  async createWorkerRoute(zoneId: string, pattern: string, workerName: string): Promise<void> {
+    await this.result(`/zones/${encodeURIComponent(zoneId)}/workers/routes`, {
+      method: 'POST',
+      body: JSON.stringify({ pattern, script: workerName }),
+    });
+  }
+
+  async deleteWorkerRoute(zoneId: string, routeId: string): Promise<void> {
+    await this.result(`/zones/${encodeURIComponent(zoneId)}/workers/routes/${encodeURIComponent(routeId)}`, {
+      method: 'DELETE',
+    });
+  }
+
+  listDnsRecords(zoneId: string): Promise<DnsRecord[]> {
+    return this.listPageItems(`/zones/${encodeURIComponent(zoneId)}/dns_records`, isDnsRecords);
+  }
+
+  async createDnsRecord(zoneId: string, name: string, content: string): Promise<void> {
+    await this.result(`/zones/${encodeURIComponent(zoneId)}/dns_records`, {
+      method: 'POST',
+      body: JSON.stringify({ type: 'CNAME', name, content, proxied: true }),
+    });
+  }
+
+  async deleteDnsRecord(zoneId: string, recordId: string): Promise<void> {
+    await this.result(`/zones/${encodeURIComponent(zoneId)}/dns_records/${encodeURIComponent(recordId)}`, {
+      method: 'DELETE',
+    });
+  }
+
+  private async listPageItems<T>(path: string, isItems: (value: unknown) => value is T[]): Promise<T[]> {
+    const items: T[] = [];
+    let page = 1;
+    for (;;) {
+      const separator = path.includes('?') ? '&' : '?';
+      const envelope = await this.request(`${path}${separator}per_page=1000&page=${page}`);
+      if (!isItems(envelope.result)) {
+        throw new Error(`Cloudflare returned an invalid paginated result for ${path}.`);
+      }
+      items.push(...envelope.result);
+      const totalPages = envelope.result_info?.total_pages ?? page;
+      if (page >= totalPages) break;
+      page += 1;
+    }
+    return items;
+  }
+
+  private async result(path: string, init?: RequestInit): Promise<unknown> {
+    return (await this.request(path, init)).result;
+  }
+
+  private async request(path: string, init: RequestInit = {}): Promise<CloudflareEnvelope> {
+    const response = await this.fetcher(`https://api.cloudflare.com/client/v4${path}`, {
+      ...init,
+      headers: {
+        Authorization: `Bearer ${this.apiToken}`,
+        'Content-Type': 'application/json',
+        ...init.headers,
+      },
+    });
+    const body: unknown = await response.json();
+    if (!isCloudflareEnvelope(body)) {
+      throw new CloudflareApiError(`Cloudflare returned a malformed response for ${path}.`, response.status, []);
+    }
+    if (!response.ok || !body.success) {
+      const errors = body.errors ?? [];
+      const message =
+        errors
+          .map((error) => error.message)
+          .filter(Boolean)
+          .join('; ') || `HTTP ${response.status}`;
+      throw new CloudflareApiError(
+        `Cloudflare API ${path} failed: ${message}`,
+        response.status,
+        errors.flatMap((error) => error.code ?? []),
+      );
+    }
+    return body;
+  }
+}

package/src/wrangler/deploy-environment.test.ts

@@ -0,0 +1,354 @@
+import { afterEach, describe, expect, it } from 'bun:test';
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import type {
+  CloudflareClient,
+  CloudflareZone,
+  DnsRecord,
+  R2Bucket,
+  WorkerDomain,
+  WorkerRoute,
+  WorkerScript,
+} from './cloudflare.js';
+import { cleanupPullRequest, deployEnvironment, type ProcessResult, type ProcessRunner } from './deploy-environment.js';
+import type { LiveKvNamespace } from './environment.js';
+
+const HASH = '16577780061662788004';
+const FIXTURE = `[env.staging]
+name = "fixture-worker-staging"
+workers_dev = false
+
+[env.staging.vars]
+ENVIRONMENT = "staging"
+`;
+
+const ROUTED_FIXTURE = `${FIXTURE}
+[[env.staging.routes]]
+pattern = "*.staging.conloca.com/*"
+zone_name = "conloca.com"
+`;
+
+const roots: string[] = [];
+
+function requiredTestValue<T>(value: T | undefined, name: string): T {
+  if (value === undefined) throw new Error(`${name} was not captured.`);
+  return value;
+}
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })));
+});
+
+class FakeRunner implements ProcessRunner {
+  readonly calls: string[][] = [];
+  configPathSeen: string | undefined;
+  secretsPathSeen: string | undefined;
+  secretsMode: number | undefined;
+  secretsJson: string | undefined;
+
+  constructor(
+    private readonly versions: unknown,
+    private readonly deployment: unknown,
+  ) {}
+
+  async run(_command: string, args: string[]): Promise<ProcessResult> {
+    this.calls.push(args);
+    if (args[0] === 'versions' && args[1] === 'list') {
+      return success(this.versions);
+    }
+    if (args[0] === 'deployments' && args[1] === 'status') {
+      return success(this.deployment);
+    }
+    const configIndex = args.indexOf('--config');
+    if (configIndex >= 0) {
+      this.configPathSeen = args[configIndex + 1];
+      expect(this.configPathSeen && existsSync(this.configPathSeen)).toBe(true);
+    }
+    const secretsIndex = args.indexOf('--secrets-file');
+    if (secretsIndex >= 0) {
+      this.secretsPathSeen = args[secretsIndex + 1];
+      const secretsPath = requiredTestValue(this.secretsPathSeen, 'secrets path');
+      this.secretsMode = statSync(secretsPath).mode & 0o777;
+      this.secretsJson = readFileSync(secretsPath, 'utf8');
+    }
+    return success({});
+  }
+}
+
+class FakeCloudflare implements CloudflareClient {
+  namespaces: LiveKvNamespace[] = [];
+  buckets: R2Bucket[] = [];
+  scripts: WorkerScript[] = [{ id: 'fixture-worker-pr123' }];
+  domains: WorkerDomain[] = [];
+  zones: CloudflareZone[] = [];
+  routes: Record<string, WorkerRoute[]> = {};
+  records: Record<string, DnsRecord[]> = {};
+  objects: Record<string, string[]> = {};
+  mutations: string[] = [];
+
+  async listKvNamespaces(): Promise<LiveKvNamespace[]> {
+    return this.namespaces;
+  }
+  async createKvNamespace(title: string): Promise<LiveKvNamespace> {
+    this.mutations.push(`create-kv:${title}`);
+    const namespace = { id: `id-${title}`, title };
+    this.namespaces.push(namespace);
+    return namespace;
+  }
+  async deleteKvNamespace(id: string): Promise<void> {
+    this.mutations.push(`delete-kv:${id}`);
+  }
+  async listR2Buckets(): Promise<R2Bucket[]> {
+    return this.buckets;
+  }
+  async createR2Bucket(name: string): Promise<void> {
+    this.mutations.push(`create-r2:${name}`);
+    this.buckets.push({ name });
+  }
+  async listR2Objects(bucket: string): Promise<string[]> {
+    return this.objects[bucket] ?? [];
+  }
+  async deleteR2Object(bucket: string, key: string): Promise<void> {
+    this.mutations.push(`delete-object:${bucket}:${key}`);
+  }
+  async deleteR2Bucket(name: string): Promise<void> {
+    this.mutations.push(`delete-r2:${name}`);
+  }
+  async listWorkerScripts(): Promise<WorkerScript[]> {
+    return this.scripts;
+  }
+  async deleteWorkerScript(name: string): Promise<void> {
+    this.mutations.push(`delete-worker:${name}`);
+  }
+  async listWorkerDomains(): Promise<WorkerDomain[]> {
+    return this.domains;
+  }
+  async createWorkerDomain(hostname: string, workerName: string): Promise<void> {
+    this.mutations.push(`create-domain:${hostname}:${workerName}`);
+  }
+  async deleteWorkerDomain(id: string): Promise<void> {
+    this.mutations.push(`delete-domain:${id}`);
+  }
+  async listZones(): Promise<CloudflareZone[]> {
+    return this.zones;
+  }
+  async listWorkerRoutes(zoneId: string): Promise<WorkerRoute[]> {
+    return this.routes[zoneId] ?? [];
+  }
+  async createWorkerRoute(zoneId: string, pattern: string, workerName: string): Promise<void> {
+    this.mutations.push(`create-route:${zoneId}:${pattern}:${workerName}`);
+  }
+  async deleteWorkerRoute(zoneId: string, routeId: string): Promise<void> {
+    this.mutations.push(`delete-route:${zoneId}:${routeId}`);
+  }
+  async listDnsRecords(zoneId: string): Promise<DnsRecord[]> {
+    return this.records[zoneId] ?? [];
+  }
+  async createDnsRecord(zoneId: string, name: string, content: string): Promise<void> {
+    this.mutations.push(`create-dns:${zoneId}:${name}:${content}`);
+  }
+  async deleteDnsRecord(zoneId: string, recordId: string): Promise<void> {
+    this.mutations.push(`delete-dns:${zoneId}:${recordId}`);
+  }
+}
+
+describe('deploy-environment remote version fallback', () => {
+  it('returns a remote cache hit for the active tagged 100% version', async () => {
+    const root = await fixtureRoot();
+    const runner = new FakeRunner([{ id: 'version-1', annotations: { 'workers/tag': `nx-${HASH}` } }], {
+      versions: [{ version_id: 'version-1', percentage: 100 }],
+    });
+
+    const result = await deployEnvironment(root, 'pr123', dependencies(runner, new FakeCloudflare()));
+
+    expect(result.action).toBe('remote-cache-hit');
+    expect(runner.calls.map((args) => args.slice(0, 2))).toEqual([
+      ['versions', 'list'],
+      ['deployments', 'status'],
+    ]);
+  });
+
+  it('activates an existing tagged version that is not current', async () => {
+    const root = await fixtureRoot();
+    const runner = new FakeRunner([{ id: 'version-1', annotations: { 'workers/tag': `nx-${HASH}` } }], {
+      versions: [{ version_id: 'version-2', percentage: 100 }],
+    });
+
+    const result = await deployEnvironment(root, 'pr123', dependencies(runner, new FakeCloudflare()));
+
+    expect(result.action).toBe('activated');
+    expect(runner.calls.at(-1)?.slice(0, 3)).toEqual(['versions', 'deploy', '--version-tag']);
+    expect(runner.configPathSeen).toBeDefined();
+    expect(existsSync(requiredTestValue(runner.configPathSeen, 'config path'))).toBe(false);
+  });
+
+  it('uploads a missing tag with a temporary config and secure secrets file, then removes both', async () => {
+    const root = await fixtureRoot();
+    await writeFile(join(root, '.dev.vars.example'), 'OAUTH_STATE_SIGNING_KEY=""\nTOKEN_ENCRYPTION_KEY=""\n');
+    const runner = new FakeRunner([], { versions: [{ version_id: 'version-2', percentage: 100 }] });
+
+    const result = await deployEnvironment(root, 'pr123', {
+      ...dependencies(runner, new FakeCloudflare()),
+      processEnv: {
+        CLOUDFLARE_ACCOUNT_ID: 'account-1',
+        CLOUDFLARE_API_TOKEN: 'token',
+        NX_TASK_HASH: HASH,
+        NX_TASK_TARGET_PROJECT: 'fixture',
+        OAUTH_STATE_SIGNING_KEY: 'shared-secret',
+        TOKEN_ENCRYPTION_KEY: 'encryption-secret',
+      },
+    });
+
+    expect(result.action).toBe('deployed');
+    expect(runner.calls.at(-1)?.[0]).toBe('deploy');
+    expect(runner.calls.at(-1)).toContain('--tag');
+    expect(runner.calls.at(-1)).toContain(`nx-${HASH}`);
+    expect(runner.secretsMode).toBe(0o600);
+    expect(JSON.parse(requiredTestValue(runner.secretsJson, 'secrets JSON'))).toEqual({
+      OAUTH_STATE_SIGNING_KEY: 'shared-secret',
+      TOKEN_ENCRYPTION_KEY: 'encryption-secret',
+    });
+    expect(existsSync(requiredTestValue(runner.configPathSeen, 'config path'))).toBe(false);
+    expect(existsSync(requiredTestValue(runner.secretsPathSeen, 'secrets path'))).toBe(false);
+  });
+
+  it('passes only present manifest values for fixed environments and preserves absent remote secrets', async () => {
+    const root = await fixtureRoot();
+    await writeFile(join(root, '.dev.vars.example'), 'OAUTH_STATE_SIGNING_KEY=""\nTOKEN_ENCRYPTION_KEY=""\n');
+    const runner = new FakeRunner([], {});
+    const cloudflare = new FakeCloudflare();
+
+    const result = await deployEnvironment(root, 'staging', {
+      runner,
+      cloudflare,
+      processEnv: {
+        CLOUDFLARE_ACCOUNT_ID: 'account-1',
+        CLOUDFLARE_API_TOKEN: 'token',
+        OAUTH_STATE_SIGNING_KEY: 'shared-secret',
+      },
+    });
+
+    expect(result.action).toBe('deployed');
+    expect(JSON.parse(requiredTestValue(runner.secretsJson, 'secrets JSON'))).toEqual({
+      OAUTH_STATE_SIGNING_KEY: 'shared-secret',
+    });
+    expect(existsSync(requiredTestValue(runner.secretsPathSeen, 'secrets path'))).toBe(false);
+  });
+
+  it('rejects a first PR Worker with missing manifest secrets before mutating Cloudflare', async () => {
+    const root = await fixtureRoot();
+    await writeFile(join(root, '.dev.vars.example'), 'OAUTH_STATE_SIGNING_KEY=""\n');
+    const cloudflare = new FakeCloudflare();
+    cloudflare.scripts = [];
+
+    await expect(
+      deployEnvironment(root, 'pr123', {
+        ...dependencies(new FakeRunner([], {}), cloudflare),
+        processEnv: {
+          CLOUDFLARE_ACCOUNT_ID: 'account-1',
+          CLOUDFLARE_API_TOKEN: 'token',
+          NX_TASK_HASH: HASH,
+          NX_TASK_TARGET_PROJECT: 'fixture',
+        },
+      }),
+    ).rejects.toThrow(/OAUTH_STATE_SIGNING_KEY/);
+    expect(cloudflare.mutations).toEqual([]);
+  });
+
+  it('recovers when a parallel deployment creates the wildcard DNS record first', async () => {
+    const root = await fixtureRoot(ROUTED_FIXTURE);
+    const cloudflare = new FakeCloudflare();
+    cloudflare.zones = [{ id: 'zone', name: 'conloca.com' }];
+    let createAttempts = 0;
+    cloudflare.createDnsRecord = async (zoneId, name, content) => {
+      createAttempts += 1;
+      cloudflare.records[zoneId] = [{ id: 'raced', name, type: 'CNAME', content, proxied: true }];
+      throw new Error('record already exists');
+    };
+
+    const result = await deployEnvironment(root, 'pr123', dependencies(new FakeRunner([], {}), cloudflare));
+
+    expect(result.action).toBe('deployed');
+    expect(createAttempts).toBe(1);
+    expect(cloudflare.records.zone?.map((record) => record.name)).toEqual(['*.pr123.conloca.com']);
+  });
+});
+
+describe('cleanup-pr exact environment matching', () => {
+  it('rejects an invalid PR before touching the client', async () => {
+    const cloudflare = new FakeCloudflare();
+    let calls = 0;
+    cloudflare.listWorkerDomains = async () => {
+      calls += 1;
+      return [];
+    };
+
+    await expect(cleanupPullRequest('/unused', 0, { cloudflare })).rejects.toThrow(/1 through 999999999/);
+    expect(calls).toBe(0);
+  });
+
+  it('deletes only exact hyphen/dot-delimited pr123 resources and is idempotent for missing resources', async () => {
+    const cloudflare = new FakeCloudflare();
+    cloudflare.domains = [
+      { id: 'domain-123', hostname: 'app.pr123.conloca.com' },
+      { id: 'domain-1234', hostname: 'app.pr1234.conloca.com' },
+    ];
+    cloudflare.zones = [{ id: 'zone', name: 'conloca.com' }];
+    cloudflare.routes.zone = [
+      { id: 'route-123', pattern: '*.pr123.conloca.com/*' },
+      { id: 'route-1234', pattern: '*.pr1234.conloca.com/*' },
+    ];
+    cloudflare.records.zone = [
+      { id: 'dns-123', name: '*.pr123.conloca.com', type: 'CNAME', content: 'pr123.conloca.com' },
+      { id: 'dns-staging', name: '*.staging.conloca.com', type: 'CNAME', content: 'staging.conloca.com' },
+    ];
+    cloudflare.scripts = [{ id: 'conloca-app-pr123' }, { id: 'conloca-app-pr1234' }, { id: 'conloca-app-staging' }];
+    cloudflare.namespaces = [
+      { id: 'kv-123', title: 'org-profiles-pr123' },
+      { id: 'kv-1234', title: 'org-profiles-pr1234' },
+    ];
+    cloudflare.buckets = [{ name: 'conloca-media-pr123' }, { name: 'conloca-media-pr1234' }];
+    cloudflare.objects['conloca-media-pr123'] = ['one', 'nested/two'];
+
+    const result = await cleanupPullRequest('/unused', 123, { cloudflare });
+
+    expect(result.deleted).toEqual({
+      workers: 1,
+      routes: 1,
+      domains: 1,
+      kvNamespaces: 1,
+      r2Buckets: 1,
+      r2Objects: 2,
+      dnsRecords: 1,
+    });
+    expect(cloudflare.mutations.join('\n')).toContain('delete-worker:conloca-app-pr123');
+    expect(cloudflare.mutations.join('\n')).not.toContain('pr1234');
+    expect(cloudflare.mutations.join('\n')).not.toContain('staging');
+  });
+});
+
+async function fixtureRoot(toml = FIXTURE): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), 'smoo-wrangler-test-'));
+  roots.push(root);
+  await writeFile(join(root, 'wrangler.toml'), toml);
+  return root;
+}
+
+function dependencies(runner: ProcessRunner, cloudflare: CloudflareClient) {
+  return {
+    runner,
+    cloudflare,
+    processEnv: {
+      CLOUDFLARE_ACCOUNT_ID: 'account-1',
+      CLOUDFLARE_API_TOKEN: 'token',
+      NX_TASK_HASH: HASH,
+      NX_TASK_TARGET_PROJECT: 'fixture',
+    },
+  };
+}
+
+function success(value: unknown): ProcessResult {
+  return { exitCode: 0, stdout: JSON.stringify(value), stderr: '' };
+}