@smoothbricks/cli 0.10.7 → 0.10.9

package/dist/wrangler/cloudflare.js

@@ -0,0 +1,238 @@
+import typia from 'typia';
+const isCloudflareEnvelope = (() => {
+    const _ip0 = input => undefined === input["code"] || "number" === typeof input["code"];
+    const _ip1 = input => undefined === input["message"] || "string" === typeof input["message"];
+    const _io0 = input => "boolean" === typeof input.success && true && (null === input.errors || undefined === input.errors || Array.isArray(input.errors) && input.errors.every(elem => "object" === typeof elem && null !== elem && false === Array.isArray(elem) && _io1(elem))) && (null === input.messages || undefined === input.messages || Array.isArray(input.messages) && input.messages.every(elem => "object" === typeof elem && null !== elem && false === Array.isArray(elem) && _io2(elem))) && (undefined === input.result_info || "object" === typeof input.result_info && null !== input.result_info && false === Array.isArray(input.result_info) && _io3(input.result_info));
+    const _io1 = input => _ip0(input) && _ip1(input);
+    const _io2 = input => _ip0(input) && _ip1(input);
+    const _io3 = input => (undefined === input.page || "number" === typeof input.page) && (undefined === input.total_pages || "number" === typeof input.total_pages) && (undefined === input.cursor || "string" === typeof input.cursor) && (undefined === input.is_truncated || "boolean" === typeof input.is_truncated);
+    return input => "object" === typeof input && null !== input && _io0(input);
+})();
+const isKvNamespaces = (() => {
+    const _io0 = input => "string" === typeof input.id && "string" === typeof input.title;
+    return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
+})();
+const isR2Buckets = (() => {
+    const _io0 = input => "string" === typeof input.name;
+    return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
+})();
+const isWorkerScripts = (() => {
+    const _io0 = input => "string" === typeof input.id;
+    return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
+})();
+const isWorkerDomains = (() => {
+    const _io0 = input => "string" === typeof input.id && "string" === typeof input.hostname && (undefined === input.service || "string" === typeof input.service);
+    return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
+})();
+const isCloudflareZones = (() => {
+    const _io0 = input => "string" === typeof input.id && "string" === typeof input.name;
+    return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
+})();
+const isWorkerRoutes = (() => {
+    const _io0 = input => "string" === typeof input.id && "string" === typeof input.pattern && (undefined === input.script || "string" === typeof input.script);
+    return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
+})();
+const isDnsRecords = (() => {
+    const _io0 = input => "string" === typeof input.id && "string" === typeof input.name && "string" === typeof input.type && "string" === typeof input.content && (undefined === input.proxied || "boolean" === typeof input.proxied);
+    return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
+})();
+const isR2Objects = (() => {
+    const _io0 = input => "string" === typeof input.key;
+    return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
+})();
+const isR2BucketPage = (() => {
+    const _io0 = input => Array.isArray(input.buckets) && input.buckets.every(elem => "object" === typeof elem && null !== elem && _io1(elem));
+    const _io1 = input => "string" === typeof input.name;
+    return input => "object" === typeof input && null !== input && _io0(input);
+})();
+const isR2ObjectPage = (() => {
+    const _io0 = input => Array.isArray(input.objects) && input.objects.every(elem => "object" === typeof elem && null !== elem && _io1(elem));
+    const _io1 = input => "string" === typeof input.key;
+    return input => "object" === typeof input && null !== input && _io0(input);
+})();
+const isCreatedKvNamespace = (() => {
+    const _io0 = input => "string" === typeof input.id && "string" === typeof input.title;
+    return input => "object" === typeof input && null !== input && _io0(input);
+})();
+export class CloudflareApiError extends Error {
+    status;
+    codes;
+    constructor(message, status, codes) {
+        super(message);
+        this.status = status;
+        this.codes = codes;
+    }
+}
+export class CloudflareRestClient {
+    apiToken;
+    fetcher;
+    accountPath;
+    constructor(accountId, apiToken, fetcher = fetch) {
+        this.apiToken = apiToken;
+        this.fetcher = fetcher;
+        if (!accountId || !apiToken) {
+            throw new Error('CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN are required.');
+        }
+        this.accountPath = `/accounts/${encodeURIComponent(accountId)}`;
+    }
+    listKvNamespaces() {
+        return this.listPageItems(`${this.accountPath}/storage/kv/namespaces`, isKvNamespaces);
+    }
+    async createKvNamespace(title) {
+        const result = await this.result(`${this.accountPath}/storage/kv/namespaces`, {
+            method: 'POST',
+            body: JSON.stringify({ title }),
+        });
+        if (!isCreatedKvNamespace(result)) {
+            throw new Error(`Cloudflare returned an invalid KV namespace after creating ${title}.`);
+        }
+        return result;
+    }
+    async deleteKvNamespace(id) {
+        await this.result(`${this.accountPath}/storage/kv/namespaces/${encodeURIComponent(id)}`, { method: 'DELETE' });
+    }
+    async listR2Buckets() {
+        const buckets = [];
+        let page = 1;
+        for (;;) {
+            const envelope = await this.request(`${this.accountPath}/r2/buckets?per_page=1000&page=${page}`);
+            let rows;
+            if (isR2Buckets(envelope.result))
+                rows = envelope.result;
+            else if (isR2BucketPage(envelope.result))
+                rows = envelope.result.buckets;
+            else
+                throw new Error('Cloudflare returned an invalid R2 bucket listing.');
+            buckets.push(...rows);
+            const totalPages = envelope.result_info?.total_pages ?? page;
+            if (page >= totalPages)
+                break;
+            page += 1;
+        }
+        return buckets;
+    }
+    async createR2Bucket(name) {
+        await this.result(`${this.accountPath}/r2/buckets`, { method: 'POST', body: JSON.stringify({ name }) });
+    }
+    async listR2Objects(bucket) {
+        const keys = [];
+        let cursor;
+        do {
+            const query = new URLSearchParams({ per_page: '1000' });
+            if (cursor)
+                query.set('cursor', cursor);
+            const envelope = await this.request(`${this.accountPath}/r2/buckets/${encodeURIComponent(bucket)}/objects?${query.toString()}`);
+            let rows;
+            if (isR2Objects(envelope.result))
+                rows = envelope.result;
+            else if (isR2ObjectPage(envelope.result))
+                rows = envelope.result.objects;
+            else
+                throw new Error(`Cloudflare returned an invalid object listing for R2 bucket ${bucket}.`);
+            keys.push(...rows.map((row) => row.key));
+            cursor = envelope.result_info?.is_truncated === true ? envelope.result_info.cursor : undefined;
+        } while (cursor);
+        return keys;
+    }
+    async deleteR2Object(bucket, key) {
+        const objectPath = key.split('/').map(encodeURIComponent).join('/');
+        await this.result(`${this.accountPath}/r2/buckets/${encodeURIComponent(bucket)}/objects/${objectPath}`, {
+            method: 'DELETE',
+        });
+    }
+    async deleteR2Bucket(name) {
+        await this.result(`${this.accountPath}/r2/buckets/${encodeURIComponent(name)}`, { method: 'DELETE' });
+    }
+    listWorkerScripts() {
+        return this.listPageItems(`${this.accountPath}/workers/scripts`, isWorkerScripts);
+    }
+    async deleteWorkerScript(name) {
+        await this.result(`${this.accountPath}/workers/scripts/${encodeURIComponent(name)}`, { method: 'DELETE' });
+    }
+    listWorkerDomains() {
+        return this.listPageItems(`${this.accountPath}/workers/domains`, isWorkerDomains);
+    }
+    async createWorkerDomain(hostname, workerName, zoneId) {
+        await this.result(`${this.accountPath}/workers/domains`, {
+            method: 'PUT',
+            body: JSON.stringify({ hostname, service: workerName, zone_id: zoneId }),
+        });
+    }
+    async deleteWorkerDomain(id) {
+        await this.result(`${this.accountPath}/workers/domains/${encodeURIComponent(id)}`, { method: 'DELETE' });
+    }
+    listZones() {
+        return this.listPageItems('/zones', isCloudflareZones);
+    }
+    listWorkerRoutes(zoneId) {
+        return this.listPageItems(`/zones/${encodeURIComponent(zoneId)}/workers/routes`, isWorkerRoutes);
+    }
+    async createWorkerRoute(zoneId, pattern, workerName) {
+        await this.result(`/zones/${encodeURIComponent(zoneId)}/workers/routes`, {
+            method: 'POST',
+            body: JSON.stringify({ pattern, script: workerName }),
+        });
+    }
+    async deleteWorkerRoute(zoneId, routeId) {
+        await this.result(`/zones/${encodeURIComponent(zoneId)}/workers/routes/${encodeURIComponent(routeId)}`, {
+            method: 'DELETE',
+        });
+    }
+    listDnsRecords(zoneId) {
+        return this.listPageItems(`/zones/${encodeURIComponent(zoneId)}/dns_records`, isDnsRecords);
+    }
+    async createDnsRecord(zoneId, name, content) {
+        await this.result(`/zones/${encodeURIComponent(zoneId)}/dns_records`, {
+            method: 'POST',
+            body: JSON.stringify({ type: 'CNAME', name, content, proxied: true }),
+        });
+    }
+    async deleteDnsRecord(zoneId, recordId) {
+        await this.result(`/zones/${encodeURIComponent(zoneId)}/dns_records/${encodeURIComponent(recordId)}`, {
+            method: 'DELETE',
+        });
+    }
+    async listPageItems(path, isItems) {
+        const items = [];
+        let page = 1;
+        for (;;) {
+            const separator = path.includes('?') ? '&' : '?';
+            const envelope = await this.request(`${path}${separator}per_page=1000&page=${page}`);
+            if (!isItems(envelope.result)) {
+                throw new Error(`Cloudflare returned an invalid paginated result for ${path}.`);
+            }
+            items.push(...envelope.result);
+            const totalPages = envelope.result_info?.total_pages ?? page;
+            if (page >= totalPages)
+                break;
+            page += 1;
+        }
+        return items;
+    }
+    async result(path, init) {
+        return (await this.request(path, init)).result;
+    }
+    async request(path, init = {}) {
+        const response = await this.fetcher(`https://api.cloudflare.com/client/v4${path}`, {
+            ...init,
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                'Content-Type': 'application/json',
+                ...init.headers,
+            },
+        });
+        const body = await response.json();
+        if (!isCloudflareEnvelope(body)) {
+            throw new CloudflareApiError(`Cloudflare returned a malformed response for ${path}.`, response.status, []);
+        }
+        if (!response.ok || !body.success) {
+            const errors = body.errors ?? [];
+            const message = errors
+                .map((error) => error.message)
+                .filter(Boolean)
+                .join('; ') || `HTTP ${response.status}`;
+            throw new CloudflareApiError(`Cloudflare API ${path} failed: ${message}`, response.status, errors.flatMap((error) => error.code ?? []));
+        }
+        return body;
+    }
+}

package/dist/wrangler/deploy-environment.d.ts

@@ -0,0 +1,48 @@
+import { type CloudflareClient } from './cloudflare.js';
+import { type EnvironmentToken } from './environment.js';
+export interface ProcessResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+export interface ProcessRunner {
+    run(command: string, args: string[], options: {
+        cwd: string;
+        env?: Record<string, string>;
+    }): Promise<ProcessResult>;
+}
+export declare class BunProcessRunner implements ProcessRunner {
+    run(command: string, args: string[], options: {
+        cwd: string;
+        env?: Record<string, string>;
+    }): Promise<ProcessResult>;
+}
+export interface WranglerCommandDependencies {
+    runner?: ProcessRunner;
+    cloudflare?: CloudflareClient;
+    processEnv?: NodeJS.ProcessEnv;
+}
+export interface DeployEnvironmentResult {
+    environment: EnvironmentToken;
+    workerName: string;
+    action: 'deployed' | 'activated' | 'remote-cache-hit';
+    versionTag?: string;
+}
+export declare function deployEnvironment(cwd: string, environmentValue: string, dependencies?: WranglerCommandDependencies): Promise<DeployEnvironmentResult>;
+export interface CleanupResult {
+    environment: `pr${number}`;
+    deleted: {
+        workers: number;
+        routes: number;
+        domains: number;
+        kvNamespaces: number;
+        r2Buckets: number;
+        r2Objects: number;
+        dnsRecords: number;
+    };
+}
+export declare function cleanupPullRequest(cwd: string, prNumber: number, dependencies?: WranglerCommandDependencies): Promise<CleanupResult>;
+export declare function nxTaskVersionTag(environment: NodeJS.ProcessEnv): string | undefined;
+export declare function findVersionIdByTag(value: unknown, tag: string): string | null;
+export declare function isFullCurrentDeployment(value: unknown, versionId: string): boolean;
+//# sourceMappingURL=deploy-environment.d.ts.map

package/dist/wrangler/deploy-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-environment.d.ts","sourceRoot":"","sources":["../../src/wrangler/deploy-environment.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,gBAAgB,EAAwB,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAGL,KAAK,gBAAgB,EAQtB,MAAM,kBAAkB,CAAC;AAG1B,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACtH;AAED,qBAAa,gBAAiB,YAAW,aAAa;IAC9C,GAAG,CACP,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GACrD,OAAO,CAAC,aAAa,CAAC,CAcxB;CACF;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,kBAAkB,CAAC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,gBAAgB,EAAE,MAAM,EACxB,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,uBAAuB,CAAC,CA2HlC;AACD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,aAAa,CAAC,CA2DxB;AAwFD,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAgBnF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuB7E;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAelF"}

package/dist/wrangler/deploy-environment.js

@@ -0,0 +1,383 @@
+import { randomUUID } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { readFile, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import typia from 'typia';
+import { CloudflareRestClient } from './cloudflare.js';
+import { derivePullRequestWranglerConfig, environmentResourceName, hasExactEnvironmentSegment, isPullRequestEnvironment, parseEnvironmentToken, planConfiguredEnvironmentResources, planPullRequestResources, pullRequestEnvironment, } from './environment.js';
+import { parseDevVarsExample } from './prepare-env.js';
+export class BunProcessRunner {
+    async run(command, args, options) {
+        const child = Bun.spawn([command, ...args], {
+            cwd: options.cwd,
+            env: { ...process.env, ...options.env },
+            stdin: 'inherit',
+            stdout: 'pipe',
+            stderr: 'pipe',
+        });
+        const [exitCode, stdout, stderr] = await Promise.all([
+            child.exited,
+            new Response(child.stdout).text(),
+            new Response(child.stderr).text(),
+        ]);
+        return { exitCode, stdout, stderr };
+    }
+}
+const isUnknownRecord = (() => {
+    const _io0 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return true;
+    });
+    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+})();
+export async function deployEnvironment(cwd, environmentValue, dependencies = {}) {
+    const environment = parseEnvironmentToken(environmentValue);
+    const processEnv = dependencies.processEnv ?? process.env;
+    const accountId = processEnv.CLOUDFLARE_ACCOUNT_ID;
+    const apiToken = processEnv.CLOUDFLARE_API_TOKEN;
+    if (!accountId)
+        throw new Error('CLOUDFLARE_ACCOUNT_ID is required.');
+    const cloudflare = dependencies.cloudflare ??
+        new CloudflareRestClient(accountId, requiredEnvironmentValue(apiToken, 'CLOUDFLARE_API_TOKEN'));
+    const runner = dependencies.runner ?? new BunProcessRunner();
+    const committedConfigPath = join(cwd, 'wrangler.toml');
+    const committedToml = await readFile(committedConfigPath, 'utf8');
+    const secretNames = readSecretNames(cwd);
+    const secretValues = {};
+    for (const name of secretNames) {
+        const value = processEnv[name];
+        if (value)
+            secretValues[name] = value;
+    }
+    const missingSecrets = secretNames.filter((name) => !processEnv[name]);
+    let configPath = committedConfigPath;
+    let temporaryConfigPath;
+    let temporarySecretsPath;
+    try {
+        if (isPullRequestEnvironment(environment)) {
+            const staging = planConfiguredEnvironmentResources(committedToml, 'staging');
+            if (!staging.workerName.endsWith('-staging')) {
+                throw new Error('[env.staging].name must end with the exact suffix -staging.');
+            }
+            const workerName = environmentResourceName(staging.workerName.slice(0, -'-staging'.length), environment);
+            const firstDeployment = !(await cloudflare.listWorkerScripts()).some((script) => script.id === workerName);
+            if (firstDeployment && missingSecrets.length > 0) {
+                throw new Error(`First deployment of ${workerName} requires process environment values for: ${missingSecrets.join(', ')}.`);
+            }
+            const liveNamespaces = await cloudflare.listKvNamespaces();
+            const plan = planPullRequestResources(committedToml, environment, liveNamespaces);
+            const derivedIds = new Map();
+            const byTitle = new Map(liveNamespaces.map((namespace) => [namespace.title, namespace]));
+            for (const namespace of plan.kvNamespaces) {
+                let live = byTitle.get(namespace.title);
+                if (!live) {
+                    try {
+                        live = await cloudflare.createKvNamespace(namespace.title);
+                    }
+                    catch (error) {
+                        live = (await cloudflare.listKvNamespaces()).find((candidate) => candidate.title === namespace.title);
+                        if (!live)
+                            throw error;
+                    }
+                    byTitle.set(live.title, live);
+                }
+                derivedIds.set(namespace.stagingId, live.id);
+            }
+            const derivedToml = derivePullRequestWranglerConfig(committedToml, {
+                environment,
+                accountId,
+                kvNamespaceIds: derivedIds,
+            });
+            temporaryConfigPath = join(cwd, `.wrangler.smoo-${process.pid}-${randomUUID()}.toml`);
+            await writeFile(temporaryConfigPath, derivedToml, { mode: 0o600 });
+            configPath = temporaryConfigPath;
+        }
+        const toml = configPath === committedConfigPath ? committedToml : await readFile(configPath, 'utf8');
+        const plan = planConfiguredEnvironmentResources(toml, environment);
+        const workerExists = await reconcileEnvironmentResources(plan, cloudflare);
+        const versionTag = nxTaskVersionTag(processEnv);
+        const commandContext = { cwd, configPath, environment, workerName: plan.workerName };
+        if (versionTag && workerExists) {
+            const versions = await wranglerJson(runner, ['versions', 'list', '--name', plan.workerName, '--json'], cwd);
+            const deployments = await wranglerJson(runner, ['deployments', 'status', '--name', plan.workerName, '--json'], cwd);
+            const versionId = findVersionIdByTag(versions, versionTag);
+            if (versionId && isFullCurrentDeployment(deployments, versionId)) {
+                return { environment, workerName: plan.workerName, action: 'remote-cache-hit', versionTag };
+            }
+            if (versionId) {
+                await wrangler(runner, [
+                    'versions',
+                    'deploy',
+                    '--version-tag',
+                    versionTag,
+                    '--name',
+                    plan.workerName,
+                    '--config',
+                    configPath,
+                    '--env',
+                    environment,
+                    '--yes',
+                ], cwd);
+                return { environment, workerName: plan.workerName, action: 'activated', versionTag };
+            }
+        }
+        const deployArgs = ['deploy', '--config', commandContext.configPath, '--env', commandContext.environment];
+        if (versionTag)
+            deployArgs.push('--tag', versionTag);
+        if (Object.keys(secretValues).length > 0) {
+            temporarySecretsPath = join(cwd, `.wrangler-secrets.smoo-${process.pid}-${randomUUID()}.json`);
+            await writeFile(temporarySecretsPath, `${JSON.stringify(secretValues)}\n`, { mode: 0o600 });
+            deployArgs.push('--secrets-file', temporarySecretsPath);
+        }
+        await wrangler(runner, deployArgs, cwd);
+        return {
+            environment,
+            workerName: commandContext.workerName,
+            action: 'deployed',
+            ...(versionTag ? { versionTag } : {}),
+        };
+    }
+    finally {
+        if (temporaryConfigPath) {
+            await rm(temporaryConfigPath, { force: true });
+        }
+        if (temporarySecretsPath) {
+            await rm(temporarySecretsPath, { force: true });
+        }
+    }
+}
+export async function cleanupPullRequest(cwd, prNumber, dependencies = {}) {
+    const environment = pullRequestEnvironment(prNumber);
+    const processEnv = dependencies.processEnv ?? process.env;
+    const cloudflare = dependencies.cloudflare ??
+        new CloudflareRestClient(requiredEnvironmentValue(processEnv.CLOUDFLARE_ACCOUNT_ID, 'CLOUDFLARE_ACCOUNT_ID'), requiredEnvironmentValue(processEnv.CLOUDFLARE_API_TOKEN, 'CLOUDFLARE_API_TOKEN'));
+    void cwd;
+    const deleted = {
+        workers: 0,
+        routes: 0,
+        domains: 0,
+        kvNamespaces: 0,
+        r2Buckets: 0,
+        r2Objects: 0,
+        dnsRecords: 0,
+    };
+    for (const domain of await cloudflare.listWorkerDomains()) {
+        if (!hasExactEnvironmentSegment(domain.hostname, environment))
+            continue;
+        await cloudflare.deleteWorkerDomain(domain.id);
+        deleted.domains += 1;
+    }
+    for (const zone of await cloudflare.listZones()) {
+        for (const route of await cloudflare.listWorkerRoutes(zone.id)) {
+            if (!hasExactEnvironmentSegment(route.pattern, environment))
+                continue;
+            await cloudflare.deleteWorkerRoute(zone.id, route.id);
+            deleted.routes += 1;
+        }
+        for (const record of await cloudflare.listDnsRecords(zone.id)) {
+            if (!hasExactEnvironmentSegment(record.name, environment))
+                continue;
+            await cloudflare.deleteDnsRecord(zone.id, record.id);
+            deleted.dnsRecords += 1;
+        }
+    }
+    for (const script of await cloudflare.listWorkerScripts()) {
+        if (!hasExactEnvironmentSegment(script.id, environment))
+            continue;
+        await cloudflare.deleteWorkerScript(script.id);
+        deleted.workers += 1;
+    }
+    for (const namespace of await cloudflare.listKvNamespaces()) {
+        if (!hasExactEnvironmentSegment(namespace.title, environment))
+            continue;
+        await cloudflare.deleteKvNamespace(namespace.id);
+        deleted.kvNamespaces += 1;
+    }
+    for (const bucket of await cloudflare.listR2Buckets()) {
+        if (!hasExactEnvironmentSegment(bucket.name, environment))
+            continue;
+        for (const key of await cloudflare.listR2Objects(bucket.name)) {
+            await cloudflare.deleteR2Object(bucket.name, key);
+            deleted.r2Objects += 1;
+        }
+        await cloudflare.deleteR2Bucket(bucket.name);
+        deleted.r2Buckets += 1;
+    }
+    return { environment, deleted };
+}
+async function reconcileEnvironmentResources(plan, cloudflare) {
+    const namespaces = await cloudflare.listKvNamespaces();
+    const namespaceIds = new Set(namespaces.map((namespace) => namespace.id));
+    for (const binding of plan.kvNamespaces) {
+        if (!namespaceIds.has(binding.id)) {
+            throw new Error(`KV binding ${binding.binding} references missing namespace ${binding.id}.`);
+        }
+    }
+    const buckets = new Set((await cloudflare.listR2Buckets()).map((bucket) => bucket.name));
+    for (const binding of plan.r2Buckets) {
+        if (buckets.has(binding.bucketName))
+            continue;
+        try {
+            await cloudflare.createR2Bucket(binding.bucketName);
+        }
+        catch (error) {
+            const exists = (await cloudflare.listR2Buckets()).some((bucket) => bucket.name === binding.bucketName);
+            if (!exists)
+                throw error;
+        }
+        buckets.add(binding.bucketName);
+    }
+    const zones = await cloudflare.listZones();
+    const zoneByName = new Map(zones.map((zone) => [zone.name, zone]));
+    const dnsNamesByZone = new Map();
+    for (const route of plan.routes) {
+        if (!route.pattern.startsWith('*.') || !route.zoneName)
+            continue;
+        const zone = zoneByName.get(route.zoneName);
+        if (!zone)
+            throw new Error(`Cloudflare zone ${route.zoneName} is not available to the deployment token.`);
+        const hostname = route.pattern.slice(0, route.pattern.indexOf('/')).replace(/^\*\./, '');
+        const wildcard = `*.${hostname}`;
+        let names = dnsNamesByZone.get(zone.id);
+        if (!names) {
+            names = new Set((await cloudflare.listDnsRecords(zone.id)).map((record) => record.name));
+            dnsNamesByZone.set(zone.id, names);
+        }
+        if (!names.has(wildcard)) {
+            try {
+                await cloudflare.createDnsRecord(zone.id, wildcard, hostname);
+            }
+            catch (error) {
+                const exists = (await cloudflare.listDnsRecords(zone.id)).some((record) => record.name === wildcard);
+                if (!exists)
+                    throw error;
+            }
+            names.add(wildcard);
+        }
+    }
+    const scripts = await cloudflare.listWorkerScripts();
+    const workerExists = scripts.some((script) => script.id === plan.workerName);
+    if (!workerExists)
+        return false;
+    const domains = await cloudflare.listWorkerDomains();
+    for (const route of plan.routes) {
+        if (!route.customDomain)
+            continue;
+        const existing = domains.find((domain) => domain.hostname === route.pattern);
+        if (existing?.service === plan.workerName)
+            continue;
+        if (existing) {
+            throw new Error(`Custom domain ${route.pattern} is already attached to ${existing.service ?? 'another Worker'}.`);
+        }
+        const zone = route.zoneName
+            ? zoneByName.get(route.zoneName)
+            : zones
+                .filter((candidate) => route.pattern === candidate.name || route.pattern.endsWith(`.${candidate.name}`))
+                .sort((left, right) => right.name.length - left.name.length)[0];
+        if (!zone)
+            throw new Error(`No accessible Cloudflare zone contains custom domain ${route.pattern}.`);
+        await cloudflare.createWorkerDomain(route.pattern, plan.workerName, zone.id);
+    }
+    for (const zone of zones) {
+        const desired = plan.routes.filter((route) => !route.customDomain && route.zoneName === zone.name);
+        if (desired.length === 0)
+            continue;
+        const routes = await cloudflare.listWorkerRoutes(zone.id);
+        for (const route of desired) {
+            const existing = routes.find((candidate) => candidate.pattern === route.pattern);
+            if (existing?.script === plan.workerName)
+                continue;
+            if (existing) {
+                throw new Error(`Worker route ${route.pattern} is already attached to ${existing.script ?? 'another Worker'}.`);
+            }
+            await cloudflare.createWorkerRoute(zone.id, route.pattern, plan.workerName);
+        }
+    }
+    return true;
+}
+export function nxTaskVersionTag(environment) {
+    const hash = environment.NX_TASK_HASH;
+    const underNx = hash !== undefined ||
+        environment.NX_TASK_TARGET_PROJECT !== undefined ||
+        environment.NX_TASK_TARGET_TARGET !== undefined;
+    if (!underNx)
+        return undefined;
+    if (!hash)
+        throw new Error('NX_TASK_HASH is required when deploy-environment runs under Nx.');
+    if (/^(?:0|[1-9][0-9]*)$/.test(hash)) {
+        return `nx-${hash}`;
+    }
+    const normalized = hash.toLowerCase();
+    if (/^[0-9a-f]{32,}$/.test(normalized)) {
+        return `nx-${normalized.slice(0, 32)}`;
+    }
+    throw new Error('NX_TASK_HASH must be canonical decimal digits or at least 32 hexadecimal characters.');
+}
+export function findVersionIdByTag(value, tag) {
+    if (Array.isArray(value)) {
+        for (const entry of value) {
+            const found = findVersionIdByTag(entry, tag);
+            if (found)
+                return found;
+        }
+        return null;
+    }
+    if (!isUnknownRecord(value))
+        return null;
+    const annotations = isUnknownRecord(value.annotations) ? value.annotations : undefined;
+    const metadata = isUnknownRecord(value.metadata) ? value.metadata : undefined;
+    const annotationTag = annotations?.['workers/tag'];
+    const candidateTag = typeof annotationTag === 'string' ? annotationTag : typeof value.tag === 'string' ? value.tag : metadata?.tag;
+    if (candidateTag === tag) {
+        if (typeof value.id === 'string')
+            return value.id;
+        if (typeof value.version_id === 'string')
+            return value.version_id;
+    }
+    for (const nested of Object.values(value)) {
+        const found = findVersionIdByTag(nested, tag);
+        if (found)
+            return found;
+    }
+    return null;
+}
+export function isFullCurrentDeployment(value, versionId) {
+    if (Array.isArray(value))
+        return value.some((entry) => isFullCurrentDeployment(entry, versionId));
+    if (!isUnknownRecord(value))
+        return false;
+    if (Array.isArray(value.versions)) {
+        return (value.versions.length === 1 &&
+            value.versions.some((version) => isUnknownRecord(version) &&
+                (version.version_id === versionId || version.id === versionId) &&
+                Number(version.percentage) === 100));
+    }
+    return Object.values(value).some((entry) => isFullCurrentDeployment(entry, versionId));
+}
+async function wranglerJson(runner, args, cwd) {
+    const result = await wrangler(runner, args, cwd);
+    try {
+        return JSON.parse(result.stdout);
+    }
+    catch {
+        throw new Error(`wrangler ${args.join(' ')} returned invalid JSON.`);
+    }
+}
+async function wrangler(runner, args, cwd) {
+    const result = await runner.run('wrangler', args, { cwd });
+    if (result.exitCode !== 0) {
+        throw new Error(`wrangler ${args.join(' ')} failed with exit code ${result.exitCode}: ${result.stderr.trim()}`);
+    }
+    return result;
+}
+function requiredEnvironmentValue(value, name) {
+    if (!value)
+        throw new Error(`${name} is required.`);
+    return value;
+}
+function readSecretNames(cwd) {
+    const path = join(cwd, '.dev.vars.example');
+    return existsSync(path) ? parseDevVarsExample(readFileSync(path, 'utf8')) : [];
+}