@sponson/sim 0.4.0 → 0.5.0

package/dist/routes/aws.d.ts

@@ -0,0 +1,43 @@
+import { type ProviderSim } from "../provider.js";
+/** One S3 CORS rule as stored. */
+export interface AwsCorsRule {
+    ID?: string;
+    AllowedOrigin: string[];
+    AllowedMethod: string[];
+    AllowedHeader: string[];
+    ExposeHeader: string[];
+    MaxAgeSeconds?: string;
+}
+/** Simulated AWS state: buckets with their CORS configuration, Amplify apps with their branches. */
+export interface AwsState {
+    /** Access key id → secret access key. */
+    keys: Record<string, string>;
+    region: string;
+    buckets: Record<string, {
+        cors: AwsCorsRule[] | null;
+    }>;
+    amplify: Record<string, {
+        branches: Record<string, {
+            environmentVariables: Record<string, string>;
+        }>;
+    }>;
+}
+/** Initial AWS state. Buckets are listed by name; Amplify apps by id, with their branches' variables. */
+export interface AwsSeed {
+    keys?: Record<string, string>;
+    region?: string;
+    buckets?: Record<string, {
+        cors?: AwsCorsRule[] | null;
+    }>;
+    amplify?: Record<string, {
+        branches: Record<string, {
+            environmentVariables?: Record<string, string>;
+        }>;
+    }>;
+}
+/** The access key id the sim's default seed accepts (`AWS_SIM_ACCESS_KEY_ID` in `simEnv`). */
+export declare const AWS_SIM_ACCESS_KEY_ID = "AKIASIMEXAMPLE0042";
+/** Its secret (`AWS_SIM_SECRET_ACCESS_KEY` in `simEnv`). */
+export declare const AWS_SIM_SECRET_ACCESS_KEY = "sim/aws-secret-access-key-0042";
+/** Simulated AWS (S3 bucket CORS, Amplify branch variables); see the assumptions at the top of this file. */
+export declare const awsSim: ProviderSim<AwsState, AwsSeed>;

package/dist/routes/aws.js

@@ -0,0 +1,211 @@
+/**
+ * Simulated AWS APIs signed with SigV4: S3 bucket CORS configuration (XML) and Amplify branch environment
+ * variables (JSON). They exist to test the generic `http` adapter's `auth: { aws_sigv4 }` and `encoding: xml`
+ * against something that checks both: every request's signature is recomputed (../auth.ts) and refused when wrong.
+ *
+ * Path-style, under `/aws`: `/aws/s3/<bucket>/?cors` stands for `https://<bucket>.s3.<region>.amazonaws.com/?cors`,
+ * `/aws/amplify/apps/<app>/branches/<branch>` for `https://amplify.<region>.amazonaws.com/apps/<app>/branches/<branch>`.
+ *
+ * Assumptions (docs/api-verification.md, "AWS through the generic adapter"):
+ *   A1. Requests are signed with SigV4 for the path's service (`s3`, `amplify`) and the seeded region; S3 requests
+ *       carry `x-amz-content-sha256`. Verified: IAM "Create a signed AWS API request"; S3 "Common request headers".
+ *   A2. `PUT /?cors` takes a `CORSConfiguration` of 1 to 100 `CORSRule`s (each with at least one `AllowedOrigin` and
+ *       one `AllowedMethod`) and requires `Content-MD5` (or an x-amz-checksum); it replaces the whole configuration
+ *       and answers 200 with no body. An empty configuration is `MalformedXML`. Verified: S3 API Reference
+ *       PutBucketCors; botocore `requestChecksumRequired`.
+ *   A3. `GET /?cors` answers the configuration as XML; a bucket without one answers 404 `NoSuchCORSConfiguration`.
+ *       Unverified (the 404 code from memory); `DELETE /?cors` answers 204. Verified: DeleteBucketCors.
+ *   A4. Amplify `GetBranch` (`GET`) and `UpdateBranch` (`POST`) on `/apps/{appId}/branches/{branchName}` answer
+ *       `{ branch: { …, environmentVariables } }`; `environmentVariables` in an update replaces the whole map.
+ *       Verified: Amplify API Reference UpdateBranch, GetBranch. Errors are JSON `{ message }` with
+ *       `x-amzn-ErrorType`; unknown app or branch is 404 `NotFoundException`.
+ */
+import { createHash } from "node:crypto";
+import { sigV4Problem } from "../auth.js";
+import { Reply, route, router } from "../provider.js";
+/** The access key id the sim's default seed accepts (`AWS_SIM_ACCESS_KEY_ID` in `simEnv`). */
+export const AWS_SIM_ACCESS_KEY_ID = "AKIASIMEXAMPLE0042";
+/** Its secret (`AWS_SIM_SECRET_ACCESS_KEY` in `simEnv`). */
+export const AWS_SIM_SECRET_ACCESS_KEY = "sim/aws-secret-access-key-0042";
+/** Simulated AWS (S3 bucket CORS, Amplify branch variables); see the assumptions at the top of this file. */
+export const awsSim = {
+    env: { token: "AWS_SIM_SECRET_ACCESS_KEY", url: "AWS_SIM_URL", testToken: AWS_SIM_SECRET_ACCESS_KEY, more: { AWS_SIM_ACCESS_KEY_ID: AWS_SIM_ACCESS_KEY_ID } },
+    defaultSeed: { buckets: { assets: { cors: null } }, amplify: { d1demo: { branches: { "pr-42": {} } } } },
+    reset(_core, seed) {
+        const buckets = {};
+        for (const [name, b] of Object.entries(seed?.buckets ?? {}))
+            buckets[name] = { cors: b.cors ? structuredClone(b.cors) : null };
+        const amplify = {};
+        for (const [app, a] of Object.entries(seed?.amplify ?? {})) {
+            amplify[app] = { branches: Object.fromEntries(Object.entries(a.branches).map(([n, b]) => [n, { environmentVariables: { ...(b.environmentVariables ?? {}) } }])) };
+        }
+        return { keys: seed?.keys ?? { [AWS_SIM_ACCESS_KEY_ID]: AWS_SIM_SECRET_ACCESS_KEY }, region: seed?.region ?? "us-east-1", buckets, amplify };
+    },
+    /**
+     * `s3.<bucket>.cors`: "delete" removes the configuration; "remove:<ID>" one rule.
+     * `amplify.<app>.<branch>.<NAME>`: a new value, or "delete".
+     */
+    drift(_core, state, { key, rest, value, only }) {
+        if (only !== undefined)
+            return false;
+        const [kind, a, b, c] = rest.split(".");
+        if (kind === "s3" && a && b === "cors")
+            return driftCors(state, a, value, key);
+        if (kind === "amplify" && a && b && c) {
+            const branch = state.amplify[a]?.branches[b];
+            if (!branch)
+                throw new Error(`drift ${key}: no branch ${a}/${b}`);
+            if (value === "delete")
+                delete branch.environmentVariables[c];
+            else
+                branch.environmentVariables[c] = value;
+            return true;
+        }
+        return false;
+    },
+    authorized(headers, state, req) {
+        return authorized(headers, req, state);
+    },
+    routes(core, state, req) {
+        return routes(core, state, req);
+    },
+};
+function driftCors(state, bucket, value, key) {
+    const b = state.buckets[bucket];
+    if (!b)
+        throw new Error(`drift ${key}: no bucket ${bucket}`);
+    if (value === "delete")
+        b.cors = null;
+    else if (value.startsWith("remove:"))
+        b.cors = (b.cors ?? []).filter((r) => r.ID !== value.slice(7));
+    else
+        throw new Error(`drift ${key}: "delete" or "remove:<ID>"`);
+    return true;
+}
+/** A1: the signature must be valid for the service the path belongs to. */
+function authorized(headers, req, state) {
+    const service = /^\/aws\/(s3|amplify)\//.exec(req.url.pathname)?.[1];
+    if (!service)
+        return false;
+    if (service === "s3" && headers["x-amz-content-sha256"] === undefined)
+        return s3Error(400, "InvalidRequest", "Missing required header for this request: x-amz-content-sha256");
+    const problem = sigV4Problem(headers, req, { keys: state.keys, region: state.region, service });
+    if (problem === null)
+        return true;
+    return service === "s3" ? s3Error(403, problem === "InvalidAccessKeyId" ? problem : "SignatureDoesNotMatch", problem) : amplifyError(401, "UnauthorizedException", problem);
+}
+// ---------------------------------------------------------------------------
+// S3 CORS (XML)
+// ---------------------------------------------------------------------------
+const XML = { "content-type": "application/xml" };
+function escape(s) {
+    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function unescape(s) {
+    return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
+function s3Error(status, code, message) {
+    return new Reply(status, `<?xml version="1.0" encoding="UTF-8"?><Error><Code>${code}</Code><Message>${escape(message)}</Message></Error>`, XML);
+}
+function corsXml(rules) {
+    const el = (name, values) => values.map((v) => `<${name}>${escape(v)}</${name}>`).join("");
+    const body = rules
+        .map((r) => `<CORSRule>${r.ID !== undefined ? el("ID", [r.ID]) : ""}${el("AllowedHeader", r.AllowedHeader)}${el("AllowedMethod", r.AllowedMethod)}${el("AllowedOrigin", r.AllowedOrigin)}${el("ExposeHeader", r.ExposeHeader)}${r.MaxAgeSeconds !== undefined ? el("MaxAgeSeconds", [r.MaxAgeSeconds]) : ""}</CORSRule>`)
+        .join("");
+    return `<?xml version="1.0" encoding="UTF-8"?>\n<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">${body}</CORSConfiguration>`;
+}
+/** The rules of a `CORSConfiguration` document; a reason when it is not one S3 accepts (A2). */
+function parseCors(xml) {
+    if (/<!DOCTYPE|<!ENTITY/i.test(xml))
+        return "DTDs are not accepted";
+    if (!/<CORSConfiguration(\s[^>]*)?>[\s\S]*<\/CORSConfiguration>\s*$/.test(xml.replace(/^<\?xml[^>]*\?>\s*/, "")))
+        return "the root element must be CORSConfiguration";
+    const rules = [];
+    for (const m of xml.matchAll(/<CORSRule>([\s\S]*?)<\/CORSRule>/g)) {
+        const values = (name) => [...m[1].matchAll(new RegExp(`<${name}>([^<]*)</${name}>`, "g"))].map((x) => unescape(x[1]));
+        const rule = { AllowedOrigin: values("AllowedOrigin"), AllowedMethod: values("AllowedMethod"), AllowedHeader: values("AllowedHeader"), ExposeHeader: values("ExposeHeader") };
+        const id = values("ID")[0];
+        const age = values("MaxAgeSeconds")[0];
+        if (id !== undefined)
+            rule.ID = id;
+        if (age !== undefined)
+            rule.MaxAgeSeconds = age;
+        if (rule.AllowedOrigin.length === 0 || rule.AllowedMethod.length === 0)
+            return "every CORSRule needs an AllowedOrigin and an AllowedMethod";
+        if (rule.AllowedMethod.some((x) => !["GET", "PUT", "POST", "DELETE", "HEAD"].includes(x)))
+            return "AllowedMethod must be GET, PUT, POST, DELETE or HEAD";
+        rules.push(rule);
+    }
+    if (rules.length === 0 || rules.length > 100)
+        return "a CORSConfiguration holds 1 to 100 CORSRules";
+    return rules;
+}
+function putCors(bucket, headers, body) {
+    const xml = typeof body === "string" ? body : "";
+    const md5 = headers["content-md5"];
+    if (md5 === undefined)
+        return s3Error(400, "InvalidRequest", "Missing required header for this request: Content-Md5");
+    if (md5 !== createHash("md5").update(xml, "utf8").digest("base64"))
+        return s3Error(400, "BadDigest", "The Content-MD5 you specified did not match what we received.");
+    const rules = parseCors(xml);
+    if (typeof rules === "string")
+        return s3Error(400, "MalformedXML", rules);
+    bucket.cors = rules;
+    return new Reply(200, "", XML);
+}
+// ---------------------------------------------------------------------------
+// Amplify branches (JSON)
+// ---------------------------------------------------------------------------
+function amplifyError(status, type, message) {
+    return new Reply(status, { message }, { "x-amzn-errortype": type });
+}
+function branchView(app, name, b) {
+    return new Reply(200, { branch: { branchArn: `arn:aws:amplify:us-east-1:000000000000:apps/${app}/branches/${name}`, branchName: name, stage: "PULL_REQUEST", environmentVariables: { ...b.environmentVariables } } });
+}
+function updateBranch(app, name, b, body) {
+    if (typeof body !== "object" || body === null)
+        return amplifyError(400, "BadRequestException", "body must be a JSON object");
+    const vars = body.environmentVariables;
+    if (vars !== undefined) {
+        if (typeof vars !== "object" || vars === null || !Object.values(vars).every((v) => typeof v === "string"))
+            return amplifyError(400, "BadRequestException", "environmentVariables must map names to strings");
+        b.environmentVariables = { ...vars };
+    }
+    return branchView(app, name, b);
+}
+const routes = router([
+    route("GET", "/s3/:bucket/", ({ state, params, url }) => {
+        const b = state.buckets[params.bucket];
+        if (!b)
+            return s3Error(404, "NoSuchBucket", "The specified bucket does not exist");
+        if (!url.searchParams.has("cors"))
+            return s3Error(501, "NotImplemented", "only ?cors is simulated");
+        return b.cors ? new Reply(200, corsXml(b.cors), XML) : s3Error(404, "NoSuchCORSConfiguration", "The CORS configuration does not exist");
+    }),
+    route("PUT", "/s3/:bucket/", ({ state, params, url, headers, body }) => {
+        const b = state.buckets[params.bucket];
+        if (!b)
+            return s3Error(404, "NoSuchBucket", "The specified bucket does not exist");
+        if (!url.searchParams.has("cors"))
+            return s3Error(501, "NotImplemented", "only ?cors is simulated");
+        return putCors(b, headers, body);
+    }),
+    route("DELETE", "/s3/:bucket/", ({ state, params, url }) => {
+        const b = state.buckets[params.bucket];
+        if (!b)
+            return s3Error(404, "NoSuchBucket", "The specified bucket does not exist");
+        if (!url.searchParams.has("cors"))
+            return s3Error(501, "NotImplemented", "only ?cors is simulated");
+        b.cors = null;
+        return new Reply(204, null);
+    }),
+    route("GET", "/amplify/apps/:app/branches/:branch", ({ state, params }) => {
+        const b = state.amplify[params.app]?.branches[params.branch];
+        return b ? branchView(params.app, params.branch, b) : amplifyError(404, "NotFoundException", "branch not found");
+    }),
+    route("POST", "/amplify/apps/:app/branches/:branch", ({ state, params, body }) => {
+        const b = state.amplify[params.app]?.branches[params.branch];
+        return b ? updateBranch(params.app, params.branch, b, body) : amplifyError(404, "NotFoundException", "branch not found");
+    }),
+], () => s3Error(404, "NotFound", "not simulated"));
+//# sourceMappingURL=aws.js.map

package/dist/routes/aws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../src/routes/aws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAsC,MAAM,gBAAgB,CAAC;AA6B1F,8FAA8F;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAC1D,4DAA4D;AAC5D,MAAM,CAAC,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AAE1E,6GAA6G;AAC7G,MAAM,CAAC,MAAM,MAAM,GAAmC;IACpD,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,yBAAyB,EAAE,IAAI,EAAE,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAAE;IAC7J,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;IAExG,KAAK,CAAC,KAAK,EAAE,IAAI;QACf,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/H,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpK,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,qBAAqB,CAAC,EAAE,yBAAyB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC/I,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;QAC5C,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACrC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/E,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClE,IAAI,KAAK,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;;gBACzD,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG;QAC5B,OAAO,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG;QACrB,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC;CACF,CAAC;AAEF,SAAS,SAAS,CAAC,KAAe,EAAE,MAAc,EAAE,KAAa,EAAE,GAAW;IAC5E,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,eAAe,MAAM,EAAE,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,QAAQ;QAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;SACjC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;;QAChG,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,6BAA6B,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,SAAS,UAAU,CAAC,OAA4B,EAAE,GAAgB,EAAE,KAAe;IACjF,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,gEAAgE,CAAC,CAAC;IAC/K,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAChG,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,KAAK,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,uBAAuB,EAAE,OAAO,CAAC,CAAC;AAC9K,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,GAAG,GAAG,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAElD,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC9H,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;IAC5D,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,sDAAsD,IAAI,mBAAmB,MAAM,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;AAClJ,CAAC;AAED,SAAS,OAAO,CAAC,KAAoB;IACnC,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,MAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7G,MAAM,IAAI,GAAG,KAAK;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC;SACxT,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,8GAA8G,IAAI,sBAAsB,CAAC;AAClJ,CAAC;AAED,gGAAgG;AAChG,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,uBAAuB,CAAC;IACpE,IAAI,CAAC,+DAA+D,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAAE,OAAO,4CAA4C,CAAC;IACtK,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,aAAa,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QAChI,MAAM,IAAI,GAAgB,EAAE,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3L,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,EAAE,KAAK,SAAS;YAAE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACnC,IAAI,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;QAChD,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,4DAA4D,CAAC;QAC5I,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,sDAAsD,CAAC;QACzJ,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,8CAA8C,CAAC;IACpG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,MAAsC,EAAE,OAA+B,EAAE,IAAa;IACrG,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IACtH,IAAI,GAAG,KAAK,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,+DAA+D,CAAC,CAAC;IACtK,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IAC1E,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC;IACpB,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;IACjE,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAY,EAAE,CAAmD;IAChG,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,+CAA+C,GAAG,aAAa,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC,oBAAoB,EAAE,EAAE,EAAE,CAAC,CAAC;AACxN,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,IAAY,EAAE,CAAmD,EAAE,IAAa;IACjH,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC,GAAG,EAAE,qBAAqB,EAAE,4BAA4B,CAAC,CAAC;IAC7H,MAAM,IAAI,GAAI,IAAgC,CAAC,oBAAoB,CAAC;IACpE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAAE,OAAO,YAAY,CAAC,GAAG,EAAE,qBAAqB,EAAE,gDAAgD,CAAC,CAAC;QAC7M,CAAC,CAAC,oBAAoB,GAAG,EAAE,GAAI,IAA+B,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,MAAM,GAAG,MAAM,CACnB;IACE,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE;QACtD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,qCAAqC,CAAC,CAAC;QACnF,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,yBAAyB,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,uCAAuC,CAAC,CAAC;IAC1I,CAAC,CAAC;IACF,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACrE,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,qCAAqC,CAAC,CAAC;QACnF,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,yBAAyB,CAAC,CAAC;QACpG,OAAO,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC;IACF,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE;QACzD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,qCAAqC,CAAC,CAAC;QACnF,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,yBAAyB,CAAC,CAAC;QACpG,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;QACd,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC;IACF,KAAK,CAAC,KAAK,EAAE,qCAAqC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;QACxE,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;IACnH,CAAC,CAAC;IACF,KAAK,CAAC,MAAM,EAAE,qCAAqC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;QAC/E,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;IAC3H,CAAC,CAAC;CACH,EACD,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAChD,CAAC"}

package/dist/routes/cloudflare.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Simulated Cloudflare: Pages projects and their per-environment variables (`deployment_configs.<env>.env_vars`).
+ *
+ * Assumptions about the real API that this fake encodes. Sources (fetched 2026-10-11): the official OpenAPI document
+ * https://github.com/cloudflare/api-schemas (`openapi.json`), the API reference pages
+ * https://developers.cloudflare.com/api/resources/pages/subresources/projects/methods/get/ and …/methods/edit/,
+ * and the Pages docs cited per item. The critical ones are pinned in scenarios/contract.test.ts
+ * (`assumption CF<n>: …`) so `pnpm test:live` checks them against a real account.
+ *
+ *   CF1. Base URL `https://api.cloudflare.com/client/v4`, `Authorization: Bearer <API token>` — verified
+ *        (https://developers.cloudflare.com/fundamentals/api/how-to/make-api-calls/). The token needs the
+ *        account permission "Cloudflare Pages Edit" (fundamentals/api/reference/permissions/; schema token groups
+ *        "Pages Read"/"Pages Write").
+ *   CF2. `GET /accounts/{account_id}/pages/projects/{project_name}` answers `200 { success, errors, messages, result }`,
+ *        `result` a project with `id`, `name`, `subdomain` and `deployment_configs.{preview,production}.env_vars`, a
+ *        nullable map NAME → `{ type: "plain_text" | "secret_text", value }` — verified (schema `pages_project`,
+ *        `pages_plain_text_env_var`, `pages_secret_text_env_var`).
+ *   CF3. A `secret_text` value is never returned: the entry is listed with its type and `value: ""` — partly
+ *        verified: the docs say secrets cannot be seen after they are set (pages/functions/bindings/), and the
+ *        schema's example is `{"type":"secret_text","value":""}`; whether the key comes back with `""`, null or
+ *        no `value` is not stated (the adapter accepts all three). Pinned.
+ *   CF4. `PATCH` of the same path merges: `deployment_configs.<env>.env_vars` keys not in the body are left alone, a
+ *        key set to `null` is deleted, and the answer is `200` with the updated project — `null` deletes and `200`
+ *        verified ("To delete an environment variable, set its key to `null`"); merging is implied by that rule and
+ *        by a body with no required fields, but not stated. Pinned: the adapter also re-reads and refuses to go on
+ *        if a variable it did not send disappeared.
+ *   CF5. No precondition (ETag / If-Match) exists for that PATCH — verified (only path parameters, no 412). Two
+ *        writers of the same key race; last write wins. Sponson's own writers take turns through the parent lock
+ *        (`lockOn`, ADR 0019).
+ *   CF6. Failures answer `4XX { success: false, errors: [{ code, message }], result: null }` — verified (schema
+ *        `pages_api-response-common-failure`). An unknown project answers `404` with code `8000007` — unverified:
+ *        the schema declares only `4XX`; the status and code come from Wrangler's error reports.
+ *   CF7. A write is visible to the next GET at once — unverified. Pinned.
+ *   CF8. Preview variables are one set shared by every preview deployment; there are no per-branch values —
+ *        verified ("This will set the configuration for all preview deployments, not just the deployments from a
+ *        specific branch", pages/functions/wrangler-configuration/).
+ *   CF9. Variable names: the schema gives no pattern (free-form map keys); the sim accepts any non-empty name.
+ *   CF10. Changing a variable does not change existing deployments; it applies to the next one — indirectly
+ *        documented ("Redeploy your project for the binding to take effect", pages/functions/bindings/). The sim
+ *        has no deployments, so nothing here depends on it.
+ */
+import { type CreatedBy, type ProviderSim } from "../provider.js";
+/** The two variable sets of a Pages project. */
+export type CloudflarePagesEnv = "preview" | "production";
+/** One variable as the simulated Cloudflare stores it (the secret's value included: the sim must compare it). */
+export interface CloudflareEnvVar {
+    type: "plain_text" | "secret_text";
+    value: string;
+}
+/** A Pages project, with the bookkeeping the sim adds (`createdBy`). */
+export interface CloudflarePagesProject {
+    id: string;
+    name: string;
+    subdomain: string;
+    createdBy: CreatedBy;
+    deployment_configs: Record<CloudflarePagesEnv, {
+        env_vars: Record<string, CloudflareEnvVar>;
+    }>;
+}
+/** The simulated Cloudflare's state: Pages projects per account id. */
+export interface CloudflareState {
+    accounts: Record<string, {
+        projects: Record<string, CloudflarePagesProject>;
+    }>;
+}
+/** Variables of one environment in a seed: NAME → a plain value, or `{ type, value }`. */
+export type CloudflareSeedVars = Record<string, string | {
+    type?: CloudflareEnvVar["type"];
+    value: string;
+}>;
+/** What a scenario or test seeds the simulated Cloudflare with (`seed: { cloudflare: … }`). */
+export interface CloudflareSeed {
+    /** Account id → project name → the variables that already exist (set "by a human", so unmanaged). */
+    accounts: Record<string, Record<string, {
+        preview?: CloudflareSeedVars;
+        production?: CloudflareSeedVars;
+    }>>;
+}
+/** The simulated Cloudflare API, registered in `PROVIDERS` (packages/sim/src/state.ts) and served under `/cloudflare`. */
+export declare const cloudflareSim: ProviderSim<CloudflareState, CloudflareSeed>;

package/dist/routes/cloudflare.js

@@ -0,0 +1,176 @@
+/**
+ * Simulated Cloudflare: Pages projects and their per-environment variables (`deployment_configs.<env>.env_vars`).
+ *
+ * Assumptions about the real API that this fake encodes. Sources (fetched 2026-10-11): the official OpenAPI document
+ * https://github.com/cloudflare/api-schemas (`openapi.json`), the API reference pages
+ * https://developers.cloudflare.com/api/resources/pages/subresources/projects/methods/get/ and …/methods/edit/,
+ * and the Pages docs cited per item. The critical ones are pinned in scenarios/contract.test.ts
+ * (`assumption CF<n>: …`) so `pnpm test:live` checks them against a real account.
+ *
+ *   CF1. Base URL `https://api.cloudflare.com/client/v4`, `Authorization: Bearer <API token>` — verified
+ *        (https://developers.cloudflare.com/fundamentals/api/how-to/make-api-calls/). The token needs the
+ *        account permission "Cloudflare Pages Edit" (fundamentals/api/reference/permissions/; schema token groups
+ *        "Pages Read"/"Pages Write").
+ *   CF2. `GET /accounts/{account_id}/pages/projects/{project_name}` answers `200 { success, errors, messages, result }`,
+ *        `result` a project with `id`, `name`, `subdomain` and `deployment_configs.{preview,production}.env_vars`, a
+ *        nullable map NAME → `{ type: "plain_text" | "secret_text", value }` — verified (schema `pages_project`,
+ *        `pages_plain_text_env_var`, `pages_secret_text_env_var`).
+ *   CF3. A `secret_text` value is never returned: the entry is listed with its type and `value: ""` — partly
+ *        verified: the docs say secrets cannot be seen after they are set (pages/functions/bindings/), and the
+ *        schema's example is `{"type":"secret_text","value":""}`; whether the key comes back with `""`, null or
+ *        no `value` is not stated (the adapter accepts all three). Pinned.
+ *   CF4. `PATCH` of the same path merges: `deployment_configs.<env>.env_vars` keys not in the body are left alone, a
+ *        key set to `null` is deleted, and the answer is `200` with the updated project — `null` deletes and `200`
+ *        verified ("To delete an environment variable, set its key to `null`"); merging is implied by that rule and
+ *        by a body with no required fields, but not stated. Pinned: the adapter also re-reads and refuses to go on
+ *        if a variable it did not send disappeared.
+ *   CF5. No precondition (ETag / If-Match) exists for that PATCH — verified (only path parameters, no 412). Two
+ *        writers of the same key race; last write wins. Sponson's own writers take turns through the parent lock
+ *        (`lockOn`, ADR 0019).
+ *   CF6. Failures answer `4XX { success: false, errors: [{ code, message }], result: null }` — verified (schema
+ *        `pages_api-response-common-failure`). An unknown project answers `404` with code `8000007` — unverified:
+ *        the schema declares only `4XX`; the status and code come from Wrangler's error reports.
+ *   CF7. A write is visible to the next GET at once — unverified. Pinned.
+ *   CF8. Preview variables are one set shared by every preview deployment; there are no per-branch values —
+ *        verified ("This will set the configuration for all preview deployments, not just the deployments from a
+ *        specific branch", pages/functions/wrangler-configuration/).
+ *   CF9. Variable names: the schema gives no pattern (free-form map keys); the sim accepts any non-empty name.
+ *   CF10. Changing a variable does not change existing deployments; it applies to the next one — indirectly
+ *        documented ("Redeploy your project for the binding to take effect", pages/functions/bindings/). The sim
+ *        has no deployments, so nothing here depends on it.
+ */
+import { Reply, route, router } from "../provider.js";
+const ENVS = ["preview", "production"];
+/** The simulated Cloudflare API, registered in `PROVIDERS` (packages/sim/src/state.ts) and served under `/cloudflare`. */
+export const cloudflareSim = {
+    env: { token: "CLOUDFLARE_API_TOKEN", url: "CLOUDFLARE_API_URL", testToken: "tok_cloudflare" },
+    defaultSeed: { accounts: { acc_demo: { demo: {} } } },
+    reset(core, seed) {
+        const accounts = {};
+        for (const [account, projects] of Object.entries(seed?.accounts ?? {})) {
+            accounts[account] = { projects: {} };
+            for (const [name, vars] of Object.entries(projects))
+                accounts[account].projects[name] = project(core, name, vars);
+        }
+        return { accounts };
+    },
+    /**
+     * `pages_env.<env>.<NAME>` or `cloudflare:<project>.pages_env.<env>.<NAME>`, what a human in the dashboard would do:
+     * `delete`; `plain:<value>` or `secret:<value>` (set, choosing the type); any other value replaces the value and
+     * keeps the type. Setting a variable that does not exist creates it as plain text.
+     */
+    drift(_core, state, { key, rest, value, only }) {
+        const m = /^pages_env\.(preview|production)\.(.+)$/.exec(rest);
+        if (!m)
+            return false;
+        const env = m[1];
+        const name = m[2];
+        const projects = Object.values(state.accounts).flatMap((a) => Object.values(a.projects)).filter((p) => only === undefined || p.name === only);
+        if (projects.length === 0)
+            throw new Error(`drift ${key}: no Pages project${only ? ` named ${only}` : ""}`);
+        for (const p of projects) {
+            const vars = p.deployment_configs[env].env_vars;
+            if (value === "delete")
+                delete vars[name];
+            else if (value.startsWith("plain:"))
+                vars[name] = { type: "plain_text", value: value.slice("plain:".length) };
+            else if (value.startsWith("secret:"))
+                vars[name] = { type: "secret_text", value: value.slice("secret:".length) };
+            else
+                vars[name] = { type: vars[name]?.type ?? "plain_text", value };
+        }
+        return true;
+    },
+    routes(core, state, req) {
+        return routes(core, state, req);
+    },
+};
+const PROJECT = "/accounts/:account/pages/projects/:project";
+const routes = router([
+    route("GET", PROJECT, ({ state, params }) => {
+        const p = state.accounts[params.account]?.projects[params.project];
+        return p ? ok(publicProject(p)) : notFound();
+    }),
+    route("PATCH", PROJECT, ({ state, params, body }) => {
+        const p = state.accounts[params.account]?.projects[params.project];
+        if (!p)
+            return notFound();
+        const problem = patchProblem(body);
+        if (problem)
+            return failure(400, 8000000, problem);
+        const configs = body.deployment_configs ?? {};
+        for (const env of ENVS) {
+            // CF4: a merge. Keys absent from the body stay; `null` deletes.
+            for (const [name, v] of Object.entries(configs[env]?.env_vars ?? {})) {
+                if (v === null)
+                    delete p.deployment_configs[env].env_vars[name];
+                else
+                    p.deployment_configs[env].env_vars[name] = { type: v.type, value: v.value };
+            }
+        }
+        return ok(publicProject(p));
+    }),
+], () => failure(404, 7003, "No route for the URI"));
+/** Why a PATCH body is refused, or undefined. Only what the schema says about `env_vars` entries is checked. */
+function patchProblem(body) {
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return "request body must be a JSON object";
+    const configs = body.deployment_configs;
+    if (configs === undefined)
+        return undefined;
+    if (configs === null || typeof configs !== "object")
+        return "deployment_configs must be an object";
+    for (const env of Object.keys(configs)) {
+        if (!ENVS.includes(env))
+            return `unknown deployment config ${env}`;
+        const problem = envVarsProblem(env, configs[env]?.env_vars);
+        if (problem)
+            return problem;
+    }
+    return undefined;
+}
+/** Why one `env_vars` map of a PATCH body is refused, or undefined. */
+function envVarsProblem(env, vars) {
+    if (vars === undefined || vars === null)
+        return undefined;
+    if (typeof vars !== "object" || Array.isArray(vars))
+        return `deployment_configs.${env}.env_vars must be an object`;
+    for (const [name, v] of Object.entries(vars)) {
+        if (name === "")
+            return "environment variable names must not be empty";
+        if (v === null)
+            continue;
+        const e = v;
+        if ((e.type !== "plain_text" && e.type !== "secret_text") || typeof e.value !== "string")
+            return `deployment_configs.${env}.env_vars.${name} must be { type: plain_text | secret_text, value: string }`;
+    }
+    return undefined;
+}
+function ok(result) {
+    return new Reply(200, { success: true, errors: [], messages: [], result });
+}
+function failure(status, code, message) {
+    return new Reply(status, { success: false, errors: [{ code, message }], messages: [], result: null });
+}
+/** CF6: what Wrangler reports for an unknown project. */
+function notFound() {
+    return failure(404, 8000007, "Project not found. The specified project name does not match any of your existing projects.");
+}
+function project(core, name, seed) {
+    const vars = (s) => Object.fromEntries(Object.entries(s ?? {}).map(([k, v]) => [k, typeof v === "string" ? { type: "plain_text", value: v } : { type: v.type ?? "plain_text", value: v.value }]));
+    return {
+        id: core.nextId("cf_"),
+        name,
+        subdomain: `${name}.pages.dev`,
+        createdBy: "sim",
+        deployment_configs: { preview: { env_vars: vars(seed.preview) }, production: { env_vars: vars(seed.production) } },
+    };
+}
+/** The project as GET answers it: CF3, a secret's value is never returned. */
+function publicProject(p) {
+    const config = (env) => ({
+        env_vars: Object.fromEntries(Object.entries(p.deployment_configs[env].env_vars).map(([k, v]) => [k, v.type === "secret_text" ? { type: v.type, value: "" } : { ...v }])),
+    });
+    return { id: p.id, name: p.name, subdomain: p.subdomain, production_branch: "main", deployment_configs: { preview: config("preview"), production: config("production") } };
+}
+//# sourceMappingURL=cloudflare.js.map

package/dist/routes/cloudflare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../src/routes/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAkD,MAAM,gBAAgB,CAAC;AAkCtG,MAAM,IAAI,GAAkC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AAEtE,0HAA0H;AAC1H,MAAM,CAAC,MAAM,aAAa,GAAiD;IACzE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,SAAS,EAAE,gBAAgB,EAAE;IAC9F,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE;IAErD,KAAK,CAAC,IAAI,EAAE,IAAI;QACd,MAAM,QAAQ,GAAgC,EAAE,CAAC;QACjD,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YACvE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACpH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;QAC5C,MAAM,CAAC,GAAG,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAuB,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC9I,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,qBAAqB,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5G,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YAChD,IAAI,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;iBACrC,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzG,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;;gBAC5G,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,YAAY,EAAE,KAAK,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG;QACrB,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC;CACF,CAAC;AAEF,MAAM,OAAO,GAAG,4CAA4C,CAAC;AAE7D,MAAM,MAAM,GAAG,MAAM,CACnB;IACE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1C,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC,CAAC;IAEF,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;QAClD,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC;YAAE,OAAO,QAAQ,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,OAAO,GAAI,IAA+G,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC1J,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,gEAAgE;YAChE,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrE,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;;oBAC3D,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YACnF,CAAC;QACH,CAAC;QACD,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC;CACH,EACD,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,sBAAsB,CAAC,CACjD,CAAC;AAEF,gHAAgH;AAChH,SAAS,YAAY,CAAC,IAAa;IACjC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,oCAAoC,CAAC;IAClH,MAAM,OAAO,GAAI,IAAgC,CAAC,kBAAkB,CAAC;IACrE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,sCAAsC,CAAC;IACnG,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CAAE,IAA0B,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,6BAA6B,GAAG,EAAE,CAAC;QAC1F,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAG,OAAkD,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxG,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uEAAuE;AACvE,SAAS,cAAc,CAAC,GAAW,EAAE,IAAa;IAChD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,sBAAsB,GAAG,6BAA6B,CAAC;IACnH,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;QACxE,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,8CAA8C,CAAC;QACvE,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QACzB,MAAM,CAAC,GAAG,CAA8B,CAAC;QACzC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,sBAAsB,GAAG,aAAa,IAAI,4DAA4D,CAAC;IAC1M,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,EAAE,CAAC,MAAe;IACzB,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;IAC5D,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACxG,CAAC;AAED,yDAAyD;AACzD,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,6FAA6F,CAAC,CAAC;AAC9H,CAAC;AAED,SAAS,OAAO,CAAC,IAAa,EAAE,IAAY,EAAE,IAAuE;IACnH,MAAM,IAAI,GAAG,CAAC,CAAiC,EAAoC,EAAE,CACnF,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAChL,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QACtB,IAAI;QACJ,SAAS,EAAE,GAAG,IAAI,YAAY;QAC9B,SAAS,EAAE,KAAK;QAChB,kBAAkB,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE;KACnH,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,CAAyB;IAC9C,MAAM,MAAM,GAAG,CAAC,GAAuB,EAAE,EAAE,CAAC,CAAC;QAC3C,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;KACzK,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;AAC7K,CAAC"}

package/dist/routes/digitalocean.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Simulated DigitalOcean App Platform: apps built from an app spec, each create and update starting a deployment.
+ *
+ * Assumptions about the real API this fake encodes, checked against the official OpenAPI document
+ * (https://github.com/digitalocean/openapi, `specification/resources/apps`) and the docs unless marked unverified.
+ * The critical ones are pinned in scenarios/contract.test.ts (`assumption DO…`).
+ *   DO1. The API is `https://api.digitalocean.com`, authenticated as `Authorization: Bearer <token>` (scopes
+ *        app:create/read/update/delete); doctl reads the token from `DIGITALOCEAN_ACCESS_TOKEN`. (verified:
+ *        https://docs.digitalocean.com/reference/api/digitalocean/, doctl README)
+ *   DO2. `POST /v2/apps` with `{ spec }` creates an app and answers `{ app: { id, spec, pending_deployment, … } }`;
+ *        `GET /v2/apps/{id}` answers `{ app }` (404 when gone); `GET /v2/apps?page=&per_page=` lists
+ *        `{ apps, links: { pages: { next } }, meta }`, with no name filter. (verified: apps_create.yml, apps_get.yml,
+ *        apps_list.yml)
+ *   DO3. An app's `spec.name` is unique in the account (`^[a-z][a-z0-9-]{0,30}[a-z0-9]$`); the status of a
+ *        duplicate create is not documented (unverified: the sim answers 409). (verified: app_spec.yml)
+ *   DO4. `PUT /v2/apps/{id}` with `{ spec }` replaces the whole spec and starts a deployment. (verified:
+ *        apps_update.yml; "starts a deployment" inferred from `pending_deployment` being set for UpdateApp)
+ *   DO5. `pending_deployment` names the deployment a create or update started; `GET
+ *        /v2/apps/{app_id}/deployments/{deployment_id}` answers `{ deployment: { id, phase } }`, the phase one of
+ *        PENDING_BUILD, BUILDING, PENDING_DEPLOY, DEPLOYING, ACTIVE, SUPERSEDED, ERROR, CANCELED. (verified:
+ *        app.yml, apps_get_deployment.yml, apps_deployment_response.yml, apps_deployment_phase.yml)
+ *   DO6. The platform adds defaults to the spec it stores (a region, instance counts); it keeps every field the
+ *        client sent, lists in the order sent. (unverified: the sim adds `region` and `instance_count`)
+ *   DO7. A `type: SECRET` variable's value is encrypted on first submission and read back as `EV[…]`.
+ *        (verified: app_variable_definition.yml, "encrypted on first submission"; the read-back form unverified)
+ *   DO8. `DELETE /v2/apps/{id}` deletes the app and its deployments (200 `{ id }`; 404 when gone). (verified:
+ *        apps_delete.yml)
+ */
+import { type CreatedBy, type ProviderSim } from "../provider.js";
+/** An app as the simulated App Platform stores it. */
+export interface DigitaloceanApp {
+    id: string;
+    spec: Record<string, unknown>;
+    liveUrl: string | null;
+    /** Deployments by id: phase, and polls left before the next phase. */
+    deployments: Record<string, {
+        phase: string;
+        polls: number;
+    }>;
+    pending: string | null;
+    createdBy: CreatedBy;
+}
+/** The simulated App Platform's state. */
+export interface DigitaloceanState {
+    apps: DigitaloceanApp[];
+    /** Polls a deployment answers BUILDING before it is ACTIVE (default 1); `fail` ends it ERROR instead. */
+    deployPolls: number;
+    failDeployments: boolean;
+}
+/** What a scenario or test seeds the simulated App Platform with (`seed: { digitalocean: … }`). */
+export interface DigitaloceanSeed {
+    /** Apps that exist already (unmanaged), by spec. */
+    apps?: Array<Record<string, unknown>>;
+    deployPolls?: number;
+    failDeployments?: boolean;
+}
+/** The simulated App Platform API, registered in `PROVIDERS` (packages/sim/src/state.ts) and served under `/digitalocean`. */
+export declare const digitaloceanSim: ProviderSim<DigitaloceanState, DigitaloceanSeed>;