@swimmingliu/autovpn 1.4.0

package/dist/pipeline/deploy.js

@@ -0,0 +1,1103 @@
+import path from 'node:path';
+import { spawn as defaultSpawn } from 'node:child_process';
+import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { mergeProjectEnv } from '../runtime/env.js';
+const PYTHON_DEPLOY_HELPER = `
+import json
+import sys
+from pathlib import Path
+from vpn_automation.config.models import DeployConfig
+from vpn_automation.config.runtime import load_runtime_env
+from vpn_automation.integrations.cloudflare import deploy_pages_bundle, resolve_cloudflare_credentials
+
+payload = json.load(sys.stdin)
+deploy = DeployConfig(**payload["deploy"])
+runtime_env = load_runtime_env(Path(payload["project_root"]))
+credentials = resolve_cloudflare_credentials(deploy, runtime_env)
+result = deploy_pages_bundle(Path(payload["bundle_dir"]), deploy, credentials)
+json.dump(result, sys.stdout, ensure_ascii=False)
+sys.stdout.write("\\n")
+`;
+const PYTHON_VERIFY_HELPER = `
+import json
+import sys
+from pathlib import Path
+from vpn_automation.config.models import DeployConfig
+from vpn_automation.config.runtime import load_runtime_env
+from vpn_automation.integrations.cloudflare import resolve_cloudflare_credentials
+from vpn_automation.backend_resume import (
+    _cleanup_blocked_pages_project,
+    _default_verify,
+    _is_verify_success,
+    _merge_deploy_verification_target,
+)
+
+payload = json.load(sys.stdin)
+deploy = DeployConfig(**payload["deploy"])
+deployment = payload.get("deployment", {})
+runtime_env = load_runtime_env(Path(payload["project_root"]))
+credentials = resolve_cloudflare_credentials(deploy, runtime_env)
+target = _merge_deploy_verification_target(deploy, deployment)
+verification = _default_verify(target, credentials)
+result = dict(verification)
+if _is_verify_success(verification):
+    result.update(_cleanup_blocked_pages_project(target, deployment, credentials))
+json.dump(result, sys.stdout, ensure_ascii=False)
+sys.stdout.write("\\n")
+`;
+const PAGES_PRODUCTION_BRANCH = 'main';
+const FALLBACK_SUFFIX_PATTERN = /^(?<prefix>.+)-(?<suffix>\d+)$/;
+const CLOUDFLARE_API_BASE_URL = 'https://api.cloudflare.com/client/v4';
+const NETWORK_ERROR_MARKERS = [
+    'fetch failed',
+    'connectivity issue',
+    'und_err_socket',
+    'other side closed',
+    'econnreset',
+    'etimedout'
+];
+const BLOCKED_PAGES_MARKERS = [
+    '8000119',
+    'your pages project has been blocked',
+    'pages project has been blocked',
+    'contact abusereply@cloudflare.com'
+];
+const PAGES_SECRET_ENV_PREFIX = 'VPN_AUTOMATION_PAGES_SECRET_';
+function clean(value) {
+    return value ? String(value).trim() : '';
+}
+function nonNegativeInt(value) {
+    const normalized = clean(value);
+    if (!/^[+-]?\d+$/.test(normalized)) {
+        return 0;
+    }
+    const parsed = Number(normalized);
+    return Number.isFinite(parsed) ? Math.max(0, Math.trunc(parsed)) : 0;
+}
+function getString(source, key) {
+    return clean(source[key]);
+}
+export function buildPagesDeployCommand(bundleDir, projectName) {
+    return ['npx', 'wrangler', 'pages', 'deploy', bundleDir, '--project-name', projectName, '--branch', PAGES_PRODUCTION_BRANCH];
+}
+export function derivePagesProjectUrl(projectName) {
+    return `https://${projectName}.pages.dev`;
+}
+export function buildSecretUrl(deploy) {
+    return `${getString(deploy, 'pages_project_url').replace(/\/+$/g, '')}/?${getString(deploy, 'secret_query')}`;
+}
+export function buildPagesProjectRootUrl(deploy) {
+    return getString(deploy, 'pages_project_url').replace(/\/+$/g, '');
+}
+export function buildCustomDomainRootUrl(deploy) {
+    const customDomain = getString(deploy, 'custom_domain').replace(/\/+$/g, '');
+    return customDomain ? `https://${customDomain}` : '';
+}
+export function rewriteUrlHost(url, hostname) {
+    try {
+        const parsed = new URL(clean(url));
+        if (!parsed.protocol || !parsed.host) {
+            return '';
+        }
+        return `${parsed.protocol}//${hostname}${parsed.pathname}${parsed.search}${parsed.hash}`;
+    }
+    catch {
+        return '';
+    }
+}
+export function buildCustomDomainSubscriptionUrl(deploy) {
+    const customDomain = getString(deploy, 'custom_domain');
+    if (!customDomain) {
+        return '';
+    }
+    const verifyUrl = getString(deploy, 'verify_subscription_url');
+    if (verifyUrl) {
+        return rewriteUrlHost(verifyUrl, customDomain) || verifyUrl;
+    }
+    const subscriptionUrl = getString(deploy, 'subscription_url');
+    return subscriptionUrl ? rewriteUrlHost(subscriptionUrl, customDomain) : '';
+}
+export function resolveVerifySubscriptionUrl(deploy) {
+    const verifySubscriptionUrl = getString(deploy, 'verify_subscription_url');
+    return verifySubscriptionUrl || getString(deploy, 'subscription_url');
+}
+export function resolveCustomDomainVerifySubscriptionUrl(deploy) {
+    return buildCustomDomainSubscriptionUrl(deploy).trim();
+}
+function pagesHostnameFromUrl(url) {
+    try {
+        return new URL(clean(url)).host.trim();
+    }
+    catch {
+        return '';
+    }
+}
+export function deriveCustomDomainDnsTarget(deploy) {
+    return pagesHostnameFromUrl(buildPagesProjectRootUrl(deploy));
+}
+function splitProjectSuffix(projectName, expectedPrefix = '') {
+    const normalized = clean(projectName);
+    if (!normalized) {
+        return { prefix: '', suffix: 0 };
+    }
+    const match = FALLBACK_SUFFIX_PATTERN.exec(normalized);
+    if (!match?.groups) {
+        return { prefix: normalized, suffix: 0 };
+    }
+    const prefix = match.groups.prefix;
+    const suffix = Number.parseInt(match.groups.suffix, 10);
+    if (expectedPrefix && prefix !== expectedPrefix) {
+        return { prefix: normalized, suffix: 0 };
+    }
+    return { prefix, suffix };
+}
+export function deriveFallbackProjectBaseName(configuredPrefix, currentProjectName) {
+    const explicit = clean(configuredPrefix);
+    if (explicit) {
+        return explicit;
+    }
+    const { prefix, suffix } = splitProjectSuffix(currentProjectName);
+    return prefix && suffix > 0 ? prefix : clean(currentProjectName);
+}
+export function generateFallbackProjectName(baseName, existingNames, options = {}) {
+    const normalized = clean(baseName);
+    if (!normalized) {
+        throw new Error('Fallback project base name is empty');
+    }
+    const existing = new Set(existingNames);
+    const current = splitProjectSuffix(options.currentProjectName ?? '', normalized);
+    const currentSuffix = current.prefix === normalized ? current.suffix : 0;
+    let maxExistingSuffix = 0;
+    for (const existingName of existing) {
+        const existing = splitProjectSuffix(existingName, normalized);
+        if (existing.prefix === normalized) {
+            maxExistingSuffix = Math.max(maxExistingSuffix, existing.suffix);
+        }
+    }
+    let nextSuffix = Math.max(currentSuffix, maxExistingSuffix, nonNegativeInt(options.lastUsedSuffix)) + 1;
+    while (true) {
+        const width = Math.max(2, String(nextSuffix).length);
+        const candidate = `${normalized}-${String(nextSuffix).padStart(width, '0')}`;
+        if (!existing.has(candidate)) {
+            return { projectName: candidate, suffix: nextSuffix };
+        }
+        nextSuffix += 1;
+    }
+}
+export function resolveLatestExistingProjectName(baseName, existingNames) {
+    const normalized = clean(baseName);
+    if (!normalized) {
+        return '';
+    }
+    const existing = new Set(existingNames);
+    if (existing.has(normalized)) {
+        return normalized;
+    }
+    let latestName = '';
+    let latestSuffix = 0;
+    for (const existingName of existing) {
+        const suffix = splitProjectSuffix(existingName, normalized);
+        if (suffix.prefix === normalized && suffix.suffix > latestSuffix) {
+            latestName = existingName;
+            latestSuffix = suffix.suffix;
+        }
+    }
+    return latestName;
+}
+export function resolveCloudflareCredentials(deploy, runtimeEnv, options = {}) {
+    const authMode = getString(deploy, 'cloudflare_auth_mode') || 'api_token';
+    const accountId = getString(deploy, 'account_id') || clean(runtimeEnv.CLOUDFLARE_ACCOUNT_ID);
+    if (authMode === 'global_key') {
+        const email = getString(deploy, 'cloudflare_email') || clean(runtimeEnv.CLOUDFLARE_EMAIL);
+        const globalApiKey = getString(deploy, 'cloudflare_global_key') || clean(runtimeEnv.CLOUDFLARE_API_KEY);
+        if (!email || !globalApiKey) {
+            throw new Error('Cloudflare global key credentials are incomplete');
+        }
+        return { auth_mode: 'global_key', api_token: '', account_id: accountId, email, global_api_key: globalApiKey };
+    }
+    const apiToken = getString(deploy, 'cloudflare_api_token') || clean(options.explicitApiToken) || clean(runtimeEnv.CLOUDFLARE_API_TOKEN);
+    if (!apiToken) {
+        throw new Error('Cloudflare API token is missing');
+    }
+    return { auth_mode: 'api_token', api_token: apiToken, account_id: accountId, email: '', global_api_key: '' };
+}
+export function buildWranglerAuthEnv(credentials) {
+    const env = { CI: '1' };
+    if (credentials.account_id) {
+        env.CLOUDFLARE_ACCOUNT_ID = credentials.account_id;
+    }
+    if (credentials.auth_mode === 'global_key') {
+        env.CLOUDFLARE_API_KEY = credentials.global_api_key;
+        env.CLOUDFLARE_EMAIL = credentials.email;
+    }
+    else {
+        env.CLOUDFLARE_API_TOKEN = credentials.api_token;
+    }
+    return env;
+}
+function buildProxyEnv(proxyUrl) {
+    return {
+        HTTP_PROXY: proxyUrl,
+        HTTPS_PROXY: proxyUrl,
+        ALL_PROXY: proxyUrl
+    };
+}
+function isTransientDeployFailure(stdout, stderr) {
+    const combined = `${stdout}\n${stderr}`.toLowerCase();
+    return NETWORK_ERROR_MARKERS.some((marker) => combined.includes(marker));
+}
+export function isBlockedPagesError(stdout, stderr = '') {
+    const combined = `${stdout}\n${stderr}`.toLowerCase();
+    return BLOCKED_PAGES_MARKERS.some((marker) => combined.includes(marker));
+}
+function resolveDeployProxyUrl(env) {
+    for (const key of [
+        'VPN_AUTOMATION_DEPLOY_PROXY',
+        'VPN_AUTOMATION_CLOUDFLARE_PROXY',
+        'VPN_AUTOMATION_UPSTREAM_PROXY',
+        'HTTPS_PROXY',
+        'https_proxy',
+        'HTTP_PROXY',
+        'http_proxy',
+        'ALL_PROXY',
+        'all_proxy'
+    ]) {
+        const value = clean(env[key]);
+        if (!value) {
+            continue;
+        }
+        if (['off', 'none', 'false', '0'].includes(value.toLowerCase())) {
+            return '';
+        }
+        return value;
+    }
+    return '';
+}
+function resolvePagesSecretValue(secretName, runtimeEnv) {
+    const configuredDefault = secretName === 'ADMIN'
+        ? clean(runtimeEnv.VPN_AUTOMATION_DEFAULT_PAGES_SECRET_ADMIN) || 'swimmingliu'
+        : '';
+    for (const key of [`${PAGES_SECRET_ENV_PREFIX}${secretName}`, secretName]) {
+        const value = clean(runtimeEnv[key]) || clean(process.env[key]);
+        if (value) {
+            return value;
+        }
+    }
+    if (configuredDefault) {
+        return configuredDefault;
+    }
+    throw new Error(`Missing Pages secret value for ${secretName}; set ${PAGES_SECRET_ENV_PREFIX}${secretName} or ${secretName}`);
+}
+function cloneEnvVars(envVars, runtimeEnv) {
+    const cloned = {};
+    for (const [name, payload] of Object.entries(envVars)) {
+        const valueType = clean(payload.type) || 'plain_text';
+        if (valueType === 'secret_text') {
+            cloned[name] = { type: 'secret_text', value: resolvePagesSecretValue(name, runtimeEnv) };
+            continue;
+        }
+        cloned[name] = { type: valueType, value: payload.value ?? '' };
+    }
+    return cloned;
+}
+function cloneDeploymentConfig(config, runtimeEnv) {
+    const cloned = {};
+    if (config.env_vars && typeof config.env_vars === 'object') {
+        cloned.env_vars = cloneEnvVars(config.env_vars, runtimeEnv);
+    }
+    if (config.kv_namespaces) {
+        cloned.kv_namespaces = config.kv_namespaces;
+    }
+    for (const key of [
+        'compatibility_date',
+        'compatibility_flags',
+        'build_image_major_version',
+        'usage_model',
+        'fail_open',
+        'always_use_latest_compatibility_date'
+    ]) {
+        if (Object.prototype.hasOwnProperty.call(config, key)) {
+            cloned[key] = config[key];
+        }
+    }
+    return cloned;
+}
+function cloneProjectDeploymentConfigs(projectPayload, runtimeEnv) {
+    const deploymentConfigs = projectPayload.deployment_configs;
+    if (!deploymentConfigs || typeof deploymentConfigs !== 'object') {
+        return {};
+    }
+    const cloned = {};
+    for (const [environmentName, config] of Object.entries(deploymentConfigs)) {
+        cloned[environmentName] = cloneDeploymentConfig(config, runtimeEnv);
+    }
+    return cloned;
+}
+function rewriteShareProjectSubValue(deploymentConfigs, options) {
+    const rewritten = {};
+    for (const [environmentName, config] of Object.entries(deploymentConfigs)) {
+        rewritten[environmentName] = { ...config };
+    }
+    for (const environmentName of ['preview', 'production']) {
+        const envConfig = { ...(rewritten[environmentName] ?? {}) };
+        const envVars = { ...(envConfig.env_vars ?? {}) };
+        envVars[options.envKey] = { type: 'plain_text', value: options.subValue };
+        envConfig.env_vars = envVars;
+        rewritten[environmentName] = envConfig;
+    }
+    return rewritten;
+}
+function buildShareProjectUpdatePayload(sourceProject, runtimeEnv, options) {
+    const clonedConfigs = cloneProjectDeploymentConfigs(sourceProject, runtimeEnv);
+    return {
+        deployment_configs: rewriteShareProjectSubValue(clonedConfigs, options)
+    };
+}
+async function fileExists(candidate) {
+    try {
+        await access(candidate);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function expandHomePath(candidate) {
+    if (candidate === '~') {
+        return process.env.HOME || candidate;
+    }
+    if (candidate.startsWith('~/')) {
+        return process.env.HOME ? path.join(process.env.HOME, candidate.slice(2)) : candidate;
+    }
+    return candidate;
+}
+async function resolveShareProjectWorkerSourcePath(projectRoot, env) {
+    const candidates = [
+        clean(env.VPN_AUTOMATION_SHARE_WORKER_PATH),
+        path.join(projectRoot, 'electron', 'runtime', 'share-worker', 'vpn.js'),
+        path.join(projectRoot, 'templates', 'share-worker', 'vpn.js'),
+        path.join(path.dirname(projectRoot), 'cloudflarevpn', 'edgetunnel', 'vpn.js')
+    ].filter(Boolean).map((candidate) => path.resolve(expandHomePath(candidate)));
+    const seen = new Set();
+    const uniqueCandidates = candidates.filter((candidate) => {
+        if (seen.has(candidate)) {
+            return false;
+        }
+        seen.add(candidate);
+        return true;
+    });
+    for (const candidate of uniqueCandidates) {
+        if (await fileExists(candidate)) {
+            return candidate;
+        }
+    }
+    throw new Error(`share worker source not found; tried: ${uniqueCandidates.join(', ')}`);
+}
+function buildShareProjectBundleDir(projectRoot) {
+    return path.join(projectRoot, 'electron', 'runtime', 'share-worker', 'share_pages_bundle');
+}
+async function stageShareProjectWorkerBundle(projectRoot, env) {
+    const sourcePath = await resolveShareProjectWorkerSourcePath(projectRoot, env);
+    const bundleDir = buildShareProjectBundleDir(projectRoot);
+    const workerEntry = path.join(bundleDir, '_worker.js');
+    await mkdir(bundleDir, { recursive: true });
+    await writeFile(workerEntry, await readFile(sourcePath, 'utf8'), 'utf8');
+    return { sourcePath, bundleDir, workerEntry };
+}
+function runCommandWithSpawn(command, options, spawnImpl = defaultSpawn) {
+    const [executable, ...args] = command;
+    const child = spawnImpl(executable, args, {
+        cwd: options.cwd,
+        env: { ...process.env, ...options.env },
+        stdio: ['ignore', 'pipe', 'pipe']
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout?.on('data', (chunk) => {
+        stdout += String(chunk);
+    });
+    child.stderr?.on('data', (chunk) => {
+        stderr += String(chunk);
+    });
+    return new Promise((resolve, reject) => {
+        child.on('error', reject);
+        child.on('close', (exitCode) => {
+            resolve({ returncode: exitCode ?? 1, stdout, stderr });
+        });
+    });
+}
+async function runPagesDeployAttempts(command, baseEnv, proxyUrl, options) {
+    const attempts = [
+        { mode: 'direct', env: baseEnv },
+        { mode: 'direct-retry', env: baseEnv }
+    ];
+    if (proxyUrl) {
+        attempts.push({ mode: 'proxy', env: { ...baseEnv, ...buildProxyEnv(proxyUrl) } });
+    }
+    let result;
+    const attemptLog = [];
+    for (let index = 0; index < attempts.length; index += 1) {
+        const attempt = attempts[index];
+        result = await options.runCommand(command, { cwd: options.cwd, env: attempt.env });
+        attemptLog.push({ mode: attempt.mode, returncode: result.returncode });
+        if (result.returncode === 0) {
+            break;
+        }
+        if (!isTransientDeployFailure(result.stdout, result.stderr)) {
+            break;
+        }
+        if (index === attempts.length - 1) {
+            break;
+        }
+    }
+    if (!result) {
+        throw new Error('Wrangler deploy did not run');
+    }
+    return { result, attempts: attemptLog };
+}
+export function mergeDeployVerificationTarget(deploy, deployment) {
+    const merged = { ...deploy };
+    for (const key of ['project_name', 'pages_project_url', 'custom_domain']) {
+        if (Object.prototype.hasOwnProperty.call(deployment, key)) {
+            merged[key] = deployment[key];
+        }
+    }
+    return merged;
+}
+export function resolveCleanupBlockedProjectCandidates(deploy, deployment) {
+    const finalProject = getString(deploy, 'project_name');
+    const cleanupCandidates = [];
+    for (const key of ['cleanup_blocked_project', 'share_project_cleanup_blocked_project']) {
+        const candidate = getString(deployment, key);
+        if (!candidate || candidate === finalProject || cleanupCandidates.includes(candidate)) {
+            continue;
+        }
+        cleanupCandidates.push(candidate);
+    }
+    return cleanupCandidates;
+}
+export function buildNoopCleanupBlockedProjectResult(deployment) {
+    return {
+        cleanup_deleted: false,
+        cleanup_errors: deployment.cleanup_errors ?? []
+    };
+}
+function normalizeHostname(value) {
+    return clean(value).replace(/\.+$/g, '').toLowerCase();
+}
+function cloudflareHeaders(credentials) {
+    const headers = { 'Content-Type': 'application/json' };
+    if (credentials.auth_mode === 'global_key') {
+        headers['X-Auth-Email'] = credentials.email;
+        headers['X-Auth-Key'] = credentials.global_api_key;
+        return headers;
+    }
+    headers.Authorization = `Bearer ${credentials.api_token}`;
+    return headers;
+}
+function responseBodyText(response) {
+    return response.text().catch(() => '');
+}
+export class CloudflareHttpClient {
+    accountId;
+    headers;
+    fetchImpl;
+    constructor(credentials, options = {}) {
+        this.accountId = credentials.account_id;
+        this.headers = cloudflareHeaders(credentials);
+        this.fetchImpl = options.fetch ?? fetch;
+    }
+    async apiRequest(pathname, options = {}) {
+        const response = await this.fetchImpl(`${CLOUDFLARE_API_BASE_URL}${pathname}`, {
+            ...options,
+            headers: { ...this.headers, ...options.headers },
+            signal: options.signal ?? AbortSignal.timeout(20_000)
+        });
+        if (!response.ok) {
+            const body = await responseBodyText(response);
+            throw new Error(`Cloudflare API request failed (${response.status}): ${body || response.statusText}`);
+        }
+        return response.json();
+    }
+    async apiResult(pathname, options = {}) {
+        const payload = await this.apiRequest(pathname, options);
+        if (payload && typeof payload === 'object' && 'result' in payload) {
+            return payload.result;
+        }
+        return payload;
+    }
+    async listAccounts() {
+        return (await this.apiResult('/accounts'));
+    }
+    async listPagesProjects() {
+        const accountId = await this.resolveAccountId();
+        return (await this.apiResult(`/accounts/${accountId}/pages/projects`));
+    }
+    async getPagesProject(projectName) {
+        const accountId = await this.resolveAccountId();
+        return (await this.apiResult(`/accounts/${accountId}/pages/projects/${projectName}`));
+    }
+    async createPagesProject(projectName) {
+        const accountId = await this.resolveAccountId();
+        return this.apiResult(`/accounts/${accountId}/pages/projects`, {
+            method: 'POST',
+            body: JSON.stringify({ name: projectName, production_branch: PAGES_PRODUCTION_BRANCH })
+        });
+    }
+    async updatePagesProject(projectName, payload) {
+        const accountId = await this.resolveAccountId();
+        return this.apiResult(`/accounts/${accountId}/pages/projects/${projectName}`, {
+            method: 'PATCH',
+            body: JSON.stringify(payload)
+        });
+    }
+    async copyPagesProjectConfig(sourceProjectName, targetProjectName, runtimeEnv) {
+        const sourceProject = await this.getPagesProject(sourceProjectName);
+        return this.updatePagesProject(targetProjectName, {
+            deployment_configs: cloneProjectDeploymentConfigs(sourceProject, runtimeEnv)
+        });
+    }
+    async listPagesDomains(projectName) {
+        const accountId = await this.resolveAccountId();
+        return (await this.apiResult(`/accounts/${accountId}/pages/projects/${projectName}/domains`));
+    }
+    async attachCustomDomain(projectName, domain) {
+        const accountId = await this.resolveAccountId();
+        return this.apiResult(`/accounts/${accountId}/pages/projects/${projectName}/domains`, {
+            method: 'POST',
+            body: JSON.stringify({ name: domain })
+        });
+    }
+    async detachCustomDomain(projectName, domain) {
+        const accountId = await this.resolveAccountId();
+        return this.apiRequest(`/accounts/${accountId}/pages/projects/${projectName}/domains/${encodeURIComponent(domain)}`, {
+            method: 'DELETE'
+        });
+    }
+    async resolveAccountId() {
+        if (this.accountId) {
+            return this.accountId;
+        }
+        const accounts = await this.listAccounts();
+        if (!accounts.length) {
+            throw new Error('No Cloudflare account available for the supplied credentials');
+        }
+        this.accountId = clean(accounts[0].id);
+        return this.accountId;
+    }
+    async listZones(name = '') {
+        const params = name ? `?name=${encodeURIComponent(name)}` : '';
+        return (await this.apiResult(`/zones${params}`));
+    }
+    async resolveZoneForHostname(hostname) {
+        const normalized = normalizeHostname(hostname);
+        const labels = normalized.split('.').filter(Boolean);
+        const startIndex = labels.length <= 2 ? 0 : 1;
+        for (let index = startIndex; index < labels.length - 1; index += 1) {
+            const candidate = labels.slice(index).join('.');
+            if (!candidate.includes('.')) {
+                continue;
+            }
+            const zones = await this.listZones(candidate);
+            for (const zone of zones) {
+                if (clean(zone.name).toLowerCase() === candidate) {
+                    return zone;
+                }
+            }
+        }
+        throw new Error(`Cloudflare zone not found for hostname: ${hostname}`);
+    }
+    async listDnsRecords(zoneId, hostname) {
+        return (await this.apiResult(`/zones/${zoneId}/dns_records?name=${encodeURIComponent(hostname)}`));
+    }
+    async upsertSubdomainCname(hostname, target, proxied = true) {
+        const normalizedHost = normalizeHostname(hostname);
+        const normalizedTarget = normalizeHostname(target);
+        const zone = await this.resolveZoneForHostname(normalizedHost);
+        const zoneId = clean(zone.id);
+        const zoneName = normalizeHostname(clean(zone.name));
+        if (normalizedHost === zoneName) {
+            throw new Error('Apex custom domains require a different DNS strategy than CNAME');
+        }
+        const records = await this.listDnsRecords(zoneId, normalizedHost);
+        const conflicting = records.filter((record) => clean(record.type).toUpperCase() !== 'CNAME');
+        if (conflicting.length) {
+            throw new Error(`Conflicting non-CNAME DNS records exist for ${normalizedHost}`);
+        }
+        const cnameRecords = records.filter((record) => clean(record.type).toUpperCase() === 'CNAME');
+        const payload = {
+            type: 'CNAME',
+            name: normalizedHost,
+            content: normalizedTarget,
+            proxied
+        };
+        if (!cnameRecords.length) {
+            return this.apiResult(`/zones/${zoneId}/dns_records`, {
+                method: 'POST',
+                body: JSON.stringify(payload)
+            });
+        }
+        if (cnameRecords.length > 1) {
+            throw new Error(`Multiple CNAME records exist for ${normalizedHost}`);
+        }
+        const current = cnameRecords[0];
+        if (normalizeHostname(clean(current.content)) === normalizedTarget
+            && Boolean(current.proxied) === proxied) {
+            return current;
+        }
+        return this.apiResult(`/zones/${zoneId}/dns_records/${clean(current.id)}`, {
+            method: 'PATCH',
+            body: JSON.stringify(payload)
+        });
+    }
+    async verifySubdomainCname(hostname, target) {
+        const normalizedHost = normalizeHostname(hostname);
+        const normalizedTarget = normalizeHostname(target);
+        const zone = await this.resolveZoneForHostname(normalizedHost);
+        const records = await this.listDnsRecords(clean(zone.id), normalizedHost);
+        return records.some((record) => (clean(record.type).toUpperCase() === 'CNAME'
+            && normalizeHostname(clean(record.name)) === normalizedHost
+            && normalizeHostname(clean(record.content)) === normalizedTarget));
+    }
+    async deletePagesProject(projectName) {
+        const accountId = await this.resolveAccountId();
+        return this.apiRequest(`/accounts/${accountId}/pages/projects/${projectName}`, { method: 'DELETE' });
+    }
+    async verifyUrl(url, expectedFragment = '') {
+        const response = await this.fetchImpl(url, {
+            method: 'GET',
+            signal: AbortSignal.timeout(30_000)
+        });
+        if (!response.ok) {
+            const body = await responseBodyText(response);
+            throw new Error(`URL verification failed (${response.status}): ${body || response.statusText}`);
+        }
+        if (!expectedFragment) {
+            return true;
+        }
+        return (await response.text()).includes(expectedFragment);
+    }
+}
+export async function defaultVerifyDeployment(deploy, client) {
+    const pagesDomainUrl = buildPagesProjectRootUrl(deploy);
+    const pagesDomainOk = pagesDomainUrl ? await client.verifyUrl(pagesDomainUrl) : false;
+    const secretOk = await client.verifyUrl(buildSecretUrl(deploy));
+    const subscriptionOk = await client.verifyUrl(resolveVerifySubscriptionUrl(deploy));
+    const customDomainUrl = buildCustomDomainRootUrl(deploy);
+    const customDomainOk = customDomainUrl ? await client.verifyUrl(customDomainUrl) : false;
+    const customDomainSubscriptionUrl = resolveCustomDomainVerifySubscriptionUrl(deploy);
+    const customDomainSubscriptionOk = customDomainSubscriptionUrl ? await client.verifyUrl(customDomainSubscriptionUrl) : false;
+    const customDomainDnsTarget = deriveCustomDomainDnsTarget(deploy);
+    const customDomainDnsOk = customDomainUrl && customDomainDnsTarget
+        ? await client.verifySubdomainCname(getString(deploy, 'custom_domain'), customDomainDnsTarget)
+        : false;
+    return {
+        pages_domain_ok: pagesDomainOk,
+        secret_ok: secretOk,
+        subscription_ok: subscriptionOk,
+        custom_domain_ok: customDomainOk,
+        custom_domain_subscription_ok: customDomainSubscriptionOk,
+        custom_domain_dns_ok: customDomainDnsOk
+    };
+}
+export async function cleanupBlockedPagesProjects(deploy, deployment, client) {
+    const candidates = resolveCleanupBlockedProjectCandidates(deploy, deployment);
+    if (!candidates.length) {
+        return buildNoopCleanupBlockedProjectResult(deployment);
+    }
+    let deletedAny = false;
+    const errors = [];
+    for (const blockedProject of candidates) {
+        try {
+            await client.deletePagesProject(blockedProject);
+            deletedAny = true;
+        }
+        catch (error) {
+            errors.push(error instanceof Error ? error.message : String(error));
+        }
+    }
+    return { cleanup_deleted: deletedAny, cleanup_errors: errors };
+}
+export function selectPipelineStageBackend(stage, env = process.env) {
+    const stageKey = `AUTOVPN_STAGE_BACKEND_${stage.toUpperCase()}`;
+    const stageOverride = String(env[stageKey] ?? '').trim().toLowerCase();
+    const pipelineOverride = String(env.AUTOVPN_PIPELINE_BACKEND ?? '').trim().toLowerCase();
+    const selected = stageOverride || pipelineOverride || 'node';
+    return selected === 'python' ? 'python' : 'node';
+}
+async function defaultResolvePythonCli(env) {
+    // @ts-expect-error Phase 1 runner remains plain ESM JavaScript.
+    const runner = await import('../../lib/runner.mjs');
+    return runner.resolveOrInstallPythonCli({ env });
+}
+function pythonCommandFor(resolved) {
+    const command = resolved.command;
+    const name = path.basename(command).toLowerCase();
+    if (['autovpn', 'autovpn.exe'].includes(name)) {
+        if (!path.isAbsolute(command)) {
+            throw new Error('Python deploy/verify fallback requires an absolute AUTOVPN_PYTHON_CLI path; PATH autovpn cannot identify its Python interpreter safely');
+        }
+        const executable = process.platform === 'win32' ? 'python.exe' : 'python';
+        return path.join(path.dirname(command), executable);
+    }
+    return process.platform === 'win32' ? 'python.exe' : 'python3';
+}
+async function runPythonJsonHelper(code, payload, options, stageName) {
+    const cwd = options.cwd ?? process.cwd();
+    const env = mergeProjectEnv(cwd, options.env ?? process.env);
+    const resolved = options.resolvePythonCli ? await options.resolvePythonCli() : await defaultResolvePythonCli(env);
+    const child = (options.spawn ?? defaultSpawn)(pythonCommandFor(resolved), ['-c', code], {
+        cwd,
+        env,
+        stdio: ['pipe', 'pipe', 'pipe']
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout?.on('data', (chunk) => {
+        stdout += String(chunk);
+    });
+    child.stderr?.on('data', (chunk) => {
+        stderr += String(chunk);
+    });
+    const completion = new Promise((resolve, reject) => {
+        child.on('error', reject);
+        child.on('close', (exitCode) => {
+            if (exitCode !== 0) {
+                reject(new Error(`Python ${stageName} backend failed with exit code ${exitCode}: ${stderr.trim()}`));
+                return;
+            }
+            try {
+                resolve(JSON.parse(stdout));
+            }
+            catch (error) {
+                reject(new Error(`Python ${stageName} backend returned invalid JSON: ${error instanceof Error ? error.message : String(error)}`));
+            }
+        });
+    });
+    child.stdin?.write(JSON.stringify(payload));
+    child.stdin?.end();
+    return completion;
+}
+function buildShareProjectNoopResult(deploy) {
+    return {
+        share_project_requested_name: getString(deploy, 'share_project_name'),
+        share_project_name: getString(deploy, 'share_project_name'),
+        share_project_fallback_used: false,
+        share_project_cleanup_blocked_project: '',
+        share_project_sub_value: '',
+        share_project_sync_ok: true,
+        share_project_sync_error: '',
+        share_project_fallback_candidate_names: [],
+        share_project_fallback_last_used_suffix: nonNegativeInt(deploy.share_project_fallback_last_used_suffix)
+    };
+}
+async function syncShareProjectSub(deploy, options) {
+    let requestedName = getString(deploy, 'share_project_name');
+    const envKey = getString(deploy, 'share_project_sub_env_key') || 'SUB';
+    const subValue = buildSecretUrl({
+        ...deploy,
+        pages_project_url: options.pagesProjectUrl,
+        secret_query: getString(deploy, 'secret_query') || 'serect_key=swimmingliu'
+    });
+    const shareAutoFallback = deploy.share_project_auto_fallback ?? true;
+    let shareLastUsedSuffix = nonNegativeInt(deploy.share_project_fallback_last_used_suffix);
+    const result = {
+        share_project_requested_name: requestedName,
+        share_project_name: requestedName,
+        share_project_fallback_used: false,
+        share_project_cleanup_blocked_project: '',
+        share_project_sub_value: requestedName ? subValue : '',
+        share_project_sync_ok: true,
+        share_project_sync_error: '',
+        share_project_fallback_candidate_names: [],
+        share_project_fallback_last_used_suffix: shareLastUsedSuffix
+    };
+    if (!requestedName) {
+        return result;
+    }
+    let sourceProject;
+    try {
+        sourceProject = await options.client.getPagesProject(requestedName);
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        if (!shareAutoFallback || !errorMessage.toLowerCase().includes('not found')) {
+            result.share_project_sync_ok = false;
+            result.share_project_sync_error = errorMessage;
+            return result;
+        }
+        const existingNames = new Set((await options.client.listPagesProjects()).map((project) => clean(project.name)).filter(Boolean));
+        const recoveredName = resolveLatestExistingProjectName(deriveFallbackProjectBaseName(getString(deploy, 'share_project_fallback_prefix'), requestedName), existingNames);
+        if (!recoveredName) {
+            result.share_project_sync_ok = false;
+            result.share_project_sync_error = errorMessage;
+            return result;
+        }
+        requestedName = recoveredName;
+        result.share_project_name = recoveredName;
+        sourceProject = await options.client.getPagesProject(requestedName);
+    }
+    const payload = buildShareProjectUpdatePayload(sourceProject, options.runtimeEnv, {
+        envKey,
+        subValue
+    });
+    const shareBundle = await stageShareProjectWorkerBundle(options.projectRoot, options.env);
+    result.share_project_source_path = shareBundle.sourcePath;
+    result.share_project_bundle_dir = shareBundle.bundleDir;
+    result.share_project_worker_entry = shareBundle.workerEntry;
+    const shareCustomDomains = typeof options.client.listPagesDomains === 'function'
+        ? (await options.client.listPagesDomains(requestedName)).map((item) => clean(item.name)).filter(Boolean)
+        : [];
+    const deployShareProject = async (projectName) => runPagesDeployAttempts(buildPagesDeployCommand(shareBundle.bundleDir, projectName), buildWranglerAuthEnv(options.credentials), resolveDeployProxyUrl(options.env), {
+        cwd: shareBundle.bundleDir,
+        runCommand: options.runCommand
+    });
+    const fallbackShareProject = async () => {
+        const existingNames = new Set((await options.client.listPagesProjects()).map((project) => clean(project.name)).filter(Boolean));
+        const fallbackBaseName = deriveFallbackProjectBaseName(getString(deploy, 'share_project_fallback_prefix'), requestedName);
+        const fallback = generateFallbackProjectName(fallbackBaseName, existingNames, {
+            currentProjectName: requestedName,
+            lastUsedSuffix: shareLastUsedSuffix
+        });
+        shareLastUsedSuffix = fallback.suffix;
+        result.share_project_fallback_candidate_names = [fallback.projectName];
+        await options.client.createPagesProject(fallback.projectName);
+        await options.client.copyPagesProjectConfig(requestedName, fallback.projectName, options.runtimeEnv);
+        await options.client.updatePagesProject(fallback.projectName, payload);
+        for (const domain of shareCustomDomains) {
+            await ensureCustomDomainBound(options.client, fallback.projectName, domain, { previousProjectName: requestedName });
+            await options.client.upsertSubdomainCname(domain, `${fallback.projectName}.pages.dev`, false);
+        }
+        const fallbackDeploy = await deployShareProject(fallback.projectName);
+        if (fallbackDeploy.result.returncode !== 0) {
+            result.share_project_sync_ok = false;
+            result.share_project_sync_error = fallbackDeploy.result.stderr || fallbackDeploy.result.stdout;
+            result.share_project_redeploy_attempts = fallbackDeploy.attempts;
+            return result;
+        }
+        result.share_project_name = fallback.projectName;
+        result.share_project_fallback_used = true;
+        result.share_project_cleanup_blocked_project = requestedName;
+        result.share_project_sync_ok = true;
+        result.share_project_sync_error = '';
+        result.share_project_fallback_last_used_suffix = shareLastUsedSuffix;
+        result.share_project_redeploy_attempts = fallbackDeploy.attempts;
+        return result;
+    };
+    try {
+        await options.client.updatePagesProject(requestedName, payload);
+        const redeploy = await deployShareProject(requestedName);
+        if (redeploy.result.returncode !== 0) {
+            if (shareAutoFallback && isBlockedPagesError(redeploy.result.stdout, redeploy.result.stderr)) {
+                return fallbackShareProject();
+            }
+            result.share_project_sync_ok = false;
+            result.share_project_sync_error = redeploy.result.stderr || redeploy.result.stdout;
+        }
+        result.share_project_redeploy_attempts = redeploy.attempts;
+        return result;
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        if (!shareAutoFallback || !isBlockedPagesError(errorMessage, '')) {
+            result.share_project_sync_ok = false;
+            result.share_project_sync_error = errorMessage;
+            return result;
+        }
+    }
+    return fallbackShareProject();
+}
+async function ensureCustomDomainBound(client, projectName, customDomain, options = {}) {
+    const normalizedDomain = clean(customDomain).toLowerCase();
+    if (!normalizedDomain) {
+        return;
+    }
+    const currentDomains = new Set((await client.listPagesDomains(projectName))
+        .map((item) => clean(item.name).toLowerCase())
+        .filter(Boolean));
+    if (currentDomains.has(normalizedDomain)) {
+        return;
+    }
+    try {
+        await client.attachCustomDomain(projectName, customDomain);
+    }
+    catch (error) {
+        const previousProjectName = clean(options.previousProjectName);
+        if (previousProjectName && previousProjectName !== projectName) {
+            await client.detachCustomDomain(previousProjectName, customDomain);
+            await client.attachCustomDomain(projectName, customDomain);
+            return;
+        }
+        throw error;
+    }
+}
+export async function deployPagesWithBackend(input, options = {}) {
+    if (selectPipelineStageBackend('deploy', options.env ?? process.env) !== 'python') {
+        const cwd = options.cwd ?? process.cwd();
+        const env = mergeProjectEnv(cwd, options.env ?? process.env);
+        const deploy = input.deploy;
+        const projectName = getString(deploy, 'project_name');
+        if (!projectName) {
+            throw new Error('Cloudflare Pages project name is missing');
+        }
+        const customDomain = getString(deploy, 'custom_domain');
+        const runtimeEnv = {
+            ...env,
+            VPN_AUTOMATION_DEFAULT_PAGES_SECRET_ADMIN: getString(deploy, 'pages_secret_admin') || 'swimmingliu'
+        };
+        const credentials = resolveCloudflareCredentials(deploy, runtimeEnv);
+        const command = buildPagesDeployCommand(input.bundleDir, projectName);
+        const baseEnv = buildWranglerAuthEnv(credentials);
+        const runCommand = options.runCommand ?? ((commandToRun, runOptions) => runCommandWithSpawn(commandToRun, runOptions, options.spawn));
+        const proxyUrl = resolveDeployProxyUrl(env);
+        let activeCommand = command;
+        let finalProjectName = projectName;
+        let pagesProjectUrl = getString(deploy, 'pages_project_url') || derivePagesProjectUrl(projectName);
+        let fallbackUsed = false;
+        let cleanupBlockedProject = '';
+        let dnsError = '';
+        let dnsTarget = '';
+        let customDomainBound = false;
+        let fallbackLastUsedSuffix = nonNegativeInt(deploy.fallback_last_used_suffix);
+        const fallbackCandidateNames = [];
+        let shareSyncResult = buildShareProjectNoopResult(deploy);
+        let { result, attempts } = await runPagesDeployAttempts(command, baseEnv, proxyUrl, {
+            cwd: input.bundleDir,
+            runCommand
+        });
+        if (result.returncode !== 0
+            && Boolean(deploy.auto_create_project_on_blocked ?? true)
+            && isBlockedPagesError(result.stdout, result.stderr)) {
+            const client = options.cloudflareDeployClient ?? new CloudflareHttpClient(credentials, { fetch: options.fetch });
+            const existingNames = new Set((await client.listPagesProjects()).map((project) => clean(project.name)).filter(Boolean));
+            const fallbackBaseName = deriveFallbackProjectBaseName(getString(deploy, 'fallback_project_prefix'), projectName);
+            const fallback = generateFallbackProjectName(fallbackBaseName, existingNames, {
+                currentProjectName: projectName,
+                lastUsedSuffix: fallbackLastUsedSuffix
+            });
+            finalProjectName = fallback.projectName;
+            fallbackLastUsedSuffix = fallback.suffix;
+            fallbackCandidateNames.push(finalProjectName);
+            await client.createPagesProject(finalProjectName);
+            await client.copyPagesProjectConfig(projectName, finalProjectName, runtimeEnv);
+            if (customDomain) {
+                await ensureCustomDomainBound(client, finalProjectName, customDomain, { previousProjectName: projectName });
+                customDomainBound = true;
+            }
+            activeCommand = buildPagesDeployCommand(input.bundleDir, finalProjectName);
+            const fallbackDeploy = await runPagesDeployAttempts(activeCommand, baseEnv, proxyUrl, {
+                cwd: input.bundleDir,
+                runCommand
+            });
+            result = fallbackDeploy.result;
+            attempts = [
+                ...attempts,
+                ...fallbackDeploy.attempts.map((attempt) => ({
+                    ...attempt,
+                    mode: `fallback-${String(attempt.mode)}`
+                }))
+            ];
+            pagesProjectUrl = derivePagesProjectUrl(finalProjectName);
+            fallbackUsed = true;
+            cleanupBlockedProject = projectName;
+        }
+        if (result.returncode === 0 && getString(deploy, 'share_project_name')) {
+            const client = options.cloudflareDeployClient ?? new CloudflareHttpClient(credentials, { fetch: options.fetch });
+            shareSyncResult = await syncShareProjectSub(deploy, {
+                projectRoot: input.projectRoot,
+                pagesProjectUrl,
+                runtimeEnv,
+                credentials,
+                client,
+                env,
+                runCommand
+            });
+        }
+        if (result.returncode === 0 && customDomain) {
+            const client = options.cloudflareDeployClient ?? new CloudflareHttpClient(credentials, { fetch: options.fetch });
+            if (!customDomainBound) {
+                await ensureCustomDomainBound(client, finalProjectName, customDomain, {
+                    previousProjectName: fallbackUsed ? projectName : ''
+                });
+            }
+            dnsTarget = pagesHostnameFromUrl(pagesProjectUrl) || `${finalProjectName}.pages.dev`;
+            try {
+                await client.upsertSubdomainCname(customDomain, dnsTarget, false);
+            }
+            catch (error) {
+                dnsError = error instanceof Error ? error.message : String(error);
+            }
+        }
+        const shareSyncError = shareSyncResult.share_project_sync_ok === false
+            ? String(shareSyncResult.share_project_sync_error || 'share project sync failed')
+            : '';
+        const finalReturncode = (shareSyncError || dnsError) ? 1 : result.returncode;
+        let finalStderr = result.stderr;
+        if (dnsError) {
+            finalStderr = `${finalStderr}\ncustom domain dns binding failed: ${dnsError}`.trim();
+        }
+        if (shareSyncError) {
+            finalStderr = `${finalStderr}\nshare project sync failed: ${shareSyncError}`.trim();
+        }
+        return {
+            command: activeCommand,
+            returncode: finalReturncode,
+            stdout: result.stdout,
+            stderr: finalStderr,
+            attempts,
+            requested_project_name: projectName,
+            fallback_candidate_names: fallbackCandidateNames,
+            cleanup_blocked_project: cleanupBlockedProject === finalProjectName ? '' : cleanupBlockedProject,
+            cleanup_deleted: false,
+            cleanup_errors: [],
+            project_name: finalProjectName,
+            pages_project_url: pagesProjectUrl,
+            custom_domain: customDomain,
+            custom_domain_dns_name: customDomain,
+            custom_domain_dns_target: dnsTarget,
+            custom_domain_dns_proxied: false,
+            custom_domain_dns_ok: Boolean(customDomain && dnsTarget && !dnsError),
+            fallback_used: fallbackUsed,
+            fallback_last_used_suffix: fallbackLastUsedSuffix,
+            ...shareSyncResult,
+            bundle_dir: input.bundleDir,
+            worker_entry: path.join(input.bundleDir, '_worker.js'),
+            module_manifest_path: path.join(input.bundleDir, 'manifest.json')
+        };
+    }
+    if (options.pythonDeploy) {
+        return options.pythonDeploy(input);
+    }
+    return runPythonJsonHelper(PYTHON_DEPLOY_HELPER, input, options, 'deploy');
+}
+export async function verifyDeploymentWithBackend(input, options = {}) {
+    if (selectPipelineStageBackend('verify', options.env ?? process.env) !== 'python') {
+        const cwd = options.cwd ?? process.cwd();
+        const env = mergeProjectEnv(cwd, options.env ?? process.env);
+        const client = options.cloudflareClient ?? new CloudflareHttpClient(resolveCloudflareCredentials(input.deploy, env), { fetch: options.fetch });
+        const target = mergeDeployVerificationTarget(input.deploy, input.deployment);
+        const verification = await defaultVerifyDeployment(target, client);
+        const result = { ...verification };
+        if (isVerifySuccess(verification)) {
+            Object.assign(result, await cleanupBlockedPagesProjects(target, input.deployment, client));
+        }
+        return result;
+    }
+    if (options.pythonVerify) {
+        return options.pythonVerify(input);
+    }
+    return runPythonJsonHelper(PYTHON_VERIFY_HELPER, input, options, 'verify');
+}
+export function isVerifySuccess(verification) {
+    const pagesDomainOk = verification.pages_domain_ok === undefined ? true : Boolean(verification.pages_domain_ok);
+    if (!(pagesDomainOk && verification.secret_ok && verification.subscription_ok)) {
+        return false;
+    }
+    if (verification.custom_domain_ok && verification.custom_domain_subscription_ok === false) {
+        return false;
+    }
+    if (verification.custom_domain_ok && verification.custom_domain_dns_ok === false) {
+        return false;
+    }
+    return true;
+}