@wtfalch/foundry 0.60.0 → 0.62.0

package/dist/apps/deploy.js

@@ -0,0 +1,791 @@
+import { createHash } from 'node:crypto';
+import { WORKER_APP_ENV_NAME, WORKER_APP_KEYS_SECRET } from '../entry-rules.js';
+import { APPS_DOMAIN } from '../org.js';
+import { WORKER_APP_KEYS_URL_VAR, workerAppHasBuild } from '../worker-app-config.js';
+import { WORKER_APP_DNS_RECORD, pendingWorkerAppMigrations, strayContainerImage, withCallTimeout, workerAppRegistryPrefix, workerAppShape, workerAppUpload, } from '../worker-app-upload.js';
+import { fetchReleaseAsset, parseAppRepo, releaseAssetOf, } from './github.js';
+/** The paths an MCP client reaches without signing in at Access: the MCP endpoint and the OAuth discovery documents. */
+export function mcpMachinePaths(mcpPath) {
+    return [
+        ...new Set([
+            mcpPath,
+            '/.well-known/oauth-protected-resource',
+            '/.well-known/oauth-authorization-server',
+        ]),
+    ];
+}
+const WORKSPACE_SUFFIX = '-work';
+export const appScriptName = (key, copy) => copy === 'live' ? key : `${key}${WORKSPACE_SUFFIX}`;
+export const appHyperdriveName = (script) => `${script}-db`;
+const APP_KEY = /^[a-z](?:[a-z0-9-]{0,52}[a-z0-9])?$/;
+const HOST = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
+const EMAIL = /^[^\s@<>"]{1,64}@[a-z0-9-]+(\.[a-z0-9-]+)+$/;
+const MACHINE_PATH = /^(\/[A-Za-z0-9._~-]+)+$/;
+const SIGN_IN_NAME = /^(AUTH_[A-Z0-9_]+|MCP_[A-Z0-9_]+|KEYS_URL)$/;
+const GATE_EMAILS_MAX = 50;
+const MACHINE_PATHS_MAX = 20;
+const ARTIFACT_MAX_BYTES = 10 * 1024 * 1024;
+const CALL_TIMEOUT_MS = 120_000;
+const UPLOAD_TIMEOUT_MS = 300_000;
+const ROLLOUT_TIMEOUT_MS = 600_000;
+const ROLLOUT_POLL_MS = 5_000;
+const SIGN_IN_VARS = ['AUTH_ORGANIZATION_ID', 'AUTH_CLIENT_ID', 'AUTH_ISSUER'];
+const MCP_VARS = ['MCP_AUDIENCE', 'MCP_RESOURCE', 'MCP_ISSUER'];
+const AUTH_APP_KEY = 'AUTH_APP_KEY';
+const PEOPLE_POLICY = 'people';
+const SELF_HOSTED = 'self_hosted';
+const MACHINES_POLICY = 'machines';
+/** A refusal or a failed call, already in plain words. */
+class Stop extends Error {
+    step;
+    reachableWithoutGate;
+    constructor(step, message, reachableWithoutGate = false) {
+        super(message);
+        this.step = step;
+        this.reachableWithoutGate = reachableWithoutGate;
+    }
+}
+/** What each step asks of the token, named as Cloudflare's token page does. */
+const PERMISSION = {
+    address: 'Zone: Read, DNS: Edit and Workers Routes: Edit',
+    build: 'Workers Scripts: Edit',
+    upload: 'Workers Scripts: Edit',
+    secrets: 'Workers Scripts: Edit',
+    database: 'Hyperdrive: Edit',
+    containers: 'Containers: Edit',
+    gate: 'Access: Apps and Policies: Edit',
+    remove: 'Workers Scripts: Edit',
+};
+function callFailure(step, what, error) {
+    const status = error?.status;
+    const timedOut = error instanceof Error && /no answer within/.test(error.message);
+    if (timedOut)
+        return new Stop(step, `Cloudflare did not answer in time while we tried to ${what}. Try again.`);
+    if (status === 401) {
+        return new Stop(step, 'Cloudflare did not accept the API token. Make a new token and save it under Settings › Connections.');
+    }
+    if (status === 403) {
+        return new Stop(step, `Cloudflare refused to let us ${what}: the API token needs ${PERMISSION[step] ?? 'more permissions'}. Add it to the token in Cloudflare and try again.`);
+    }
+    return new Stop(step, `Cloudflare could not ${what}${typeof status === 'number' ? ` (it answered ${status})` : ''}. Try again; if it keeps failing, look at the app in your Cloudflare account.`);
+}
+const sorted = (list) => [...list].sort();
+const sameJson = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+/** The domain a person would add to Cloudflare for `host`: its last two labels. */
+const domainOf = (host) => host.split('.').slice(-2).join('.');
+const onPlatformZone = (host) => host === APPS_DOMAIN || host.endsWith(`.${APPS_DOMAIN}`);
+function parsePostgresUrl(url) {
+    const refuse = () => new Stop('database', 'The database address is not a Postgres address. It looks like postgres://user:password@host:5432/name.');
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw refuse();
+    }
+    if (parsed.protocol !== 'postgres:' && parsed.protocol !== 'postgresql:')
+        throw refuse();
+    let database;
+    let user;
+    let password;
+    try {
+        database = decodeURIComponent(parsed.pathname.replace(/^\//, ''));
+        user = decodeURIComponent(parsed.username);
+        password = decodeURIComponent(parsed.password);
+    }
+    catch {
+        throw refuse();
+    }
+    const port = parsed.port ? Number(parsed.port) : 5432;
+    if (!parsed.hostname || !database || !user || !password || !Number.isInteger(port))
+        throw refuse();
+    return {
+        scheme: parsed.protocol === 'postgresql:' ? 'postgresql' : 'postgres',
+        host: parsed.hostname,
+        port,
+        database,
+        user,
+        password,
+    };
+}
+/** Cloudflare's upload metadata for `upload`. Secrets are kept across uploads. */
+function uploadMetadata(upload) {
+    const migrations = upload.migrations;
+    return {
+        compatibility_date: upload.compatibilityDate,
+        ...(upload.compatibilityFlags.length ? { compatibility_flags: upload.compatibilityFlags } : {}),
+        bindings: upload.bindings,
+        ...(migrations
+            ? {
+                migrations: {
+                    ...(migrations.oldTag === undefined ? {} : { old_tag: migrations.oldTag }),
+                    new_tag: migrations.newTag,
+                    steps: migrations.steps.map((step) => ({
+                        ...(step.newSqliteClasses?.length
+                            ? { new_sqlite_classes: step.newSqliteClasses }
+                            : {}),
+                        ...(step.deletedClasses?.length ? { deleted_classes: step.deletedClasses } : {}),
+                        ...(step.renamedClasses?.length ? { renamed_classes: step.renamedClasses } : {}),
+                    })),
+                },
+            }
+            : {}),
+        ...(upload.containers ? { containers: upload.containers.map((c) => ({ class_name: c })) } : {}),
+        observability: upload.observability,
+        keep_bindings: ['secret_text'],
+    };
+}
+function makeContext(input, deps) {
+    const cf = deps.cloudflare(input.account);
+    const ms = deps.timeoutMs ?? CALL_TIMEOUT_MS;
+    return {
+        cf,
+        steps: [],
+        deps,
+        async call(step, what, task, over) {
+            try {
+                return await withCallTimeout(over ?? ms, what, task);
+            }
+            catch (error) {
+                throw callFailure(step, what, error);
+            }
+        },
+    };
+}
+/** Never let a value we were handed reach a message, whatever path built it. */
+function scrub(text, hidden) {
+    let out = text;
+    for (const value of hidden) {
+        if (value.length >= 4)
+            out = out.split(value).join('[hidden]');
+    }
+    return out;
+}
+async function settle(run, ctx, hidden) {
+    const steps = ctx?.steps ?? [];
+    try {
+        if (!ctx)
+            throw new Stop('check', 'Could not reach your Cloudflare account. Check the connection under Settings › Connections.');
+        const url = await run(ctx);
+        return { ok: true, steps: steps.map((s) => scrub(s, hidden)), url: scrub(url, hidden) };
+    }
+    catch (error) {
+        const stop = error instanceof Stop
+            ? error
+            : new Stop('unexpected', 'Something went wrong while setting up the app. Try again.');
+        return {
+            ok: false,
+            step: stop.step,
+            message: scrub(stop.message, hidden),
+            steps: steps.map((s) => scrub(s, hidden)),
+            ...(stop.reachableWithoutGate ? { reachableWithoutGate: true } : {}),
+        };
+    }
+}
+/** `removing`: a copy under a legacy `-work` key may still be taken down; only a deploy refuses it. */
+function checkNames(app, removing = false) {
+    if (!APP_KEY.test(app.key)) {
+        throw new Stop('check', 'The app’s key must be lower-case letters, digits and dashes, start with a letter and be at most 54 characters.');
+    }
+    // `<key>-work` is the workspace copy of `<key>`: an app keyed `foo-work` would be foo's workspace.
+    if (!removing && app.key.endsWith(WORKSPACE_SUFFIX)) {
+        throw new Stop('check', 'The app’s key may not end in -work: that name is kept for the workspace of another app. Pick another key.');
+    }
+    if (!HOST.test(app.host)) {
+        throw new Stop('check', `${app.host.slice(0, 80)} is not a web address we can use.`);
+    }
+}
+async function findAddress(ctx, app, script) {
+    if (onPlatformZone(app.host)) {
+        if (app.copy === 'live') {
+            throw new Stop('address', `${app.host} is on companyincluded.app, which your own Cloudflare account cannot serve yet. Use a domain that is in your Cloudflare account for the live app.`);
+        }
+        const subdomain = await ctx.call('address', 'read your workers.dev name', () => ctx.cf.getWorkersSubdomain());
+        if (!subdomain) {
+            throw new Stop('address', 'Your Cloudflare account has no workers.dev name yet. Open Workers & Pages in Cloudflare once to choose it, then try again.');
+        }
+        const host = `${script}.${subdomain}.workers.dev`;
+        ctx.steps.push(`The workspace is served at ${host}`);
+        return { kind: 'workers.dev', host };
+    }
+    const zone = await ctx.call('address', `find ${domainOf(app.host)} in your account`, () => ctx.cf.findZoneByApex(app.host));
+    if (!zone) {
+        throw new Stop('address', `${domainOf(app.host)} is not in your Cloudflare account. Add it there first, or pick a name on companyincluded.app.`);
+    }
+    if (zone.status !== 'active') {
+        throw new Stop('address', `${zone.name} is in your Cloudflare account but is not active yet. Finish adding it in Cloudflare (its name servers), then try again.`);
+    }
+    ctx.steps.push(`Found ${zone.name} in your Cloudflare account`);
+    return { kind: 'zone', zone: { id: zone.id, name: zone.name }, host: app.host };
+}
+/** Refuses a route or record on the host that something else made, before anything is written. */
+async function checkAddressFree(ctx, address, script) {
+    if (address.kind !== 'zone')
+        return;
+    const pattern = `${address.host}/*`;
+    const routes = await ctx.call('address', `read the routes of ${address.zone.name}`, () => ctx.cf.listWorkerRoutes(address.zone.id));
+    const taken = routes.find((r) => r.pattern === pattern && r.script !== script);
+    if (taken) {
+        throw new Stop('address', `${address.host} already sends its visitors to ${taken.script ? `another Worker (${taken.script})` : 'nothing'} in your Cloudflare account. Remove that route in Cloudflare, or pick another name.`);
+    }
+    const records = await ctx.call('address', `read the DNS records of ${address.host}`, () => ctx.cf.listDnsRecords(address.zone.id, { name: address.host }));
+    const foreign = records.find((r) => !(r.type === WORKER_APP_DNS_RECORD.type && r.content === WORKER_APP_DNS_RECORD.content));
+    if (foreign) {
+        throw new Stop('address', `${address.host} already has a DNS record (${foreign.type}) in your Cloudflare account. Remove it there, or pick another name.`);
+    }
+}
+async function publishAddress(ctx, address, script) {
+    if (address.kind === 'workers.dev') {
+        await ctx.call('address', 'turn on the workers.dev address', () => ctx.cf.setWorkerScriptSubdomain(script, true));
+        ctx.steps.push(`Turned on ${address.host}`);
+        return;
+    }
+    // The route is the address; workers.dev was turned off right after the upload.
+    const { zone, host } = address;
+    const records = await ctx.call('address', `read the DNS records of ${host}`, () => ctx.cf.listDnsRecords(zone.id, { name: host }));
+    if (records.some((r) => r.type === WORKER_APP_DNS_RECORD.type && r.content === WORKER_APP_DNS_RECORD.content)) {
+        ctx.steps.push(`The DNS record of ${host} is in place`);
+    }
+    else {
+        await ctx.call('address', `make the DNS record of ${host}`, () => ctx.cf.createDnsRecord(zone.id, { ...WORKER_APP_DNS_RECORD, name: host, proxied: true }));
+        ctx.steps.push(`Made the DNS record of ${host}`);
+    }
+    const pattern = `${host}/*`;
+    const routes = await ctx.call('address', `read the routes of ${zone.name}`, () => ctx.cf.listWorkerRoutes(zone.id));
+    if (routes.some((r) => r.pattern === pattern && r.script === script)) {
+        ctx.steps.push(`The route ${pattern} is in place`);
+    }
+    else {
+        await ctx.call('address', `make the route ${pattern}`, () => ctx.cf.createWorkerRoute(zone.id, { pattern, script }));
+        ctx.steps.push(`Made the route ${pattern}`);
+    }
+    // A route of this app on another name of the same zone is from an earlier address.
+    for (const old of routes.filter((r) => r.script === script && r.pattern !== pattern)) {
+        await ctx.call('address', `remove the old route ${old.pattern}`, () => ctx.cf.deleteWorkerRoute(zone.id, old.id));
+        ctx.steps.push(`Removed the old route ${old.pattern}`);
+    }
+}
+// ---- the gate ---------------------------------------------------------------
+const isOurAccessApp = (a, script, host) => (a.domain === host && a.name === script) ||
+    (a.domain.startsWith(`${host}/`) && a.name === `${script} ${a.domain.slice(host.length)}`);
+/**
+ * Our gate app holds our one rule and nothing else: any other rule on it (an `everyone` allow
+ * added in Cloudflare, a second copy of ours) would open it, so it is removed, first.
+ */
+async function ensurePolicy(ctx, appId, policy, label) {
+    const live = await ctx.call('gate', `read the Access rules of ${label}`, () => ctx.cf.listAccessPolicies(appId));
+    const found = live.find((p) => p.name === policy.name);
+    const others = live.filter((p) => p !== found);
+    for (const other of others) {
+        await ctx.call('gate', `remove an Access rule of ${label}`, () => ctx.cf.deleteAccessPolicy(appId, other.id));
+    }
+    if (others.length > 0) {
+        ctx.steps.push(`Removed ${others.length} Access ${others.length === 1 ? 'rule' : 'rules'} on ${label} that Boule did not make`);
+    }
+    if (found && found.decision === policy.decision && sameJson(found.include, policy.include)) {
+        return false;
+    }
+    if (found) {
+        await ctx.call('gate', `update the Access rule of ${label}`, () => ctx.cf.updateAccessPolicy(appId, found.id, { ...policy, precedence: 1 }));
+    }
+    else {
+        await ctx.call('gate', `make the Access rule of ${label}`, () => ctx.cf.createAccessPolicy(appId, { ...policy, precedence: 1 }));
+    }
+    return true;
+}
+/**
+ * Our Access app on `domain`, self-hosted. One of another type (which gates nothing) or a second
+ * copy is removed after the right one exists, so the domain is never left without a gate.
+ */
+async function ensureAccessApp(ctx, ours, domain, name, what, made) {
+    const same = ours.filter((a) => a.domain === domain);
+    let id = same.find((a) => a.type === SELF_HOSTED)?.id;
+    if (!id) {
+        const created = await ctx.call('gate', `make the Access app for ${what}`, () => ctx.cf.createAccessApp({ name, domain, type: SELF_HOSTED, session_duration: '24h' }));
+        id = created.id;
+        ctx.steps.push(made);
+    }
+    for (const extra of same.filter((a) => a.id !== id)) {
+        await ctx.call('gate', `remove the Access app ${domain}`, () => ctx.cf.deleteAccessApp(extra.id));
+        ctx.steps.push(`Removed an Access app on ${domain} that was ${extra.type === SELF_HOSTED ? 'a second copy' : 'not self-hosted'}`);
+    }
+    return id;
+}
+async function ensureGate(ctx, host, script, gate) {
+    const apps = await ctx.call('gate', 'read your Access apps', () => ctx.cf.listAccessApps());
+    const ours = apps.filter((a) => isOurAccessApp(a, script, host));
+    if (!gate) {
+        for (const app of ours) {
+            await ctx.call('gate', `remove the Access app ${app.domain}`, () => ctx.cf.deleteAccessApp(app.id));
+            ctx.steps.push(`Removed the gate on ${app.domain}`);
+        }
+        return;
+    }
+    // Anything on the host or a path of it that is not ours: we cannot tell what it lets through.
+    const foreign = apps.find((a) => (a.domain === host || a.domain.startsWith(`${host}/`)) && !isOurAccessApp(a, script, host));
+    if (foreign) {
+        throw new Stop('gate', `${host} already has a Cloudflare Access app (${foreign.name}) that Boule did not make. Remove it in Cloudflare, then try again.`);
+    }
+    const emails = sorted(gate.emails.map((e) => e.trim().toLowerCase()));
+    // The machine paths first: they are what the gate must let through once it exists.
+    const wanted = new Set(gate.machinePaths);
+    for (const path of sorted([...wanted])) {
+        const appId = await ensureAccessApp(ctx, ours, `${host}${path}`, `${script} ${path}`, path, `Let machines reach ${path} without signing in`);
+        if (await ensurePolicy(ctx, appId, { name: MACHINES_POLICY, decision: 'bypass', include: [{ everyone: {} }] }, path)) {
+            ctx.steps.push(`Set the rule that lets machines reach ${path}`);
+        }
+    }
+    for (const app of ours) {
+        if (app.domain === host || wanted.has(app.domain.slice(host.length)))
+            continue;
+        await ctx.call('gate', `remove the Access app ${app.domain}`, () => ctx.cf.deleteAccessApp(app.id));
+        ctx.steps.push(`Removed the open path ${app.domain.slice(host.length)}`);
+    }
+    const wholeId = await ensureAccessApp(ctx, ours, host, script, host, `Made the gate on ${host}`);
+    const changed = await ensurePolicy(ctx, wholeId, {
+        name: PEOPLE_POLICY,
+        decision: 'allow',
+        include: emails.map((email) => ({ email: { email } })),
+    }, host);
+    ctx.steps.push(changed
+        ? `Let ${emails.length} ${emails.length === 1 ? 'person' : 'people'} through the gate`
+        : `The gate lets the same ${emails.length} ${emails.length === 1 ? 'person' : 'people'} through`);
+}
+function checkGate(gate, copy) {
+    if (!gate) {
+        if (copy === 'workspace') {
+            throw new Stop('check', 'A workspace needs a list of the people who may open it.');
+        }
+        return;
+    }
+    const emails = gate.emails.map((e) => e.trim().toLowerCase());
+    if (emails.length === 0) {
+        throw new Stop('check', 'Add at least one person who may open the workspace.');
+    }
+    if (emails.length > GATE_EMAILS_MAX) {
+        throw new Stop('check', `At most ${GATE_EMAILS_MAX} people may be let through the gate.`);
+    }
+    const bad = emails.find((e) => !EMAIL.test(e));
+    if (bad !== undefined)
+        throw new Stop('check', `${bad.slice(0, 80)} is not an email address.`);
+    if (new Set(emails).size !== emails.length) {
+        throw new Stop('check', 'The same email address is in the list twice.');
+    }
+    if (gate.machinePaths.length > MACHINE_PATHS_MAX) {
+        throw new Stop('check', `At most ${MACHINE_PATHS_MAX} paths may be open to machines.`);
+    }
+    for (const path of gate.machinePaths) {
+        if (!MACHINE_PATH.test(path) ||
+            path.split('/').some((s) => s === '.' || s === '..') ||
+            path.length > 200) {
+            throw new Stop('check', `${path.slice(0, 80)} is not a path we can open to machines. A path starts with / and holds letters, digits and . _ ~ -.`);
+        }
+    }
+}
+// ---- secrets, containers, database --------------------------------------------
+async function putSecrets(ctx, script, secrets) {
+    // Cloudflare never shows a value, so each one is written again; a write of the same value changes nothing.
+    for (const [name, value] of Object.entries(secrets).sort(([a], [b]) => a.localeCompare(b))) {
+        await ctx.call('secrets', `set the secret ${name}`, () => ctx.cf.putWorkerSecret(script, name, value));
+    }
+    const count = Object.keys(secrets).length;
+    ctx.steps.push(`Set ${count} ${count === 1 ? 'secret' : 'secrets'}`);
+}
+/** After the upload: a secret the build no longer names goes once the new code runs. */
+async function pruneSecrets(ctx, script, secrets) {
+    const live = await ctx.call('secrets', 'read the app’s secret names', () => ctx.cf.listWorkerSecrets(script));
+    for (const { name } of live) {
+        if (name in secrets)
+            continue;
+        await ctx.call('secrets', `remove the old secret ${name}`, () => ctx.cf.deleteWorkerSecret(script, name));
+        ctx.steps.push(`Removed the old secret ${name}`);
+    }
+}
+const containerAppName = (script, className) => `${script}-${className}`.toLowerCase();
+async function waitForRollout(ctx, appId, rolloutId, className) {
+    const deadline = Date.now() + (ctx.deps.rolloutTimeoutMs ?? ROLLOUT_TIMEOUT_MS);
+    const poll = ctx.deps.rolloutPollMs ?? ROLLOUT_POLL_MS;
+    for (;;) {
+        const { status } = await ctx.call('containers', `read the ${className} rollout`, () => ctx.cf.getContainerRollout(appId, rolloutId));
+        if (status === 'completed')
+            return;
+        if (status === 'reverted' || status === 'replaced') {
+            throw new Stop('containers', `The new ${className} container image did not start (Cloudflare ${status} it). The app still runs the old one. Look at the build, then try again.`);
+        }
+        if (Date.now() >= deadline) {
+            throw new Stop('containers', `The new ${className} container image is still rolling out. Try again in a few minutes.`);
+        }
+        await new Promise((resolve) => setTimeout(resolve, poll));
+    }
+}
+async function syncContainers(ctx, script, containers) {
+    const [namespaces, apps] = await Promise.all([
+        ctx.call('containers', 'read the app’s Durable Objects', () => ctx.cf.listDurableObjectNamespaces()),
+        ctx.call('containers', 'read your container applications', () => ctx.cf.listContainerApplications()),
+    ]);
+    const ofScript = namespaces.filter((ns) => ns.script === script);
+    const used = new Set();
+    for (const container of containers) {
+        const namespace = ofScript.find((ns) => ns.className === container.className);
+        if (!namespace) {
+            throw new Stop('containers', `The build has no Durable Object ${container.className} for its container. Check the build’s build.json.`);
+        }
+        const name = containerAppName(script, container.className);
+        const live = apps.find((a) => a.namespaceId === namespace.id);
+        if (!live) {
+            const { id } = await ctx.call('containers', `make the ${container.className} container`, () => ctx.cf.createContainerApplication({
+                name,
+                image: container.image,
+                instanceType: container.instanceType,
+                maxInstances: container.maxInstances,
+                namespaceId: namespace.id,
+            }));
+            used.add(id);
+            ctx.steps.push(`Made the ${container.className} container`);
+            continue;
+        }
+        used.add(live.id);
+        let changed = false;
+        if (live.maxInstances !== container.maxInstances) {
+            await ctx.call('containers', `set how many ${container.className} containers may run`, () => ctx.cf.updateContainerApplication(live.id, { maxInstances: container.maxInstances }));
+            changed = true;
+        }
+        if (live.image !== container.image || live.instanceType !== container.instanceType) {
+            const rollout = await ctx.call('containers', `roll out the new ${container.className} image`, () => ctx.cf.rolloutContainerApplication(live.id, {
+                image: container.image,
+                instanceType: container.instanceType,
+                description: 'Boule: new build',
+            }));
+            await waitForRollout(ctx, live.id, rollout.id, container.className);
+            changed = true;
+        }
+        ctx.steps.push(changed
+            ? `Brought the ${container.className} container to the new build`
+            : `The ${container.className} container is current`);
+    }
+    // A container of this script whose class the build no longer runs in a container.
+    const ours = new Set(ofScript.map((ns) => ns.id));
+    for (const app of apps) {
+        if (used.has(app.id) || !ours.has(app.namespaceId))
+            continue;
+        await ctx.call('containers', `remove the container ${app.name}`, () => ctx.cf.deleteContainerApplication(app.id));
+        ctx.steps.push(`Removed the container ${app.name}`);
+    }
+}
+async function ensureHyperdrive(ctx, script, origin) {
+    const name = appHyperdriveName(script);
+    const configs = await ctx.call('database', 'read your Hyperdrive configs', () => ctx.cf.listHyperdriveConfigs());
+    const found = configs.find((c) => c.name === name);
+    // Always written: Cloudflare never shows the password, so a changed one could not be seen.
+    if (found) {
+        await ctx.call('database', 'update the database link', () => ctx.cf.updateHyperdriveConfig(found.id, name, origin));
+        ctx.steps.push(`Updated the database link ${name}`);
+        return found.id;
+    }
+    const { id } = await ctx.call('database', 'make the database link', () => ctx.cf.createHyperdriveConfig(name, origin));
+    ctx.steps.push(`Made the database link ${name}`);
+    return id;
+}
+async function deleteHyperdrive(ctx, step, script) {
+    const name = appHyperdriveName(script);
+    const configs = await ctx.call(step, 'read your Hyperdrive configs', () => ctx.cf.listHyperdriveConfigs());
+    for (const config of configs.filter((c) => c.name === name)) {
+        await ctx.call(step, 'remove the database link', () => ctx.cf.deleteHyperdriveConfig(config.id));
+        ctx.steps.push(`Removed the database link ${name}`);
+    }
+}
+/** Everything that needs no call: names, env, secrets, images, the database address. */
+function prepare(input) {
+    checkNames(input.app);
+    const app = input.entry.workerApp;
+    if (!app)
+        throw new Stop('check', 'This app is not a Worker app.');
+    if (!workerAppHasBuild(app)) {
+        throw new Stop('check', 'The app has no build yet. Publish a release with its build.json first.');
+    }
+    checkGate(input.gate ?? null, input.app.copy);
+    const repo = input.app.repo;
+    if (!parseAppRepo(repo)) {
+        throw new Stop('check', 'The app needs its GitHub repository, written owner/name (for example nordvik/terminal).');
+    }
+    const asset = releaseAssetOf(app.artifactUrl, repo);
+    if (!asset) {
+        throw new Stop('check', `The build must be a file of a release of ${repo} (https://github.com/${repo}/releases/download/<tag>/<file>).`);
+    }
+    if (input.github && !input.github.token) {
+        throw new Stop('check', 'The GitHub connection has no token. Save it again under Settings › Connections.');
+    }
+    if (!/^[0-9a-f]{64}$/.test(app.artifactSha256)) {
+        throw new Stop('check', 'The build’s checksum in build.json is not a sha256 (64 lower-case hex characters).');
+    }
+    const stray = strayContainerImage(app, input.account.accountId);
+    if (stray) {
+        throw new Stop('check', `The ${stray.className} container image is not in your Cloudflare account’s registry. Push it to ${workerAppRegistryPrefix(input.account.accountId)}… from the app’s build, then try again.`);
+    }
+    const signIn = input.signIn ?? {};
+    for (const name of Object.keys(signIn)) {
+        if (!SIGN_IN_NAME.test(name) || !WORKER_APP_ENV_NAME.test(name)) {
+            throw new Stop('check', `${name.slice(0, 64)} is not a sign-in setting the app can take.`);
+        }
+    }
+    for (const name of Object.keys(input.secrets)) {
+        if (!WORKER_APP_ENV_NAME.test(name)) {
+            throw new Stop('check', `${name.slice(0, 64)} is not a secret name the app can take: capital letters, digits and _ only.`);
+        }
+    }
+    const vars = { ...(app.vars ?? {}), ...signIn };
+    const clash = Object.keys(input.secrets).find((name) => name in vars);
+    if (clash)
+        throw new Stop('check', `${clash} is both a setting and a secret. Keep only one.`);
+    const missing = [];
+    for (const [name, source] of Object.entries(app.secrets ?? {})) {
+        if (!input.secrets[name])
+            missing.push(name);
+        if (source.from === 'keysCustody' &&
+            name === WORKER_APP_KEYS_SECRET &&
+            !vars[WORKER_APP_KEYS_URL_VAR]) {
+            missing.push(WORKER_APP_KEYS_URL_VAR);
+        }
+    }
+    if (app.authEnv) {
+        for (const name of SIGN_IN_VARS)
+            if (!vars[name])
+                missing.push(name);
+        if (!input.secrets[AUTH_APP_KEY])
+            missing.push(AUTH_APP_KEY);
+        if (input.entry.uses?.auth?.mcp)
+            for (const name of MCP_VARS)
+                if (!vars[name])
+                    missing.push(name);
+    }
+    if (missing.length > 0) {
+        throw new Stop('check', `The app still needs ${[...new Set(missing)].join(', ')}. Finish its sign-in and secrets in Boule, then try again.`);
+    }
+    let database = null;
+    if (app.database) {
+        if (!input.database?.url) {
+            throw new Stop('check', 'The app needs a database. Add its Postgres address under Database, then try again.');
+        }
+        database = parsePostgresUrl(input.database.url);
+    }
+    return {
+        asset,
+        script: appScriptName(input.app.key, input.app.copy),
+        shape: workerAppShape(app),
+        vars: Object.entries(vars).sort(([a], [b]) => a.localeCompare(b)),
+        secrets: { ...input.secrets },
+        database,
+        migrationsNote: Boolean(app.database?.migrationsSha256),
+    };
+}
+async function fetchBuild(ctx, prepared, github) {
+    const { shape, asset } = prepared;
+    const ms = ctx.deps.timeoutMs ?? CALL_TIMEOUT_MS;
+    const repo = `${asset.owner}/${asset.name}`;
+    let bytes;
+    try {
+        bytes = await withCallTimeout(ms, 'fetch the build', () => ctx.deps.fetchArtifact
+            ? ctx.deps.fetchArtifact(shape.artifactUrl)
+            : fetchReleaseAsset(asset, {
+                token: github?.token ?? null,
+                fetch: ctx.deps.fetch ?? fetch,
+                timeoutMs: ms,
+                maxBytes: ARTIFACT_MAX_BYTES,
+            }));
+    }
+    catch (error) {
+        // `withCallTimeout` drops the error and keeps its code: ReleaseAssetError's reason.
+        const code = error?.code;
+        const reason = code === 'not_found' || code === 'refused' || code === 'too_large' ? code : 'failed';
+        if (reason === 'too_large')
+            throw new Stop('build', 'The app’s build is larger than 10 MB.');
+        if (reason === 'refused' || (reason === 'not_found' && !github)) {
+            throw new Stop('build', github
+                ? `GitHub did not let us read the build of ${repo}. The GitHub token under Settings › Connections needs Contents: Read on ${repo}.`
+                : `We could not read the build of ${repo}. If the repository is private, connect GitHub under Settings › Connections, then try again.`);
+        }
+        if (reason === 'not_found') {
+            throw new Stop('build', `The release ${asset.tag} of ${repo} has no file ${asset.file}. Publish the release again with its files.`);
+        }
+        throw new Stop('build', 'We could not download the app’s build from its release. Check the GitHub connection and that the release still has its files.');
+    }
+    if (bytes.length === 0 || bytes.length > ARTIFACT_MAX_BYTES) {
+        throw new Stop('build', 'The app’s build is empty or larger than 10 MB.');
+    }
+    if (createHash('sha256').update(bytes).digest('hex') !== shape.artifactSha256.toLowerCase()) {
+        throw new Stop('build', 'The downloaded build is not the one build.json names (its checksum differs). Publish the release again.');
+    }
+    ctx.steps.push('Downloaded the build and checked it');
+    return bytes;
+}
+/**
+ * Deploys one Worker app copy into the company's own account and returns what it did, or the step
+ * that stopped it in plain words. Never throws.
+ */
+export async function deployWorkerApp(input, deps) {
+    const hidden = [];
+    let ctx = null;
+    try {
+        hidden.push(input.account.token);
+        hidden.push(...Object.values(input.secrets));
+        if (input.database?.url)
+            hidden.push(input.database.url);
+        if (input.github?.token)
+            hidden.push(input.github.token);
+    }
+    catch {
+        // An input we cannot read is refused by the checks below.
+    }
+    try {
+        ctx = makeContext(input, deps);
+    }
+    catch {
+        ctx = null;
+    }
+    return settle(async (c) => {
+        const prepared = prepare(input);
+        const { script, shape } = prepared;
+        if (prepared.database) {
+            const parsed = prepared.database;
+            hidden.push(parsed.password);
+        }
+        const address = await findAddress(c, input.app, script);
+        await checkAddressFree(c, address, script);
+        const module = await fetchBuild(c, prepared, input.github ?? null);
+        // The gate before the upload: a workers.dev address can be live the moment the script is,
+        // so a workspace is gated from its first request.
+        await ensureGate(c, address.host, script, input.gate ?? null);
+        let hyperdriveId;
+        if (prepared.database)
+            hyperdriveId = await ensureHyperdrive(c, script, prepared.database);
+        else if (input.database?.url)
+            c.steps.push('The database address was not used: this build asks for no database');
+        if (prepared.migrationsNote) {
+            c.steps.push('The build’s database changes (migrations.json) are not run by the deploy: run them first with applyWorkerAppMigrations');
+        }
+        const scripts = await c.call('upload', 'read your Workers', () => c.cf.listWorkerScripts());
+        const existing = scripts.find((s) => s.id === script);
+        const pending = pendingWorkerAppMigrations(shape.migrations, existing?.migrationTag);
+        if (!pending.ok) {
+            throw new Stop('upload', `The Worker ${script} in your account holds a Durable Object change this build does not list. Its build.json must keep every earlier migration, in order.`);
+        }
+        const upload = workerAppUpload(script, shape, prepared.vars, pending.migrations, hyperdriveId);
+        // A script already there takes its secrets before the new code that may read them (the
+        // upload keeps them); a new script cannot hold a secret before it exists.
+        if (existing)
+            await putSecrets(c, script, prepared.secrets);
+        await c.call('upload', 'upload the app', () => c.cf.uploadWorkerModule(script, { module, metadata: uploadMetadata(upload) }), deps.timeoutMs ?? UPLOAD_TIMEOUT_MS);
+        c.steps.push(`Uploaded ${script}${pending.migrations ? ` with Durable Object change ${pending.migrations.newTag}` : ''}`);
+        // On a company zone the route is the address and the gate is on it: workers.dev goes off
+        // at once, before anything else can fail, so nothing reaches the copy around them.
+        if (address.kind === 'zone') {
+            try {
+                await c.call('address', 'turn off the workers.dev address', () => c.cf.setWorkerScriptSubdomain(script, false));
+            }
+            catch {
+                // The code is up and its gate is on the zone host only: workers.dev may serve it ungated.
+                throw new Stop('address', `${script} is uploaded, but Cloudflare did not let us turn off its workers.dev address, so it may be reachable there without its gate. Remove the app now (removeWorkerApp), then deploy it again.`, true);
+            }
+            c.steps.push(`Kept ${script} off workers.dev`);
+        }
+        if (!existing)
+            await putSecrets(c, script, prepared.secrets);
+        await pruneSecrets(c, script, prepared.secrets);
+        if (!prepared.database)
+            await deleteHyperdrive(c, 'database', script);
+        await syncContainers(c, script, shape.containers);
+        await publishAddress(c, address, script);
+        return `https://${address.host}`;
+    }, ctx, hidden);
+}
+/** Whether a route pattern (`host/*`, `*.zone/*`, `*host/*`) serves `host`. */
+function routeCoversHost(pattern, host) {
+    const on = pattern.split('/')[0] ?? '';
+    if (on === host)
+        return true;
+    return on.startsWith('*') && host.endsWith(on.slice(1));
+}
+/**
+ * Removes one copy: its workers.dev address first, then its route and DNS record, its containers,
+ * the script with its secrets, its database link, and its Access apps last, so the gate stays
+ * until nothing is left behind it. A piece already gone is skipped, so a rerun converges. Never
+ * throws.
+ */
+export async function removeWorkerApp(input, deps) {
+    let ctx = null;
+    try {
+        ctx = makeContext(input, deps);
+    }
+    catch {
+        ctx = null;
+    }
+    return settle(async (c) => {
+        checkNames(input.app, true);
+        const script = appScriptName(input.app.key, input.app.copy);
+        const scripts = await c.call('remove', 'read your Workers', () => c.cf.listWorkerScripts());
+        const exists = scripts.some((s) => s.id === script);
+        if (exists) {
+            await c.call('address', 'turn off the workers.dev address', () => c.cf.setWorkerScriptSubdomain(script, false));
+            c.steps.push(`Turned off the workers.dev address of ${script}`);
+        }
+        let host = input.app.host;
+        if (onPlatformZone(input.app.host)) {
+            const subdomain = await c.call('address', 'read your workers.dev name', () => c.cf.getWorkersSubdomain());
+            if (subdomain)
+                host = `${script}.${subdomain}.workers.dev`;
+            else
+                c.steps.push('Your account has no workers.dev name, so there was no workers.dev address to remove');
+        }
+        else {
+            const zone = await c.call('address', `find ${domainOf(input.app.host)} in your account`, () => c.cf.findZoneByApex(input.app.host));
+            if (!zone) {
+                c.steps.push(`${domainOf(input.app.host)} is not in your Cloudflare account, so there was no route to remove`);
+            }
+            else {
+                const routes = await c.call('address', `read the routes of ${zone.name}`, () => c.cf.listWorkerRoutes(zone.id));
+                for (const route of routes.filter((r) => r.script === script)) {
+                    await c.call('address', `remove the route ${route.pattern}`, () => c.cf.deleteWorkerRoute(zone.id, route.id));
+                    c.steps.push(`Removed the route ${route.pattern}`);
+                }
+                // The record may serve another Worker's route on the same name: then it stays.
+                const shared = routes.some((r) => r.script !== undefined &&
+                    r.script !== script &&
+                    routeCoversHost(r.pattern, input.app.host));
+                const records = await c.call('address', `read the DNS records of ${input.app.host}`, () => c.cf.listDnsRecords(zone.id, { name: input.app.host }));
+                for (const record of records) {
+                    if (record.type !== WORKER_APP_DNS_RECORD.type ||
+                        record.content !== WORKER_APP_DNS_RECORD.content) {
+                        continue;
+                    }
+                    if (shared) {
+                        c.steps.push(`Kept the DNS record of ${input.app.host}: another Worker’s route uses it`);
+                        continue;
+                    }
+                    await c.call('address', `remove the DNS record of ${input.app.host}`, () => c.cf.deleteDnsRecord(zone.id, record.id));
+                    c.steps.push(`Removed the DNS record of ${input.app.host}`);
+                }
+            }
+        }
+        const [namespaces, apps] = await Promise.all([
+            c.call('remove', 'read the app’s Durable Objects', () => c.cf.listDurableObjectNamespaces()),
+            c.call('remove', 'read your container applications', () => c.cf.listContainerApplications()),
+        ]);
+        const ours = new Set(namespaces.filter((ns) => ns.script === script).map((ns) => ns.id));
+        for (const app of apps.filter((a) => ours.has(a.namespaceId))) {
+            await c.call('remove', `remove the container ${app.name}`, () => c.cf.deleteContainerApplication(app.id));
+            c.steps.push(`Removed the container ${app.name}`);
+        }
+        if (exists) {
+            await c.call('remove', `remove the Worker ${script}`, () => c.cf.deleteWorkerScript(script));
+            c.steps.push(`Removed the Worker ${script} and its secrets`);
+        }
+        else {
+            c.steps.push(`The Worker ${script} was already gone`);
+        }
+        // After the script: Cloudflare refuses to delete a config a live Worker binds.
+        await deleteHyperdrive(c, 'database', script);
+        // Last: a copy that failed to go halfway is still behind its gate.
+        await ensureGate(c, host, script, null);
+        return `https://${host}`;
+    }, ctx, [input.account.token]);
+}