data-collection-framework 0.1.0__py3-none-any.whl

dcf/engine/transforms.py

@@ -0,0 +1,41 @@
+from __future__ import annotations
+
+from typing import Any
+
+from ..config.models import ArrayJoinTransform, CrsReprojectTransform, Transform
+from .fetcher import _get_nested
+
+
+def apply_transform(transform: Transform, record: dict) -> Any:
+    if isinstance(transform, CrsReprojectTransform):
+        return _crs_reproject(transform, record)
+    if isinstance(transform, ArrayJoinTransform):
+        return _array_join(transform, record)
+    raise ValueError(f"Unknown transform type: {type(transform)}")
+
+
+def _array_join(t: ArrayJoinTransform, record: dict) -> str | None:
+    value = _get_nested(record, t.path)
+    if value is None:
+        return None
+    if not isinstance(value, list):
+        return str(value)
+    return t.separator.join(str(item) for item in value)
+
+
+def _crs_reproject(t: CrsReprojectTransform, record: dict) -> float | None:
+    from pyproj import Transformer as ProjTransformer
+
+    try:
+        raw_x = record.get(t.from_columns[0])
+        raw_y = record.get(t.from_columns[1])
+        if raw_x is None or raw_y is None:
+            return None
+        x = float(raw_x)
+        y = float(raw_y)
+    except (TypeError, ValueError):
+        return None
+
+    proj = ProjTransformer.from_crs(t.from_crs, t.to_crs, always_xy=True)
+    lon, lat = proj.transform(x, y)
+    return lon if t.component == "x" else lat

dcf/gcp/_collector_utils.py

@@ -0,0 +1,87 @@
+"""Shared schema projection utilities used by both beam_runner (GCP/Dataflow)
+and local_stream_runner (local Kafka)."""
+
+from __future__ import annotations
+
+import json
+import logging
+from datetime import datetime, timezone
+from pathlib import Path
+
+import pyarrow as pa
+import yaml
+
+logger = logging.getLogger(__name__)
+
+TYPE_MAP: dict[str, pa.DataType] = {
+    "string": pa.string(),
+    "integer": pa.int64(),
+    "float": pa.float64(),
+    "boolean": pa.bool_(),
+    "timestamp": pa.timestamp("us", tz="UTC"),
+    "date": pa.date32(),
+}
+
+
+def load_columns(collector_name: str) -> list[dict]:
+    path = Path("collectors") / f"{collector_name}.yml"
+    data = yaml.safe_load(path.read_text())
+    return data["schema"]["columns"]
+
+
+def to_pyarrow_schema(columns: list[dict]) -> pa.Schema:
+    fields = [
+        pa.field(col["name"], TYPE_MAP.get(col.get("type", "string"), pa.string()))
+        for col in columns
+    ]
+    return pa.schema(fields)
+
+
+def cast_value(value, col_type: str | None):
+    if value is None:
+        return None
+    if col_type == "integer":
+        return int(value)
+    if col_type == "float":
+        return float(value)
+    if col_type == "boolean":
+        return bool(value)
+    if col_type == "timestamp":
+        if isinstance(value, str):
+            for fmt in ("%Y-%m-%dT%H:%M:%SZ", "%Y-%m-%dT%H:%M:%S.%fZ", "%Y-%m-%dT%H:%M:%S%z"):
+                try:
+                    dt = datetime.strptime(value.rstrip("Z") + "+00:00", fmt.replace("Z", "%z"))
+                    return dt.astimezone(timezone.utc)
+                except ValueError:
+                    continue
+        return value
+    if col_type == "date":
+        if isinstance(value, str):
+            try:
+                return datetime.strptime(value, "%Y-%m-%d").date()
+            except ValueError:
+                return value
+        return value
+    return str(value) if value is not None else None
+
+
+def project_message(msg_bytes: bytes, columns: list[dict]) -> dict | None:
+    try:
+        record = json.loads(msg_bytes.decode("utf-8"))
+    except (json.JSONDecodeError, UnicodeDecodeError):
+        logger.warning("Skipping unparseable message")
+        return None
+
+    row: dict = {}
+    for col in columns:
+        path = col.get("path") or col["name"]
+        parts = path.split(".")
+        val = record
+        for part in parts:
+            if isinstance(val, dict):
+                val = val.get(part)
+            else:
+                val = None
+                break
+        row[col["name"]] = cast_value(val, col.get("type"))
+    return row

dcf/gcp/auth.py

@@ -0,0 +1 @@
+# Replaced by api/gcp/gcloud.py

dcf/gcp/batch_deploy.py

@@ -0,0 +1,548 @@
+"""Batch collector deployment: builds a container image via Cloud Build, then uses
+Terraform to provision a Cloud Run job. DAG is written directly to GCS for the
+custom Airflow stack (no Cloud Composer)."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import logging
+import os
+import secrets
+import shutil
+import subprocess
+from datetime import datetime, timezone
+from pathlib import Path
+
+import yaml
+
+logger = logging.getLogger(__name__)
+
+_DCF_PKG_DIR = Path(__file__).parent.parent          # dcf/ package
+_DCF_REPO_ROOT = _DCF_PKG_DIR.parent
+_BATCH_MODULE_DIR = _DCF_PKG_DIR / "infra" / "modules" / "batch_collector"
+_BUILD_DIR = Path.home() / ".dcf" / "build"
+_TF_PLUGIN_CACHE = Path.home() / ".dcf" / ".plugin-cache"
+
+
+def _tf_state_dir(project_root: Path) -> Path:
+    """Return the Terraform state directory for this project.
+
+    Defaults to <project_root>/.dcf/terraform; can be overridden with
+    `terraform_state_dir` in project.yml.
+    """
+    cfg_path = project_root / "project.yml"
+    if cfg_path.exists():
+        cfg = yaml.safe_load(cfg_path.read_text()) or {}
+        custom = cfg.get("terraform_state_dir")
+        if custom:
+            return Path(custom).expanduser()
+    return project_root / ".dcf" / "terraform"
+
+
+def _write_pyproject_toml(dest: Path) -> None:
+    repo_pyproject = _DCF_REPO_ROOT / "pyproject.toml"
+    if repo_pyproject.exists():
+        shutil.copy2(repo_pyproject, dest / "pyproject.toml")
+        return
+
+    import importlib.metadata
+
+    meta = importlib.metadata.metadata("dcf")
+    version = meta["Version"]
+    reqs = importlib.metadata.requires("dcf") or []
+    direct_deps = [r for r in reqs if "extra ==" not in r]
+    deps_str = "\n".join(f'    "{r}",' for r in direct_deps)
+    (dest / "pyproject.toml").write_text(
+        f'[project]\n'
+        f'name = "dcf"\n'
+        f'version = "{version}"\n'
+        f'requires-python = ">=3.12"\n'
+        f'dependencies = [\n{deps_str}\n]\n\n'
+        f'[project.scripts]\n'
+        f'dcf = "dcf.cli:app"\n\n'
+        f'[tool.setuptools.packages.find]\n'
+        f'include = ["dcf*"]\n'
+    )
+
+
+# ------------------------------------------------------------------ #
+# Public API                                                           #
+# ------------------------------------------------------------------ #
+
+def deploy(
+    collector_name: str,
+    schedule: str,
+    paused: bool,
+    project_root: Path,
+    gcp_config: dict,
+) -> dict:
+    """Provision a Cloud Run job for a collector via Terraform, write DAG to GCS,
+    and provision the GCP Airflow stack (Cloud Run + Cloud SQL) if needed.
+
+    Returns the deployment state dict to write into project.yml.
+    """
+    project_id = gcp_config["project_id"]
+    region = gcp_config["region"]
+    warehouse_bucket = gcp_config["warehouse_bucket"]
+    sa_email = gcp_config["sa_email"]
+
+    image_uri = _image_uri(project_id, region, collector_name)
+
+    print(f"  Syncing build context for '{collector_name}'...", flush=True)
+    build_context = _sync_build_context(project_root, collector_name, gcp_config)
+    content_hash = _content_hash(build_context)
+
+    print(f"  Ensuring Artifact Registry repository exists...", flush=True)
+    _ensure_artifact_registry_repo(project_id, region)
+
+    print(f"  Applying Terraform (Cloud Run job + Cloud Build)...", flush=True)
+    print(f"  (First build may take a few minutes)", flush=True)
+    job_name = _terraform_apply_collector(
+        collector_name=collector_name,
+        image_uri=image_uri,
+        sa_email=sa_email,
+        build_context=build_context,
+        content_hash=content_hash,
+        project_id=project_id,
+        region=region,
+        project_root=project_root,
+    )
+
+    print(f"  Writing DAG to GCS...", flush=True)
+    dag_content = _gcp_dag_content(
+        collector_name=collector_name,
+        schedule=schedule,
+        paused=paused,
+        project_id=project_id,
+        region=region,
+        job_name=job_name,
+    )
+    _write_dag_gcs(dag_content, collector_name, warehouse_bucket)
+
+    print(f"  Provisioning GCP Airflow stack...", flush=True)
+    credentials = _generate_airflow_credentials(project_root)
+    airflow_outputs = _tf_apply_airflow_gcp(
+        build_context=_airflow_build_context(),
+        image_uri=_airflow_image_uri(project_id, region),
+        content_hash=_airflow_content_hash(),
+        gcp_config=gcp_config,
+        credentials=credentials,
+        project_root=project_root,
+    )
+
+    airflow_url = airflow_outputs.get("webserver_url", {}).get("value", "")
+    if airflow_url:
+        print(f"  Airflow UI: {airflow_url}", flush=True)
+
+    return {
+        "schedule": schedule,
+        "dag_id": collector_name,
+        "cloud_run_job": job_name,
+        "airflow_url": airflow_url,
+        "image_uri": image_uri,
+        "deployed_at": datetime.now(tz=timezone.utc).isoformat(timespec="seconds"),
+    }
+
+
+def undeploy(collector_name: str, deployment: dict, gcp_config: dict, project_root: Path) -> None:
+    """Remove the Cloud Run job via Terraform destroy and delete the DAG from GCS."""
+    project_id = gcp_config["project_id"]
+    region = gcp_config["region"]
+    warehouse_bucket = gcp_config["warehouse_bucket"]
+
+    print(f"  Destroying Terraform resources for '{collector_name}'...", flush=True)
+    _terraform_destroy_collector(collector_name, project_id, region, project_root)
+
+    print(f"  Deleting DAG from GCS...", flush=True)
+    _delete_dag_gcs(collector_name, warehouse_bucket)
+
+    if not _gcs_dag_files_exist(warehouse_bucket):
+        print(f"  No remaining DAGs — tearing down Airflow stack...", flush=True)
+        _tf_destroy_airflow_gcp(project_root)
+
+
+# ------------------------------------------------------------------ #
+# Build context                                                        #
+# ------------------------------------------------------------------ #
+
+def _image_uri(project_id: str, region: str, collector_name: str) -> str:
+    return f"{region}-docker.pkg.dev/{project_id}/dcf-runner/{collector_name}:latest"
+
+
+def _sync_build_context(
+    project_root: Path, collector_name: str, gcp_config: dict
+) -> Path:
+    """Create a stable build context dir at ~/.dcf/build/gcp/<name>/."""
+    build_context = _BUILD_DIR / "gcp" / collector_name
+    shutil.rmtree(build_context, ignore_errors=True)
+    build_context.mkdir(parents=True)
+
+    shutil.copytree(_DCF_PKG_DIR, build_context / "dcf")
+    _write_pyproject_toml(build_context)
+
+    for subdir in ("collectors", "connectors"):
+        src = project_root / subdir
+        dst = build_context / subdir
+        if src.exists():
+            shutil.copytree(src, dst)
+        else:
+            dst.mkdir()
+
+    minimal_config = {
+        "catalog": "gcp",
+        "gcp": {
+            "project_id": gcp_config["project_id"],
+            "region": gcp_config["region"],
+            "warehouse_bucket": gcp_config["warehouse_bucket"],
+        },
+    }
+    (build_context / "project.yml").write_text(
+        yaml.dump(minimal_config, default_flow_style=False)
+    )
+
+    return build_context
+
+
+def _content_hash(build_context: Path) -> str:
+    """SHA256 of all files in build_context, excluding Dockerfile (written by Terraform)."""
+    h = hashlib.sha256()
+    for path in sorted(build_context.rglob("*")):
+        if path.is_file() and path.name != "Dockerfile":
+            h.update(path.read_bytes())
+    return h.hexdigest()
+
+
+# ------------------------------------------------------------------ #
+# Terraform: per-collector resources                                   #
+# ------------------------------------------------------------------ #
+
+def _expected_job_name(collector_name: str) -> str:
+    return f"dcf-job-{collector_name.replace('_', '-')}"
+
+
+def _tf_work_dir(collector_name: str, project_root: Path) -> Path:
+    return _tf_state_dir(project_root) / "collectors" / collector_name / "gcp"
+
+
+def _copy_module_to_work_dir(module_dir: Path, work_dir: Path) -> None:
+    """Copy a leaf Terraform module's .tf files + shared templates into work_dir."""
+    for item in module_dir.iterdir():
+        if item.name in (".terraform", ".terraform.lock.hcl"):
+            continue
+        if item.is_file() and item.suffix == ".tf":
+            shutil.copy2(item, work_dir / item.name)
+    templates_src = _DCF_PKG_DIR / "infra" / "templates"
+    templates_dst = work_dir / "templates"
+    if templates_dst.exists():
+        shutil.rmtree(templates_dst)
+    shutil.copytree(templates_src, templates_dst)
+
+
+def _tf_env() -> dict:
+    return {
+        **os.environ,
+        "TF_INPUT": "0",
+        "TF_PLUGIN_CACHE_DIR": str(_TF_PLUGIN_CACHE),
+    }
+
+
+def _tf_run(cmd: list[str], work_dir: Path, env: dict) -> None:
+    result = subprocess.run(cmd, cwd=str(work_dir), env=env, capture_output=True, text=True)
+    if result.returncode != 0:
+        logger.error(
+            "Terraform command failed: %s\nSTDOUT: %s\nSTDERR: %s",
+            " ".join(cmd), result.stdout, result.stderr,
+        )
+        raise RuntimeError(
+            f"terraform {cmd[1]} failed (exit {result.returncode}): {result.stderr[-2000:]}"
+        )
+    logger.info("terraform %s OK", cmd[1])
+
+
+def _terraform_apply_collector(
+    collector_name: str,
+    image_uri: str,
+    sa_email: str,
+    build_context: Path,
+    content_hash: str,
+    project_id: str,
+    region: str,
+    project_root: Path,
+) -> str:
+    """Provision Cloud Run job via Terraform + Cloud Build. Returns the job name."""
+    work_dir = _tf_work_dir(collector_name, project_root)
+    work_dir.mkdir(parents=True, exist_ok=True)
+    _TF_PLUGIN_CACHE.mkdir(parents=True, exist_ok=True)
+
+    _copy_module_to_work_dir(_BATCH_MODULE_DIR / "gcp", work_dir)
+
+    tfvars = {
+        "project_id": project_id,
+        "region": region,
+        "collector_name": collector_name,
+        "image_uri": image_uri,
+        "sa_email": sa_email,
+        "build_context": str(build_context),
+        "content_hash": content_hash,
+        "java_enabled": False,
+    }
+    (work_dir / "terraform.tfvars.json").write_text(json.dumps(tfvars, indent=2))
+
+    env = _tf_env()
+    _tf_run(["terraform", "init", "-reconfigure"], work_dir, env)
+    _import_existing_cloud_run_job(collector_name, project_id, region, work_dir, env)
+    _tf_run(["terraform", "apply", "-auto-approve"], work_dir, env)
+
+    outputs = json.loads(
+        subprocess.run(
+            ["terraform", "output", "-json"],
+            cwd=str(work_dir), env=env, capture_output=True, text=True,
+        ).stdout
+    )
+    return outputs["job_name"]["value"]
+
+
+def _terraform_destroy_collector(
+    collector_name: str, project_id: str, region: str, project_root: Path,
+) -> None:
+    """Destroy Cloud Run job via Terraform, then remove the state dir."""
+    work_dir = _tf_work_dir(collector_name, project_root)
+    if not work_dir.exists():
+        raise RuntimeError(
+            f"No Terraform state found for collector '{collector_name}' at {work_dir}.\n"
+            "If you deployed from a different machine, delete the Cloud Run job manually:\n"
+            f"  gcloud run jobs delete dcf-job-{collector_name.replace('_', '-')} "
+            f"--region {region} --project {project_id} --quiet"
+        )
+
+    env = _tf_env()
+    _tf_run(["terraform", "destroy", "-auto-approve"], work_dir, env)
+    shutil.rmtree(work_dir)
+
+
+def _import_existing_cloud_run_job(
+    collector_name: str, project_id: str, region: str, work_dir: Path, env: dict,
+) -> None:
+    """Import an existing Cloud Run job into Terraform state to avoid 409 on apply."""
+    job_name = _expected_job_name(collector_name)
+    check = subprocess.run(
+        ["gcloud", "run", "jobs", "describe", job_name,
+         "--region", region, "--project", project_id],
+        capture_output=True,
+    )
+    if check.returncode != 0:
+        return
+
+    resource_id = f"projects/{project_id}/locations/{region}/jobs/{job_name}"
+    result = subprocess.run(
+        ["terraform", "import", "google_cloud_run_v2_job.collector", resource_id],
+        cwd=str(work_dir), env=env, capture_output=True, text=True,
+    )
+    if result.returncode == 0:
+        logger.info("Imported existing Cloud Run job '%s' into Terraform state", job_name)
+    elif "already managed by Terraform" in result.stdout + result.stderr:
+        logger.info("Cloud Run job '%s' already in Terraform state", job_name)
+    else:
+        logger.warning("terraform import returned non-zero: %s", result.stderr[-500:])
+
+
+# ------------------------------------------------------------------ #
+# GCS DAG management                                                   #
+# ------------------------------------------------------------------ #
+
+def _dag_gcs_path(collector_name: str) -> str:
+    return f"airflow/dags/{collector_name}.py"
+
+
+def _gcp_dag_content(
+    collector_name: str, schedule: str, paused: bool,
+    project_id: str, region: str, job_name: str,
+) -> str:
+    paused_str = "True" if paused else "False"
+    return f"""\
+# Generated by dcf — do not edit manually
+from datetime import datetime
+from airflow import DAG
+from airflow.providers.google.cloud.operators.cloud_run import CloudRunExecuteJobOperator
+
+with DAG(
+    dag_id="{collector_name}",
+    schedule_interval="{schedule}",
+    start_date=datetime(2024, 1, 1),
+    catchup=False,
+    is_paused_upon_creation={paused_str},
+    tags=["dcf"],
+) as dag:
+    run_job = CloudRunExecuteJobOperator(
+        task_id="run_{collector_name}",
+        project_id="{project_id}",
+        region="{region}",
+        job_name="{job_name}",
+    )
+"""
+
+
+def _write_dag_gcs(dag_content: str, collector_name: str, warehouse_bucket: str) -> None:
+    from google.cloud import storage
+    client = storage.Client()
+    bucket = client.bucket(warehouse_bucket)
+    blob = bucket.blob(_dag_gcs_path(collector_name))
+    blob.upload_from_string(dag_content, content_type="text/plain")
+    logger.info("Uploaded DAG to gs://%s/%s", warehouse_bucket, _dag_gcs_path(collector_name))
+
+
+def _delete_dag_gcs(collector_name: str, warehouse_bucket: str) -> None:
+    from google.cloud import storage
+    client = storage.Client()
+    bucket = client.bucket(warehouse_bucket)
+    blob = bucket.blob(_dag_gcs_path(collector_name))
+    if blob.exists():
+        blob.delete()
+        logger.info("Deleted DAG gs://%s/%s", warehouse_bucket, _dag_gcs_path(collector_name))
+
+
+def _gcs_dag_files_exist(warehouse_bucket: str) -> bool:
+    """Return True if any DAG files remain in gs://<bucket>/airflow/dags/."""
+    from google.cloud import storage
+    client = storage.Client()
+    blobs = list(client.list_blobs(warehouse_bucket, prefix="airflow/dags/", max_results=1))
+    return len(blobs) > 0
+
+
+# ------------------------------------------------------------------ #
+# Artifact Registry                                                    #
+# ------------------------------------------------------------------ #
+
+def _ensure_artifact_registry_repo(project_id: str, region: str) -> None:
+    check = subprocess.run(
+        [
+            "gcloud", "artifacts", "repositories", "describe", "dcf-runner",
+            "--location", region, "--project", project_id,
+        ],
+        capture_output=True,
+    )
+    if check.returncode != 0:
+        result = subprocess.run(
+            [
+                "gcloud", "artifacts", "repositories", "create", "dcf-runner",
+                "--repository-format=docker",
+                "--location", region,
+                "--project", project_id,
+            ],
+            capture_output=True, text=True,
+        )
+        if result.returncode != 0:
+            raise RuntimeError(
+                f"Failed to create Artifact Registry repository: {result.stderr}\n"
+                "Ensure the API is enabled:\n"
+                "  gcloud services enable artifactregistry.googleapis.com"
+            )
+
+
+# ------------------------------------------------------------------ #
+# GCP Airflow stack                                                    #
+# ------------------------------------------------------------------ #
+
+def _airflow_image_uri(project_id: str, region: str) -> str:
+    return f"{region}-docker.pkg.dev/{project_id}/dcf-runner/dcf-airflow:latest"
+
+
+def _airflow_build_context() -> Path:
+    build_context = _BUILD_DIR / "airflow-gcp"
+    build_context.mkdir(parents=True, exist_ok=True)
+    return build_context
+
+
+def _airflow_content_hash() -> str:
+    template = _DCF_PKG_DIR / "infra" / "modules" / "templates" / "airflow.Dockerfile.tftpl"
+    return hashlib.sha256(template.read_bytes()).hexdigest()
+
+
+def _generate_airflow_credentials(project_root: Path) -> dict:
+    """Read/generate Airflow credentials from project.yml."""
+    cfg_path = project_root / "project.yml"
+    cfg: dict = yaml.safe_load(cfg_path.read_text()) or {} if cfg_path.exists() else {}
+
+    admin_password = cfg.get("airflow_admin_password")
+    if not admin_password:
+        import getpass
+        admin_password = getpass.getpass("Enter Airflow admin password: ").strip()
+        if not admin_password:
+            raise RuntimeError("Airflow admin password cannot be empty.")
+        cfg["airflow_admin_password"] = admin_password
+        cfg_path.write_text(yaml.dump(cfg, default_flow_style=False, sort_keys=False))
+        logger.info("Saved airflow_admin_password to project.yml")
+
+    changed = False
+
+    fernet_key = cfg.get("airflow_fernet_key")
+    if not fernet_key:
+        from cryptography.fernet import Fernet
+        fernet_key = Fernet.generate_key().decode()
+        cfg["airflow_fernet_key"] = fernet_key
+        changed = True
+
+    db_password = cfg.get("airflow_db_password")
+    if not db_password:
+        db_password = secrets.token_urlsafe(16)
+        cfg["airflow_db_password"] = db_password
+        changed = True
+
+    if changed:
+        cfg_path.write_text(yaml.dump(cfg, default_flow_style=False, sort_keys=False))
+
+    return {
+        "db_password": db_password,
+        "admin_password": admin_password,
+        "fernet_key": fernet_key,
+    }
+
+
+def _tf_apply_airflow_gcp(
+    build_context: Path,
+    image_uri: str,
+    content_hash: str,
+    gcp_config: dict,
+    credentials: dict,
+    project_root: Path,
+) -> dict:
+    work_dir = _tf_state_dir(project_root) / "airflow" / "gcp"
+    work_dir.mkdir(parents=True, exist_ok=True)
+    _TF_PLUGIN_CACHE.mkdir(parents=True, exist_ok=True)
+
+    _copy_module_to_work_dir(_BATCH_MODULE_DIR / "gcp" / "airflow", work_dir)
+
+    tfvars = {
+        "image_uri": image_uri,
+        "build_context": str(build_context),
+        "content_hash": content_hash,
+        "project_id": gcp_config["project_id"],
+        "region": gcp_config["region"],
+        "sa_email": gcp_config["sa_email"],
+        "warehouse_bucket": gcp_config["warehouse_bucket"],
+        "db_password": credentials["db_password"],
+        "admin_password": credentials["admin_password"],
+        "fernet_key": credentials["fernet_key"],
+    }
+    (work_dir / "terraform.tfvars.json").write_text(json.dumps(tfvars, indent=2))
+
+    env = _tf_env()
+    _tf_run(["terraform", "init", "-reconfigure"], work_dir, env)
+    _tf_run(["terraform", "apply", "-auto-approve"], work_dir, env)
+
+    raw = subprocess.run(
+        ["terraform", "output", "-json"],
+        cwd=str(work_dir), env=env, capture_output=True, text=True,
+    ).stdout
+    return json.loads(raw) if raw.strip() else {}
+
+
+def _tf_destroy_airflow_gcp(project_root: Path) -> None:
+    work_dir = _tf_state_dir(project_root) / "airflow" / "gcp"
+    if not work_dir.exists():
+        return
+
+    env = _tf_env()
+    _tf_run(["terraform", "destroy", "-auto-approve"], work_dir, env)
+    shutil.rmtree(work_dir)