Taskfile.yml

version: '3'

# View organization profile at: https://github.com/joeblew999?preview=true

vars:
  GITHUB_ORG: joeblew999
  # Platform detection
  OS: "{{OS}}"
  ARCH: "{{ARCH}}"
  # Platform-specific extensions
  EXE_EXT: '{{if eq OS "windows"}}.exe{{end}}'
  # Platform-specific binaries
  GH_BINARY: 'gh{{.EXE_EXT}}'
  TERRAFORM_BINARY: 'terraform{{.EXE_EXT}}'
  NATS_BINARY: 'nats{{.EXE_EXT}}'
  # Platform-specific paths
  HOME_DIR: '{{if eq OS "windows"}}{{.USERPROFILE}}{{else}}{{.HOME}}{{end}}'
  # Go CLI tools for cross-platform compatibility
  BIN_DIR: "{{.ROOT_DIR}}/.bin"
  GOJQ: "{{.BIN_DIR}}/gojq"

tasks:
  default:
    desc: List available tasks
    cmds:
      - |
        echo "🛠️  GitHub Organization Setup Tool"
        echo "Platform: {{.OS}}/{{.ARCH}}"
        echo "Organization: {{.GITHUB_ORG}}"
        echo ""
      - task --list

  setup:
    desc: Create .github structure from templates
    cmds:
      - task: clean
      - mkdir -p .github profile
      - go run cmd/github-setup/main.go -org={{.GITHUB_ORG}}

  clean:
    desc: Remove generated .github files
    cmds:
      - rm -rf .github/ISSUE_TEMPLATE .github/issue-templates .github/workflows .github/CODEOWNERS .github/dependabot.yml .github/pull_request_template.md .github/PULL_REQUEST_TEMPLATE

  check:
    desc: Check if generated files are up to date with templates
    cmds:
      - |
        echo "Checking if generated files are up to date..."
        TEMP_DIR=$(mktemp -d)
        go run cmd/github-setup/main.go -org={{.GITHUB_ORG}} -output="$TEMP_DIR"
        if ! diff -r .github "$TEMP_DIR" > /dev/null 2>&1; then
          echo "❌ Generated files are out of date. Run 'task setup' to update."
          rm -rf "$TEMP_DIR"
          exit 1
        else
          echo "✅ Generated files are up to date."
          rm -rf "$TEMP_DIR"
        fi

  install-gh:
    desc: Ensure GitHub CLI is installed (idempotent, cross-platform)
    cmds:
      - |
        echo "📦 Installing GitHub CLI for {{.OS}}/{{.ARCH}}..."
        
        if command -v {{.GH_BINARY}} >/dev/null 2>&1; then
          echo "✅ GitHub CLI already installed: $({{.GH_BINARY}} --version | {{.GOJQ}} -Rs 'split("\n")[0]')"
        else
          echo "📦 Installing GitHub CLI..."
          
          {{if eq .OS "darwin"}}
          # macOS via Homebrew
          if command -v brew >/dev/null 2>&1; then
            brew install gh
          else
            echo "❌ Homebrew not found. Install from: https://brew.sh/"
            exit 1
          fi
          
          {{else if eq .OS "linux"}}
          # Linux via package manager
          if command -v apt >/dev/null 2>&1; then
            # Debian/Ubuntu
            curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
            echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
            sudo apt update && sudo apt install gh
          elif command -v yum >/dev/null 2>&1; then
            # RHEL/CentOS/Fedora
            sudo yum install -y yum-utils
            sudo yum-config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo
            sudo yum install gh
          elif command -v pacman >/dev/null 2>&1; then
            # Arch Linux
            sudo pacman -S github-cli
          else
            echo "❌ Unsupported Linux distribution. Install manually: https://cli.github.com/"
            exit 1
          fi
          
          {{else if eq .OS "windows"}}
          # Windows via package manager
          if command -v choco >/dev/null 2>&1; then
            choco install gh
          elif command -v scoop >/dev/null 2>&1; then
            scoop install gh
          elif command -v winget >/dev/null 2>&1; then
            winget install --id GitHub.cli
          else
            echo "❌ No package manager found (choco/scoop/winget). Install from: https://cli.github.com/"
            exit 1
          fi
          
          {{else}}
          echo "❌ Unsupported OS: {{.OS}}. Please install GitHub CLI manually: https://cli.github.com/"
          exit 1
          {{end}}
          
          echo "✅ GitHub CLI installed: $({{.GH_BINARY}} --version | {{.GOJQ}} -Rs 'split("\n")[0]')"
        fi

  verify-github:
    desc: Verify repository state on GitHub matches local templates
    deps: [install-gh]
    cmds:
      - |
        echo "🔍 Verifying GitHub repository state..."
        
        # Check if repo exists and is accessible
        if ! gh repo view {{.GITHUB_ORG}}/.github >/dev/null 2>&1; then
          echo "❌ Cannot access repository {{.GITHUB_ORG}}/.github"
          exit 1
        fi
        
        echo "✅ Repository {{.GITHUB_ORG}}/.github is accessible"
        
        # Check if workflows are enabled
        echo "📋 Checking workflows..."
        gh workflow list --repo {{.GITHUB_ORG}}/.github
        
        # Check if issues/PRs use our templates
        echo "📝 Checking if templates are active..."
        echo "  Issue templates:"
        gh api repos/{{.GITHUB_ORG}}/.github/contents/.github/ISSUE_TEMPLATE --jq '.[].name' 2>/dev/null || \
        gh api repos/{{.GITHUB_ORG}}/.github/contents/.github/issue-templates --jq '.[].name' 2>/dev/null || \
        echo "    No issue templates found"
        
        # Check organization profile
        echo "🏢 Organization profile:"
        gh api orgs/{{.GITHUB_ORG}} --jq '.name // .login' 2>/dev/null || \
        echo "    Organization API requires admin:org scope"
        
        # Check if dependabot is configured
        echo "🤖 Checking Dependabot configuration..."
        if gh api repos/{{.GITHUB_ORG}}/.github/contents/.github/dependabot.yml >/dev/null 2>&1; then
          echo "✅ Dependabot configuration found"
        else
          echo "❌ Dependabot configuration not found"
        fi
        
        echo "✅ GitHub verification complete"

  validate-all:
    desc: Run all validation checks (local + GitHub)
    cmds:
      - task: check
      - task: verify-github

  status:
    desc: Show current system status and health
    cmds:
      - |
        echo "🏢 GitHub Organization: {{.GITHUB_ORG}}"
        echo "📁 Repository: https://github.com/{{.GITHUB_ORG}}/.github"
        echo "🌍 Platform: {{.OS}}/{{.ARCH}}"
        echo ""
        echo "📊 System Status:"
        
        # Check if files are generated
        if [ -d ".github" ]; then
          echo "✅ Generated files exist"
        else
          echo "❌ Generated files missing - run 'task setup'"
        fi
        
        # Check if files are up to date (quick check)
        if task check >/dev/null 2>&1; then
          echo "✅ Generated files are up to date"
        else
          echo "⚠️  Generated files may be out of date - run 'task check' for details"
        fi
        
        # Check Go module
        if go mod verify >/dev/null 2>&1; then
          echo "✅ Go module verified"
        else
          echo "❌ Go module issues - run 'go mod tidy'"
        fi
        
        # Platform-aware GitHub CLI check
        if command -v {{.GH_BINARY}} >/dev/null 2>&1; then
          echo "✅ GitHub CLI available: $({{.GH_BINARY}} --version | {{.GOJQ}} -Rs 'split("\n")[0] | split(" ")[2]')"
        else
          echo "❌ GitHub CLI not installed - run 'task install-gh'"
        fi
        
        # Platform-specific checks
        {{if eq .OS "darwin"}}
        # macOS specific checks
        if command -v brew >/dev/null 2>&1; then
          echo "✅ Homebrew available"
        else
          echo "⚠️  Homebrew not installed (recommended for macOS)"
        fi
        {{else if eq .OS "linux"}}
        # Linux specific checks
        if systemctl --version >/dev/null 2>&1; then
          echo "✅ Systemd available"
        else
          echo "ℹ️  Systemd not available (using alternative service management)"
        fi
        {{else if eq .OS "windows"}}
        # Windows specific checks  
        if command -v choco >/dev/null 2>&1; then
          echo "✅ Chocolatey available"
        elif command -v scoop >/dev/null 2>&1; then
          echo "✅ Scoop available"
        elif command -v winget >/dev/null 2>&1; then
          echo "✅ Winget available"
        else
          echo "⚠️  No package manager found (consider installing Chocolatey/Scoop/Winget)"
        fi
        {{end}}

  dev:
    desc: Development workflow - clean, setup, and check
    cmds:
      - echo "🚀 Running development workflow..."
      - task: clean
      - task: setup
      - task: check
      - echo "✅ Development workflow complete"

  help:
    desc: Show detailed help and usage examples
    cmds:
      - |
        echo "🛠️  GitHub Organization Setup Tool"
        echo "=================================="
        echo ""
        echo "📋 Quick Start:"
        echo "  task setup     # Generate all files"
        echo "  task status    # Check system health"
        echo "  task dev       # Development workflow"
        echo ""
        echo "🔍 Validation:"
        echo "  task check           # Check local files vs templates"
        echo "  task verify-github   # Check GitHub state"
        echo "  task validate-all    # Run all checks"
        echo ""
        echo "🧹 Maintenance:"
        echo "  task clean       # Remove generated files"
        echo "  task install-gh  # Install GitHub CLI"
        echo ""
        echo "🚀 NATS Integration:"
        echo "  task nats-monitor        # Monitor NATS-powered workflows"
        echo "  task nats-deploy         # Deploy NATS infrastructure"
        echo "  task nats-scale          # Scale NATS infrastructure"
        echo "  task nats-controller     # Run NATS controller locally"
        echo ""
        echo "🐝 Bee Integration:"
        echo "  task bee-install         # Install bee event system"
        echo "  task bee-generate        # Generate handlers from protobuf"
        echo "  task bee-run             # Run bee orchestrator"
        echo "  task bee-validate        # Validate schemas and config"
        echo "  task bee-demo            # Show bee capabilities"
        echo ""
        echo "🌍 Cross-Platform:"
        echo "  task test-platform       # Test cross-platform compatibility"
        echo "  Platform: {{.OS}}/{{.ARCH}}   # Current platform"
        echo ""
        echo "📖 Documentation:"
        echo "  README.md        # Architecture and patterns"
        echo "  CONTRIBUTING.md  # Contribution guidelines"
        echo ""
        echo "🌐 Links:"
        echo "  Repository: https://github.com/{{.GITHUB_ORG}}/.github"
        echo "  Profile:    https://github.com/{{.GITHUB_ORG}}?preview=true"
        echo "  Workflows:  https://github.com/{{.GITHUB_ORG}}/.github/actions"

  # Bootstrap tasks
  bootstrap:
    desc: "Bootstrap GitHub organization for self-management (handles sequencing and race conditions)"
    cmds:
      - ./bootstrap.sh
    deps: [check-prerequisites]

  bootstrap-dev:
    desc: "Bootstrap in development mode with embedded NATS"
    env:
      BOOTSTRAP_MODE: dev
      NATS_DEPLOYMENT_TYPE: self_hosted
    cmds:
      - ./bootstrap.sh --mode dev

  bootstrap-synadia:
    desc: "Bootstrap with Synadia Cloud NATS"
    env:
      BOOTSTRAP_MODE: auto
      NATS_DEPLOYMENT_TYPE: synadia_cloud
    cmds:
      - ./bootstrap.sh --nats-type synadia_cloud
    preconditions:
      - sh: '[ -n "${SYNADIA_CREDS_FILE:-}" ] || [ -n "${SYNADIA_JWT:-}" ]'
        msg: "Synadia Cloud credentials required (SYNADIA_CREDS_FILE or SYNADIA_JWT)"

  check-prerequisites:
    desc: "Check system prerequisites for bootstrap"
    cmds:
      - |
        echo "🔍 Checking prerequisites..."
        missing_tools=()
        
        command -v git >/dev/null 2>&1 || missing_tools+=("git")
        command -v go >/dev/null 2>&1 || missing_tools+=("go")
        command -v docker >/dev/null 2>&1 || missing_tools+=("docker")
        
        if [ ${#missing_tools[@]} -ne 0 ]; then
          echo "❌ Missing required tools: ${missing_tools[*]}"
          exit 1
        fi
        
        echo "✅ All prerequisites satisfied"
    silent: true

  nats-bootstrap:
    desc: "Start embedded NATS server for development/bootstrap"
    cmds:
      - go run cmd/nats-bootstrap/main.go

  nats-test-connection:
    desc: "Test NATS connectivity"
    cmds:
      - |
        if command -v nats >/dev/null 2>&1; then
          echo "Testing NATS connectivity..."
          nats --server="${NATS_URLS:-nats://localhost:4222}" pub test.connection "Test message $(date)"
          echo "✅ NATS connectivity test passed"
        else
          echo "⚠️ NATS CLI not found - install with: go install github.com/nats-io/natscli/nats@latest"
        fi

  monitor-workflow:
    desc: Monitor GitHub Actions workflow execution
    cmds:
      - |
        echo "🔍 Monitoring GitHub Actions workflow for template changes..."
        echo "This script monitors the full cycle: template change → GitHub Actions → file regeneration"
        echo ""
        ./monitor-workflow.sh

  monitor-nats:
    desc: Monitor workflow using NATS (requires NATS server)
    cmds:
      - |
        echo "🚀 NATS-enhanced workflow monitoring"
        echo "This demonstrates advanced patterns for workflow orchestration"
        echo ""
        ./nats-monitor.sh check

  nats-demo:
    desc: Show NATS enhanced workflow capabilities
    cmds:
      - |
        echo "🌟 NATS Enhanced GitHub Workflow Demonstration"
        echo "=============================================="
        echo ""
        ./nats-monitor.sh demo

  nats-controller:
    desc: Start the NATS-based workflow controller (requires NATS server)
    cmds:
      - |
        echo "🎛️  Starting NATS workflow controller..."
        go mod download
        go run cmd/nats-controller/main.go

  nats-monitor:
    desc: Monitor NATS-powered GitHub workflows
    cmds:
      - |
        echo "🔍 NATS Workflow Monitor for {{.GITHUB_ORG}}"
        echo "==========================================="
        
        if [ -f "nats-monitor.sh" ]; then
          chmod +x nats-monitor.sh
          ./nats-monitor.sh
        else
          echo "❌ nats-monitor.sh not found"
          echo "   This would connect to Synadia Cloud and monitor:"
          echo "   • github.{{.GITHUB_ORG}}.template_changed"
          echo "   • github.{{.GITHUB_ORG}}.workflow_status"
          echo "   • github.{{.GITHUB_ORG}}.regeneration_requested"
          echo ""
          echo "   To enable NATS monitoring:"
          echo "   1. Sign up for Synadia Cloud"
          echo "   2. Configure credentials"
          echo "   3. Run: task nats-deploy"
        fi

  nats-deploy:
    desc: Deploy NATS infrastructure using Terraform
    cmds:
      - |
        echo "🚀 Deploying NATS Infrastructure"
        echo "================================"
        
        if ! command -v terraform >/dev/null 2>&1; then
          echo "❌ Terraform not installed"
          echo "   Install from: https://www.terraform.io/downloads"
          exit 1
        fi
        
        cd terraform
        
        echo "📋 Initializing Terraform..."
        terraform init
        
        echo "📋 Planning NATS infrastructure..."
        terraform plan -var="github_org={{.GITHUB_ORG}}"
        
        echo ""
        echo "To apply:"
        echo "  cd terraform && terraform apply -var='github_org={{.GITHUB_ORG}}'"

  nats-scale:
    desc: Scale NATS infrastructure based on load
    cmds:
      - |
        echo "📈 NATS Infrastructure Scaling"
        echo "=============================="
        
        echo "This would:"
        echo "1. Check current GitHub event load"
        echo "2. Analyze NATS queue depths"
        echo "3. Trigger Terraform for additional capacity"
        echo "4. Auto-configure new NATS nodes"
        echo ""
        echo "Example scaling triggers:"
        echo "• Queue depth > 1000 messages"
        echo "• Processing latency > 30 seconds"
        echo "• GitHub API rate limit approaching"
        echo ""
        echo "Self-similar pattern: NATS controllers deploy more NATS!"

  nats-controller:
    desc: Run NATS controller locally for development
    cmds:
      - |
        echo "🤖 Starting Local NATS Controller"
        echo "================================="
        
        if [ ! -f "cmd/nats-controller/main.go" ]; then
          echo "❌ NATS controller not found"
          exit 1
        fi
        
        echo "📋 Environment:"
        echo "  GITHUB_ORG: {{.GITHUB_ORG}}"
        echo "  NATS_URL: ${NATS_URL:-nats://localhost:4222}"
        echo ""
        
        if ! command -v {{.NATS_BINARY}} >/dev/null 2>&1; then
          echo "⚠️  NATS CLI not installed"
          echo "   Install from: https://github.com/nats-io/natscli"
          echo "   Or use Docker: docker run natsio/nats-server"
        fi
        
        echo "🚀 Starting controller..."
        go run cmd/nats-controller/main.go

  bee-install:
    desc: Install bee for event-driven GitHub workflows
    cmds:
      - |
        echo "🐝 Installing bee for event-driven workflows"
        echo "============================================"
        
        if command -v bee >/dev/null 2>&1; then
          echo "✅ bee already installed: $(bee version)"
        else
          echo "📦 Installing bee..."
          go install github.com/blinkinglight/bee/cmd/bee@latest
          
          if command -v bee >/dev/null 2>&1; then
            echo "✅ bee installed: $(bee version)"
          else
            echo "❌ bee installation failed"
            echo "   Try manual installation: https://github.com/blinkinglight/bee"
            exit 1
          fi
        fi

  bee-generate:
    desc: Generate bee handlers from protobuf schemas
    deps: [bee-install]
    cmds:
      - |
        echo "🔧 Generating bee handlers from protobuf schemas"
        echo "==============================================="
        
        if [ ! -f "schemas/github_events.proto" ]; then
          echo "❌ Protobuf schema not found: schemas/github_events.proto"
          exit 1
        fi
        
        echo "📋 Generating Go code from protobuf..."
        
        # Create output directory
        mkdir -p pkg/events/v1
        
        # Generate protobuf Go code
        if command -v protoc >/dev/null 2>&1; then
          protoc --go_out=pkg/events/v1 --go_opt=paths=source_relative schemas/github_events.proto
          echo "✅ Protobuf Go code generated"
        else
          echo "⚠️  protoc not installed, skipping protobuf generation"
          echo "   Install from: https://protobuf.dev/downloads/"
        fi
        
        echo "🐝 Generating bee handlers..."
        bee generate --config bee.yaml
        
        echo "✅ bee handler generation complete"

  bee-run:
    desc: Run bee-powered GitHub workflow orchestrator
    deps: [bee-generate]
    cmds:
      - |
        echo "🐝 Starting bee GitHub Workflow Orchestrator"
        echo "==========================================="
        
        if [ ! -f "bee.yaml" ]; then
          echo "❌ bee configuration not found: bee.yaml"
          exit 1
        fi
        
        echo "📋 Configuration:"
        echo "  GITHUB_ORG: {{.GITHUB_ORG}}"
        echo "  NATS_URL: ${NATS_URL:-nats://localhost:4222}"
        echo "  Config: bee.yaml"
        echo ""
        
        echo "🚀 Starting bee orchestrator..."
        bee run --config bee.yaml

  bee-validate:
    desc: Validate bee configuration and schemas
    deps: [bee-install]
    cmds:
      - |
        echo "🔍 Validating bee configuration and schemas"
        echo "=========================================="
        
        if [ ! -f "bee.yaml" ]; then
          echo "❌ bee configuration not found: bee.yaml"
          exit 1
        fi
        
        echo "📋 Validating bee.yaml configuration..."
        bee validate --config bee.yaml
        
        if [ -f "schemas/github_events.proto" ]; then
          echo "📋 Validating protobuf schema..."
          if command -v protoc >/dev/null 2>&1; then
            protoc --descriptor_set_out=/dev/null schemas/github_events.proto
            echo "✅ Protobuf schema is valid"
          else
            echo "⚠️  protoc not installed, skipping schema validation"
          fi
        fi
        
        echo "✅ All validations passed"

  bee-demo:
    desc: Demonstrate bee integration capabilities
    cmds:
      - |
        echo "🌟 Bee + NATS + GitHub Integration Demo"
        echo "======================================"
        echo ""
        echo "🐝 Bee brings to our GitHub workflow orchestration:"
        echo ""
        echo "📋 Type-Safe Event Handling:"
        echo "  • Protobuf schemas define all GitHub events"
        echo "  • Generated Go handlers with compile-time safety"
        echo "  • Schema evolution without breaking changes"
        echo ""
        echo "🔄 Event-Driven Architecture:"
        echo "  • GitHub webhooks → Protobuf events → NATS → bee handlers"
        echo "  • Terraform operations triggered by events"
        echo "  • Self-healing infrastructure through event sourcing"
        echo ""
        echo "🚀 Advanced Features:"
        echo "  • Built-in metrics and tracing"
        echo "  • Event replay for debugging"
        echo "  • Rate limiting and backpressure"
        echo "  • Multi-language support (Go, Rust, Python)"
        echo ""
        echo "🔧 Self-Terraforming Pattern:"
        echo "  • bee handlers detect infrastructure needs"
        echo "  • Automatically trigger Terraform operations"
        echo "  • NATS controllers deploy more NATS infrastructure"
        echo "  • Self-similar scaling across regions"
        echo ""
        echo "📊 Observability:"
        echo "  • Prometheus metrics for all events"
        echo "  • Jaeger tracing for distributed debugging"
        echo "  • Structured logging with correlation IDs"
        echo ""
        echo "🌐 Getting Started:"
        echo "  task bee-install     # Install bee"
        echo "  task bee-generate    # Generate handlers"
        echo "  task bee-run         # Start orchestrator"
        echo ""
        echo "This represents the next evolution of GitHub workflow"
        echo "orchestration - event-driven, type-safe, and infinitely scalable! 🐝🚀"

  # =============================================================================
  # Cloudflare Integration Tasks
  # =============================================================================

  cloudflare:setup:
    desc: "Setup Cloudflare integration (R2 + Containers)"
    cmds:
      - task: cloudflare:setup:r2
      - task: cloudflare:setup:containers
      - echo "✅ Cloudflare integration setup complete"

  cloudflare:setup:r2:
    desc: "Setup Cloudflare R2 backend for Terraform state"
    cmds:
      - |
        echo "🏗️ Setting up Cloudflare R2 backend..."
        if [ -z "$CLOUDFLARE_ACCOUNT_ID" ]; then
          echo "⚠️ CLOUDFLARE_ACCOUNT_ID not set - skipping R2 setup"
          echo "💡 Set environment variables to enable R2 backend:"
          echo "   export CLOUDFLARE_ACCOUNT_ID=your-account-id"
          echo "   export CLOUDFLARE_R2_ACCESS_KEY=your-access-key"
          echo "   export CLOUDFLARE_R2_SECRET_KEY=your-secret-key"
        else
          echo "✅ Cloudflare R2 configuration detected"
          echo "📋 R2 Endpoint: https://$CLOUDFLARE_ACCOUNT_ID.r2.cloudflarestorage.com"
          echo "💰 Expected savings: ~95% vs AWS S3 (zero egress fees)"
        fi

  cloudflare:setup:containers:
    desc: "Setup Cloudflare Containers for NATS deployment"
    cmds:
      - |
        echo "🐳 Setting up Cloudflare Containers..."
        if command -v wrangler >/dev/null 2>&1; then
          echo "✅ Wrangler CLI found"
          wrangler --version
        else
          echo "📦 Installing Wrangler CLI..."
          npm install -g wrangler
        fi
        
        if [ -z "$CLOUDFLARE_API_TOKEN" ]; then
          echo "⚠️ CLOUDFLARE_API_TOKEN not set"
          echo "💡 Login to Cloudflare and set API token:"
          echo "   wrangler login"
          echo "   export CLOUDFLARE_API_TOKEN=your-api-token"
        else
          echo "✅ Cloudflare API token configured"
        fi

  cloudflare:deploy:
    desc: "Deploy NATS containers to Cloudflare"
    deps: [cloudflare:setup:containers]
    cmds:
      - |
        echo "🚀 Deploying NATS orchestrator to Cloudflare..."
        if [ ! -f "wrangler.toml" ]; then
          echo "📝 Creating wrangler.toml from template..."
          cp terraform/templates/wrangler.toml.tpl wrangler.toml
          echo "✏️ Please edit wrangler.toml with your account details"
        fi
        
        if [ -n "$CLOUDFLARE_API_TOKEN" ]; then
          echo "🔄 Deploying worker..."
          wrangler deploy
          echo "✅ Deployment complete"
          echo "🌐 Access your NATS orchestrator at:"
          echo "   https://nats-orchestrator.<your-subdomain>.workers.dev"
        else
          echo "⚠️ CLOUDFLARE_API_TOKEN required for deployment"
        fi

  cloudflare:test:
    desc: "Test Cloudflare NATS deployment"
    cmds:
      - |
        echo "🧪 Testing Cloudflare NATS deployment..."
        if [ -n "$CLOUDFLARE_WORKER_URL" ]; then
          echo "📡 Testing health endpoint..."
          curl -f "$CLOUDFLARE_WORKER_URL/health" || echo "❌ Health check failed"
          
          echo "📊 Testing API endpoints..."
          curl -f "$CLOUDFLARE_WORKER_URL/api/containers" || echo "❌ API test failed"
          
          echo "✅ Cloudflare integration tests complete"
        else
          echo "⚠️ CLOUDFLARE_WORKER_URL not set"
          echo "💡 Set your worker URL: export CLOUDFLARE_WORKER_URL=https://your-worker.workers.dev"
        fi

  cloudflare:migrate:state:
    desc: "Migrate Terraform state to Cloudflare R2"
    cmds:
      - |
        echo "📦 Migrating Terraform state to Cloudflare R2..."
        echo "⚠️ This will modify your Terraform backend configuration"
        read -p "Continue? (y/N) " -n 1 -r
        echo
        if [[ $REPLY =~ ^[Yy]$ ]]; then
          echo "🔄 Updating backend configuration..."
          cd terraform
          
          # Backup current state
          cp terraform.tfstate terraform.tfstate.backup.$(date +%s) 2>/dev/null || true
          
          # Initialize with R2 backend
          terraform init -migrate-state
          
          echo "✅ State migration complete"
          echo "💾 Backup created: terraform.tfstate.backup.*"
        else
          echo "❌ Migration cancelled"
        fi

  cloudflare:cost:analysis:
    desc: "Show Cloudflare cost analysis vs alternatives"
    cmds:
      - |
        echo "💰 Cloudflare Integration Cost Analysis"
        echo "========================================"
        echo
        echo "📊 R2 vs AWS S3 (monthly, 10GB storage + 1M reads + 100GB egress):"
        echo "   Cloudflare R2: \$0.51 total"
        echo "   AWS S3:        \$9.63 total"
        echo "   💡 Savings:     \$9.12 (95% reduction)"
        echo
        echo "🐳 Containers vs Traditional VPS (basic instance, 50% utilization):"
        echo "   Cloudflare:    \$5-10/month (global, auto-scale, zero-ops)"
        echo "   AWS Fargate:   \$15-25/month (regional, manual scaling)"
        echo "   DigitalOcean:  \$12/month (single region, manual management)"
        echo
        echo "🌍 Additional Benefits:"
        echo "   ✅ Zero egress fees"
        echo "   ✅ Global edge deployment"
        echo "   ✅ Auto-scaling"
        echo "   ✅ Built-in observability"
        echo "   ✅ Zero cold start"
        echo "   ✅ Integrated platform (Workers, KV, R2)"

  cloudflare:docs:
    desc: "Open Cloudflare integration documentation"
    cmds:
      - |
        echo "📖 Opening Cloudflare integration documentation..."
        if command -v open >/dev/null 2>&1; then
          open CLOUDFLARE-INTEGRATION.md
        elif command -v xdg-open >/dev/null 2>&1; then
          xdg-open CLOUDFLARE-INTEGRATION.md
        else
          echo "📄 View documentation: CLOUDFLARE-INTEGRATION.md"
        fi

  # =============================================================================
  # Secret Management
  # =============================================================================

  secrets:init:
    desc: "Initialize secret management (.env.example)"
    cmds:
      - |
        echo "🔐 Initializing secret management..."
        chmod +x secret-sync.sh
        ./secret-sync.sh init
        echo ""
        echo "💡 Next steps:"
        echo "   1. cp .env.example .env"
        echo "   2. Edit .env with your actual secrets"
        echo "   3. task secrets:sync"

  secrets:sync:
    desc: "Sync .env secrets to GitHub (requires .env file)"
    cmds:
      - |
        echo "🔄 Syncing secrets to GitHub..."
        chmod +x secret-sync.sh
        ./secret-sync.sh sync

  secrets:test:
    desc: "Test secret access across all platforms"
    cmds:
      - |
        echo "🧪 Testing secret access..."
        chmod +x secret-sync.sh
        ./secret-sync.sh test

  secrets:list:
    desc: "List current GitHub secrets"
    cmds:
      - |
        echo "📋 Listing GitHub secrets..."
        chmod +x secret-sync.sh
        ./secret-sync.sh list

  secrets:generate:
    desc: "Generate secure random secrets (webhooks, etc.)"
    cmds:
      - |
        echo "🎲 Generating secure secrets..."
        chmod +x secret-sync.sh
        ./secret-sync.sh generate

  secrets:security:
    desc: "Run security checks on secret management"
    cmds:
      - |
        echo "🛡️ Running security checks..."
        chmod +x secret-sync.sh
        ./secret-sync.sh security

  secrets:setup:
    desc: "Complete secret setup flow (init + guide)"
    cmds:
      - task: secrets:init
      - |
        echo ""
        echo "🔐 Secret Setup Guide"
        echo "====================="
        echo ""
        echo "1️⃣  GitHub Token:"
        echo "   🌐 Go to: https://github.com/settings/tokens"
        echo "   ⚙️  Create token with: repo, workflow, admin:org, admin:repo_hook"
        echo "   📝 Copy token to .env as GITHUB_TOKEN"
        echo ""
        echo "2️⃣  Synadia Cloud (Optional):"
        echo "   🌐 Go to: https://cloud.synadia.com/"
        echo "   📝 Get token & account name"
        echo "   💾 Download .nats/creds file"
        echo ""
        echo "3️⃣  Cloudflare (Optional):"
        echo "   🌐 Go to: https://dash.cloudflare.com/profile/api-tokens"
        echo "   🔑 Create token with Zone:Read, Account:Read permissions"
        echo "   📝 Get Account ID from dashboard"
        echo ""
        echo "4️⃣  Complete setup:"
        echo "   📝 Edit .env with your values"
        echo "   🔄 task secrets:sync"
        echo "   🧪 task secrets:test"

  secrets:rotate:
    desc: "Rotate secrets (interactive)"
    cmds:
      - |
        echo "🔄 Secret Rotation Workflow"
        echo "==========================="
        echo ""
        echo "⚠️  This will help you rotate secrets safely."
        echo "📝 Make sure you have backup access to all platforms!"
        echo ""
        read -p "Continue with secret rotation? (y/N) " -n 1 -r
        echo
        if [[ $REPLY =~ ^[Yy]$ ]]; then
          echo ""
          echo "1️⃣  Generate new GitHub token:"
          echo "   🌐 https://github.com/settings/tokens"
          echo "   📝 Update GITHUB_TOKEN in .env"
          echo ""
          echo "2️⃣  Generate new Cloudflare token (if used):"
          echo "   🌐 https://dash.cloudflare.com/profile/api-tokens"
          echo "   📝 Update CLOUDFLARE_API_TOKEN in .env"
          echo ""
          echo "3️⃣  Update platform secrets:"
          echo "   🔄 task secrets:sync"
          echo ""
          echo "4️⃣  Test access:"
          echo "   🧪 task secrets:test"
          echo ""
          echo "5️⃣  Revoke old tokens from platform UIs"
        else
          echo "❌ Secret rotation cancelled"
        fi

  secrets:backup:
    desc: "Create encrypted backup of secret configuration"
    cmds:
      - |
        echo "💾 Creating encrypted secret backup..."
        
        if [ ! -f .env ]; then
          echo "❌ .env file not found"
          exit 1
        fi
        
        BACKUP_FILE="secrets-backup-$(date +%Y%m%d-%H%M%S).tar.gz.gpg"
        
        echo "🗜️  Creating archive..."
        tar -czf - .env .env.example secret-sync.sh | gpg --symmetric --cipher-algo AES256 --compress-algo 1 --output "$BACKUP_FILE"
        
        if [ $? -eq 0 ]; then
          echo "✅ Encrypted backup created: $BACKUP_FILE"
          echo "🔐 Use GPG passphrase to decrypt later"
          echo ""
          echo "💡 To restore:"
          echo "   gpg --decrypt $BACKUP_FILE | tar -xzf -"
        else
          echo "❌ Backup failed"
        fi

  secrets:restore:
    desc: "Restore from encrypted backup"
    cmds:
      - |
        echo "📂 Available backup files:"
        ls -la secrets-backup-*.tar.gz.gpg 2>/dev/null || echo "❌ No backup files found"
        echo ""
        read -p "Enter backup filename: " BACKUP_FILE
        
        if [ -f "$BACKUP_FILE" ]; then
          echo "🔓 Decrypting and restoring..."
          gpg --decrypt "$BACKUP_FILE" | tar -xzf -
          
          if [ $? -eq 0 ]; then
            echo "✅ Secrets restored from backup"
            echo "🧪 Run 'task secrets:test' to verify"
          else
            echo "❌ Restore failed"
          fi
        else
          echo "❌ Backup file not found: $BACKUP_FILE"
        fi

  # =============================================================================