@dragonmastery/tamer 0.1.1 → 0.28.0

package/dist/applyTarget-BetDYdeS.mjs

@@ -0,0 +1,152 @@
+import { f as getDispatchNamespaces, m as getLogpushJobs, p as getDnsRecords } from "./normalize-Bx0bpFop.mjs";
+import { a as resourceModules, o as logicalNamesForResourceKind } from "./fetchStackImports-B4ZJahOt.mjs";
+import { a as effectiveDnsRecordProxied, i as effectiveDnsRecordComment, o as effectiveDnsRecordTtl, r as dnsRecordStateKey, t as dnsRecordAppliesToEnv } from "./dns-records.resolve-DwBR_1WI.mjs";
+
+//#region src/features/dns-records/dns-records.diff.ts
+function dnsRecordDiffPlanItems(args) {
+	const { resources, tenant, env, state } = args;
+	const items = [];
+	for (const config of resources) {
+		if (!dnsRecordAppliesToEnv(config, env)) continue;
+		const key = dnsRecordStateKey(config.zoneId, config.type, config.name);
+		const entry = state.get(key);
+		if (!entry || entry.type !== "dns_record") continue;
+		const stateEntry = entry;
+		if (stateEntry.recordType !== config.type) {
+			items.push({
+				kind: "dns_record",
+				action: "replace",
+				logicalName: config.logicalName,
+				derivedName: `${config.type} ${config.name}`,
+				detail: `type ${stateEntry.recordType} -> ${config.type} (delete + recreate)`,
+				changes: [{
+					field: "type",
+					from: stateEntry.recordType,
+					to: config.type,
+					kind: "immutable"
+				}]
+			});
+			continue;
+		}
+		const changes = computeMutableChanges(stateEntry, config, tenant, env);
+		if (changes.length === 0) continue;
+		items.push({
+			kind: "dns_record",
+			action: "update",
+			logicalName: config.logicalName,
+			derivedName: `${config.type} ${config.name}`,
+			detail: changes.map((c) => `${c.field}: ${formatVal(c.from)} -> ${formatVal(c.to)}`).join(", "),
+			changes
+		});
+	}
+	return items;
+}
+/**
+* Pure comparison shared with `dnsRecordApply` so plan and apply agree
+* on what counts as drift on the mutable record fields. Excludes the
+* `type` change — that's an immutable replace handled separately.
+*/
+function computeDnsRecordMutableChanges(state, config, tenant, env) {
+	return computeMutableChanges(state, config, tenant, env);
+}
+function computeMutableChanges(state, config, tenant, env) {
+	const expectedTtl = effectiveDnsRecordTtl(config);
+	const expectedProxied = effectiveDnsRecordProxied(config);
+	const expectedComment = effectiveDnsRecordComment(config, tenant, env);
+	const changes = [];
+	if (state.content !== config.content) changes.push({
+		field: "content",
+		from: state.content,
+		to: config.content,
+		kind: "mutable"
+	});
+	if (state.ttl !== expectedTtl) changes.push({
+		field: "ttl",
+		from: state.ttl,
+		to: expectedTtl,
+		kind: "mutable"
+	});
+	if (state.proxied !== expectedProxied) changes.push({
+		field: "proxied",
+		from: state.proxied,
+		to: expectedProxied,
+		kind: "mutable"
+	});
+	if (config.priority !== void 0 && state.priority !== config.priority) changes.push({
+		field: "priority",
+		from: state.priority,
+		to: config.priority,
+		kind: "mutable"
+	});
+	if (state.comment !== expectedComment) changes.push({
+		field: "comment",
+		from: state.comment,
+		to: expectedComment,
+		kind: "mutable"
+	});
+	return changes;
+}
+function formatVal(v) {
+	if (v === void 0) return "(unset)";
+	if (typeof v === "string") return v.length > 32 ? `${v.slice(0, 29)}...` : v;
+	return String(v);
+}
+
+//#endregion
+//#region src/core/apply/applyTarget.ts
+const APPLY_TARGET_KINDS = new Set([
+	...resourceModules.map((m) => m.kind),
+	"dispatch_namespace",
+	"dns_record",
+	"logpush_job"
+]);
+/**
+* Parse `tamer apply --target` / `tamer plan --target` (`d1:settings`,
+* `dispatch_namespace:workspace`, …). Not valid for `worker_route` /
+* `worker_script` (routes deploy with `tamer deploy`; scripts with wrangler).
+*/
+function parseApplyTarget(raw) {
+	const idx = raw.indexOf(":");
+	if (idx < 1 || idx === raw.length - 1) throw new Error(`Invalid --target "${raw}": expected <kind>:<logicalName> (e.g. d1:settings, dns_record:apex_txt)`);
+	const kind = raw.slice(0, idx);
+	const logical = raw.slice(idx + 1);
+	if (!logical.trim()) throw new Error(`Invalid --target "${raw}": missing logical name after ":"`);
+	if (kind === "worker_route" || kind === "worker_script") throw new Error(`--target ${kind}:… is not supported here (worker routes are applied on \`tamer deploy\`; scripts via wrangler). Omit --target or pass a resource kind.`);
+	if (!APPLY_TARGET_KINDS.has(kind)) {
+		const list = [...APPLY_TARGET_KINDS].sort().join(", ");
+		throw new Error(`Unknown resource kind in --target: "${kind}". Expected one of: ${list}`);
+	}
+	return {
+		kind,
+		logical
+	};
+}
+async function assertApplyTargetDeclared(config, baseDir, target) {
+	if (target.kind === "dispatch_namespace") {
+		const names = getDispatchNamespaces(config).map((n) => n.logicalName);
+		if (!names.includes(target.logical)) throw new Error(`No dispatch_namespace "${target.logical}" in the Tamer project config. Declared: ${names.length ? names.join(", ") : "(none)"}`);
+		return;
+	}
+	if (target.kind === "dns_record") {
+		const names = getDnsRecords(config).map((d) => d.logicalName);
+		if (!names.includes(target.logical)) throw new Error(`No dns_record "${target.logical}" in the Tamer project config. Declared: ${names.length ? names.join(", ") : "(none)"}`);
+		return;
+	}
+	if (target.kind === "logpush_job") {
+		const names = getLogpushJobs(config).map((j) => j.logicalName);
+		if (!names.includes(target.logical)) throw new Error(`No logpush_job "${target.logical}" in the Tamer project config. Declared: ${names.length ? names.join(", ") : "(none)"}`);
+		return;
+	}
+	const set = await logicalNamesForResourceKind(config, baseDir, target.kind);
+	if (!set.has(target.logical)) {
+		const arr = [...set].sort();
+		throw new Error(`No ${target.kind} resource "${target.logical}" in the Tamer project config for this stack. Declared ${target.kind}: ${arr.length ? arr.join(", ") : "(none)"}`);
+	}
+}
+function filterPlanItemsForTarget(items, target) {
+	return items.filter((it) => it.kind === target.kind && it.logicalName === target.logical);
+}
+
+//#endregion
+export { dnsRecordDiffPlanItems as a, computeDnsRecordMutableChanges as i, filterPlanItemsForTarget as n, parseApplyTarget as r, assertApplyTargetDeclared as t };
+//# sourceMappingURL=applyTarget-BetDYdeS.mjs.map

package/dist/applyTarget-BetDYdeS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"applyTarget-BetDYdeS.mjs","names":["items: PlanItem[]","changes: PlanFieldChange[]","APPLY_TARGET_KINDS: ReadonlySet<string>"],"sources":["../src/features/dns-records/dns-records.diff.ts","../src/core/apply/applyTarget.ts"],"sourcesContent":["/**\n * Plan-time field-level diff for declared DNS records. Pure: takes the\n * already-recorded {@link DnsRecordStateEntry} and the {@link\n * DnsRecordResourceConfig} the user wrote, and returns the\n * `update` / `replace` items `tamer plan` should emit.\n *\n * Mirrors the patch + delete-and-recreate decision tree in\n * {@link dnsRecordApply}:\n *   - `type` change → `replace` (Cloudflare's API rejects PATCH on type per\n *     https://developers.cloudflare.com/fundamentals/api/reference/deprecations/).\n *   - any of `content` / `ttl` / `proxied` / `priority` / `comment` differ →\n *     `update` (in-place PATCH).\n *\n * Records that don't yet have a state row are reported by `dnsRecordDrift`\n * as `undeployed` instead — those become `create` items. Records that\n * `apply` would skip (env-skipped, missing zone) are excluded here.\n */\n\nimport type {\n  DnsRecordResourceConfig,\n  DnsRecordStateEntry,\n  TenantMeta,\n} from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { PlanFieldChange, PlanItem } from \"../../core/plan/plan.types.js\";\nimport {\n  dnsRecordAppliesToEnv,\n  dnsRecordStateKey,\n  effectiveDnsRecordComment,\n  effectiveDnsRecordProxied,\n  effectiveDnsRecordTtl,\n} from \"./dns-records.resolve.js\";\n\nexport function dnsRecordDiffPlanItems(args: {\n  resources: DnsRecordResourceConfig[];\n  tenant: TenantMeta;\n  env: string;\n  state: StateManager;\n}): PlanItem[] {\n  const { resources, tenant, env, state } = args;\n  const items: PlanItem[] = [];\n\n  for (const config of resources) {\n    if (!dnsRecordAppliesToEnv(config, env)) continue;\n    const key = dnsRecordStateKey(config.zoneId, config.type, config.name);\n    const entry = state.get(key);\n    if (!entry || entry.type !== \"dns_record\") continue;\n\n    const stateEntry = entry as DnsRecordStateEntry;\n    if (stateEntry.recordType !== config.type) {\n      items.push({\n        kind: \"dns_record\",\n        action: \"replace\",\n        logicalName: config.logicalName,\n        derivedName: `${config.type} ${config.name}`,\n        detail: `type ${stateEntry.recordType} -> ${config.type} (delete + recreate)`,\n        changes: [\n          {\n            field: \"type\",\n            from: stateEntry.recordType,\n            to: config.type,\n            kind: \"immutable\",\n          },\n        ],\n      });\n      continue;\n    }\n\n    const changes = computeMutableChanges(stateEntry, config, tenant, env);\n    if (changes.length === 0) continue;\n    items.push({\n      kind: \"dns_record\",\n      action: \"update\",\n      logicalName: config.logicalName,\n      derivedName: `${config.type} ${config.name}`,\n      detail: changes\n        .map((c) => `${c.field}: ${formatVal(c.from)} -> ${formatVal(c.to)}`)\n        .join(\", \"),\n      changes,\n    });\n  }\n\n  return items;\n}\n\n/**\n * Pure comparison shared with `dnsRecordApply` so plan and apply agree\n * on what counts as drift on the mutable record fields. Excludes the\n * `type` change — that's an immutable replace handled separately.\n */\nexport function computeDnsRecordMutableChanges(\n  state: DnsRecordStateEntry,\n  config: DnsRecordResourceConfig,\n  tenant: TenantMeta,\n  env: string,\n): PlanFieldChange[] {\n  return computeMutableChanges(state, config, tenant, env);\n}\n\nfunction computeMutableChanges(\n  state: DnsRecordStateEntry,\n  config: DnsRecordResourceConfig,\n  tenant: TenantMeta,\n  env: string,\n): PlanFieldChange[] {\n  const expectedTtl = effectiveDnsRecordTtl(config);\n  const expectedProxied = effectiveDnsRecordProxied(config);\n  const expectedComment = effectiveDnsRecordComment(\n    config,\n    tenant,\n    env,\n  );\n\n  const changes: PlanFieldChange[] = [];\n  if (state.content !== config.content) {\n    changes.push({\n      field: \"content\",\n      from: state.content,\n      to: config.content,\n      kind: \"mutable\",\n    });\n  }\n  if (state.ttl !== expectedTtl) {\n    changes.push({\n      field: \"ttl\",\n      from: state.ttl,\n      to: expectedTtl,\n      kind: \"mutable\",\n    });\n  }\n  if (state.proxied !== expectedProxied) {\n    changes.push({\n      field: \"proxied\",\n      from: state.proxied,\n      to: expectedProxied,\n      kind: \"mutable\",\n    });\n  }\n  if (\n    config.priority !== undefined &&\n    state.priority !== config.priority\n  ) {\n    changes.push({\n      field: \"priority\",\n      from: state.priority,\n      to: config.priority,\n      kind: \"mutable\",\n    });\n  }\n  if (state.comment !== expectedComment) {\n    changes.push({\n      field: \"comment\",\n      from: state.comment,\n      to: expectedComment,\n      kind: \"mutable\",\n    });\n  }\n  return changes;\n}\n\nfunction formatVal(v: unknown): string {\n  if (v === undefined) return \"(unset)\";\n  if (typeof v === \"string\") return v.length > 32 ? `${v.slice(0, 29)}...` : v;\n  return String(v);\n}\n","import type { CfiConfig } from \"../../types.js\";\nimport {\n  getDispatchNamespaces,\n  getDnsRecords,\n  getLogpushJobs,\n} from \"../../types.js\";\nimport { logicalNamesForResourceKind } from \"../config/resourcesFromConfig.js\";\nimport type { ResourceKind } from \"../registry/registry.js\";\nimport { resourceModules } from \"../registry/registry.js\";\nimport type { PlanItem } from \"../plan/plan.types.js\";\n\nconst APPLY_TARGET_KINDS: ReadonlySet<string> = new Set([\n  ...resourceModules.map((m) => m.kind),\n  \"dispatch_namespace\",\n  \"dns_record\",\n  \"logpush_job\",\n]);\n\nexport type ApplyTargetKind =\n  | ResourceKind\n  | \"dispatch_namespace\"\n  | \"dns_record\"\n  | \"logpush_job\";\n\nexport interface ApplyTarget {\n  kind: ApplyTargetKind;\n  logical: string;\n}\n\n/**\n * Parse `tamer apply --target` / `tamer plan --target` (`d1:settings`,\n * `dispatch_namespace:workspace`, …). Not valid for `worker_route` /\n * `worker_script` (routes deploy with `tamer deploy`; scripts with wrangler).\n */\nexport function parseApplyTarget(raw: string): ApplyTarget {\n  const idx = raw.indexOf(\":\");\n  if (idx < 1 || idx === raw.length - 1) {\n    throw new Error(\n      `Invalid --target \"${raw}\": expected <kind>:<logicalName> (e.g. d1:settings, dns_record:apex_txt)`,\n    );\n  }\n  const kind = raw.slice(0, idx);\n  const logical = raw.slice(idx + 1);\n  if (!logical.trim()) {\n    throw new Error(\n      `Invalid --target \"${raw}\": missing logical name after \":\"`,\n    );\n  }\n  if (kind === \"worker_route\" || kind === \"worker_script\") {\n    throw new Error(\n      `--target ${kind}:… is not supported here (worker routes are applied on \\`tamer deploy\\`; scripts via wrangler). Omit --target or pass a resource kind.`,\n    );\n  }\n  if (!APPLY_TARGET_KINDS.has(kind)) {\n    const list = [...APPLY_TARGET_KINDS].sort().join(\", \");\n    throw new Error(\n      `Unknown resource kind in --target: \"${kind}\". Expected one of: ${list}`,\n    );\n  }\n  return { kind: kind as ApplyTargetKind, logical };\n}\n\nexport async function assertApplyTargetDeclared(\n  config: CfiConfig,\n  baseDir: string,\n  target: ApplyTarget,\n): Promise<void> {\n  if (target.kind === \"dispatch_namespace\") {\n    const names = getDispatchNamespaces(config).map((n) => n.logicalName);\n    if (!names.includes(target.logical)) {\n      throw new Error(\n        `No dispatch_namespace \"${target.logical}\" in the Tamer project config. Declared: ${names.length ? names.join(\", \") : \"(none)\"}`,\n      );\n    }\n    return;\n  }\n  if (target.kind === \"dns_record\") {\n    const names = getDnsRecords(config).map((d) => d.logicalName);\n    if (!names.includes(target.logical)) {\n      throw new Error(\n        `No dns_record \"${target.logical}\" in the Tamer project config. Declared: ${names.length ? names.join(\", \") : \"(none)\"}`,\n      );\n    }\n    return;\n  }\n  if (target.kind === \"logpush_job\") {\n    const names = getLogpushJobs(config).map((j) => j.logicalName);\n    if (!names.includes(target.logical)) {\n      throw new Error(\n        `No logpush_job \"${target.logical}\" in the Tamer project config. Declared: ${names.length ? names.join(\", \") : \"(none)\"}`,\n      );\n    }\n    return;\n  }\n  const set = await logicalNamesForResourceKind(config, baseDir, target.kind);\n  if (!set.has(target.logical)) {\n    const arr = [...set].sort();\n    throw new Error(\n      `No ${target.kind} resource \"${target.logical}\" in the Tamer project config for this stack. Declared ${target.kind}: ${arr.length ? arr.join(\", \") : \"(none)\"}`,\n    );\n  }\n}\n\nexport function filterPlanItemsForTarget(\n  items: PlanItem[],\n  target: ApplyTarget,\n): PlanItem[] {\n  return items.filter(\n    (it) => it.kind === target.kind && it.logicalName === target.logical,\n  );\n}\n"],"mappings":";;;;;AAiCA,SAAgB,uBAAuB,MAKxB;CACb,MAAM,EAAE,WAAW,QAAQ,KAAK,UAAU;CAC1C,MAAMA,QAAoB,EAAE;AAE5B,MAAK,MAAM,UAAU,WAAW;AAC9B,MAAI,CAAC,sBAAsB,QAAQ,IAAI,CAAE;EACzC,MAAM,MAAM,kBAAkB,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK;EACtE,MAAM,QAAQ,MAAM,IAAI,IAAI;AAC5B,MAAI,CAAC,SAAS,MAAM,SAAS,aAAc;EAE3C,MAAM,aAAa;AACnB,MAAI,WAAW,eAAe,OAAO,MAAM;AACzC,SAAM,KAAK;IACT,MAAM;IACN,QAAQ;IACR,aAAa,OAAO;IACpB,aAAa,GAAG,OAAO,KAAK,GAAG,OAAO;IACtC,QAAQ,QAAQ,WAAW,WAAW,MAAM,OAAO,KAAK;IACxD,SAAS,CACP;KACE,OAAO;KACP,MAAM,WAAW;KACjB,IAAI,OAAO;KACX,MAAM;KACP,CACF;IACF,CAAC;AACF;;EAGF,MAAM,UAAU,sBAAsB,YAAY,QAAQ,QAAQ,IAAI;AACtE,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,KAAK;GACT,MAAM;GACN,QAAQ;GACR,aAAa,OAAO;GACpB,aAAa,GAAG,OAAO,KAAK,GAAG,OAAO;GACtC,QAAQ,QACL,KAAK,MAAM,GAAG,EAAE,MAAM,IAAI,UAAU,EAAE,KAAK,CAAC,MAAM,UAAU,EAAE,GAAG,GAAG,CACpE,KAAK,KAAK;GACb;GACD,CAAC;;AAGJ,QAAO;;;;;;;AAQT,SAAgB,+BACd,OACA,QACA,QACA,KACmB;AACnB,QAAO,sBAAsB,OAAO,QAAQ,QAAQ,IAAI;;AAG1D,SAAS,sBACP,OACA,QACA,QACA,KACmB;CACnB,MAAM,cAAc,sBAAsB,OAAO;CACjD,MAAM,kBAAkB,0BAA0B,OAAO;CACzD,MAAM,kBAAkB,0BACtB,QACA,QACA,IACD;CAED,MAAMC,UAA6B,EAAE;AACrC,KAAI,MAAM,YAAY,OAAO,QAC3B,SAAQ,KAAK;EACX,OAAO;EACP,MAAM,MAAM;EACZ,IAAI,OAAO;EACX,MAAM;EACP,CAAC;AAEJ,KAAI,MAAM,QAAQ,YAChB,SAAQ,KAAK;EACX,OAAO;EACP,MAAM,MAAM;EACZ,IAAI;EACJ,MAAM;EACP,CAAC;AAEJ,KAAI,MAAM,YAAY,gBACpB,SAAQ,KAAK;EACX,OAAO;EACP,MAAM,MAAM;EACZ,IAAI;EACJ,MAAM;EACP,CAAC;AAEJ,KACE,OAAO,aAAa,UACpB,MAAM,aAAa,OAAO,SAE1B,SAAQ,KAAK;EACX,OAAO;EACP,MAAM,MAAM;EACZ,IAAI,OAAO;EACX,MAAM;EACP,CAAC;AAEJ,KAAI,MAAM,YAAY,gBACpB,SAAQ,KAAK;EACX,OAAO;EACP,MAAM,MAAM;EACZ,IAAI;EACJ,MAAM;EACP,CAAC;AAEJ,QAAO;;AAGT,SAAS,UAAU,GAAoB;AACrC,KAAI,MAAM,OAAW,QAAO;AAC5B,KAAI,OAAO,MAAM,SAAU,QAAO,EAAE,SAAS,KAAK,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,OAAO;AAC3E,QAAO,OAAO,EAAE;;;;;ACxJlB,MAAMC,qBAA0C,IAAI,IAAI;CACtD,GAAG,gBAAgB,KAAK,MAAM,EAAE,KAAK;CACrC;CACA;CACA;CACD,CAAC;;;;;;AAkBF,SAAgB,iBAAiB,KAA0B;CACzD,MAAM,MAAM,IAAI,QAAQ,IAAI;AAC5B,KAAI,MAAM,KAAK,QAAQ,IAAI,SAAS,EAClC,OAAM,IAAI,MACR,qBAAqB,IAAI,0EAC1B;CAEH,MAAM,OAAO,IAAI,MAAM,GAAG,IAAI;CAC9B,MAAM,UAAU,IAAI,MAAM,MAAM,EAAE;AAClC,KAAI,CAAC,QAAQ,MAAM,CACjB,OAAM,IAAI,MACR,qBAAqB,IAAI,mCAC1B;AAEH,KAAI,SAAS,kBAAkB,SAAS,gBACtC,OAAM,IAAI,MACR,YAAY,KAAK,wIAClB;AAEH,KAAI,CAAC,mBAAmB,IAAI,KAAK,EAAE;EACjC,MAAM,OAAO,CAAC,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,KAAK;AACtD,QAAM,IAAI,MACR,uCAAuC,KAAK,sBAAsB,OACnE;;AAEH,QAAO;EAAQ;EAAyB;EAAS;;AAGnD,eAAsB,0BACpB,QACA,SACA,QACe;AACf,KAAI,OAAO,SAAS,sBAAsB;EACxC,MAAM,QAAQ,sBAAsB,OAAO,CAAC,KAAK,MAAM,EAAE,YAAY;AACrE,MAAI,CAAC,MAAM,SAAS,OAAO,QAAQ,CACjC,OAAM,IAAI,MACR,0BAA0B,OAAO,QAAQ,2CAA2C,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG,WACvH;AAEH;;AAEF,KAAI,OAAO,SAAS,cAAc;EAChC,MAAM,QAAQ,cAAc,OAAO,CAAC,KAAK,MAAM,EAAE,YAAY;AAC7D,MAAI,CAAC,MAAM,SAAS,OAAO,QAAQ,CACjC,OAAM,IAAI,MACR,kBAAkB,OAAO,QAAQ,2CAA2C,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG,WAC/G;AAEH;;AAEF,KAAI,OAAO,SAAS,eAAe;EACjC,MAAM,QAAQ,eAAe,OAAO,CAAC,KAAK,MAAM,EAAE,YAAY;AAC9D,MAAI,CAAC,MAAM,SAAS,OAAO,QAAQ,CACjC,OAAM,IAAI,MACR,mBAAmB,OAAO,QAAQ,2CAA2C,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG,WAChH;AAEH;;CAEF,MAAM,MAAM,MAAM,4BAA4B,QAAQ,SAAS,OAAO,KAAK;AAC3E,KAAI,CAAC,IAAI,IAAI,OAAO,QAAQ,EAAE;EAC5B,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM;AAC3B,QAAM,IAAI,MACR,MAAM,OAAO,KAAK,aAAa,OAAO,QAAQ,yDAAyD,OAAO,KAAK,IAAI,IAAI,SAAS,IAAI,KAAK,KAAK,GAAG,WACtJ;;;AAIL,SAAgB,yBACd,OACA,QACY;AACZ,QAAO,MAAM,QACV,OAAO,GAAG,SAAS,OAAO,QAAQ,GAAG,gBAAgB,OAAO,QAC9D"}

package/dist/bootstrap-CBzPilB1.mjs

@@ -0,0 +1,33 @@
+import { n as loadConfig } from "./loader-DP7yXqT6.mjs";
+import { n as cloudflareAccountIdFromEnv, t as CFApiClient } from "./CFApiClient-DhbyyV71.mjs";
+import { d as tamerStateDatabaseName, f as stackNameForConfig, t as StateManager, u as ensureTamerStateDatabase } from "./StateManager-DTqtLLVX.mjs";
+import "./r2S3EmptyBucket-DD81ZWQ7.mjs";
+import { n as ensureTamerArtifactsBucket } from "./tamerArtifactsR2-Ccgplu2Q.mjs";
+
+//#region src/cli/commands/bootstrap.ts
+async function runBootstrap(options) {
+	const { env, configPath } = options;
+	if (env === "local") {
+		console.log("bootstrap: env=local uses in-memory state only; no D1/R2 metadata is created.");
+		return;
+	}
+	const config = await loadConfig(configPath, { env });
+	const accountId = config.account_id ?? cloudflareAccountIdFromEnv();
+	if (!accountId) throw new Error("account_id required in config or CLOUDFLARE_ACCOUNT_ID env var");
+	const api = new CFApiClient(accountId);
+	const stackName = stackNameForConfig(config);
+	const uuid = await ensureTamerStateDatabase(api, config.tenant.id, env, stackName);
+	console.log(`Tamer state ready: D1 uuid=${uuid} name=${tamerStateDatabaseName(env)} (stack=${stackName})`);
+	const bucketName = await ensureTamerArtifactsBucket(api, env);
+	console.log(`Tamer artifacts ready: R2 bucket=${bucketName}`);
+	const state = new StateManager(config.tenant.id, env, stackName);
+	await state.hydrate(api);
+	state.beginOperation("bootstrap");
+	if (!state.getStackMeta()?.name) state.setStackMeta({ name: stackName });
+	state.finishOperation("ready");
+	await state.persist(api);
+}
+
+//#endregion
+export { runBootstrap };
+//# sourceMappingURL=bootstrap-CBzPilB1.mjs.map

package/dist/bootstrap-CBzPilB1.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-CBzPilB1.mjs","names":[],"sources":["../src/cli/commands/bootstrap.ts"],"sourcesContent":["import { loadConfig } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport {\n  ensureTamerStateDatabase,\n  tamerStateDatabaseName,\n} from \"../../core/state/tamerStateDb.js\";\nimport {\n  ensureTamerArtifactsBucket,\n} from \"../../core/state/tamerArtifactsR2.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\n\nexport async function runBootstrap(options: {\n  env: string;\n  configPath?: string;\n}): Promise<void> {\n  const { env, configPath } = options;\n  if (env === \"local\") {\n    console.log(\n      \"bootstrap: env=local uses in-memory state only; no D1/R2 metadata is created.\",\n    );\n    return;\n  }\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const api = new CFApiClient(accountId);\n  const stackName = stackNameForConfig(config);\n  const uuid = await ensureTamerStateDatabase(\n    api,\n    config.tenant.id,\n    env,\n    stackName,\n  );\n  console.log(\n    `Tamer state ready: D1 uuid=${uuid} name=${tamerStateDatabaseName(env)} (stack=${stackName})`,\n  );\n\n  const bucketName = await ensureTamerArtifactsBucket(api, env);\n  console.log(`Tamer artifacts ready: R2 bucket=${bucketName}`);\n\n  const state = new StateManager(config.tenant.id, env, stackName);\n  await state.hydrate(api);\n  state.beginOperation(\"bootstrap\");\n  if (!state.getStackMeta()?.name) {\n    state.setStackMeta({ name: stackName });\n  }\n  state.finishOperation(\"ready\");\n  await state.persist(api);\n}\n"],"mappings":";;;;;;;AAaA,eAAsB,aAAa,SAGjB;CAChB,MAAM,EAAE,KAAK,eAAe;AAC5B,KAAI,QAAQ,SAAS;AACnB,UAAQ,IACN,gFACD;AACD;;CAGF,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,YAAY,mBAAmB,OAAO;CAC5C,MAAM,OAAO,MAAM,yBACjB,KACA,OAAO,OAAO,IACd,KACA,UACD;AACD,SAAQ,IACN,8BAA8B,KAAK,QAAQ,uBAAuB,IAAI,CAAC,UAAU,UAAU,GAC5F;CAED,MAAM,aAAa,MAAM,2BAA2B,KAAK,IAAI;AAC7D,SAAQ,IAAI,oCAAoC,aAAa;CAE7D,MAAM,QAAQ,IAAI,aAAa,OAAO,OAAO,IAAI,KAAK,UAAU;AAChE,OAAM,MAAM,QAAQ,IAAI;AACxB,OAAM,eAAe,YAAY;AACjC,KAAI,CAAC,MAAM,cAAc,EAAE,KACzB,OAAM,aAAa,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAM,gBAAgB,QAAQ;AAC9B,OAAM,MAAM,QAAQ,IAAI"}

package/dist/buildDispatchUploadForm-BoUB93b3.mjs

@@ -0,0 +1,38 @@
+import { basename } from "path";
+import { readFileSync } from "fs";
+
+//#region src/core/wfp/buildDispatchUploadForm.ts
+/**
+* Build multipart body for PUT .../dispatch/namespaces/{ns}/scripts/{script}
+* with a single Worker module file.
+*/
+function buildSingleModuleDispatchForm(mainFilePath, opts) {
+	const moduleName = basename(mainFilePath);
+	const body = readFileSync(mainFilePath);
+	const metadata = {
+		main_module: moduleName,
+		compatibility_date: opts.compatibility_date
+	};
+	if (opts.compatibility_flags?.length) metadata.compatibility_flags = opts.compatibility_flags;
+	const form = new FormData();
+	form.append("metadata", new Blob([JSON.stringify(metadata)], { type: "application/json" }));
+	form.append(moduleName, new Blob([body], { type: "application/javascript+module" }), moduleName);
+	return form;
+}
+/** Same as {@link buildSingleModuleDispatchForm} but from in-memory bytes (e.g. R2 download). */
+function buildSingleModuleDispatchFormFromBuffer(moduleName, body, opts) {
+	const bytes = body instanceof ArrayBuffer ? new Uint8Array(body) : body;
+	const metadata = {
+		main_module: moduleName,
+		compatibility_date: opts.compatibility_date
+	};
+	if (opts.compatibility_flags?.length) metadata.compatibility_flags = opts.compatibility_flags;
+	const form = new FormData();
+	form.append("metadata", new Blob([JSON.stringify(metadata)], { type: "application/json" }));
+	form.append(moduleName, new Blob([bytes], { type: "application/javascript+module" }), moduleName);
+	return form;
+}
+
+//#endregion
+export { buildSingleModuleDispatchFormFromBuffer as n, buildSingleModuleDispatchForm as t };
+//# sourceMappingURL=buildDispatchUploadForm-BoUB93b3.mjs.map

package/dist/buildDispatchUploadForm-BoUB93b3.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildDispatchUploadForm-BoUB93b3.mjs","names":["metadata: Record<string, unknown>"],"sources":["../src/core/wfp/buildDispatchUploadForm.ts"],"sourcesContent":["import { basename } from \"path\";\nimport { readFileSync } from \"fs\";\n\n/**\n * Build multipart body for PUT .../dispatch/namespaces/{ns}/scripts/{script}\n * with a single Worker module file.\n */\nexport function buildSingleModuleDispatchForm(\n  mainFilePath: string,\n  opts: {\n    compatibility_date: string;\n    compatibility_flags?: string[];\n  },\n): FormData {\n  const moduleName = basename(mainFilePath);\n  const body = readFileSync(mainFilePath);\n  const metadata: Record<string, unknown> = {\n    main_module: moduleName,\n    compatibility_date: opts.compatibility_date,\n  };\n  if (opts.compatibility_flags?.length) {\n    metadata.compatibility_flags = opts.compatibility_flags;\n  }\n  const form = new FormData();\n  form.append(\n    \"metadata\",\n    new Blob([JSON.stringify(metadata)], { type: \"application/json\" }),\n  );\n  // CRITICAL: Cloudflare reads `Content-Type: application/javascript+module`\n  // off the module part to decide whether to treat it as ESM. Without this it\n  // errors with `Main module must be an ES module.` even though metadata uses\n  // `main_module`.\n  form.append(\n    moduleName,\n    new Blob([body], { type: \"application/javascript+module\" }),\n    moduleName,\n  );\n  return form;\n}\n\n/** Same as {@link buildSingleModuleDispatchForm} but from in-memory bytes (e.g. R2 download). */\nexport function buildSingleModuleDispatchFormFromBuffer(\n  moduleName: string,\n  body: Uint8Array | ArrayBuffer,\n  opts: {\n    compatibility_date: string;\n    compatibility_flags?: string[];\n  },\n): FormData {\n  const bytes = body instanceof ArrayBuffer ? new Uint8Array(body) : body;\n  const metadata: Record<string, unknown> = {\n    main_module: moduleName,\n    compatibility_date: opts.compatibility_date,\n  };\n  if (opts.compatibility_flags?.length) {\n    metadata.compatibility_flags = opts.compatibility_flags;\n  }\n  const form = new FormData();\n  form.append(\n    \"metadata\",\n    new Blob([JSON.stringify(metadata)], { type: \"application/json\" }),\n  );\n  form.append(\n    moduleName,\n    new Blob([bytes], { type: \"application/javascript+module\" }),\n    moduleName,\n  );\n  return form;\n}\n"],"mappings":";;;;;;;;AAOA,SAAgB,8BACd,cACA,MAIU;CACV,MAAM,aAAa,SAAS,aAAa;CACzC,MAAM,OAAO,aAAa,aAAa;CACvC,MAAMA,WAAoC;EACxC,aAAa;EACb,oBAAoB,KAAK;EAC1B;AACD,KAAI,KAAK,qBAAqB,OAC5B,UAAS,sBAAsB,KAAK;CAEtC,MAAM,OAAO,IAAI,UAAU;AAC3B,MAAK,OACH,YACA,IAAI,KAAK,CAAC,KAAK,UAAU,SAAS,CAAC,EAAE,EAAE,MAAM,oBAAoB,CAAC,CACnE;AAKD,MAAK,OACH,YACA,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,iCAAiC,CAAC,EAC3D,WACD;AACD,QAAO;;;AAIT,SAAgB,wCACd,YACA,MACA,MAIU;CACV,MAAM,QAAQ,gBAAgB,cAAc,IAAI,WAAW,KAAK,GAAG;CACnE,MAAMA,WAAoC;EACxC,aAAa;EACb,oBAAoB,KAAK;EAC1B;AACD,KAAI,KAAK,qBAAqB,OAC5B,UAAS,sBAAsB,KAAK;CAEtC,MAAM,OAAO,IAAI,UAAU;AAC3B,MAAK,OACH,YACA,IAAI,KAAK,CAAC,KAAK,UAAU,SAAS,CAAC,EAAE,EAAE,MAAM,oBAAoB,CAAC,CACnE;AACD,MAAK,OACH,YACA,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,iCAAiC,CAAC,EAC5D,WACD;AACD,QAAO"}

package/dist/cloudflareSnapshot-B4FOaNr0.mjs

@@ -0,0 +1,163 @@
+import { f as getDispatchNamespaces, m as getLogpushJobs, p as getDnsRecords } from "./normalize-Bx0bpFop.mjs";
+import { t as getWorkers } from "./loader-DP7yXqT6.mjs";
+import { n as cloudflareAccountIdFromEnv } from "./CFApiClient-DhbyyV71.mjs";
+import { _ as namingFromConfig, a as resourceModules, t as fetchStackImports, u as mergeWorkerConfigForResourcePick } from "./fetchStackImports-B4ZJahOt.mjs";
+import { f as stackNameForConfig, t as StateManager } from "./StateManager-DTqtLLVX.mjs";
+import { n as dispatchNamespaceSync, t as dnsRecordSync } from "./dns-records.sync-Bpzz9H0s.mjs";
+import { i as logpushJobSync } from "./logpush-job-xS7270FZ.mjs";
+import { readFileSync, writeFileSync } from "fs";
+import { createHash } from "crypto";
+
+//#region src/core/plan/planFile.ts
+/** Stable on-disk format identifier for `tamer plan --out`. */
+const PLAN_FILE_FORMAT = "tamer-plan/v1";
+/**
+* Stable JSON stringify: object keys are sorted recursively. The hash must
+* be deterministic across machines, so insertion order can't matter.
+*/
+function canonicalJson(value) {
+	return stableStringify(value);
+}
+function stableStringify(value) {
+	if (value === null || typeof value !== "object") return JSON.stringify(value);
+	if (Array.isArray(value)) return `[${value.map((v) => stableStringify(v)).join(",")}]`;
+	const obj = value;
+	return `{${Object.keys(obj).sort().map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(",")}}`;
+}
+function sha256Hex(input) {
+	return `sha256:${createHash("sha256").update(input).digest("hex")}`;
+}
+/**
+* Compute the attestation hashes for `(config, state)` exactly as the
+* apply-side will recompute them. Keep both sides in sync — the canonical
+* JSON algorithm above is the contract.
+*/
+function computeAttestation(config, state, cloudflareSnapshot) {
+	const att = {
+		configHash: sha256Hex(canonicalJson(config)),
+		stateHash: sha256Hex(canonicalJson(stateForHash(state))),
+		stateRevision: state.revision
+	};
+	if (cloudflareSnapshot) att.cloudflareHash = sha256Hex(canonicalJson(cloudflareSnapshot));
+	return att;
+}
+/**
+* Stable hash of a Cloudflare snapshot; same algorithm as
+* `attestation.cloudflareHash` so apply can recompute and compare.
+*/
+function hashCloudflareSnapshot(snapshot) {
+	return sha256Hex(canonicalJson(snapshot));
+}
+/**
+* State view used for hashing — strips fields that legitimately drift
+* between consecutive reads (timestamps, revision counter) so the hash
+* only changes when *resources* / *tenants* / *stack* change.
+*/
+function stateForHash(state) {
+	const { resources, tenants, stack } = state;
+	return {
+		resources: resources ?? {},
+		tenants: tenants ?? {},
+		stack
+	};
+}
+function writePlanFile(path, file) {
+	writeFileSync(path, JSON.stringify(file, null, 2), "utf-8");
+}
+function readPlanFile(path) {
+	let raw;
+	try {
+		raw = readFileSync(path, "utf-8");
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		throw new Error(`--plan: cannot read plan file "${path}": ${msg}`);
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		throw new Error(`--plan: plan file "${path}" is not valid JSON: ${msg}`);
+	}
+	if (!isPlanFile(parsed)) throw new Error(`--plan: plan file "${path}" is missing required fields or has wrong format (expected ${PLAN_FILE_FORMAT})`);
+	if (parsed.format !== PLAN_FILE_FORMAT) throw new Error(`--plan: plan file format "${parsed.format}" is not supported by this Tamer build (expected ${PLAN_FILE_FORMAT})`);
+	return parsed;
+}
+function isPlanFile(v) {
+	if (!v || typeof v !== "object") return false;
+	const o = v;
+	return typeof o.format === "string" && typeof o.tenantId === "string" && typeof o.env === "string" && typeof o.generatedAt === "string" && !!o.report && typeof o.report === "object" && !!o.attestation && typeof o.attestation === "object";
+}
+
+//#endregion
+//#region src/core/plan/cloudflareSnapshot.ts
+/**
+* Drift-aware Cloudflare snapshot used by `tamer plan --out` and
+* `tamer apply --plan`.
+*
+* Drives the registry's `sync` hook for every kind against a **fresh
+* in-memory state** so the result reflects only what currently exists on
+* Cloudflare (no carryover from D1). The shape mirrors the post-sync
+* resource map but strips volatile fields (timestamps) so consecutive
+* snapshots of an unchanged account hash to the same value.
+*
+* Apply recomputes this against live Cloudflare and refuses to proceed if
+* `cloudflareHash` differs from the plan's pinned hash — that's how a
+* stale plan against drifted infra is detected.
+*/
+async function buildCloudflareSnapshot(args) {
+	const { config, env, api, baseDir } = args;
+	const naming = namingFromConfig(config);
+	const state = new StateManager(config.tenant.id, env, stackNameForConfig(config));
+	state.hydrateInMemory();
+	const accountId = config.account_id ?? cloudflareAccountIdFromEnv() ?? "";
+	const imports = env !== "local" ? await fetchStackImports(api, config, env).catch(() => ({})) : {};
+	const workers = await getWorkers(config, baseDir);
+	for (const mod of resourceModules) {
+		const all = await mod.fetchAll(api);
+		for (const [workerKey, wc] of workers) {
+			const mergedWorker = env !== "local" && accountId ? mergeWorkerConfigForResourcePick(config, workerKey, wc, env, accountId, naming, state, {
+				referencesMode: "tolerant",
+				imports
+			}) : wc;
+			const resources = mod.pickResources(mergedWorker);
+			if (resources.length === 0) continue;
+			mod.sync({
+				all,
+				resources,
+				tenant: config.tenant,
+				env,
+				api,
+				state,
+				naming,
+				config,
+				baseDir
+			});
+		}
+	}
+	if (getDispatchNamespaces(config).length > 0 && env !== "local") await dispatchNamespaceSync(getDispatchNamespaces(config), config.tenant, env, api, state);
+	if (getDnsRecords(config).length > 0 && env !== "local") await dnsRecordSync(getDnsRecords(config), config.tenant, env, api, state);
+	if (getLogpushJobs(config).length > 0 && env !== "local") await logpushJobSync(getLogpushJobs(config), config.tenant, env, api, state);
+	const entries = state.getAll();
+	const stable = { entries: {} };
+	for (const key of Object.keys(entries).sort()) stable.entries[key] = stripVolatile(entries[key]);
+	return stable;
+}
+/**
+* Per-entry projection used in {@link CloudflareSnapshot}. Drops fields
+* that legitimately move between two reads of the same Cloudflare resource
+* (timestamps); keeps anything that, if it changed, would mean the plan is
+* no longer accurate (cfId, derivedName, kind-specific identity bits).
+*/
+function stripVolatile(entry) {
+	const out = {};
+	for (const [k, v] of Object.entries(entry)) {
+		if (k === "createdAt" || k === "updatedAt") continue;
+		out[k] = v;
+	}
+	return out;
+}
+
+//#endregion
+export { readPlanFile as a, hashCloudflareSnapshot as i, PLAN_FILE_FORMAT as n, writePlanFile as o, computeAttestation as r, buildCloudflareSnapshot as t };
+//# sourceMappingURL=cloudflareSnapshot-B4FOaNr0.mjs.map

package/dist/cloudflareSnapshot-B4FOaNr0.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflareSnapshot-B4FOaNr0.mjs","names":["att: PlanAttestation","raw: string","parsed: unknown","stable: CloudflareSnapshot","out: Record<string, unknown>"],"sources":["../src/core/plan/planFile.ts","../src/core/plan/cloudflareSnapshot.ts"],"sourcesContent":["import { createHash } from \"crypto\";\nimport { readFileSync, writeFileSync } from \"fs\";\nimport type { CfiConfig, CfiState } from \"../../types.js\";\nimport type { PlanReport } from \"./plan.types.js\";\nimport type { CloudflareSnapshot } from \"./cloudflareSnapshot.js\";\n\n/** Stable on-disk format identifier for `tamer plan --out`. */\nexport const PLAN_FILE_FORMAT = \"tamer-plan/v1\" as const;\n\n/**\n * Serialized `tamer plan` output, suitable for `tamer apply --plan`.\n *\n * The {@link attestation} hashes pin the `(config, state)` pair the plan\n * was generated against. Apply recomputes the same hashes at run time and\n * refuses to proceed if either drifted, so a stale plan can never silently\n * apply against a different reality. Use `--allow-stale` only when you\n * understand the risk.\n */\nexport interface PlanFile {\n  format: typeof PLAN_FILE_FORMAT;\n  tenantId: string;\n  env: string;\n  generatedAt: string;\n  /** The plan as it would be printed by `tamer plan` (kept for review). */\n  report: PlanReport;\n  attestation: PlanAttestation;\n}\n\nexport interface PlanAttestation {\n  /** SHA-256 over the canonical JSON of the parsed `tamer.config.ts`. */\n  configHash: string;\n  /** SHA-256 over the canonical JSON of `state.load()` at plan time. */\n  stateHash: string;\n  /** Revision at plan time (informational; primary check is stateHash). */\n  stateRevision?: number;\n  /**\n   * Drift-aware refresh: SHA-256 over the normalized **Cloudflare-side**\n   * snapshot at plan time (per-kind `sync()` against a fresh in-memory\n   * state, with timestamps stripped). Apply re-fetches and recomputes; a\n   * mismatch means infrastructure drifted out-of-band between plan and\n   * apply, so the plan is no longer accurate. Omitted for `env: local`.\n   */\n  cloudflareHash?: string;\n}\n\n/**\n * Stable JSON stringify: object keys are sorted recursively. The hash must\n * be deterministic across machines, so insertion order can't matter.\n */\nexport function canonicalJson(value: unknown): string {\n  return stableStringify(value);\n}\n\nfunction stableStringify(value: unknown): string {\n  if (value === null || typeof value !== \"object\") {\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) {\n    return `[${value.map((v) => stableStringify(v)).join(\",\")}]`;\n  }\n  const obj = value as Record<string, unknown>;\n  const keys = Object.keys(obj).sort();\n  const body = keys\n    .map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`)\n    .join(\",\");\n  return `{${body}}`;\n}\n\nexport function sha256Hex(input: string): string {\n  return `sha256:${createHash(\"sha256\").update(input).digest(\"hex\")}`;\n}\n\n/**\n * Compute the attestation hashes for `(config, state)` exactly as the\n * apply-side will recompute them. Keep both sides in sync — the canonical\n * JSON algorithm above is the contract.\n */\nexport function computeAttestation(\n  config: CfiConfig,\n  state: CfiState,\n  cloudflareSnapshot?: CloudflareSnapshot,\n): PlanAttestation {\n  const att: PlanAttestation = {\n    configHash: sha256Hex(canonicalJson(config)),\n    stateHash: sha256Hex(canonicalJson(stateForHash(state))),\n    stateRevision: state.revision,\n  };\n  if (cloudflareSnapshot) {\n    att.cloudflareHash = sha256Hex(canonicalJson(cloudflareSnapshot));\n  }\n  return att;\n}\n\n/**\n * Stable hash of a Cloudflare snapshot; same algorithm as\n * `attestation.cloudflareHash` so apply can recompute and compare.\n */\nexport function hashCloudflareSnapshot(\n  snapshot: CloudflareSnapshot,\n): string {\n  return sha256Hex(canonicalJson(snapshot));\n}\n\n/**\n * State view used for hashing — strips fields that legitimately drift\n * between consecutive reads (timestamps, revision counter) so the hash\n * only changes when *resources* / *tenants* / *stack* change.\n */\nfunction stateForHash(state: CfiState): unknown {\n  const { resources, tenants, stack } = state;\n  return { resources: resources ?? {}, tenants: tenants ?? {}, stack };\n}\n\nexport function writePlanFile(path: string, file: PlanFile): void {\n  writeFileSync(path, JSON.stringify(file, null, 2), \"utf-8\");\n}\n\nexport function readPlanFile(path: string): PlanFile {\n  let raw: string;\n  try {\n    raw = readFileSync(path, \"utf-8\");\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`--plan: cannot read plan file \"${path}\": ${msg}`);\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`--plan: plan file \"${path}\" is not valid JSON: ${msg}`);\n  }\n  if (!isPlanFile(parsed)) {\n    throw new Error(\n      `--plan: plan file \"${path}\" is missing required fields or has wrong format ` +\n        `(expected ${PLAN_FILE_FORMAT})`,\n    );\n  }\n  if (parsed.format !== PLAN_FILE_FORMAT) {\n    throw new Error(\n      `--plan: plan file format \"${parsed.format}\" is not supported by this Tamer build (expected ${PLAN_FILE_FORMAT})`,\n    );\n  }\n  return parsed;\n}\n\nfunction isPlanFile(v: unknown): v is PlanFile {\n  if (!v || typeof v !== \"object\") return false;\n  const o = v as Record<string, unknown>;\n  return (\n    typeof o.format === \"string\" &&\n    typeof o.tenantId === \"string\" &&\n    typeof o.env === \"string\" &&\n    typeof o.generatedAt === \"string\" &&\n    !!o.report &&\n    typeof o.report === \"object\" &&\n    !!o.attestation &&\n    typeof o.attestation === \"object\"\n  );\n}\n","import type { CfiConfig, StateEntry } from \"../../types.js\";\nimport type { CFApiClient } from \"../api/CFApiClient.js\";\nimport { StateManager } from \"../state/StateManager.js\";\nimport { stackNameForConfig } from \"../state/stackName.js\";\nimport { resourceModules } from \"../registry/registry.js\";\nimport { namingFromConfig } from \"../config/namingFromConfig.js\";\nimport { getWorkers } from \"../config/loader.js\";\nimport { dispatchNamespaceSync } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordSync } from \"../../features/dns-records/index.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobSync } from \"../../features/logpush-job/index.js\";\nimport { fetchStackImports } from \"../imports/fetchStackImports.js\";\nimport { cloudflareAccountIdFromEnv } from \"../cloudflareEnv.js\";\nimport { mergeWorkerConfigForResourcePick } from \"../config/resolver.js\";\n\n/**\n * Drift-aware Cloudflare snapshot used by `tamer plan --out` and\n * `tamer apply --plan`.\n *\n * Drives the registry's `sync` hook for every kind against a **fresh\n * in-memory state** so the result reflects only what currently exists on\n * Cloudflare (no carryover from D1). The shape mirrors the post-sync\n * resource map but strips volatile fields (timestamps) so consecutive\n * snapshots of an unchanged account hash to the same value.\n *\n * Apply recomputes this against live Cloudflare and refuses to proceed if\n * `cloudflareHash` differs from the plan's pinned hash — that's how a\n * stale plan against drifted infra is detected.\n */\nexport async function buildCloudflareSnapshot(args: {\n  config: CfiConfig;\n  env: string;\n  api: CFApiClient;\n  baseDir: string;\n}): Promise<CloudflareSnapshot> {\n  const { config, env, api, baseDir } = args;\n  const naming = namingFromConfig(config);\n  // In-memory snapshot — never round-trips to D1, so stack name only\n  // matters for diagnostics; passing it keeps logs consistent with the\n  // owning stack.\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  state.hydrateInMemory();\n\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv() ?? \"\";\n  const imports =\n    env !== \"local\"\n      ? await fetchStackImports(api, config, env).catch(\n          () => ({} as Record<string, Record<string, string>>),\n        )\n      : ({} as Record<string, Record<string, string>>);\n\n  const workers = await getWorkers(config, baseDir);\n\n  for (const mod of resourceModules) {\n    const all = await mod.fetchAll(api);\n    for (const [workerKey, wc] of workers) {\n      const mergedWorker =\n        env !== \"local\" && accountId\n          ? mergeWorkerConfigForResourcePick(\n              config,\n              workerKey,\n              wc,\n              env,\n              accountId,\n              naming,\n              state,\n              { referencesMode: \"tolerant\", imports },\n            )\n          : wc;\n      const resources = mod.pickResources(mergedWorker);\n      if (resources.length === 0) continue;\n      mod.sync({\n        all,\n        resources,\n        tenant: config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n      });\n    }\n  }\n\n  if (getDispatchNamespaces(config).length > 0 && env !== \"local\") {\n    await dispatchNamespaceSync(\n      getDispatchNamespaces(config),\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n  }\n\n  if (getDnsRecords(config).length > 0 && env !== \"local\") {\n    await dnsRecordSync(\n      getDnsRecords(config),\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n  }\n\n  if (getLogpushJobs(config).length > 0 && env !== \"local\") {\n    await logpushJobSync(\n      getLogpushJobs(config),\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n  }\n\n  const entries = state.getAll();\n  const stable: CloudflareSnapshot = { entries: {} };\n  for (const key of Object.keys(entries).sort()) {\n    stable.entries[key] = stripVolatile(entries[key]!);\n  }\n  return stable;\n}\n\n/**\n * Per-entry projection used in {@link CloudflareSnapshot}. Drops fields\n * that legitimately move between two reads of the same Cloudflare resource\n * (timestamps); keeps anything that, if it changed, would mean the plan is\n * no longer accurate (cfId, derivedName, kind-specific identity bits).\n */\nfunction stripVolatile(entry: StateEntry): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(entry)) {\n    if (k === \"createdAt\" || k === \"updatedAt\") continue;\n    out[k] = v;\n  }\n  return out;\n}\n\nexport interface CloudflareSnapshot {\n  /** Sorted by key (== `derivedName`) for deterministic hashing. */\n  entries: Record<string, Record<string, unknown>>;\n}\n"],"mappings":";;;;;;;;;;;;AAOA,MAAa,mBAAmB;;;;;AA0ChC,SAAgB,cAAc,OAAwB;AACpD,QAAO,gBAAgB,MAAM;;AAG/B,SAAS,gBAAgB,OAAwB;AAC/C,KAAI,UAAU,QAAQ,OAAO,UAAU,SACrC,QAAO,KAAK,UAAU,MAAM;AAE9B,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,IAAI,MAAM,KAAK,MAAM,gBAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;CAE5D,MAAM,MAAM;AAKZ,QAAO,IAJM,OAAO,KAAK,IAAI,CAAC,MAAM,CAEjC,KAAK,MAAM,GAAG,KAAK,UAAU,EAAE,CAAC,GAAG,gBAAgB,IAAI,GAAG,GAAG,CAC7D,KAAK,IAAI,CACI;;AAGlB,SAAgB,UAAU,OAAuB;AAC/C,QAAO,UAAU,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;;;;;;AAQnE,SAAgB,mBACd,QACA,OACA,oBACiB;CACjB,MAAMA,MAAuB;EAC3B,YAAY,UAAU,cAAc,OAAO,CAAC;EAC5C,WAAW,UAAU,cAAc,aAAa,MAAM,CAAC,CAAC;EACxD,eAAe,MAAM;EACtB;AACD,KAAI,mBACF,KAAI,iBAAiB,UAAU,cAAc,mBAAmB,CAAC;AAEnE,QAAO;;;;;;AAOT,SAAgB,uBACd,UACQ;AACR,QAAO,UAAU,cAAc,SAAS,CAAC;;;;;;;AAQ3C,SAAS,aAAa,OAA0B;CAC9C,MAAM,EAAE,WAAW,SAAS,UAAU;AACtC,QAAO;EAAE,WAAW,aAAa,EAAE;EAAE,SAAS,WAAW,EAAE;EAAE;EAAO;;AAGtE,SAAgB,cAAc,MAAc,MAAsB;AAChE,eAAc,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,EAAE,QAAQ;;AAG7D,SAAgB,aAAa,MAAwB;CACnD,IAAIC;AACJ,KAAI;AACF,QAAM,aAAa,MAAM,QAAQ;UAC1B,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MAAM,kCAAkC,KAAK,KAAK,MAAM;;CAEpE,IAAIC;AACJ,KAAI;AACF,WAAS,KAAK,MAAM,IAAI;UACjB,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MAAM,sBAAsB,KAAK,uBAAuB,MAAM;;AAE1E,KAAI,CAAC,WAAW,OAAO,CACrB,OAAM,IAAI,MACR,sBAAsB,KAAK,6DACZ,iBAAiB,GACjC;AAEH,KAAI,OAAO,WAAW,iBACpB,OAAM,IAAI,MACR,6BAA6B,OAAO,OAAO,mDAAmD,iBAAiB,GAChH;AAEH,QAAO;;AAGT,SAAS,WAAW,GAA2B;AAC7C,KAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;CACxC,MAAM,IAAI;AACV,QACE,OAAO,EAAE,WAAW,YACpB,OAAO,EAAE,aAAa,YACtB,OAAO,EAAE,QAAQ,YACjB,OAAO,EAAE,gBAAgB,YACzB,CAAC,CAAC,EAAE,UACJ,OAAO,EAAE,WAAW,YACpB,CAAC,CAAC,EAAE,eACJ,OAAO,EAAE,gBAAgB;;;;;;;;;;;;;;;;;;;AChI7B,eAAsB,wBAAwB,MAKd;CAC9B,MAAM,EAAE,QAAQ,KAAK,KAAK,YAAY;CACtC,MAAM,SAAS,iBAAiB,OAAO;CAIvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,iBAAiB;CAEvB,MAAM,YAAY,OAAO,cAAc,4BAA4B,IAAI;CACvE,MAAM,UACJ,QAAQ,UACJ,MAAM,kBAAkB,KAAK,QAAQ,IAAI,CAAC,aACjC,EAAE,EACV,GACA,EAAE;CAET,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AAEjD,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,MAAM,MAAM,IAAI,SAAS,IAAI;AACnC,OAAK,MAAM,CAAC,WAAW,OAAO,SAAS;GACrC,MAAM,eACJ,QAAQ,WAAW,YACf,iCACE,QACA,WACA,IACA,KACA,WACA,QACA,OACA;IAAE,gBAAgB;IAAY;IAAS,CACxC,GACD;GACN,MAAM,YAAY,IAAI,cAAc,aAAa;AACjD,OAAI,UAAU,WAAW,EAAG;AAC5B,OAAI,KAAK;IACP;IACA;IACA,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;;;AAIN,KAAI,sBAAsB,OAAO,CAAC,SAAS,KAAK,QAAQ,QACtD,OAAM,sBACJ,sBAAsB,OAAO,EAC7B,OAAO,QACP,KACA,KACA,MACD;AAGH,KAAI,cAAc,OAAO,CAAC,SAAS,KAAK,QAAQ,QAC9C,OAAM,cACJ,cAAc,OAAO,EACrB,OAAO,QACP,KACA,KACA,MACD;AAGH,KAAI,eAAe,OAAO,CAAC,SAAS,KAAK,QAAQ,QAC/C,OAAM,eACJ,eAAe,OAAO,EACtB,OAAO,QACP,KACA,KACA,MACD;CAGH,MAAM,UAAU,MAAM,QAAQ;CAC9B,MAAMC,SAA6B,EAAE,SAAS,EAAE,EAAE;AAClD,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CAAC,MAAM,CAC3C,QAAO,QAAQ,OAAO,cAAc,QAAQ,KAAM;AAEpD,QAAO;;;;;;;;AAST,SAAS,cAAc,OAA4C;CACjE,MAAMC,MAA+B,EAAE;AACvC,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,EAAE;AAC1C,MAAI,MAAM,eAAe,MAAM,YAAa;AAC5C,MAAI,KAAK;;AAEX,QAAO"}

package/dist/deploy-gHEQxhmx.mjs

@@ -0,0 +1,119 @@
+import { n as loadConfig, t as getWorkers } from "./loader-DP7yXqT6.mjs";
+import { n as cloudflareAccountIdFromEnv, t as CFApiClient } from "./CFApiClient-DhbyyV71.mjs";
+import { _ as namingFromConfig, d as mergedWorkerConfigForEnv, f as resolveDeployedWorkerName, g as wranglerConfigCliArgs, l as buildIntraStackScriptNameMap, m as rewriteIntraStackServiceTargets, p as resolveWorkerConfig, t as fetchStackImports } from "./fetchStackImports-B4ZJahOt.mjs";
+import { f as stackNameForConfig, t as StateManager } from "./StateManager-DTqtLLVX.mjs";
+import "./r2S3EmptyBucket-DD81ZWQ7.mjs";
+import { n as writeWranglerJson, t as generateWranglerConfig } from "./generator-CIMbcPzv.mjs";
+import "./logpush-job-xS7270FZ.mjs";
+import { r as workerRoutesApply } from "./worker-route-Be2IvOdr.mjs";
+import { runSync } from "./sync-f2K2blwm.mjs";
+import { t as spawnWranglerSync } from "./wranglerSpawn-DmEz0ldT.mjs";
+
+//#region src/cli/commands/deploy.ts
+/**
+* Topologically sort workers by `services[].service` so that dependencies
+* deploy before dependents. Cloudflare rejects deploys that reference
+* service bindings to workers that don't yet exist on the account.
+* Cross-config dependencies (services not in this monorepo) are ignored.
+*/
+function topoSortWorkersByServiceBindings(workers, config, naming, env) {
+	const intraMap = buildIntraStackScriptNameMap(config, env, naming);
+	const scriptNameToKey = /* @__PURE__ */ new Map();
+	for (const [key, cfg] of workers) {
+		const name = resolveDeployedWorkerName(config, key, cfg, env, naming);
+		scriptNameToKey.set(name, key);
+	}
+	const byKey = new Map(workers);
+	const visited = /* @__PURE__ */ new Set();
+	const visiting = /* @__PURE__ */ new Set();
+	const out = [];
+	function visit(key) {
+		if (visited.has(key)) return;
+		if (visiting.has(key)) return;
+		visiting.add(key);
+		const cfg = byKey.get(key);
+		if (cfg) {
+			const deps = rewriteIntraStackServiceTargets(mergedWorkerConfigForEnv(cfg, env, config.tenant), intraMap).services?.map((s) => s.service) ?? [];
+			for (const dep of deps) {
+				const depKey = scriptNameToKey.get(dep);
+				if (depKey && depKey !== key) visit(depKey);
+			}
+			visiting.delete(key);
+			visited.add(key);
+			out.push([key, cfg]);
+		}
+	}
+	for (const [key] of workers) visit(key);
+	return out;
+}
+async function runDeploy(options) {
+	const workerFilter = options.worker;
+	const env = options.env;
+	if (!env) throw new Error("deploy: --env is required (e.g. --env staging). Tamer no longer defaults to prod — pass the env explicitly.");
+	const configPath = options.configPath;
+	const baseDir = process.cwd();
+	const config = await loadConfig(configPath, { env });
+	const accountId = config.account_id ?? cloudflareAccountIdFromEnv();
+	if (!accountId) throw new Error("account_id required in config or CLOUDFLARE_ACCOUNT_ID env var");
+	console.log(`Syncing state for env: ${env}...`);
+	await runSync({
+		env,
+		configPath
+	});
+	const naming = namingFromConfig(config);
+	const api = new CFApiClient(accountId);
+	const state = new StateManager(config.tenant.id, env, stackNameForConfig(config));
+	await state.hydrate(api);
+	const imports = await fetchStackImports(api, config, env);
+	state.beginOperation("deploy", workerFilter ? `worker:${workerFilter}` : void 0);
+	try {
+		const workers = await getWorkers(config, baseDir);
+		const toDeploy = workerFilter ? workers.filter(([k]) => k === workerFilter) : workers;
+		if (toDeploy.length === 0) throw new Error(workerFilter ? `Worker "${workerFilter}" not found` : "No workers configured");
+		const ordered = topoSortWorkersByServiceBindings(toDeploy, config, naming, env);
+		for (const [workerKey, workerConfig] of ordered) {
+			const resolved = await resolveWorkerConfig(config, workerKey, workerConfig, env, baseDir, accountId, naming, state, { imports });
+			const wranglerConfig = generateWranglerConfig(resolved, state, naming);
+			writeWranglerJson(resolved.workerDir, wranglerConfig, resolved.wranglerOutFile);
+			if (spawnWranglerSync([
+				"wrangler",
+				...wranglerConfigCliArgs(resolved.wranglerOutFile),
+				"types"
+			], {
+				cwd: resolved.workerDir,
+				stdio: "inherit"
+			}).status !== 0) throw new Error(`wrangler types failed for ${workerKey}`);
+			const dispatchNs = resolved.dispatchNamespace ?? options.dispatchNamespace;
+			const deployArgs = [
+				"wrangler",
+				...wranglerConfigCliArgs(resolved.wranglerOutFile),
+				"deploy"
+			];
+			if (dispatchNs) deployArgs.push("--dispatch-namespace", dispatchNs);
+			if (spawnWranglerSync(deployArgs, {
+				cwd: resolved.workerDir,
+				stdio: "inherit"
+			}).status !== 0) throw new Error(`wrangler deploy failed for ${workerKey}`);
+			console.log(`Deployed ${workerKey}`);
+		}
+		if (env !== "local") try {
+			await workerRoutesApply(env, config, baseDir, accountId, naming, state, api, { imports });
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			throw new Error(`worker routes apply failed after deploy: ${msg}`);
+		}
+		state.finishOperation();
+		await state.persist(api);
+		console.log(`Deploy complete for env: ${env}`);
+	} catch (err) {
+		state.failOperation(err instanceof Error ? err.message : String(err));
+		try {
+			await state.persist(api);
+		} catch {}
+		throw err;
+	}
+}
+
+//#endregion
+export { runDeploy };
+//# sourceMappingURL=deploy-gHEQxhmx.mjs.map

package/dist/deploy-gHEQxhmx.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-gHEQxhmx.mjs","names":["out: WorkerEntry[]"],"sources":["../src/cli/commands/deploy.ts"],"sourcesContent":["import type { CfiConfig, WorkerConfig } from \"../../types.js\";\nimport { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport { wranglerConfigCliArgs } from \"../../core/wrangler/wranglerOutFile.js\";\nimport { spawnWranglerSync } from \"../../core/wrangler/wranglerSpawn.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport {\n  buildIntraStackScriptNameMap,\n  mergedWorkerConfigForEnv,\n  resolveDeployedWorkerName,\n  resolveWorkerConfig,\n  rewriteIntraStackServiceTargets,\n} from \"../../core/config/resolver.js\";\nimport {\n  generateWranglerConfig,\n  writeWranglerJson,\n} from \"../../core/wrangler/generator.js\";\nimport { runSync } from \"./sync.js\";\nimport { workerRoutesApply } from \"../../features/worker-route/index.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\n\ntype WorkerEntry = [string, WorkerConfig];\n\n/**\n * Topologically sort workers by `services[].service` so that dependencies\n * deploy before dependents. Cloudflare rejects deploys that reference\n * service bindings to workers that don't yet exist on the account.\n * Cross-config dependencies (services not in this monorepo) are ignored.\n */\nexport function topoSortWorkersByServiceBindings(\n  workers: WorkerEntry[],\n  config: CfiConfig,\n  naming: NamingEngine,\n  env: string,\n): WorkerEntry[] {\n  const intraMap = buildIntraStackScriptNameMap(config, env, naming);\n  const scriptNameToKey = new Map<string, string>();\n  for (const [key, cfg] of workers) {\n    const name = resolveDeployedWorkerName(config, key, cfg, env, naming);\n    scriptNameToKey.set(name, key);\n  }\n\n  const byKey = new Map(workers);\n  const visited = new Set<string>();\n  const visiting = new Set<string>();\n  const out: WorkerEntry[] = [];\n\n  function visit(key: string): void {\n    if (visited.has(key)) return;\n    if (visiting.has(key)) return;\n    visiting.add(key);\n    const cfg = byKey.get(key);\n    if (cfg) {\n      const merged = rewriteIntraStackServiceTargets(\n        mergedWorkerConfigForEnv(cfg, env, config.tenant),\n        intraMap,\n      );\n      const deps = merged.services?.map((s) => s.service) ?? [];\n      for (const dep of deps) {\n        const depKey = scriptNameToKey.get(dep);\n        if (depKey && depKey !== key) visit(depKey);\n      }\n      visiting.delete(key);\n      visited.add(key);\n      out.push([key, cfg]);\n    }\n  }\n\n  for (const [key] of workers) visit(key);\n  return out;\n}\n\nexport async function runDeploy(options: {\n  worker?: string;\n  env?: string;\n  configPath?: string;\n  /** Passed to `wrangler deploy --dispatch-namespace` when the worker has no `dispatchNamespace` in config. */\n  dispatchNamespace?: string;\n}): Promise<void> {\n  const workerFilter = options.worker;\n  // `--env` is intentionally required (no silent default to \"prod\") to\n  // match every other Tamer command and to avoid the classic \"ran\n  // `tamer deploy` from the wrong shell, shipped a half-tested branch\n  // to production\" footgun.\n  const env = options.env;\n  if (!env) {\n    throw new Error(\n      \"deploy: --env is required (e.g. --env staging). \" +\n        \"Tamer no longer defaults to prod — pass the env explicitly.\",\n    );\n  }\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  console.log(`Syncing state for env: ${env}...`);\n  await runSync({ env, configPath });\n\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const imports = await fetchStackImports(api, config, env);\n  state.beginOperation(\"deploy\", workerFilter ? `worker:${workerFilter}` : undefined);\n\n  try {\n\n  const workers = await getWorkers(config, baseDir);\n  const toDeploy = workerFilter\n    ? workers.filter(([k]) => k === workerFilter)\n    : workers;\n\n  if (toDeploy.length === 0) {\n    throw new Error(\n      workerFilter\n        ? `Worker \"${workerFilter}\" not found`\n        : \"No workers configured\",\n    );\n  }\n\n  const ordered = topoSortWorkersByServiceBindings(\n    toDeploy,\n    config,\n    naming,\n    env,\n  );\n\n  for (const [workerKey, workerConfig] of ordered) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { imports },\n    );\n    const wranglerConfig = generateWranglerConfig(resolved, state, naming);\n    writeWranglerJson(resolved.workerDir, wranglerConfig, resolved.wranglerOutFile);\n\n    const typesArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n      \"types\",\n    ];\n    const typesResult = spawnWranglerSync(typesArgs, {\n      cwd: resolved.workerDir,\n      stdio: \"inherit\",\n    });\n    if (typesResult.status !== 0) {\n      throw new Error(`wrangler types failed for ${workerKey}`);\n    }\n\n    const dispatchNs =\n      resolved.dispatchNamespace ?? options.dispatchNamespace;\n    const deployArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n      \"deploy\",\n    ];\n    if (dispatchNs) {\n      deployArgs.push(\"--dispatch-namespace\", dispatchNs);\n    }\n\n    const deployResult = spawnWranglerSync(deployArgs, {\n      cwd: resolved.workerDir,\n      stdio: \"inherit\",\n    });\n    if (deployResult.status !== 0) {\n      throw new Error(`wrangler deploy failed for ${workerKey}`);\n    }\n    console.log(`Deployed ${workerKey}`);\n  }\n\n  if (env !== \"local\") {\n    try {\n      await workerRoutesApply(\n        env,\n        config,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        api,\n        { imports },\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      throw new Error(`worker routes apply failed after deploy: ${msg}`);\n    }\n  }\n\n  state.finishOperation();\n  await state.persist(api);\n  console.log(`Deploy complete for env: ${env}`);\n  } catch (err) {\n    state.failOperation(err instanceof Error ? err.message : String(err));\n    try {\n      await state.persist(api);\n    } catch {\n      /* swallow secondary persist failure */\n    }\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiCA,SAAgB,iCACd,SACA,QACA,QACA,KACe;CACf,MAAM,WAAW,6BAA6B,QAAQ,KAAK,OAAO;CAClE,MAAM,kCAAkB,IAAI,KAAqB;AACjD,MAAK,MAAM,CAAC,KAAK,QAAQ,SAAS;EAChC,MAAM,OAAO,0BAA0B,QAAQ,KAAK,KAAK,KAAK,OAAO;AACrE,kBAAgB,IAAI,MAAM,IAAI;;CAGhC,MAAM,QAAQ,IAAI,IAAI,QAAQ;CAC9B,MAAM,0BAAU,IAAI,KAAa;CACjC,MAAM,2BAAW,IAAI,KAAa;CAClC,MAAMA,MAAqB,EAAE;CAE7B,SAAS,MAAM,KAAmB;AAChC,MAAI,QAAQ,IAAI,IAAI,CAAE;AACtB,MAAI,SAAS,IAAI,IAAI,CAAE;AACvB,WAAS,IAAI,IAAI;EACjB,MAAM,MAAM,MAAM,IAAI,IAAI;AAC1B,MAAI,KAAK;GAKP,MAAM,OAJS,gCACb,yBAAyB,KAAK,KAAK,OAAO,OAAO,EACjD,SACD,CACmB,UAAU,KAAK,MAAM,EAAE,QAAQ,IAAI,EAAE;AACzD,QAAK,MAAM,OAAO,MAAM;IACtB,MAAM,SAAS,gBAAgB,IAAI,IAAI;AACvC,QAAI,UAAU,WAAW,IAAK,OAAM,OAAO;;AAE7C,YAAS,OAAO,IAAI;AACpB,WAAQ,IAAI,IAAI;AAChB,OAAI,KAAK,CAAC,KAAK,IAAI,CAAC;;;AAIxB,MAAK,MAAM,CAAC,QAAQ,QAAS,OAAM,IAAI;AACvC,QAAO;;AAGT,eAAsB,UAAU,SAMd;CAChB,MAAM,eAAe,QAAQ;CAK7B,MAAM,MAAM,QAAQ;AACpB,KAAI,CAAC,IACH,OAAM,IAAI,MACR,8GAED;CAEH,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;AAGH,SAAQ,IAAI,0BAA0B,IAAI,KAAK;AAC/C,OAAM,QAAQ;EAAE;EAAK;EAAY,CAAC;CAElC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;AACzD,OAAM,eAAe,UAAU,eAAe,UAAU,iBAAiB,OAAU;AAEnF,KAAI;EAEJ,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;EACjD,MAAM,WAAW,eACb,QAAQ,QAAQ,CAAC,OAAO,MAAM,aAAa,GAC3C;AAEJ,MAAI,SAAS,WAAW,EACtB,OAAM,IAAI,MACR,eACI,WAAW,aAAa,eACxB,wBACL;EAGH,MAAM,UAAU,iCACd,UACA,QACA,QACA,IACD;AAED,OAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;GAC/C,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;GACD,MAAM,iBAAiB,uBAAuB,UAAU,OAAO,OAAO;AACtE,qBAAkB,SAAS,WAAW,gBAAgB,SAAS,gBAAgB;AAW/E,OAJoB,kBALF;IAChB;IACA,GAAG,sBAAsB,SAAS,gBAAgB;IAClD;IACD,EACgD;IAC/C,KAAK,SAAS;IACd,OAAO;IACR,CAAC,CACc,WAAW,EACzB,OAAM,IAAI,MAAM,6BAA6B,YAAY;GAG3D,MAAM,aACJ,SAAS,qBAAqB,QAAQ;GACxC,MAAM,aAAa;IACjB;IACA,GAAG,sBAAsB,SAAS,gBAAgB;IAClD;IACD;AACD,OAAI,WACF,YAAW,KAAK,wBAAwB,WAAW;AAOrD,OAJqB,kBAAkB,YAAY;IACjD,KAAK,SAAS;IACd,OAAO;IACR,CAAC,CACe,WAAW,EAC1B,OAAM,IAAI,MAAM,8BAA8B,YAAY;AAE5D,WAAQ,IAAI,YAAY,YAAY;;AAGtC,MAAI,QAAQ,QACV,KAAI;AACF,SAAM,kBACJ,KACA,QACA,SACA,WACA,QACA,OACA,KACA,EAAE,SAAS,CACZ;WACM,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,SAAM,IAAI,MAAM,4CAA4C,MAAM;;AAItE,QAAM,iBAAiB;AACvB,QAAM,MAAM,QAAQ,IAAI;AACxB,UAAQ,IAAI,4BAA4B,MAAM;UACrC,KAAK;AACZ,QAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,MAAI;AACF,SAAM,MAAM,QAAQ,IAAI;UAClB;AAGR,QAAM"}