@dragonmastery/tamer 0.1.2 → 0.28.0

package/dist/fetchStackImports-B4ZJahOt.mjs

@@ -0,0 +1,3817 @@
+import { f as getDispatchNamespaces, n as materializeTamerResolvable, r as materializeVars } from "./normalize-Bx0bpFop.mjs";
+import { t as getWorkers } from "./loader-DP7yXqT6.mjs";
+import { f as stackNameForConfig, o as effectiveDispatchNamespaceName, s as isEphemeralEnv, t as StateManager } from "./StateManager-DTqtLLVX.mjs";
+import { n as r2S3CredentialsFromEnv, t as emptyR2BucketViaS3 } from "./r2S3EmptyBucket-DD81ZWQ7.mjs";
+import { n as logApplyChange } from "./planFormat-CJw8Kq2s.mjs";
+import { resolve } from "path";
+
+//#region src/core/naming/NamingEngine.ts
+function reLiteral(s) {
+	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var NamingEngine = class {
+	constructor(tenant, conventions) {
+		this.tenant = tenant;
+		this.conventions = conventions;
+	}
+	d1SingleName(logicalName, env) {
+		if (this.conventions?.d1Single) return this.conventions.d1Single(logicalName, this.tenant.id, env);
+		return `db_${logicalName}_t_${this.tenant.id}_${env}`;
+	}
+	d1ShardName(logicalName, shardDate, env) {
+		if (this.conventions?.d1Shard) return this.conventions.d1Shard(logicalName, shardDate, this.tenant.id, env);
+		const dateNoDashes = shardDate.replace(/-/g, "");
+		if (logicalName === "default" || logicalName === "") return `db_${dateNoDashes}_t_${this.tenant.id}_${env}`;
+		return `db_${logicalName}_${dateNoDashes}_t_${this.tenant.id}_${env}`;
+	}
+	d1SingleBindingKey(logicalName) {
+		return `DB_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
+	}
+	d1ShardBindingKey(logicalName, shardDate) {
+		const dateNoDashes = shardDate.replace(/-/g, "");
+		return `DB_${logicalName.toUpperCase().replace(/-/g, "_")}_${dateNoDashes}_T_${this.tenant.id.toUpperCase()}`;
+	}
+	r2BucketName(logicalName, env) {
+		if (this.conventions?.r2Bucket) {
+			const dateNoDashes = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10).replace(/-/g, "");
+			return this.conventions.r2Bucket(logicalName, dateNoDashes, this.tenant.id, env);
+		}
+		return `r2-${logicalName}-t-${this.tenant.id}-${env}`;
+	}
+	/**
+	* Wrangler `r2_buckets[].binding`: logical + tenant only (same idea as {@link kvBindingKey}).
+	* Stable across envs; default {@link r2BucketName} is `r2-{logical}-t-{tenant}-{env}`.
+	*/
+	r2BindingKey(logicalName) {
+		return `R2_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
+	}
+	kvNamespaceName(logicalName, env) {
+		return `kv_${logicalName}_t_${this.tenant.id}_${env}`;
+	}
+	kvBindingKey(logicalName) {
+		return `KV_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
+	}
+	queueName(logicalName, env) {
+		return `q-${logicalName}-t-${this.tenant.id}-${env}`;
+	}
+	queueBindingKey(logicalName) {
+		return `Q_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
+	}
+	hyperdriveName(logicalName, env) {
+		return `hd-${logicalName}-t-${this.tenant.id}-${env}`;
+	}
+	hyperdriveBindingKey(logicalName) {
+		return `HD_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
+	}
+	vectorizeName(logicalName, env) {
+		return `vec-${logicalName}-t-${this.tenant.id}-${env}`;
+	}
+	vectorizeBindingKey(logicalName) {
+		return `VEC_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
+	}
+	/**
+	* AI Gateway slug (== Cloudflare gateway id). Per the Cloudflare API,
+	* gateway ids are case-sensitive lowercase ascii with `-`/`_`. Format:
+	* `aigw-{logical}-t-{tenantId}-{env}`.
+	*/
+	aiGatewayId(logicalName, env) {
+		return `aigw-${logicalName}-t-${this.tenant.id}-${env}`.toLowerCase();
+	}
+	/**
+	* Stable cross-reference binding key for AI Gateway. AI Gateway has no
+	* Wrangler binding kind today, so this is only consumed by
+	* `${tamer:ai_gateway:<logical>.binding}` interpolations.
+	*/
+	aiGatewayBindingKey(logicalName) {
+		return `AI_GW_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
+	}
+	/**
+	* Cloudflare-side pipeline name. Pipelines V1 names must be lowercase
+	* alphanumerics + hyphens (no underscores), so we mirror the R2 scheme.
+	* Pattern: `pipe-{logical}-t-{tenantId}-{env}`.
+	*/
+	pipelineName(logicalName, env) {
+		return `pipe-${logicalName}-t-${this.tenant.id}-${env}`.toLowerCase();
+	}
+	/**
+	* Wrangler binding key emitted in `pipelines[]`. Uppercased logical with
+	* the tenant id appended so two tenants can share a worker namespace
+	* without colliding bindings.
+	*/
+	pipelineBindingKey(logicalName) {
+		return `PIPE_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
+	}
+	pipelineMatchPattern(logicalName, env) {
+		const exact = this.pipelineName(logicalName, env);
+		return (name) => name === exact;
+	}
+	/**
+	* Cloudflare-side workflow name. Workflow names accept lowercase
+	* alphanumerics + hyphens; we mirror the pipelines/AI-Gateway hyphen
+	* scheme. Pattern: `wf-{logical}-t-{tenantId}-{env}`.
+	*/
+	workflowName(logicalName, env) {
+		return `wf-${logicalName}-t-${this.tenant.id}-${env}`.toLowerCase();
+	}
+	/**
+	* Wrangler binding key emitted in `workflows[]`. Uppercased logical with
+	* the tenant id appended so two tenants sharing a script can't collide.
+	*/
+	workflowBindingKey(logicalName) {
+		return `WF_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
+	}
+	workflowMatchPattern(logicalName, env) {
+		const exact = this.workflowName(logicalName, env);
+		return (name) => name === exact;
+	}
+	/**
+	* Cloudflare Secrets Store name. Account-scoped — the API allows free-form
+	* names (the dashboard examples use both `service_x_keys` and dashed
+	* variants), so we mirror our hyphen convention for consistency with
+	* pipelines / workflows / AI Gateway. Pattern:
+	* `sec-{logical}-t-{tenantId}-{env}`.
+	*/
+	secretsStoreName(logicalName, env) {
+		return `sec-${logicalName}-t-${this.tenant.id}-${env}`.toLowerCase();
+	}
+	/**
+	* Stable cross-reference key for the store. Secrets Store has no Wrangler
+	* binding kind directly — `secrets_store_secrets[]` references the
+	* resolved `store_id`, not the store name — so this only powers
+	* `${tamer:secret_store:<n>.binding}` interpolations.
+	*/
+	secretsStoreBindingKey(logicalName) {
+		return `SEC_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
+	}
+	secretsStoreMatchPattern(logicalName, env) {
+		const exact = this.secretsStoreName(logicalName, env);
+		return (name) => name === exact;
+	}
+	workerName(workerKey, env) {
+		if (this.conventions?.workerName) return this.conventions.workerName(this.tenant.slug, workerKey, env, this.tenant.id);
+		if (env === "local") return `${this.tenant.slug}-${workerKey}-${this.tenant.id}`;
+		return `${this.tenant.slug}-${workerKey}-${env}-${this.tenant.id}`;
+	}
+	d1MatchPattern(logicalName, env) {
+		const suffix = `_t_${this.tenant.id}_${env}`;
+		if (logicalName === "default" || logicalName === "") return (name) => /^db_\d{8}_t_/.test(name) && name.endsWith(suffix);
+		const prefix = `db_${logicalName}_`;
+		return (name) => name.startsWith(prefix) && name.endsWith(suffix);
+	}
+	/**
+	* Default: exact {@link r2BucketName}, or legacy dated buckets
+	* `r2-{logical}-{YYYYMMDD}-t-{tenant}-{env}` from older Tamer versions.
+	* Custom {@link NamingConventions.r2Bucket}: exact name only (uses today's date
+	* when calling the hook, same as apply).
+	*/
+	r2MatchPattern(logicalName, env) {
+		if (this.conventions?.r2Bucket) {
+			const expected = this.r2BucketName(logicalName, env);
+			return (name) => name === expected;
+		}
+		const exactNew = `r2-${logicalName}-t-${this.tenant.id}-${env}`;
+		const legacyDated = /* @__PURE__ */ new RegExp(`^r2-${reLiteral(logicalName)}-\\d{8}-t-${reLiteral(this.tenant.id)}-${reLiteral(env)}$`);
+		return (name) => name === exactNew || legacyDated.test(name);
+	}
+	extractD1ShardDate(name) {
+		const match = name.match(/_(\d{8})_t_/);
+		if (match) {
+			const d = match[1];
+			return `${d.slice(0, 4)}-${d.slice(4, 6)}-${d.slice(6, 8)}`;
+		}
+		return null;
+	}
+	extractR2Date(name) {
+		const match = name.match(/r2-\w+-(\d{8})-t-/);
+		if (match) {
+			const d = match[1];
+			return `${d.slice(0, 4)}-${d.slice(4, 6)}-${d.slice(6, 8)}`;
+		}
+		return null;
+	}
+};
+
+//#endregion
+//#region src/core/config/namingFromConfig.ts
+function namingFromConfig(config) {
+	const conventions = "naming" in config && config.naming ? config.naming : void 0;
+	return new NamingEngine(config.tenant, conventions);
+}
+
+//#endregion
+//#region src/core/routes/routes.resolve.ts
+const DEFAULT_PROD_ENVS = ["prod", "production"];
+const DEFAULT_SKIP_ENVS = ["local"];
+/**
+* Per `docs/handoff.md` §6:
+*   - prod / production → bare apex (`todo.com`)
+*   - any other env (including ephemeral `pr-*`) → `{env}.{apex}`
+*   - `local` (or anything in `skipEnvs`) → no route
+*
+* The resource-name `-{env}` suffix on workers/D1/R2/KV is decoupled from
+* URLs; this function only computes the URL.
+*/
+function effectiveHostForEnv(route, env) {
+	if ((route.skipEnvs ?? DEFAULT_SKIP_ENVS).includes(env)) return void 0;
+	if ((route.prodEnvs ?? DEFAULT_PROD_ENVS).includes(env)) return route.host;
+	return `${env}.${route.host}`;
+}
+/**
+* Expand one Tamer route into a wrangler `Route` (or `undefined` if the env
+* should not receive the route at all).
+*/
+function expandRouteForEnv(route, env) {
+	const host = effectiveHostForEnv(route, env);
+	if (!host) return void 0;
+	const zone = route.zone ?? route.host;
+	if (route.customDomain) return {
+		pattern: host,
+		custom_domain: true
+	};
+	return {
+		pattern: `${host}${route.path ?? "/*"}`,
+		zone_name: zone
+	};
+}
+/**
+* Expand `tamerRoutes` for the given env, dropping any that resolve to
+* `undefined` (`local`, `skipEnvs`).
+*
+* Note: ephemeral envs (matching `tenant.ephemeralEnvPattern`) follow the
+* same `{env}.{apex}` prefix rule as any non-prod env — e.g. an env named
+* `pr-1234` resolves to `pr-1234.todo.com`. Callers that want a different
+* URL scheme for ephemeral envs should special-case before calling.
+*/
+function effectiveRoutesForEnv(tamerRoutes, env) {
+	if (!tamerRoutes || tamerRoutes.length === 0) return [];
+	const out = [];
+	for (const r of tamerRoutes) {
+		const expanded = expandRouteForEnv(r, env);
+		if (expanded) out.push(expanded);
+	}
+	return out;
+}
+/**
+* Zone-name routes are attached via the Cloudflare Workers Routes HTTP API
+* (`/zones/{id}/workers/routes`), not via `wrangler.json`, so deploys stay
+* consistent with `tamer drift` / destroy.
+*/
+function isApiManagedZoneRoute(r) {
+	return typeof r === "object" && r !== null && "zone_name" in r && typeof r.zone_name === "string" && "pattern" in r && typeof r.pattern === "string" && !("custom_domain" in r && r.custom_domain === true);
+}
+/** Custom-domain `tamerRoutes` stay in wrangler until a dedicated API path exists. */
+function isWranglerOnlyTamerRoute(r) {
+	return typeof r === "object" && r !== null && "custom_domain" in r && r.custom_domain === true;
+}
+
+//#endregion
+//#region src/core/wrangler/wranglerOutFile.ts
+/** Reject path segments in generated Wrangler config filename. */
+function assertSafeWranglerOutFile(name) {
+	const trimmed = name.trim();
+	if (!trimmed) throw new Error("wranglerOutFile cannot be empty");
+	if (trimmed.includes("/") || trimmed.includes("\\") || trimmed.startsWith("..")) throw new Error(`Invalid wranglerOutFile "${name}": use a basename only (e.g. wrangler.json)`);
+	return trimmed;
+}
+/** Extra CLI args so Wrangler uses a non-default config file. */
+function wranglerConfigCliArgs(outFile) {
+	if (outFile === "wrangler.json") return [];
+	return ["--config", outFile];
+}
+
+//#endregion
+//#region src/core/references/references.ts
+var TamerReferenceError = class extends Error {
+	constructor(message, fieldPath) {
+		super(`${message} (at ${fieldPath})`);
+		this.fieldPath = fieldPath;
+		this.name = "TamerReferenceError";
+	}
+};
+const REF_RE = /\$\{tamer:([a-z0-9_]+):([a-zA-Z0-9_-]+)\.([a-zA-Z0-9_-]+)\}/g;
+/**
+* Scan a string for any `${tamer:...}` references. Returns true when at
+* least one reference is present (used for cheap pre-checks).
+*/
+function stringHasReference(s) {
+	REF_RE.lastIndex = 0;
+	return REF_RE.test(s);
+}
+/**
+* Resolve every `${tamer:...}` reference in `value`. Replacement preserves
+* surrounding text for partial-string interpolation. `fieldPath` is included
+* in any thrown {@link TamerReferenceError} for actionable diagnostics.
+*/
+function resolveReferencesInString(value, ctx, fieldPath) {
+	if (!stringHasReference(value)) return value;
+	return value.replace(REF_RE, (match, kind, logicalName, field) => {
+		try {
+			return lookupReference(kind, logicalName, field, ctx, fieldPath);
+		} catch (err) {
+			if (ctx.tolerant && err instanceof TamerReferenceError) return match;
+			throw err;
+		}
+	});
+}
+/**
+* Walk a `vars` record (or any flat string→string map) replacing references
+* in every value. Returns a new object; the input is not mutated.
+*/
+function resolveReferencesInVars(vars, ctx, fieldPathPrefix) {
+	if (!vars) return vars;
+	const out = {};
+	for (const [key, value] of Object.entries(vars)) {
+		if (typeof value !== "string") {
+			out[key] = value;
+			continue;
+		}
+		out[key] = resolveReferencesInString(value, ctx, `${fieldPathPrefix}.${key}`);
+	}
+	return out;
+}
+function lookupReference(kind, logicalName, field, ctx, fieldPath) {
+	switch (kind) {
+		case "d1": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "d1_database" && entry.logicalName === logicalName);
+		case "r2": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "r2_bucket" && entry.logicalName === logicalName);
+		case "kv": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "kv_namespace" && entry.logicalName === logicalName);
+		case "queue": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "queue" && entry.logicalName === logicalName);
+		case "hyperdrive": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "hyperdrive" && entry.logicalName === logicalName);
+		case "vectorize": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "vectorize" && entry.logicalName === logicalName);
+		case "ai_gateway": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "ai_gateway" && entry.logicalName === logicalName);
+		case "pipeline": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "pipeline" && entry.logicalName === logicalName);
+		case "workflow": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "workflow" && entry.logicalName === logicalName);
+		case "secret_store": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "secrets_store" && entry.logicalName === logicalName);
+		case "dispatch_namespace": return lookupDispatchNamespace(ctx, logicalName, field, fieldPath);
+		case "worker": return lookupWorker(ctx, logicalName, field, fieldPath);
+		case "import": return lookupImport(ctx, logicalName, field, fieldPath);
+		case "logpush_pipelines": return lookupLogpushPipelines(ctx, logicalName, field, fieldPath);
+		case "config": return lookupConfigField(ctx, logicalName, field, fieldPath);
+		default: throw new TamerReferenceError(`Unknown reference kind "${kind}" — expected one of d1 | r2 | kv | queue | hyperdrive | vectorize | ai_gateway | pipeline | workflow | secret_store | dispatch_namespace | worker | import | logpush_pipelines | config`, fieldPath);
+	}
+}
+function lookupConfigField(ctx, _logicalName, field, fieldPath) {
+	if (field === "account_id") {
+		const id = (ctx.accountId ?? ctx.config.account_id ?? "").trim();
+		if (!id) throw new TamerReferenceError(`Reference \${tamer:config:stack.account_id} needs the stack Cloudflare account id — set top-level account_id in tamer/project.config.ts or pass CLOUDFLARE_ACCOUNT_ID when running tamer.`, fieldPath);
+		return id;
+	}
+	throw new TamerReferenceError(`Unknown field "${field}" on config reference — expected account_id`, fieldPath);
+}
+function getLogpushPipelinesEntry(ctx, logicalName, fieldPath) {
+	const all = ctx.state.getAll();
+	const entry = Object.values(all).find((e) => e.type === "logpush_pipelines" && e.logicalName === logicalName);
+	if (!entry) throw new TamerReferenceError(`Reference \${tamer:logpush_pipelines:${logicalName}.…} cannot be resolved — no pipelines graph in state for logpush job "${logicalName}". Run a full \`tamer apply\` (including the Logpush / pipelinesAuto step) for env "${ctx.env}" first.`, fieldPath);
+	return entry;
+}
+/**
+* Exposes fields from the `logpush_pipelines:*` D1 state row (after
+* `ensurePipelinesLogpushProvision` has run) for `outputs` and `vars`, e.g.
+* `${tamer:logpush_pipelines:workers-trace.r2_data_catalog_table_name}`.
+*/
+function lookupLogpushPipelines(ctx, logicalName, field, fieldPath) {
+	const entry = getLogpushPipelinesEntry(ctx, logicalName, fieldPath);
+	switch (field) {
+		case "r2_data_catalog_table_name":
+		case "iceberg_table": {
+			const v = entry.r2DataCatalogTableName?.trim();
+			if (!v) throw new TamerReferenceError(`logpush_pipelines state for "${logicalName}" has no r2DataCatalogTableName (sink not yet created, or pre-upgrade state). Re-run a full \`tamer apply\` for env "${ctx.env}" after pipelinesAuto provisions the sink, or set table manually in consuming stack.`, fieldPath);
+			return v;
+		}
+		case "r2_data_catalog_table_name_pipelines":
+		case "iceberg_table_pipelines": {
+			const v = entry.r2DataCatalogTableNamePipelines?.trim();
+			if (v) return v;
+			const fallback = entry.r2DataCatalogTableName?.trim();
+			if (!fallback) throw new TamerReferenceError(`logpush_pipelines state for "${logicalName}" has no table name (sink not yet created). Re-run \`tamer apply\` for env "${ctx.env}".`, fieldPath);
+			return fallback;
+		}
+		case "r2_data_catalog_namespace":
+		case "iceberg_namespace": return (entry.r2DataCatalogNamespace ?? "default").trim() || "default";
+		case "name": return entry.pipelineName;
+		case "id": return entry.pipelineId;
+		default: throw new TamerReferenceError(`Unknown field "${field}" on logpush_pipelines reference — expected r2_data_catalog_table_name | r2_data_catalog_table_name_pipelines | r2_data_catalog_namespace | name | id | iceberg_table | iceberg_table_pipelines | iceberg_namespace`, fieldPath);
+	}
+}
+/**
+* Resolve a `${tamer:import:<stack>.<output>}` against pre-fetched sibling
+* stack outputs. The pre-fetch (`fetchStackImports`) loads every imported
+* stack's `cfi_state:{stack}` row before resolution begins; this lookup is
+* pure map access. Throws if the stack isn't in `ctx.imports` (config
+* never declared it / pre-fetch wasn't wired in for this command) or if
+* the named output hasn't been published yet (sibling stack hasn't run
+* `apply` since the output was declared, or has been destroyed).
+*/
+function lookupImport(ctx, stackName, outputName, fieldPath) {
+	const imports = ctx.imports;
+	if (!imports || !(stackName in imports)) throw new TamerReferenceError(`Reference \${tamer:import:${stackName}.${outputName}} cannot be resolved — no imported stack "${stackName}" available. Ensure stack "${stackName}" exists in env "${ctx.env}" (run 'tamer apply' there first) and that the current command pre-fetches sibling stacks.`, fieldPath);
+	const stackOutputs = imports[stackName];
+	if (!(outputName in stackOutputs)) {
+		const available = Object.keys(stackOutputs).sort();
+		throw new TamerReferenceError(`Reference \${tamer:import:${stackName}.${outputName}} cannot be resolved — output "${outputName}" not found on imported stack "${stackName}".${available.length > 0 ? ` Available outputs on stack "${stackName}": ${available.join(", ")}.` : ` Stack "${stackName}" has no published outputs — run 'tamer apply' there with an \`outputs:\` block.`}`, fieldPath);
+	}
+	return stackOutputs[outputName];
+}
+function lookupResource(ctx, kind, logicalName, field, fieldPath, predicate) {
+	const all = ctx.state.getAll();
+	const entry = Object.values(all).find(predicate);
+	if (!entry) throw new TamerReferenceError(`Reference \${tamer:${kind}:${logicalName}.${field}} cannot be resolved — no ${kind} resource named "${logicalName}" in state. Run 'tamer apply --env ${ctx.env}' first.`, fieldPath);
+	switch (field) {
+		case "name": return resourceName(entry);
+		case "id": return resourceId(entry, kind, logicalName, fieldPath);
+		case "binding": return resourceBinding(entry);
+		default: throw new TamerReferenceError(`Unknown field "${field}" on ${kind} reference — expected name | id | binding`, fieldPath);
+	}
+}
+function resourceName(entry) {
+	switch (entry.type) {
+		case "d1_database":
+		case "kv_namespace":
+		case "queue":
+		case "hyperdrive":
+		case "vectorize":
+		case "ai_gateway":
+		case "pipeline":
+		case "workflow":
+		case "secrets_store":
+		case "dispatch_namespace":
+		case "r2_bucket": return entry.derivedName;
+		case "dns_record": return entry.name;
+		case "logpush_job": return entry.derivedName;
+		case "logpush_pipelines": return entry.pipelineName;
+		case "worker_route": return entry.pattern;
+	}
+}
+function resourceId(entry, kind, logicalName, fieldPath) {
+	switch (entry.type) {
+		case "d1_database":
+		case "kv_namespace":
+		case "queue":
+		case "hyperdrive":
+		case "vectorize":
+		case "ai_gateway":
+		case "pipeline":
+		case "workflow":
+		case "secrets_store": return entry.cfId;
+		case "r2_bucket": throw new TamerReferenceError(`R2 bucket "${logicalName}" has no .id (R2 buckets are addressed by name); use \${tamer:${kind}:${logicalName}.name}`, fieldPath);
+		case "dispatch_namespace": return entry.derivedName;
+		case "dns_record": return entry.recordId;
+		case "logpush_job": return String(entry.cfJobId);
+		case "logpush_pipelines": return entry.pipelineId;
+		case "worker_route": return entry.routeId;
+	}
+}
+function resourceBinding(entry) {
+	switch (entry.type) {
+		case "d1_database":
+		case "r2_bucket":
+		case "kv_namespace":
+		case "queue":
+		case "hyperdrive":
+		case "vectorize":
+		case "ai_gateway":
+		case "pipeline":
+		case "workflow":
+		case "secrets_store": return entry.bindingKey;
+		case "dispatch_namespace": return entry.derivedName;
+		case "dns_record": throw new Error("internal: dns_record has no .binding — use .name or .id in config references");
+		case "logpush_job": throw new Error("internal: logpush_job has no .binding — use .name or .id in config references");
+		case "logpush_pipelines": throw new Error("internal: logpush_pipelines has no .binding — use .name or .id in config references");
+		case "worker_route": return entry.routeId;
+	}
+}
+function lookupDispatchNamespace(ctx, logicalName, field, fieldPath) {
+	if (!getDispatchNamespaces(ctx.config).find((d) => d.logicalName === logicalName)) throw new TamerReferenceError(`Reference \${tamer:dispatch_namespace:${logicalName}.${field}} cannot be resolved — no dispatchNamespaces entry named "${logicalName}" in the Tamer project config`, fieldPath);
+	if (field !== "name" && field !== "id") throw new TamerReferenceError(`Unknown field "${field}" on dispatch_namespace reference — expected name | id`, fieldPath);
+	const all = ctx.state.getAll();
+	const stateEntry = Object.values(all).find((e) => e.type === "dispatch_namespace" && e.logicalName === logicalName);
+	if (!stateEntry || stateEntry.type !== "dispatch_namespace") throw new TamerReferenceError(`Reference \${tamer:dispatch_namespace:${logicalName}.${field}} unresolved — no state entry. Run 'tamer apply --env ${ctx.env}' first.`, fieldPath);
+	return stateEntry.derivedName;
+}
+function lookupWorker(ctx, workerKey, field, fieldPath) {
+	let target;
+	if (ctx.config.workers && ctx.config.workers[workerKey]) target = ctx.config.workers[workerKey];
+	else if (ctx.config.worker && workerKey === "default") target = ctx.config.worker;
+	if (!target) throw new TamerReferenceError(`Reference \${tamer:worker:${workerKey}.${field}} cannot be resolved — no worker key "${workerKey}" in the Tamer project config`, fieldPath);
+	if (field !== "name") throw new TamerReferenceError(`Unknown field "${field}" on worker reference — only "name" is supported (the env-suffixed deployed script name)`, fieldPath);
+	return resolveDeployedWorkerName(ctx.config, workerKey, target, ctx.env, ctx.naming);
+}
+
+//#endregion
+//#region src/core/config/resolver.ts
+/** Wrangler script name after env suffix rules (matches `tamer deploy`). */
+function resolveDeployedWorkerName(_config, workerKey, workerConfig, env, naming) {
+	const sn = workerConfig.scriptName?.trim();
+	if (sn) {
+		if (env === "local") return sn;
+		return `${sn}-${env}`;
+	}
+	return naming.workerName(workerKey, env);
+}
+/**
+* Map from base service-binding target name (`scriptName` for envs other than
+* `local`, or the local-deployed name) → env-suffixed deployed name for every
+* worker in `config`. Used to auto-rewrite intra-stack `services[].service`
+* fields so fixtures don't have to repeat env overrides for every env.
+*/
+function buildIntraStackScriptNameMap(config, env, naming) {
+	const map = /* @__PURE__ */ new Map();
+	if (config.workers) for (const [key, wc] of Object.entries(config.workers)) {
+		const baseName = wc.scriptName?.trim() ?? naming.workerName(key, "local");
+		const deployed = resolveDeployedWorkerName(config, key, wc, env, naming);
+		map.set(baseName, deployed);
+	}
+	if (config.worker) {
+		const w = config.worker;
+		const baseName = w.scriptName?.trim() ?? naming.workerName("default", "local");
+		const deployed = resolveDeployedWorkerName(config, "default", w, env, naming);
+		map.set(baseName, deployed);
+	}
+	return map;
+}
+/** Returns a worker config copy whose `services[].service` is rewritten to env-suffixed deployed names. */
+function rewriteIntraStackServiceTargets(workerConfig, baseToDeployed) {
+	const services = workerConfig.services;
+	if (!services || services.length === 0) return workerConfig;
+	let rewroteAny = false;
+	const rewritten = services.map((s) => {
+		const target = baseToDeployed.get(s.service);
+		if (!target || target === s.service) return s;
+		rewroteAny = true;
+		return {
+			...s,
+			service: target
+		};
+	});
+	if (!rewroteAny) return workerConfig;
+	return {
+		...workerConfig,
+		services: rewritten
+	};
+}
+function mergeVars(base = {}, override = {}) {
+	return {
+		...base,
+		...override
+	};
+}
+/** Same env merge as `resolveWorkerConfig` (for deploy topo-sort service edges). */
+function mergedWorkerConfigForEnv(workerConfig, env, tenant) {
+	let merged = { ...workerConfig };
+	if (env === "local" && workerConfig.local) merged = {
+		...merged,
+		...workerConfig.local,
+		vars: mergeVars(workerConfig.vars, workerConfig.local.vars)
+	};
+	else if (workerConfig.env?.[env]) {
+		const envOverride = workerConfig.env[env];
+		merged = {
+			...merged,
+			...envOverride,
+			vars: mergeVars(workerConfig.vars, envOverride.vars)
+		};
+	}
+	const mv = merged.vars;
+	if (mv && Object.prototype.hasOwnProperty.call(mv, "BRANCH_SUFFIX")) merged = {
+		...merged,
+		vars: {
+			...mv,
+			BRANCH_SUFFIX: isEphemeralEnv(env, tenant) ? env : ""
+		}
+	};
+	return merged;
+}
+/**
+* Align `dispatch_namespaces[].namespace` and `vars.WFP_NAMESPACE` with
+* {@link effectiveDispatchNamespaceName} for envs that have no explicit
+* `worker.env[env]` block (e.g. `pr-*` shared namespace).
+*/
+function applyDispatchNamespaceEnvOverrides(config, merged, env) {
+	const dns = getDispatchNamespaces(config);
+	if (dns.length === 0) return merged;
+	const resolved = effectiveDispatchNamespaceName(dns[0], env, config.tenant);
+	const m = merged;
+	let next = merged;
+	if (m.dispatch_namespaces?.length) next = {
+		...next,
+		dispatch_namespaces: m.dispatch_namespaces.map((d) => ({
+			...d,
+			namespace: resolved
+		}))
+	};
+	if (m.vars && typeof m.vars.WFP_NAMESPACE === "string" && m.vars.WFP_NAMESPACE === dns[0].namespace) {
+		const v = next.vars;
+		next = {
+			...next,
+			vars: {
+				...v,
+				WFP_NAMESPACE: resolved
+			}
+		};
+	}
+	return next;
+}
+/**
+* Walk the merged worker config and replace `${tamer:<kind>:<logical>.<field>}`
+* references in `vars` and `tamerRoutes[].host` / `.zone` against the current
+* state snapshot. Also resolves `r2_buckets[].bucket_name`,
+* **`services[].service`**, **`dispatch_namespaces[].namespace`**, and
+* `resources.d1[].databaseName` when `ownership` is `external`. Throws
+* `TamerReferenceError` (with field path) if any
+* reference is unresolved — bubbles up to the caller as a fatal.
+*/
+function resolveCrossResourceReferences(merged, ctx) {
+	const refCtx = {
+		config: ctx.config,
+		env: ctx.env,
+		state: ctx.state,
+		naming: ctx.naming,
+		tolerant: ctx.tolerant,
+		imports: ctx.imports,
+		accountId: ctx.accountId
+	};
+	const m = merged;
+	let next = merged;
+	if (m.vars) {
+		const resolvedVars = resolveReferencesInVars(materializeVars(m.vars), refCtx, `worker[${ctx.workerKey}].vars`);
+		if (resolvedVars && resolvedVars !== m.vars) next = {
+			...next,
+			vars: resolvedVars
+		};
+	}
+	const tamerRoutes = next.tamerRoutes;
+	if (tamerRoutes && tamerRoutes.length > 0) {
+		let mutated = false;
+		const resolvedRoutes = tamerRoutes.map((r, idx) => {
+			const fieldBase = `worker[${ctx.workerKey}].tamerRoutes[${idx}]`;
+			const host = resolveReferencesInString(r.host, refCtx, `${fieldBase}.host`);
+			const zone = r.zone ? resolveReferencesInString(r.zone, refCtx, `${fieldBase}.zone`) : r.zone;
+			if (host !== r.host || zone !== r.zone) mutated = true;
+			return {
+				...r,
+				host,
+				...zone !== void 0 ? { zone } : {}
+			};
+		});
+		if (mutated) next = {
+			...next,
+			tamerRoutes: resolvedRoutes
+		};
+	}
+	const r2Buckets = next.r2_buckets;
+	if (r2Buckets && r2Buckets.length > 0) {
+		let mutated = false;
+		const resolvedBuckets = r2Buckets.map((b, idx) => {
+			const raw = b.bucket_name;
+			if (raw === void 0) return b;
+			const fieldBase = `worker[${ctx.workerKey}].r2_buckets[${idx}].bucket_name`;
+			const bucket_name = resolveReferencesInString(materializeTamerResolvable(raw), refCtx, fieldBase);
+			if (bucket_name !== raw) mutated = true;
+			return {
+				...b,
+				bucket_name
+			};
+		});
+		if (mutated) next = {
+			...next,
+			r2_buckets: resolvedBuckets
+		};
+	}
+	const svc = next.services;
+	if (svc && svc.length > 0) {
+		let mutated = false;
+		const resolvedSvc = svc.map((s, idx) => {
+			const raw = s.service;
+			const fieldBase = `worker[${ctx.workerKey}].services[${idx}].service`;
+			const service = resolveReferencesInString(materializeTamerResolvable(raw), refCtx, fieldBase);
+			if (service !== raw) mutated = true;
+			return {
+				...s,
+				service
+			};
+		});
+		if (mutated) next = {
+			...next,
+			services: resolvedSvc
+		};
+	}
+	const dispatchNsMerged = next.dispatch_namespaces;
+	if (dispatchNsMerged && dispatchNsMerged.length > 0) {
+		let mutated = false;
+		const resolvedDn = dispatchNsMerged.map((d, idx) => {
+			const raw = d.namespace;
+			const fieldBase = `worker[${ctx.workerKey}].dispatch_namespaces[${idx}].namespace`;
+			const namespace = resolveReferencesInString(materializeTamerResolvable(raw), refCtx, fieldBase);
+			if (namespace !== raw) mutated = true;
+			return {
+				...d,
+				namespace
+			};
+		});
+		if (mutated) next = {
+			...next,
+			dispatch_namespaces: resolvedDn
+		};
+	}
+	const resBlock = next.resources;
+	if (resBlock?.d1 && resBlock.d1.length > 0) {
+		let mutated = false;
+		const d1Resolved = resBlock.d1.map((d1c, idx) => {
+			if (d1c.ownership !== "external" || !d1c.databaseName) return d1c;
+			const fieldBase = `worker[${ctx.workerKey}].resources.d1[${idx}].databaseName`;
+			const databaseName = resolveReferencesInString(materializeTamerResolvable(d1c.databaseName), refCtx, fieldBase);
+			if (databaseName !== d1c.databaseName) mutated = true;
+			return {
+				...d1c,
+				databaseName
+			};
+		});
+		if (mutated) next = {
+			...next,
+			resources: {
+				...resBlock,
+				d1: d1Resolved
+			}
+		};
+	}
+	return next;
+}
+function stripTamerFields(config) {
+	const { path, config: configPath, resources, local, env, scriptName: _scriptName, wranglerOutFile: _out, dispatchNamespace: _dispatchNs, tamerRoutes: _tamerRoutes, tamerStaleRouteSweepZones: _tamerStaleRouteSweepZones, ...rest } = config;
+	return rest;
+}
+/**
+* Env merge + intra-stack `services` rewrite + sibling-stack resolution for
+* **`resources.d1[].databaseName` only** when `ownership: "external"`.
+*
+* Use before {@link ResourceModule.pickResources} during `apply` / `sync` /
+* `drift` so imported D1 names are known **without** resolving worker `vars`
+* (those references often need resources created earlier in the same `apply`).
+*/
+function mergeWorkerConfigForResourcePick(config, workerKey, workerConfig, env, accountId, naming, state, opts = {}) {
+	let merged = mergedWorkerConfigForEnv(workerConfig, env, config.tenant);
+	merged = applyDispatchNamespaceEnvOverrides(config, merged, env);
+	const intraMap = buildIntraStackScriptNameMap(config, env, naming);
+	merged = rewriteIntraStackServiceTargets(merged, intraMap);
+	const refCtx = {
+		config,
+		env,
+		state,
+		naming,
+		tolerant: opts.referencesMode === "tolerant",
+		imports: opts.imports,
+		accountId
+	};
+	const resBlock = merged.resources;
+	if (!resBlock?.d1?.length) return merged;
+	const d1Resolved = resBlock.d1.map((d1c, idx) => {
+		if (d1c.ownership !== "external" || !d1c.databaseName) return d1c;
+		const fieldBase = `worker[${workerKey}].resources.d1[${idx}].databaseName`;
+		const databaseName = resolveReferencesInString(materializeTamerResolvable(d1c.databaseName), refCtx, fieldBase);
+		return {
+			...d1c,
+			databaseName
+		};
+	});
+	return {
+		...merged,
+		resources: {
+			...resBlock,
+			d1: d1Resolved
+		}
+	};
+}
+/**
+* Env-merged worker config with every `${tamer:…}` site resolved for wrangler
+* (`vars`, `tamerRoutes`, `r2_buckets[].bucket_name`, external D1 names).
+* Used by {@link resolveWorkerConfig} after resource state is up to date.
+*/
+function mergeWorkerConfigWithResolvedRefs(config, workerKey, workerConfig, env, accountId, naming, state, opts = {}) {
+	let merged = mergedWorkerConfigForEnv(workerConfig, env, config.tenant);
+	merged = applyDispatchNamespaceEnvOverrides(config, merged, env);
+	const intraMap = buildIntraStackScriptNameMap(config, env, naming);
+	merged = rewriteIntraStackServiceTargets(merged, intraMap);
+	return resolveCrossResourceReferences(merged, {
+		config,
+		env,
+		state,
+		naming,
+		workerKey,
+		tolerant: opts.referencesMode === "tolerant",
+		imports: opts.imports,
+		accountId
+	});
+}
+async function resolveWorkerConfig(config, workerKey, workerConfig, env, baseDir, accountId, naming, state, opts = {}) {
+	const merged = mergeWorkerConfigWithResolvedRefs(config, workerKey, workerConfig, env, accountId, naming, state, opts);
+	const workerDir = workerConfig.path ? resolve(baseDir, workerConfig.path) : baseDir;
+	const m = merged;
+	const workerName = resolveDeployedWorkerName(config, workerKey, merged, env, naming);
+	const wranglerOutFile = assertSafeWranglerOutFile(m.wranglerOutFile?.trim() || "wrangler.json");
+	const dispatchNamespace = m.dispatchNamespace?.trim() || void 0;
+	const stripped = stripTamerFields(merged);
+	const tamerRoutes = merged.tamerRoutes;
+	const expandedRoutes = effectiveRoutesForEnv(tamerRoutes, env);
+	const apiManagedRoutes = expandedRoutes.filter(isApiManagedZoneRoute);
+	const wranglerTamerRoutes = expandedRoutes.filter(isWranglerOnlyTamerRoute);
+	const mergedRoutes = [...stripped.routes ?? [], ...wranglerTamerRoutes];
+	/** Non-local deploys emit `routes: []` when there are none — omitting `routes` can leave stale Wrangler-published custom domains attached from a prior config. */
+	const wranglerRoutes = mergedRoutes.length > 0 ? mergedRoutes : env === "local" ? void 0 : [];
+	return {
+		workerKey,
+		workerName,
+		workerDir,
+		env,
+		wranglerOutFile,
+		dispatchNamespace,
+		wranglerConfig: {
+			...stripped,
+			...wranglerRoutes !== void 0 ? { routes: wranglerRoutes } : {},
+			name: workerName,
+			account_id: accountId,
+			compatibility_date: stripped.compatibility_date ?? config.compatibility_date
+		},
+		resources: merged.resources ?? workerConfig.resources ?? {},
+		apiManagedRoutes
+	};
+}
+
+//#endregion
+//#region src/features/d1/d1.ownership.ts
+function d1IsExternal(config) {
+	return config.ownership === "external";
+}
+/**
+* Skip provision / migrate / Cloudflare delete for this binding.
+* `preserveOnDestroy` alone keeps legacy "same derived name as owner" behaviour.
+*/
+function d1SkipsProvisionAndMigrate(config) {
+	return d1IsExternal(config) || config.preserveOnDestroy === true;
+}
+/** Cloudflare D1 database name for state keys, sync, and wrangler `database_name`. */
+function d1CloudflareDatabaseName(config, env, naming) {
+	if (config.type !== "single") throw new Error(`D1 "${config.logicalName}": expected type "single" for derived database name`);
+	if (d1IsExternal(config)) {
+		const n = config.databaseName;
+		if (typeof n !== "string" || !n.trim()) throw new Error(`D1 "${config.logicalName}" has ownership "external" but databaseName is empty — ensure imports are pre-fetched and config is merged with resolveWorkerConfig / mergeWorkerConfigWithResolvedRefs.`);
+		return n.trim();
+	}
+	return naming.d1SingleName(config.logicalName, env);
+}
+
+//#endregion
+//#region src/features/d1/d1.apply.ts
+function todayNoDashes() {
+	return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10).replace(/-/g, "");
+}
+function todayIso$1() {
+	return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+}
+async function d1Apply(resources, tenant, env, api, state, naming, addShard) {
+	for (const config of resources) {
+		if (config.type === "single") {
+			const derivedName$1 = d1CloudflareDatabaseName(config, env, naming);
+			if (state.get(derivedName$1)) continue;
+			if (d1SkipsProvisionAndMigrate(config)) {
+				console.warn(`[apply] Skipping D1 create for "${config.logicalName}" (external / preserveOnDestroy). Run \`tamer sync\` after the owning stack has created ${derivedName$1}.`);
+				continue;
+			}
+			const { uuid: uuid$1 } = await api.d1Create(derivedName$1);
+			state.set(derivedName$1, {
+				type: "d1_database",
+				logicalName: config.logicalName,
+				derivedName: derivedName$1,
+				bindingKey: config.binding?.trim() || naming.d1SingleBindingKey(config.logicalName),
+				cfId: uuid$1,
+				migrationsDir: config.migrationsDir,
+				preserveOnDestroy: false,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			continue;
+		}
+		if (addShard && addShard !== config.logicalName) continue;
+		if (addShard && addShard === config.logicalName) {
+			const shardDate$1 = todayNoDashes();
+			const derivedName$1 = naming.d1ShardName(config.logicalName, shardDate$1, env);
+			if (state.get(derivedName$1)) continue;
+			const { uuid: uuid$1 } = await api.d1Create(derivedName$1);
+			state.set(derivedName$1, {
+				type: "d1_database",
+				logicalName: config.logicalName,
+				shardDate: todayIso$1(),
+				derivedName: derivedName$1,
+				bindingKey: naming.d1ShardBindingKey(config.logicalName, shardDate$1),
+				cfId: uuid$1,
+				migrationsDir: config.migrationsDir,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			continue;
+		}
+		const allResources = state.getAll();
+		if (Object.values(allResources).filter((e) => e.type === "d1_database" && "logicalName" in e && e.logicalName === config.logicalName).length > 0) continue;
+		const shardDate = todayNoDashes();
+		const derivedName = naming.d1ShardName(config.logicalName, shardDate, env);
+		const { uuid } = await api.d1Create(derivedName);
+		state.set(derivedName, {
+			type: "d1_database",
+			logicalName: config.logicalName,
+			shardDate: todayIso$1(),
+			derivedName,
+			bindingKey: naming.d1ShardBindingKey(config.logicalName, shardDate),
+			cfId: uuid,
+			migrationsDir: config.migrationsDir,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	}
+}
+
+//#endregion
+//#region src/features/d1/d1.naming.ts
+function d1MatchPattern(config, env, naming) {
+	if (config.type === "single") {
+		const exactName = naming.d1SingleName(config.logicalName, env);
+		return (name) => name === exactName;
+	}
+	return naming.d1MatchPattern(config.logicalName, env);
+}
+function d1ExtractShardDate(name, naming) {
+	return naming.extractD1ShardDate(name);
+}
+
+//#endregion
+//#region src/features/d1/d1.sync.ts
+function d1Sync(allD1, resources, tenant, env, state, naming) {
+	for (const config of resources) {
+		const pattern = d1MatchPattern(config, env, naming);
+		if (config.type === "single") {
+			const derivedKey = d1CloudflareDatabaseName(config, env, naming);
+			const match = allD1.find((db) => db.name === derivedKey);
+			if (match) state.set(match.name, {
+				type: "d1_database",
+				logicalName: config.logicalName,
+				derivedName: match.name,
+				bindingKey: config.binding?.trim() || naming.d1SingleBindingKey(config.logicalName),
+				cfId: match.uuid,
+				migrationsDir: config.migrationsDir,
+				preserveOnDestroy: d1SkipsProvisionAndMigrate(config),
+				createdAt: match.created_at,
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			continue;
+		}
+		const shards = allD1.filter((db) => pattern(db.name));
+		for (const shard of shards) {
+			const shardDate = d1ExtractShardDate(shard.name, naming);
+			if (!shardDate) continue;
+			state.set(shard.name, {
+				type: "d1_database",
+				logicalName: config.logicalName,
+				shardDate,
+				derivedName: shard.name,
+				bindingKey: naming.d1ShardBindingKey(config.logicalName, shardDate),
+				cfId: shard.uuid,
+				migrationsDir: config.migrationsDir,
+				createdAt: shard.created_at,
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			});
+		}
+	}
+}
+
+//#endregion
+//#region src/features/d1/d1.drift.ts
+/**
+* Diff D1 state against the Cloudflare list and the current config.
+*
+* - **single**: one expected derived name per resource.
+* - **sharded**: every CF database matching the pattern is "expected"; state
+*   should contain an entry for each.
+*/
+function d1Drift(allD1, resources, env, state, naming) {
+	const drift = {
+		kind: "d1",
+		missingFromCloudflare: [],
+		unrecordedInState: [],
+		undeployed: []
+	};
+	const cfByName = new Map(allD1.map((db) => [db.name, db.uuid]));
+	const allState = state.getAll();
+	const d1State = Object.values(allState).filter((e) => e.type === "d1_database");
+	for (const config of resources) {
+		if (config.type === "single") {
+			const derivedName = d1CloudflareDatabaseName(config, env, naming);
+			const cfId = cfByName.get(derivedName);
+			const stateEntry = d1State.find((e) => e.logicalName === config.logicalName && !e.shardDate);
+			if (stateEntry && !cfId) drift.missingFromCloudflare.push(toEntry(stateEntry));
+			else if (cfId && !stateEntry) drift.unrecordedInState.push({
+				logicalName: config.logicalName,
+				derivedName,
+				cfId
+			});
+			else if (!cfId && !stateEntry) drift.undeployed.push({
+				logicalName: config.logicalName,
+				derivedName
+			});
+			continue;
+		}
+		const pattern = naming.d1MatchPattern(config.logicalName, env);
+		const cfShards = allD1.filter((db) => pattern(db.name));
+		const cfShardNames = new Set(cfShards.map((s) => s.name));
+		const stateShards = d1State.filter((e) => e.logicalName === config.logicalName && !!e.shardDate);
+		const stateShardNames = new Set(stateShards.map((s) => s.derivedName));
+		for (const shard of stateShards) if (!cfShardNames.has(shard.derivedName)) drift.missingFromCloudflare.push(toEntry(shard));
+		for (const shard of cfShards) if (!stateShardNames.has(shard.name)) drift.unrecordedInState.push({
+			logicalName: config.logicalName,
+			derivedName: shard.name,
+			cfId: shard.uuid,
+			detail: d1ExtractShardDate(shard.name, naming) ?? void 0
+		});
+		if (cfShards.length === 0 && stateShards.length === 0) drift.undeployed.push({
+			logicalName: config.logicalName,
+			derivedName: `(no shards for ${config.logicalName})`
+		});
+	}
+	return drift;
+}
+function toEntry(e) {
+	return {
+		logicalName: e.logicalName,
+		derivedName: e.derivedName,
+		cfId: e.cfId,
+		detail: e.shardDate
+	};
+}
+
+//#endregion
+//#region src/core/config/resourcesFromConfig.ts
+/**
+* Logical resource names declared on workers in this config (for
+* stack-scoped destroy / drift). Iterates the resource registry — adding a
+* new kind doesn't require editing this file.
+*/
+async function logicalNamesForResourceKind(config, baseDir, kind) {
+	const mod = getResourceModule(kind);
+	if (!mod) return /* @__PURE__ */ new Set();
+	const workers = await getWorkers(config, baseDir);
+	const set = /* @__PURE__ */ new Set();
+	for (const [, wc] of workers) for (const r of mod.pickResources(wc)) {
+		const logical = r.logicalName;
+		if (logical) set.add(logical);
+	}
+	return set;
+}
+
+//#endregion
+//#region src/features/d1/d1.destroy.ts
+async function d1Destroy(_env, state, api, config, baseDir, _force) {
+	const owned = await logicalNamesForResourceKind(config, baseDir, "d1");
+	const resources = state.getAll();
+	const d1Entries = Object.values(resources).filter((e) => e.type === "d1_database");
+	for (const entry of d1Entries) {
+		if (!owned.has(entry.logicalName)) continue;
+		if (entry.preserveOnDestroy) {
+			console.log(`Skipping D1 destroy for ${entry.derivedName} (preserveOnDestroy / cross-stack binding).`);
+			continue;
+		}
+		try {
+			await api.d1Delete(entry.cfId);
+			state.delete(entry.derivedName);
+		} catch (err) {
+			console.warn(`Failed to delete D1 ${entry.derivedName}:`, err);
+		}
+	}
+}
+
+//#endregion
+//#region src/features/d1/d1.generate.ts
+function d1Generate(resources, env, state, naming) {
+	const bindings = [];
+	for (const config of resources) {
+		if (config.type === "single") {
+			const derivedName = d1CloudflareDatabaseName(config, env, naming);
+			const entry = state.get(derivedName);
+			if (!entry || entry.type !== "d1_database") {
+				if (d1SkipsProvisionAndMigrate(config)) throw new Error(`Cross-stack D1 "${config.logicalName}" (${derivedName}) not in state. Deploy the owning stack first, then re-run from this stack (apply now syncs automatically for env "${env}").`);
+				throw new Error(`D1 "${config.logicalName}" not in state. Run 'tamer apply --env ${env}' first.`);
+			}
+			bindings.push({
+				binding: entry.bindingKey,
+				database_id: entry.cfId,
+				database_name: derivedName,
+				migrations_dir: config.migrationsDir,
+				migrations_table: config.migrationsTable
+			});
+			continue;
+		}
+		const allResources = state.getAll();
+		const shards = Object.values(allResources).filter((e) => e.type === "d1_database" && e.logicalName === config.logicalName);
+		for (const shard of shards) bindings.push({
+			binding: shard.bindingKey,
+			database_id: shard.cfId,
+			database_name: shard.derivedName,
+			migrations_dir: config.migrationsDir,
+			migrations_table: config.migrationsTable
+		});
+	}
+	return bindings;
+}
+
+//#endregion
+//#region src/features/d1/d1.status.ts
+function d1Status(resources, env, state, naming) {
+	const results = [];
+	for (const config of resources) {
+		if (config.type === "single") {
+			const derivedName = d1CloudflareDatabaseName(config, env, naming);
+			const entry = state.get(derivedName);
+			results.push({
+				binding: config.binding?.trim() || naming.d1SingleBindingKey(config.logicalName),
+				name: derivedName,
+				cfId: entry?.cfId ?? "",
+				status: entry ? "ok" : "missing"
+			});
+			continue;
+		}
+		const allResources = state.getAll();
+		const shards = Object.values(allResources).filter((e) => e.type === "d1_database" && e.logicalName === config.logicalName);
+		for (const shard of shards) results.push({
+			binding: shard.bindingKey,
+			name: shard.derivedName,
+			cfId: shard.cfId,
+			status: "ok"
+		});
+		if (shards.length === 0) results.push({
+			binding: naming.d1ShardBindingKey(config.logicalName, "00000000"),
+			name: `(no shards for ${config.logicalName})`,
+			cfId: "",
+			status: "missing"
+		});
+	}
+	return results;
+}
+
+//#endregion
+//#region src/core/registry/pickResources.ts
+/**
+* Helper used by every {@link ResourceModule.pickResources} so module files
+* can accept either a full `WorkerConfig` (the common path from `apply`,
+* `sync`, `drift`, `status`) or a bare `WorkerResources` (the wrangler
+* generator passes `resolved.resources` directly). Returns `undefined`
+* when no resource map is present.
+*/
+function resourcesFrom(source) {
+	if (!source) return void 0;
+	if ("resources" in source) return source.resources;
+	return source;
+}
+
+//#endregion
+//#region src/features/d1/d1.module.ts
+const d1Module = {
+	kind: "d1",
+	label: "D1",
+	configKey: "d1",
+	stateEntryType: "d1_database",
+	async fetchAll(api) {
+		return api.d1ListAll();
+	},
+	async apply(ctx) {
+		await d1Apply(ctx.resources, ctx.tenant, ctx.env, ctx.api, ctx.state, ctx.naming, ctx.addShard);
+	},
+	sync(ctx) {
+		d1Sync(ctx.all, ctx.resources, ctx.tenant, ctx.env, ctx.state, ctx.naming);
+	},
+	drift(ctx) {
+		return d1Drift(ctx.all, ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	async destroy(ctx) {
+		await d1Destroy(ctx.env, ctx.state, ctx.api, ctx.config, ctx.baseDir, ctx.force);
+	},
+	status(ctx) {
+		return d1Status(ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	generate(ctx) {
+		if (ctx.resources.length === 0) return {};
+		const generated = d1Generate(ctx.resources, ctx.env, ctx.state, ctx.naming);
+		return { d1_databases: [...ctx.passthrough?.d1_databases ?? [], ...generated] };
+	},
+	pickResources(source) {
+		return resourcesFrom(source)?.d1 ?? [];
+	},
+	async destroyOne({ api, state, key, entry }) {
+		if (entry.type !== "d1_database") return;
+		try {
+			await api.d1Delete(entry.cfId);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Rollback: failed to delete D1 ${entry.derivedName}:`, err);
+		}
+	},
+	async importOne({ options, env, api, state, naming, ts }) {
+		if (!options.cfId) throw new Error("import d1: --cf-id <uuid> is required");
+		const hit = (await api.d1ListAll()).find((d) => d.uuid === options.cfId);
+		if (!hit) throw new Error(`import d1: D1 database with uuid "${options.cfId}" not found in account`);
+		const derivedName = options.shardDate ? naming.d1ShardName(options.logical, options.shardDate, env) : naming.d1SingleName(options.logical, env);
+		if (hit.name !== derivedName) throw new Error(`import d1: cf name "${hit.name}" does not match derived "${derivedName}" — wrong --logical, missing --shard-date, or naming convention drift?`);
+		const bindingKey = options.shardDate ? naming.d1ShardBindingKey(options.logical, options.shardDate) : naming.d1SingleBindingKey(options.logical);
+		const existing = state.get(derivedName);
+		if (existing && existing.type === "d1_database" && existing.cfId !== options.cfId) throw new Error(`import d1: state already tracks "${derivedName}" with a different cfId`);
+		const entry = {
+			type: "d1_database",
+			logicalName: options.logical,
+			shardDate: options.shardDate,
+			derivedName,
+			bindingKey,
+			cfId: options.cfId,
+			createdAt: existing?.type === "d1_database" ? existing.createdAt : ts,
+			updatedAt: ts
+		};
+		state.set(derivedName, entry);
+	}
+};
+
+//#endregion
+//#region src/features/r2/r2.apply.ts
+function existingR2ForLogical(state, logicalName) {
+	for (const e of Object.values(state.getAll())) if (e.type === "r2_bucket" && e.logicalName === logicalName) return e;
+}
+function todayIso() {
+	return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+}
+function assertValidR2BucketName(name, logicalName) {
+	const errors = [];
+	if (name.length < 3 || name.length > 63) errors.push(`length must be 3-63 chars (got ${name.length})`);
+	if (!/^[a-z0-9][a-z0-9-]*[a-z0-9]$/.test(name)) errors.push("must contain only lowercase letters, numbers, and hyphens, and start/end with a letter or number");
+	if (/--/.test(name)) errors.push("must not contain consecutive hyphens");
+	if (errors.length > 0) throw new Error(`Invalid R2 bucket name "${name}" (derived for logical resource "${logicalName}"): ${errors.join("; ")}. Adjust your naming.r2Bucket hook (e.g., replace underscores with hyphens and lowercase the result).`);
+}
+async function r2Apply(resources, tenant, env, api, state, naming) {
+	for (const config of resources) {
+		const derivedName = naming.r2BucketName(config.logicalName, env);
+		if (state.get(derivedName)) {
+			console.log(`R2: skip "${derivedName}" (already in state; logical "${config.logicalName}")`);
+			continue;
+		}
+		const prior = existingR2ForLogical(state, config.logicalName);
+		if (prior) {
+			console.log(`R2: skip "${derivedName}" (logical "${config.logicalName}" already in state as "${prior.derivedName}")`);
+			continue;
+		}
+		assertValidR2BucketName(derivedName, config.logicalName);
+		await api.r2Create(derivedName);
+		console.log(`R2: created "${derivedName}" (logical "${config.logicalName}")`);
+		state.set(derivedName, {
+			type: "r2_bucket",
+			logicalName: config.logicalName,
+			createdDate: todayIso(),
+			derivedName,
+			bindingKey: config.binding?.trim() || naming.r2BindingKey(config.logicalName),
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	}
+}
+
+//#endregion
+//#region src/features/r2/r2.naming.ts
+function r2ExtractDate(name, naming) {
+	return naming.extractR2Date(name);
+}
+
+//#endregion
+//#region src/features/r2/r2.sync.ts
+function r2Sync(allR2, resources, tenant, env, state, naming) {
+	for (const config of resources) {
+		const pattern = naming.r2MatchPattern(config.logicalName, env);
+		const match = allR2.find((b) => pattern(b.name));
+		if (match) {
+			const createdDate = r2ExtractDate(match.name, naming) ?? match.creation_date.slice(0, 10);
+			const prev = state.get(match.name);
+			state.set(match.name, {
+				type: "r2_bucket",
+				logicalName: config.logicalName,
+				createdDate,
+				derivedName: match.name,
+				bindingKey: config.binding?.trim() || (prev?.type === "r2_bucket" && prev.bindingKey ? prev.bindingKey : naming.r2BindingKey(config.logicalName)),
+				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			});
+		}
+	}
+}
+
+//#endregion
+//#region src/features/r2/r2.drift.ts
+/**
+* Diff R2 state against the Cloudflare list and the current config.
+*
+* R2 buckets carry a date stamp, so each declared resource matches at most one
+* bucket (the one whose name matches the logical-name pattern).
+*/
+function r2Drift(allR2, resources, env, state, naming) {
+	const drift = {
+		kind: "r2",
+		missingFromCloudflare: [],
+		unrecordedInState: [],
+		undeployed: []
+	};
+	const cfNames = new Set(allR2.map((b) => b.name));
+	const allState = state.getAll();
+	const r2State = Object.values(allState).filter((e) => e.type === "r2_bucket");
+	for (const config of resources) {
+		const pattern = naming.r2MatchPattern(config.logicalName, env);
+		const cfMatch = allR2.find((b) => pattern(b.name));
+		const stateEntry = r2State.find((e) => e.logicalName === config.logicalName);
+		if (stateEntry && !cfNames.has(stateEntry.derivedName)) {
+			drift.missingFromCloudflare.push({
+				logicalName: stateEntry.logicalName,
+				derivedName: stateEntry.derivedName
+			});
+			continue;
+		}
+		if (cfMatch && !stateEntry) {
+			drift.unrecordedInState.push({
+				logicalName: config.logicalName,
+				derivedName: cfMatch.name
+			});
+			continue;
+		}
+		if (!cfMatch && !stateEntry) drift.undeployed.push({
+			logicalName: config.logicalName,
+			derivedName: `(no bucket for ${config.logicalName})`
+		});
+	}
+	return drift;
+}
+
+//#endregion
+//#region src/features/r2/r2.destroy.ts
+async function r2Destroy(_env, state, api, config, baseDir, _force) {
+	const owned = await logicalNamesForResourceKind(config, baseDir, "r2");
+	const resources = state.getAll();
+	const r2Entries = Object.values(resources).filter((e) => e.type === "r2_bucket");
+	const accountId = api.getAccountId();
+	const s3creds = r2S3CredentialsFromEnv();
+	for (const entry of r2Entries) {
+		if (!owned.has(entry.logicalName)) continue;
+		const name = entry.derivedName;
+		if (s3creds) try {
+			console.log(`R2: emptying bucket "${name}" via S3 API (incomplete multipart uploads, then objects)…`);
+			const { uploadsAborted, objectsDeleted } = await emptyR2BucketViaS3(accountId, name, s3creds);
+			console.log(`R2: bucket "${name}" — aborted ${uploadsAborted} multipart upload(s), deleted ${objectsDeleted} object(s).`);
+		} catch (err) {
+			console.warn(`R2: S3 empty failed for "${name}" (fix credentials or use the dashboard; still attempting API bucket delete):`, err instanceof Error ? err.message : err);
+		}
+		else console.warn(`R2: skipping S3 empty for "${name}" (set R2_ACCESS_KEY_ID and R2_SECRET_ACCESS_KEY to remove all objects and incomplete multipart uploads before bucket delete). Create an R2 API token in the dashboard (R2 → Manage R2 API Tokens) with object read+write; those keys are not the same as CLOUDFLARE_API_TOKEN.`);
+		try {
+			await api.r2Delete(name);
+			state.delete(name);
+		} catch (err) {
+			console.warn(`Failed to delete R2 ${name}:`, err);
+		}
+	}
+}
+
+//#endregion
+//#region src/features/r2/r2.generate.ts
+function r2Generate(resources, env, state, naming) {
+	const bindings = [];
+	for (const config of resources) {
+		const allResources = state.getAll();
+		const entry = Object.values(allResources).find((e) => e.type === "r2_bucket" && e.logicalName === config.logicalName);
+		if (!entry) throw new Error(`R2 "${config.logicalName}" not in state. Run 'tamer apply --env ${env}' first.`);
+		bindings.push({
+			binding: entry.bindingKey,
+			bucket_name: entry.derivedName
+		});
+	}
+	return bindings;
+}
+
+//#endregion
+//#region src/features/r2/r2.status.ts
+function r2Status(resources, env, state, naming) {
+	const results = [];
+	for (const config of resources) {
+		const allResources = state.getAll();
+		const entry = Object.values(allResources).find((e) => e.type === "r2_bucket" && e.logicalName === config.logicalName);
+		results.push({
+			binding: entry?.bindingKey ?? naming.r2BindingKey(config.logicalName),
+			name: entry?.derivedName ?? naming.r2BucketName(config.logicalName, env),
+			status: entry ? "ok" : "missing"
+		});
+	}
+	return results;
+}
+
+//#endregion
+//#region src/features/r2/r2.module.ts
+const r2Module = {
+	kind: "r2",
+	label: "R2",
+	configKey: "r2",
+	stateEntryType: "r2_bucket",
+	async fetchAll(api) {
+		return api.r2ListAll();
+	},
+	async apply(ctx) {
+		await r2Apply(ctx.resources, ctx.tenant, ctx.env, ctx.api, ctx.state, ctx.naming);
+	},
+	sync(ctx) {
+		r2Sync(ctx.all, ctx.resources, ctx.tenant, ctx.env, ctx.state, ctx.naming);
+	},
+	drift(ctx) {
+		return r2Drift(ctx.all, ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	async destroy(ctx) {
+		await r2Destroy(ctx.env, ctx.state, ctx.api, ctx.config, ctx.baseDir, ctx.force);
+	},
+	status(ctx) {
+		return r2Status(ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	generate(ctx) {
+		if (ctx.resources.length === 0) return {};
+		return { r2_buckets: r2Generate(ctx.resources, ctx.env, ctx.state, ctx.naming) };
+	},
+	pickResources(source) {
+		return resourcesFrom(source)?.r2 ?? [];
+	},
+	async destroyOne({ api, state, key, entry }) {
+		if (entry.type !== "r2_bucket") return;
+		try {
+			await api.r2Delete(entry.derivedName);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Rollback: failed to delete R2 ${entry.derivedName}:`, err);
+		}
+	},
+	async importOne({ options, env, api, state, naming, ts }) {
+		const bucketName = options.cfId;
+		if (!bucketName) throw new Error("import r2: --cf-id <bucket-name> is required");
+		const hit = (await api.r2ListAll()).find((b) => b.name === bucketName);
+		if (!hit) throw new Error(`import r2: bucket "${bucketName}" not found in account`);
+		if (!naming.r2MatchPattern(options.logical, env)(hit.name)) throw new Error(`import r2: bucket name "${hit.name}" does not match expected pattern for logical "${options.logical}" and env "${env}"`);
+		const derivedName = hit.name;
+		const createdDate = options.createdDate ?? naming.extractR2Date(hit.name) ?? hit.creation_date.slice(0, 10);
+		const bindingKey = naming.r2BindingKey(options.logical);
+		const existing = state.get(derivedName);
+		const entry = {
+			type: "r2_bucket",
+			logicalName: options.logical,
+			derivedName,
+			bindingKey,
+			createdDate,
+			createdAt: existing?.type === "r2_bucket" ? existing.createdAt : ts,
+			updatedAt: ts
+		};
+		state.set(derivedName, entry);
+	}
+};
+
+//#endregion
+//#region src/features/kv/kv.apply.ts
+async function kvApply(resources, tenant, env, api, state, naming) {
+	for (const config of resources) {
+		const derivedName = naming.kvNamespaceName(config.logicalName, env);
+		if (state.get(derivedName)) continue;
+		const { id } = await api.kvCreate(derivedName);
+		state.set(derivedName, {
+			type: "kv_namespace",
+			logicalName: config.logicalName,
+			derivedName,
+			bindingKey: config.binding?.trim() || naming.kvBindingKey(config.logicalName),
+			cfId: id,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	}
+}
+
+//#endregion
+//#region src/features/kv/kv.sync.ts
+function kvSync(allKV, resources, tenant, env, state, naming) {
+	for (const config of resources) {
+		const derivedName = naming.kvNamespaceName(config.logicalName, env);
+		const match = allKV.find((ns) => ns.title === derivedName);
+		if (match) state.set(derivedName, {
+			type: "kv_namespace",
+			logicalName: config.logicalName,
+			derivedName,
+			bindingKey: config.binding?.trim() || naming.kvBindingKey(config.logicalName),
+			cfId: match.id,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	}
+}
+
+//#endregion
+//#region src/features/kv/kv.drift.ts
+function kvDrift(allKV, resources, env, state, naming) {
+	const drift = {
+		kind: "kv",
+		missingFromCloudflare: [],
+		unrecordedInState: [],
+		undeployed: []
+	};
+	const cfByTitle = new Map(allKV.map((ns) => [ns.title, ns.id]));
+	const allState = state.getAll();
+	const kvState = Object.values(allState).filter((e) => e.type === "kv_namespace");
+	for (const config of resources) {
+		const derivedName = naming.kvNamespaceName(config.logicalName, env);
+		const cfId = cfByTitle.get(derivedName);
+		const stateEntry = kvState.find((e) => e.logicalName === config.logicalName);
+		if (stateEntry && !cfId) drift.missingFromCloudflare.push({
+			logicalName: stateEntry.logicalName,
+			derivedName: stateEntry.derivedName,
+			cfId: stateEntry.cfId
+		});
+		else if (cfId && !stateEntry) drift.unrecordedInState.push({
+			logicalName: config.logicalName,
+			derivedName,
+			cfId
+		});
+		else if (!cfId && !stateEntry) drift.undeployed.push({
+			logicalName: config.logicalName,
+			derivedName
+		});
+	}
+	return drift;
+}
+
+//#endregion
+//#region src/features/kv/kv.destroy.ts
+async function kvDestroy(_env, state, api, config, baseDir, _force) {
+	const owned = await logicalNamesForResourceKind(config, baseDir, "kv");
+	const resources = state.getAll();
+	const kvEntries = Object.values(resources).filter((e) => e.type === "kv_namespace");
+	for (const entry of kvEntries) {
+		if (!owned.has(entry.logicalName)) continue;
+		try {
+			await api.kvDelete(entry.cfId);
+			state.delete(entry.derivedName);
+		} catch (err) {
+			console.warn(`Failed to delete KV ${entry.derivedName}:`, err);
+		}
+	}
+}
+
+//#endregion
+//#region src/features/kv/kv.generate.ts
+function kvGenerate(resources, env, state, naming) {
+	const bindings = [];
+	for (const config of resources) {
+		const derivedName = naming.kvNamespaceName(config.logicalName, env);
+		const entry = state.get(derivedName);
+		if (!entry || entry.type !== "kv_namespace") throw new Error(`KV "${config.logicalName}" not in state. Run 'tamer apply --env ${env}' first.`);
+		bindings.push({
+			binding: entry.bindingKey,
+			id: entry.cfId
+		});
+	}
+	return bindings;
+}
+
+//#endregion
+//#region src/features/kv/kv.status.ts
+function kvStatus(resources, env, state, naming) {
+	const results = [];
+	for (const config of resources) {
+		const derivedName = naming.kvNamespaceName(config.logicalName, env);
+		const entry = state.get(derivedName);
+		results.push({
+			binding: naming.kvBindingKey(config.logicalName),
+			name: derivedName,
+			status: entry ? "ok" : "missing"
+		});
+	}
+	return results;
+}
+
+//#endregion
+//#region src/features/kv/kv.module.ts
+const kvModule = {
+	kind: "kv",
+	label: "KV",
+	configKey: "kv",
+	stateEntryType: "kv_namespace",
+	async fetchAll(api) {
+		return (await api.kvListAll()).map((k) => ({
+			id: k.id,
+			title: k.title
+		}));
+	},
+	async apply(ctx) {
+		await kvApply(ctx.resources, ctx.tenant, ctx.env, ctx.api, ctx.state, ctx.naming);
+	},
+	sync(ctx) {
+		kvSync(ctx.all, ctx.resources, ctx.tenant, ctx.env, ctx.state, ctx.naming);
+	},
+	drift(ctx) {
+		return kvDrift(ctx.all, ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	async destroy(ctx) {
+		await kvDestroy(ctx.env, ctx.state, ctx.api, ctx.config, ctx.baseDir, ctx.force);
+	},
+	status(ctx) {
+		return kvStatus(ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	generate(ctx) {
+		if (ctx.resources.length === 0) return {};
+		return { kv_namespaces: kvGenerate(ctx.resources, ctx.env, ctx.state, ctx.naming) };
+	},
+	pickResources(source) {
+		return resourcesFrom(source)?.kv ?? [];
+	},
+	async destroyOne({ api, state, key, entry }) {
+		if (entry.type !== "kv_namespace") return;
+		try {
+			await api.kvDelete(entry.cfId);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Rollback: failed to delete KV ${entry.derivedName}:`, err);
+		}
+	},
+	async importOne({ options, env, api, state, naming, ts }) {
+		if (!options.cfId) throw new Error("import kv: --cf-id <namespace-id> is required");
+		const hit = (await api.kvListAll()).find((k) => k.id === options.cfId);
+		if (!hit) throw new Error(`import kv: KV namespace id "${options.cfId}" not found in account`);
+		const derivedName = naming.kvNamespaceName(options.logical, env);
+		if (hit.title !== derivedName) throw new Error(`import kv: cf title "${hit.title}" does not match derived "${derivedName}"`);
+		const bindingKey = naming.kvBindingKey(options.logical);
+		const existing = state.get(derivedName);
+		const entry = {
+			type: "kv_namespace",
+			logicalName: options.logical,
+			derivedName,
+			bindingKey,
+			cfId: options.cfId,
+			createdAt: existing?.type === "kv_namespace" ? existing.createdAt : ts,
+			updatedAt: ts
+		};
+		state.set(derivedName, entry);
+	}
+};
+
+//#endregion
+//#region src/features/queues/queues.apply.ts
+const STATE_KEY_PREFIX$6 = "queue:";
+function stateKey$6(derivedName) {
+	return `${STATE_KEY_PREFIX$6}${derivedName}`;
+}
+async function queuesApply(resources, _tenant, env, api, state, naming) {
+	for (const config of resources) {
+		const derivedName = naming.queueName(config.logicalName, env);
+		const key = stateKey$6(derivedName);
+		if (state.get(key)) continue;
+		const ts = (/* @__PURE__ */ new Date()).toISOString();
+		const { queue_id } = await api.queueCreate(derivedName);
+		state.set(key, {
+			type: "queue",
+			logicalName: config.logicalName,
+			derivedName,
+			bindingKey: config.binding?.trim() || naming.queueBindingKey(config.logicalName),
+			cfId: queue_id,
+			producerBinding: !config.consumerOnly,
+			createdAt: ts,
+			updatedAt: ts
+		});
+	}
+}
+
+//#endregion
+//#region src/features/queues/queues.sync.ts
+function queuesSync(allQueues, resources, _tenant, env, state, naming) {
+	for (const config of resources) {
+		const derivedName = naming.queueName(config.logicalName, env);
+		const match = allQueues.find((q) => q.queue_name === derivedName);
+		if (!match) continue;
+		const key = `queue:${derivedName}`;
+		const existing = state.get(key);
+		const ts = (/* @__PURE__ */ new Date()).toISOString();
+		state.set(key, {
+			type: "queue",
+			logicalName: config.logicalName,
+			derivedName,
+			bindingKey: config.binding?.trim() || naming.queueBindingKey(config.logicalName),
+			cfId: match.queue_id,
+			producerBinding: !config.consumerOnly,
+			createdAt: existing?.type === "queue" ? existing.createdAt : ts,
+			updatedAt: ts
+		});
+	}
+}
+
+//#endregion
+//#region src/features/queues/queues.drift.ts
+function queuesDrift(allQueues, resources, env, state, naming) {
+	const drift = {
+		kind: "queue",
+		missingFromCloudflare: [],
+		unrecordedInState: [],
+		undeployed: []
+	};
+	const cfByName = new Map(allQueues.map((q) => [q.queue_name, q.queue_id]));
+	const stateEntries = Object.values(state.getAll()).filter((e) => e.type === "queue");
+	for (const config of resources) {
+		const derivedName = naming.queueName(config.logicalName, env);
+		const cfId = cfByName.get(derivedName);
+		const stateEntry = stateEntries.find((e) => e.logicalName === config.logicalName);
+		if (stateEntry && !cfId) drift.missingFromCloudflare.push({
+			logicalName: stateEntry.logicalName,
+			derivedName: stateEntry.derivedName,
+			cfId: stateEntry.cfId
+		});
+		else if (cfId && !stateEntry) drift.unrecordedInState.push({
+			logicalName: config.logicalName,
+			derivedName,
+			cfId
+		});
+		else if (!cfId && !stateEntry) drift.undeployed.push({
+			logicalName: config.logicalName,
+			derivedName
+		});
+	}
+	return drift;
+}
+
+//#endregion
+//#region src/features/queues/queues.destroy.ts
+async function queuesDestroy(_env, state, api, config, baseDir, _force) {
+	const owned = await logicalNamesForResourceKind(config, baseDir, "queue");
+	const resources = state.getAll();
+	const entries = Object.entries(resources).filter((kv) => kv[1].type === "queue");
+	for (const [key, entry] of entries) {
+		if (!owned.has(entry.logicalName)) continue;
+		try {
+			await api.queueDelete(entry.cfId);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Failed to delete queue ${entry.derivedName}:`, err);
+		}
+	}
+}
+
+//#endregion
+//#region src/features/queues/queues.generate.ts
+/**
+* Emit `queues.producers[]` for every declared queue (skips entries marked
+* `consumerOnly`). Consumers stay wrangler-side and can be set on the worker
+* config under `queues.consumers` (passed through unchanged).
+*/
+function queuesGenerate(resources, env, state, naming) {
+	const producers = [];
+	for (const config of resources) {
+		if (config.consumerOnly) continue;
+		const derivedName = naming.queueName(config.logicalName, env);
+		const entry = state.get(`queue:${derivedName}`);
+		if (!entry || entry.type !== "queue") throw new Error(`Queue "${config.logicalName}" not in state. Run 'tamer apply --env ${env}' first.`);
+		producers.push({
+			binding: entry.bindingKey,
+			queue: entry.derivedName
+		});
+	}
+	if (producers.length === 0) return void 0;
+	return { producers };
+}
+
+//#endregion
+//#region src/features/queues/queues.status.ts
+function queuesStatus(resources, env, state, naming) {
+	const out = [];
+	for (const config of resources) {
+		const derivedName = naming.queueName(config.logicalName, env);
+		const entry = state.get(`queue:${derivedName}`);
+		out.push({
+			binding: config.binding?.trim() || naming.queueBindingKey(config.logicalName),
+			name: derivedName,
+			status: entry ? "ok" : "missing"
+		});
+	}
+	return out;
+}
+
+//#endregion
+//#region src/features/queues/queues.module.ts
+const queuesModule = {
+	kind: "queue",
+	label: "Queues",
+	configKey: "queues",
+	stateEntryType: "queue",
+	async fetchAll(api) {
+		return (await api.queuesListAll()).map((q) => ({
+			queue_id: q.queue_id,
+			queue_name: q.queue_name
+		}));
+	},
+	async apply(ctx) {
+		await queuesApply(ctx.resources, ctx.tenant, ctx.env, ctx.api, ctx.state, ctx.naming);
+	},
+	sync(ctx) {
+		queuesSync(ctx.all, ctx.resources, ctx.tenant, ctx.env, ctx.state, ctx.naming);
+	},
+	drift(ctx) {
+		return queuesDrift(ctx.all, ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	async destroy(ctx) {
+		await queuesDestroy(ctx.env, ctx.state, ctx.api, ctx.config, ctx.baseDir, ctx.force);
+	},
+	status(ctx) {
+		return queuesStatus(ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	generate(ctx) {
+		const generated = ctx.resources.length > 0 ? queuesGenerate(ctx.resources, ctx.env, ctx.state, ctx.naming) : void 0;
+		const passthrough = ctx.passthrough?.queues;
+		if (!generated && !passthrough) return {};
+		const producers = [...passthrough?.producers ?? [], ...generated?.producers ?? []];
+		const consumers = passthrough?.consumers ?? [];
+		if (producers.length === 0 && consumers.length === 0) return {};
+		const out = {};
+		if (producers.length > 0) out.producers = producers;
+		if (consumers.length > 0) out.consumers = consumers;
+		return { queues: out };
+	},
+	pickResources(source) {
+		return resourcesFrom(source)?.queues ?? [];
+	},
+	async destroyOne({ api, state, key, entry }) {
+		if (entry.type !== "queue") return;
+		try {
+			await api.queueDelete(entry.cfId);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Rollback: failed to delete queue ${entry.derivedName}:`, err);
+		}
+	},
+	async importOne({ options, env, api, state, naming, ts }) {
+		if (!options.cfId) throw new Error("import queue: --cf-id <queue-id> is required");
+		const hit = (await api.queuesListAll()).find((q) => q.queue_id === options.cfId);
+		if (!hit) throw new Error(`import queue: queue id "${options.cfId}" not found in account`);
+		const derivedName = naming.queueName(options.logical, env);
+		if (hit.queue_name !== derivedName) throw new Error(`import queue: cf name "${hit.queue_name}" does not match derived "${derivedName}"`);
+		const bindingKey = naming.queueBindingKey(options.logical);
+		const key = `queue:${derivedName}`;
+		const existing = state.get(key);
+		const entry = {
+			type: "queue",
+			logicalName: options.logical,
+			derivedName,
+			bindingKey,
+			cfId: options.cfId,
+			producerBinding: existing?.type === "queue" ? existing.producerBinding : true,
+			createdAt: existing?.type === "queue" ? existing.createdAt : ts,
+			updatedAt: ts
+		};
+		state.set(key, entry);
+	}
+};
+
+//#endregion
+//#region src/features/hyperdrive/hyperdrive.secrets.ts
+/**
+* Resolve a value that is either a literal string or `{ fromEnv: "VAR" }`
+* lookup against `process.env`. Throws a clear error when the env var is
+* missing — these values are sent to Cloudflare on create and never
+* persisted in Tamer state.
+*/
+function resolveSecret(value, label) {
+	if (typeof value === "string") return value;
+	const envName = value.fromEnv;
+	const v = process.env[envName];
+	if (!v) throw new Error(`hyperdrive: ${label} requires env var ${envName} (set it before running 'tamer apply')`);
+	return v;
+}
+function resolveHyperdriveOrigin(config) {
+	const o = config.origin;
+	return {
+		scheme: o.scheme,
+		host: o.host,
+		port: o.port,
+		database: o.database,
+		user: o.user,
+		password: resolveSecret(o.password, `${config.logicalName}.origin.password`),
+		access_client_id: o.access_client_id,
+		access_client_secret: o.access_client_secret ? resolveSecret(o.access_client_secret, `${config.logicalName}.origin.access_client_secret`) : void 0
+	};
+}
+
+//#endregion
+//#region src/features/hyperdrive/hyperdrive.diff.ts
+function hyperdriveDiffPlanItems(args) {
+	const { resources, env, state, naming } = args;
+	const items = [];
+	for (const config of resources) {
+		const derivedName = naming.hyperdriveName(config.logicalName, env);
+		const entry = state.get(`hyperdrive:${derivedName}`);
+		if (!entry || entry.type !== "hyperdrive") continue;
+		const changes = computeChanges$1(entry, config);
+		if (changes.length === 0) continue;
+		items.push({
+			kind: "hyperdrive",
+			action: "update",
+			logicalName: config.logicalName,
+			derivedName,
+			detail: changes.map((c) => `${c.field}: ${formatVal$2(c.from)} -> ${formatVal$2(c.to)}`).join(", "),
+			changes
+		});
+	}
+	return items;
+}
+/**
+* Pure comparison shared with `hyperdriveApply` so plan and apply agree
+* on what counts as drift on the origin fields Tamer persists.
+*/
+function computeHyperdriveChanges(state, config) {
+	return computeChanges$1(state, config);
+}
+function computeChanges$1(state, config) {
+	const changes = [];
+	if (state.scheme !== config.origin.scheme) changes.push({
+		field: "origin.scheme",
+		from: state.scheme,
+		to: config.origin.scheme,
+		kind: "mutable"
+	});
+	if (state.originHost !== config.origin.host) changes.push({
+		field: "origin.host",
+		from: state.originHost,
+		to: config.origin.host,
+		kind: "mutable"
+	});
+	if (state.originDatabase !== config.origin.database) changes.push({
+		field: "origin.database",
+		from: state.originDatabase,
+		to: config.origin.database,
+		kind: "mutable"
+	});
+	return changes;
+}
+function formatVal$2(v) {
+	if (v === void 0) return "(unset)";
+	if (typeof v === "string") return v.length > 32 ? `${v.slice(0, 29)}...` : v;
+	return String(v);
+}
+
+//#endregion
+//#region src/features/hyperdrive/hyperdrive.apply.ts
+const STATE_KEY_PREFIX$5 = "hyperdrive:";
+function stateKey$5(derivedName) {
+	return `${STATE_KEY_PREFIX$5}${derivedName}`;
+}
+async function hyperdriveApply(resources, _tenant, env, api, state, naming) {
+	for (const config of resources) {
+		const derivedName = naming.hyperdriveName(config.logicalName, env);
+		const key = stateKey$5(derivedName);
+		const existing = state.get(key);
+		const ts = (/* @__PURE__ */ new Date()).toISOString();
+		if (existing && existing.type === "hyperdrive") {
+			const stateEntry = existing;
+			const changes = computeHyperdriveChanges(stateEntry, config);
+			if (changes.length === 0) continue;
+			logApplyChange({
+				kind: "hyperdrive",
+				action: "update",
+				logical: config.logicalName,
+				derived: derivedName,
+				changes
+			});
+			const origin$1 = resolveHyperdriveOrigin(config);
+			await api.hyperdrivePatch(stateEntry.cfId, { origin: origin$1 });
+			state.set(key, {
+				...stateEntry,
+				scheme: config.origin.scheme,
+				originHost: config.origin.host,
+				originDatabase: config.origin.database,
+				updatedAt: ts
+			});
+			continue;
+		}
+		logApplyChange({
+			kind: "hyperdrive",
+			action: "create",
+			logical: config.logicalName,
+			derived: derivedName
+		});
+		const origin = resolveHyperdriveOrigin(config);
+		const { id } = await api.hyperdriveCreate({
+			name: derivedName,
+			origin,
+			caching: config.caching,
+			mtls: config.mtls
+		});
+		state.set(key, {
+			type: "hyperdrive",
+			logicalName: config.logicalName,
+			derivedName,
+			bindingKey: config.binding?.trim() || naming.hyperdriveBindingKey(config.logicalName),
+			cfId: id,
+			scheme: config.origin.scheme,
+			originHost: config.origin.host,
+			originDatabase: config.origin.database,
+			createdAt: ts,
+			updatedAt: ts
+		});
+	}
+}
+
+//#endregion
+//#region src/features/hyperdrive/hyperdrive.sync.ts
+function hyperdriveSync(allHyperdrive, resources, _tenant, env, state, naming) {
+	for (const config of resources) {
+		const derivedName = naming.hyperdriveName(config.logicalName, env);
+		const match = allHyperdrive.find((h) => h.name === derivedName);
+		if (!match) continue;
+		const key = `hyperdrive:${derivedName}`;
+		const existing = state.get(key);
+		const ts = (/* @__PURE__ */ new Date()).toISOString();
+		state.set(key, {
+			type: "hyperdrive",
+			logicalName: config.logicalName,
+			derivedName,
+			bindingKey: config.binding?.trim() || naming.hyperdriveBindingKey(config.logicalName),
+			cfId: match.id,
+			scheme: config.origin.scheme,
+			originHost: match.origin?.host ?? config.origin.host,
+			originDatabase: match.origin?.database ?? config.origin.database,
+			createdAt: existing?.type === "hyperdrive" ? existing.createdAt : ts,
+			updatedAt: ts
+		});
+	}
+}
+
+//#endregion
+//#region src/features/hyperdrive/hyperdrive.drift.ts
+function hyperdriveDrift(allHyperdrive, resources, env, state, naming) {
+	const drift = {
+		kind: "hyperdrive",
+		missingFromCloudflare: [],
+		unrecordedInState: [],
+		undeployed: []
+	};
+	const cfByName = new Map(allHyperdrive.map((h) => [h.name, h.id]));
+	const stateEntries = Object.values(state.getAll()).filter((e) => e.type === "hyperdrive");
+	for (const config of resources) {
+		const derivedName = naming.hyperdriveName(config.logicalName, env);
+		const cfId = cfByName.get(derivedName);
+		const stateEntry = stateEntries.find((e) => e.logicalName === config.logicalName);
+		if (stateEntry && !cfId) drift.missingFromCloudflare.push({
+			logicalName: stateEntry.logicalName,
+			derivedName: stateEntry.derivedName,
+			cfId: stateEntry.cfId
+		});
+		else if (cfId && !stateEntry) drift.unrecordedInState.push({
+			logicalName: config.logicalName,
+			derivedName,
+			cfId
+		});
+		else if (!cfId && !stateEntry) drift.undeployed.push({
+			logicalName: config.logicalName,
+			derivedName
+		});
+	}
+	return drift;
+}
+
+//#endregion
+//#region src/features/hyperdrive/hyperdrive.destroy.ts
+async function hyperdriveDestroy(_env, state, api, config, baseDir, _force) {
+	const owned = await logicalNamesForResourceKind(config, baseDir, "hyperdrive");
+	const resources = state.getAll();
+	const entries = Object.entries(resources).filter((kv) => kv[1].type === "hyperdrive");
+	for (const [key, entry] of entries) {
+		if (!owned.has(entry.logicalName)) continue;
+		try {
+			await api.hyperdriveDelete(entry.cfId);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Failed to delete hyperdrive ${entry.derivedName}:`, err);
+		}
+	}
+}
+
+//#endregion
+//#region src/features/hyperdrive/hyperdrive.generate.ts
+function hyperdriveGenerate(resources, env, state, naming) {
+	const out = [];
+	for (const config of resources) {
+		const derivedName = naming.hyperdriveName(config.logicalName, env);
+		const entry = state.get(`hyperdrive:${derivedName}`);
+		if (!entry || entry.type !== "hyperdrive") throw new Error(`Hyperdrive "${config.logicalName}" not in state. Run 'tamer apply --env ${env}' first.`);
+		out.push({
+			binding: entry.bindingKey,
+			id: entry.cfId,
+			localConnectionString: config.localConnectionString
+		});
+	}
+	return out;
+}
+
+//#endregion
+//#region src/features/hyperdrive/hyperdrive.status.ts
+function hyperdriveStatus(resources, env, state, naming) {
+	const out = [];
+	for (const config of resources) {
+		const derivedName = naming.hyperdriveName(config.logicalName, env);
+		const entry = state.get(`hyperdrive:${derivedName}`);
+		out.push({
+			binding: config.binding?.trim() || naming.hyperdriveBindingKey(config.logicalName),
+			name: derivedName,
+			status: entry ? "ok" : "missing"
+		});
+	}
+	return out;
+}
+
+//#endregion
+//#region src/features/hyperdrive/hyperdrive.module.ts
+const hyperdriveModule = {
+	kind: "hyperdrive",
+	label: "Hyperdrive",
+	configKey: "hyperdrive",
+	stateEntryType: "hyperdrive",
+	async fetchAll(api) {
+		return (await api.hyperdriveListAll()).map((h) => ({
+			id: h.id,
+			name: h.name,
+			origin: h.origin
+		}));
+	},
+	async apply(ctx) {
+		await hyperdriveApply(ctx.resources, ctx.tenant, ctx.env, ctx.api, ctx.state, ctx.naming);
+	},
+	sync(ctx) {
+		hyperdriveSync(ctx.all, ctx.resources, ctx.tenant, ctx.env, ctx.state, ctx.naming);
+	},
+	drift(ctx) {
+		return hyperdriveDrift(ctx.all, ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	diff(ctx) {
+		return hyperdriveDiffPlanItems({
+			resources: ctx.resources,
+			env: ctx.env,
+			state: ctx.state,
+			naming: ctx.naming
+		});
+	},
+	async destroy(ctx) {
+		await hyperdriveDestroy(ctx.env, ctx.state, ctx.api, ctx.config, ctx.baseDir, ctx.force);
+	},
+	status(ctx) {
+		return hyperdriveStatus(ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	generate(ctx) {
+		const generated = ctx.resources.length > 0 ? hyperdriveGenerate(ctx.resources, ctx.env, ctx.state, ctx.naming) : [];
+		const passthrough = ctx.passthrough?.hyperdrive ?? [];
+		if (generated.length === 0 && passthrough.length === 0) return {};
+		return { hyperdrive: [...passthrough, ...generated] };
+	},
+	pickResources(source) {
+		return resourcesFrom(source)?.hyperdrive ?? [];
+	},
+	async destroyOne({ api, state, key, entry }) {
+		if (entry.type !== "hyperdrive") return;
+		try {
+			await api.hyperdriveDelete(entry.cfId);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Rollback: failed to delete Hyperdrive ${entry.derivedName}:`, err);
+		}
+	},
+	async importOne({ options, env, api, state, naming, ts }) {
+		if (!options.cfId) throw new Error("import hyperdrive: --cf-id <config-id> is required");
+		const hit = (await api.hyperdriveListAll()).find((h) => h.id === options.cfId);
+		if (!hit) throw new Error(`import hyperdrive: config id "${options.cfId}" not found in account`);
+		const derivedName = naming.hyperdriveName(options.logical, env);
+		if (hit.name !== derivedName) throw new Error(`import hyperdrive: cf name "${hit.name}" does not match derived "${derivedName}"`);
+		const bindingKey = naming.hyperdriveBindingKey(options.logical);
+		const key = `hyperdrive:${derivedName}`;
+		const existing = state.get(key);
+		const scheme = hit.origin?.scheme === "mysql" ? "mysql" : hit.origin?.scheme === "postgresql" ? "postgresql" : "postgres";
+		const entry = {
+			type: "hyperdrive",
+			logicalName: options.logical,
+			derivedName,
+			bindingKey,
+			cfId: options.cfId,
+			scheme,
+			originHost: hit.origin?.host ?? "",
+			originDatabase: hit.origin?.database ?? "",
+			createdAt: existing?.type === "hyperdrive" ? existing.createdAt : ts,
+			updatedAt: ts
+		};
+		state.set(key, entry);
+	}
+};
+
+//#endregion
+//#region src/features/vectorize/vectorize.apply.ts
+const STATE_KEY_PREFIX$4 = "vectorize:";
+function stateKey$4(derivedName) {
+	return `${STATE_KEY_PREFIX$4}${derivedName}`;
+}
+async function vectorizeApply(resources, _tenant, env, api, state, naming) {
+	for (const config of resources) {
+		const derivedName = naming.vectorizeName(config.logicalName, env);
+		const key = stateKey$4(derivedName);
+		const existing = state.get(key);
+		if (existing) {
+			if (existing.type === "vectorize") {
+				if (existing.dimensions !== config.dimensions || existing.metric !== config.metric) throw new Error(`Vectorize index "${config.logicalName}" config changed (dimensions/metric are immutable). Run 'tamer destroy --resource ${config.logicalName}' first, then re-apply.`);
+			}
+			continue;
+		}
+		const ts = (/* @__PURE__ */ new Date()).toISOString();
+		const created = await api.vectorizeCreate({
+			name: derivedName,
+			description: config.description,
+			config: {
+				dimensions: config.dimensions,
+				metric: config.metric
+			}
+		});
+		state.set(key, {
+			type: "vectorize",
+			logicalName: config.logicalName,
+			derivedName,
+			bindingKey: config.binding?.trim() || naming.vectorizeBindingKey(config.logicalName),
+			cfId: created.id ?? derivedName,
+			dimensions: config.dimensions,
+			metric: config.metric,
+			createdAt: ts,
+			updatedAt: ts
+		});
+	}
+}
+
+//#endregion
+//#region src/features/vectorize/vectorize.sync.ts
+function vectorizeSync(allIndexes, resources, _tenant, env, state, naming) {
+	for (const config of resources) {
+		const derivedName = naming.vectorizeName(config.logicalName, env);
+		const match = allIndexes.find((i) => i.name === derivedName);
+		if (!match) continue;
+		const key = `vectorize:${derivedName}`;
+		const existing = state.get(key);
+		const ts = (/* @__PURE__ */ new Date()).toISOString();
+		state.set(key, {
+			type: "vectorize",
+			logicalName: config.logicalName,
+			derivedName,
+			bindingKey: config.binding?.trim() || naming.vectorizeBindingKey(config.logicalName),
+			cfId: match.id ?? derivedName,
+			dimensions: match.config?.dimensions ?? config.dimensions,
+			metric: (match.config?.metric ?? null) || config.metric,
+			createdAt: existing?.type === "vectorize" ? existing.createdAt : ts,
+			updatedAt: ts
+		});
+	}
+}
+
+//#endregion
+//#region src/features/vectorize/vectorize.drift.ts
+function vectorizeDrift(allIndexes, resources, env, state, naming) {
+	const drift = {
+		kind: "vectorize",
+		missingFromCloudflare: [],
+		unrecordedInState: [],
+		undeployed: []
+	};
+	const cfByName = new Map(allIndexes.map((i) => [i.name, i.id ?? i.name]));
+	const stateEntries = Object.values(state.getAll()).filter((e) => e.type === "vectorize");
+	for (const config of resources) {
+		const derivedName = naming.vectorizeName(config.logicalName, env);
+		const cfId = cfByName.get(derivedName);
+		const stateEntry = stateEntries.find((e) => e.logicalName === config.logicalName);
+		if (stateEntry && !cfId) drift.missingFromCloudflare.push({
+			logicalName: stateEntry.logicalName,
+			derivedName: stateEntry.derivedName,
+			cfId: stateEntry.cfId
+		});
+		else if (cfId && !stateEntry) drift.unrecordedInState.push({
+			logicalName: config.logicalName,
+			derivedName,
+			cfId
+		});
+		else if (!cfId && !stateEntry) drift.undeployed.push({
+			logicalName: config.logicalName,
+			derivedName
+		});
+	}
+	return drift;
+}
+
+//#endregion
+//#region src/features/vectorize/vectorize.destroy.ts
+async function vectorizeDestroy(_env, state, api, config, baseDir, _force) {
+	const owned = await logicalNamesForResourceKind(config, baseDir, "vectorize");
+	const resources = state.getAll();
+	const entries = Object.entries(resources).filter((kv) => kv[1].type === "vectorize");
+	for (const [key, entry] of entries) {
+		if (!owned.has(entry.logicalName)) continue;
+		try {
+			await api.vectorizeDelete(entry.derivedName);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Failed to delete vectorize index ${entry.derivedName}:`, err);
+		}
+	}
+}
+
+//#endregion
+//#region src/features/vectorize/vectorize.generate.ts
+/**
+* Emit `vectorize[]` bindings for declared indexes. Each binding requires
+* the index to exist in state (i.e. `tamer apply` has run). Throws otherwise
+* so the operator gets an actionable error before `wrangler deploy`.
+*/
+function vectorizeGenerate(resources, env, state, naming) {
+	const out = [];
+	for (const config of resources) {
+		const derivedName = naming.vectorizeName(config.logicalName, env);
+		const entry = state.get(`vectorize:${derivedName}`);
+		if (!entry || entry.type !== "vectorize") throw new Error(`Vectorize index "${config.logicalName}" not in state. Run 'tamer apply --env ${env}' first.`);
+		out.push({
+			binding: entry.bindingKey,
+			index_name: entry.derivedName
+		});
+	}
+	return out;
+}
+
+//#endregion
+//#region src/features/vectorize/vectorize.status.ts
+function vectorizeStatus(resources, env, state, naming) {
+	const out = [];
+	for (const config of resources) {
+		const derivedName = naming.vectorizeName(config.logicalName, env);
+		const entry = state.get(`vectorize:${derivedName}`);
+		out.push({
+			binding: config.binding?.trim() || naming.vectorizeBindingKey(config.logicalName),
+			name: derivedName,
+			status: entry ? "ok" : "missing"
+		});
+	}
+	return out;
+}
+
+//#endregion
+//#region src/features/vectorize/vectorize.diff.ts
+function vectorizeDiffPlanItems(args) {
+	const { resources, env, state, naming } = args;
+	const items = [];
+	for (const config of resources) {
+		const derivedName = naming.vectorizeName(config.logicalName, env);
+		const key = `vectorize:${derivedName}`;
+		const entry = state.get(key);
+		if (!entry || entry.type !== "vectorize") continue;
+		const stateEntry = entry;
+		const changes = [];
+		if (stateEntry.dimensions !== config.dimensions) changes.push({
+			field: "dimensions",
+			from: stateEntry.dimensions,
+			to: config.dimensions,
+			kind: "immutable"
+		});
+		if (stateEntry.metric !== config.metric) changes.push({
+			field: "metric",
+			from: stateEntry.metric,
+			to: config.metric,
+			kind: "immutable"
+		});
+		if (changes.length === 0) continue;
+		items.push({
+			kind: "vectorize",
+			action: "replace",
+			logicalName: config.logicalName,
+			derivedName,
+			detail: changes.map((c) => `${c.field}: ${c.from} -> ${c.to}`).join(", "),
+			changes
+		});
+	}
+	return items;
+}
+
+//#endregion
+//#region src/features/vectorize/vectorize.module.ts
+const vectorizeModule = {
+	kind: "vectorize",
+	label: "Vectorize",
+	configKey: "vectorize",
+	stateEntryType: "vectorize",
+	async fetchAll(api) {
+		return (await api.vectorizeListAll()).map((v) => ({
+			id: v.id,
+			name: v.name,
+			config: v.config
+		}));
+	},
+	async apply(ctx) {
+		await vectorizeApply(ctx.resources, ctx.tenant, ctx.env, ctx.api, ctx.state, ctx.naming);
+	},
+	sync(ctx) {
+		vectorizeSync(ctx.all, ctx.resources, ctx.tenant, ctx.env, ctx.state, ctx.naming);
+	},
+	drift(ctx) {
+		return vectorizeDrift(ctx.all, ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	diff(ctx) {
+		return vectorizeDiffPlanItems({
+			resources: ctx.resources,
+			env: ctx.env,
+			state: ctx.state,
+			naming: ctx.naming
+		});
+	},
+	async destroy(ctx) {
+		await vectorizeDestroy(ctx.env, ctx.state, ctx.api, ctx.config, ctx.baseDir, ctx.force);
+	},
+	status(ctx) {
+		return vectorizeStatus(ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	generate(ctx) {
+		const generated = ctx.resources.length > 0 ? vectorizeGenerate(ctx.resources, ctx.env, ctx.state, ctx.naming) : [];
+		const passthrough = ctx.passthrough?.vectorize ?? [];
+		if (generated.length === 0 && passthrough.length === 0) return {};
+		return { vectorize: [...passthrough, ...generated] };
+	},
+	pickResources(source) {
+		return resourcesFrom(source)?.vectorize ?? [];
+	},
+	async destroyOne({ api, state, key, entry }) {
+		if (entry.type !== "vectorize") return;
+		try {
+			await api.vectorizeDelete(entry.derivedName);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Rollback: failed to delete Vectorize ${entry.derivedName}:`, err);
+		}
+	},
+	async importOne({ options, env, api, state, naming, ts }) {
+		const indexName = options.cfId;
+		if (!indexName) throw new Error("import vectorize: --cf-id <index-name> is required");
+		const hit = (await api.vectorizeListAll()).find((v) => v.name === indexName);
+		if (!hit) throw new Error(`import vectorize: index "${indexName}" not found in account`);
+		const derivedName = naming.vectorizeName(options.logical, env);
+		if (hit.name !== derivedName) throw new Error(`import vectorize: cf name "${hit.name}" does not match derived "${derivedName}"`);
+		if (!hit.config) throw new Error(`import vectorize: cf index "${hit.name}" returned no config (dimensions/metric)`);
+		const metric = hit.config.metric;
+		const bindingKey = naming.vectorizeBindingKey(options.logical);
+		const key = `vectorize:${derivedName}`;
+		const existing = state.get(key);
+		const entry = {
+			type: "vectorize",
+			logicalName: options.logical,
+			derivedName,
+			bindingKey,
+			cfId: hit.id ?? derivedName,
+			dimensions: hit.config.dimensions,
+			metric,
+			createdAt: existing?.type === "vectorize" ? existing.createdAt : ts,
+			updatedAt: ts
+		};
+		state.set(key, entry);
+	}
+};
+
+//#endregion
+//#region src/features/ai-gateway/ai-gateway.types.ts
+/**
+* Default values applied to optional `AIGatewayResourceConfig` fields. Kept
+* here so apply / sync / drift agree on what "no override" actually means
+* when comparing config to Cloudflare state.
+*/
+const AI_GATEWAY_DEFAULTS = {
+	cacheTtl: 0,
+	cacheInvalidateOnUpdate: false,
+	collectLogs: true,
+	authentication: false,
+	rateLimitingInterval: 0,
+	rateLimitingLimit: 0,
+	rateLimitingTechnique: "fixed"
+};
+function resolveAIGatewayConfig(config) {
+	return {
+		cacheTtl: config.cacheTtl ?? AI_GATEWAY_DEFAULTS.cacheTtl,
+		cacheInvalidateOnUpdate: config.cacheInvalidateOnUpdate ?? AI_GATEWAY_DEFAULTS.cacheInvalidateOnUpdate,
+		collectLogs: config.collectLogs ?? AI_GATEWAY_DEFAULTS.collectLogs,
+		authentication: config.authentication ?? AI_GATEWAY_DEFAULTS.authentication,
+		rateLimitingInterval: config.rateLimitingInterval ?? AI_GATEWAY_DEFAULTS.rateLimitingInterval,
+		rateLimitingLimit: config.rateLimitingLimit ?? AI_GATEWAY_DEFAULTS.rateLimitingLimit,
+		rateLimitingTechnique: config.rateLimitingTechnique ?? AI_GATEWAY_DEFAULTS.rateLimitingTechnique
+	};
+}
+
+//#endregion
+//#region src/features/ai-gateway/ai-gateway.diff.ts
+function aiGatewayDiffPlanItems(args) {
+	const { resources, env, state, naming } = args;
+	const items = [];
+	for (const config of resources) {
+		const derivedName = naming.aiGatewayId(config.logicalName, env);
+		const entry = state.get(`ai_gateway:${derivedName}`);
+		if (!entry || entry.type !== "ai_gateway") continue;
+		const changes = computeChanges(entry, config);
+		if (changes.length === 0) continue;
+		items.push({
+			kind: "ai_gateway",
+			action: "update",
+			logicalName: config.logicalName,
+			derivedName,
+			detail: changes.map((c) => `${c.field}: ${formatVal$1(c.from)} -> ${formatVal$1(c.to)}`).join(", "),
+			changes
+		});
+	}
+	return items;
+}
+/**
+* Pure comparison shared with `aiGatewayApply` — keeps the plan and the
+* apply path in lockstep about which fields count as drift.
+*/
+function computeAIGatewayChanges(state, config) {
+	return computeChanges(state, config);
+}
+function computeChanges(state, config) {
+	const resolved = resolveAIGatewayConfig(config);
+	const changes = [];
+	if (state.cacheTtl !== resolved.cacheTtl) changes.push({
+		field: "cacheTtl",
+		from: state.cacheTtl,
+		to: resolved.cacheTtl,
+		kind: "mutable"
+	});
+	if (state.cacheInvalidateOnUpdate !== resolved.cacheInvalidateOnUpdate) changes.push({
+		field: "cacheInvalidateOnUpdate",
+		from: state.cacheInvalidateOnUpdate,
+		to: resolved.cacheInvalidateOnUpdate,
+		kind: "mutable"
+	});
+	if (state.collectLogs !== resolved.collectLogs) changes.push({
+		field: "collectLogs",
+		from: state.collectLogs,
+		to: resolved.collectLogs,
+		kind: "mutable"
+	});
+	if (state.authentication !== resolved.authentication) changes.push({
+		field: "authentication",
+		from: state.authentication,
+		to: resolved.authentication,
+		kind: "mutable"
+	});
+	if (state.rateLimitingInterval !== resolved.rateLimitingInterval) changes.push({
+		field: "rateLimitingInterval",
+		from: state.rateLimitingInterval,
+		to: resolved.rateLimitingInterval,
+		kind: "mutable"
+	});
+	if (state.rateLimitingLimit !== resolved.rateLimitingLimit) changes.push({
+		field: "rateLimitingLimit",
+		from: state.rateLimitingLimit,
+		to: resolved.rateLimitingLimit,
+		kind: "mutable"
+	});
+	if (state.rateLimitingTechnique !== resolved.rateLimitingTechnique) changes.push({
+		field: "rateLimitingTechnique",
+		from: state.rateLimitingTechnique,
+		to: resolved.rateLimitingTechnique,
+		kind: "mutable"
+	});
+	return changes;
+}
+function formatVal$1(v) {
+	if (v === void 0) return "(unset)";
+	if (typeof v === "string") return v.length > 32 ? `${v.slice(0, 29)}...` : v;
+	return String(v);
+}
+
+//#endregion
+//#region src/features/ai-gateway/ai-gateway.apply.ts
+const STATE_KEY_PREFIX$3 = "ai_gateway:";
+function stateKey$3(derivedName) {
+	return `${STATE_KEY_PREFIX$3}${derivedName}`;
+}
+async function aiGatewayApply(resources, _tenant, env, api, state, naming) {
+	for (const config of resources) {
+		const derivedName = naming.aiGatewayId(config.logicalName, env);
+		const key = stateKey$3(derivedName);
+		const existing = state.get(key);
+		const resolved = resolveAIGatewayConfig(config);
+		const ts = (/* @__PURE__ */ new Date()).toISOString();
+		if (existing && existing.type === "ai_gateway") {
+			const changes = computeAIGatewayChanges(existing, config);
+			if (changes.length === 0) continue;
+			logApplyChange({
+				kind: "ai_gateway",
+				action: "update",
+				logical: config.logicalName,
+				derived: derivedName,
+				changes
+			});
+			await api.aiGatewayUpdate(derivedName, {
+				cache_ttl: resolved.cacheTtl,
+				cache_invalidate_on_update: resolved.cacheInvalidateOnUpdate,
+				collect_logs: resolved.collectLogs,
+				authentication: resolved.authentication,
+				rate_limiting_interval: resolved.rateLimitingInterval,
+				rate_limiting_limit: resolved.rateLimitingLimit,
+				rate_limiting_technique: resolved.rateLimitingTechnique
+			});
+			state.set(key, {
+				...existing,
+				cacheTtl: resolved.cacheTtl,
+				cacheInvalidateOnUpdate: resolved.cacheInvalidateOnUpdate,
+				collectLogs: resolved.collectLogs,
+				authentication: resolved.authentication,
+				rateLimitingInterval: resolved.rateLimitingInterval,
+				rateLimitingLimit: resolved.rateLimitingLimit,
+				rateLimitingTechnique: resolved.rateLimitingTechnique,
+				updatedAt: ts
+			});
+			continue;
+		}
+		logApplyChange({
+			kind: "ai_gateway",
+			action: "create",
+			logical: config.logicalName,
+			derived: derivedName
+		});
+		await api.aiGatewayCreate({
+			id: derivedName,
+			cache_ttl: resolved.cacheTtl,
+			cache_invalidate_on_update: resolved.cacheInvalidateOnUpdate,
+			collect_logs: resolved.collectLogs,
+			authentication: resolved.authentication,
+			rate_limiting_interval: resolved.rateLimitingInterval,
+			rate_limiting_limit: resolved.rateLimitingLimit,
+			rate_limiting_technique: resolved.rateLimitingTechnique
+		});
+		state.set(key, {
+			type: "ai_gateway",
+			logicalName: config.logicalName,
+			derivedName,
+			bindingKey: naming.aiGatewayBindingKey(config.logicalName),
+			cfId: derivedName,
+			cacheTtl: resolved.cacheTtl,
+			cacheInvalidateOnUpdate: resolved.cacheInvalidateOnUpdate,
+			collectLogs: resolved.collectLogs,
+			authentication: resolved.authentication,
+			rateLimitingInterval: resolved.rateLimitingInterval,
+			rateLimitingLimit: resolved.rateLimitingLimit,
+			rateLimitingTechnique: resolved.rateLimitingTechnique,
+			createdAt: ts,
+			updatedAt: ts
+		});
+	}
+}
+
+//#endregion
+//#region src/features/ai-gateway/ai-gateway.sync.ts
+function aiGatewaySync(allGateways, resources, _tenant, env, state, naming) {
+	for (const config of resources) {
+		const derivedName = naming.aiGatewayId(config.logicalName, env);
+		const match = allGateways.find((g) => g.id === derivedName);
+		if (!match) continue;
+		const key = `ai_gateway:${derivedName}`;
+		const existing = state.get(key);
+		const ts = (/* @__PURE__ */ new Date()).toISOString();
+		const resolved = resolveAIGatewayConfig(config);
+		state.set(key, {
+			type: "ai_gateway",
+			logicalName: config.logicalName,
+			derivedName,
+			bindingKey: naming.aiGatewayBindingKey(config.logicalName),
+			cfId: derivedName,
+			cacheTtl: match.cache_ttl ?? resolved.cacheTtl,
+			cacheInvalidateOnUpdate: match.cache_invalidate_on_update ?? resolved.cacheInvalidateOnUpdate,
+			collectLogs: match.collect_logs ?? resolved.collectLogs,
+			authentication: match.authentication ?? resolved.authentication,
+			rateLimitingInterval: match.rate_limiting_interval ?? resolved.rateLimitingInterval,
+			rateLimitingLimit: match.rate_limiting_limit ?? resolved.rateLimitingLimit,
+			rateLimitingTechnique: match.rate_limiting_technique ?? resolved.rateLimitingTechnique,
+			createdAt: existing?.type === "ai_gateway" ? existing.createdAt : ts,
+			updatedAt: ts
+		});
+	}
+}
+
+//#endregion
+//#region src/features/ai-gateway/ai-gateway.drift.ts
+function aiGatewayDrift(allGateways, resources, env, state, naming) {
+	const drift = {
+		kind: "ai_gateway",
+		missingFromCloudflare: [],
+		unrecordedInState: [],
+		undeployed: []
+	};
+	const cfIds = new Set(allGateways.map((g) => g.id));
+	const stateEntries = Object.values(state.getAll()).filter((e) => e.type === "ai_gateway");
+	for (const config of resources) {
+		const derivedName = naming.aiGatewayId(config.logicalName, env);
+		const inCloudflare = cfIds.has(derivedName);
+		const stateEntry = stateEntries.find((e) => e.logicalName === config.logicalName);
+		if (stateEntry && !inCloudflare) drift.missingFromCloudflare.push({
+			logicalName: stateEntry.logicalName,
+			derivedName: stateEntry.derivedName,
+			cfId: stateEntry.cfId
+		});
+		else if (inCloudflare && !stateEntry) drift.unrecordedInState.push({
+			logicalName: config.logicalName,
+			derivedName,
+			cfId: derivedName
+		});
+		else if (!inCloudflare && !stateEntry) drift.undeployed.push({
+			logicalName: config.logicalName,
+			derivedName
+		});
+	}
+	return drift;
+}
+
+//#endregion
+//#region src/features/ai-gateway/ai-gateway.destroy.ts
+async function aiGatewayDestroy(_env, state, api, config, baseDir, _force) {
+	const owned = await logicalNamesForResourceKind(config, baseDir, "ai_gateway");
+	const resources = state.getAll();
+	const entries = Object.entries(resources).filter((kv) => kv[1].type === "ai_gateway");
+	for (const [key, entry] of entries) {
+		if (!owned.has(entry.logicalName)) continue;
+		try {
+			await api.aiGatewayDelete(entry.derivedName);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Failed to delete AI Gateway ${entry.derivedName}:`, err);
+		}
+	}
+}
+
+//#endregion
+//#region src/features/ai-gateway/ai-gateway.status.ts
+function aiGatewayStatus(resources, env, state, naming) {
+	const out = [];
+	for (const config of resources) {
+		const derivedName = naming.aiGatewayId(config.logicalName, env);
+		const entry = state.get(`ai_gateway:${derivedName}`);
+		out.push({
+			binding: naming.aiGatewayBindingKey(config.logicalName),
+			name: derivedName,
+			status: entry ? "ok" : "missing"
+		});
+	}
+	return out;
+}
+
+//#endregion
+//#region src/features/ai-gateway/ai-gateway.module.ts
+const aiGatewayModule = {
+	kind: "ai_gateway",
+	label: "AI Gateway",
+	configKey: "aiGateway",
+	stateEntryType: "ai_gateway",
+	async fetchAll(api) {
+		return await api.aiGatewayListAll();
+	},
+	async apply(ctx) {
+		await aiGatewayApply(ctx.resources, ctx.tenant, ctx.env, ctx.api, ctx.state, ctx.naming);
+	},
+	sync(ctx) {
+		aiGatewaySync(ctx.all, ctx.resources, ctx.tenant, ctx.env, ctx.state, ctx.naming);
+	},
+	drift(ctx) {
+		return aiGatewayDrift(ctx.all, ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	diff(ctx) {
+		return aiGatewayDiffPlanItems({
+			resources: ctx.resources,
+			env: ctx.env,
+			state: ctx.state,
+			naming: ctx.naming
+		});
+	},
+	async destroy(ctx) {
+		await aiGatewayDestroy(ctx.env, ctx.state, ctx.api, ctx.config, ctx.baseDir, ctx.force);
+	},
+	status(ctx) {
+		return aiGatewayStatus(ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	generate() {
+		return {};
+	},
+	pickResources(source) {
+		return resourcesFrom(source)?.aiGateway ?? [];
+	},
+	async destroyOne({ api, state, key, entry }) {
+		if (entry.type !== "ai_gateway") return;
+		try {
+			await api.aiGatewayDelete(entry.derivedName);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Rollback: failed to delete AI Gateway ${entry.derivedName}:`, err);
+		}
+	},
+	async importOne({ options, env, api, state, naming, ts }) {
+		const gatewayId = options.cfId;
+		if (!gatewayId) throw new Error("import ai_gateway: --cf-id <gateway-id> is required");
+		const hit = (await api.aiGatewayListAll()).find((g) => g.id === gatewayId);
+		if (!hit) throw new Error(`import ai_gateway: gateway "${gatewayId}" not found in account`);
+		const derivedName = naming.aiGatewayId(options.logical, env);
+		if (hit.id !== derivedName) throw new Error(`import ai_gateway: cf id "${hit.id}" does not match derived "${derivedName}"`);
+		const key = `ai_gateway:${derivedName}`;
+		const existing = state.get(key);
+		const defaults = resolveAIGatewayConfig({ logicalName: options.logical });
+		const entry = {
+			type: "ai_gateway",
+			logicalName: options.logical,
+			derivedName,
+			bindingKey: naming.aiGatewayBindingKey(options.logical),
+			cfId: hit.id,
+			cacheTtl: hit.cache_ttl ?? defaults.cacheTtl,
+			cacheInvalidateOnUpdate: hit.cache_invalidate_on_update ?? defaults.cacheInvalidateOnUpdate,
+			collectLogs: hit.collect_logs ?? defaults.collectLogs,
+			authentication: hit.authentication ?? defaults.authentication,
+			rateLimitingInterval: hit.rate_limiting_interval ?? defaults.rateLimitingInterval,
+			rateLimitingLimit: hit.rate_limiting_limit ?? defaults.rateLimitingLimit,
+			rateLimitingTechnique: hit.rate_limiting_technique ?? defaults.rateLimitingTechnique,
+			createdAt: existing?.type === "ai_gateway" ? existing.createdAt : ts,
+			updatedAt: ts
+		};
+		state.set(key, entry);
+	}
+};
+
+//#endregion
+//#region src/features/pipelines/pipelines.apply.ts
+const STATE_KEY_PREFIX$2 = "pipeline:";
+function stateKey$2(derivedName) {
+	return `${STATE_KEY_PREFIX$2}${derivedName}`;
+}
+/**
+* Idempotent create — skips when a state entry already exists. Pipeline SQL
+* updates on existing pipelines are deliberately not handled here (Cloudflare's
+* V1 endpoint has no PATCH today; SQL changes require a destroy + recreate).
+* Drift surfaces SQL mismatches so operators can recover explicitly.
+*/
+async function pipelinesApply(resources, _tenant, env, api, state, naming) {
+	for (const config of resources) {
+		const derivedName = naming.pipelineName(config.logicalName, env);
+		const key = stateKey$2(derivedName);
+		if (state.get(key)) continue;
+		const ts = (/* @__PURE__ */ new Date()).toISOString();
+		const created = await api.pipelineCreate({
+			name: derivedName,
+			sql: config.sql
+		});
+		state.set(key, {
+			type: "pipeline",
+			logicalName: config.logicalName,
+			derivedName,
+			bindingKey: config.binding?.trim() || naming.pipelineBindingKey(config.logicalName),
+			cfId: created.id,
+			sql: created.sql ?? config.sql,
+			status: created.status,
+			createdAt: ts,
+			updatedAt: ts
+		});
+	}
+}
+
+//#endregion
+//#region src/features/pipelines/pipelines.sync.ts
+function pipelinesSync(allPipelines, resources, _tenant, env, state, naming) {
+	for (const config of resources) {
+		const derivedName = naming.pipelineName(config.logicalName, env);
+		const match = allPipelines.find((p) => p.name === derivedName);
+		if (!match) continue;
+		const key = `pipeline:${derivedName}`;
+		const existing = state.get(key);
+		const ts = (/* @__PURE__ */ new Date()).toISOString();
+		state.set(key, {
+			type: "pipeline",
+			logicalName: config.logicalName,
+			derivedName,
+			bindingKey: config.binding?.trim() || naming.pipelineBindingKey(config.logicalName),
+			cfId: match.id,
+			sql: match.sql,
+			status: match.status,
+			createdAt: existing?.type === "pipeline" ? existing.createdAt : ts,
+			updatedAt: ts
+		});
+	}
+}
+
+//#endregion
+//#region src/features/pipelines/pipelines.drift.ts
+function pipelinesDrift(allPipelines, resources, env, state, naming) {
+	const drift = {
+		kind: "pipeline",
+		missingFromCloudflare: [],
+		unrecordedInState: [],
+		undeployed: []
+	};
+	const cfByName = new Map(allPipelines.map((p) => [p.name, p]));
+	const stateEntries = Object.values(state.getAll()).filter((e) => e.type === "pipeline");
+	for (const config of resources) {
+		const derivedName = naming.pipelineName(config.logicalName, env);
+		const inCloudflare = cfByName.has(derivedName);
+		const stateEntry = stateEntries.find((e) => e.logicalName === config.logicalName);
+		if (stateEntry && !inCloudflare) drift.missingFromCloudflare.push({
+			logicalName: stateEntry.logicalName,
+			derivedName: stateEntry.derivedName,
+			cfId: stateEntry.cfId
+		});
+		else if (inCloudflare && !stateEntry) {
+			const cf = cfByName.get(derivedName);
+			drift.unrecordedInState.push({
+				logicalName: config.logicalName,
+				derivedName,
+				cfId: cf.id
+			});
+		} else if (!inCloudflare && !stateEntry) drift.undeployed.push({
+			logicalName: config.logicalName,
+			derivedName
+		});
+	}
+	return drift;
+}
+
+//#endregion
+//#region src/features/pipelines/pipelines.destroy.ts
+async function pipelinesDestroy(_env, state, api, config, baseDir, _force) {
+	const owned = await logicalNamesForResourceKind(config, baseDir, "pipeline");
+	const resources = state.getAll();
+	const entries = Object.entries(resources).filter((kv) => kv[1].type === "pipeline");
+	for (const [key, entry] of entries) {
+		if (!owned.has(entry.logicalName)) continue;
+		try {
+			await api.pipelineDelete(entry.cfId);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Failed to delete Pipeline ${entry.derivedName}:`, err);
+		}
+	}
+}
+
+//#endregion
+//#region src/features/pipelines/pipelines.generate.ts
+/**
+* Emit `pipelines[]` bindings for declared pipelines. Each binding requires
+* the pipeline to exist in state (i.e. `tamer apply` has run). Throws
+* otherwise so the operator gets an actionable error before `wrangler deploy`.
+*
+* Note: Wrangler's `pipeline` field accepts the pipeline **name**, not the
+* server-assigned id, so we emit the derived name here.
+*/
+function pipelinesGenerate(resources, env, state, naming) {
+	const out = [];
+	for (const config of resources) {
+		const derivedName = naming.pipelineName(config.logicalName, env);
+		const entry = state.get(`pipeline:${derivedName}`);
+		if (!entry || entry.type !== "pipeline") throw new Error(`Pipeline "${config.logicalName}" not in state. Run 'tamer apply --env ${env}' first.`);
+		out.push({
+			binding: entry.bindingKey,
+			pipeline: entry.derivedName
+		});
+	}
+	return out;
+}
+
+//#endregion
+//#region src/features/pipelines/pipelines.status.ts
+function pipelinesStatus(resources, env, state, naming) {
+	const out = [];
+	for (const config of resources) {
+		const derivedName = naming.pipelineName(config.logicalName, env);
+		const entry = state.get(`pipeline:${derivedName}`);
+		out.push({
+			binding: config.binding?.trim() || naming.pipelineBindingKey(config.logicalName),
+			name: derivedName,
+			status: entry ? "ok" : "missing"
+		});
+	}
+	return out;
+}
+
+//#endregion
+//#region src/features/pipelines/pipelines.diff.ts
+function pipelinesDiffPlanItems(args) {
+	const { resources, env, state, naming } = args;
+	const items = [];
+	for (const config of resources) {
+		const derivedName = naming.pipelineName(config.logicalName, env);
+		const key = `pipeline:${derivedName}`;
+		const entry = state.get(key);
+		if (!entry || entry.type !== "pipeline") continue;
+		const stateEntry = entry;
+		const expectedBinding = config.binding?.trim() || naming.pipelineBindingKey(config.logicalName);
+		const changes = [];
+		if (stateEntry.sql !== config.sql) changes.push({
+			field: "sql",
+			from: truncate(stateEntry.sql),
+			to: truncate(config.sql),
+			kind: "immutable"
+		});
+		if (stateEntry.bindingKey !== expectedBinding) changes.push({
+			field: "binding",
+			from: stateEntry.bindingKey,
+			to: expectedBinding,
+			kind: "mutable"
+		});
+		if (changes.length === 0) continue;
+		const hasImmutable = changes.some((c) => c.kind === "immutable");
+		items.push({
+			kind: "pipeline",
+			action: hasImmutable ? "replace" : "update",
+			logicalName: config.logicalName,
+			derivedName,
+			detail: changes.map((c) => c.field).join(", "),
+			changes
+		});
+	}
+	return items;
+}
+function truncate(v) {
+	return v.length > 60 ? `${v.slice(0, 57)}...` : v;
+}
+
+//#endregion
+//#region src/features/pipelines/pipelines.module.ts
+const pipelinesModule = {
+	kind: "pipeline",
+	label: "Pipeline",
+	configKey: "pipelines",
+	stateEntryType: "pipeline",
+	async fetchAll(api) {
+		return (await api.pipelineListAll()).map((p) => ({
+			id: p.id,
+			name: p.name,
+			sql: p.sql,
+			status: p.status
+		}));
+	},
+	async apply(ctx) {
+		await pipelinesApply(ctx.resources, ctx.tenant, ctx.env, ctx.api, ctx.state, ctx.naming);
+	},
+	sync(ctx) {
+		pipelinesSync(ctx.all, ctx.resources, ctx.tenant, ctx.env, ctx.state, ctx.naming);
+	},
+	drift(ctx) {
+		return pipelinesDrift(ctx.all, ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	diff(ctx) {
+		return pipelinesDiffPlanItems({
+			resources: ctx.resources,
+			env: ctx.env,
+			state: ctx.state,
+			naming: ctx.naming
+		});
+	},
+	async destroy(ctx) {
+		await pipelinesDestroy(ctx.env, ctx.state, ctx.api, ctx.config, ctx.baseDir, ctx.force);
+	},
+	status(ctx) {
+		return pipelinesStatus(ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	generate(ctx) {
+		const generated = ctx.resources.length > 0 ? pipelinesGenerate(ctx.resources, ctx.env, ctx.state, ctx.naming) : [];
+		const passthrough = ctx.passthrough?.pipelines ?? [];
+		if (generated.length === 0 && passthrough.length === 0) return {};
+		return { pipelines: [...passthrough, ...generated] };
+	},
+	pickResources(source) {
+		return resourcesFrom(source)?.pipelines ?? [];
+	},
+	async destroyOne({ api, state, key, entry }) {
+		if (entry.type !== "pipeline") return;
+		try {
+			await api.pipelineDelete(entry.cfId);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Rollback: failed to delete Pipeline ${entry.derivedName}:`, err);
+		}
+	},
+	async importOne({ options, env, api, state, naming, ts }) {
+		const pipelineId = options.cfId;
+		if (!pipelineId) throw new Error("import pipeline: --cf-id <pipeline-id> is required");
+		const hit = (await api.pipelineListAll()).find((p) => p.id === pipelineId);
+		if (!hit) throw new Error(`import pipeline: pipeline "${pipelineId}" not found in account`);
+		const derivedName = naming.pipelineName(options.logical, env);
+		if (hit.name !== derivedName) throw new Error(`import pipeline: cf name "${hit.name}" does not match derived "${derivedName}"`);
+		const key = `pipeline:${derivedName}`;
+		const existing = state.get(key);
+		const entry = {
+			type: "pipeline",
+			logicalName: options.logical,
+			derivedName,
+			bindingKey: naming.pipelineBindingKey(options.logical),
+			cfId: hit.id,
+			sql: hit.sql,
+			status: hit.status,
+			createdAt: existing?.type === "pipeline" ? existing.createdAt : ts,
+			updatedAt: ts
+		};
+		state.set(key, entry);
+	}
+};
+
+//#endregion
+//#region src/features/workflows/workflows.diff.ts
+function workflowsDiffPlanItems(args) {
+	const { resources, env, state, naming, worker } = args;
+	const items = [];
+	for (const config of resources) {
+		const derivedName = naming.workflowName(config.logicalName, env);
+		const key = `workflow:${derivedName}`;
+		const entry = state.get(key);
+		if (!entry || entry.type !== "workflow") continue;
+		const changes = computeWorkflowChanges(entry, config, naming, worker);
+		if (changes.length === 0) continue;
+		items.push({
+			kind: "workflow",
+			action: "update",
+			logicalName: config.logicalName,
+			derivedName,
+			detail: changes.map((c) => `${c.field}: ${formatVal(c.from)} -> ${formatVal(c.to)}`).join(", "),
+			changes
+		});
+	}
+	return items;
+}
+/**
+* Pure comparison shared with `workflowsApply` so plan and apply agree
+* on what counts as drift on a registered workflow. Drift in any of
+* `className`, `scriptName` (defaulting to the owning worker's
+* deployed name), `limits.steps`, or the binding key triggers an
+* in-place PUT — Cloudflare treats `PUT /accounts/{id}/workflows/{name}`
+* as create-or-update.
+*/
+function computeWorkflowChanges(state, config, naming, worker) {
+	const expectedScriptName = config.scriptName?.trim() ?? worker?.deployedName;
+	const expectedBindingKey = config.binding?.trim() || naming.workflowBindingKey(config.logicalName);
+	const changes = [];
+	if (state.className !== config.className) changes.push({
+		field: "className",
+		from: state.className,
+		to: config.className,
+		kind: "mutable"
+	});
+	if (expectedScriptName !== void 0 && state.scriptName !== expectedScriptName) changes.push({
+		field: "scriptName",
+		from: state.scriptName,
+		to: expectedScriptName,
+		kind: "mutable"
+	});
+	const stateSteps = state.limits?.steps;
+	const configSteps = config.limits?.steps;
+	if ((stateSteps ?? null) !== (configSteps ?? null)) changes.push({
+		field: "limits.steps",
+		from: stateSteps,
+		to: configSteps,
+		kind: "mutable"
+	});
+	if (state.bindingKey !== expectedBindingKey) changes.push({
+		field: "binding",
+		from: state.bindingKey,
+		to: expectedBindingKey,
+		kind: "mutable"
+	});
+	return changes;
+}
+function formatVal(v) {
+	if (v === void 0 || v === null) return "(unset)";
+	if (typeof v === "string") return v.length > 32 ? `${v.slice(0, 29)}...` : v;
+	return String(v);
+}
+
+//#endregion
+//#region src/features/workflows/workflows.apply.ts
+const STATE_KEY_PREFIX$1 = "workflow:";
+function stateKey$1(derivedName) {
+	return `${STATE_KEY_PREFIX$1}${derivedName}`;
+}
+function resolveScriptName(config, worker) {
+	const explicit = config.scriptName?.trim();
+	if (explicit) return explicit;
+	if (!worker) throw new Error(`workflow "${config.logicalName}": no scriptName given and module ran without a worker scope — set scriptName on the resource or invoke apply per-worker.`);
+	return worker.deployedName;
+}
+function limitsEqual(a, b) {
+	return (a?.steps ?? null) === (b?.steps ?? null);
+}
+/**
+* Idempotent upsert via `PUT /accounts/{id}/workflows/{name}`. Cloudflare
+* treats PUT as create-or-update, so we issue it whenever the recorded
+* `(class_name, script_name, limits)` triple has drifted from config (or
+* the workflow has never been registered at all). Drift between recorded
+* state and *live* Cloudflare is surfaced separately by `workflowsDrift`.
+*/
+async function workflowsApply(resources, _tenant, env, api, state, naming, worker) {
+	for (const config of resources) {
+		const derivedName = naming.workflowName(config.logicalName, env);
+		const scriptName = resolveScriptName(config, worker);
+		const key = stateKey$1(derivedName);
+		const existing = state.get(key);
+		const wantsBindingKey = config.binding?.trim() || naming.workflowBindingKey(config.logicalName);
+		if (existing && existing.type === "workflow" && existing.className === config.className && existing.scriptName === scriptName && limitsEqual(existing.limits, config.limits) && existing.bindingKey === wantsBindingKey) continue;
+		if (existing && existing.type === "workflow") {
+			const changes = computeWorkflowChanges(existing, config, naming, worker);
+			logApplyChange({
+				kind: "workflow",
+				action: "update",
+				logical: config.logicalName,
+				derived: derivedName,
+				changes
+			});
+		} else logApplyChange({
+			kind: "workflow",
+			action: "create",
+			logical: config.logicalName,
+			derived: derivedName
+		});
+		const ts = (/* @__PURE__ */ new Date()).toISOString();
+		const upserted = await api.workflowUpsert(derivedName, {
+			class_name: config.className,
+			script_name: scriptName,
+			...config.limits ? { limits: config.limits } : {}
+		});
+		const entry = {
+			type: "workflow",
+			logicalName: config.logicalName,
+			derivedName,
+			bindingKey: wantsBindingKey,
+			cfId: upserted.id,
+			className: upserted.class_name,
+			scriptName: upserted.script_name,
+			limits: config.limits,
+			createdAt: existing?.type === "workflow" ? existing.createdAt : ts,
+			updatedAt: ts
+		};
+		state.set(key, entry);
+	}
+}
+
+//#endregion
+//#region src/features/workflows/workflows.sync.ts
+/**
+* Match each declared workflow against `GET /accounts/{id}/workflows` and
+* upsert into state. Stack-scoped: `resources` is already filtered to the
+* current config, so we never persist a workflow owned by another stack
+* sharing this state row.
+*/
+function workflowsSync(allWorkflows, resources, _tenant, env, state, naming) {
+	for (const config of resources) {
+		const derivedName = naming.workflowName(config.logicalName, env);
+		const match = allWorkflows.find((w) => w.name === derivedName);
+		if (!match) continue;
+		const key = `workflow:${derivedName}`;
+		const existing = state.get(key);
+		const ts = (/* @__PURE__ */ new Date()).toISOString();
+		const entry = {
+			type: "workflow",
+			logicalName: config.logicalName,
+			derivedName,
+			bindingKey: config.binding?.trim() || naming.workflowBindingKey(config.logicalName),
+			cfId: match.id,
+			className: match.class_name,
+			scriptName: match.script_name,
+			limits: existing?.type === "workflow" ? existing.limits : config.limits,
+			createdAt: existing?.type === "workflow" ? existing.createdAt : ts,
+			updatedAt: ts
+		};
+		state.set(key, entry);
+	}
+}
+
+//#endregion
+//#region src/features/workflows/workflows.drift.ts
+function workflowsDrift(allWorkflows, resources, env, state, naming) {
+	const drift = {
+		kind: "workflow",
+		missingFromCloudflare: [],
+		unrecordedInState: [],
+		undeployed: []
+	};
+	const cfByName = new Map(allWorkflows.map((w) => [w.name, w]));
+	const stateEntries = Object.values(state.getAll()).filter((e) => e.type === "workflow");
+	for (const config of resources) {
+		const derivedName = naming.workflowName(config.logicalName, env);
+		const inCloudflare = cfByName.has(derivedName);
+		const stateEntry = stateEntries.find((e) => e.logicalName === config.logicalName);
+		if (stateEntry && !inCloudflare) drift.missingFromCloudflare.push({
+			logicalName: stateEntry.logicalName,
+			derivedName: stateEntry.derivedName,
+			cfId: stateEntry.cfId
+		});
+		else if (inCloudflare && !stateEntry) {
+			const cf = cfByName.get(derivedName);
+			drift.unrecordedInState.push({
+				logicalName: config.logicalName,
+				derivedName,
+				cfId: cf.id
+			});
+		} else if (!inCloudflare && !stateEntry) drift.undeployed.push({
+			logicalName: config.logicalName,
+			derivedName
+		});
+	}
+	return drift;
+}
+
+//#endregion
+//#region src/features/workflows/workflows.destroy.ts
+async function workflowsDestroy(_env, state, api, config, baseDir, _force) {
+	const owned = await logicalNamesForResourceKind(config, baseDir, "workflow");
+	const resources = state.getAll();
+	const entries = Object.entries(resources).filter((kv) => kv[1].type === "workflow");
+	for (const [key, entry] of entries) {
+		if (!owned.has(entry.logicalName)) continue;
+		try {
+			await api.workflowDelete(entry.derivedName);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Failed to delete Workflow ${entry.derivedName}:`, err);
+		}
+	}
+}
+
+//#endregion
+//#region src/features/workflows/workflows.generate.ts
+/**
+* Emit `workflows[]` bindings for declared workflows. Requires `tamer apply`
+* to have run (state row present) so we can fail fast with a clear message
+* before `wrangler deploy` would surface a less actionable error.
+*
+* `script_name` is only emitted when the user pinned an explicit override
+* — without it, Wrangler binds to the current worker's own script, which
+* matches our default-to-owning-worker semantics in apply.
+*/
+function workflowsGenerate(resources, env, state, naming, worker) {
+	const out = [];
+	for (const config of resources) {
+		const derivedName = naming.workflowName(config.logicalName, env);
+		const entry = state.get(`workflow:${derivedName}`);
+		if (!entry || entry.type !== "workflow") throw new Error(`Workflow "${config.logicalName}" not in state. Run 'tamer apply --env ${env}' first.`);
+		const explicitScript = config.scriptName?.trim();
+		const ownerScript = worker?.deployedName;
+		const binding = {
+			binding: entry.bindingKey,
+			name: entry.derivedName,
+			class_name: entry.className
+		};
+		if (explicitScript) binding.script_name = explicitScript;
+		else if (ownerScript && ownerScript !== entry.scriptName) binding.script_name = entry.scriptName;
+		out.push(binding);
+	}
+	return out;
+}
+
+//#endregion
+//#region src/features/workflows/workflows.status.ts
+function workflowsStatus(resources, env, state, naming) {
+	const out = [];
+	for (const config of resources) {
+		const derivedName = naming.workflowName(config.logicalName, env);
+		const entry = state.get(`workflow:${derivedName}`);
+		out.push({
+			binding: config.binding?.trim() || naming.workflowBindingKey(config.logicalName),
+			name: derivedName,
+			status: entry ? "ok" : "missing"
+		});
+	}
+	return out;
+}
+
+//#endregion
+//#region src/features/workflows/workflows.module.ts
+const workflowsModule = {
+	kind: "workflow",
+	label: "Workflow",
+	configKey: "workflows",
+	stateEntryType: "workflow",
+	async fetchAll(api) {
+		return (await api.workflowListAll()).map((w) => ({
+			id: w.id,
+			name: w.name,
+			class_name: w.class_name,
+			script_name: w.script_name
+		}));
+	},
+	async apply(ctx) {
+		await workflowsApply(ctx.resources, ctx.tenant, ctx.env, ctx.api, ctx.state, ctx.naming, ctx.worker);
+	},
+	sync(ctx) {
+		workflowsSync(ctx.all, ctx.resources, ctx.tenant, ctx.env, ctx.state, ctx.naming);
+	},
+	drift(ctx) {
+		return workflowsDrift(ctx.all, ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	diff(ctx) {
+		return workflowsDiffPlanItems({
+			resources: ctx.resources,
+			env: ctx.env,
+			state: ctx.state,
+			naming: ctx.naming,
+			worker: ctx.worker
+		});
+	},
+	async destroy(ctx) {
+		await workflowsDestroy(ctx.env, ctx.state, ctx.api, ctx.config, ctx.baseDir, ctx.force);
+	},
+	status(ctx) {
+		return workflowsStatus(ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	generate(ctx) {
+		const generated = ctx.resources.length > 0 ? workflowsGenerate(ctx.resources, ctx.env, ctx.state, ctx.naming, ctx.worker) : [];
+		const passthrough = ctx.passthrough?.workflows ?? [];
+		if (generated.length === 0 && passthrough.length === 0) return {};
+		return { workflows: [...passthrough, ...generated] };
+	},
+	pickResources(source) {
+		return resourcesFrom(source)?.workflows ?? [];
+	},
+	async destroyOne({ api, state, key, entry }) {
+		if (entry.type !== "workflow") return;
+		try {
+			await api.workflowDelete(entry.derivedName);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Rollback: failed to delete Workflow ${entry.derivedName}:`, err);
+		}
+	},
+	async importOne({ options, env, api, state, naming, ts }) {
+		const all = await api.workflowListAll();
+		const derivedName = naming.workflowName(options.logical, env);
+		const hit = all.find((w) => w.name === derivedName);
+		if (!hit) throw new Error(`import workflow: no workflow named "${derivedName}" found in account`);
+		if (options.cfId && hit.id !== options.cfId) throw new Error(`import workflow: cf id "${hit.id}" does not match --cf-id "${options.cfId}"`);
+		const key = `workflow:${derivedName}`;
+		const existing = state.get(key);
+		const entry = {
+			type: "workflow",
+			logicalName: options.logical,
+			derivedName,
+			bindingKey: naming.workflowBindingKey(options.logical),
+			cfId: hit.id,
+			className: hit.class_name,
+			scriptName: hit.script_name,
+			limits: existing?.type === "workflow" ? existing.limits : void 0,
+			createdAt: existing?.type === "workflow" ? existing.createdAt : ts,
+			updatedAt: ts
+		};
+		state.set(key, entry);
+	}
+};
+
+//#endregion
+//#region src/features/secrets-store/secrets-store.apply.ts
+const STATE_KEY_PREFIX = "secrets_store:";
+function stateKey(derivedName) {
+	return `${STATE_KEY_PREFIX}${derivedName}`;
+}
+/**
+* Idempotent provisioning for Secrets Store stores. The Cloudflare create
+* endpoint is non-idempotent (a duplicate name returns 409), so we list
+* first and short-circuit when a matching name already exists. Secret
+* **values** are deliberately out of scope — Tamer only manages the
+* account-scoped container. See `SecretsStoreSecretBinding` for how
+* worker bindings reference the resolved `store_id`.
+*/
+async function secretsStoreApply(resources, _tenant, env, api, state, naming) {
+	if (resources.length === 0) return;
+	let allStores = null;
+	for (const config of resources) {
+		const derivedName = naming.secretsStoreName(config.logicalName, env);
+		const key = stateKey(derivedName);
+		const existing = state.get(key);
+		const wantsBindingKey = naming.secretsStoreBindingKey(config.logicalName);
+		if (existing && existing.type === "secrets_store" && existing.bindingKey === wantsBindingKey) continue;
+		if (allStores === null) allStores = await api.secretsStoreListAll();
+		const match = allStores.find((s) => s.name === derivedName);
+		const ts = (/* @__PURE__ */ new Date()).toISOString();
+		let cfId;
+		if (match) cfId = match.id;
+		else cfId = (await api.secretsStoreCreate(derivedName)).id;
+		const entry = {
+			type: "secrets_store",
+			logicalName: config.logicalName,
+			derivedName,
+			bindingKey: wantsBindingKey,
+			cfId,
+			createdAt: existing?.type === "secrets_store" ? existing.createdAt : ts,
+			updatedAt: ts
+		};
+		state.set(key, entry);
+	}
+}
+
+//#endregion
+//#region src/features/secrets-store/secrets-store.sync.ts
+/**
+* Match each declared store against `GET /accounts/{id}/secrets_store/stores`
+* and upsert into state. Stack-scoped: `resources` is already filtered to
+* the current config so we never persist a store owned by another stack
+* sharing this state row.
+*/
+function secretsStoreSync(allStores, resources, _tenant, env, state, naming) {
+	for (const config of resources) {
+		const derivedName = naming.secretsStoreName(config.logicalName, env);
+		const match = allStores.find((s) => s.name === derivedName);
+		if (!match) continue;
+		const key = `secrets_store:${derivedName}`;
+		const existing = state.get(key);
+		const ts = (/* @__PURE__ */ new Date()).toISOString();
+		const entry = {
+			type: "secrets_store",
+			logicalName: config.logicalName,
+			derivedName,
+			bindingKey: naming.secretsStoreBindingKey(config.logicalName),
+			cfId: match.id,
+			createdAt: existing?.type === "secrets_store" ? existing.createdAt : ts,
+			updatedAt: ts
+		};
+		state.set(key, entry);
+	}
+}
+
+//#endregion
+//#region src/features/secrets-store/secrets-store.drift.ts
+function secretsStoreDrift(allStores, resources, env, state, naming) {
+	const drift = {
+		kind: "secret_store",
+		missingFromCloudflare: [],
+		unrecordedInState: [],
+		undeployed: []
+	};
+	const cfByName = new Map(allStores.map((s) => [s.name, s]));
+	const stateEntries = Object.values(state.getAll()).filter((e) => e.type === "secrets_store");
+	for (const config of resources) {
+		const derivedName = naming.secretsStoreName(config.logicalName, env);
+		const inCloudflare = cfByName.has(derivedName);
+		const stateEntry = stateEntries.find((e) => e.logicalName === config.logicalName);
+		if (stateEntry && !inCloudflare) drift.missingFromCloudflare.push({
+			logicalName: stateEntry.logicalName,
+			derivedName: stateEntry.derivedName,
+			cfId: stateEntry.cfId
+		});
+		else if (inCloudflare && !stateEntry) {
+			const cf = cfByName.get(derivedName);
+			drift.unrecordedInState.push({
+				logicalName: config.logicalName,
+				derivedName,
+				cfId: cf.id
+			});
+		} else if (!inCloudflare && !stateEntry) drift.undeployed.push({
+			logicalName: config.logicalName,
+			derivedName
+		});
+	}
+	return drift;
+}
+
+//#endregion
+//#region src/features/secrets-store/secrets-store.destroy.ts
+async function secretsStoreDestroy(_env, state, api, config, baseDir, _force) {
+	const owned = await logicalNamesForResourceKind(config, baseDir, "secret_store");
+	const resources = state.getAll();
+	const entries = Object.entries(resources).filter((kv) => kv[1].type === "secrets_store");
+	for (const [key, entry] of entries) {
+		if (!owned.has(entry.logicalName)) continue;
+		try {
+			await api.secretsStoreDelete(entry.cfId);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Failed to delete Secrets Store ${entry.derivedName}:`, err);
+		}
+	}
+}
+
+//#endregion
+//#region src/features/secrets-store/secrets-store.status.ts
+function secretsStoreStatus(resources, env, state, naming) {
+	const out = [];
+	for (const config of resources) {
+		const derivedName = naming.secretsStoreName(config.logicalName, env);
+		const entry = state.get(`secrets_store:${derivedName}`);
+		out.push({
+			binding: naming.secretsStoreBindingKey(config.logicalName),
+			name: derivedName,
+			cfId: entry?.cfId,
+			status: entry ? "ok" : "missing"
+		});
+	}
+	return out;
+}
+
+//#endregion
+//#region src/features/secrets-store/secrets-store.module.ts
+const secretsStoreModule = {
+	kind: "secret_store",
+	label: "Secrets Store",
+	configKey: "secretsStores",
+	stateEntryType: "secrets_store",
+	async fetchAll(api) {
+		return (await api.secretsStoreListAll()).map((s) => ({
+			id: s.id,
+			name: s.name
+		}));
+	},
+	async apply(ctx) {
+		await secretsStoreApply(ctx.resources, ctx.tenant, ctx.env, ctx.api, ctx.state, ctx.naming);
+	},
+	sync(ctx) {
+		secretsStoreSync(ctx.all, ctx.resources, ctx.tenant, ctx.env, ctx.state, ctx.naming);
+	},
+	drift(ctx) {
+		return secretsStoreDrift(ctx.all, ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	async destroy(ctx) {
+		await secretsStoreDestroy(ctx.env, ctx.state, ctx.api, ctx.config, ctx.baseDir, ctx.force);
+	},
+	status(ctx) {
+		return secretsStoreStatus(ctx.resources, ctx.env, ctx.state, ctx.naming);
+	},
+	generate() {
+		return {};
+	},
+	pickResources(source) {
+		return resourcesFrom(source)?.secretsStores ?? [];
+	},
+	async destroyOne({ api, state, key, entry }) {
+		if (entry.type !== "secrets_store") return;
+		try {
+			await api.secretsStoreDelete(entry.cfId);
+			state.delete(key);
+		} catch (err) {
+			console.warn(`Rollback: failed to delete Secrets Store ${entry.derivedName}:`, err);
+		}
+	},
+	async importOne({ options, env, api, state, naming, ts }) {
+		const all = await api.secretsStoreListAll();
+		const derivedName = naming.secretsStoreName(options.logical, env);
+		const hit = all.find((s) => s.name === derivedName);
+		if (!hit) throw new Error(`import secret_store: no store named "${derivedName}" found in account`);
+		if (options.cfId && hit.id !== options.cfId) throw new Error(`import secret_store: cf id "${hit.id}" does not match --cf-id "${options.cfId}"`);
+		const key = `secrets_store:${derivedName}`;
+		const existing = state.get(key);
+		const entry = {
+			type: "secrets_store",
+			logicalName: options.logical,
+			derivedName,
+			bindingKey: naming.secretsStoreBindingKey(options.logical),
+			cfId: hit.id,
+			createdAt: existing?.type === "secrets_store" ? existing.createdAt : ts,
+			updatedAt: ts
+		};
+		state.set(key, entry);
+	}
+};
+
+//#endregion
+//#region src/core/registry/registry.ts
+const resourceModules = [
+	d1Module,
+	r2Module,
+	kvModule,
+	queuesModule,
+	hyperdriveModule,
+	vectorizeModule,
+	aiGatewayModule,
+	pipelinesModule,
+	workflowsModule,
+	secretsStoreModule
+];
+const moduleByKind = new Map(resourceModules.map((m) => [m.kind, m]));
+/** Lookup by stable kind. Returns `undefined` for unknown kinds. */
+function getResourceModule(kind) {
+	return moduleByKind.get(kind);
+}
+
+//#endregion
+//#region src/core/imports/fetchStackImports.ts
+const IMPORT_RE = /\$\{tamer:import:([a-zA-Z0-9_-]+)\.([a-zA-Z0-9_-]+)\}/g;
+/**
+* Walk the merged `CfiConfig` and collect every `${tamer:import:…}` ref
+* site along with where it was found. Used both to drive the pre-fetch
+* (which sibling stacks to load) and by `tamer status` to render an
+* "inbound imports" panel even before any `apply` has run.
+*
+* Self-imports (current stack importing from its own name) are filtered
+* out — they are almost always a config typo and would otherwise
+* silently resolve via the same row this command is about to write.
+*/
+function scanConfigForImports(config) {
+	const selfStack = stackNameForConfig(config);
+	const refs = [];
+	const seen = /* @__PURE__ */ new Set();
+	const push = (raw, fieldPath) => {
+		if (!raw) return;
+		IMPORT_RE.lastIndex = 0;
+		let m;
+		while ((m = IMPORT_RE.exec(raw)) !== null) {
+			const stack = m[1];
+			const output = m[2];
+			if (stack === selfStack) continue;
+			const key = `${fieldPath}::${stack}.${output}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			refs.push({
+				stack,
+				output,
+				fieldPath
+			});
+		}
+	};
+	const walkVars = (vars, pathPrefix) => {
+		if (!vars) return;
+		for (const [k, v] of Object.entries(vars)) push(materializeTamerResolvable(v), `${pathPrefix}.${k}`);
+	};
+	const walkR2BucketNames = (w, pathPrefix) => {
+		if (!w.r2_buckets) return;
+		w.r2_buckets.forEach((b, i) => {
+			if (b.bucket_name === void 0) return;
+			push(materializeTamerResolvable(b.bucket_name), `${pathPrefix}.r2_buckets[${i}].bucket_name`);
+		});
+	};
+	const walkD1DatabaseNames = (w, pathPrefix) => {
+		const d1 = w.resources?.d1;
+		if (!d1) return;
+		d1.forEach((d, i) => {
+			if (d.databaseName === void 0) return;
+			push(materializeTamerResolvable(d.databaseName), `${pathPrefix}.resources.d1[${i}].databaseName`);
+		});
+	};
+	/** Service bindings / WfP namespace strings may carry `${tamer:import:…}`. */
+	const walkBindingsWithRefs = (w, pathPrefix) => {
+		w.services?.forEach((s, i) => {
+			if (s.service === void 0) return;
+			push(materializeTamerResolvable(s.service), `${pathPrefix}.services[${i}].service`);
+		});
+		w.dispatch_namespaces?.forEach((d, i) => {
+			if (d.namespace === void 0) return;
+			push(materializeTamerResolvable(d.namespace), `${pathPrefix}.dispatch_namespaces[${i}].namespace`);
+		});
+	};
+	if (config.worker) {
+		walkVars(config.worker.vars, "worker.vars");
+		walkR2BucketNames(config.worker, "worker");
+		walkD1DatabaseNames(config.worker, "worker");
+		walkBindingsWithRefs(config.worker, "worker");
+		if (config.worker.tamerRoutes) config.worker.tamerRoutes.forEach((r, i) => {
+			push(r.host, `worker.tamerRoutes[${i}].host`);
+			push(r.zone, `worker.tamerRoutes[${i}].zone`);
+		});
+	}
+	if (config.workers) for (const [key, w] of Object.entries(config.workers)) {
+		walkVars(w.vars, `worker[${key}].vars`);
+		walkR2BucketNames(w, `worker[${key}]`);
+		walkD1DatabaseNames(w, `worker[${key}]`);
+		walkBindingsWithRefs(w, `worker[${key}]`);
+		if (w.tamerRoutes) w.tamerRoutes.forEach((r, i) => {
+			push(r.host, `worker[${key}].tamerRoutes[${i}].host`);
+			push(r.zone, `worker[${key}].tamerRoutes[${i}].zone`);
+		});
+	}
+	if (config.outputs) for (const [name, source] of Object.entries(config.outputs)) push(materializeTamerResolvable(source), `outputs.${name}`);
+	return refs;
+}
+/** Distinct sibling stack names referenced anywhere in `config`. */
+function importedStackNames(config) {
+	const refs = scanConfigForImports(config);
+	return [...new Set(refs.map((r) => r.stack))].sort();
+}
+/**
+* Hydrate every imported sibling stack's persisted outputs and return
+* them shaped for {@link ReferenceContext.imports}.
+*
+* - `local` env: returns `{}` immediately. Local mode never persists
+*   state, so cross-stack imports are inherently unresolvable. Callers
+*   running in tolerant mode (`plan`, `status`) will see the placeholder
+*   verbatim; strict callers (`apply`, `deploy`) will fail at resolution
+*   with a clear "no imported stack" message.
+* - Missing sibling state row: recorded as an empty outputs map, so
+*   `lookupImport` can produce a "no published outputs" diagnostic
+*   (vs. the generic "stack not pre-fetched" error).
+*
+* The {@link CFApiClient} is shared with the caller for socket reuse.
+*/
+async function fetchStackImports(api, config, env) {
+	const stacks = importedStackNames(config);
+	if (stacks.length === 0 || env === "local") return {};
+	const out = {};
+	for (const stack of stacks) {
+		const sibling = new StateManager(config.tenant.id, env, stack);
+		try {
+			await sibling.hydrate(api);
+		} catch (err) {
+			throw new Error(`Failed to hydrate imported stack "${stack}" from env "${env}": ${err instanceof Error ? err.message : String(err)}`);
+		}
+		const persisted = sibling.getStackOutputs();
+		const flat = {};
+		for (const [name, v] of Object.entries(persisted)) flat[name] = v.value;
+		out[stack] = flat;
+	}
+	return out;
+}
+
+//#endregion
+export { namingFromConfig as _, resourceModules as a, d1SkipsProvisionAndMigrate as c, mergedWorkerConfigForEnv as d, resolveDeployedWorkerName as f, wranglerConfigCliArgs as g, resolveReferencesInString as h, getResourceModule as i, buildIntraStackScriptNameMap as l, rewriteIntraStackServiceTargets as m, importedStackNames as n, logicalNamesForResourceKind as o, resolveWorkerConfig as p, scanConfigForImports as r, d1CloudflareDatabaseName as s, fetchStackImports as t, mergeWorkerConfigForResourcePick as u };
+//# sourceMappingURL=fetchStackImports-B4ZJahOt.mjs.map