@dragonmastery/tamer 0.29.0 → 0.30.0

package/dist/{cloudflareSnapshot-DzPuCRTh.mjs.map → cloudflareSnapshot-GBUHeg2m.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"cloudflareSnapshot-DzPuCRTh.mjs","names":["att: PlanAttestation","raw: string","parsed: unknown","stable: CloudflareSnapshot","out: Record<string, unknown>"],"sources":["../src/core/plan/planFile.ts","../src/core/plan/cloudflareSnapshot.ts"],"sourcesContent":["import { createHash } from \"crypto\";\nimport { readFileSync, writeFileSync } from \"fs\";\nimport type { CfiConfig, CfiState } from \"../../types.js\";\nimport type { PlanReport } from \"./plan.types.js\";\nimport type { CloudflareSnapshot } from \"./cloudflareSnapshot.js\";\n\n/** Stable on-disk format identifier for `tamer plan --out`. */\nexport const PLAN_FILE_FORMAT = \"tamer-plan/v1\" as const;\n\n/**\n * Serialized `tamer plan` output, suitable for `tamer apply --plan`.\n *\n * The {@link attestation} hashes pin the `(config, state)` pair the plan\n * was generated against. Apply recomputes the same hashes at run time and\n * refuses to proceed if either drifted, so a stale plan can never silently\n * apply against a different reality. Use `--allow-stale` only when you\n * understand the risk.\n */\nexport interface PlanFile {\n  format: typeof PLAN_FILE_FORMAT;\n  tenantId: string;\n  env: string;\n  generatedAt: string;\n  /** The plan as it would be printed by `tamer plan` (kept for review). */\n  report: PlanReport;\n  attestation: PlanAttestation;\n}\n\nexport interface PlanAttestation {\n  /** SHA-256 over the canonical JSON of the parsed `tamer.config.ts`. */\n  configHash: string;\n  /** SHA-256 over the canonical JSON of `state.load()` at plan time. */\n  stateHash: string;\n  /** Revision at plan time (informational; primary check is stateHash). */\n  stateRevision?: number;\n  /**\n   * Drift-aware refresh: SHA-256 over the normalized **Cloudflare-side**\n   * snapshot at plan time (per-kind `sync()` against a fresh in-memory\n   * state, with timestamps stripped). Apply re-fetches and recomputes; a\n   * mismatch means infrastructure drifted out-of-band between plan and\n   * apply, so the plan is no longer accurate. Omitted for `env: local`.\n   */\n  cloudflareHash?: string;\n}\n\n/**\n * Stable JSON stringify: object keys are sorted recursively. The hash must\n * be deterministic across machines, so insertion order can't matter.\n */\nexport function canonicalJson(value: unknown): string {\n  return stableStringify(value);\n}\n\nfunction stableStringify(value: unknown): string {\n  if (value === null || typeof value !== \"object\") {\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) {\n    return `[${value.map((v) => stableStringify(v)).join(\",\")}]`;\n  }\n  const obj = value as Record<string, unknown>;\n  const keys = Object.keys(obj).sort();\n  const body = keys\n    .map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`)\n    .join(\",\");\n  return `{${body}}`;\n}\n\nexport function sha256Hex(input: string): string {\n  return `sha256:${createHash(\"sha256\").update(input).digest(\"hex\")}`;\n}\n\n/**\n * Compute the attestation hashes for `(config, state)` exactly as the\n * apply-side will recompute them. Keep both sides in sync — the canonical\n * JSON algorithm above is the contract.\n */\nexport function computeAttestation(\n  config: CfiConfig,\n  state: CfiState,\n  cloudflareSnapshot?: CloudflareSnapshot,\n): PlanAttestation {\n  const att: PlanAttestation = {\n    configHash: sha256Hex(canonicalJson(config)),\n    stateHash: sha256Hex(canonicalJson(stateForHash(state))),\n    stateRevision: state.revision,\n  };\n  if (cloudflareSnapshot) {\n    att.cloudflareHash = sha256Hex(canonicalJson(cloudflareSnapshot));\n  }\n  return att;\n}\n\n/**\n * Stable hash of a Cloudflare snapshot; same algorithm as\n * `attestation.cloudflareHash` so apply can recompute and compare.\n */\nexport function hashCloudflareSnapshot(\n  snapshot: CloudflareSnapshot,\n): string {\n  return sha256Hex(canonicalJson(snapshot));\n}\n\n/**\n * State view used for hashing — strips fields that legitimately drift\n * between consecutive reads (timestamps, revision counter) so the hash\n * only changes when *resources* / *tenants* / *stack* change.\n */\nfunction stateForHash(state: CfiState): unknown {\n  const { resources, tenants, stack } = state;\n  return { resources: resources ?? {}, tenants: tenants ?? {}, stack };\n}\n\nexport function writePlanFile(path: string, file: PlanFile): void {\n  writeFileSync(path, JSON.stringify(file, null, 2), \"utf-8\");\n}\n\nexport function readPlanFile(path: string): PlanFile {\n  let raw: string;\n  try {\n    raw = readFileSync(path, \"utf-8\");\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`--plan: cannot read plan file \"${path}\": ${msg}`);\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`--plan: plan file \"${path}\" is not valid JSON: ${msg}`);\n  }\n  if (!isPlanFile(parsed)) {\n    throw new Error(\n      `--plan: plan file \"${path}\" is missing required fields or has wrong format ` +\n        `(expected ${PLAN_FILE_FORMAT})`,\n    );\n  }\n  if (parsed.format !== PLAN_FILE_FORMAT) {\n    throw new Error(\n      `--plan: plan file format \"${parsed.format}\" is not supported by this Tamer build (expected ${PLAN_FILE_FORMAT})`,\n    );\n  }\n  return parsed;\n}\n\nfunction isPlanFile(v: unknown): v is PlanFile {\n  if (!v || typeof v !== \"object\") return false;\n  const o = v as Record<string, unknown>;\n  return (\n    typeof o.format === \"string\" &&\n    typeof o.tenantId === \"string\" &&\n    typeof o.env === \"string\" &&\n    typeof o.generatedAt === \"string\" &&\n    !!o.report &&\n    typeof o.report === \"object\" &&\n    !!o.attestation &&\n    typeof o.attestation === \"object\"\n  );\n}\n","import type { CfiConfig, StateEntry } from \"../../types.js\";\nimport type { CFApiClient } from \"../api/CFApiClient.js\";\nimport { StateManager } from \"../state/StateManager.js\";\nimport { stackNameForConfig } from \"../state/stackName.js\";\nimport { resourceModules } from \"../registry/registry.js\";\nimport { namingFromConfig } from \"../config/namingFromConfig.js\";\nimport { getWorkers } from \"../config/loader.js\";\nimport { dispatchNamespaceSync } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordSync } from \"../../features/dns-records/index.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobSync } from \"../../features/logpush-job/index.js\";\nimport { fetchStackImports } from \"../imports/fetchStackImports.js\";\nimport { cloudflareAccountIdFromEnv } from \"../cloudflareEnv.js\";\nimport { mergeWorkerConfigForResourcePick } from \"../config/resolver.js\";\n\n/**\n * Drift-aware Cloudflare snapshot used by `tamer plan --out` and\n * `tamer apply --plan`.\n *\n * Drives the registry's `sync` hook for every kind against a **fresh\n * in-memory state** so the result reflects only what currently exists on\n * Cloudflare (no carryover from D1). The shape mirrors the post-sync\n * resource map but strips volatile fields (timestamps) so consecutive\n * snapshots of an unchanged account hash to the same value.\n *\n * Apply recomputes this against live Cloudflare and refuses to proceed if\n * `cloudflareHash` differs from the plan's pinned hash — that's how a\n * stale plan against drifted infra is detected.\n */\nexport async function buildCloudflareSnapshot(args: {\n  config: CfiConfig;\n  env: string;\n  api: CFApiClient;\n  baseDir: string;\n}): Promise<CloudflareSnapshot> {\n  const { config, env, api, baseDir } = args;\n  const naming = namingFromConfig(config);\n  // In-memory snapshot — never round-trips to D1, so stack name only\n  // matters for diagnostics; passing it keeps logs consistent with the\n  // owning stack.\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  state.hydrateInMemory();\n\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv() ?? \"\";\n  const imports =\n    env !== \"local\"\n      ? await fetchStackImports(api, config, env).catch(\n          () => ({} as Record<string, Record<string, string>>),\n        )\n      : ({} as Record<string, Record<string, string>>);\n\n  const workers = await getWorkers(config, baseDir);\n\n  for (const mod of resourceModules) {\n    const all = await mod.fetchAll(api);\n    for (const [workerKey, wc] of workers) {\n      const mergedWorker =\n        env !== \"local\" && accountId\n          ? mergeWorkerConfigForResourcePick(\n              config,\n              workerKey,\n              wc,\n              env,\n              accountId,\n              naming,\n              state,\n              { referencesMode: \"tolerant\", imports },\n            )\n          : wc;\n      const resources = mod.pickResources(mergedWorker);\n      if (resources.length === 0) continue;\n      mod.sync({\n        all,\n        resources,\n        tenant: config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n      });\n    }\n  }\n\n  if (getDispatchNamespaces(config).length > 0 && env !== \"local\") {\n    await dispatchNamespaceSync(\n      getDispatchNamespaces(config),\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n  }\n\n  if (getDnsRecords(config).length > 0 && env !== \"local\") {\n    await dnsRecordSync(\n      getDnsRecords(config),\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n  }\n\n  if (getLogpushJobs(config).length > 0 && env !== \"local\") {\n    await logpushJobSync(\n      getLogpushJobs(config),\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n  }\n\n  const entries = state.getAll();\n  const stable: CloudflareSnapshot = { entries: {} };\n  for (const key of Object.keys(entries).sort()) {\n    stable.entries[key] = stripVolatile(entries[key]!);\n  }\n  return stable;\n}\n\n/**\n * Per-entry projection used in {@link CloudflareSnapshot}. Drops fields\n * that legitimately move between two reads of the same Cloudflare resource\n * (timestamps); keeps anything that, if it changed, would mean the plan is\n * no longer accurate (cfId, derivedName, kind-specific identity bits).\n */\nfunction stripVolatile(entry: StateEntry): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(entry)) {\n    if (k === \"createdAt\" || k === \"updatedAt\") continue;\n    out[k] = v;\n  }\n  return out;\n}\n\nexport interface CloudflareSnapshot {\n  /** Sorted by key (== `derivedName`) for deterministic hashing. */\n  entries: Record<string, Record<string, unknown>>;\n}\n"],"mappings":";;;;;;;;;;;;AAOA,MAAa,mBAAmB;;;;;AA0ChC,SAAgB,cAAc,OAAwB;AACpD,QAAO,gBAAgB,MAAM;;AAG/B,SAAS,gBAAgB,OAAwB;AAC/C,KAAI,UAAU,QAAQ,OAAO,UAAU,SACrC,QAAO,KAAK,UAAU,MAAM;AAE9B,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,IAAI,MAAM,KAAK,MAAM,gBAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;CAE5D,MAAM,MAAM;AAKZ,QAAO,IAJM,OAAO,KAAK,IAAI,CAAC,MAAM,CAEjC,KAAK,MAAM,GAAG,KAAK,UAAU,EAAE,CAAC,GAAG,gBAAgB,IAAI,GAAG,GAAG,CAC7D,KAAK,IAAI,CACI;;AAGlB,SAAgB,UAAU,OAAuB;AAC/C,QAAO,UAAU,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;;;;;;AAQnE,SAAgB,mBACd,QACA,OACA,oBACiB;CACjB,MAAMA,MAAuB;EAC3B,YAAY,UAAU,cAAc,OAAO,CAAC;EAC5C,WAAW,UAAU,cAAc,aAAa,MAAM,CAAC,CAAC;EACxD,eAAe,MAAM;EACtB;AACD,KAAI,mBACF,KAAI,iBAAiB,UAAU,cAAc,mBAAmB,CAAC;AAEnE,QAAO;;;;;;AAOT,SAAgB,uBACd,UACQ;AACR,QAAO,UAAU,cAAc,SAAS,CAAC;;;;;;;AAQ3C,SAAS,aAAa,OAA0B;CAC9C,MAAM,EAAE,WAAW,SAAS,UAAU;AACtC,QAAO;EAAE,WAAW,aAAa,EAAE;EAAE,SAAS,WAAW,EAAE;EAAE;EAAO;;AAGtE,SAAgB,cAAc,MAAc,MAAsB;AAChE,eAAc,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,EAAE,QAAQ;;AAG7D,SAAgB,aAAa,MAAwB;CACnD,IAAIC;AACJ,KAAI;AACF,QAAM,aAAa,MAAM,QAAQ;UAC1B,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MAAM,kCAAkC,KAAK,KAAK,MAAM;;CAEpE,IAAIC;AACJ,KAAI;AACF,WAAS,KAAK,MAAM,IAAI;UACjB,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MAAM,sBAAsB,KAAK,uBAAuB,MAAM;;AAE1E,KAAI,CAAC,WAAW,OAAO,CACrB,OAAM,IAAI,MACR,sBAAsB,KAAK,6DACZ,iBAAiB,GACjC;AAEH,KAAI,OAAO,WAAW,iBACpB,OAAM,IAAI,MACR,6BAA6B,OAAO,OAAO,mDAAmD,iBAAiB,GAChH;AAEH,QAAO;;AAGT,SAAS,WAAW,GAA2B;AAC7C,KAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;CACxC,MAAM,IAAI;AACV,QACE,OAAO,EAAE,WAAW,YACpB,OAAO,EAAE,aAAa,YACtB,OAAO,EAAE,QAAQ,YACjB,OAAO,EAAE,gBAAgB,YACzB,CAAC,CAAC,EAAE,UACJ,OAAO,EAAE,WAAW,YACpB,CAAC,CAAC,EAAE,eACJ,OAAO,EAAE,gBAAgB;;;;;;;;;;;;;;;;;;;AChI7B,eAAsB,wBAAwB,MAKd;CAC9B,MAAM,EAAE,QAAQ,KAAK,KAAK,YAAY;CACtC,MAAM,SAAS,iBAAiB,OAAO;CAIvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,iBAAiB;CAEvB,MAAM,YAAY,OAAO,cAAc,4BAA4B,IAAI;CACvE,MAAM,UACJ,QAAQ,UACJ,MAAM,kBAAkB,KAAK,QAAQ,IAAI,CAAC,aACjC,EAAE,EACV,GACA,EAAE;CAET,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AAEjD,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,MAAM,MAAM,IAAI,SAAS,IAAI;AACnC,OAAK,MAAM,CAAC,WAAW,OAAO,SAAS;GACrC,MAAM,eACJ,QAAQ,WAAW,YACf,iCACE,QACA,WACA,IACA,KACA,WACA,QACA,OACA;IAAE,gBAAgB;IAAY;IAAS,CACxC,GACD;GACN,MAAM,YAAY,IAAI,cAAc,aAAa;AACjD,OAAI,UAAU,WAAW,EAAG;AAC5B,OAAI,KAAK;IACP;IACA;IACA,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;;;AAIN,KAAI,sBAAsB,OAAO,CAAC,SAAS,KAAK,QAAQ,QACtD,OAAM,sBACJ,sBAAsB,OAAO,EAC7B,OAAO,QACP,KACA,KACA,MACD;AAGH,KAAI,cAAc,OAAO,CAAC,SAAS,KAAK,QAAQ,QAC9C,OAAM,cACJ,cAAc,OAAO,EACrB,OAAO,QACP,KACA,KACA,MACD;AAGH,KAAI,eAAe,OAAO,CAAC,SAAS,KAAK,QAAQ,QAC/C,OAAM,eACJ,eAAe,OAAO,EACtB,OAAO,QACP,KACA,KACA,MACD;CAGH,MAAM,UAAU,MAAM,QAAQ;CAC9B,MAAMC,SAA6B,EAAE,SAAS,EAAE,EAAE;AAClD,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CAAC,MAAM,CAC3C,QAAO,QAAQ,OAAO,cAAc,QAAQ,KAAM;AAEpD,QAAO;;;;;;;;AAST,SAAS,cAAc,OAA4C;CACjE,MAAMC,MAA+B,EAAE;AACvC,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,EAAE;AAC1C,MAAI,MAAM,eAAe,MAAM,YAAa;AAC5C,MAAI,KAAK;;AAEX,QAAO"}
+{"version":3,"file":"cloudflareSnapshot-GBUHeg2m.mjs","names":["att: PlanAttestation","raw: string","parsed: unknown","stable: CloudflareSnapshot","out: Record<string, unknown>"],"sources":["../src/core/plan/planFile.ts","../src/core/plan/cloudflareSnapshot.ts"],"sourcesContent":["import { createHash } from \"crypto\";\nimport { readFileSync, writeFileSync } from \"fs\";\nimport type { CfiConfig, CfiState } from \"../../types.js\";\nimport type { PlanReport } from \"./plan.types.js\";\nimport type { CloudflareSnapshot } from \"./cloudflareSnapshot.js\";\n\n/** Stable on-disk format identifier for `tamer plan --out`. */\nexport const PLAN_FILE_FORMAT = \"tamer-plan/v1\" as const;\n\n/**\n * Serialized `tamer plan` output, suitable for `tamer apply --plan`.\n *\n * The {@link attestation} hashes pin the `(config, state)` pair the plan\n * was generated against. Apply recomputes the same hashes at run time and\n * refuses to proceed if either drifted, so a stale plan can never silently\n * apply against a different reality. Use `--allow-stale` only when you\n * understand the risk.\n */\nexport interface PlanFile {\n  format: typeof PLAN_FILE_FORMAT;\n  tenantId: string;\n  env: string;\n  generatedAt: string;\n  /** The plan as it would be printed by `tamer plan` (kept for review). */\n  report: PlanReport;\n  attestation: PlanAttestation;\n}\n\nexport interface PlanAttestation {\n  /** SHA-256 over the canonical JSON of the parsed `tamer.config.ts`. */\n  configHash: string;\n  /** SHA-256 over the canonical JSON of `state.load()` at plan time. */\n  stateHash: string;\n  /** Revision at plan time (informational; primary check is stateHash). */\n  stateRevision?: number;\n  /**\n   * Drift-aware refresh: SHA-256 over the normalized **Cloudflare-side**\n   * snapshot at plan time (per-kind `sync()` against a fresh in-memory\n   * state, with timestamps stripped). Apply re-fetches and recomputes; a\n   * mismatch means infrastructure drifted out-of-band between plan and\n   * apply, so the plan is no longer accurate. Omitted for `env: local`.\n   */\n  cloudflareHash?: string;\n}\n\n/**\n * Stable JSON stringify: object keys are sorted recursively. The hash must\n * be deterministic across machines, so insertion order can't matter.\n */\nexport function canonicalJson(value: unknown): string {\n  return stableStringify(value);\n}\n\nfunction stableStringify(value: unknown): string {\n  if (value === null || typeof value !== \"object\") {\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) {\n    return `[${value.map((v) => stableStringify(v)).join(\",\")}]`;\n  }\n  const obj = value as Record<string, unknown>;\n  const keys = Object.keys(obj).sort();\n  const body = keys\n    .map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`)\n    .join(\",\");\n  return `{${body}}`;\n}\n\nexport function sha256Hex(input: string): string {\n  return `sha256:${createHash(\"sha256\").update(input).digest(\"hex\")}`;\n}\n\n/**\n * Compute the attestation hashes for `(config, state)` exactly as the\n * apply-side will recompute them. Keep both sides in sync — the canonical\n * JSON algorithm above is the contract.\n */\nexport function computeAttestation(\n  config: CfiConfig,\n  state: CfiState,\n  cloudflareSnapshot?: CloudflareSnapshot,\n): PlanAttestation {\n  const att: PlanAttestation = {\n    configHash: sha256Hex(canonicalJson(config)),\n    stateHash: sha256Hex(canonicalJson(stateForHash(state))),\n    stateRevision: state.revision,\n  };\n  if (cloudflareSnapshot) {\n    att.cloudflareHash = sha256Hex(canonicalJson(cloudflareSnapshot));\n  }\n  return att;\n}\n\n/**\n * Stable hash of a Cloudflare snapshot; same algorithm as\n * `attestation.cloudflareHash` so apply can recompute and compare.\n */\nexport function hashCloudflareSnapshot(\n  snapshot: CloudflareSnapshot,\n): string {\n  return sha256Hex(canonicalJson(snapshot));\n}\n\n/**\n * State view used for hashing — strips fields that legitimately drift\n * between consecutive reads (timestamps, revision counter) so the hash\n * only changes when *resources* / *tenants* / *stack* change.\n */\nfunction stateForHash(state: CfiState): unknown {\n  const { resources, tenants, stack } = state;\n  return { resources: resources ?? {}, tenants: tenants ?? {}, stack };\n}\n\nexport function writePlanFile(path: string, file: PlanFile): void {\n  writeFileSync(path, JSON.stringify(file, null, 2), \"utf-8\");\n}\n\nexport function readPlanFile(path: string): PlanFile {\n  let raw: string;\n  try {\n    raw = readFileSync(path, \"utf-8\");\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`--plan: cannot read plan file \"${path}\": ${msg}`);\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`--plan: plan file \"${path}\" is not valid JSON: ${msg}`);\n  }\n  if (!isPlanFile(parsed)) {\n    throw new Error(\n      `--plan: plan file \"${path}\" is missing required fields or has wrong format ` +\n        `(expected ${PLAN_FILE_FORMAT})`,\n    );\n  }\n  if (parsed.format !== PLAN_FILE_FORMAT) {\n    throw new Error(\n      `--plan: plan file format \"${parsed.format}\" is not supported by this Tamer build (expected ${PLAN_FILE_FORMAT})`,\n    );\n  }\n  return parsed;\n}\n\nfunction isPlanFile(v: unknown): v is PlanFile {\n  if (!v || typeof v !== \"object\") return false;\n  const o = v as Record<string, unknown>;\n  return (\n    typeof o.format === \"string\" &&\n    typeof o.tenantId === \"string\" &&\n    typeof o.env === \"string\" &&\n    typeof o.generatedAt === \"string\" &&\n    !!o.report &&\n    typeof o.report === \"object\" &&\n    !!o.attestation &&\n    typeof o.attestation === \"object\"\n  );\n}\n","import type { CfiConfig, StateEntry } from \"../../types.js\";\nimport type { CFApiClient } from \"../api/CFApiClient.js\";\nimport { StateManager } from \"../state/StateManager.js\";\nimport { stackNameForConfig } from \"../state/stackName.js\";\nimport { resourceModules } from \"../registry/registry.js\";\nimport { namingFromConfig } from \"../config/namingFromConfig.js\";\nimport { getWorkers } from \"../config/loader.js\";\nimport { dispatchNamespaceSync } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordSync } from \"../../features/dns-records/index.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobSync } from \"../../features/logpush-job/index.js\";\nimport { fetchStackImports } from \"../imports/fetchStackImports.js\";\nimport { cloudflareAccountIdFromEnv } from \"../cloudflareEnv.js\";\nimport { mergeWorkerConfigForResourcePick } from \"../config/resolver.js\";\n\n/**\n * Drift-aware Cloudflare snapshot used by `tamer plan --out` and\n * `tamer apply --plan`.\n *\n * Drives the registry's `sync` hook for every kind against a **fresh\n * in-memory state** so the result reflects only what currently exists on\n * Cloudflare (no carryover from D1). The shape mirrors the post-sync\n * resource map but strips volatile fields (timestamps) so consecutive\n * snapshots of an unchanged account hash to the same value.\n *\n * Apply recomputes this against live Cloudflare and refuses to proceed if\n * `cloudflareHash` differs from the plan's pinned hash — that's how a\n * stale plan against drifted infra is detected.\n */\nexport async function buildCloudflareSnapshot(args: {\n  config: CfiConfig;\n  env: string;\n  api: CFApiClient;\n  baseDir: string;\n}): Promise<CloudflareSnapshot> {\n  const { config, env, api, baseDir } = args;\n  const naming = namingFromConfig(config);\n  // In-memory snapshot — never round-trips to D1, so stack name only\n  // matters for diagnostics; passing it keeps logs consistent with the\n  // owning stack.\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  state.hydrateInMemory();\n\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv() ?? \"\";\n  const imports =\n    env !== \"local\"\n      ? await fetchStackImports(api, config, env).catch(\n          () => ({} as Record<string, Record<string, string>>),\n        )\n      : ({} as Record<string, Record<string, string>>);\n\n  const workers = await getWorkers(config, baseDir);\n\n  for (const mod of resourceModules) {\n    const all = await mod.fetchAll(api);\n    for (const [workerKey, wc] of workers) {\n      const mergedWorker =\n        env !== \"local\" && accountId\n          ? mergeWorkerConfigForResourcePick(\n              config,\n              workerKey,\n              wc,\n              env,\n              accountId,\n              naming,\n              state,\n              { referencesMode: \"tolerant\", imports },\n            )\n          : wc;\n      const resources = mod.pickResources(mergedWorker);\n      if (resources.length === 0) continue;\n      mod.sync({\n        all,\n        resources,\n        tenant: config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n      });\n    }\n  }\n\n  if (getDispatchNamespaces(config).length > 0 && env !== \"local\") {\n    await dispatchNamespaceSync(\n      getDispatchNamespaces(config),\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n  }\n\n  if (getDnsRecords(config).length > 0 && env !== \"local\") {\n    await dnsRecordSync(\n      getDnsRecords(config),\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n  }\n\n  if (getLogpushJobs(config).length > 0 && env !== \"local\") {\n    await logpushJobSync(\n      getLogpushJobs(config),\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n  }\n\n  const entries = state.getAll();\n  const stable: CloudflareSnapshot = { entries: {} };\n  for (const key of Object.keys(entries).sort()) {\n    stable.entries[key] = stripVolatile(entries[key]!);\n  }\n  return stable;\n}\n\n/**\n * Per-entry projection used in {@link CloudflareSnapshot}. Drops fields\n * that legitimately move between two reads of the same Cloudflare resource\n * (timestamps); keeps anything that, if it changed, would mean the plan is\n * no longer accurate (cfId, derivedName, kind-specific identity bits).\n */\nfunction stripVolatile(entry: StateEntry): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(entry)) {\n    if (k === \"createdAt\" || k === \"updatedAt\") continue;\n    out[k] = v;\n  }\n  return out;\n}\n\nexport interface CloudflareSnapshot {\n  /** Sorted by key (== `derivedName`) for deterministic hashing. */\n  entries: Record<string, Record<string, unknown>>;\n}\n"],"mappings":";;;;;;;;;;;;AAOA,MAAa,mBAAmB;;;;;AA0ChC,SAAgB,cAAc,OAAwB;AACpD,QAAO,gBAAgB,MAAM;;AAG/B,SAAS,gBAAgB,OAAwB;AAC/C,KAAI,UAAU,QAAQ,OAAO,UAAU,SACrC,QAAO,KAAK,UAAU,MAAM;AAE9B,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,IAAI,MAAM,KAAK,MAAM,gBAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;CAE5D,MAAM,MAAM;AAKZ,QAAO,IAJM,OAAO,KAAK,IAAI,CAAC,MAAM,CAEjC,KAAK,MAAM,GAAG,KAAK,UAAU,EAAE,CAAC,GAAG,gBAAgB,IAAI,GAAG,GAAG,CAC7D,KAAK,IAAI,CACI;;AAGlB,SAAgB,UAAU,OAAuB;AAC/C,QAAO,UAAU,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;;;;;;AAQnE,SAAgB,mBACd,QACA,OACA,oBACiB;CACjB,MAAMA,MAAuB;EAC3B,YAAY,UAAU,cAAc,OAAO,CAAC;EAC5C,WAAW,UAAU,cAAc,aAAa,MAAM,CAAC,CAAC;EACxD,eAAe,MAAM;EACtB;AACD,KAAI,mBACF,KAAI,iBAAiB,UAAU,cAAc,mBAAmB,CAAC;AAEnE,QAAO;;;;;;AAOT,SAAgB,uBACd,UACQ;AACR,QAAO,UAAU,cAAc,SAAS,CAAC;;;;;;;AAQ3C,SAAS,aAAa,OAA0B;CAC9C,MAAM,EAAE,WAAW,SAAS,UAAU;AACtC,QAAO;EAAE,WAAW,aAAa,EAAE;EAAE,SAAS,WAAW,EAAE;EAAE;EAAO;;AAGtE,SAAgB,cAAc,MAAc,MAAsB;AAChE,eAAc,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,EAAE,QAAQ;;AAG7D,SAAgB,aAAa,MAAwB;CACnD,IAAIC;AACJ,KAAI;AACF,QAAM,aAAa,MAAM,QAAQ;UAC1B,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MAAM,kCAAkC,KAAK,KAAK,MAAM;;CAEpE,IAAIC;AACJ,KAAI;AACF,WAAS,KAAK,MAAM,IAAI;UACjB,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MAAM,sBAAsB,KAAK,uBAAuB,MAAM;;AAE1E,KAAI,CAAC,WAAW,OAAO,CACrB,OAAM,IAAI,MACR,sBAAsB,KAAK,6DACZ,iBAAiB,GACjC;AAEH,KAAI,OAAO,WAAW,iBACpB,OAAM,IAAI,MACR,6BAA6B,OAAO,OAAO,mDAAmD,iBAAiB,GAChH;AAEH,QAAO;;AAGT,SAAS,WAAW,GAA2B;AAC7C,KAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;CACxC,MAAM,IAAI;AACV,QACE,OAAO,EAAE,WAAW,YACpB,OAAO,EAAE,aAAa,YACtB,OAAO,EAAE,QAAQ,YACjB,OAAO,EAAE,gBAAgB,YACzB,CAAC,CAAC,EAAE,UACJ,OAAO,EAAE,WAAW,YACpB,CAAC,CAAC,EAAE,eACJ,OAAO,EAAE,gBAAgB;;;;;;;;;;;;;;;;;;;AChI7B,eAAsB,wBAAwB,MAKd;CAC9B,MAAM,EAAE,QAAQ,KAAK,KAAK,YAAY;CACtC,MAAM,SAAS,iBAAiB,OAAO;CAIvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,iBAAiB;CAEvB,MAAM,YAAY,OAAO,cAAc,4BAA4B,IAAI;CACvE,MAAM,UACJ,QAAQ,UACJ,MAAM,kBAAkB,KAAK,QAAQ,IAAI,CAAC,aACjC,EAAE,EACV,GACA,EAAE;CAET,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AAEjD,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,MAAM,MAAM,IAAI,SAAS,IAAI;AACnC,OAAK,MAAM,CAAC,WAAW,OAAO,SAAS;GACrC,MAAM,eACJ,QAAQ,WAAW,YACf,iCACE,QACA,WACA,IACA,KACA,WACA,QACA,OACA;IAAE,gBAAgB;IAAY;IAAS,CACxC,GACD;GACN,MAAM,YAAY,IAAI,cAAc,aAAa;AACjD,OAAI,UAAU,WAAW,EAAG;AAC5B,OAAI,KAAK;IACP;IACA;IACA,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;;;AAIN,KAAI,sBAAsB,OAAO,CAAC,SAAS,KAAK,QAAQ,QACtD,OAAM,sBACJ,sBAAsB,OAAO,EAC7B,OAAO,QACP,KACA,KACA,MACD;AAGH,KAAI,cAAc,OAAO,CAAC,SAAS,KAAK,QAAQ,QAC9C,OAAM,cACJ,cAAc,OAAO,EACrB,OAAO,QACP,KACA,KACA,MACD;AAGH,KAAI,eAAe,OAAO,CAAC,SAAS,KAAK,QAAQ,QAC/C,OAAM,eACJ,eAAe,OAAO,EACtB,OAAO,QACP,KACA,KACA,MACD;CAGH,MAAM,UAAU,MAAM,QAAQ;CAC9B,MAAMC,SAA6B,EAAE,SAAS,EAAE,EAAE;AAClD,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CAAC,MAAM,CAC3C,QAAO,QAAQ,OAAO,cAAc,QAAQ,KAAM;AAEpD,QAAO;;;;;;;;AAST,SAAS,cAAc,OAA4C;CACjE,MAAMC,MAA+B,EAAE;AACvC,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,EAAE;AAC1C,MAAI,MAAM,eAAe,MAAM,YAAa;AAC5C,MAAI,KAAK;;AAEX,QAAO"}

package/dist/{deploy-C0edCpn9.mjs → deploy-DAEjDjOm.mjs}

@@ -1,12 +1,12 @@
-import { n as loadConfig, t as getWorkers } from "./loader-DAvCKLTT.mjs";
+import { n as loadConfig, t as getWorkers } from "./loader-DnT9iqz9.mjs";
 import { n as cloudflareAccountIdFromEnv, t as CFApiClient } from "./CFApiClient-DhbyyV71.mjs";
-import { _ as namingFromConfig, d as mergedWorkerConfigForEnv, f as resolveDeployedWorkerName, g as wranglerConfigCliArgs, l as buildIntraStackScriptNameMap, m as rewriteIntraStackServiceTargets, p as resolveWorkerConfig, t as fetchStackImports } from "./fetchStackImports-C-1THPYL.mjs";
-import { f as stackNameForConfig, t as StateManager } from "./StateManager-DTqtLLVX.mjs";
+import { _ as wranglerConfigCliArgs, f as mergedWorkerConfigForEnv, h as rewriteIntraStackServiceTargets, m as resolveWorkerConfig, p as resolveDeployedWorkerName, t as fetchStackImports, u as buildIntraStackScriptNameMap, v as namingFromConfig } from "./fetchStackImports-ClUYZy_U.mjs";
+import { f as stackNameForConfig, t as StateManager } from "./StateManager-JLBtz9V-.mjs";
 import "./r2S3EmptyBucket-DD81ZWQ7.mjs";
-import { n as writeWranglerJson, t as generateWranglerConfig } from "./generator-Ba-vqyBG.mjs";
+import { n as writeWranglerJson, t as generateWranglerConfig } from "./generator-h_VG0Q5f.mjs";
 import "./logpush-job-DsRkOORJ.mjs";
-import { r as workerRoutesApply } from "./worker-route-CMbtozNa.mjs";
-import { runSync } from "./sync-B_pyPi7Z.mjs";
+import { r as workerRoutesApply } from "./worker-route-DY1onr-h.mjs";
+import { runSync } from "./sync-BdJ43vO7.mjs";
 import { t as spawnWranglerSync } from "./wranglerSpawn-DmEz0ldT.mjs";
 
 //#region src/cli/commands/deploy.ts
@@ -116,4 +116,4 @@ async function runDeploy(options) {
 
 //#endregion
 export { runDeploy };
-//# sourceMappingURL=deploy-C0edCpn9.mjs.map
+//# sourceMappingURL=deploy-DAEjDjOm.mjs.map

package/dist/{deploy-C0edCpn9.mjs.map → deploy-DAEjDjOm.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"deploy-C0edCpn9.mjs","names":["out: WorkerEntry[]"],"sources":["../src/cli/commands/deploy.ts"],"sourcesContent":["import type { CfiConfig, WorkerConfig } from \"../../types.js\";\nimport { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport { wranglerConfigCliArgs } from \"../../core/wrangler/wranglerOutFile.js\";\nimport { spawnWranglerSync } from \"../../core/wrangler/wranglerSpawn.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport {\n  buildIntraStackScriptNameMap,\n  mergedWorkerConfigForEnv,\n  resolveDeployedWorkerName,\n  resolveWorkerConfig,\n  rewriteIntraStackServiceTargets,\n} from \"../../core/config/resolver.js\";\nimport {\n  generateWranglerConfig,\n  writeWranglerJson,\n} from \"../../core/wrangler/generator.js\";\nimport { runSync } from \"./sync.js\";\nimport { workerRoutesApply } from \"../../features/worker-route/index.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\n\ntype WorkerEntry = [string, WorkerConfig];\n\n/**\n * Topologically sort workers by `services[].service` so that dependencies\n * deploy before dependents. Cloudflare rejects deploys that reference\n * service bindings to workers that don't yet exist on the account.\n * Cross-config dependencies (services not in this monorepo) are ignored.\n */\nexport function topoSortWorkersByServiceBindings(\n  workers: WorkerEntry[],\n  config: CfiConfig,\n  naming: NamingEngine,\n  env: string,\n): WorkerEntry[] {\n  const intraMap = buildIntraStackScriptNameMap(config, env, naming);\n  const scriptNameToKey = new Map<string, string>();\n  for (const [key, cfg] of workers) {\n    const name = resolveDeployedWorkerName(config, key, cfg, env, naming);\n    scriptNameToKey.set(name, key);\n  }\n\n  const byKey = new Map(workers);\n  const visited = new Set<string>();\n  const visiting = new Set<string>();\n  const out: WorkerEntry[] = [];\n\n  function visit(key: string): void {\n    if (visited.has(key)) return;\n    if (visiting.has(key)) return;\n    visiting.add(key);\n    const cfg = byKey.get(key);\n    if (cfg) {\n      const merged = rewriteIntraStackServiceTargets(\n        mergedWorkerConfigForEnv(cfg, env, config.tenant),\n        intraMap,\n      );\n      const deps = merged.services?.map((s) => s.service) ?? [];\n      for (const dep of deps) {\n        const depKey = scriptNameToKey.get(dep);\n        if (depKey && depKey !== key) visit(depKey);\n      }\n      visiting.delete(key);\n      visited.add(key);\n      out.push([key, cfg]);\n    }\n  }\n\n  for (const [key] of workers) visit(key);\n  return out;\n}\n\nexport async function runDeploy(options: {\n  worker?: string;\n  env?: string;\n  configPath?: string;\n  /** Passed to `wrangler deploy --dispatch-namespace` when the worker has no `dispatchNamespace` in config. */\n  dispatchNamespace?: string;\n}): Promise<void> {\n  const workerFilter = options.worker;\n  // `--env` is intentionally required (no silent default to \"prod\") to\n  // match every other Tamer command and to avoid the classic \"ran\n  // `tamer deploy` from the wrong shell, shipped a half-tested branch\n  // to production\" footgun.\n  const env = options.env;\n  if (!env) {\n    throw new Error(\n      \"deploy: --env is required (e.g. --env staging). \" +\n        \"Tamer no longer defaults to prod — pass the env explicitly.\",\n    );\n  }\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  console.log(`Syncing state for env: ${env}...`);\n  await runSync({ env, configPath });\n\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const imports = await fetchStackImports(api, config, env);\n  state.beginOperation(\"deploy\", workerFilter ? `worker:${workerFilter}` : undefined);\n\n  try {\n\n  const workers = await getWorkers(config, baseDir);\n  const toDeploy = workerFilter\n    ? workers.filter(([k]) => k === workerFilter)\n    : workers;\n\n  if (toDeploy.length === 0) {\n    throw new Error(\n      workerFilter\n        ? `Worker \"${workerFilter}\" not found`\n        : \"No workers configured\",\n    );\n  }\n\n  const ordered = topoSortWorkersByServiceBindings(\n    toDeploy,\n    config,\n    naming,\n    env,\n  );\n\n  for (const [workerKey, workerConfig] of ordered) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { imports },\n    );\n    const wranglerConfig = generateWranglerConfig(resolved, state, naming);\n    writeWranglerJson(resolved.workerDir, wranglerConfig, resolved.wranglerOutFile);\n\n    const typesArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n      \"types\",\n    ];\n    const typesResult = spawnWranglerSync(typesArgs, {\n      cwd: resolved.workerDir,\n      stdio: \"inherit\",\n    });\n    if (typesResult.status !== 0) {\n      throw new Error(`wrangler types failed for ${workerKey}`);\n    }\n\n    const dispatchNs =\n      resolved.dispatchNamespace ?? options.dispatchNamespace;\n    const deployArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n      \"deploy\",\n    ];\n    if (dispatchNs) {\n      deployArgs.push(\"--dispatch-namespace\", dispatchNs);\n    }\n\n    const deployResult = spawnWranglerSync(deployArgs, {\n      cwd: resolved.workerDir,\n      stdio: \"inherit\",\n    });\n    if (deployResult.status !== 0) {\n      throw new Error(`wrangler deploy failed for ${workerKey}`);\n    }\n    console.log(`Deployed ${workerKey}`);\n  }\n\n  if (env !== \"local\") {\n    try {\n      await workerRoutesApply(\n        env,\n        config,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        api,\n        { imports },\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      throw new Error(`worker routes apply failed after deploy: ${msg}`);\n    }\n  }\n\n  state.finishOperation();\n  await state.persist(api);\n  console.log(`Deploy complete for env: ${env}`);\n  } catch (err) {\n    state.failOperation(err instanceof Error ? err.message : String(err));\n    try {\n      await state.persist(api);\n    } catch {\n      /* swallow secondary persist failure */\n    }\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiCA,SAAgB,iCACd,SACA,QACA,QACA,KACe;CACf,MAAM,WAAW,6BAA6B,QAAQ,KAAK,OAAO;CAClE,MAAM,kCAAkB,IAAI,KAAqB;AACjD,MAAK,MAAM,CAAC,KAAK,QAAQ,SAAS;EAChC,MAAM,OAAO,0BAA0B,QAAQ,KAAK,KAAK,KAAK,OAAO;AACrE,kBAAgB,IAAI,MAAM,IAAI;;CAGhC,MAAM,QAAQ,IAAI,IAAI,QAAQ;CAC9B,MAAM,0BAAU,IAAI,KAAa;CACjC,MAAM,2BAAW,IAAI,KAAa;CAClC,MAAMA,MAAqB,EAAE;CAE7B,SAAS,MAAM,KAAmB;AAChC,MAAI,QAAQ,IAAI,IAAI,CAAE;AACtB,MAAI,SAAS,IAAI,IAAI,CAAE;AACvB,WAAS,IAAI,IAAI;EACjB,MAAM,MAAM,MAAM,IAAI,IAAI;AAC1B,MAAI,KAAK;GAKP,MAAM,OAJS,gCACb,yBAAyB,KAAK,KAAK,OAAO,OAAO,EACjD,SACD,CACmB,UAAU,KAAK,MAAM,EAAE,QAAQ,IAAI,EAAE;AACzD,QAAK,MAAM,OAAO,MAAM;IACtB,MAAM,SAAS,gBAAgB,IAAI,IAAI;AACvC,QAAI,UAAU,WAAW,IAAK,OAAM,OAAO;;AAE7C,YAAS,OAAO,IAAI;AACpB,WAAQ,IAAI,IAAI;AAChB,OAAI,KAAK,CAAC,KAAK,IAAI,CAAC;;;AAIxB,MAAK,MAAM,CAAC,QAAQ,QAAS,OAAM,IAAI;AACvC,QAAO;;AAGT,eAAsB,UAAU,SAMd;CAChB,MAAM,eAAe,QAAQ;CAK7B,MAAM,MAAM,QAAQ;AACpB,KAAI,CAAC,IACH,OAAM,IAAI,MACR,8GAED;CAEH,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;AAGH,SAAQ,IAAI,0BAA0B,IAAI,KAAK;AAC/C,OAAM,QAAQ;EAAE;EAAK;EAAY,CAAC;CAElC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;AACzD,OAAM,eAAe,UAAU,eAAe,UAAU,iBAAiB,OAAU;AAEnF,KAAI;EAEJ,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;EACjD,MAAM,WAAW,eACb,QAAQ,QAAQ,CAAC,OAAO,MAAM,aAAa,GAC3C;AAEJ,MAAI,SAAS,WAAW,EACtB,OAAM,IAAI,MACR,eACI,WAAW,aAAa,eACxB,wBACL;EAGH,MAAM,UAAU,iCACd,UACA,QACA,QACA,IACD;AAED,OAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;GAC/C,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;GACD,MAAM,iBAAiB,uBAAuB,UAAU,OAAO,OAAO;AACtE,qBAAkB,SAAS,WAAW,gBAAgB,SAAS,gBAAgB;AAW/E,OAJoB,kBALF;IAChB;IACA,GAAG,sBAAsB,SAAS,gBAAgB;IAClD;IACD,EACgD;IAC/C,KAAK,SAAS;IACd,OAAO;IACR,CAAC,CACc,WAAW,EACzB,OAAM,IAAI,MAAM,6BAA6B,YAAY;GAG3D,MAAM,aACJ,SAAS,qBAAqB,QAAQ;GACxC,MAAM,aAAa;IACjB;IACA,GAAG,sBAAsB,SAAS,gBAAgB;IAClD;IACD;AACD,OAAI,WACF,YAAW,KAAK,wBAAwB,WAAW;AAOrD,OAJqB,kBAAkB,YAAY;IACjD,KAAK,SAAS;IACd,OAAO;IACR,CAAC,CACe,WAAW,EAC1B,OAAM,IAAI,MAAM,8BAA8B,YAAY;AAE5D,WAAQ,IAAI,YAAY,YAAY;;AAGtC,MAAI,QAAQ,QACV,KAAI;AACF,SAAM,kBACJ,KACA,QACA,SACA,WACA,QACA,OACA,KACA,EAAE,SAAS,CACZ;WACM,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,SAAM,IAAI,MAAM,4CAA4C,MAAM;;AAItE,QAAM,iBAAiB;AACvB,QAAM,MAAM,QAAQ,IAAI;AACxB,UAAQ,IAAI,4BAA4B,MAAM;UACrC,KAAK;AACZ,QAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,MAAI;AACF,SAAM,MAAM,QAAQ,IAAI;UAClB;AAGR,QAAM"}
+{"version":3,"file":"deploy-DAEjDjOm.mjs","names":["out: WorkerEntry[]"],"sources":["../src/cli/commands/deploy.ts"],"sourcesContent":["import type { CfiConfig, WorkerConfig } from \"../../types.js\";\nimport { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport { wranglerConfigCliArgs } from \"../../core/wrangler/wranglerOutFile.js\";\nimport { spawnWranglerSync } from \"../../core/wrangler/wranglerSpawn.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport {\n  buildIntraStackScriptNameMap,\n  mergedWorkerConfigForEnv,\n  resolveDeployedWorkerName,\n  resolveWorkerConfig,\n  rewriteIntraStackServiceTargets,\n} from \"../../core/config/resolver.js\";\nimport {\n  generateWranglerConfig,\n  writeWranglerJson,\n} from \"../../core/wrangler/generator.js\";\nimport { runSync } from \"./sync.js\";\nimport { workerRoutesApply } from \"../../features/worker-route/index.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\n\ntype WorkerEntry = [string, WorkerConfig];\n\n/**\n * Topologically sort workers by `services[].service` so that dependencies\n * deploy before dependents. Cloudflare rejects deploys that reference\n * service bindings to workers that don't yet exist on the account.\n * Cross-config dependencies (services not in this monorepo) are ignored.\n */\nexport function topoSortWorkersByServiceBindings(\n  workers: WorkerEntry[],\n  config: CfiConfig,\n  naming: NamingEngine,\n  env: string,\n): WorkerEntry[] {\n  const intraMap = buildIntraStackScriptNameMap(config, env, naming);\n  const scriptNameToKey = new Map<string, string>();\n  for (const [key, cfg] of workers) {\n    const name = resolveDeployedWorkerName(config, key, cfg, env, naming);\n    scriptNameToKey.set(name, key);\n  }\n\n  const byKey = new Map(workers);\n  const visited = new Set<string>();\n  const visiting = new Set<string>();\n  const out: WorkerEntry[] = [];\n\n  function visit(key: string): void {\n    if (visited.has(key)) return;\n    if (visiting.has(key)) return;\n    visiting.add(key);\n    const cfg = byKey.get(key);\n    if (cfg) {\n      const merged = rewriteIntraStackServiceTargets(\n        mergedWorkerConfigForEnv(cfg, env, config.tenant),\n        intraMap,\n      );\n      const deps = merged.services?.map((s) => s.service) ?? [];\n      for (const dep of deps) {\n        const depKey = scriptNameToKey.get(dep);\n        if (depKey && depKey !== key) visit(depKey);\n      }\n      visiting.delete(key);\n      visited.add(key);\n      out.push([key, cfg]);\n    }\n  }\n\n  for (const [key] of workers) visit(key);\n  return out;\n}\n\nexport async function runDeploy(options: {\n  worker?: string;\n  env?: string;\n  configPath?: string;\n  /** Passed to `wrangler deploy --dispatch-namespace` when the worker has no `dispatchNamespace` in config. */\n  dispatchNamespace?: string;\n}): Promise<void> {\n  const workerFilter = options.worker;\n  // `--env` is intentionally required (no silent default to \"prod\") to\n  // match every other Tamer command and to avoid the classic \"ran\n  // `tamer deploy` from the wrong shell, shipped a half-tested branch\n  // to production\" footgun.\n  const env = options.env;\n  if (!env) {\n    throw new Error(\n      \"deploy: --env is required (e.g. --env staging). \" +\n        \"Tamer no longer defaults to prod — pass the env explicitly.\",\n    );\n  }\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  console.log(`Syncing state for env: ${env}...`);\n  await runSync({ env, configPath });\n\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const imports = await fetchStackImports(api, config, env);\n  state.beginOperation(\"deploy\", workerFilter ? `worker:${workerFilter}` : undefined);\n\n  try {\n\n  const workers = await getWorkers(config, baseDir);\n  const toDeploy = workerFilter\n    ? workers.filter(([k]) => k === workerFilter)\n    : workers;\n\n  if (toDeploy.length === 0) {\n    throw new Error(\n      workerFilter\n        ? `Worker \"${workerFilter}\" not found`\n        : \"No workers configured\",\n    );\n  }\n\n  const ordered = topoSortWorkersByServiceBindings(\n    toDeploy,\n    config,\n    naming,\n    env,\n  );\n\n  for (const [workerKey, workerConfig] of ordered) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { imports },\n    );\n    const wranglerConfig = generateWranglerConfig(resolved, state, naming);\n    writeWranglerJson(resolved.workerDir, wranglerConfig, resolved.wranglerOutFile);\n\n    const typesArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n      \"types\",\n    ];\n    const typesResult = spawnWranglerSync(typesArgs, {\n      cwd: resolved.workerDir,\n      stdio: \"inherit\",\n    });\n    if (typesResult.status !== 0) {\n      throw new Error(`wrangler types failed for ${workerKey}`);\n    }\n\n    const dispatchNs =\n      resolved.dispatchNamespace ?? options.dispatchNamespace;\n    const deployArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n      \"deploy\",\n    ];\n    if (dispatchNs) {\n      deployArgs.push(\"--dispatch-namespace\", dispatchNs);\n    }\n\n    const deployResult = spawnWranglerSync(deployArgs, {\n      cwd: resolved.workerDir,\n      stdio: \"inherit\",\n    });\n    if (deployResult.status !== 0) {\n      throw new Error(`wrangler deploy failed for ${workerKey}`);\n    }\n    console.log(`Deployed ${workerKey}`);\n  }\n\n  if (env !== \"local\") {\n    try {\n      await workerRoutesApply(\n        env,\n        config,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        api,\n        { imports },\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      throw new Error(`worker routes apply failed after deploy: ${msg}`);\n    }\n  }\n\n  state.finishOperation();\n  await state.persist(api);\n  console.log(`Deploy complete for env: ${env}`);\n  } catch (err) {\n    state.failOperation(err instanceof Error ? err.message : String(err));\n    try {\n      await state.persist(api);\n    } catch {\n      /* swallow secondary persist failure */\n    }\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiCA,SAAgB,iCACd,SACA,QACA,QACA,KACe;CACf,MAAM,WAAW,6BAA6B,QAAQ,KAAK,OAAO;CAClE,MAAM,kCAAkB,IAAI,KAAqB;AACjD,MAAK,MAAM,CAAC,KAAK,QAAQ,SAAS;EAChC,MAAM,OAAO,0BAA0B,QAAQ,KAAK,KAAK,KAAK,OAAO;AACrE,kBAAgB,IAAI,MAAM,IAAI;;CAGhC,MAAM,QAAQ,IAAI,IAAI,QAAQ;CAC9B,MAAM,0BAAU,IAAI,KAAa;CACjC,MAAM,2BAAW,IAAI,KAAa;CAClC,MAAMA,MAAqB,EAAE;CAE7B,SAAS,MAAM,KAAmB;AAChC,MAAI,QAAQ,IAAI,IAAI,CAAE;AACtB,MAAI,SAAS,IAAI,IAAI,CAAE;AACvB,WAAS,IAAI,IAAI;EACjB,MAAM,MAAM,MAAM,IAAI,IAAI;AAC1B,MAAI,KAAK;GAKP,MAAM,OAJS,gCACb,yBAAyB,KAAK,KAAK,OAAO,OAAO,EACjD,SACD,CACmB,UAAU,KAAK,MAAM,EAAE,QAAQ,IAAI,EAAE;AACzD,QAAK,MAAM,OAAO,MAAM;IACtB,MAAM,SAAS,gBAAgB,IAAI,IAAI;AACvC,QAAI,UAAU,WAAW,IAAK,OAAM,OAAO;;AAE7C,YAAS,OAAO,IAAI;AACpB,WAAQ,IAAI,IAAI;AAChB,OAAI,KAAK,CAAC,KAAK,IAAI,CAAC;;;AAIxB,MAAK,MAAM,CAAC,QAAQ,QAAS,OAAM,IAAI;AACvC,QAAO;;AAGT,eAAsB,UAAU,SAMd;CAChB,MAAM,eAAe,QAAQ;CAK7B,MAAM,MAAM,QAAQ;AACpB,KAAI,CAAC,IACH,OAAM,IAAI,MACR,8GAED;CAEH,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;AAGH,SAAQ,IAAI,0BAA0B,IAAI,KAAK;AAC/C,OAAM,QAAQ;EAAE;EAAK;EAAY,CAAC;CAElC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;AACzD,OAAM,eAAe,UAAU,eAAe,UAAU,iBAAiB,OAAU;AAEnF,KAAI;EAEJ,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;EACjD,MAAM,WAAW,eACb,QAAQ,QAAQ,CAAC,OAAO,MAAM,aAAa,GAC3C;AAEJ,MAAI,SAAS,WAAW,EACtB,OAAM,IAAI,MACR,eACI,WAAW,aAAa,eACxB,wBACL;EAGH,MAAM,UAAU,iCACd,UACA,QACA,QACA,IACD;AAED,OAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;GAC/C,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;GACD,MAAM,iBAAiB,uBAAuB,UAAU,OAAO,OAAO;AACtE,qBAAkB,SAAS,WAAW,gBAAgB,SAAS,gBAAgB;AAW/E,OAJoB,kBALF;IAChB;IACA,GAAG,sBAAsB,SAAS,gBAAgB;IAClD;IACD,EACgD;IAC/C,KAAK,SAAS;IACd,OAAO;IACR,CAAC,CACc,WAAW,EACzB,OAAM,IAAI,MAAM,6BAA6B,YAAY;GAG3D,MAAM,aACJ,SAAS,qBAAqB,QAAQ;GACxC,MAAM,aAAa;IACjB;IACA,GAAG,sBAAsB,SAAS,gBAAgB;IAClD;IACD;AACD,OAAI,WACF,YAAW,KAAK,wBAAwB,WAAW;AAOrD,OAJqB,kBAAkB,YAAY;IACjD,KAAK,SAAS;IACd,OAAO;IACR,CAAC,CACe,WAAW,EAC1B,OAAM,IAAI,MAAM,8BAA8B,YAAY;AAE5D,WAAQ,IAAI,YAAY,YAAY;;AAGtC,MAAI,QAAQ,QACV,KAAI;AACF,SAAM,kBACJ,KACA,QACA,SACA,WACA,QACA,OACA,KACA,EAAE,SAAS,CACZ;WACM,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,SAAM,IAAI,MAAM,4CAA4C,MAAM;;AAItE,QAAM,iBAAiB;AACvB,QAAM,MAAM,QAAQ,IAAI;AACxB,UAAQ,IAAI,4BAA4B,MAAM;UACrC,KAAK;AACZ,QAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,MAAI;AACF,SAAM,MAAM,QAAQ,IAAI;UAClB;AAGR,QAAM"}

package/dist/{destroy-DzgA4lCA.mjs → destroy-DtgPD_bD.mjs}

@@ -1,16 +1,16 @@
 import { f as getDispatchNamespaces, p as getDnsRecords } from "./normalize-DVSTRZhO.mjs";
-import { n as loadConfig, t as getWorkers } from "./loader-DAvCKLTT.mjs";
+import { n as loadConfig, t as getWorkers } from "./loader-DnT9iqz9.mjs";
 import { n as cloudflareAccountIdFromEnv, t as CFApiClient } from "./CFApiClient-DhbyyV71.mjs";
-import { _ as namingFromConfig, a as resourceModules, o as logicalNamesForResourceKind } from "./fetchStackImports-C-1THPYL.mjs";
-import { f as stackNameForConfig, l as destroyTamerStateDatabase, s as isEphemeralEnv, t as StateManager } from "./StateManager-DTqtLLVX.mjs";
+import { a as resourceModules, s as logicalNamesForResourceKind, v as namingFromConfig } from "./fetchStackImports-ClUYZy_U.mjs";
+import { f as stackNameForConfig, l as destroyTamerStateDatabase, s as isEphemeralEnv, t as StateManager } from "./StateManager-JLBtz9V-.mjs";
 import "./r2S3EmptyBucket-DD81ZWQ7.mjs";
 import { n as logpushJobDestroy } from "./logpush-job-DsRkOORJ.mjs";
-import { n as workerRoutesDestroy } from "./worker-route-CMbtozNa.mjs";
-import { runSync } from "./sync-B_pyPi7Z.mjs";
-import { i as hashCloudflareSnapshot, t as buildCloudflareSnapshot } from "./cloudflareSnapshot-DzPuCRTh.mjs";
-import { t as verifyPlanFile } from "./verifyPlanFile-ah_4tvTu.mjs";
+import { n as workerRoutesDestroy } from "./worker-route-DY1onr-h.mjs";
+import { runSync } from "./sync-BdJ43vO7.mjs";
+import { i as hashCloudflareSnapshot, t as buildCloudflareSnapshot } from "./cloudflareSnapshot-GBUHeg2m.mjs";
+import { t as verifyPlanFile } from "./verifyPlanFile-BQ7GCDC2.mjs";
 import { t as destroyTamerArtifactsBucket } from "./tamerArtifactsR2-Ccgplu2Q.mjs";
-import { n as workersDestroy } from "./workers-C-oeZhdD.mjs";
+import { n as workersDestroy } from "./workers-DNKsZOq4.mjs";
 
 //#region src/features/dispatch-namespace/dispatch-namespace.destroy.ts
 /**
@@ -212,4 +212,4 @@ async function runDestroy(options) {
 
 //#endregion
 export { runDestroy };
-//# sourceMappingURL=destroy-DzgA4lCA.mjs.map
+//# sourceMappingURL=destroy-DtgPD_bD.mjs.map

package/dist/{destroy-DzgA4lCA.mjs.map → destroy-DtgPD_bD.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"destroy-DzgA4lCA.mjs","names":[],"sources":["../src/features/dispatch-namespace/dispatch-namespace.destroy.ts","../src/features/dns-records/dns-records.destroy.ts","../src/cli/destroyGuard.ts","../src/cli/commands/destroy.ts"],"sourcesContent":["import type { CfiConfig } from \"../../types.js\";\nimport { getDispatchNamespaces } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { DispatchNamespaceStateEntry } from \"../../types.js\";\nimport { isEphemeralEnv } from \"./dispatch-namespace.resolve.js\";\n\n/**\n * Tear down every dispatch namespace recorded in state.\n *\n * Cloudflare refuses to delete a namespace that still contains scripts, so we\n * enumerate `/dispatch/namespaces/{ns}/scripts` and delete each (with `force`\n * so dependents like service-bind targets don't block the removal). This\n * covers tenant scripts uploaded by `tamer wfp put` / `provision-workflow`\n * that aren't otherwise tracked in Tamer state.\n */\nexport async function dispatchNamespaceDestroy(\n  env: string,\n  state: StateManager,\n  api: CFApiClient,\n  config: CfiConfig,\n  _force?: boolean,\n): Promise<void> {\n  const allowedLogical = new Set(\n    getDispatchNamespaces(config).map((d) => d.logicalName),\n  );\n  if (allowedLogical.size === 0) return;\n\n  for (const [key, entry] of Object.entries(state.getAll())) {\n    if (entry.type !== \"dispatch_namespace\") continue;\n    const ns = entry as DispatchNamespaceStateEntry;\n    if (!allowedLogical.has(ns.logicalName)) continue;\n    const isSharedEphemeral = ns.derivedName.endsWith(\"-ephemeral\");\n    try {\n      const scripts = await api.dispatchNamespaceScriptList(ns.derivedName);\n      for (const s of scripts) {\n        if (isEphemeralEnv(env, config.tenant) && isSharedEphemeral) {\n          if (!s.id.endsWith(`-${env}`)) continue;\n        }\n        try {\n          await api.dispatchNamespaceScriptDelete(ns.derivedName, s.id, {\n            force: true,\n          });\n          console.log(\n            `Deleted tenant script \"${s.id}\" from namespace ${ns.derivedName}.`,\n          );\n        } catch (err) {\n          console.warn(\n            `Failed to delete tenant script ${s.id} in ${ns.derivedName}:`,\n            err instanceof Error ? err.message : err,\n          );\n        }\n      }\n      if (isEphemeralEnv(env, config.tenant) && isSharedEphemeral) {\n        console.log(\n          `Left shared dispatch namespace ${ns.derivedName} (removed only scripts suffixed -${env}).`,\n        );\n        continue;\n      }\n      await api.dispatchNamespaceDelete(ns.derivedName);\n      state.delete(key);\n    } catch (err) {\n      console.warn(\n        `Failed to delete dispatch namespace ${ns.derivedName}:`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n  }\n}\n","import type { CfiConfig, DnsRecordStateEntry } from \"../../types.js\";\nimport { getDnsRecords } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\n\n/**\n * Tear down every DNS record this stack owns. Restricted to records\n * whose `logicalName` is declared in the current `CfiConfig.dnsRecords`\n * (matches `runDestroy` semantics for shared state rows). Records flagged\n * `preserveOnDestroy: true` are left in place but still dropped from\n * state — the operator is responsible for re-importing them later.\n */\nexport async function dnsRecordDestroy(\n  env: string,\n  state: StateManager,\n  api: CFApiClient,\n  config: CfiConfig,\n  _force?: boolean,\n): Promise<void> {\n  if (env === \"local\") return;\n  const declared = getDnsRecords(config);\n  if (declared.length === 0) return;\n  const preserve = new Map<string, boolean>(\n    declared.map((c) => [c.logicalName, !!c.preserveOnDestroy]),\n  );\n  const allowedLogical = new Set(declared.map((c) => c.logicalName));\n\n  for (const [key, entry] of Object.entries(state.getAll())) {\n    if (entry.type !== \"dns_record\") continue;\n    const rec = entry as DnsRecordStateEntry;\n    if (!allowedLogical.has(rec.logicalName)) continue;\n    if (preserve.get(rec.logicalName)) {\n      console.log(\n        `Preserved DNS record ${rec.recordType} ${rec.name} (preserveOnDestroy).`,\n      );\n      state.delete(key);\n      continue;\n    }\n    try {\n      await api.zoneDnsRecordDelete(rec.zoneId, rec.recordId);\n      state.delete(key);\n    } catch (err) {\n      console.warn(\n        `Failed to delete DNS record ${rec.recordType} ${rec.name}:`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n  }\n}\n","/** Shared envs where destroy must be confirmed with `--confirm-env <same>`. */\nexport const SHARED_ENV_DESTROY = [\n  \"dev\",\n  \"staging\",\n  \"prod\",\n  \"production\",\n] as const;\n\n/**\n * @param force When true, skips the typed confirmation (break-glass).\n */\nexport function assertDestroyEnvAllowed(\n  env: string,\n  force: boolean,\n  confirmEnv?: string,\n): void {\n  if (force) return;\n  if (!SHARED_ENV_DESTROY.includes(env as (typeof SHARED_ENV_DESTROY)[number])) {\n    return;\n  }\n  if (confirmEnv !== env) {\n    throw new Error(\n      `Destroying shared environment \"${env}\" requires --confirm-env ${env}`,\n    );\n  }\n}\n","import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { logicalNamesForResourceKind } from \"../../core/config/resourcesFromConfig.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { destroyTamerStateDatabase } from \"../../core/state/tamerStateDb.js\";\nimport { destroyTamerArtifactsBucket } from \"../../core/state/tamerArtifactsR2.js\";\nimport { getDispatchNamespaces, getDnsRecords } from \"../../types.js\";\nimport { logpushJobDestroy } from \"../../features/logpush-job/index.js\";\nimport { assertDestroyEnvAllowed } from \"../destroyGuard.js\";\nimport { dispatchNamespaceDestroy } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordDestroy } from \"../../features/dns-records/index.js\";\nimport { workersDestroy } from \"../../features/workers/index.js\";\nimport { workerRoutesDestroy } from \"../../features/worker-route/index.js\";\nimport { runSync } from \"./sync.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { verifyPlanFile } from \"../../core/plan/verifyPlanFile.js\";\nimport { hashCloudflareSnapshot } from \"../../core/plan/planFile.js\";\nimport { buildCloudflareSnapshot } from \"../../core/plan/cloudflareSnapshot.js\";\n\nexport async function runDestroy(options: {\n  env: string;\n  force?: boolean;\n  skipWorkers?: boolean;\n  confirmEnv?: string;\n  configPath?: string;\n  /** When true, delete the shared `tamer-state-{env}` D1 after other resources (use on last stack teardown). */\n  wipeMetadata?: boolean;\n  /**\n   * Path to a destroy plan file from `tamer plan --destroy --out`. Destroy\n   * recomputes the `(config, state, cloudflare)` attestation hashes and\n   * refuses to proceed if any drifted (override with `allowStale`). The\n   * pinned plan ensures the operator destroys exactly what they reviewed.\n   */\n  planFile?: string;\n  allowStale?: boolean;\n}): Promise<void> {\n  const {\n    env,\n    force = false,\n    skipWorkers = false,\n    confirmEnv,\n    configPath,\n    wipeMetadata = false,\n  } = options;\n  const baseDir = process.cwd();\n\n  assertDestroyEnvAllowed(env, force, confirmEnv);\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  if (options.planFile) {\n    const verifyApi = new CFApiClient(accountId);\n    const verifyState = new StateManager(\n      config.tenant.id,\n      env,\n      stackNameForConfig(config),\n    );\n    await verifyState.hydrate(verifyApi);\n    const liveSnapshot =\n      env === \"local\"\n        ? undefined\n        : await buildCloudflareSnapshot({\n            config,\n            env,\n            api: verifyApi,\n            baseDir,\n          });\n    verifyPlanFile({\n      planPath: options.planFile,\n      command: \"destroy\",\n      expectedMode: \"destroy\",\n      env,\n      tenantId: config.tenant.id,\n      config,\n      stateAtPlanCheck: verifyState.load(),\n      liveCloudflareHash: liveSnapshot\n        ? hashCloudflareSnapshot(liveSnapshot)\n        : undefined,\n      allowStale: !!options.allowStale,\n    });\n  }\n\n  if (env !== \"local\") {\n    console.log(`Syncing state from Cloudflare for env: ${env}...`);\n    await runSync({ env, configPath });\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  state.beginOperation(\"destroy\", wipeMetadata ? \"wipe-metadata\" : undefined);\n  try {\n    await state.persist(api);\n  } catch {\n    /* in-progress marker best-effort */\n  }\n\n  try {\n    if (!skipWorkers) {\n      await workerRoutesDestroy(env, config, baseDir, state, api);\n      await state.persist(api);\n      await workersDestroy(env, baseDir, accountId, config, state, api, force);\n    }\n\n    const ownedByKind = await Promise.all(\n      resourceModules.map((m) =>\n        logicalNamesForResourceKind(config, baseDir, m.kind).then((set) => ({\n          mod: m,\n          owned: set,\n        })),\n      ),\n    );\n    const workers = await getWorkers(config, baseDir);\n\n    // Always run Logpush + Pipelines teardown: state may still hold\n    // `logpush_pipelines` even if logpush was removed from tamer.config.ts,\n    // and destroy must still delete the Pipelines stream/sink in that case.\n    await logpushJobDestroy(env, state, api, config);\n    await state.persist(api);\n\n    for (const { mod, owned } of ownedByKind) {\n      if (owned.size === 0) continue;\n      // Aggregate this kind's resources across all workers in the config — the\n      // destroy hook only needs them for stack-scope filtering and may walk\n      // state directly. Empty array is acceptable when state holds entries\n      // owned by another stack we still want to filter against `owned`.\n      const resources = workers.flatMap(([, wc]) => mod.pickResources(wc));\n      await mod.destroy({\n        resources,\n        tenant: config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n        force,\n      });\n    }\n\n    if (getDispatchNamespaces(config).length > 0) {\n      await dispatchNamespaceDestroy(env, state, api, config, force);\n    }\n\n    if (getDnsRecords(config).length > 0) {\n      await dnsRecordDestroy(env, state, api, config, force);\n    }\n\n    // Clear `stackOutputs` after every successful destroy — the values\n    // pointed at resources we just deleted, so leaving them in state would\n    // mislead a future `tamer status` and (post-imports) leak dangling\n    // refs into sibling stacks. The state row itself is dropped further\n    // below when `wipeMetadata` is set.\n    state.replaceStackOutputs({});\n\n    if (env !== \"local\" && wipeMetadata) {\n      const deletedDb = await destroyTamerStateDatabase(api, env);\n      if (deletedDb) {\n        console.log(`Deleted Tamer metadata database tamer-state-${env}.`);\n      }\n      try {\n        const deletedBucket = await destroyTamerArtifactsBucket(api, env);\n        if (deletedBucket) {\n          console.log(\n            `Deleted Tamer artifacts bucket tamer-artifacts-${env}.`,\n          );\n        }\n      } catch (err) {\n        console.warn(\n          `Failed to delete Tamer artifacts bucket tamer-artifacts-${env} (likely non-empty; remove objects and re-run with --wipe-metadata):`,\n          err instanceof Error ? err.message : err,\n        );\n      }\n    }\n\n    if (env !== \"local\" && !wipeMetadata) {\n      state.finishOperation();\n      try {\n        await state.persist(api);\n      } catch {\n        /* state row may have been wiped by sub-steps */\n      }\n    }\n    state.clearDirty();\n    console.log(`Destroyed all resources for env: ${env}`);\n  } catch (err) {\n    if (env !== \"local\") {\n      state.failOperation(err instanceof Error ? err.message : String(err));\n      try {\n        await state.persist(api);\n      } catch {\n        /* swallow secondary persist failure */\n      }\n    }\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgBA,eAAsB,yBACpB,KACA,OACA,KACA,QACA,QACe;CACf,MAAM,iBAAiB,IAAI,IACzB,sBAAsB,OAAO,CAAC,KAAK,MAAM,EAAE,YAAY,CACxD;AACD,KAAI,eAAe,SAAS,EAAG;AAE/B,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACzD,MAAI,MAAM,SAAS,qBAAsB;EACzC,MAAM,KAAK;AACX,MAAI,CAAC,eAAe,IAAI,GAAG,YAAY,CAAE;EACzC,MAAM,oBAAoB,GAAG,YAAY,SAAS,aAAa;AAC/D,MAAI;GACF,MAAM,UAAU,MAAM,IAAI,4BAA4B,GAAG,YAAY;AACrE,QAAK,MAAM,KAAK,SAAS;AACvB,QAAI,eAAe,KAAK,OAAO,OAAO,IAAI,mBACxC;SAAI,CAAC,EAAE,GAAG,SAAS,IAAI,MAAM,CAAE;;AAEjC,QAAI;AACF,WAAM,IAAI,8BAA8B,GAAG,aAAa,EAAE,IAAI,EAC5D,OAAO,MACR,CAAC;AACF,aAAQ,IACN,0BAA0B,EAAE,GAAG,mBAAmB,GAAG,YAAY,GAClE;aACM,KAAK;AACZ,aAAQ,KACN,kCAAkC,EAAE,GAAG,MAAM,GAAG,YAAY,IAC5D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;AAGL,OAAI,eAAe,KAAK,OAAO,OAAO,IAAI,mBAAmB;AAC3D,YAAQ,IACN,kCAAkC,GAAG,YAAY,mCAAmC,IAAI,IACzF;AACD;;AAEF,SAAM,IAAI,wBAAwB,GAAG,YAAY;AACjD,SAAM,OAAO,IAAI;WACV,KAAK;AACZ,WAAQ,KACN,uCAAuC,GAAG,YAAY,IACtD,eAAe,QAAQ,IAAI,UAAU,IACtC;;;;;;;;;;;;;;ACrDP,eAAsB,iBACpB,KACA,OACA,KACA,QACA,QACe;AACf,KAAI,QAAQ,QAAS;CACrB,MAAM,WAAW,cAAc,OAAO;AACtC,KAAI,SAAS,WAAW,EAAG;CAC3B,MAAM,WAAW,IAAI,IACnB,SAAS,KAAK,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAC5D;CACD,MAAM,iBAAiB,IAAI,IAAI,SAAS,KAAK,MAAM,EAAE,YAAY,CAAC;AAElE,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACzD,MAAI,MAAM,SAAS,aAAc;EACjC,MAAM,MAAM;AACZ,MAAI,CAAC,eAAe,IAAI,IAAI,YAAY,CAAE;AAC1C,MAAI,SAAS,IAAI,IAAI,YAAY,EAAE;AACjC,WAAQ,IACN,wBAAwB,IAAI,WAAW,GAAG,IAAI,KAAK,uBACpD;AACD,SAAM,OAAO,IAAI;AACjB;;AAEF,MAAI;AACF,SAAM,IAAI,oBAAoB,IAAI,QAAQ,IAAI,SAAS;AACvD,SAAM,OAAO,IAAI;WACV,KAAK;AACZ,WAAQ,KACN,+BAA+B,IAAI,WAAW,GAAG,IAAI,KAAK,IAC1D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;;;;;;AC5CP,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACD;;;;AAKD,SAAgB,wBACd,KACA,OACA,YACM;AACN,KAAI,MAAO;AACX,KAAI,CAAC,mBAAmB,SAAS,IAA2C,CAC1E;AAEF,KAAI,eAAe,IACjB,OAAM,IAAI,MACR,kCAAkC,IAAI,2BAA2B,MAClE;;;;;ACDL,eAAsB,WAAW,SAgBf;CAChB,MAAM,EACJ,KACA,QAAQ,OACR,cAAc,OACd,YACA,YACA,eAAe,UACb;CACJ,MAAM,UAAU,QAAQ,KAAK;AAE7B,yBAAwB,KAAK,OAAO,WAAW;CAE/C,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;AAGH,KAAI,QAAQ,UAAU;EACpB,MAAM,YAAY,IAAI,YAAY,UAAU;EAC5C,MAAM,cAAc,IAAI,aACtB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,QAAM,YAAY,QAAQ,UAAU;EACpC,MAAM,eACJ,QAAQ,UACJ,SACA,MAAM,wBAAwB;GAC5B;GACA;GACA,KAAK;GACL;GACD,CAAC;AACR,iBAAe;GACb,UAAU,QAAQ;GAClB,SAAS;GACT,cAAc;GACd;GACA,UAAU,OAAO,OAAO;GACxB;GACA,kBAAkB,YAAY,MAAM;GACpC,oBAAoB,eAChB,uBAAuB,aAAa,GACpC;GACJ,YAAY,CAAC,CAAC,QAAQ;GACvB,CAAC;;AAGJ,KAAI,QAAQ,SAAS;AACnB,UAAQ,IAAI,0CAA0C,IAAI,KAAK;AAC/D,QAAM,QAAQ;GAAE;GAAK;GAAY,CAAC;;CAGpC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;AACxB,OAAM,eAAe,WAAW,eAAe,kBAAkB,OAAU;AAC3E,KAAI;AACF,QAAM,MAAM,QAAQ,IAAI;SAClB;AAIR,KAAI;AACF,MAAI,CAAC,aAAa;AAChB,SAAM,oBAAoB,KAAK,QAAQ,SAAS,OAAO,IAAI;AAC3D,SAAM,MAAM,QAAQ,IAAI;AACxB,SAAM,eAAe,KAAK,SAAS,WAAW,QAAQ,OAAO,KAAK,MAAM;;EAG1E,MAAM,cAAc,MAAM,QAAQ,IAChC,gBAAgB,KAAK,MACnB,4BAA4B,QAAQ,SAAS,EAAE,KAAK,CAAC,MAAM,SAAS;GAClE,KAAK;GACL,OAAO;GACR,EAAE,CACJ,CACF;EACD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AAKjD,QAAM,kBAAkB,KAAK,OAAO,KAAK,OAAO;AAChD,QAAM,MAAM,QAAQ,IAAI;AAExB,OAAK,MAAM,EAAE,KAAK,WAAW,aAAa;AACxC,OAAI,MAAM,SAAS,EAAG;GAKtB,MAAM,YAAY,QAAQ,SAAS,GAAG,QAAQ,IAAI,cAAc,GAAG,CAAC;AACpE,SAAM,IAAI,QAAQ;IAChB;IACA,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;;AAGJ,MAAI,sBAAsB,OAAO,CAAC,SAAS,EACzC,OAAM,yBAAyB,KAAK,OAAO,KAAK,QAAQ,MAAM;AAGhE,MAAI,cAAc,OAAO,CAAC,SAAS,EACjC,OAAM,iBAAiB,KAAK,OAAO,KAAK,QAAQ,MAAM;AAQxD,QAAM,oBAAoB,EAAE,CAAC;AAE7B,MAAI,QAAQ,WAAW,cAAc;AAEnC,OADkB,MAAM,0BAA0B,KAAK,IAAI,CAEzD,SAAQ,IAAI,+CAA+C,IAAI,GAAG;AAEpE,OAAI;AAEF,QADsB,MAAM,4BAA4B,KAAK,IAAI,CAE/D,SAAQ,IACN,kDAAkD,IAAI,GACvD;YAEI,KAAK;AACZ,YAAQ,KACN,2DAA2D,IAAI,uEAC/D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;AAIL,MAAI,QAAQ,WAAW,CAAC,cAAc;AACpC,SAAM,iBAAiB;AACvB,OAAI;AACF,UAAM,MAAM,QAAQ,IAAI;WAClB;;AAIV,QAAM,YAAY;AAClB,UAAQ,IAAI,oCAAoC,MAAM;UAC/C,KAAK;AACZ,MAAI,QAAQ,SAAS;AACnB,SAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,OAAI;AACF,UAAM,MAAM,QAAQ,IAAI;WAClB;;AAIV,QAAM"}
+{"version":3,"file":"destroy-DtgPD_bD.mjs","names":[],"sources":["../src/features/dispatch-namespace/dispatch-namespace.destroy.ts","../src/features/dns-records/dns-records.destroy.ts","../src/cli/destroyGuard.ts","../src/cli/commands/destroy.ts"],"sourcesContent":["import type { CfiConfig } from \"../../types.js\";\nimport { getDispatchNamespaces } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { DispatchNamespaceStateEntry } from \"../../types.js\";\nimport { isEphemeralEnv } from \"./dispatch-namespace.resolve.js\";\n\n/**\n * Tear down every dispatch namespace recorded in state.\n *\n * Cloudflare refuses to delete a namespace that still contains scripts, so we\n * enumerate `/dispatch/namespaces/{ns}/scripts` and delete each (with `force`\n * so dependents like service-bind targets don't block the removal). This\n * covers tenant scripts uploaded by `tamer wfp put` / `provision-workflow`\n * that aren't otherwise tracked in Tamer state.\n */\nexport async function dispatchNamespaceDestroy(\n  env: string,\n  state: StateManager,\n  api: CFApiClient,\n  config: CfiConfig,\n  _force?: boolean,\n): Promise<void> {\n  const allowedLogical = new Set(\n    getDispatchNamespaces(config).map((d) => d.logicalName),\n  );\n  if (allowedLogical.size === 0) return;\n\n  for (const [key, entry] of Object.entries(state.getAll())) {\n    if (entry.type !== \"dispatch_namespace\") continue;\n    const ns = entry as DispatchNamespaceStateEntry;\n    if (!allowedLogical.has(ns.logicalName)) continue;\n    const isSharedEphemeral = ns.derivedName.endsWith(\"-ephemeral\");\n    try {\n      const scripts = await api.dispatchNamespaceScriptList(ns.derivedName);\n      for (const s of scripts) {\n        if (isEphemeralEnv(env, config.tenant) && isSharedEphemeral) {\n          if (!s.id.endsWith(`-${env}`)) continue;\n        }\n        try {\n          await api.dispatchNamespaceScriptDelete(ns.derivedName, s.id, {\n            force: true,\n          });\n          console.log(\n            `Deleted tenant script \"${s.id}\" from namespace ${ns.derivedName}.`,\n          );\n        } catch (err) {\n          console.warn(\n            `Failed to delete tenant script ${s.id} in ${ns.derivedName}:`,\n            err instanceof Error ? err.message : err,\n          );\n        }\n      }\n      if (isEphemeralEnv(env, config.tenant) && isSharedEphemeral) {\n        console.log(\n          `Left shared dispatch namespace ${ns.derivedName} (removed only scripts suffixed -${env}).`,\n        );\n        continue;\n      }\n      await api.dispatchNamespaceDelete(ns.derivedName);\n      state.delete(key);\n    } catch (err) {\n      console.warn(\n        `Failed to delete dispatch namespace ${ns.derivedName}:`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n  }\n}\n","import type { CfiConfig, DnsRecordStateEntry } from \"../../types.js\";\nimport { getDnsRecords } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\n\n/**\n * Tear down every DNS record this stack owns. Restricted to records\n * whose `logicalName` is declared in the current `CfiConfig.dnsRecords`\n * (matches `runDestroy` semantics for shared state rows). Records flagged\n * `preserveOnDestroy: true` are left in place but still dropped from\n * state — the operator is responsible for re-importing them later.\n */\nexport async function dnsRecordDestroy(\n  env: string,\n  state: StateManager,\n  api: CFApiClient,\n  config: CfiConfig,\n  _force?: boolean,\n): Promise<void> {\n  if (env === \"local\") return;\n  const declared = getDnsRecords(config);\n  if (declared.length === 0) return;\n  const preserve = new Map<string, boolean>(\n    declared.map((c) => [c.logicalName, !!c.preserveOnDestroy]),\n  );\n  const allowedLogical = new Set(declared.map((c) => c.logicalName));\n\n  for (const [key, entry] of Object.entries(state.getAll())) {\n    if (entry.type !== \"dns_record\") continue;\n    const rec = entry as DnsRecordStateEntry;\n    if (!allowedLogical.has(rec.logicalName)) continue;\n    if (preserve.get(rec.logicalName)) {\n      console.log(\n        `Preserved DNS record ${rec.recordType} ${rec.name} (preserveOnDestroy).`,\n      );\n      state.delete(key);\n      continue;\n    }\n    try {\n      await api.zoneDnsRecordDelete(rec.zoneId, rec.recordId);\n      state.delete(key);\n    } catch (err) {\n      console.warn(\n        `Failed to delete DNS record ${rec.recordType} ${rec.name}:`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n  }\n}\n","/** Shared envs where destroy must be confirmed with `--confirm-env <same>`. */\nexport const SHARED_ENV_DESTROY = [\n  \"dev\",\n  \"staging\",\n  \"prod\",\n  \"production\",\n] as const;\n\n/**\n * @param force When true, skips the typed confirmation (break-glass).\n */\nexport function assertDestroyEnvAllowed(\n  env: string,\n  force: boolean,\n  confirmEnv?: string,\n): void {\n  if (force) return;\n  if (!SHARED_ENV_DESTROY.includes(env as (typeof SHARED_ENV_DESTROY)[number])) {\n    return;\n  }\n  if (confirmEnv !== env) {\n    throw new Error(\n      `Destroying shared environment \"${env}\" requires --confirm-env ${env}`,\n    );\n  }\n}\n","import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { logicalNamesForResourceKind } from \"../../core/config/resourcesFromConfig.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { destroyTamerStateDatabase } from \"../../core/state/tamerStateDb.js\";\nimport { destroyTamerArtifactsBucket } from \"../../core/state/tamerArtifactsR2.js\";\nimport { getDispatchNamespaces, getDnsRecords } from \"../../types.js\";\nimport { logpushJobDestroy } from \"../../features/logpush-job/index.js\";\nimport { assertDestroyEnvAllowed } from \"../destroyGuard.js\";\nimport { dispatchNamespaceDestroy } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordDestroy } from \"../../features/dns-records/index.js\";\nimport { workersDestroy } from \"../../features/workers/index.js\";\nimport { workerRoutesDestroy } from \"../../features/worker-route/index.js\";\nimport { runSync } from \"./sync.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { verifyPlanFile } from \"../../core/plan/verifyPlanFile.js\";\nimport { hashCloudflareSnapshot } from \"../../core/plan/planFile.js\";\nimport { buildCloudflareSnapshot } from \"../../core/plan/cloudflareSnapshot.js\";\n\nexport async function runDestroy(options: {\n  env: string;\n  force?: boolean;\n  skipWorkers?: boolean;\n  confirmEnv?: string;\n  configPath?: string;\n  /** When true, delete the shared `tamer-state-{env}` D1 after other resources (use on last stack teardown). */\n  wipeMetadata?: boolean;\n  /**\n   * Path to a destroy plan file from `tamer plan --destroy --out`. Destroy\n   * recomputes the `(config, state, cloudflare)` attestation hashes and\n   * refuses to proceed if any drifted (override with `allowStale`). The\n   * pinned plan ensures the operator destroys exactly what they reviewed.\n   */\n  planFile?: string;\n  allowStale?: boolean;\n}): Promise<void> {\n  const {\n    env,\n    force = false,\n    skipWorkers = false,\n    confirmEnv,\n    configPath,\n    wipeMetadata = false,\n  } = options;\n  const baseDir = process.cwd();\n\n  assertDestroyEnvAllowed(env, force, confirmEnv);\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  if (options.planFile) {\n    const verifyApi = new CFApiClient(accountId);\n    const verifyState = new StateManager(\n      config.tenant.id,\n      env,\n      stackNameForConfig(config),\n    );\n    await verifyState.hydrate(verifyApi);\n    const liveSnapshot =\n      env === \"local\"\n        ? undefined\n        : await buildCloudflareSnapshot({\n            config,\n            env,\n            api: verifyApi,\n            baseDir,\n          });\n    verifyPlanFile({\n      planPath: options.planFile,\n      command: \"destroy\",\n      expectedMode: \"destroy\",\n      env,\n      tenantId: config.tenant.id,\n      config,\n      stateAtPlanCheck: verifyState.load(),\n      liveCloudflareHash: liveSnapshot\n        ? hashCloudflareSnapshot(liveSnapshot)\n        : undefined,\n      allowStale: !!options.allowStale,\n    });\n  }\n\n  if (env !== \"local\") {\n    console.log(`Syncing state from Cloudflare for env: ${env}...`);\n    await runSync({ env, configPath });\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  state.beginOperation(\"destroy\", wipeMetadata ? \"wipe-metadata\" : undefined);\n  try {\n    await state.persist(api);\n  } catch {\n    /* in-progress marker best-effort */\n  }\n\n  try {\n    if (!skipWorkers) {\n      await workerRoutesDestroy(env, config, baseDir, state, api);\n      await state.persist(api);\n      await workersDestroy(env, baseDir, accountId, config, state, api, force);\n    }\n\n    const ownedByKind = await Promise.all(\n      resourceModules.map((m) =>\n        logicalNamesForResourceKind(config, baseDir, m.kind).then((set) => ({\n          mod: m,\n          owned: set,\n        })),\n      ),\n    );\n    const workers = await getWorkers(config, baseDir);\n\n    // Always run Logpush + Pipelines teardown: state may still hold\n    // `logpush_pipelines` even if logpush was removed from tamer.config.ts,\n    // and destroy must still delete the Pipelines stream/sink in that case.\n    await logpushJobDestroy(env, state, api, config);\n    await state.persist(api);\n\n    for (const { mod, owned } of ownedByKind) {\n      if (owned.size === 0) continue;\n      // Aggregate this kind's resources across all workers in the config — the\n      // destroy hook only needs them for stack-scope filtering and may walk\n      // state directly. Empty array is acceptable when state holds entries\n      // owned by another stack we still want to filter against `owned`.\n      const resources = workers.flatMap(([, wc]) => mod.pickResources(wc));\n      await mod.destroy({\n        resources,\n        tenant: config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n        force,\n      });\n    }\n\n    if (getDispatchNamespaces(config).length > 0) {\n      await dispatchNamespaceDestroy(env, state, api, config, force);\n    }\n\n    if (getDnsRecords(config).length > 0) {\n      await dnsRecordDestroy(env, state, api, config, force);\n    }\n\n    // Clear `stackOutputs` after every successful destroy — the values\n    // pointed at resources we just deleted, so leaving them in state would\n    // mislead a future `tamer status` and (post-imports) leak dangling\n    // refs into sibling stacks. The state row itself is dropped further\n    // below when `wipeMetadata` is set.\n    state.replaceStackOutputs({});\n\n    if (env !== \"local\" && wipeMetadata) {\n      const deletedDb = await destroyTamerStateDatabase(api, env);\n      if (deletedDb) {\n        console.log(`Deleted Tamer metadata database tamer-state-${env}.`);\n      }\n      try {\n        const deletedBucket = await destroyTamerArtifactsBucket(api, env);\n        if (deletedBucket) {\n          console.log(\n            `Deleted Tamer artifacts bucket tamer-artifacts-${env}.`,\n          );\n        }\n      } catch (err) {\n        console.warn(\n          `Failed to delete Tamer artifacts bucket tamer-artifacts-${env} (likely non-empty; remove objects and re-run with --wipe-metadata):`,\n          err instanceof Error ? err.message : err,\n        );\n      }\n    }\n\n    if (env !== \"local\" && !wipeMetadata) {\n      state.finishOperation();\n      try {\n        await state.persist(api);\n      } catch {\n        /* state row may have been wiped by sub-steps */\n      }\n    }\n    state.clearDirty();\n    console.log(`Destroyed all resources for env: ${env}`);\n  } catch (err) {\n    if (env !== \"local\") {\n      state.failOperation(err instanceof Error ? err.message : String(err));\n      try {\n        await state.persist(api);\n      } catch {\n        /* swallow secondary persist failure */\n      }\n    }\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgBA,eAAsB,yBACpB,KACA,OACA,KACA,QACA,QACe;CACf,MAAM,iBAAiB,IAAI,IACzB,sBAAsB,OAAO,CAAC,KAAK,MAAM,EAAE,YAAY,CACxD;AACD,KAAI,eAAe,SAAS,EAAG;AAE/B,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACzD,MAAI,MAAM,SAAS,qBAAsB;EACzC,MAAM,KAAK;AACX,MAAI,CAAC,eAAe,IAAI,GAAG,YAAY,CAAE;EACzC,MAAM,oBAAoB,GAAG,YAAY,SAAS,aAAa;AAC/D,MAAI;GACF,MAAM,UAAU,MAAM,IAAI,4BAA4B,GAAG,YAAY;AACrE,QAAK,MAAM,KAAK,SAAS;AACvB,QAAI,eAAe,KAAK,OAAO,OAAO,IAAI,mBACxC;SAAI,CAAC,EAAE,GAAG,SAAS,IAAI,MAAM,CAAE;;AAEjC,QAAI;AACF,WAAM,IAAI,8BAA8B,GAAG,aAAa,EAAE,IAAI,EAC5D,OAAO,MACR,CAAC;AACF,aAAQ,IACN,0BAA0B,EAAE,GAAG,mBAAmB,GAAG,YAAY,GAClE;aACM,KAAK;AACZ,aAAQ,KACN,kCAAkC,EAAE,GAAG,MAAM,GAAG,YAAY,IAC5D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;AAGL,OAAI,eAAe,KAAK,OAAO,OAAO,IAAI,mBAAmB;AAC3D,YAAQ,IACN,kCAAkC,GAAG,YAAY,mCAAmC,IAAI,IACzF;AACD;;AAEF,SAAM,IAAI,wBAAwB,GAAG,YAAY;AACjD,SAAM,OAAO,IAAI;WACV,KAAK;AACZ,WAAQ,KACN,uCAAuC,GAAG,YAAY,IACtD,eAAe,QAAQ,IAAI,UAAU,IACtC;;;;;;;;;;;;;;ACrDP,eAAsB,iBACpB,KACA,OACA,KACA,QACA,QACe;AACf,KAAI,QAAQ,QAAS;CACrB,MAAM,WAAW,cAAc,OAAO;AACtC,KAAI,SAAS,WAAW,EAAG;CAC3B,MAAM,WAAW,IAAI,IACnB,SAAS,KAAK,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAC5D;CACD,MAAM,iBAAiB,IAAI,IAAI,SAAS,KAAK,MAAM,EAAE,YAAY,CAAC;AAElE,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACzD,MAAI,MAAM,SAAS,aAAc;EACjC,MAAM,MAAM;AACZ,MAAI,CAAC,eAAe,IAAI,IAAI,YAAY,CAAE;AAC1C,MAAI,SAAS,IAAI,IAAI,YAAY,EAAE;AACjC,WAAQ,IACN,wBAAwB,IAAI,WAAW,GAAG,IAAI,KAAK,uBACpD;AACD,SAAM,OAAO,IAAI;AACjB;;AAEF,MAAI;AACF,SAAM,IAAI,oBAAoB,IAAI,QAAQ,IAAI,SAAS;AACvD,SAAM,OAAO,IAAI;WACV,KAAK;AACZ,WAAQ,KACN,+BAA+B,IAAI,WAAW,GAAG,IAAI,KAAK,IAC1D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;;;;;;AC5CP,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACD;;;;AAKD,SAAgB,wBACd,KACA,OACA,YACM;AACN,KAAI,MAAO;AACX,KAAI,CAAC,mBAAmB,SAAS,IAA2C,CAC1E;AAEF,KAAI,eAAe,IACjB,OAAM,IAAI,MACR,kCAAkC,IAAI,2BAA2B,MAClE;;;;;ACDL,eAAsB,WAAW,SAgBf;CAChB,MAAM,EACJ,KACA,QAAQ,OACR,cAAc,OACd,YACA,YACA,eAAe,UACb;CACJ,MAAM,UAAU,QAAQ,KAAK;AAE7B,yBAAwB,KAAK,OAAO,WAAW;CAE/C,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;AAGH,KAAI,QAAQ,UAAU;EACpB,MAAM,YAAY,IAAI,YAAY,UAAU;EAC5C,MAAM,cAAc,IAAI,aACtB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,QAAM,YAAY,QAAQ,UAAU;EACpC,MAAM,eACJ,QAAQ,UACJ,SACA,MAAM,wBAAwB;GAC5B;GACA;GACA,KAAK;GACL;GACD,CAAC;AACR,iBAAe;GACb,UAAU,QAAQ;GAClB,SAAS;GACT,cAAc;GACd;GACA,UAAU,OAAO,OAAO;GACxB;GACA,kBAAkB,YAAY,MAAM;GACpC,oBAAoB,eAChB,uBAAuB,aAAa,GACpC;GACJ,YAAY,CAAC,CAAC,QAAQ;GACvB,CAAC;;AAGJ,KAAI,QAAQ,SAAS;AACnB,UAAQ,IAAI,0CAA0C,IAAI,KAAK;AAC/D,QAAM,QAAQ;GAAE;GAAK;GAAY,CAAC;;CAGpC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;AACxB,OAAM,eAAe,WAAW,eAAe,kBAAkB,OAAU;AAC3E,KAAI;AACF,QAAM,MAAM,QAAQ,IAAI;SAClB;AAIR,KAAI;AACF,MAAI,CAAC,aAAa;AAChB,SAAM,oBAAoB,KAAK,QAAQ,SAAS,OAAO,IAAI;AAC3D,SAAM,MAAM,QAAQ,IAAI;AACxB,SAAM,eAAe,KAAK,SAAS,WAAW,QAAQ,OAAO,KAAK,MAAM;;EAG1E,MAAM,cAAc,MAAM,QAAQ,IAChC,gBAAgB,KAAK,MACnB,4BAA4B,QAAQ,SAAS,EAAE,KAAK,CAAC,MAAM,SAAS;GAClE,KAAK;GACL,OAAO;GACR,EAAE,CACJ,CACF;EACD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AAKjD,QAAM,kBAAkB,KAAK,OAAO,KAAK,OAAO;AAChD,QAAM,MAAM,QAAQ,IAAI;AAExB,OAAK,MAAM,EAAE,KAAK,WAAW,aAAa;AACxC,OAAI,MAAM,SAAS,EAAG;GAKtB,MAAM,YAAY,QAAQ,SAAS,GAAG,QAAQ,IAAI,cAAc,GAAG,CAAC;AACpE,SAAM,IAAI,QAAQ;IAChB;IACA,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;;AAGJ,MAAI,sBAAsB,OAAO,CAAC,SAAS,EACzC,OAAM,yBAAyB,KAAK,OAAO,KAAK,QAAQ,MAAM;AAGhE,MAAI,cAAc,OAAO,CAAC,SAAS,EACjC,OAAM,iBAAiB,KAAK,OAAO,KAAK,QAAQ,MAAM;AAQxD,QAAM,oBAAoB,EAAE,CAAC;AAE7B,MAAI,QAAQ,WAAW,cAAc;AAEnC,OADkB,MAAM,0BAA0B,KAAK,IAAI,CAEzD,SAAQ,IAAI,+CAA+C,IAAI,GAAG;AAEpE,OAAI;AAEF,QADsB,MAAM,4BAA4B,KAAK,IAAI,CAE/D,SAAQ,IACN,kDAAkD,IAAI,GACvD;YAEI,KAAK;AACZ,YAAQ,KACN,2DAA2D,IAAI,uEAC/D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;AAIL,MAAI,QAAQ,WAAW,CAAC,cAAc;AACpC,SAAM,iBAAiB;AACvB,OAAI;AACF,UAAM,MAAM,QAAQ,IAAI;WAClB;;AAIV,QAAM,YAAY;AAClB,UAAQ,IAAI,oCAAoC,MAAM;UAC/C,KAAK;AACZ,MAAI,QAAQ,SAAS;AACnB,SAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,OAAI;AACF,UAAM,MAAM,QAAQ,IAAI;WAClB;;AAIV,QAAM"}

package/dist/{destroy-tenant-U0t7BeJ0.mjs → destroy-tenant-B-VLKfc6.mjs}

@@ -1,6 +1,6 @@
-import { n as loadConfig } from "./loader-DAvCKLTT.mjs";
+import { n as loadConfig } from "./loader-DnT9iqz9.mjs";
 import { n as cloudflareAccountIdFromEnv, t as CFApiClient } from "./CFApiClient-DhbyyV71.mjs";
-import { a as tenantStateKey, f as stackNameForConfig, t as StateManager } from "./StateManager-DTqtLLVX.mjs";
+import { a as tenantStateKey, f as stackNameForConfig, t as StateManager } from "./StateManager-JLBtz9V-.mjs";
 
 //#region src/core/env/protectedEnvs.ts
 /**
@@ -100,4 +100,4 @@ async function runDestroyTenant(options) {
 
 //#endregion
 export { runDestroyTenant };
-//# sourceMappingURL=destroy-tenant-U0t7BeJ0.mjs.map
+//# sourceMappingURL=destroy-tenant-B-VLKfc6.mjs.map

package/dist/{destroy-tenant-U0t7BeJ0.mjs.map → destroy-tenant-B-VLKfc6.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"destroy-tenant-U0t7BeJ0.mjs","names":["DEFAULT_PROTECTED_ENVS: readonly string[]","result: DestroyTenantResult","errors: string[]","removedShards: { role: string; derivedName: string; cfId: string }[]"],"sources":["../src/core/env/protectedEnvs.ts","../src/cli/commands/destroy-tenant.ts"],"sourcesContent":["import type { CfiConfig } from \"../../types.js\";\n\n/**\n * Default set of envs that require explicit confirmation before\n * `destroy-tenant` will run. Used when the loaded config doesn't pin\n * `tenant.protectedEnvs` — these two names are universal-enough across\n * accounts that \"destroying prod by accident\" stays guarded by default,\n * but the operator is free to override the list (e.g. a multi-region\n * account with `production-eu` / `production-us` / `canary` adds those\n * here, and a personal account passes `[]` to disable the prompt).\n */\nconst DEFAULT_PROTECTED_ENVS: readonly string[] = [\"prod\", \"production\"];\n\n/**\n * `true` when `env` is in `tenant.protectedEnvs` from the loaded\n * `tamer.config.ts` (or in the default set when the config doesn't\n * pin its own list). Single source of truth for the destroy\n * confirmation check — call this **after** `loadConfig` so the\n * config-pinned list is honored.\n */\nexport function isProtectedEnv(env: string, config: CfiConfig): boolean {\n  const list = config.tenant.protectedEnvs ?? DEFAULT_PROTECTED_ENVS;\n  return list.includes(env);\n}\n\nexport { DEFAULT_PROTECTED_ENVS };\n","import { loadConfig } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { tenantStateKey } from \"../../core/tenant/tenantKeys.js\";\nimport { isProtectedEnv } from \"../../core/env/protectedEnvs.js\";\n\n/**\n * Machine-readable result envelope emitted on the final stdout line\n * when `--json` is passed. Mirrors `ProvisionTenantResult` so the\n * Cloudflare Container caller (`provision-workflow`, see\n * `docs/handoff.md` §7) can consume both commands with the same\n * parsing path. `removed.shards` lists every D1 we attempted to\n * delete; `errors` lists any best-effort delete failures so the\n * Workflow can surface them without re-parsing logs.\n */\nexport interface DestroyTenantResult {\n  status: \"destroyed\" | \"noop\" | \"failed\";\n  tenantKey: string;\n  product: string;\n  workspace: string;\n  env: string;\n  removed: {\n    scriptName?: string;\n    dispatchNamespaceName?: string;\n    shards: { role: string; derivedName: string; cfId: string }[];\n  };\n  errors: string[];\n  error?: string;\n}\n\nexport async function runDestroyTenant(options: {\n  env: string;\n  product: string;\n  workspace: string;\n  force?: boolean;\n  confirmTenant?: string;\n  configPath?: string;\n  json?: boolean;\n}): Promise<void> {\n  const env = options.env;\n  if (env === \"local\") {\n    throw new Error(\"destroy-tenant requires a non-local --env.\");\n  }\n\n  // Load config FIRST so the protection prompt can read\n  // `tenant.protectedEnvs` from `tamer.config.ts`. This intentionally\n  // ignores `--force` so a misconfigured CLI invocation can't\n  // bypass even the load step — we want the parsed config in hand\n  // before we accept any confirmation flag.\n  const config = await loadConfig(options.configPath, { env });\n\n  if (isProtectedEnv(env, config) && !options.force) {\n    if (options.confirmTenant !== options.workspace) {\n      throw new Error(\n        `destroy-tenant: env \"${env}\" is in tenant.protectedEnvs ` +\n          `(or the default [\"prod\",\"production\"]); pass ` +\n          `--confirm-tenant ${options.workspace} (must match --workspace) or use --force`,\n      );\n    }\n  }\n\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n\n  const t = state.getTenant(options.product, options.workspace);\n  if (!t) {\n    if (!options.force) {\n      throw new Error(\n        `No tenant state for ${tenantStateKey(options.product, options.workspace)}; pass --force to skip state check`,\n      );\n    }\n    console.log(\"No tenant record in state; nothing to remove.\");\n    if (options.json) {\n      const result: DestroyTenantResult = {\n        status: \"noop\",\n        tenantKey: tenantStateKey(options.product, options.workspace),\n        product: options.product,\n        workspace: options.workspace,\n        env,\n        removed: { shards: [] },\n        errors: [],\n      };\n      process.stdout.write(JSON.stringify(result) + \"\\n\");\n    }\n    return;\n  }\n\n  const errors: string[] = [];\n  try {\n    await api.dispatchNamespaceScriptDelete(\n      t.dispatchNamespaceName,\n      t.scriptName,\n      { force: true },\n    );\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    console.warn(`[destroy-tenant] script delete: ${msg}`);\n    errors.push(`script:${t.scriptName}:${msg}`);\n  }\n\n  const removedShards: { role: string; derivedName: string; cfId: string }[] =\n    [];\n  for (const shard of t.d1Shards ?? []) {\n    try {\n      await api.d1Delete(shard.cfId);\n      removedShards.push({\n        role: shard.role,\n        derivedName: shard.derivedName,\n        cfId: shard.cfId,\n      });\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[destroy-tenant] D1 ${shard.derivedName}: ${msg}`);\n      errors.push(`d1:${shard.derivedName}:${msg}`);\n    }\n  }\n\n  state.deleteTenant(options.product, options.workspace);\n  await state.persist(api);\n\n  console.log(\n    `Destroyed tenant ${tenantStateKey(options.product, options.workspace)}`,\n  );\n\n  if (options.json) {\n    const result: DestroyTenantResult = {\n      status: \"destroyed\",\n      tenantKey: tenantStateKey(options.product, options.workspace),\n      product: options.product,\n      workspace: options.workspace,\n      env,\n      removed: {\n        scriptName: t.scriptName,\n        dispatchNamespaceName: t.dispatchNamespaceName,\n        shards: removedShards,\n      },\n      errors,\n    };\n    process.stdout.write(JSON.stringify(result) + \"\\n\");\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAWA,MAAMA,yBAA4C,CAAC,QAAQ,aAAa;;;;;;;;AASxE,SAAgB,eAAe,KAAa,QAA4B;AAEtE,SADa,OAAO,OAAO,iBAAiB,wBAChC,SAAS,IAAI;;;;;ACU3B,eAAsB,iBAAiB,SAQrB;CAChB,MAAM,MAAM,QAAQ;AACpB,KAAI,QAAQ,QACV,OAAM,IAAI,MAAM,6CAA6C;CAQ/D,MAAM,SAAS,MAAM,WAAW,QAAQ,YAAY,EAAE,KAAK,CAAC;AAE5D,KAAI,eAAe,KAAK,OAAO,IAAI,CAAC,QAAQ,OAC1C;MAAI,QAAQ,kBAAkB,QAAQ,UACpC,OAAM,IAAI,MACR,wBAAwB,IAAI,6FAEN,QAAQ,UAAU,0CACzC;;CAIL,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,MAAM,IAAI,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;AAC7D,KAAI,CAAC,GAAG;AACN,MAAI,CAAC,QAAQ,MACX,OAAM,IAAI,MACR,uBAAuB,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,oCAC3E;AAEH,UAAQ,IAAI,gDAAgD;AAC5D,MAAI,QAAQ,MAAM;GAChB,MAAMC,SAA8B;IAClC,QAAQ;IACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;IAC7D,SAAS,QAAQ;IACjB,WAAW,QAAQ;IACnB;IACA,SAAS,EAAE,QAAQ,EAAE,EAAE;IACvB,QAAQ,EAAE;IACX;AACD,WAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK;;AAErD;;CAGF,MAAMC,SAAmB,EAAE;AAC3B,KAAI;AACF,QAAM,IAAI,8BACR,EAAE,uBACF,EAAE,YACF,EAAE,OAAO,MAAM,CAChB;UACM,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,mCAAmC,MAAM;AACtD,SAAO,KAAK,UAAU,EAAE,WAAW,GAAG,MAAM;;CAG9C,MAAMC,gBACJ,EAAE;AACJ,MAAK,MAAM,SAAS,EAAE,YAAY,EAAE,CAClC,KAAI;AACF,QAAM,IAAI,SAAS,MAAM,KAAK;AAC9B,gBAAc,KAAK;GACjB,MAAM,MAAM;GACZ,aAAa,MAAM;GACnB,MAAM,MAAM;GACb,CAAC;UACK,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,uBAAuB,MAAM,YAAY,IAAI,MAAM;AAChE,SAAO,KAAK,MAAM,MAAM,YAAY,GAAG,MAAM;;AAIjD,OAAM,aAAa,QAAQ,SAAS,QAAQ,UAAU;AACtD,OAAM,MAAM,QAAQ,IAAI;AAExB,SAAQ,IACN,oBAAoB,eAAe,QAAQ,SAAS,QAAQ,UAAU,GACvE;AAED,KAAI,QAAQ,MAAM;EAChB,MAAMF,SAA8B;GAClC,QAAQ;GACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;GAC7D,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB;GACA,SAAS;IACP,YAAY,EAAE;IACd,uBAAuB,EAAE;IACzB,QAAQ;IACT;GACD;GACD;AACD,UAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK"}
+{"version":3,"file":"destroy-tenant-B-VLKfc6.mjs","names":["DEFAULT_PROTECTED_ENVS: readonly string[]","result: DestroyTenantResult","errors: string[]","removedShards: { role: string; derivedName: string; cfId: string }[]"],"sources":["../src/core/env/protectedEnvs.ts","../src/cli/commands/destroy-tenant.ts"],"sourcesContent":["import type { CfiConfig } from \"../../types.js\";\n\n/**\n * Default set of envs that require explicit confirmation before\n * `destroy-tenant` will run. Used when the loaded config doesn't pin\n * `tenant.protectedEnvs` — these two names are universal-enough across\n * accounts that \"destroying prod by accident\" stays guarded by default,\n * but the operator is free to override the list (e.g. a multi-region\n * account with `production-eu` / `production-us` / `canary` adds those\n * here, and a personal account passes `[]` to disable the prompt).\n */\nconst DEFAULT_PROTECTED_ENVS: readonly string[] = [\"prod\", \"production\"];\n\n/**\n * `true` when `env` is in `tenant.protectedEnvs` from the loaded\n * `tamer.config.ts` (or in the default set when the config doesn't\n * pin its own list). Single source of truth for the destroy\n * confirmation check — call this **after** `loadConfig` so the\n * config-pinned list is honored.\n */\nexport function isProtectedEnv(env: string, config: CfiConfig): boolean {\n  const list = config.tenant.protectedEnvs ?? DEFAULT_PROTECTED_ENVS;\n  return list.includes(env);\n}\n\nexport { DEFAULT_PROTECTED_ENVS };\n","import { loadConfig } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { tenantStateKey } from \"../../core/tenant/tenantKeys.js\";\nimport { isProtectedEnv } from \"../../core/env/protectedEnvs.js\";\n\n/**\n * Machine-readable result envelope emitted on the final stdout line\n * when `--json` is passed. Mirrors `ProvisionTenantResult` so the\n * Cloudflare Container caller (`provision-workflow`, see\n * `docs/handoff.md` §7) can consume both commands with the same\n * parsing path. `removed.shards` lists every D1 we attempted to\n * delete; `errors` lists any best-effort delete failures so the\n * Workflow can surface them without re-parsing logs.\n */\nexport interface DestroyTenantResult {\n  status: \"destroyed\" | \"noop\" | \"failed\";\n  tenantKey: string;\n  product: string;\n  workspace: string;\n  env: string;\n  removed: {\n    scriptName?: string;\n    dispatchNamespaceName?: string;\n    shards: { role: string; derivedName: string; cfId: string }[];\n  };\n  errors: string[];\n  error?: string;\n}\n\nexport async function runDestroyTenant(options: {\n  env: string;\n  product: string;\n  workspace: string;\n  force?: boolean;\n  confirmTenant?: string;\n  configPath?: string;\n  json?: boolean;\n}): Promise<void> {\n  const env = options.env;\n  if (env === \"local\") {\n    throw new Error(\"destroy-tenant requires a non-local --env.\");\n  }\n\n  // Load config FIRST so the protection prompt can read\n  // `tenant.protectedEnvs` from `tamer.config.ts`. This intentionally\n  // ignores `--force` so a misconfigured CLI invocation can't\n  // bypass even the load step — we want the parsed config in hand\n  // before we accept any confirmation flag.\n  const config = await loadConfig(options.configPath, { env });\n\n  if (isProtectedEnv(env, config) && !options.force) {\n    if (options.confirmTenant !== options.workspace) {\n      throw new Error(\n        `destroy-tenant: env \"${env}\" is in tenant.protectedEnvs ` +\n          `(or the default [\"prod\",\"production\"]); pass ` +\n          `--confirm-tenant ${options.workspace} (must match --workspace) or use --force`,\n      );\n    }\n  }\n\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n\n  const t = state.getTenant(options.product, options.workspace);\n  if (!t) {\n    if (!options.force) {\n      throw new Error(\n        `No tenant state for ${tenantStateKey(options.product, options.workspace)}; pass --force to skip state check`,\n      );\n    }\n    console.log(\"No tenant record in state; nothing to remove.\");\n    if (options.json) {\n      const result: DestroyTenantResult = {\n        status: \"noop\",\n        tenantKey: tenantStateKey(options.product, options.workspace),\n        product: options.product,\n        workspace: options.workspace,\n        env,\n        removed: { shards: [] },\n        errors: [],\n      };\n      process.stdout.write(JSON.stringify(result) + \"\\n\");\n    }\n    return;\n  }\n\n  const errors: string[] = [];\n  try {\n    await api.dispatchNamespaceScriptDelete(\n      t.dispatchNamespaceName,\n      t.scriptName,\n      { force: true },\n    );\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    console.warn(`[destroy-tenant] script delete: ${msg}`);\n    errors.push(`script:${t.scriptName}:${msg}`);\n  }\n\n  const removedShards: { role: string; derivedName: string; cfId: string }[] =\n    [];\n  for (const shard of t.d1Shards ?? []) {\n    try {\n      await api.d1Delete(shard.cfId);\n      removedShards.push({\n        role: shard.role,\n        derivedName: shard.derivedName,\n        cfId: shard.cfId,\n      });\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[destroy-tenant] D1 ${shard.derivedName}: ${msg}`);\n      errors.push(`d1:${shard.derivedName}:${msg}`);\n    }\n  }\n\n  state.deleteTenant(options.product, options.workspace);\n  await state.persist(api);\n\n  console.log(\n    `Destroyed tenant ${tenantStateKey(options.product, options.workspace)}`,\n  );\n\n  if (options.json) {\n    const result: DestroyTenantResult = {\n      status: \"destroyed\",\n      tenantKey: tenantStateKey(options.product, options.workspace),\n      product: options.product,\n      workspace: options.workspace,\n      env,\n      removed: {\n        scriptName: t.scriptName,\n        dispatchNamespaceName: t.dispatchNamespaceName,\n        shards: removedShards,\n      },\n      errors,\n    };\n    process.stdout.write(JSON.stringify(result) + \"\\n\");\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAWA,MAAMA,yBAA4C,CAAC,QAAQ,aAAa;;;;;;;;AASxE,SAAgB,eAAe,KAAa,QAA4B;AAEtE,SADa,OAAO,OAAO,iBAAiB,wBAChC,SAAS,IAAI;;;;;ACU3B,eAAsB,iBAAiB,SAQrB;CAChB,MAAM,MAAM,QAAQ;AACpB,KAAI,QAAQ,QACV,OAAM,IAAI,MAAM,6CAA6C;CAQ/D,MAAM,SAAS,MAAM,WAAW,QAAQ,YAAY,EAAE,KAAK,CAAC;AAE5D,KAAI,eAAe,KAAK,OAAO,IAAI,CAAC,QAAQ,OAC1C;MAAI,QAAQ,kBAAkB,QAAQ,UACpC,OAAM,IAAI,MACR,wBAAwB,IAAI,6FAEN,QAAQ,UAAU,0CACzC;;CAIL,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,MAAM,IAAI,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;AAC7D,KAAI,CAAC,GAAG;AACN,MAAI,CAAC,QAAQ,MACX,OAAM,IAAI,MACR,uBAAuB,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,oCAC3E;AAEH,UAAQ,IAAI,gDAAgD;AAC5D,MAAI,QAAQ,MAAM;GAChB,MAAMC,SAA8B;IAClC,QAAQ;IACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;IAC7D,SAAS,QAAQ;IACjB,WAAW,QAAQ;IACnB;IACA,SAAS,EAAE,QAAQ,EAAE,EAAE;IACvB,QAAQ,EAAE;IACX;AACD,WAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK;;AAErD;;CAGF,MAAMC,SAAmB,EAAE;AAC3B,KAAI;AACF,QAAM,IAAI,8BACR,EAAE,uBACF,EAAE,YACF,EAAE,OAAO,MAAM,CAChB;UACM,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,mCAAmC,MAAM;AACtD,SAAO,KAAK,UAAU,EAAE,WAAW,GAAG,MAAM;;CAG9C,MAAMC,gBACJ,EAAE;AACJ,MAAK,MAAM,SAAS,EAAE,YAAY,EAAE,CAClC,KAAI;AACF,QAAM,IAAI,SAAS,MAAM,KAAK;AAC9B,gBAAc,KAAK;GACjB,MAAM,MAAM;GACZ,aAAa,MAAM;GACnB,MAAM,MAAM;GACb,CAAC;UACK,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,uBAAuB,MAAM,YAAY,IAAI,MAAM;AAChE,SAAO,KAAK,MAAM,MAAM,YAAY,GAAG,MAAM;;AAIjD,OAAM,aAAa,QAAQ,SAAS,QAAQ,UAAU;AACtD,OAAM,MAAM,QAAQ,IAAI;AAExB,SAAQ,IACN,oBAAoB,eAAe,QAAQ,SAAS,QAAQ,UAAU,GACvE;AAED,KAAI,QAAQ,MAAM;EAChB,MAAMF,SAA8B;GAClC,QAAQ;GACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;GAC7D,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB;GACA,SAAS;IACP,YAAY,EAAE;IACd,uBAAuB,EAAE;IACzB,QAAQ;IACT;GACD;GACD;AACD,UAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK"}

package/dist/{dev-CZbKfdFw.mjs → dev-BYItpt9U.mjs}

@@ -1,12 +1,12 @@
-import { n as loadConfig, t as getWorkers } from "./loader-DAvCKLTT.mjs";
+import { n as loadConfig, t as getWorkers } from "./loader-DnT9iqz9.mjs";
 import { n as cloudflareAccountIdFromEnv, t as CFApiClient } from "./CFApiClient-DhbyyV71.mjs";
-import { _ as namingFromConfig, g as wranglerConfigCliArgs, p as resolveWorkerConfig, t as fetchStackImports } from "./fetchStackImports-C-1THPYL.mjs";
-import { f as stackNameForConfig, t as StateManager } from "./StateManager-DTqtLLVX.mjs";
+import { _ as wranglerConfigCliArgs, m as resolveWorkerConfig, t as fetchStackImports, v as namingFromConfig } from "./fetchStackImports-ClUYZy_U.mjs";
+import { f as stackNameForConfig, t as StateManager } from "./StateManager-JLBtz9V-.mjs";
 import "./r2S3EmptyBucket-DD81ZWQ7.mjs";
-import { n as writeWranglerJson, t as generateWranglerConfig } from "./generator-Ba-vqyBG.mjs";
+import { n as writeWranglerJson, t as generateWranglerConfig } from "./generator-h_VG0Q5f.mjs";
 import "./logpush-job-DsRkOORJ.mjs";
-import "./worker-route-CMbtozNa.mjs";
-import { runSync } from "./sync-B_pyPi7Z.mjs";
+import "./worker-route-DY1onr-h.mjs";
+import { runSync } from "./sync-BdJ43vO7.mjs";
 import { spawn } from "child_process";
 
 //#region src/cli/commands/dev.ts
@@ -100,4 +100,4 @@ async function runDev(options) {
 
 //#endregion
 export { runDev };
-//# sourceMappingURL=dev-CZbKfdFw.mjs.map
+//# sourceMappingURL=dev-BYItpt9U.mjs.map

package/dist/{dev-CZbKfdFw.mjs.map → dev-BYItpt9U.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"dev-CZbKfdFw.mjs","names":["workerKey","workerConfig","resolved","children: ChildProcess[]"],"sources":["../src/cli/commands/dev.ts"],"sourcesContent":["import type { ChildProcess } from \"child_process\";\nimport { spawn } from \"child_process\";\nimport { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { wranglerConfigCliArgs } from \"../../core/wrangler/wranglerOutFile.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { resolveWorkerConfig } from \"../../core/config/resolver.js\";\nimport {\n  generateWranglerConfig,\n  writeWranglerJson,\n} from \"../../core/wrangler/generator.js\";\nimport { runSync } from \"./sync.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\n\nexport async function runDev(options: {\n  worker?: string;\n  env?: string;\n  configPath?: string;\n  /** Run every selected worker as a separate `wrangler dev` on incrementing ports (from TAMER_DEV_BASE_PORT or 8787). */\n  all?: boolean;\n}): Promise<void> {\n  const workerFilter = options.worker;\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n\n  if (\n    env !== \"local\" &&\n    Object.keys(state.load().resources).length === 0\n  ) {\n    console.log(\"Tamer state is empty; running sync...\");\n    await runSync({ env, configPath });\n    state.reset();\n    await state.hydrate(api);\n  }\n\n  // Pre-fetch sibling stack outputs so worker `vars` / `tamerRoutes`\n  // can reference `${tamer:import:<stack>.<output>}` even in dev mode.\n  // No-op in local env (returns `{}`); when missing in non-local, the\n  // import resolver will throw with a clear \"run apply on <stack>\" hint.\n  const imports = await fetchStackImports(api, config, env);\n\n  const workers = await getWorkers(config, baseDir);\n  const toRun = workerFilter\n    ? workers.filter(([k]) => k === workerFilter)\n    : workers;\n\n  if (toRun.length === 0) {\n    throw new Error(\n      workerFilter\n        ? `Worker \"${workerFilter}\" not found`\n        : \"No workers configured\",\n    );\n  }\n\n  for (const [workerKey, workerConfig] of toRun) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { imports },\n    );\n    const wranglerConfig = generateWranglerConfig(resolved, state, naming);\n    writeWranglerJson(resolved.workerDir, wranglerConfig, resolved.wranglerOutFile);\n  }\n\n  if (options.all && toRun.length > 0) {\n    const basePort = Number(process.env.TAMER_DEV_BASE_PORT) || 8787;\n    const children: ChildProcess[] = [];\n\n    for (let i = 0; i < toRun.length; i++) {\n      const [workerKey, workerConfig] = toRun[i];\n      const resolved = await resolveWorkerConfig(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        { imports },\n      );\n      const port = basePort + i;\n      const devArgs = [\n        \"wrangler\",\n        ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n        \"dev\",\n        \"--port\",\n        String(port),\n      ];\n      console.log(`Starting ${workerKey} on http://127.0.0.1:${port}`);\n      const proc = spawn(\"bunx\", devArgs, {\n        cwd: resolved.workerDir,\n        stdio: \"inherit\",\n        shell: true,\n      });\n      children.push(proc);\n    }\n\n    const shutdown = () => {\n      for (const c of children) {\n        if (!c.killed) c.kill(\"SIGTERM\");\n      }\n    };\n    process.once(\"SIGINT\", () => {\n      shutdown();\n      process.exit(0);\n    });\n    process.once(\"SIGTERM\", () => {\n      shutdown();\n      process.exit(0);\n    });\n\n    await new Promise<void>((resolve) => {\n      let remaining = children.length;\n      for (const c of children) {\n        c.on(\"exit\", () => {\n          remaining -= 1;\n          if (remaining <= 0) resolve();\n        });\n      }\n    });\n    return;\n  }\n\n  const [workerKey, workerConfig] = toRun[0];\n  const resolved = await resolveWorkerConfig(\n    config,\n    workerKey,\n    workerConfig,\n    env,\n    baseDir,\n    accountId,\n    naming,\n    state,\n    { imports },\n  );\n\n  console.log(`Starting wrangler dev for ${workerKey}...`);\n  const devArgs = [\n    \"wrangler\",\n    ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n    \"dev\",\n  ];\n  const proc = spawn(\"bunx\", devArgs, {\n    cwd: resolved.workerDir,\n    stdio: \"inherit\",\n    shell: true,\n  });\n\n  proc.on(\"exit\", (code) => {\n    process.exit(code ?? 0);\n  });\n}\n"],"mappings":";;;;;;;;;;;;AAiBA,eAAsB,OAAO,SAMX;CAChB,MAAM,eAAe,QAAQ;CAC7B,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;AAExB,KACE,QAAQ,WACR,OAAO,KAAK,MAAM,MAAM,CAAC,UAAU,CAAC,WAAW,GAC/C;AACA,UAAQ,IAAI,wCAAwC;AACpD,QAAM,QAAQ;GAAE;GAAK;GAAY,CAAC;AAClC,QAAM,OAAO;AACb,QAAM,MAAM,QAAQ,IAAI;;CAO1B,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;CAEzD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CACjD,MAAM,QAAQ,eACV,QAAQ,QAAQ,CAAC,OAAO,MAAM,aAAa,GAC3C;AAEJ,KAAI,MAAM,WAAW,EACnB,OAAM,IAAI,MACR,eACI,WAAW,aAAa,eACxB,wBACL;AAGH,MAAK,MAAM,CAACA,aAAWC,mBAAiB,OAAO;EAC7C,MAAMC,aAAW,MAAM,oBACrB,QACAF,aACAC,gBACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;EACD,MAAM,iBAAiB,uBAAuBC,YAAU,OAAO,OAAO;AACtE,oBAAkBA,WAAS,WAAW,gBAAgBA,WAAS,gBAAgB;;AAGjF,KAAI,QAAQ,OAAO,MAAM,SAAS,GAAG;EACnC,MAAM,WAAW,OAAO,QAAQ,IAAI,oBAAoB,IAAI;EAC5D,MAAMC,WAA2B,EAAE;AAEnC,OAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;GACrC,MAAM,CAACH,aAAWC,kBAAgB,MAAM;GACxC,MAAMC,aAAW,MAAM,oBACrB,QACAF,aACAC,gBACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;GACD,MAAM,OAAO,WAAW;GACxB,MAAM,UAAU;IACd;IACA,GAAG,sBAAsBC,WAAS,gBAAgB;IAClD;IACA;IACA,OAAO,KAAK;IACb;AACD,WAAQ,IAAI,YAAYF,YAAU,uBAAuB,OAAO;GAChE,MAAM,OAAO,MAAM,QAAQ,SAAS;IAClC,KAAKE,WAAS;IACd,OAAO;IACP,OAAO;IACR,CAAC;AACF,YAAS,KAAK,KAAK;;EAGrB,MAAM,iBAAiB;AACrB,QAAK,MAAM,KAAK,SACd,KAAI,CAAC,EAAE,OAAQ,GAAE,KAAK,UAAU;;AAGpC,UAAQ,KAAK,gBAAgB;AAC3B,aAAU;AACV,WAAQ,KAAK,EAAE;IACf;AACF,UAAQ,KAAK,iBAAiB;AAC5B,aAAU;AACV,WAAQ,KAAK,EAAE;IACf;AAEF,QAAM,IAAI,SAAe,YAAY;GACnC,IAAI,YAAY,SAAS;AACzB,QAAK,MAAM,KAAK,SACd,GAAE,GAAG,cAAc;AACjB,iBAAa;AACb,QAAI,aAAa,EAAG,UAAS;KAC7B;IAEJ;AACF;;CAGF,MAAM,CAAC,WAAW,gBAAgB,MAAM;CACxC,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;AAED,SAAQ,IAAI,6BAA6B,UAAU,KAAK;AAYxD,CANa,MAAM,QALH;EACd;EACA,GAAG,sBAAsB,SAAS,gBAAgB;EAClD;EACD,EACmC;EAClC,KAAK,SAAS;EACd,OAAO;EACP,OAAO;EACR,CAAC,CAEG,GAAG,SAAS,SAAS;AACxB,UAAQ,KAAK,QAAQ,EAAE;GACvB"}
+{"version":3,"file":"dev-BYItpt9U.mjs","names":["workerKey","workerConfig","resolved","children: ChildProcess[]"],"sources":["../src/cli/commands/dev.ts"],"sourcesContent":["import type { ChildProcess } from \"child_process\";\nimport { spawn } from \"child_process\";\nimport { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { wranglerConfigCliArgs } from \"../../core/wrangler/wranglerOutFile.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { resolveWorkerConfig } from \"../../core/config/resolver.js\";\nimport {\n  generateWranglerConfig,\n  writeWranglerJson,\n} from \"../../core/wrangler/generator.js\";\nimport { runSync } from \"./sync.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\n\nexport async function runDev(options: {\n  worker?: string;\n  env?: string;\n  configPath?: string;\n  /** Run every selected worker as a separate `wrangler dev` on incrementing ports (from TAMER_DEV_BASE_PORT or 8787). */\n  all?: boolean;\n}): Promise<void> {\n  const workerFilter = options.worker;\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n\n  if (\n    env !== \"local\" &&\n    Object.keys(state.load().resources).length === 0\n  ) {\n    console.log(\"Tamer state is empty; running sync...\");\n    await runSync({ env, configPath });\n    state.reset();\n    await state.hydrate(api);\n  }\n\n  // Pre-fetch sibling stack outputs so worker `vars` / `tamerRoutes`\n  // can reference `${tamer:import:<stack>.<output>}` even in dev mode.\n  // No-op in local env (returns `{}`); when missing in non-local, the\n  // import resolver will throw with a clear \"run apply on <stack>\" hint.\n  const imports = await fetchStackImports(api, config, env);\n\n  const workers = await getWorkers(config, baseDir);\n  const toRun = workerFilter\n    ? workers.filter(([k]) => k === workerFilter)\n    : workers;\n\n  if (toRun.length === 0) {\n    throw new Error(\n      workerFilter\n        ? `Worker \"${workerFilter}\" not found`\n        : \"No workers configured\",\n    );\n  }\n\n  for (const [workerKey, workerConfig] of toRun) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { imports },\n    );\n    const wranglerConfig = generateWranglerConfig(resolved, state, naming);\n    writeWranglerJson(resolved.workerDir, wranglerConfig, resolved.wranglerOutFile);\n  }\n\n  if (options.all && toRun.length > 0) {\n    const basePort = Number(process.env.TAMER_DEV_BASE_PORT) || 8787;\n    const children: ChildProcess[] = [];\n\n    for (let i = 0; i < toRun.length; i++) {\n      const [workerKey, workerConfig] = toRun[i];\n      const resolved = await resolveWorkerConfig(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        { imports },\n      );\n      const port = basePort + i;\n      const devArgs = [\n        \"wrangler\",\n        ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n        \"dev\",\n        \"--port\",\n        String(port),\n      ];\n      console.log(`Starting ${workerKey} on http://127.0.0.1:${port}`);\n      const proc = spawn(\"bunx\", devArgs, {\n        cwd: resolved.workerDir,\n        stdio: \"inherit\",\n        shell: true,\n      });\n      children.push(proc);\n    }\n\n    const shutdown = () => {\n      for (const c of children) {\n        if (!c.killed) c.kill(\"SIGTERM\");\n      }\n    };\n    process.once(\"SIGINT\", () => {\n      shutdown();\n      process.exit(0);\n    });\n    process.once(\"SIGTERM\", () => {\n      shutdown();\n      process.exit(0);\n    });\n\n    await new Promise<void>((resolve) => {\n      let remaining = children.length;\n      for (const c of children) {\n        c.on(\"exit\", () => {\n          remaining -= 1;\n          if (remaining <= 0) resolve();\n        });\n      }\n    });\n    return;\n  }\n\n  const [workerKey, workerConfig] = toRun[0];\n  const resolved = await resolveWorkerConfig(\n    config,\n    workerKey,\n    workerConfig,\n    env,\n    baseDir,\n    accountId,\n    naming,\n    state,\n    { imports },\n  );\n\n  console.log(`Starting wrangler dev for ${workerKey}...`);\n  const devArgs = [\n    \"wrangler\",\n    ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n    \"dev\",\n  ];\n  const proc = spawn(\"bunx\", devArgs, {\n    cwd: resolved.workerDir,\n    stdio: \"inherit\",\n    shell: true,\n  });\n\n  proc.on(\"exit\", (code) => {\n    process.exit(code ?? 0);\n  });\n}\n"],"mappings":";;;;;;;;;;;;AAiBA,eAAsB,OAAO,SAMX;CAChB,MAAM,eAAe,QAAQ;CAC7B,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;AAExB,KACE,QAAQ,WACR,OAAO,KAAK,MAAM,MAAM,CAAC,UAAU,CAAC,WAAW,GAC/C;AACA,UAAQ,IAAI,wCAAwC;AACpD,QAAM,QAAQ;GAAE;GAAK;GAAY,CAAC;AAClC,QAAM,OAAO;AACb,QAAM,MAAM,QAAQ,IAAI;;CAO1B,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;CAEzD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CACjD,MAAM,QAAQ,eACV,QAAQ,QAAQ,CAAC,OAAO,MAAM,aAAa,GAC3C;AAEJ,KAAI,MAAM,WAAW,EACnB,OAAM,IAAI,MACR,eACI,WAAW,aAAa,eACxB,wBACL;AAGH,MAAK,MAAM,CAACA,aAAWC,mBAAiB,OAAO;EAC7C,MAAMC,aAAW,MAAM,oBACrB,QACAF,aACAC,gBACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;EACD,MAAM,iBAAiB,uBAAuBC,YAAU,OAAO,OAAO;AACtE,oBAAkBA,WAAS,WAAW,gBAAgBA,WAAS,gBAAgB;;AAGjF,KAAI,QAAQ,OAAO,MAAM,SAAS,GAAG;EACnC,MAAM,WAAW,OAAO,QAAQ,IAAI,oBAAoB,IAAI;EAC5D,MAAMC,WAA2B,EAAE;AAEnC,OAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;GACrC,MAAM,CAACH,aAAWC,kBAAgB,MAAM;GACxC,MAAMC,aAAW,MAAM,oBACrB,QACAF,aACAC,gBACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;GACD,MAAM,OAAO,WAAW;GACxB,MAAM,UAAU;IACd;IACA,GAAG,sBAAsBC,WAAS,gBAAgB;IAClD;IACA;IACA,OAAO,KAAK;IACb;AACD,WAAQ,IAAI,YAAYF,YAAU,uBAAuB,OAAO;GAChE,MAAM,OAAO,MAAM,QAAQ,SAAS;IAClC,KAAKE,WAAS;IACd,OAAO;IACP,OAAO;IACR,CAAC;AACF,YAAS,KAAK,KAAK;;EAGrB,MAAM,iBAAiB;AACrB,QAAK,MAAM,KAAK,SACd,KAAI,CAAC,EAAE,OAAQ,GAAE,KAAK,UAAU;;AAGpC,UAAQ,KAAK,gBAAgB;AAC3B,aAAU;AACV,WAAQ,KAAK,EAAE;IACf;AACF,UAAQ,KAAK,iBAAiB;AAC5B,aAAU;AACV,WAAQ,KAAK,EAAE;IACf;AAEF,QAAM,IAAI,SAAe,YAAY;GACnC,IAAI,YAAY,SAAS;AACzB,QAAK,MAAM,KAAK,SACd,GAAE,GAAG,cAAc;AACjB,iBAAa;AACb,QAAI,aAAa,EAAG,UAAS;KAC7B;IAEJ;AACF;;CAGF,MAAM,CAAC,WAAW,gBAAgB,MAAM;CACxC,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;AAED,SAAQ,IAAI,6BAA6B,UAAU,KAAK;AAYxD,CANa,MAAM,QALH;EACd;EACA,GAAG,sBAAsB,SAAS,gBAAgB;EAClD;EACD,EACmC;EAClC,KAAK,SAAS;EACd,OAAO;EACP,OAAO;EACR,CAAC,CAEG,GAAG,SAAS,SAAS;AACxB,UAAQ,KAAK,QAAQ,EAAE;GACvB"}

package/dist/{dns-records.sync-Bpzz9H0s.mjs → dns-records.sync-CfI1mqXv.mjs}

@@ -1,4 +1,4 @@
-import { o as effectiveDispatchNamespaceName } from "./StateManager-DTqtLLVX.mjs";
+import { o as effectiveDispatchNamespaceName } from "./StateManager-JLBtz9V-.mjs";
 import { n as dnsRecordCommentMarker, r as dnsRecordStateKey, t as dnsRecordAppliesToEnv } from "./dns-records.resolve-DwBR_1WI.mjs";
 
 //#region src/features/dispatch-namespace/dispatch-namespace.sync.ts
@@ -72,4 +72,4 @@ async function dnsRecordSync(resources, tenant, env, api, state) {
 
 //#endregion
 export { dispatchNamespaceSync as n, dnsRecordSync as t };
-//# sourceMappingURL=dns-records.sync-Bpzz9H0s.mjs.map
+//# sourceMappingURL=dns-records.sync-CfI1mqXv.mjs.map

package/dist/{dns-records.sync-Bpzz9H0s.mjs.map → dns-records.sync-CfI1mqXv.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"dns-records.sync-Bpzz9H0s.mjs","names":["entry: DnsRecordStateEntry"],"sources":["../src/features/dispatch-namespace/dispatch-namespace.sync.ts","../src/features/dns-records/dns-records.sync.ts"],"sourcesContent":["import type { TenantMeta, DispatchNamespaceResourceConfig } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { effectiveDispatchNamespaceName } from \"./dispatch-namespace.resolve.js\";\n\nexport async function dispatchNamespaceSync(\n  resources: DispatchNamespaceResourceConfig[],\n  tenant: TenantMeta,\n  env: string,\n  api: CFApiClient,\n  state: StateManager,\n): Promise<void> {\n  if (resources.length === 0) return;\n  if (env === \"local\") return;\n\n  const list = await api.dispatchNamespaceListAll();\n  const names = new Set(list.map((n) => n.namespace_name));\n\n  for (const config of resources) {\n    const resolved = effectiveDispatchNamespaceName(config, env, tenant);\n    const key = `dispatch_ns:${resolved}`;\n    if (!names.has(resolved)) continue;\n\n    state.set(key, {\n      type: \"dispatch_namespace\",\n      logicalName: config.logicalName,\n      derivedName: resolved,\n      createdAt: new Date().toISOString(),\n      updatedAt: new Date().toISOString(),\n    });\n  }\n}\n","import type {\n  DnsRecordResourceConfig,\n  DnsRecordStateEntry,\n  TenantMeta,\n} from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport {\n  dnsRecordAppliesToEnv,\n  dnsRecordCommentMarker,\n  dnsRecordStateKey,\n} from \"./dns-records.resolve.js\";\n\n/**\n * Re-adopt every Tamer-attributed DNS record found on the live zones into\n * state. Mirrors the dispatch-namespace sync pattern: Tamer never\n * **destroys** records here, just imports rows that match its\n * attribution comment so a `apply` straight after `sync` is a no-op when\n * Cloudflare and config agree.\n *\n * Records on Cloudflare without Tamer's marker comment are ignored even\n * if they happen to match the declared `(zone, type, name)` — they are\n * presumed to be hand-managed and surface in `tamer drift` as\n * `unrecordedInState` so the operator can decide.\n */\nexport async function dnsRecordSync(\n  resources: DnsRecordResourceConfig[],\n  tenant: TenantMeta,\n  env: string,\n  api: CFApiClient,\n  state: StateManager,\n): Promise<void> {\n  if (resources.length === 0) return;\n  const applicable = resources.filter((r) => dnsRecordAppliesToEnv(r, env));\n  if (applicable.length === 0) return;\n\n  const zoneCache = new Map<\n    string,\n    Awaited<ReturnType<CFApiClient[\"zoneDnsRecordListAll\"]>>\n  >();\n\n  for (const config of applicable) {\n    let live = zoneCache.get(config.zoneId);\n    if (!live) {\n      live = await api.zoneDnsRecordListAll(config.zoneId);\n      zoneCache.set(config.zoneId, live);\n    }\n    const marker = dnsRecordCommentMarker(tenant, env, config.logicalName);\n    const adopted = live.find(\n      (r) =>\n        r.type === config.type &&\n        typeof r.comment === \"string\" &&\n        r.comment.startsWith(marker),\n    );\n    if (!adopted) continue;\n    const stateKey = dnsRecordStateKey(config.zoneId, config.type, config.name);\n    const ts = new Date().toISOString();\n    const entry: DnsRecordStateEntry = {\n      type: \"dns_record\",\n      logicalName: config.logicalName,\n      zoneId: config.zoneId,\n      recordType: config.type,\n      name: adopted.name,\n      content: adopted.content,\n      ttl: adopted.ttl ?? 1,\n      proxied: adopted.proxied ?? false,\n      priority: adopted.priority,\n      comment: adopted.comment ?? marker,\n      recordId: adopted.id,\n      createdAt: state.get(stateKey)?.type === \"dns_record\"\n        ? (state.get(stateKey) as DnsRecordStateEntry).createdAt\n        : ts,\n      updatedAt: ts,\n    };\n    state.set(stateKey, entry);\n  }\n}\n"],"mappings":";;;;AAKA,eAAsB,sBACpB,WACA,QACA,KACA,KACA,OACe;AACf,KAAI,UAAU,WAAW,EAAG;AAC5B,KAAI,QAAQ,QAAS;CAErB,MAAM,OAAO,MAAM,IAAI,0BAA0B;CACjD,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK,MAAM,EAAE,eAAe,CAAC;AAExD,MAAK,MAAM,UAAU,WAAW;EAC9B,MAAM,WAAW,+BAA+B,QAAQ,KAAK,OAAO;EACpE,MAAM,MAAM,eAAe;AAC3B,MAAI,CAAC,MAAM,IAAI,SAAS,CAAE;AAE1B,QAAM,IAAI,KAAK;GACb,MAAM;GACN,aAAa,OAAO;GACpB,aAAa;GACb,4BAAW,IAAI,MAAM,EAAC,aAAa;GACnC,4BAAW,IAAI,MAAM,EAAC,aAAa;GACpC,CAAC;;;;;;;;;;;;;;;;;;ACJN,eAAsB,cACpB,WACA,QACA,KACA,KACA,OACe;AACf,KAAI,UAAU,WAAW,EAAG;CAC5B,MAAM,aAAa,UAAU,QAAQ,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACzE,KAAI,WAAW,WAAW,EAAG;CAE7B,MAAM,4BAAY,IAAI,KAGnB;AAEH,MAAK,MAAM,UAAU,YAAY;EAC/B,IAAI,OAAO,UAAU,IAAI,OAAO,OAAO;AACvC,MAAI,CAAC,MAAM;AACT,UAAO,MAAM,IAAI,qBAAqB,OAAO,OAAO;AACpD,aAAU,IAAI,OAAO,QAAQ,KAAK;;EAEpC,MAAM,SAAS,uBAAuB,QAAQ,KAAK,OAAO,YAAY;EACtE,MAAM,UAAU,KAAK,MAClB,MACC,EAAE,SAAS,OAAO,QAClB,OAAO,EAAE,YAAY,YACrB,EAAE,QAAQ,WAAW,OAAO,CAC/B;AACD,MAAI,CAAC,QAAS;EACd,MAAM,WAAW,kBAAkB,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK;EAC3E,MAAM,sBAAK,IAAI,MAAM,EAAC,aAAa;EACnC,MAAMA,QAA6B;GACjC,MAAM;GACN,aAAa,OAAO;GACpB,QAAQ,OAAO;GACf,YAAY,OAAO;GACnB,MAAM,QAAQ;GACd,SAAS,QAAQ;GACjB,KAAK,QAAQ,OAAO;GACpB,SAAS,QAAQ,WAAW;GAC5B,UAAU,QAAQ;GAClB,SAAS,QAAQ,WAAW;GAC5B,UAAU,QAAQ;GAClB,WAAW,MAAM,IAAI,SAAS,EAAE,SAAS,eACpC,MAAM,IAAI,SAAS,CAAyB,YAC7C;GACJ,WAAW;GACZ;AACD,QAAM,IAAI,UAAU,MAAM"}
+{"version":3,"file":"dns-records.sync-CfI1mqXv.mjs","names":["entry: DnsRecordStateEntry"],"sources":["../src/features/dispatch-namespace/dispatch-namespace.sync.ts","../src/features/dns-records/dns-records.sync.ts"],"sourcesContent":["import type { TenantMeta, DispatchNamespaceResourceConfig } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { effectiveDispatchNamespaceName } from \"./dispatch-namespace.resolve.js\";\n\nexport async function dispatchNamespaceSync(\n  resources: DispatchNamespaceResourceConfig[],\n  tenant: TenantMeta,\n  env: string,\n  api: CFApiClient,\n  state: StateManager,\n): Promise<void> {\n  if (resources.length === 0) return;\n  if (env === \"local\") return;\n\n  const list = await api.dispatchNamespaceListAll();\n  const names = new Set(list.map((n) => n.namespace_name));\n\n  for (const config of resources) {\n    const resolved = effectiveDispatchNamespaceName(config, env, tenant);\n    const key = `dispatch_ns:${resolved}`;\n    if (!names.has(resolved)) continue;\n\n    state.set(key, {\n      type: \"dispatch_namespace\",\n      logicalName: config.logicalName,\n      derivedName: resolved,\n      createdAt: new Date().toISOString(),\n      updatedAt: new Date().toISOString(),\n    });\n  }\n}\n","import type {\n  DnsRecordResourceConfig,\n  DnsRecordStateEntry,\n  TenantMeta,\n} from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport {\n  dnsRecordAppliesToEnv,\n  dnsRecordCommentMarker,\n  dnsRecordStateKey,\n} from \"./dns-records.resolve.js\";\n\n/**\n * Re-adopt every Tamer-attributed DNS record found on the live zones into\n * state. Mirrors the dispatch-namespace sync pattern: Tamer never\n * **destroys** records here, just imports rows that match its\n * attribution comment so a `apply` straight after `sync` is a no-op when\n * Cloudflare and config agree.\n *\n * Records on Cloudflare without Tamer's marker comment are ignored even\n * if they happen to match the declared `(zone, type, name)` — they are\n * presumed to be hand-managed and surface in `tamer drift` as\n * `unrecordedInState` so the operator can decide.\n */\nexport async function dnsRecordSync(\n  resources: DnsRecordResourceConfig[],\n  tenant: TenantMeta,\n  env: string,\n  api: CFApiClient,\n  state: StateManager,\n): Promise<void> {\n  if (resources.length === 0) return;\n  const applicable = resources.filter((r) => dnsRecordAppliesToEnv(r, env));\n  if (applicable.length === 0) return;\n\n  const zoneCache = new Map<\n    string,\n    Awaited<ReturnType<CFApiClient[\"zoneDnsRecordListAll\"]>>\n  >();\n\n  for (const config of applicable) {\n    let live = zoneCache.get(config.zoneId);\n    if (!live) {\n      live = await api.zoneDnsRecordListAll(config.zoneId);\n      zoneCache.set(config.zoneId, live);\n    }\n    const marker = dnsRecordCommentMarker(tenant, env, config.logicalName);\n    const adopted = live.find(\n      (r) =>\n        r.type === config.type &&\n        typeof r.comment === \"string\" &&\n        r.comment.startsWith(marker),\n    );\n    if (!adopted) continue;\n    const stateKey = dnsRecordStateKey(config.zoneId, config.type, config.name);\n    const ts = new Date().toISOString();\n    const entry: DnsRecordStateEntry = {\n      type: \"dns_record\",\n      logicalName: config.logicalName,\n      zoneId: config.zoneId,\n      recordType: config.type,\n      name: adopted.name,\n      content: adopted.content,\n      ttl: adopted.ttl ?? 1,\n      proxied: adopted.proxied ?? false,\n      priority: adopted.priority,\n      comment: adopted.comment ?? marker,\n      recordId: adopted.id,\n      createdAt: state.get(stateKey)?.type === \"dns_record\"\n        ? (state.get(stateKey) as DnsRecordStateEntry).createdAt\n        : ts,\n      updatedAt: ts,\n    };\n    state.set(stateKey, entry);\n  }\n}\n"],"mappings":";;;;AAKA,eAAsB,sBACpB,WACA,QACA,KACA,KACA,OACe;AACf,KAAI,UAAU,WAAW,EAAG;AAC5B,KAAI,QAAQ,QAAS;CAErB,MAAM,OAAO,MAAM,IAAI,0BAA0B;CACjD,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK,MAAM,EAAE,eAAe,CAAC;AAExD,MAAK,MAAM,UAAU,WAAW;EAC9B,MAAM,WAAW,+BAA+B,QAAQ,KAAK,OAAO;EACpE,MAAM,MAAM,eAAe;AAC3B,MAAI,CAAC,MAAM,IAAI,SAAS,CAAE;AAE1B,QAAM,IAAI,KAAK;GACb,MAAM;GACN,aAAa,OAAO;GACpB,aAAa;GACb,4BAAW,IAAI,MAAM,EAAC,aAAa;GACnC,4BAAW,IAAI,MAAM,EAAC,aAAa;GACpC,CAAC;;;;;;;;;;;;;;;;;;ACJN,eAAsB,cACpB,WACA,QACA,KACA,KACA,OACe;AACf,KAAI,UAAU,WAAW,EAAG;CAC5B,MAAM,aAAa,UAAU,QAAQ,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACzE,KAAI,WAAW,WAAW,EAAG;CAE7B,MAAM,4BAAY,IAAI,KAGnB;AAEH,MAAK,MAAM,UAAU,YAAY;EAC/B,IAAI,OAAO,UAAU,IAAI,OAAO,OAAO;AACvC,MAAI,CAAC,MAAM;AACT,UAAO,MAAM,IAAI,qBAAqB,OAAO,OAAO;AACpD,aAAU,IAAI,OAAO,QAAQ,KAAK;;EAEpC,MAAM,SAAS,uBAAuB,QAAQ,KAAK,OAAO,YAAY;EACtE,MAAM,UAAU,KAAK,MAClB,MACC,EAAE,SAAS,OAAO,QAClB,OAAO,EAAE,YAAY,YACrB,EAAE,QAAQ,WAAW,OAAO,CAC/B;AACD,MAAI,CAAC,QAAS;EACd,MAAM,WAAW,kBAAkB,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK;EAC3E,MAAM,sBAAK,IAAI,MAAM,EAAC,aAAa;EACnC,MAAMA,QAA6B;GACjC,MAAM;GACN,aAAa,OAAO;GACpB,QAAQ,OAAO;GACf,YAAY,OAAO;GACnB,MAAM,QAAQ;GACd,SAAS,QAAQ;GACjB,KAAK,QAAQ,OAAO;GACpB,SAAS,QAAQ,WAAW;GAC5B,UAAU,QAAQ;GAClB,SAAS,QAAQ,WAAW;GAC5B,UAAU,QAAQ;GAClB,WAAW,MAAM,IAAI,SAAS,EAAE,SAAS,eACpC,MAAM,IAAI,SAAS,CAAyB,YAC7C;GACJ,WAAW;GACZ;AACD,QAAM,IAAI,UAAU,MAAM"}

package/dist/drift-DRnwTyZD.mjs

@@ -0,0 +1,10 @@
+import "./loader-DnT9iqz9.mjs";
+import "./fetchStackImports-ClUYZy_U.mjs";
+import "./StateManager-JLBtz9V-.mjs";
+import "./r2S3EmptyBucket-DD81ZWQ7.mjs";
+import { n as runDrift, t as computeDriftReport } from "./drift-DncpkI2R.mjs";
+import "./logpush-job-DsRkOORJ.mjs";
+import "./worker-route-DY1onr-h.mjs";
+import "./workers-DNKsZOq4.mjs";
+
+export { runDrift };

package/dist/{drift-B5bpkI0i.mjs → drift-DncpkI2R.mjs}

@@ -1,12 +1,12 @@
 import { f as getDispatchNamespaces, m as getLogpushJobs, p as getDnsRecords } from "./normalize-DVSTRZhO.mjs";
-import { n as loadConfig, t as getWorkers } from "./loader-DAvCKLTT.mjs";
+import { n as loadConfig, t as getWorkers } from "./loader-DnT9iqz9.mjs";
 import { n as cloudflareAccountIdFromEnv, t as CFApiClient } from "./CFApiClient-DhbyyV71.mjs";
-import { _ as namingFromConfig, a as resourceModules, t as fetchStackImports, u as mergeWorkerConfigForResourcePick } from "./fetchStackImports-C-1THPYL.mjs";
-import { a as tenantStateKey, f as stackNameForConfig, o as effectiveDispatchNamespaceName, t as StateManager } from "./StateManager-DTqtLLVX.mjs";
+import { a as resourceModules, d as mergeWorkerConfigForResourcePick, t as fetchStackImports, v as namingFromConfig } from "./fetchStackImports-ClUYZy_U.mjs";
+import { a as tenantStateKey, f as stackNameForConfig, o as effectiveDispatchNamespaceName, t as StateManager } from "./StateManager-JLBtz9V-.mjs";
 import { n as dnsRecordCommentMarker, r as dnsRecordStateKey, t as dnsRecordAppliesToEnv } from "./dns-records.resolve-DwBR_1WI.mjs";
 import { r as logpushJobDrift } from "./logpush-job-DsRkOORJ.mjs";
-import { t as workerRoutesDrift } from "./worker-route-CMbtozNa.mjs";
-import { t as workersDrift } from "./workers-C-oeZhdD.mjs";
+import { t as workerRoutesDrift } from "./worker-route-DY1onr-h.mjs";
+import { t as workersDrift } from "./workers-DNKsZOq4.mjs";
 
 //#region src/features/dispatch-namespace/dispatch-namespace.drift.ts
 function dispatchNamespaceDrift(allDispatch, resources, env, tenant, state) {
@@ -320,4 +320,4 @@ function suffix(cfId) {
 
 //#endregion
 export { runDrift as n, computeDriftReport as t };
-//# sourceMappingURL=drift-B5bpkI0i.mjs.map
+//# sourceMappingURL=drift-DncpkI2R.mjs.map