@dragonmastery/tamer 0.29.0 → 0.30.0

package/dist/{provision-tenant-Wfck-2Oa.mjs.map → provision-tenant-BcZocyyn.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"provision-tenant-Wfck-2Oa.mjs","names":["result: ProvisionTenantResult","allD1: Awaited<ReturnType<typeof api.d1ListAll>> | null","shards: TenantD1ShardRef[]","form: FormData"],"sources":["../src/cli/commands/provision-tenant.ts"],"sourcesContent":["import { basename, resolve } from \"path\";\nimport { loadConfig } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { getDispatchNamespaces } from \"../../types.js\";\nimport { effectiveDispatchNamespaceName } from \"../../features/dispatch-namespace/dispatch-namespace.resolve.js\";\nimport {\n  parseTenantShardRoles,\n  tenantDispatchScriptName,\n  tenantShardDatabaseName,\n  tenantStateKey,\n} from \"../../core/tenant/tenantKeys.js\";\nimport {\n  buildSingleModuleDispatchForm,\n  buildSingleModuleDispatchFormFromBuffer,\n} from \"../../core/wfp/buildDispatchUploadForm.js\";\nimport { tamerArtifactsBucketName } from \"../../core/state/tamerArtifactsR2.js\";\nimport { logApplyChange } from \"../../core/plan/planFormat.js\";\nimport type { TenantD1ShardRef, TenantStateEntry } from \"../../types.js\";\n\nconst now = (): string => new Date().toISOString();\n\nfunction buildTenantEntry(\n  options: {\n    product: string;\n    workspace: string;\n    dispatchNamespaceName: string;\n    scriptName: string;\n  },\n  status: TenantStateEntry[\"provisioningStatus\"],\n  existing: TenantStateEntry | undefined,\n  patch?: Partial<Pick<TenantStateEntry, \"d1Shards\">>,\n): TenantStateEntry {\n  return {\n    product: options.product,\n    workspace: options.workspace,\n    provisioningStatus: status,\n    dispatchNamespaceName: options.dispatchNamespaceName,\n    scriptName: options.scriptName,\n    d1Shards: patch?.d1Shards ?? existing?.d1Shards,\n    createdAt: existing?.createdAt ?? now(),\n    updatedAt: now(),\n  };\n}\n\n/**\n * Resolve the effective shard set for this provision call.\n *\n *   1. The configured layout (`tenant.d1Shards` in `tamer.config.ts`)\n *      is the source of truth — any role used by `--shards` must\n *      appear here, and `apply` / `drift` / other operators read the\n *      same shape.\n *   2. When `--shards a,b` is passed, trim to that subset (preserving\n *      configured order so plan/provision logs stay deterministic).\n *      Extending the layout is an edit to `tamer.config.ts`, not a\n *      CLI flag — that's why `parseTenantShardRoles` rejects roles\n *      outside the configured set.\n *   3. When the config has no `tenant.d1Shards`, the resolved set is\n *      empty: `provision-tenant` only uploads the dispatch script\n *      (truly generic single-Worker tenant case).\n */\nfunction resolveShardRoles(\n  configured: readonly string[],\n  shardsRaw: string | undefined,\n): string[] {\n  if (shardsRaw == null || shardsRaw.trim() === \"\") return [...configured];\n  return parseTenantShardRoles(shardsRaw, configured);\n}\n\n/**\n * Idempotent tenant provisioning. Each call:\n *\n *   1. Marks the tenant `pending` if there's no record yet.\n *   2. For every shard role declared in `tenant.d1Shards` in\n *      `tamer.config.ts` (or a `--shards` subset): looks up an\n *      existing D1 by derived name (`tenantShardDatabaseName(role,\n *      …)`), creating it via `d1Create` only when missing. Persists\n *      the `(role, derivedName, cfId)` triple to\n *      `state.tenants[…].d1Shards[]`.\n *   3. Marks the tenant `d1_created` once *all* requested shards\n *      exist in state.\n *   4. Uploads the dispatch script (from `--main` or `--artifact-key`)\n *      via the WFP dispatch namespace.\n *   5. Marks the tenant `ready`.\n *\n * When `tenant.d1Shards` is omitted, step 2/3 collapse to a no-op\n * (truly generic single-Worker tenant — only the dispatch script is\n * provisioned). Re-running with the same shard set is a no-op (state\n * already has those rows). Editing `tamer.config.ts` to **extend**\n * the layout (e.g. adding a new role) and re-running picks up the\n * missing shards without disturbing existing ones, so a tenant\n * created with `[\"app\"]` can be migrated to `[\"system\",\"app\",\n * \"history\"]` (or `[\"primary\",\"audit\"]`, or any other set) with one\n * config edit + one `provision-tenant` invocation. Re-running after\n * a config that **shrinks** the layout never deletes shards (use\n * `destroy-tenant` for that).\n */\n/**\n * Machine-readable result envelope emitted on the final stdout line\n * when `--json` is passed. Designed for the Cloudflare Container caller\n * (`provision-workflow`, see `docs/handoff.md` §7) so the Worker can\n * parse the result without scraping human logs. On success the Workflow\n * sees `status: \"ready\"` plus the materialized tenant shape; on\n * failure it sees `status: \"failed\"` with `error` + best-effort\n * `partial` state, and the process exits non-zero.\n */\nexport interface ProvisionTenantResult {\n  status: \"ready\" | \"failed\" | \"noop\";\n  tenantKey: string;\n  product: string;\n  workspace: string;\n  env: string;\n  scriptName: string;\n  dispatchNamespaceName: string;\n  shards: { role: string; derivedName: string; cfId: string }[];\n  error?: string;\n}\n\nexport async function runProvisionTenant(options: {\n  env: string;\n  product: string;\n  workspace: string;\n  main?: string;\n  artifactKey?: string;\n  moduleName?: string;\n  configPath?: string;\n  compatibilityDate?: string;\n  compatibilityFlags?: string[];\n  /**\n   * Raw `--shards` value (`\"system,app\"` etc.) — validated against\n   * `tenant.d1Shards` from the loaded config. Omit to provision every\n   * configured shard.\n   */\n  shardsRaw?: string;\n  json?: boolean;\n}): Promise<void> {\n  const env = options.env;\n  if (env === \"local\") {\n    throw new Error(\n      \"provision-tenant requires a non-local --env (Cloudflare-backed state).\",\n    );\n  }\n\n  try {\n    await provisionTenantInner(options);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    if (options.json) {\n      // Failure envelope: we may have died before loadConfig, so we\n      // can't ask `tenant.ephemeralEnvPattern` whether `env` would\n      // get the `-{env}` suffix. Emit the non-ephemeral form as a\n      // best-effort hint — `error` carries the real signal.\n      const result: ProvisionTenantResult = {\n        status: \"failed\",\n        tenantKey: tenantStateKey(options.product, options.workspace),\n        product: options.product,\n        workspace: options.workspace,\n        env,\n        scriptName: `${options.product}-${options.workspace}`,\n        dispatchNamespaceName: \"\",\n        shards: [],\n        error: msg,\n      };\n      process.stdout.write(JSON.stringify(result) + \"\\n\");\n    }\n    // Container caller (provision-workflow) reads exit code as\n    // primary success/failure signal; JSON envelope on stdout is\n    // secondary detail. Re-throw so the CLI surfaces the original\n    // error in human mode.\n    throw err;\n  }\n}\n\nasync function provisionTenantInner(options: {\n  env: string;\n  product: string;\n  workspace: string;\n  main?: string;\n  artifactKey?: string;\n  moduleName?: string;\n  configPath?: string;\n  compatibilityDate?: string;\n  compatibilityFlags?: string[];\n  shardsRaw?: string;\n  json?: boolean;\n}): Promise<void> {\n  const env = options.env;\n  const config = await loadConfig(options.configPath, { env });\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const dns = getDispatchNamespaces(config);\n  if (dns.length === 0) {\n    throw new Error(\n      \"provision-tenant requires at least one dispatch namespace in the Tamer project config (dispatchNamespaces).\",\n    );\n  }\n  const nsConfig = dns[0]!;\n  const dispatchNamespaceName = effectiveDispatchNamespaceName(\n    nsConfig,\n    env,\n    config.tenant,\n  );\n  const scriptName = tenantDispatchScriptName(\n    options.product,\n    options.workspace,\n    env,\n    config.tenant,\n  );\n  const desiredRoles = resolveShardRoles(\n    config.tenant.d1Shards ?? [],\n    options.shardsRaw,\n  );\n\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n\n  let existing = state.getTenant(options.product, options.workspace);\n  // \"ready\" is a no-op only when the existing layout already covers\n  // every requested shard role. Adding a new role re-opens the tenant\n  // for incremental provisioning without forcing a full re-deploy.\n  if (existing?.provisioningStatus === \"ready\") {\n    const have = new Set((existing.d1Shards ?? []).map((s) => s.role));\n    const missing = desiredRoles.filter((r) => !have.has(r));\n    if (missing.length === 0) {\n      console.log(\n        `Tenant ${tenantStateKey(options.product, options.workspace)} already ready; nothing to do.`,\n      );\n      if (options.json) {\n        const result: ProvisionTenantResult = {\n          status: \"noop\",\n          tenantKey: tenantStateKey(options.product, options.workspace),\n          product: options.product,\n          workspace: options.workspace,\n          env,\n          scriptName,\n          dispatchNamespaceName,\n          shards: (existing.d1Shards ?? []).map((s) => ({\n            role: s.role,\n            derivedName: s.derivedName,\n            cfId: s.cfId,\n          })),\n        };\n        process.stdout.write(JSON.stringify(result) + \"\\n\");\n      }\n      return;\n    }\n    console.log(\n      `Tenant ${tenantStateKey(options.product, options.workspace)} ready but missing shards: ${missing.join(\", \")}; extending layout.`,\n    );\n  }\n\n  const compatDate =\n    options.compatibilityDate ??\n    config.compatibility_date ??\n    new Date().toISOString().slice(0, 10);\n\n  const entryOpts = {\n    product: options.product,\n    workspace: options.workspace,\n    dispatchNamespaceName,\n    scriptName,\n  };\n\n  if (!existing) {\n    state.setTenant(buildTenantEntry(entryOpts, \"pending\", undefined));\n    await state.persist(api);\n    existing = state.getTenant(options.product, options.workspace)!;\n  }\n\n  // Reconcile each requested shard role. We list D1 once per call when\n  // we need to (some role is missing from state) and reuse the result\n  // for every subsequent role.\n  let allD1: Awaited<ReturnType<typeof api.d1ListAll>> | null = null;\n  const shards: TenantD1ShardRef[] = [...(existing.d1Shards ?? [])];\n\n  for (const role of desiredRoles) {\n    if (shards.find((s) => s.role === role)) continue;\n    const derivedName = tenantShardDatabaseName(\n      role,\n      options.workspace,\n      options.product,\n      config.tenant.id,\n      env,\n    );\n    if (allD1 === null) {\n      allD1 = await api.d1ListAll();\n    }\n    let cfId = allD1.find((d) => d.name === derivedName)?.uuid;\n    if (cfId) {\n      // Adopt an existing D1 (e.g. partial-failure resume, or\n      // operator created it out-of-band) without re-issuing POST.\n      logApplyChange({\n        kind: \"d1\",\n        action: \"no_change\",\n        logical: `${role}-shard`,\n        derived: derivedName,\n      });\n    } else {\n      logApplyChange({\n        kind: \"d1\",\n        action: \"create\",\n        logical: `${role}-shard`,\n        derived: derivedName,\n      });\n      const created = await api.d1Create(derivedName);\n      cfId = created.uuid;\n    }\n    shards.push({ role, derivedName, cfId });\n    // Persist after each shard so a network failure mid-loop leaves\n    // the already-created shards recorded — `provision-tenant` is\n    // resumable role-by-role.\n    state.setTenant(\n      buildTenantEntry(entryOpts, \"d1_created\", existing, { d1Shards: shards }),\n    );\n    await state.persist(api);\n    existing = state.getTenant(options.product, options.workspace)!;\n  }\n\n  let form: FormData;\n  if (options.main) {\n    const mainPath = resolve(process.cwd(), options.main);\n    form = buildSingleModuleDispatchForm(mainPath, {\n      compatibility_date: compatDate,\n      compatibility_flags: options.compatibilityFlags,\n    });\n  } else if (options.artifactKey) {\n    const bucket = tamerArtifactsBucketName(env);\n    const body = await api.r2GetObject(bucket, options.artifactKey);\n    const mod =\n      options.moduleName?.trim() ||\n      basename(options.artifactKey).replace(/\\.(zip|tar|gz)$/i, \"\") ||\n      \"worker.js\";\n    form = buildSingleModuleDispatchFormFromBuffer(mod, body, {\n      compatibility_date: compatDate,\n      compatibility_flags: options.compatibilityFlags,\n    });\n  } else {\n    throw new Error(\"provision-tenant: provide --main or --artifact-key\");\n  }\n\n  await api.dispatchNamespaceScriptPut(dispatchNamespaceName, scriptName, form);\n\n  state.setTenant(\n    buildTenantEntry(entryOpts, \"ready\", existing, { d1Shards: shards }),\n  );\n  await state.persist(api);\n\n  const shardsSummary =\n    shards.length > 0\n      ? `shards: ${shards.map((s) => s.role).join(\", \")}`\n      : \"no shards declared\";\n  console.log(\n    `Provisioned tenant ${tenantStateKey(options.product, options.workspace)} → script ${scriptName} in ${dispatchNamespaceName} (${shardsSummary})`,\n  );\n\n  if (options.json) {\n    const result: ProvisionTenantResult = {\n      status: \"ready\",\n      tenantKey: tenantStateKey(options.product, options.workspace),\n      product: options.product,\n      workspace: options.workspace,\n      env,\n      scriptName,\n      dispatchNamespaceName,\n      shards: shards.map((s) => ({\n        role: s.role,\n        derivedName: s.derivedName,\n        cfId: s.cfId,\n      })),\n    };\n    process.stdout.write(JSON.stringify(result) + \"\\n\");\n  }\n}\n"],"mappings":";;;;;;;;;;;AAsBA,MAAM,6BAAoB,IAAI,MAAM,EAAC,aAAa;AAElD,SAAS,iBACP,SAMA,QACA,UACA,OACkB;AAClB,QAAO;EACL,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB,oBAAoB;EACpB,uBAAuB,QAAQ;EAC/B,YAAY,QAAQ;EACpB,UAAU,OAAO,YAAY,UAAU;EACvC,WAAW,UAAU,aAAa,KAAK;EACvC,WAAW,KAAK;EACjB;;;;;;;;;;;;;;;;;;AAmBH,SAAS,kBACP,YACA,WACU;AACV,KAAI,aAAa,QAAQ,UAAU,MAAM,KAAK,GAAI,QAAO,CAAC,GAAG,WAAW;AACxE,QAAO,sBAAsB,WAAW,WAAW;;AAoDrD,eAAsB,mBAAmB,SAiBvB;CAChB,MAAM,MAAM,QAAQ;AACpB,KAAI,QAAQ,QACV,OAAM,IAAI,MACR,yEACD;AAGH,KAAI;AACF,QAAM,qBAAqB,QAAQ;UAC5B,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,MAAI,QAAQ,MAAM;GAKhB,MAAMA,SAAgC;IACpC,QAAQ;IACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;IAC7D,SAAS,QAAQ;IACjB,WAAW,QAAQ;IACnB;IACA,YAAY,GAAG,QAAQ,QAAQ,GAAG,QAAQ;IAC1C,uBAAuB;IACvB,QAAQ,EAAE;IACV,OAAO;IACR;AACD,WAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK;;AAMrD,QAAM;;;AAIV,eAAe,qBAAqB,SAYlB;CAChB,MAAM,MAAM,QAAQ;CACpB,MAAM,SAAS,MAAM,WAAW,QAAQ,YAAY,EAAE,KAAK,CAAC;CAC5D,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,MAAM,sBAAsB,OAAO;AACzC,KAAI,IAAI,WAAW,EACjB,OAAM,IAAI,MACR,8GACD;CAEH,MAAM,WAAW,IAAI;CACrB,MAAM,wBAAwB,+BAC5B,UACA,KACA,OAAO,OACR;CACD,MAAM,aAAa,yBACjB,QAAQ,SACR,QAAQ,WACR,KACA,OAAO,OACR;CACD,MAAM,eAAe,kBACnB,OAAO,OAAO,YAAY,EAAE,EAC5B,QAAQ,UACT;CAED,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,IAAI,WAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;AAIlE,KAAI,UAAU,uBAAuB,SAAS;EAC5C,MAAM,OAAO,IAAI,KAAK,SAAS,YAAY,EAAE,EAAE,KAAK,MAAM,EAAE,KAAK,CAAC;EAClE,MAAM,UAAU,aAAa,QAAQ,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;AACxD,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAQ,IACN,UAAU,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,gCAC9D;AACD,OAAI,QAAQ,MAAM;IAChB,MAAMA,SAAgC;KACpC,QAAQ;KACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;KAC7D,SAAS,QAAQ;KACjB,WAAW,QAAQ;KACnB;KACA;KACA;KACA,SAAS,SAAS,YAAY,EAAE,EAAE,KAAK,OAAO;MAC5C,MAAM,EAAE;MACR,aAAa,EAAE;MACf,MAAM,EAAE;MACT,EAAE;KACJ;AACD,YAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK;;AAErD;;AAEF,UAAQ,IACN,UAAU,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,6BAA6B,QAAQ,KAAK,KAAK,CAAC,qBAC9G;;CAGH,MAAM,aACJ,QAAQ,qBACR,OAAO,uCACP,IAAI,MAAM,EAAC,aAAa,CAAC,MAAM,GAAG,GAAG;CAEvC,MAAM,YAAY;EAChB,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB;EACA;EACD;AAED,KAAI,CAAC,UAAU;AACb,QAAM,UAAU,iBAAiB,WAAW,WAAW,OAAU,CAAC;AAClE,QAAM,MAAM,QAAQ,IAAI;AACxB,aAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;;CAMhE,IAAIC,QAA0D;CAC9D,MAAMC,SAA6B,CAAC,GAAI,SAAS,YAAY,EAAE,CAAE;AAEjE,MAAK,MAAM,QAAQ,cAAc;AAC/B,MAAI,OAAO,MAAM,MAAM,EAAE,SAAS,KAAK,CAAE;EACzC,MAAM,cAAc,wBAClB,MACA,QAAQ,WACR,QAAQ,SACR,OAAO,OAAO,IACd,IACD;AACD,MAAI,UAAU,KACZ,SAAQ,MAAM,IAAI,WAAW;EAE/B,IAAI,OAAO,MAAM,MAAM,MAAM,EAAE,SAAS,YAAY,EAAE;AACtD,MAAI,KAGF,gBAAe;GACb,MAAM;GACN,QAAQ;GACR,SAAS,GAAG,KAAK;GACjB,SAAS;GACV,CAAC;OACG;AACL,kBAAe;IACb,MAAM;IACN,QAAQ;IACR,SAAS,GAAG,KAAK;IACjB,SAAS;IACV,CAAC;AAEF,WADgB,MAAM,IAAI,SAAS,YAAY,EAChC;;AAEjB,SAAO,KAAK;GAAE;GAAM;GAAa;GAAM,CAAC;AAIxC,QAAM,UACJ,iBAAiB,WAAW,cAAc,UAAU,EAAE,UAAU,QAAQ,CAAC,CAC1E;AACD,QAAM,MAAM,QAAQ,IAAI;AACxB,aAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;;CAGhE,IAAIC;AACJ,KAAI,QAAQ,KAEV,QAAO,8BADU,QAAQ,QAAQ,KAAK,EAAE,QAAQ,KAAK,EACN;EAC7C,oBAAoB;EACpB,qBAAqB,QAAQ;EAC9B,CAAC;UACO,QAAQ,aAAa;EAC9B,MAAM,SAAS,yBAAyB,IAAI;EAC5C,MAAM,OAAO,MAAM,IAAI,YAAY,QAAQ,QAAQ,YAAY;AAK/D,SAAO,wCAHL,QAAQ,YAAY,MAAM,IAC1B,SAAS,QAAQ,YAAY,CAAC,QAAQ,oBAAoB,GAAG,IAC7D,aACkD,MAAM;GACxD,oBAAoB;GACpB,qBAAqB,QAAQ;GAC9B,CAAC;OAEF,OAAM,IAAI,MAAM,qDAAqD;AAGvE,OAAM,IAAI,2BAA2B,uBAAuB,YAAY,KAAK;AAE7E,OAAM,UACJ,iBAAiB,WAAW,SAAS,UAAU,EAAE,UAAU,QAAQ,CAAC,CACrE;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,MAAM,gBACJ,OAAO,SAAS,IACZ,WAAW,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK,KAC/C;AACN,SAAQ,IACN,sBAAsB,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,YAAY,WAAW,MAAM,sBAAsB,IAAI,cAAc,GAC/I;AAED,KAAI,QAAQ,MAAM;EAChB,MAAMH,SAAgC;GACpC,QAAQ;GACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;GAC7D,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB;GACA;GACA;GACA,QAAQ,OAAO,KAAK,OAAO;IACzB,MAAM,EAAE;IACR,aAAa,EAAE;IACf,MAAM,EAAE;IACT,EAAE;GACJ;AACD,UAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK"}
+{"version":3,"file":"provision-tenant-BcZocyyn.mjs","names":["result: ProvisionTenantResult","allD1: Awaited<ReturnType<typeof api.d1ListAll>> | null","shards: TenantD1ShardRef[]","form: FormData"],"sources":["../src/cli/commands/provision-tenant.ts"],"sourcesContent":["import { basename, resolve } from \"path\";\nimport { loadConfig } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { getDispatchNamespaces } from \"../../types.js\";\nimport { effectiveDispatchNamespaceName } from \"../../features/dispatch-namespace/dispatch-namespace.resolve.js\";\nimport {\n  parseTenantShardRoles,\n  tenantDispatchScriptName,\n  tenantShardDatabaseName,\n  tenantStateKey,\n} from \"../../core/tenant/tenantKeys.js\";\nimport {\n  buildSingleModuleDispatchForm,\n  buildSingleModuleDispatchFormFromBuffer,\n} from \"../../core/wfp/buildDispatchUploadForm.js\";\nimport { tamerArtifactsBucketName } from \"../../core/state/tamerArtifactsR2.js\";\nimport { logApplyChange } from \"../../core/plan/planFormat.js\";\nimport type { TenantD1ShardRef, TenantStateEntry } from \"../../types.js\";\n\nconst now = (): string => new Date().toISOString();\n\nfunction buildTenantEntry(\n  options: {\n    product: string;\n    workspace: string;\n    dispatchNamespaceName: string;\n    scriptName: string;\n  },\n  status: TenantStateEntry[\"provisioningStatus\"],\n  existing: TenantStateEntry | undefined,\n  patch?: Partial<Pick<TenantStateEntry, \"d1Shards\">>,\n): TenantStateEntry {\n  return {\n    product: options.product,\n    workspace: options.workspace,\n    provisioningStatus: status,\n    dispatchNamespaceName: options.dispatchNamespaceName,\n    scriptName: options.scriptName,\n    d1Shards: patch?.d1Shards ?? existing?.d1Shards,\n    createdAt: existing?.createdAt ?? now(),\n    updatedAt: now(),\n  };\n}\n\n/**\n * Resolve the effective shard set for this provision call.\n *\n *   1. The configured layout (`tenant.d1Shards` in `tamer.config.ts`)\n *      is the source of truth — any role used by `--shards` must\n *      appear here, and `apply` / `drift` / other operators read the\n *      same shape.\n *   2. When `--shards a,b` is passed, trim to that subset (preserving\n *      configured order so plan/provision logs stay deterministic).\n *      Extending the layout is an edit to `tamer.config.ts`, not a\n *      CLI flag — that's why `parseTenantShardRoles` rejects roles\n *      outside the configured set.\n *   3. When the config has no `tenant.d1Shards`, the resolved set is\n *      empty: `provision-tenant` only uploads the dispatch script\n *      (truly generic single-Worker tenant case).\n */\nfunction resolveShardRoles(\n  configured: readonly string[],\n  shardsRaw: string | undefined,\n): string[] {\n  if (shardsRaw == null || shardsRaw.trim() === \"\") return [...configured];\n  return parseTenantShardRoles(shardsRaw, configured);\n}\n\n/**\n * Idempotent tenant provisioning. Each call:\n *\n *   1. Marks the tenant `pending` if there's no record yet.\n *   2. For every shard role declared in `tenant.d1Shards` in\n *      `tamer.config.ts` (or a `--shards` subset): looks up an\n *      existing D1 by derived name (`tenantShardDatabaseName(role,\n *      …)`), creating it via `d1Create` only when missing. Persists\n *      the `(role, derivedName, cfId)` triple to\n *      `state.tenants[…].d1Shards[]`.\n *   3. Marks the tenant `d1_created` once *all* requested shards\n *      exist in state.\n *   4. Uploads the dispatch script (from `--main` or `--artifact-key`)\n *      via the WFP dispatch namespace.\n *   5. Marks the tenant `ready`.\n *\n * When `tenant.d1Shards` is omitted, step 2/3 collapse to a no-op\n * (truly generic single-Worker tenant — only the dispatch script is\n * provisioned). Re-running with the same shard set is a no-op (state\n * already has those rows). Editing `tamer.config.ts` to **extend**\n * the layout (e.g. adding a new role) and re-running picks up the\n * missing shards without disturbing existing ones, so a tenant\n * created with `[\"app\"]` can be migrated to `[\"system\",\"app\",\n * \"history\"]` (or `[\"primary\",\"audit\"]`, or any other set) with one\n * config edit + one `provision-tenant` invocation. Re-running after\n * a config that **shrinks** the layout never deletes shards (use\n * `destroy-tenant` for that).\n */\n/**\n * Machine-readable result envelope emitted on the final stdout line\n * when `--json` is passed. Designed for the Cloudflare Container caller\n * (`provision-workflow`, see `docs/handoff.md` §7) so the Worker can\n * parse the result without scraping human logs. On success the Workflow\n * sees `status: \"ready\"` plus the materialized tenant shape; on\n * failure it sees `status: \"failed\"` with `error` + best-effort\n * `partial` state, and the process exits non-zero.\n */\nexport interface ProvisionTenantResult {\n  status: \"ready\" | \"failed\" | \"noop\";\n  tenantKey: string;\n  product: string;\n  workspace: string;\n  env: string;\n  scriptName: string;\n  dispatchNamespaceName: string;\n  shards: { role: string; derivedName: string; cfId: string }[];\n  error?: string;\n}\n\nexport async function runProvisionTenant(options: {\n  env: string;\n  product: string;\n  workspace: string;\n  main?: string;\n  artifactKey?: string;\n  moduleName?: string;\n  configPath?: string;\n  compatibilityDate?: string;\n  compatibilityFlags?: string[];\n  /**\n   * Raw `--shards` value (`\"system,app\"` etc.) — validated against\n   * `tenant.d1Shards` from the loaded config. Omit to provision every\n   * configured shard.\n   */\n  shardsRaw?: string;\n  json?: boolean;\n}): Promise<void> {\n  const env = options.env;\n  if (env === \"local\") {\n    throw new Error(\n      \"provision-tenant requires a non-local --env (Cloudflare-backed state).\",\n    );\n  }\n\n  try {\n    await provisionTenantInner(options);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    if (options.json) {\n      // Failure envelope: we may have died before loadConfig, so we\n      // can't ask `tenant.ephemeralEnvPattern` whether `env` would\n      // get the `-{env}` suffix. Emit the non-ephemeral form as a\n      // best-effort hint — `error` carries the real signal.\n      const result: ProvisionTenantResult = {\n        status: \"failed\",\n        tenantKey: tenantStateKey(options.product, options.workspace),\n        product: options.product,\n        workspace: options.workspace,\n        env,\n        scriptName: `${options.product}-${options.workspace}`,\n        dispatchNamespaceName: \"\",\n        shards: [],\n        error: msg,\n      };\n      process.stdout.write(JSON.stringify(result) + \"\\n\");\n    }\n    // Container caller (provision-workflow) reads exit code as\n    // primary success/failure signal; JSON envelope on stdout is\n    // secondary detail. Re-throw so the CLI surfaces the original\n    // error in human mode.\n    throw err;\n  }\n}\n\nasync function provisionTenantInner(options: {\n  env: string;\n  product: string;\n  workspace: string;\n  main?: string;\n  artifactKey?: string;\n  moduleName?: string;\n  configPath?: string;\n  compatibilityDate?: string;\n  compatibilityFlags?: string[];\n  shardsRaw?: string;\n  json?: boolean;\n}): Promise<void> {\n  const env = options.env;\n  const config = await loadConfig(options.configPath, { env });\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const dns = getDispatchNamespaces(config);\n  if (dns.length === 0) {\n    throw new Error(\n      \"provision-tenant requires at least one dispatch namespace in the Tamer project config (dispatchNamespaces).\",\n    );\n  }\n  const nsConfig = dns[0]!;\n  const dispatchNamespaceName = effectiveDispatchNamespaceName(\n    nsConfig,\n    env,\n    config.tenant,\n  );\n  const scriptName = tenantDispatchScriptName(\n    options.product,\n    options.workspace,\n    env,\n    config.tenant,\n  );\n  const desiredRoles = resolveShardRoles(\n    config.tenant.d1Shards ?? [],\n    options.shardsRaw,\n  );\n\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n\n  let existing = state.getTenant(options.product, options.workspace);\n  // \"ready\" is a no-op only when the existing layout already covers\n  // every requested shard role. Adding a new role re-opens the tenant\n  // for incremental provisioning without forcing a full re-deploy.\n  if (existing?.provisioningStatus === \"ready\") {\n    const have = new Set((existing.d1Shards ?? []).map((s) => s.role));\n    const missing = desiredRoles.filter((r) => !have.has(r));\n    if (missing.length === 0) {\n      console.log(\n        `Tenant ${tenantStateKey(options.product, options.workspace)} already ready; nothing to do.`,\n      );\n      if (options.json) {\n        const result: ProvisionTenantResult = {\n          status: \"noop\",\n          tenantKey: tenantStateKey(options.product, options.workspace),\n          product: options.product,\n          workspace: options.workspace,\n          env,\n          scriptName,\n          dispatchNamespaceName,\n          shards: (existing.d1Shards ?? []).map((s) => ({\n            role: s.role,\n            derivedName: s.derivedName,\n            cfId: s.cfId,\n          })),\n        };\n        process.stdout.write(JSON.stringify(result) + \"\\n\");\n      }\n      return;\n    }\n    console.log(\n      `Tenant ${tenantStateKey(options.product, options.workspace)} ready but missing shards: ${missing.join(\", \")}; extending layout.`,\n    );\n  }\n\n  const compatDate =\n    options.compatibilityDate ??\n    config.compatibility_date ??\n    new Date().toISOString().slice(0, 10);\n\n  const entryOpts = {\n    product: options.product,\n    workspace: options.workspace,\n    dispatchNamespaceName,\n    scriptName,\n  };\n\n  if (!existing) {\n    state.setTenant(buildTenantEntry(entryOpts, \"pending\", undefined));\n    await state.persist(api);\n    existing = state.getTenant(options.product, options.workspace)!;\n  }\n\n  // Reconcile each requested shard role. We list D1 once per call when\n  // we need to (some role is missing from state) and reuse the result\n  // for every subsequent role.\n  let allD1: Awaited<ReturnType<typeof api.d1ListAll>> | null = null;\n  const shards: TenantD1ShardRef[] = [...(existing.d1Shards ?? [])];\n\n  for (const role of desiredRoles) {\n    if (shards.find((s) => s.role === role)) continue;\n    const derivedName = tenantShardDatabaseName(\n      role,\n      options.workspace,\n      options.product,\n      config.tenant.id,\n      env,\n    );\n    if (allD1 === null) {\n      allD1 = await api.d1ListAll();\n    }\n    let cfId = allD1.find((d) => d.name === derivedName)?.uuid;\n    if (cfId) {\n      // Adopt an existing D1 (e.g. partial-failure resume, or\n      // operator created it out-of-band) without re-issuing POST.\n      logApplyChange({\n        kind: \"d1\",\n        action: \"no_change\",\n        logical: `${role}-shard`,\n        derived: derivedName,\n      });\n    } else {\n      logApplyChange({\n        kind: \"d1\",\n        action: \"create\",\n        logical: `${role}-shard`,\n        derived: derivedName,\n      });\n      const created = await api.d1Create(derivedName);\n      cfId = created.uuid;\n    }\n    shards.push({ role, derivedName, cfId });\n    // Persist after each shard so a network failure mid-loop leaves\n    // the already-created shards recorded — `provision-tenant` is\n    // resumable role-by-role.\n    state.setTenant(\n      buildTenantEntry(entryOpts, \"d1_created\", existing, { d1Shards: shards }),\n    );\n    await state.persist(api);\n    existing = state.getTenant(options.product, options.workspace)!;\n  }\n\n  let form: FormData;\n  if (options.main) {\n    const mainPath = resolve(process.cwd(), options.main);\n    form = buildSingleModuleDispatchForm(mainPath, {\n      compatibility_date: compatDate,\n      compatibility_flags: options.compatibilityFlags,\n    });\n  } else if (options.artifactKey) {\n    const bucket = tamerArtifactsBucketName(env);\n    const body = await api.r2GetObject(bucket, options.artifactKey);\n    const mod =\n      options.moduleName?.trim() ||\n      basename(options.artifactKey).replace(/\\.(zip|tar|gz)$/i, \"\") ||\n      \"worker.js\";\n    form = buildSingleModuleDispatchFormFromBuffer(mod, body, {\n      compatibility_date: compatDate,\n      compatibility_flags: options.compatibilityFlags,\n    });\n  } else {\n    throw new Error(\"provision-tenant: provide --main or --artifact-key\");\n  }\n\n  await api.dispatchNamespaceScriptPut(dispatchNamespaceName, scriptName, form);\n\n  state.setTenant(\n    buildTenantEntry(entryOpts, \"ready\", existing, { d1Shards: shards }),\n  );\n  await state.persist(api);\n\n  const shardsSummary =\n    shards.length > 0\n      ? `shards: ${shards.map((s) => s.role).join(\", \")}`\n      : \"no shards declared\";\n  console.log(\n    `Provisioned tenant ${tenantStateKey(options.product, options.workspace)} → script ${scriptName} in ${dispatchNamespaceName} (${shardsSummary})`,\n  );\n\n  if (options.json) {\n    const result: ProvisionTenantResult = {\n      status: \"ready\",\n      tenantKey: tenantStateKey(options.product, options.workspace),\n      product: options.product,\n      workspace: options.workspace,\n      env,\n      scriptName,\n      dispatchNamespaceName,\n      shards: shards.map((s) => ({\n        role: s.role,\n        derivedName: s.derivedName,\n        cfId: s.cfId,\n      })),\n    };\n    process.stdout.write(JSON.stringify(result) + \"\\n\");\n  }\n}\n"],"mappings":";;;;;;;;;;;AAsBA,MAAM,6BAAoB,IAAI,MAAM,EAAC,aAAa;AAElD,SAAS,iBACP,SAMA,QACA,UACA,OACkB;AAClB,QAAO;EACL,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB,oBAAoB;EACpB,uBAAuB,QAAQ;EAC/B,YAAY,QAAQ;EACpB,UAAU,OAAO,YAAY,UAAU;EACvC,WAAW,UAAU,aAAa,KAAK;EACvC,WAAW,KAAK;EACjB;;;;;;;;;;;;;;;;;;AAmBH,SAAS,kBACP,YACA,WACU;AACV,KAAI,aAAa,QAAQ,UAAU,MAAM,KAAK,GAAI,QAAO,CAAC,GAAG,WAAW;AACxE,QAAO,sBAAsB,WAAW,WAAW;;AAoDrD,eAAsB,mBAAmB,SAiBvB;CAChB,MAAM,MAAM,QAAQ;AACpB,KAAI,QAAQ,QACV,OAAM,IAAI,MACR,yEACD;AAGH,KAAI;AACF,QAAM,qBAAqB,QAAQ;UAC5B,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,MAAI,QAAQ,MAAM;GAKhB,MAAMA,SAAgC;IACpC,QAAQ;IACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;IAC7D,SAAS,QAAQ;IACjB,WAAW,QAAQ;IACnB;IACA,YAAY,GAAG,QAAQ,QAAQ,GAAG,QAAQ;IAC1C,uBAAuB;IACvB,QAAQ,EAAE;IACV,OAAO;IACR;AACD,WAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK;;AAMrD,QAAM;;;AAIV,eAAe,qBAAqB,SAYlB;CAChB,MAAM,MAAM,QAAQ;CACpB,MAAM,SAAS,MAAM,WAAW,QAAQ,YAAY,EAAE,KAAK,CAAC;CAC5D,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,MAAM,sBAAsB,OAAO;AACzC,KAAI,IAAI,WAAW,EACjB,OAAM,IAAI,MACR,8GACD;CAEH,MAAM,WAAW,IAAI;CACrB,MAAM,wBAAwB,+BAC5B,UACA,KACA,OAAO,OACR;CACD,MAAM,aAAa,yBACjB,QAAQ,SACR,QAAQ,WACR,KACA,OAAO,OACR;CACD,MAAM,eAAe,kBACnB,OAAO,OAAO,YAAY,EAAE,EAC5B,QAAQ,UACT;CAED,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,IAAI,WAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;AAIlE,KAAI,UAAU,uBAAuB,SAAS;EAC5C,MAAM,OAAO,IAAI,KAAK,SAAS,YAAY,EAAE,EAAE,KAAK,MAAM,EAAE,KAAK,CAAC;EAClE,MAAM,UAAU,aAAa,QAAQ,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;AACxD,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAQ,IACN,UAAU,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,gCAC9D;AACD,OAAI,QAAQ,MAAM;IAChB,MAAMA,SAAgC;KACpC,QAAQ;KACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;KAC7D,SAAS,QAAQ;KACjB,WAAW,QAAQ;KACnB;KACA;KACA;KACA,SAAS,SAAS,YAAY,EAAE,EAAE,KAAK,OAAO;MAC5C,MAAM,EAAE;MACR,aAAa,EAAE;MACf,MAAM,EAAE;MACT,EAAE;KACJ;AACD,YAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK;;AAErD;;AAEF,UAAQ,IACN,UAAU,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,6BAA6B,QAAQ,KAAK,KAAK,CAAC,qBAC9G;;CAGH,MAAM,aACJ,QAAQ,qBACR,OAAO,uCACP,IAAI,MAAM,EAAC,aAAa,CAAC,MAAM,GAAG,GAAG;CAEvC,MAAM,YAAY;EAChB,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB;EACA;EACD;AAED,KAAI,CAAC,UAAU;AACb,QAAM,UAAU,iBAAiB,WAAW,WAAW,OAAU,CAAC;AAClE,QAAM,MAAM,QAAQ,IAAI;AACxB,aAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;;CAMhE,IAAIC,QAA0D;CAC9D,MAAMC,SAA6B,CAAC,GAAI,SAAS,YAAY,EAAE,CAAE;AAEjE,MAAK,MAAM,QAAQ,cAAc;AAC/B,MAAI,OAAO,MAAM,MAAM,EAAE,SAAS,KAAK,CAAE;EACzC,MAAM,cAAc,wBAClB,MACA,QAAQ,WACR,QAAQ,SACR,OAAO,OAAO,IACd,IACD;AACD,MAAI,UAAU,KACZ,SAAQ,MAAM,IAAI,WAAW;EAE/B,IAAI,OAAO,MAAM,MAAM,MAAM,EAAE,SAAS,YAAY,EAAE;AACtD,MAAI,KAGF,gBAAe;GACb,MAAM;GACN,QAAQ;GACR,SAAS,GAAG,KAAK;GACjB,SAAS;GACV,CAAC;OACG;AACL,kBAAe;IACb,MAAM;IACN,QAAQ;IACR,SAAS,GAAG,KAAK;IACjB,SAAS;IACV,CAAC;AAEF,WADgB,MAAM,IAAI,SAAS,YAAY,EAChC;;AAEjB,SAAO,KAAK;GAAE;GAAM;GAAa;GAAM,CAAC;AAIxC,QAAM,UACJ,iBAAiB,WAAW,cAAc,UAAU,EAAE,UAAU,QAAQ,CAAC,CAC1E;AACD,QAAM,MAAM,QAAQ,IAAI;AACxB,aAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;;CAGhE,IAAIC;AACJ,KAAI,QAAQ,KAEV,QAAO,8BADU,QAAQ,QAAQ,KAAK,EAAE,QAAQ,KAAK,EACN;EAC7C,oBAAoB;EACpB,qBAAqB,QAAQ;EAC9B,CAAC;UACO,QAAQ,aAAa;EAC9B,MAAM,SAAS,yBAAyB,IAAI;EAC5C,MAAM,OAAO,MAAM,IAAI,YAAY,QAAQ,QAAQ,YAAY;AAK/D,SAAO,wCAHL,QAAQ,YAAY,MAAM,IAC1B,SAAS,QAAQ,YAAY,CAAC,QAAQ,oBAAoB,GAAG,IAC7D,aACkD,MAAM;GACxD,oBAAoB;GACpB,qBAAqB,QAAQ;GAC9B,CAAC;OAEF,OAAM,IAAI,MAAM,qDAAqD;AAGvE,OAAM,IAAI,2BAA2B,uBAAuB,YAAY,KAAK;AAE7E,OAAM,UACJ,iBAAiB,WAAW,SAAS,UAAU,EAAE,UAAU,QAAQ,CAAC,CACrE;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,MAAM,gBACJ,OAAO,SAAS,IACZ,WAAW,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK,KAC/C;AACN,SAAQ,IACN,sBAAsB,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,YAAY,WAAW,MAAM,sBAAsB,IAAI,cAAc,GAC/I;AAED,KAAI,QAAQ,MAAM;EAChB,MAAMH,SAAgC;GACpC,QAAQ;GACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;GAC7D,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB;GACA;GACA;GACA,QAAQ,OAAO,KAAK,OAAO;IACzB,MAAM,EAAE;IACR,aAAa,EAAE;IACf,MAAM,EAAE;IACT,EAAE;GACJ;AACD,UAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK"}

package/dist/{stackOutputs-CQQHtdPA.mjs → stackOutputs-D33EmyfT.mjs}

@@ -1,5 +1,5 @@
 import { n as materializeTamerResolvable } from "./normalize-DVSTRZhO.mjs";
-import { h as resolveReferencesInString } from "./fetchStackImports-C-1THPYL.mjs";
+import { g as resolveReferencesInString } from "./fetchStackImports-ClUYZy_U.mjs";
 
 //#region src/core/outputs/stackOutputs.ts
 /**
@@ -66,4 +66,4 @@ function buildOutputsView(config, state) {
 
 //#endregion
 export { resolveStackOutputs as n, buildOutputsView as t };
-//# sourceMappingURL=stackOutputs-CQQHtdPA.mjs.map
+//# sourceMappingURL=stackOutputs-D33EmyfT.mjs.map

package/dist/{stackOutputs-CQQHtdPA.mjs.map → stackOutputs-D33EmyfT.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"stackOutputs-CQQHtdPA.mjs","names":["out: Record<string, CfiStackOutputValue>","rows: StackOutputRow[]","status: StackOutputRow[\"status\"]"],"sources":["../src/core/outputs/stackOutputs.ts"],"sourcesContent":["/**\n * Tamer's CloudFormation `Outputs` analogue.\n *\n * `tamer.config.ts > outputs` declares named exports as Tamer reference\n * strings (e.g. `\"${tamer:d1:users.id}\"`). After a successful `apply` the\n * engine resolves every entry against the just-completed state and persists\n * the literal under {@link CfiState.stackOutputs}. Sibling stacks consume\n * them via `${tamer:import:<stackName>.<outputName>}` (added separately).\n *\n * Resolution is **strict**: any unresolved/unknown reference fails the\n * apply (and rolls back when `--rollback-on-failure` is set). Read-only\n * commands like `status` use {@link buildOutputsView} which is tolerant\n * and shows the placeholder verbatim alongside the persisted value.\n */\nimport type {\n  CfiConfig,\n  CfiStackOutputValue,\n} from \"../../types.js\";\nimport { materializeTamerResolvable } from \"../../dx/normalize.js\";\nimport type { NamingEngine } from \"../naming/NamingEngine.js\";\nimport type { StateManager } from \"../state/StateManager.js\";\nimport {\n  resolveReferencesInString,\n  TamerReferenceError,\n} from \"../references/references.js\";\n\n/**\n * Resolve every `outputs:` entry against the current state. Throws\n * {@link TamerReferenceError} on the first unresolved reference so a failed\n * apply can roll back instead of silently persisting half-resolved values.\n *\n * Pass an explicit `now` only from tests — production code should let it\n * default to wall-clock so `resolvedAt` reflects the real persist time.\n */\nexport function resolveStackOutputs(\n  config: CfiConfig,\n  ctx: {\n    env: string;\n    state: StateManager;\n    naming: NamingEngine;\n    /**\n     * Outputs from sibling stacks pre-fetched by `fetchStackImports`.\n     * An output may chain through an import (e.g.\n     * `outputs: { region: \"${tamer:import:net.region}\" }`) — strict\n     * resolution requires the sibling row to be hydrated already.\n     */\n    imports?: Record<string, Record<string, string>>;\n    /** Same as wrangler / apply `accountId` (for `${tamer:config:stack.account_id}` in outputs). */\n    accountId?: string;\n  },\n  now: () => string = () => new Date().toISOString(),\n): Record<string, CfiStackOutputValue> {\n  const outputs = config.outputs;\n  if (!outputs || Object.keys(outputs).length === 0) return {};\n  const refCtx = {\n    config,\n    env: ctx.env,\n    state: ctx.state,\n    naming: ctx.naming,\n    tolerant: false,\n    imports: ctx.imports,\n    accountId: ctx.accountId,\n  };\n  const resolvedAt = now();\n  const out: Record<string, CfiStackOutputValue> = {};\n  for (const [name, source] of Object.entries(outputs)) {\n    const sourceStr = materializeTamerResolvable(source);\n    const value = resolveReferencesInString(\n      sourceStr,\n      refCtx,\n      `outputs.${name}`,\n    );\n    out[name] = { value, source: sourceStr, resolvedAt };\n  }\n  return out;\n}\n\n/**\n * One row in the `tamer status` outputs panel. Combines the *declared*\n * source (from `tamer.config.ts`) with the *persisted* value (from state)\n * so operators can see drift between \"what the config says\" and \"what we\n * last resolved\". `value` is `null` when the output is declared but has\n * never been resolved (no `apply` yet), or when a stale persisted entry\n * exists for an output that has since been removed from config.\n */\nexport interface StackOutputRow {\n  name: string;\n  /** Live source from `tamer.config.ts > outputs[name]`, if still declared. */\n  declaredSource: string | undefined;\n  /** Persisted resolved literal, if `apply` has run for this output. */\n  value: string | null;\n  /** Source string at last persist (drifts vs. `declaredSource` after edits). */\n  persistedSource: string | undefined;\n  /** ISO timestamp of last persist (undefined when never resolved). */\n  resolvedAt: string | undefined;\n  /**\n   * `\"resolved\"` when persisted matches declared source, `\"stale\"` when\n   * source has drifted since persist (re-run apply), `\"orphan\"` when\n   * persisted but no longer declared, `\"pending\"` when declared but never\n   * resolved.\n   */\n  status: \"resolved\" | \"stale\" | \"orphan\" | \"pending\";\n}\n\n/**\n * Tolerant union of declared + persisted outputs for `tamer status` and the\n * machine-readable `--json` envelope. Never throws.\n */\nexport function buildOutputsView(\n  config: CfiConfig,\n  state: StateManager,\n): StackOutputRow[] {\n  const declared = config.outputs ?? {};\n  const persisted = state.getStackOutputs();\n  const names = new Set<string>([\n    ...Object.keys(declared),\n    ...Object.keys(persisted),\n  ]);\n  const rows: StackOutputRow[] = [];\n  for (const name of [...names].sort()) {\n    const rawDeclared = declared[name];\n    const declaredSource =\n      rawDeclared !== undefined ? materializeTamerResolvable(rawDeclared) : undefined;\n    const p = persisted[name];\n    let status: StackOutputRow[\"status\"];\n    if (declaredSource && !p) status = \"pending\";\n    else if (!declaredSource && p) status = \"orphan\";\n    else if (declaredSource && p && declaredSource !== p.source) status = \"stale\";\n    else status = \"resolved\";\n    rows.push({\n      name,\n      declaredSource,\n      value: p?.value ?? null,\n      persistedSource: p?.source,\n      resolvedAt: p?.resolvedAt,\n      status,\n    });\n  }\n  return rows;\n}\n\nexport { TamerReferenceError };\n"],"mappings":";;;;;;;;;;;;AAkCA,SAAgB,oBACd,QACA,KAcA,6BAA0B,IAAI,MAAM,EAAC,aAAa,EACb;CACrC,MAAM,UAAU,OAAO;AACvB,KAAI,CAAC,WAAW,OAAO,KAAK,QAAQ,CAAC,WAAW,EAAG,QAAO,EAAE;CAC5D,MAAM,SAAS;EACb;EACA,KAAK,IAAI;EACT,OAAO,IAAI;EACX,QAAQ,IAAI;EACZ,UAAU;EACV,SAAS,IAAI;EACb,WAAW,IAAI;EAChB;CACD,MAAM,aAAa,KAAK;CACxB,MAAMA,MAA2C,EAAE;AACnD,MAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,QAAQ,EAAE;EACpD,MAAM,YAAY,2BAA2B,OAAO;AAMpD,MAAI,QAAQ;GAAE,OALA,0BACZ,WACA,QACA,WAAW,OACZ;GACoB,QAAQ;GAAW;GAAY;;AAEtD,QAAO;;;;;;AAkCT,SAAgB,iBACd,QACA,OACkB;CAClB,MAAM,WAAW,OAAO,WAAW,EAAE;CACrC,MAAM,YAAY,MAAM,iBAAiB;CACzC,MAAM,QAAQ,IAAI,IAAY,CAC5B,GAAG,OAAO,KAAK,SAAS,EACxB,GAAG,OAAO,KAAK,UAAU,CAC1B,CAAC;CACF,MAAMC,OAAyB,EAAE;AACjC,MAAK,MAAM,QAAQ,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE;EACpC,MAAM,cAAc,SAAS;EAC7B,MAAM,iBACJ,gBAAgB,SAAY,2BAA2B,YAAY,GAAG;EACxE,MAAM,IAAI,UAAU;EACpB,IAAIC;AACJ,MAAI,kBAAkB,CAAC,EAAG,UAAS;WAC1B,CAAC,kBAAkB,EAAG,UAAS;WAC/B,kBAAkB,KAAK,mBAAmB,EAAE,OAAQ,UAAS;MACjE,UAAS;AACd,OAAK,KAAK;GACR;GACA;GACA,OAAO,GAAG,SAAS;GACnB,iBAAiB,GAAG;GACpB,YAAY,GAAG;GACf;GACD,CAAC;;AAEJ,QAAO"}
+{"version":3,"file":"stackOutputs-D33EmyfT.mjs","names":["out: Record<string, CfiStackOutputValue>","rows: StackOutputRow[]","status: StackOutputRow[\"status\"]"],"sources":["../src/core/outputs/stackOutputs.ts"],"sourcesContent":["/**\n * Tamer's CloudFormation `Outputs` analogue.\n *\n * `tamer.config.ts > outputs` declares named exports as Tamer reference\n * strings (e.g. `\"${tamer:d1:users.id}\"`). After a successful `apply` the\n * engine resolves every entry against the just-completed state and persists\n * the literal under {@link CfiState.stackOutputs}. Sibling stacks consume\n * them via `${tamer:import:<stackName>.<outputName>}` (added separately).\n *\n * Resolution is **strict**: any unresolved/unknown reference fails the\n * apply (and rolls back when `--rollback-on-failure` is set). Read-only\n * commands like `status` use {@link buildOutputsView} which is tolerant\n * and shows the placeholder verbatim alongside the persisted value.\n */\nimport type {\n  CfiConfig,\n  CfiStackOutputValue,\n} from \"../../types.js\";\nimport { materializeTamerResolvable } from \"../../dx/normalize.js\";\nimport type { NamingEngine } from \"../naming/NamingEngine.js\";\nimport type { StateManager } from \"../state/StateManager.js\";\nimport {\n  resolveReferencesInString,\n  TamerReferenceError,\n} from \"../references/references.js\";\n\n/**\n * Resolve every `outputs:` entry against the current state. Throws\n * {@link TamerReferenceError} on the first unresolved reference so a failed\n * apply can roll back instead of silently persisting half-resolved values.\n *\n * Pass an explicit `now` only from tests — production code should let it\n * default to wall-clock so `resolvedAt` reflects the real persist time.\n */\nexport function resolveStackOutputs(\n  config: CfiConfig,\n  ctx: {\n    env: string;\n    state: StateManager;\n    naming: NamingEngine;\n    /**\n     * Outputs from sibling stacks pre-fetched by `fetchStackImports`.\n     * An output may chain through an import (e.g.\n     * `outputs: { region: \"${tamer:import:net.region}\" }`) — strict\n     * resolution requires the sibling row to be hydrated already.\n     */\n    imports?: Record<string, Record<string, string>>;\n    /** Same as wrangler / apply `accountId` (for `${tamer:config:stack.account_id}` in outputs). */\n    accountId?: string;\n  },\n  now: () => string = () => new Date().toISOString(),\n): Record<string, CfiStackOutputValue> {\n  const outputs = config.outputs;\n  if (!outputs || Object.keys(outputs).length === 0) return {};\n  const refCtx = {\n    config,\n    env: ctx.env,\n    state: ctx.state,\n    naming: ctx.naming,\n    tolerant: false,\n    imports: ctx.imports,\n    accountId: ctx.accountId,\n  };\n  const resolvedAt = now();\n  const out: Record<string, CfiStackOutputValue> = {};\n  for (const [name, source] of Object.entries(outputs)) {\n    const sourceStr = materializeTamerResolvable(source);\n    const value = resolveReferencesInString(\n      sourceStr,\n      refCtx,\n      `outputs.${name}`,\n    );\n    out[name] = { value, source: sourceStr, resolvedAt };\n  }\n  return out;\n}\n\n/**\n * One row in the `tamer status` outputs panel. Combines the *declared*\n * source (from `tamer.config.ts`) with the *persisted* value (from state)\n * so operators can see drift between \"what the config says\" and \"what we\n * last resolved\". `value` is `null` when the output is declared but has\n * never been resolved (no `apply` yet), or when a stale persisted entry\n * exists for an output that has since been removed from config.\n */\nexport interface StackOutputRow {\n  name: string;\n  /** Live source from `tamer.config.ts > outputs[name]`, if still declared. */\n  declaredSource: string | undefined;\n  /** Persisted resolved literal, if `apply` has run for this output. */\n  value: string | null;\n  /** Source string at last persist (drifts vs. `declaredSource` after edits). */\n  persistedSource: string | undefined;\n  /** ISO timestamp of last persist (undefined when never resolved). */\n  resolvedAt: string | undefined;\n  /**\n   * `\"resolved\"` when persisted matches declared source, `\"stale\"` when\n   * source has drifted since persist (re-run apply), `\"orphan\"` when\n   * persisted but no longer declared, `\"pending\"` when declared but never\n   * resolved.\n   */\n  status: \"resolved\" | \"stale\" | \"orphan\" | \"pending\";\n}\n\n/**\n * Tolerant union of declared + persisted outputs for `tamer status` and the\n * machine-readable `--json` envelope. Never throws.\n */\nexport function buildOutputsView(\n  config: CfiConfig,\n  state: StateManager,\n): StackOutputRow[] {\n  const declared = config.outputs ?? {};\n  const persisted = state.getStackOutputs();\n  const names = new Set<string>([\n    ...Object.keys(declared),\n    ...Object.keys(persisted),\n  ]);\n  const rows: StackOutputRow[] = [];\n  for (const name of [...names].sort()) {\n    const rawDeclared = declared[name];\n    const declaredSource =\n      rawDeclared !== undefined ? materializeTamerResolvable(rawDeclared) : undefined;\n    const p = persisted[name];\n    let status: StackOutputRow[\"status\"];\n    if (declaredSource && !p) status = \"pending\";\n    else if (!declaredSource && p) status = \"orphan\";\n    else if (declaredSource && p && declaredSource !== p.source) status = \"stale\";\n    else status = \"resolved\";\n    rows.push({\n      name,\n      declaredSource,\n      value: p?.value ?? null,\n      persistedSource: p?.source,\n      resolvedAt: p?.resolvedAt,\n      status,\n    });\n  }\n  return rows;\n}\n\nexport { TamerReferenceError };\n"],"mappings":";;;;;;;;;;;;AAkCA,SAAgB,oBACd,QACA,KAcA,6BAA0B,IAAI,MAAM,EAAC,aAAa,EACb;CACrC,MAAM,UAAU,OAAO;AACvB,KAAI,CAAC,WAAW,OAAO,KAAK,QAAQ,CAAC,WAAW,EAAG,QAAO,EAAE;CAC5D,MAAM,SAAS;EACb;EACA,KAAK,IAAI;EACT,OAAO,IAAI;EACX,QAAQ,IAAI;EACZ,UAAU;EACV,SAAS,IAAI;EACb,WAAW,IAAI;EAChB;CACD,MAAM,aAAa,KAAK;CACxB,MAAMA,MAA2C,EAAE;AACnD,MAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,QAAQ,EAAE;EACpD,MAAM,YAAY,2BAA2B,OAAO;AAMpD,MAAI,QAAQ;GAAE,OALA,0BACZ,WACA,QACA,WAAW,OACZ;GACoB,QAAQ;GAAW;GAAY;;AAEtD,QAAO;;;;;;AAkCT,SAAgB,iBACd,QACA,OACkB;CAClB,MAAM,WAAW,OAAO,WAAW,EAAE;CACrC,MAAM,YAAY,MAAM,iBAAiB;CACzC,MAAM,QAAQ,IAAI,IAAY,CAC5B,GAAG,OAAO,KAAK,SAAS,EACxB,GAAG,OAAO,KAAK,UAAU,CAC1B,CAAC;CACF,MAAMC,OAAyB,EAAE;AACjC,MAAK,MAAM,QAAQ,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE;EACpC,MAAM,cAAc,SAAS;EAC7B,MAAM,iBACJ,gBAAgB,SAAY,2BAA2B,YAAY,GAAG;EACxE,MAAM,IAAI,UAAU;EACpB,IAAIC;AACJ,MAAI,kBAAkB,CAAC,EAAG,UAAS;WAC1B,CAAC,kBAAkB,EAAG,UAAS;WAC/B,kBAAkB,KAAK,mBAAmB,EAAE,OAAQ,UAAS;MACjE,UAAS;AACd,OAAK,KAAK;GACR;GACA;GACA,OAAO,GAAG,SAAS;GACnB,iBAAiB,GAAG;GACpB,YAAY,GAAG;GACf;GACD,CAAC;;AAEJ,QAAO"}

package/dist/{status-D5GLpWyn.mjs → status-BAPpi2Zt.mjs}

@@ -1,12 +1,12 @@
 import { f as getDispatchNamespaces, m as getLogpushJobs, p as getDnsRecords } from "./normalize-DVSTRZhO.mjs";
-import { n as loadConfig, t as getWorkers } from "./loader-DAvCKLTT.mjs";
+import { n as loadConfig, t as getWorkers } from "./loader-DnT9iqz9.mjs";
 import { n as cloudflareAccountIdFromEnv, t as CFApiClient } from "./CFApiClient-DhbyyV71.mjs";
-import { _ as namingFromConfig, a as resourceModules, f as resolveDeployedWorkerName, r as scanConfigForImports, t as fetchStackImports, u as mergeWorkerConfigForResourcePick } from "./fetchStackImports-C-1THPYL.mjs";
-import { a as tenantStateKey, f as stackNameForConfig, t as StateManager } from "./StateManager-DTqtLLVX.mjs";
+import { a as resourceModules, d as mergeWorkerConfigForResourcePick, p as resolveDeployedWorkerName, r as scanConfigForImports, t as fetchStackImports, v as namingFromConfig } from "./fetchStackImports-ClUYZy_U.mjs";
+import { a as tenantStateKey, f as stackNameForConfig, t as StateManager } from "./StateManager-JLBtz9V-.mjs";
 import "./r2S3EmptyBucket-DD81ZWQ7.mjs";
 import { r as dnsRecordStateKey, t as dnsRecordAppliesToEnv } from "./dns-records.resolve-DwBR_1WI.mjs";
 import { t as logpushJobStatus } from "./logpush-job-DsRkOORJ.mjs";
-import { t as buildOutputsView } from "./stackOutputs-CQQHtdPA.mjs";
+import { t as buildOutputsView } from "./stackOutputs-D33EmyfT.mjs";
 
 //#region src/features/dispatch-namespace/dispatch-namespace.status.ts
 function dispatchNamespaceStatus(resources, _env, state, _naming) {
@@ -195,4 +195,4 @@ async function runStatus(options) {
 
 //#endregion
 export { runStatus };
-//# sourceMappingURL=status-D5GLpWyn.mjs.map
+//# sourceMappingURL=status-BAPpi2Zt.mjs.map

package/dist/{status-D5GLpWyn.mjs.map → status-BAPpi2Zt.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"status-D5GLpWyn.mjs","names":["results: Array<{\n    logicalName: string;\n    namespace: string;\n    status: ResourceStatus;\n  }>","rows: DnsRecordStatusRow[]","meta: string[]","siblingImports: Record<string, Record<string, string>>","logpushLive:\n    | Awaited<ReturnType<CFApiClient[\"logpushAccountJobsList\"]>>\n    | undefined","hints: string[]"],"sources":["../src/features/dispatch-namespace/dispatch-namespace.status.ts","../src/features/dns-records/dns-records.status.ts","../src/cli/commands/status.ts"],"sourcesContent":["import type { DispatchNamespaceResourceConfig } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport type { ResourceStatus } from \"../../types.js\";\n\nexport function dispatchNamespaceStatus(\n  resources: DispatchNamespaceResourceConfig[],\n  _env: string,\n  state: StateManager,\n  _naming: NamingEngine,\n): Array<{ logicalName: string; namespace: string; status: ResourceStatus }> {\n  const results: Array<{\n    logicalName: string;\n    namespace: string;\n    status: ResourceStatus;\n  }> = [];\n\n  for (const config of resources) {\n    const key = `dispatch_ns:${config.namespace}`;\n    const entry = state.get(key);\n    results.push({\n      logicalName: config.logicalName,\n      namespace: config.namespace,\n      status:\n        entry?.type === \"dispatch_namespace\" ? \"ok\" : \"missing\",\n    });\n  }\n\n  return results;\n}\n","import type { DnsRecordResourceConfig, ResourceStatus } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport {\n  dnsRecordAppliesToEnv,\n  dnsRecordStateKey,\n} from \"./dns-records.resolve.js\";\n\nexport interface DnsRecordStatusRow {\n  logicalName: string;\n  type: string;\n  name: string;\n  recordId?: string;\n  status: ResourceStatus;\n}\n\nexport function dnsRecordStatus(\n  resources: DnsRecordResourceConfig[],\n  env: string,\n  state: StateManager,\n): DnsRecordStatusRow[] {\n  const rows: DnsRecordStatusRow[] = [];\n  for (const config of resources) {\n    if (!dnsRecordAppliesToEnv(config, env)) {\n      rows.push({\n        logicalName: config.logicalName,\n        type: config.type,\n        name: config.name,\n        status: \"ok\",\n      });\n      continue;\n    }\n    const entry = state.get(\n      dnsRecordStateKey(config.zoneId, config.type, config.name),\n    );\n    if (entry?.type === \"dns_record\") {\n      rows.push({\n        logicalName: config.logicalName,\n        type: entry.recordType,\n        name: entry.name,\n        recordId: entry.recordId,\n        status: \"ok\",\n      });\n    } else {\n      rows.push({\n        logicalName: config.logicalName,\n        type: config.type,\n        name: config.name,\n        status: \"missing\",\n      });\n    }\n  }\n  return rows;\n}\n","import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { dispatchNamespaceStatus } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordStatus } from \"../../features/dns-records/index.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobStatus } from \"../../features/logpush-job/index.js\";\nimport { tenantStateKey } from \"../../core/tenant/tenantKeys.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport {\n  resolveDeployedWorkerName,\n  mergeWorkerConfigForResourcePick,\n} from \"../../core/config/resolver.js\";\nimport { buildOutputsView } from \"../../core/outputs/stackOutputs.js\";\nimport {\n  fetchStackImports,\n  scanConfigForImports,\n} from \"../../core/imports/fetchStackImports.js\";\n\nexport async function runStatus(options: {\n  env?: string;\n  configPath?: string;\n  /** `product:workspace` — show only this workspace tenant from state. */\n  tenant?: string;\n}): Promise<void> {\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n\n  const workers = await getWorkers(config, baseDir);\n  console.log(\n    `\\nStatus for ${config.tenant.name} (${config.tenant.slug}) — env: ${env}\\n`,\n  );\n\n  if (options.tenant?.trim()) {\n    const raw = options.tenant.trim();\n    const colon = raw.indexOf(\":\");\n    if (colon < 1) {\n      throw new Error(\n        'status --tenant expects \"product:workspace\" (e.g. todo:acme)',\n      );\n    }\n    const product = raw.slice(0, colon);\n    const workspace = raw.slice(colon + 1);\n    const t = state.getTenant(product, workspace);\n    console.log(`Workspace tenant ${tenantStateKey(product, workspace)}:`);\n    if (!t) {\n      console.log(\"  (no record in tamer state)\\n\");\n      return;\n    }\n    console.log(`  status: ${t.provisioningStatus}`);\n    console.log(`  dispatch namespace: ${t.dispatchNamespaceName}`);\n    console.log(`  script: ${t.scriptName}`);\n    if (t.d1Shards?.length) {\n      console.log(\"  D1 shards:\");\n      for (const s of t.d1Shards) {\n        console.log(`    ${s.role}: ${s.derivedName} [${s.cfId}]`);\n      }\n    }\n    console.log();\n    return;\n  }\n\n  const outputRows = buildOutputsView(config, state);\n  if (outputRows.length > 0) {\n    console.log(\"Stack outputs:\");\n    for (const r of outputRows) {\n      const valueText =\n        r.value === null\n          ? \"(unresolved — run apply)\"\n          : r.value;\n      const meta: string[] = [r.status];\n      if (r.status === \"stale\" && r.declaredSource) {\n        meta.push(`source drifted → ${r.declaredSource}`);\n      }\n      console.log(`  ${r.name}: ${valueText} [${meta.join(\", \")}]`);\n    }\n    console.log();\n  }\n\n  // Inbound imports — show every `${tamer:import:<stack>.<output>}`\n  // referenced by config, grouped by source stack. We tolerate fetch\n  // failures so `tamer status` still works in offline / partial-cred\n  // environments; a missing sibling row just displays \"(unresolved)\".\n  const importRefs = scanConfigForImports(config);\n  let siblingImports: Record<string, Record<string, string>> = {};\n  try {\n    siblingImports = await fetchStackImports(api, config, env);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    console.warn(`(could not pre-fetch imported stacks: ${msg})`);\n  }\n  if (importRefs.length > 0) {\n    console.log(\"Stack imports:\");\n    const byStack = new Map<string, Set<string>>();\n    for (const r of importRefs) {\n      if (!byStack.has(r.stack)) byStack.set(r.stack, new Set());\n      byStack.get(r.stack)!.add(r.output);\n    }\n    for (const [stack, outputs] of [...byStack].sort(([a], [b]) =>\n      a.localeCompare(b),\n    )) {\n      console.log(`  from stack \"${stack}\":`);\n      const stackOutputs = siblingImports[stack] ?? {};\n      for (const out of [...outputs].sort()) {\n        const v = stackOutputs[out];\n        const status = v === undefined ? \"unresolved\" : \"resolved\";\n        const value = v ?? \"(missing — run `tamer apply` on that stack)\";\n        console.log(`    ${out}: ${value} [${status}]`);\n      }\n    }\n    console.log();\n  }\n\n  const dns = dispatchNamespaceStatus(\n    getDispatchNamespaces(config),\n    env,\n    state,\n    naming,\n  );\n  if (dns.length > 0) {\n    console.log(\"Dispatch namespaces:\");\n    for (const r of dns) {\n      console.log(`  ${r.logicalName} (${r.namespace}) [${r.status}]`);\n    }\n    console.log();\n  }\n\n  const dnsRows = dnsRecordStatus(getDnsRecords(config), env, state);\n  if (dnsRows.length > 0) {\n    console.log(\"DNS records:\");\n    for (const r of dnsRows) {\n      const id = r.recordId ? ` [${r.recordId}]` : \"\";\n      console.log(`  ${r.logicalName}: ${r.type} ${r.name}${id} [${r.status}]`);\n    }\n    console.log();\n  }\n\n  let logpushLive:\n    | Awaited<ReturnType<CFApiClient[\"logpushAccountJobsList\"]>>\n    | undefined;\n  if (env !== \"local\") {\n    try {\n      logpushLive = await api.logpushAccountJobsList();\n    } catch {\n      // Token may lack Logpush list; state-only rows still print.\n    }\n  }\n  const logpushRows = logpushJobStatus(\n    getLogpushJobs(config),\n    config.tenant,\n    env,\n    state,\n    logpushLive,\n  );\n  if (logpushRows.length > 0) {\n    console.log(\"Logpush jobs:\");\n    for (const r of logpushRows) {\n      const id = r.cfJobId != null ? ` [id ${r.cfJobId}]` : \"\";\n      const hints: string[] = [];\n      if (r.cfEnabled === false) hints.push(\"disabled on Cloudflare\");\n      if (r.cfError) hints.push(`CF error: ${r.cfError}`);\n      const hint = hints.length > 0 ? ` — ${hints.join(\"; \")}` : \"\";\n      console.log(`  ${r.logicalName}: ${r.jobName}${id} [${r.status}]${hint}`);\n    }\n    console.log();\n  }\n\n  for (const [workerKey, workerConfig] of workers) {\n    console.log(`Worker: ${workerKey}`);\n    const deployedName = resolveDeployedWorkerName(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      naming,\n    );\n    const mergedWorker = mergeWorkerConfigForResourcePick(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports: siblingImports },\n    );\n    let printedAny = false;\n    for (const mod of resourceModules) {\n      const resources = mod.pickResources(mergedWorker);\n      if (resources.length === 0) continue;\n      const rows = mod.status({\n        resources,\n        env,\n        state,\n        naming,\n        worker: { workerKey, deployedName },\n      });\n      if (rows.length === 0) continue;\n      printedAny = true;\n      console.log(`  ${mod.label}:`);\n      for (const r of rows) {\n        console.log(`    ${r.binding}: ${r.name} [${r.status}]`);\n      }\n    }\n    if (!printedAny) console.log(\"  (no resources)\");\n    console.log();\n  }\n}\n"],"mappings":";;;;;;;;;;;AAKA,SAAgB,wBACd,WACA,MACA,OACA,SAC2E;CAC3E,MAAMA,UAID,EAAE;AAEP,MAAK,MAAM,UAAU,WAAW;EAC9B,MAAM,MAAM,eAAe,OAAO;EAClC,MAAM,QAAQ,MAAM,IAAI,IAAI;AAC5B,UAAQ,KAAK;GACX,aAAa,OAAO;GACpB,WAAW,OAAO;GAClB,QACE,OAAO,SAAS,uBAAuB,OAAO;GACjD,CAAC;;AAGJ,QAAO;;;;;ACbT,SAAgB,gBACd,WACA,KACA,OACsB;CACtB,MAAMC,OAA6B,EAAE;AACrC,MAAK,MAAM,UAAU,WAAW;AAC9B,MAAI,CAAC,sBAAsB,QAAQ,IAAI,EAAE;AACvC,QAAK,KAAK;IACR,aAAa,OAAO;IACpB,MAAM,OAAO;IACb,MAAM,OAAO;IACb,QAAQ;IACT,CAAC;AACF;;EAEF,MAAM,QAAQ,MAAM,IAClB,kBAAkB,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK,CAC3D;AACD,MAAI,OAAO,SAAS,aAClB,MAAK,KAAK;GACR,aAAa,OAAO;GACpB,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,UAAU,MAAM;GAChB,QAAQ;GACT,CAAC;MAEF,MAAK,KAAK;GACR,aAAa,OAAO;GACpB,MAAM,OAAO;GACb,MAAM,OAAO;GACb,QAAQ;GACT,CAAC;;AAGN,QAAO;;;;;AC7BT,eAAsB,UAAU,SAKd;CAChB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAEH,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,SAAQ,IACN,gBAAgB,OAAO,OAAO,KAAK,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,IAC1E;AAED,KAAI,QAAQ,QAAQ,MAAM,EAAE;EAC1B,MAAM,MAAM,QAAQ,OAAO,MAAM;EACjC,MAAM,QAAQ,IAAI,QAAQ,IAAI;AAC9B,MAAI,QAAQ,EACV,OAAM,IAAI,MACR,iEACD;EAEH,MAAM,UAAU,IAAI,MAAM,GAAG,MAAM;EACnC,MAAM,YAAY,IAAI,MAAM,QAAQ,EAAE;EACtC,MAAM,IAAI,MAAM,UAAU,SAAS,UAAU;AAC7C,UAAQ,IAAI,oBAAoB,eAAe,SAAS,UAAU,CAAC,GAAG;AACtE,MAAI,CAAC,GAAG;AACN,WAAQ,IAAI,iCAAiC;AAC7C;;AAEF,UAAQ,IAAI,aAAa,EAAE,qBAAqB;AAChD,UAAQ,IAAI,yBAAyB,EAAE,wBAAwB;AAC/D,UAAQ,IAAI,aAAa,EAAE,aAAa;AACxC,MAAI,EAAE,UAAU,QAAQ;AACtB,WAAQ,IAAI,eAAe;AAC3B,QAAK,MAAM,KAAK,EAAE,SAChB,SAAQ,IAAI,OAAO,EAAE,KAAK,IAAI,EAAE,YAAY,IAAI,EAAE,KAAK,GAAG;;AAG9D,UAAQ,KAAK;AACb;;CAGF,MAAM,aAAa,iBAAiB,QAAQ,MAAM;AAClD,KAAI,WAAW,SAAS,GAAG;AACzB,UAAQ,IAAI,iBAAiB;AAC7B,OAAK,MAAM,KAAK,YAAY;GAC1B,MAAM,YACJ,EAAE,UAAU,OACR,6BACA,EAAE;GACR,MAAMC,OAAiB,CAAC,EAAE,OAAO;AACjC,OAAI,EAAE,WAAW,WAAW,EAAE,eAC5B,MAAK,KAAK,oBAAoB,EAAE,iBAAiB;AAEnD,WAAQ,IAAI,KAAK,EAAE,KAAK,IAAI,UAAU,IAAI,KAAK,KAAK,KAAK,CAAC,GAAG;;AAE/D,UAAQ,KAAK;;CAOf,MAAM,aAAa,qBAAqB,OAAO;CAC/C,IAAIC,iBAAyD,EAAE;AAC/D,KAAI;AACF,mBAAiB,MAAM,kBAAkB,KAAK,QAAQ,IAAI;UACnD,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,yCAAyC,IAAI,GAAG;;AAE/D,KAAI,WAAW,SAAS,GAAG;AACzB,UAAQ,IAAI,iBAAiB;EAC7B,MAAM,0BAAU,IAAI,KAA0B;AAC9C,OAAK,MAAM,KAAK,YAAY;AAC1B,OAAI,CAAC,QAAQ,IAAI,EAAE,MAAM,CAAE,SAAQ,IAAI,EAAE,uBAAO,IAAI,KAAK,CAAC;AAC1D,WAAQ,IAAI,EAAE,MAAM,CAAE,IAAI,EAAE,OAAO;;AAErC,OAAK,MAAM,CAAC,OAAO,YAAY,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OACtD,EAAE,cAAc,EAAE,CACnB,EAAE;AACD,WAAQ,IAAI,iBAAiB,MAAM,IAAI;GACvC,MAAM,eAAe,eAAe,UAAU,EAAE;AAChD,QAAK,MAAM,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE;IACrC,MAAM,IAAI,aAAa;IACvB,MAAM,SAAS,MAAM,SAAY,eAAe;IAChD,MAAM,QAAQ,KAAK;AACnB,YAAQ,IAAI,OAAO,IAAI,IAAI,MAAM,IAAI,OAAO,GAAG;;;AAGnD,UAAQ,KAAK;;CAGf,MAAM,MAAM,wBACV,sBAAsB,OAAO,EAC7B,KACA,OACA,OACD;AACD,KAAI,IAAI,SAAS,GAAG;AAClB,UAAQ,IAAI,uBAAuB;AACnC,OAAK,MAAM,KAAK,IACd,SAAQ,IAAI,KAAK,EAAE,YAAY,IAAI,EAAE,UAAU,KAAK,EAAE,OAAO,GAAG;AAElE,UAAQ,KAAK;;CAGf,MAAM,UAAU,gBAAgB,cAAc,OAAO,EAAE,KAAK,MAAM;AAClE,KAAI,QAAQ,SAAS,GAAG;AACtB,UAAQ,IAAI,eAAe;AAC3B,OAAK,MAAM,KAAK,SAAS;GACvB,MAAM,KAAK,EAAE,WAAW,KAAK,EAAE,SAAS,KAAK;AAC7C,WAAQ,IAAI,KAAK,EAAE,YAAY,IAAI,EAAE,KAAK,GAAG,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,GAAG;;AAE3E,UAAQ,KAAK;;CAGf,IAAIC;AAGJ,KAAI,QAAQ,QACV,KAAI;AACF,gBAAc,MAAM,IAAI,wBAAwB;SAC1C;CAIV,MAAM,cAAc,iBAClB,eAAe,OAAO,EACtB,OAAO,QACP,KACA,OACA,YACD;AACD,KAAI,YAAY,SAAS,GAAG;AAC1B,UAAQ,IAAI,gBAAgB;AAC5B,OAAK,MAAM,KAAK,aAAa;GAC3B,MAAM,KAAK,EAAE,WAAW,OAAO,QAAQ,EAAE,QAAQ,KAAK;GACtD,MAAMC,QAAkB,EAAE;AAC1B,OAAI,EAAE,cAAc,MAAO,OAAM,KAAK,yBAAyB;AAC/D,OAAI,EAAE,QAAS,OAAM,KAAK,aAAa,EAAE,UAAU;GACnD,MAAM,OAAO,MAAM,SAAS,IAAI,MAAM,MAAM,KAAK,KAAK,KAAK;AAC3D,WAAQ,IAAI,KAAK,EAAE,YAAY,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,OAAO,GAAG,OAAO;;AAE3E,UAAQ,KAAK;;AAGf,MAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;AAC/C,UAAQ,IAAI,WAAW,YAAY;EACnC,MAAM,eAAe,0BACnB,QACA,WACA,cACA,KACA,OACD;EACD,MAAM,eAAe,iCACnB,QACA,WACA,cACA,KACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY,SAAS;GAAgB,CACxD;EACD,IAAI,aAAa;AACjB,OAAK,MAAM,OAAO,iBAAiB;GACjC,MAAM,YAAY,IAAI,cAAc,aAAa;AACjD,OAAI,UAAU,WAAW,EAAG;GAC5B,MAAM,OAAO,IAAI,OAAO;IACtB;IACA;IACA;IACA;IACA,QAAQ;KAAE;KAAW;KAAc;IACpC,CAAC;AACF,OAAI,KAAK,WAAW,EAAG;AACvB,gBAAa;AACb,WAAQ,IAAI,KAAK,IAAI,MAAM,GAAG;AAC9B,QAAK,MAAM,KAAK,KACd,SAAQ,IAAI,OAAO,EAAE,QAAQ,IAAI,EAAE,KAAK,IAAI,EAAE,OAAO,GAAG;;AAG5D,MAAI,CAAC,WAAY,SAAQ,IAAI,mBAAmB;AAChD,UAAQ,KAAK"}
+{"version":3,"file":"status-BAPpi2Zt.mjs","names":["results: Array<{\n    logicalName: string;\n    namespace: string;\n    status: ResourceStatus;\n  }>","rows: DnsRecordStatusRow[]","meta: string[]","siblingImports: Record<string, Record<string, string>>","logpushLive:\n    | Awaited<ReturnType<CFApiClient[\"logpushAccountJobsList\"]>>\n    | undefined","hints: string[]"],"sources":["../src/features/dispatch-namespace/dispatch-namespace.status.ts","../src/features/dns-records/dns-records.status.ts","../src/cli/commands/status.ts"],"sourcesContent":["import type { DispatchNamespaceResourceConfig } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport type { ResourceStatus } from \"../../types.js\";\n\nexport function dispatchNamespaceStatus(\n  resources: DispatchNamespaceResourceConfig[],\n  _env: string,\n  state: StateManager,\n  _naming: NamingEngine,\n): Array<{ logicalName: string; namespace: string; status: ResourceStatus }> {\n  const results: Array<{\n    logicalName: string;\n    namespace: string;\n    status: ResourceStatus;\n  }> = [];\n\n  for (const config of resources) {\n    const key = `dispatch_ns:${config.namespace}`;\n    const entry = state.get(key);\n    results.push({\n      logicalName: config.logicalName,\n      namespace: config.namespace,\n      status:\n        entry?.type === \"dispatch_namespace\" ? \"ok\" : \"missing\",\n    });\n  }\n\n  return results;\n}\n","import type { DnsRecordResourceConfig, ResourceStatus } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport {\n  dnsRecordAppliesToEnv,\n  dnsRecordStateKey,\n} from \"./dns-records.resolve.js\";\n\nexport interface DnsRecordStatusRow {\n  logicalName: string;\n  type: string;\n  name: string;\n  recordId?: string;\n  status: ResourceStatus;\n}\n\nexport function dnsRecordStatus(\n  resources: DnsRecordResourceConfig[],\n  env: string,\n  state: StateManager,\n): DnsRecordStatusRow[] {\n  const rows: DnsRecordStatusRow[] = [];\n  for (const config of resources) {\n    if (!dnsRecordAppliesToEnv(config, env)) {\n      rows.push({\n        logicalName: config.logicalName,\n        type: config.type,\n        name: config.name,\n        status: \"ok\",\n      });\n      continue;\n    }\n    const entry = state.get(\n      dnsRecordStateKey(config.zoneId, config.type, config.name),\n    );\n    if (entry?.type === \"dns_record\") {\n      rows.push({\n        logicalName: config.logicalName,\n        type: entry.recordType,\n        name: entry.name,\n        recordId: entry.recordId,\n        status: \"ok\",\n      });\n    } else {\n      rows.push({\n        logicalName: config.logicalName,\n        type: config.type,\n        name: config.name,\n        status: \"missing\",\n      });\n    }\n  }\n  return rows;\n}\n","import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { dispatchNamespaceStatus } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordStatus } from \"../../features/dns-records/index.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobStatus } from \"../../features/logpush-job/index.js\";\nimport { tenantStateKey } from \"../../core/tenant/tenantKeys.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport {\n  resolveDeployedWorkerName,\n  mergeWorkerConfigForResourcePick,\n} from \"../../core/config/resolver.js\";\nimport { buildOutputsView } from \"../../core/outputs/stackOutputs.js\";\nimport {\n  fetchStackImports,\n  scanConfigForImports,\n} from \"../../core/imports/fetchStackImports.js\";\n\nexport async function runStatus(options: {\n  env?: string;\n  configPath?: string;\n  /** `product:workspace` — show only this workspace tenant from state. */\n  tenant?: string;\n}): Promise<void> {\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n\n  const workers = await getWorkers(config, baseDir);\n  console.log(\n    `\\nStatus for ${config.tenant.name} (${config.tenant.slug}) — env: ${env}\\n`,\n  );\n\n  if (options.tenant?.trim()) {\n    const raw = options.tenant.trim();\n    const colon = raw.indexOf(\":\");\n    if (colon < 1) {\n      throw new Error(\n        'status --tenant expects \"product:workspace\" (e.g. todo:acme)',\n      );\n    }\n    const product = raw.slice(0, colon);\n    const workspace = raw.slice(colon + 1);\n    const t = state.getTenant(product, workspace);\n    console.log(`Workspace tenant ${tenantStateKey(product, workspace)}:`);\n    if (!t) {\n      console.log(\"  (no record in tamer state)\\n\");\n      return;\n    }\n    console.log(`  status: ${t.provisioningStatus}`);\n    console.log(`  dispatch namespace: ${t.dispatchNamespaceName}`);\n    console.log(`  script: ${t.scriptName}`);\n    if (t.d1Shards?.length) {\n      console.log(\"  D1 shards:\");\n      for (const s of t.d1Shards) {\n        console.log(`    ${s.role}: ${s.derivedName} [${s.cfId}]`);\n      }\n    }\n    console.log();\n    return;\n  }\n\n  const outputRows = buildOutputsView(config, state);\n  if (outputRows.length > 0) {\n    console.log(\"Stack outputs:\");\n    for (const r of outputRows) {\n      const valueText =\n        r.value === null\n          ? \"(unresolved — run apply)\"\n          : r.value;\n      const meta: string[] = [r.status];\n      if (r.status === \"stale\" && r.declaredSource) {\n        meta.push(`source drifted → ${r.declaredSource}`);\n      }\n      console.log(`  ${r.name}: ${valueText} [${meta.join(\", \")}]`);\n    }\n    console.log();\n  }\n\n  // Inbound imports — show every `${tamer:import:<stack>.<output>}`\n  // referenced by config, grouped by source stack. We tolerate fetch\n  // failures so `tamer status` still works in offline / partial-cred\n  // environments; a missing sibling row just displays \"(unresolved)\".\n  const importRefs = scanConfigForImports(config);\n  let siblingImports: Record<string, Record<string, string>> = {};\n  try {\n    siblingImports = await fetchStackImports(api, config, env);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    console.warn(`(could not pre-fetch imported stacks: ${msg})`);\n  }\n  if (importRefs.length > 0) {\n    console.log(\"Stack imports:\");\n    const byStack = new Map<string, Set<string>>();\n    for (const r of importRefs) {\n      if (!byStack.has(r.stack)) byStack.set(r.stack, new Set());\n      byStack.get(r.stack)!.add(r.output);\n    }\n    for (const [stack, outputs] of [...byStack].sort(([a], [b]) =>\n      a.localeCompare(b),\n    )) {\n      console.log(`  from stack \"${stack}\":`);\n      const stackOutputs = siblingImports[stack] ?? {};\n      for (const out of [...outputs].sort()) {\n        const v = stackOutputs[out];\n        const status = v === undefined ? \"unresolved\" : \"resolved\";\n        const value = v ?? \"(missing — run `tamer apply` on that stack)\";\n        console.log(`    ${out}: ${value} [${status}]`);\n      }\n    }\n    console.log();\n  }\n\n  const dns = dispatchNamespaceStatus(\n    getDispatchNamespaces(config),\n    env,\n    state,\n    naming,\n  );\n  if (dns.length > 0) {\n    console.log(\"Dispatch namespaces:\");\n    for (const r of dns) {\n      console.log(`  ${r.logicalName} (${r.namespace}) [${r.status}]`);\n    }\n    console.log();\n  }\n\n  const dnsRows = dnsRecordStatus(getDnsRecords(config), env, state);\n  if (dnsRows.length > 0) {\n    console.log(\"DNS records:\");\n    for (const r of dnsRows) {\n      const id = r.recordId ? ` [${r.recordId}]` : \"\";\n      console.log(`  ${r.logicalName}: ${r.type} ${r.name}${id} [${r.status}]`);\n    }\n    console.log();\n  }\n\n  let logpushLive:\n    | Awaited<ReturnType<CFApiClient[\"logpushAccountJobsList\"]>>\n    | undefined;\n  if (env !== \"local\") {\n    try {\n      logpushLive = await api.logpushAccountJobsList();\n    } catch {\n      // Token may lack Logpush list; state-only rows still print.\n    }\n  }\n  const logpushRows = logpushJobStatus(\n    getLogpushJobs(config),\n    config.tenant,\n    env,\n    state,\n    logpushLive,\n  );\n  if (logpushRows.length > 0) {\n    console.log(\"Logpush jobs:\");\n    for (const r of logpushRows) {\n      const id = r.cfJobId != null ? ` [id ${r.cfJobId}]` : \"\";\n      const hints: string[] = [];\n      if (r.cfEnabled === false) hints.push(\"disabled on Cloudflare\");\n      if (r.cfError) hints.push(`CF error: ${r.cfError}`);\n      const hint = hints.length > 0 ? ` — ${hints.join(\"; \")}` : \"\";\n      console.log(`  ${r.logicalName}: ${r.jobName}${id} [${r.status}]${hint}`);\n    }\n    console.log();\n  }\n\n  for (const [workerKey, workerConfig] of workers) {\n    console.log(`Worker: ${workerKey}`);\n    const deployedName = resolveDeployedWorkerName(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      naming,\n    );\n    const mergedWorker = mergeWorkerConfigForResourcePick(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports: siblingImports },\n    );\n    let printedAny = false;\n    for (const mod of resourceModules) {\n      const resources = mod.pickResources(mergedWorker);\n      if (resources.length === 0) continue;\n      const rows = mod.status({\n        resources,\n        env,\n        state,\n        naming,\n        worker: { workerKey, deployedName },\n      });\n      if (rows.length === 0) continue;\n      printedAny = true;\n      console.log(`  ${mod.label}:`);\n      for (const r of rows) {\n        console.log(`    ${r.binding}: ${r.name} [${r.status}]`);\n      }\n    }\n    if (!printedAny) console.log(\"  (no resources)\");\n    console.log();\n  }\n}\n"],"mappings":";;;;;;;;;;;AAKA,SAAgB,wBACd,WACA,MACA,OACA,SAC2E;CAC3E,MAAMA,UAID,EAAE;AAEP,MAAK,MAAM,UAAU,WAAW;EAC9B,MAAM,MAAM,eAAe,OAAO;EAClC,MAAM,QAAQ,MAAM,IAAI,IAAI;AAC5B,UAAQ,KAAK;GACX,aAAa,OAAO;GACpB,WAAW,OAAO;GAClB,QACE,OAAO,SAAS,uBAAuB,OAAO;GACjD,CAAC;;AAGJ,QAAO;;;;;ACbT,SAAgB,gBACd,WACA,KACA,OACsB;CACtB,MAAMC,OAA6B,EAAE;AACrC,MAAK,MAAM,UAAU,WAAW;AAC9B,MAAI,CAAC,sBAAsB,QAAQ,IAAI,EAAE;AACvC,QAAK,KAAK;IACR,aAAa,OAAO;IACpB,MAAM,OAAO;IACb,MAAM,OAAO;IACb,QAAQ;IACT,CAAC;AACF;;EAEF,MAAM,QAAQ,MAAM,IAClB,kBAAkB,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK,CAC3D;AACD,MAAI,OAAO,SAAS,aAClB,MAAK,KAAK;GACR,aAAa,OAAO;GACpB,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,UAAU,MAAM;GAChB,QAAQ;GACT,CAAC;MAEF,MAAK,KAAK;GACR,aAAa,OAAO;GACpB,MAAM,OAAO;GACb,MAAM,OAAO;GACb,QAAQ;GACT,CAAC;;AAGN,QAAO;;;;;AC7BT,eAAsB,UAAU,SAKd;CAChB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAEH,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,SAAQ,IACN,gBAAgB,OAAO,OAAO,KAAK,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,IAC1E;AAED,KAAI,QAAQ,QAAQ,MAAM,EAAE;EAC1B,MAAM,MAAM,QAAQ,OAAO,MAAM;EACjC,MAAM,QAAQ,IAAI,QAAQ,IAAI;AAC9B,MAAI,QAAQ,EACV,OAAM,IAAI,MACR,iEACD;EAEH,MAAM,UAAU,IAAI,MAAM,GAAG,MAAM;EACnC,MAAM,YAAY,IAAI,MAAM,QAAQ,EAAE;EACtC,MAAM,IAAI,MAAM,UAAU,SAAS,UAAU;AAC7C,UAAQ,IAAI,oBAAoB,eAAe,SAAS,UAAU,CAAC,GAAG;AACtE,MAAI,CAAC,GAAG;AACN,WAAQ,IAAI,iCAAiC;AAC7C;;AAEF,UAAQ,IAAI,aAAa,EAAE,qBAAqB;AAChD,UAAQ,IAAI,yBAAyB,EAAE,wBAAwB;AAC/D,UAAQ,IAAI,aAAa,EAAE,aAAa;AACxC,MAAI,EAAE,UAAU,QAAQ;AACtB,WAAQ,IAAI,eAAe;AAC3B,QAAK,MAAM,KAAK,EAAE,SAChB,SAAQ,IAAI,OAAO,EAAE,KAAK,IAAI,EAAE,YAAY,IAAI,EAAE,KAAK,GAAG;;AAG9D,UAAQ,KAAK;AACb;;CAGF,MAAM,aAAa,iBAAiB,QAAQ,MAAM;AAClD,KAAI,WAAW,SAAS,GAAG;AACzB,UAAQ,IAAI,iBAAiB;AAC7B,OAAK,MAAM,KAAK,YAAY;GAC1B,MAAM,YACJ,EAAE,UAAU,OACR,6BACA,EAAE;GACR,MAAMC,OAAiB,CAAC,EAAE,OAAO;AACjC,OAAI,EAAE,WAAW,WAAW,EAAE,eAC5B,MAAK,KAAK,oBAAoB,EAAE,iBAAiB;AAEnD,WAAQ,IAAI,KAAK,EAAE,KAAK,IAAI,UAAU,IAAI,KAAK,KAAK,KAAK,CAAC,GAAG;;AAE/D,UAAQ,KAAK;;CAOf,MAAM,aAAa,qBAAqB,OAAO;CAC/C,IAAIC,iBAAyD,EAAE;AAC/D,KAAI;AACF,mBAAiB,MAAM,kBAAkB,KAAK,QAAQ,IAAI;UACnD,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,yCAAyC,IAAI,GAAG;;AAE/D,KAAI,WAAW,SAAS,GAAG;AACzB,UAAQ,IAAI,iBAAiB;EAC7B,MAAM,0BAAU,IAAI,KAA0B;AAC9C,OAAK,MAAM,KAAK,YAAY;AAC1B,OAAI,CAAC,QAAQ,IAAI,EAAE,MAAM,CAAE,SAAQ,IAAI,EAAE,uBAAO,IAAI,KAAK,CAAC;AAC1D,WAAQ,IAAI,EAAE,MAAM,CAAE,IAAI,EAAE,OAAO;;AAErC,OAAK,MAAM,CAAC,OAAO,YAAY,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OACtD,EAAE,cAAc,EAAE,CACnB,EAAE;AACD,WAAQ,IAAI,iBAAiB,MAAM,IAAI;GACvC,MAAM,eAAe,eAAe,UAAU,EAAE;AAChD,QAAK,MAAM,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE;IACrC,MAAM,IAAI,aAAa;IACvB,MAAM,SAAS,MAAM,SAAY,eAAe;IAChD,MAAM,QAAQ,KAAK;AACnB,YAAQ,IAAI,OAAO,IAAI,IAAI,MAAM,IAAI,OAAO,GAAG;;;AAGnD,UAAQ,KAAK;;CAGf,MAAM,MAAM,wBACV,sBAAsB,OAAO,EAC7B,KACA,OACA,OACD;AACD,KAAI,IAAI,SAAS,GAAG;AAClB,UAAQ,IAAI,uBAAuB;AACnC,OAAK,MAAM,KAAK,IACd,SAAQ,IAAI,KAAK,EAAE,YAAY,IAAI,EAAE,UAAU,KAAK,EAAE,OAAO,GAAG;AAElE,UAAQ,KAAK;;CAGf,MAAM,UAAU,gBAAgB,cAAc,OAAO,EAAE,KAAK,MAAM;AAClE,KAAI,QAAQ,SAAS,GAAG;AACtB,UAAQ,IAAI,eAAe;AAC3B,OAAK,MAAM,KAAK,SAAS;GACvB,MAAM,KAAK,EAAE,WAAW,KAAK,EAAE,SAAS,KAAK;AAC7C,WAAQ,IAAI,KAAK,EAAE,YAAY,IAAI,EAAE,KAAK,GAAG,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,GAAG;;AAE3E,UAAQ,KAAK;;CAGf,IAAIC;AAGJ,KAAI,QAAQ,QACV,KAAI;AACF,gBAAc,MAAM,IAAI,wBAAwB;SAC1C;CAIV,MAAM,cAAc,iBAClB,eAAe,OAAO,EACtB,OAAO,QACP,KACA,OACA,YACD;AACD,KAAI,YAAY,SAAS,GAAG;AAC1B,UAAQ,IAAI,gBAAgB;AAC5B,OAAK,MAAM,KAAK,aAAa;GAC3B,MAAM,KAAK,EAAE,WAAW,OAAO,QAAQ,EAAE,QAAQ,KAAK;GACtD,MAAMC,QAAkB,EAAE;AAC1B,OAAI,EAAE,cAAc,MAAO,OAAM,KAAK,yBAAyB;AAC/D,OAAI,EAAE,QAAS,OAAM,KAAK,aAAa,EAAE,UAAU;GACnD,MAAM,OAAO,MAAM,SAAS,IAAI,MAAM,MAAM,KAAK,KAAK,KAAK;AAC3D,WAAQ,IAAI,KAAK,EAAE,YAAY,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,OAAO,GAAG,OAAO;;AAE3E,UAAQ,KAAK;;AAGf,MAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;AAC/C,UAAQ,IAAI,WAAW,YAAY;EACnC,MAAM,eAAe,0BACnB,QACA,WACA,cACA,KACA,OACD;EACD,MAAM,eAAe,iCACnB,QACA,WACA,cACA,KACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY,SAAS;GAAgB,CACxD;EACD,IAAI,aAAa;AACjB,OAAK,MAAM,OAAO,iBAAiB;GACjC,MAAM,YAAY,IAAI,cAAc,aAAa;AACjD,OAAI,UAAU,WAAW,EAAG;GAC5B,MAAM,OAAO,IAAI,OAAO;IACtB;IACA;IACA;IACA;IACA,QAAQ;KAAE;KAAW;KAAc;IACpC,CAAC;AACF,OAAI,KAAK,WAAW,EAAG;AACvB,gBAAa;AACb,WAAQ,IAAI,KAAK,IAAI,MAAM,GAAG;AAC9B,QAAK,MAAM,KAAK,KACd,SAAQ,IAAI,OAAO,EAAE,QAAQ,IAAI,EAAE,KAAK,IAAI,EAAE,OAAO,GAAG;;AAG5D,MAAI,CAAC,WAAY,SAAQ,IAAI,mBAAmB;AAChD,UAAQ,KAAK"}

package/dist/{sync-B_pyPi7Z.mjs → sync-BdJ43vO7.mjs}

@@ -1,12 +1,12 @@
 import { f as getDispatchNamespaces, m as getLogpushJobs, p as getDnsRecords } from "./normalize-DVSTRZhO.mjs";
-import { n as loadConfig, t as getWorkers } from "./loader-DAvCKLTT.mjs";
+import { n as loadConfig, t as getWorkers } from "./loader-DnT9iqz9.mjs";
 import { n as cloudflareAccountIdFromEnv, t as CFApiClient } from "./CFApiClient-DhbyyV71.mjs";
-import { _ as namingFromConfig, a as resourceModules, t as fetchStackImports, u as mergeWorkerConfigForResourcePick } from "./fetchStackImports-C-1THPYL.mjs";
-import { f as stackNameForConfig, t as StateManager } from "./StateManager-DTqtLLVX.mjs";
+import { a as resourceModules, d as mergeWorkerConfigForResourcePick, t as fetchStackImports, v as namingFromConfig } from "./fetchStackImports-ClUYZy_U.mjs";
+import { f as stackNameForConfig, t as StateManager } from "./StateManager-JLBtz9V-.mjs";
 import "./r2S3EmptyBucket-DD81ZWQ7.mjs";
-import { n as dispatchNamespaceSync, t as dnsRecordSync } from "./dns-records.sync-Bpzz9H0s.mjs";
+import { n as dispatchNamespaceSync, t as dnsRecordSync } from "./dns-records.sync-CfI1mqXv.mjs";
 import { i as logpushJobSync } from "./logpush-job-DsRkOORJ.mjs";
-import { i as workerRouteSync } from "./worker-route-CMbtozNa.mjs";
+import { i as workerRouteSync } from "./worker-route-DY1onr-h.mjs";
 
 //#region src/cli/commands/sync.ts
 async function runSync(options) {
@@ -87,4 +87,4 @@ async function runSync(options) {
 
 //#endregion
 export { runSync };
-//# sourceMappingURL=sync-B_pyPi7Z.mjs.map
+//# sourceMappingURL=sync-BdJ43vO7.mjs.map

package/dist/{sync-B_pyPi7Z.mjs.map → sync-BdJ43vO7.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"sync-B_pyPi7Z.mjs","names":[],"sources":["../src/cli/commands/sync.ts"],"sourcesContent":["import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { dispatchNamespaceSync } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordSync } from \"../../features/dns-records/index.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobSync } from \"../../features/logpush-job/index.js\";\nimport { workerRouteSync } from \"../../features/worker-route/index.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\nimport { mergeWorkerConfigForResourcePick } from \"../../core/config/resolver.js\";\n\nexport async function runSync(options: {\n  env?: string;\n  configPath?: string;\n}): Promise<void> {\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  // Tolerant pre-fetch: sync runs against existing cloud state, so we\n  // pass real import values into worker-route resolution to avoid\n  // matching against `${tamer:import:…}` placeholders.\n  const imports = await fetchStackImports(api, config, env).catch((err) => {\n    const msg = err instanceof Error ? err.message : String(err);\n    console.warn(`[sync] skipping cross-stack imports: ${msg}`);\n    return {} as Record<string, Record<string, string>>;\n  });\n\n  async function safeList<T>(\n    label: string,\n    fn: () => Promise<T[]>,\n  ): Promise<T[]> {\n    try {\n      return await fn();\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] skipping ${label}: ${msg}`);\n      return [];\n    }\n  }\n\n  const lists = await Promise.all(\n    resourceModules.map((m) =>\n      safeList(`${m.label} list`, () => m.fetchAll(api)),\n    ),\n  );\n\n  if (getDispatchNamespaces(config).length > 0) {\n    try {\n      await dispatchNamespaceSync(\n        getDispatchNamespaces(config),\n        config.tenant,\n        env,\n        api,\n        state,\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] skipping dispatch namespaces: ${msg}`);\n    }\n  }\n\n  if (getDnsRecords(config).length > 0) {\n    try {\n      await dnsRecordSync(\n        getDnsRecords(config),\n        config.tenant,\n        env,\n        api,\n        state,\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] skipping dns records: ${msg}`);\n    }\n  }\n\n  if (getLogpushJobs(config).length > 0 && env !== \"local\") {\n    try {\n      await logpushJobSync(\n        getLogpushJobs(config),\n        config.tenant,\n        env,\n        api,\n        state,\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] skipping logpush jobs: ${msg}`);\n    }\n  }\n\n  const workers = await getWorkers(config, baseDir);\n  for (const [workerKey, workerConfig] of workers) {\n    const mergedWorker = mergeWorkerConfigForResourcePick(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports },\n    );\n    resourceModules.forEach((mod, i) => {\n      const resources = mod.pickResources(mergedWorker);\n      if (resources.length === 0) return;\n      mod.sync({\n        resources,\n        all: lists[i],\n        tenant: config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n      });\n    });\n  }\n\n  try {\n    await workerRouteSync(env, config, baseDir, accountId, naming, state, api, {\n      imports,\n    });\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    console.warn(`[sync] skipping worker routes: ${msg}`);\n  }\n\n  await state.persist(api);\n  console.log(`Synced state for env: ${env}`);\n}\n"],"mappings":";;;;;;;;;;;AAeA,eAAsB,QAAQ,SAGZ;CAChB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAIxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI,CAAC,OAAO,QAAQ;EACvE,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,wCAAwC,MAAM;AAC3D,SAAO,EAAE;GACT;CAEF,eAAe,SACb,OACA,IACc;AACd,MAAI;AACF,UAAO,MAAM,IAAI;WACV,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,mBAAmB,MAAM,IAAI,MAAM;AAChD,UAAO,EAAE;;;CAIb,MAAM,QAAQ,MAAM,QAAQ,IAC1B,gBAAgB,KAAK,MACnB,SAAS,GAAG,EAAE,MAAM,cAAc,EAAE,SAAS,IAAI,CAAC,CACnD,CACF;AAED,KAAI,sBAAsB,OAAO,CAAC,SAAS,EACzC,KAAI;AACF,QAAM,sBACJ,sBAAsB,OAAO,EAC7B,OAAO,QACP,KACA,KACA,MACD;UACM,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,wCAAwC,MAAM;;AAI/D,KAAI,cAAc,OAAO,CAAC,SAAS,EACjC,KAAI;AACF,QAAM,cACJ,cAAc,OAAO,EACrB,OAAO,QACP,KACA,KACA,MACD;UACM,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,gCAAgC,MAAM;;AAIvD,KAAI,eAAe,OAAO,CAAC,SAAS,KAAK,QAAQ,QAC/C,KAAI;AACF,QAAM,eACJ,eAAe,OAAO,EACtB,OAAO,QACP,KACA,KACA,MACD;UACM,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,iCAAiC,MAAM;;CAIxD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,MAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;EAC/C,MAAM,eAAe,iCACnB,QACA,WACA,cACA,KACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY;GAAS,CACxC;AACD,kBAAgB,SAAS,KAAK,MAAM;GAClC,MAAM,YAAY,IAAI,cAAc,aAAa;AACjD,OAAI,UAAU,WAAW,EAAG;AAC5B,OAAI,KAAK;IACP;IACA,KAAK,MAAM;IACX,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;IACF;;AAGJ,KAAI;AACF,QAAM,gBAAgB,KAAK,QAAQ,SAAS,WAAW,QAAQ,OAAO,KAAK,EACzE,SACD,CAAC;UACK,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,kCAAkC,MAAM;;AAGvD,OAAM,MAAM,QAAQ,IAAI;AACxB,SAAQ,IAAI,yBAAyB,MAAM"}
+{"version":3,"file":"sync-BdJ43vO7.mjs","names":[],"sources":["../src/cli/commands/sync.ts"],"sourcesContent":["import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { dispatchNamespaceSync } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordSync } from \"../../features/dns-records/index.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobSync } from \"../../features/logpush-job/index.js\";\nimport { workerRouteSync } from \"../../features/worker-route/index.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\nimport { mergeWorkerConfigForResourcePick } from \"../../core/config/resolver.js\";\n\nexport async function runSync(options: {\n  env?: string;\n  configPath?: string;\n}): Promise<void> {\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  // Tolerant pre-fetch: sync runs against existing cloud state, so we\n  // pass real import values into worker-route resolution to avoid\n  // matching against `${tamer:import:…}` placeholders.\n  const imports = await fetchStackImports(api, config, env).catch((err) => {\n    const msg = err instanceof Error ? err.message : String(err);\n    console.warn(`[sync] skipping cross-stack imports: ${msg}`);\n    return {} as Record<string, Record<string, string>>;\n  });\n\n  async function safeList<T>(\n    label: string,\n    fn: () => Promise<T[]>,\n  ): Promise<T[]> {\n    try {\n      return await fn();\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] skipping ${label}: ${msg}`);\n      return [];\n    }\n  }\n\n  const lists = await Promise.all(\n    resourceModules.map((m) =>\n      safeList(`${m.label} list`, () => m.fetchAll(api)),\n    ),\n  );\n\n  if (getDispatchNamespaces(config).length > 0) {\n    try {\n      await dispatchNamespaceSync(\n        getDispatchNamespaces(config),\n        config.tenant,\n        env,\n        api,\n        state,\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] skipping dispatch namespaces: ${msg}`);\n    }\n  }\n\n  if (getDnsRecords(config).length > 0) {\n    try {\n      await dnsRecordSync(\n        getDnsRecords(config),\n        config.tenant,\n        env,\n        api,\n        state,\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] skipping dns records: ${msg}`);\n    }\n  }\n\n  if (getLogpushJobs(config).length > 0 && env !== \"local\") {\n    try {\n      await logpushJobSync(\n        getLogpushJobs(config),\n        config.tenant,\n        env,\n        api,\n        state,\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] skipping logpush jobs: ${msg}`);\n    }\n  }\n\n  const workers = await getWorkers(config, baseDir);\n  for (const [workerKey, workerConfig] of workers) {\n    const mergedWorker = mergeWorkerConfigForResourcePick(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports },\n    );\n    resourceModules.forEach((mod, i) => {\n      const resources = mod.pickResources(mergedWorker);\n      if (resources.length === 0) return;\n      mod.sync({\n        resources,\n        all: lists[i],\n        tenant: config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n      });\n    });\n  }\n\n  try {\n    await workerRouteSync(env, config, baseDir, accountId, naming, state, api, {\n      imports,\n    });\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    console.warn(`[sync] skipping worker routes: ${msg}`);\n  }\n\n  await state.persist(api);\n  console.log(`Synced state for env: ${env}`);\n}\n"],"mappings":";;;;;;;;;;;AAeA,eAAsB,QAAQ,SAGZ;CAChB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAIxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI,CAAC,OAAO,QAAQ;EACvE,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,wCAAwC,MAAM;AAC3D,SAAO,EAAE;GACT;CAEF,eAAe,SACb,OACA,IACc;AACd,MAAI;AACF,UAAO,MAAM,IAAI;WACV,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,mBAAmB,MAAM,IAAI,MAAM;AAChD,UAAO,EAAE;;;CAIb,MAAM,QAAQ,MAAM,QAAQ,IAC1B,gBAAgB,KAAK,MACnB,SAAS,GAAG,EAAE,MAAM,cAAc,EAAE,SAAS,IAAI,CAAC,CACnD,CACF;AAED,KAAI,sBAAsB,OAAO,CAAC,SAAS,EACzC,KAAI;AACF,QAAM,sBACJ,sBAAsB,OAAO,EAC7B,OAAO,QACP,KACA,KACA,MACD;UACM,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,wCAAwC,MAAM;;AAI/D,KAAI,cAAc,OAAO,CAAC,SAAS,EACjC,KAAI;AACF,QAAM,cACJ,cAAc,OAAO,EACrB,OAAO,QACP,KACA,KACA,MACD;UACM,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,gCAAgC,MAAM;;AAIvD,KAAI,eAAe,OAAO,CAAC,SAAS,KAAK,QAAQ,QAC/C,KAAI;AACF,QAAM,eACJ,eAAe,OAAO,EACtB,OAAO,QACP,KACA,KACA,MACD;UACM,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,iCAAiC,MAAM;;CAIxD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,MAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;EAC/C,MAAM,eAAe,iCACnB,QACA,WACA,cACA,KACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY;GAAS,CACxC;AACD,kBAAgB,SAAS,KAAK,MAAM;GAClC,MAAM,YAAY,IAAI,cAAc,aAAa;AACjD,OAAI,UAAU,WAAW,EAAG;AAC5B,OAAI,KAAK;IACP;IACA,KAAK,MAAM;IACX,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;IACF;;AAGJ,KAAI;AACF,QAAM,gBAAgB,KAAK,QAAQ,SAAS,WAAW,QAAQ,OAAO,KAAK,EACzE,SACD,CAAC;UACK,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,kCAAkC,MAAM;;AAGvD,OAAM,MAAM,QAAQ,IAAI;AACxB,SAAQ,IAAI,yBAAyB,MAAM"}

package/dist/tamer.mjs

@@ -2723,6 +2723,17 @@ function _array(Class, element, params) {
 	});
 }
 /* @__NO_SIDE_EFFECTS__ */
+function _custom(Class, fn, _params) {
+	const norm = normalizeParams(_params);
+	norm.abort ?? (norm.abort = true);
+	return new Class({
+		type: "custom",
+		check: "custom",
+		fn,
+		...norm
+	});
+}
+/* @__NO_SIDE_EFFECTS__ */
 function _refine(Class, fn, _params) {
 	return new Class({
 		type: "custom",
@@ -4020,6 +4031,9 @@ const ZodCustom = /* @__PURE__ */ $constructor("ZodCustom", (inst, def) => {
 	ZodType.init(inst, def);
 	inst._zod.processJSONSchema = (ctx, json, params) => customProcessor(inst, ctx, json, params);
 });
+function custom(fn, _params) {
+	return _custom(ZodCustom, fn ?? (() => true), _params);
+}
 function refine(fn, _params = {}) {
 	return _refine(ZodCustom, fn, _params);
 }
@@ -4346,14 +4360,14 @@ async function main() {
 	try {
 		switch (command) {
 			case "bootstrap":
-				await import("./bootstrap-BxwxC_2Z.mjs").then((m) => m.runBootstrap(parseBootstrapArgs(rest)));
+				await import("./bootstrap-BicPW44a.mjs").then((m) => m.runBootstrap(parseBootstrapArgs(rest)));
 				break;
 			case "sync":
-				await import("./sync-B_pyPi7Z.mjs").then((m) => m.runSync(parseSyncArgs(rest)));
+				await import("./sync-BdJ43vO7.mjs").then((m) => m.runSync(parseSyncArgs(rest)));
 				break;
 			case "apply": {
 				const a = parseApplyArgs(rest);
-				await import("./apply-BOABC3UB.mjs").then((m) => m.runApply({
+				await import("./apply-CWU3HY0P.mjs").then((m) => m.runApply({
 					env: a.env,
 					addShard: a.addShard,
 					configPath: a.configPath,
@@ -4365,11 +4379,11 @@ async function main() {
 				break;
 			}
 			case "dev":
-				await import("./dev-CZbKfdFw.mjs").then((m) => m.runDev(parseDevArgs(rest)));
+				await import("./dev-BYItpt9U.mjs").then((m) => m.runDev(parseDevArgs(rest)));
 				break;
 			case "deploy": {
 				const d = parseDeployArgs(rest);
-				await import("./deploy-C0edCpn9.mjs").then((m) => m.runDeploy({
+				await import("./deploy-DAEjDjOm.mjs").then((m) => m.runDeploy({
 					worker: d.worker,
 					env: d.env,
 					configPath: d.configPath,
@@ -4378,23 +4392,23 @@ async function main() {
 				break;
 			}
 			case "migrate":
-				await import("./migrate-BpW6JkIg.mjs").then((m) => m.runMigrate(parseMigrateArgs(rest)));
+				await import("./migrate-Bwl0w6XN.mjs").then((m) => m.runMigrate(parseMigrateArgs(rest)));
 				break;
 			case "types":
-				await import("./types-JrdlG7Dy.mjs").then((m) => m.runTypes(parseTypesArgs(rest)));
+				await import("./types-CN1BOr0U.mjs").then((m) => m.runTypes(parseTypesArgs(rest)));
 				break;
 			case "status":
-				await import("./status-D5GLpWyn.mjs").then((m) => m.runStatus(parseStatusArgs(rest)));
+				await import("./status-BAPpi2Zt.mjs").then((m) => m.runStatus(parseStatusArgs(rest)));
 				break;
 			case "events":
-				await import("./events-BIznt8Sj.mjs").then((m) => m.runEvents(parseEventsArgs(rest)));
+				await import("./events-B6oCdvSt.mjs").then((m) => m.runEvents(parseEventsArgs(rest)));
 				break;
 			case "drift":
-				exitStatus = await import("./drift-BNa92AK5.mjs").then((m) => m.runDrift(parseDriftArgs(rest)));
+				exitStatus = await import("./drift-DRnwTyZD.mjs").then((m) => m.runDrift(parseDriftArgs(rest)));
 				break;
 			case "plan": {
 				const p = parsePlanArgs(rest);
-				exitStatus = await import("./plan-Do5rE-c5.mjs").then((m) => m.runPlan({
+				exitStatus = await import("./plan-BNIAD--f.mjs").then((m) => m.runPlan({
 					env: p.env,
 					configPath: p.configPath,
 					json: p.json,
@@ -4406,14 +4420,14 @@ async function main() {
 				break;
 			}
 			case "import":
-				await import("./import-B0dlwKoQ.mjs").then((m) => m.runImport(parseImportArgs(rest)));
+				await import("./import-D8zaVvwK.mjs").then((m) => m.runImport(parseImportArgs(rest)));
 				break;
 			case "doctor":
 				exitStatus = await import("./doctor-C_hs7k2D.mjs").then((m) => m.runDoctor(parseDoctorArgs(rest)));
 				break;
 			case "provision-tenant": {
 				const p = parseProvisionTenantArgs(rest);
-				await import("./provision-tenant-Wfck-2Oa.mjs").then((m) => m.runProvisionTenant({
+				await import("./provision-tenant-BcZocyyn.mjs").then((m) => m.runProvisionTenant({
 					env: p.env,
 					product: p.product,
 					workspace: p.workspace,
@@ -4430,7 +4444,7 @@ async function main() {
 			}
 			case "destroy-tenant": {
 				const t = parseDestroyTenantArgs(rest);
-				await import("./destroy-tenant-U0t7BeJ0.mjs").then((m) => m.runDestroyTenant({
+				await import("./destroy-tenant-B-VLKfc6.mjs").then((m) => m.runDestroyTenant({
 					env: t.env,
 					product: t.product,
 					workspace: t.workspace,
@@ -4443,7 +4457,7 @@ async function main() {
 			}
 			case "destroy": {
 				const d = parseDestroyArgs(rest);
-				await import("./destroy-DzgA4lCA.mjs").then((m) => m.runDestroy({
+				await import("./destroy-DtgPD_bD.mjs").then((m) => m.runDestroy({
 					env: d.env,
 					force: d.force,
 					skipWorkers: d.skipWorkers,
@@ -4458,12 +4472,12 @@ async function main() {
 			case "wfp": {
 				const [sub, ...wfpRest] = rest;
 				if (sub === "put") {
-					const { parseWfpPutArgs, runWfpPut } = await import("./wfp-put-DL0mJNNz.mjs");
+					const { parseWfpPutArgs, runWfpPut } = await import("./wfp-put-DjErqxFa.mjs");
 					await runWfpPut(parseWfpPutArgs(wfpRest));
 					break;
 				}
 				if (sub === "delete") {
-					const { parseWfpDeleteArgs, runWfpDelete } = await import("./wfp-delete-BhuUrBUA.mjs");
+					const { parseWfpDeleteArgs, runWfpDelete } = await import("./wfp-delete-BG9WBd7F.mjs");
 					await runWfpDelete(parseWfpDeleteArgs(wfpRest));
 					break;
 				}
@@ -4549,5 +4563,5 @@ Environment variables (same as Wrangler):
 main();
 
 //#endregion
-export { boolean as a, number$1 as c, string as d, union as f, array as i, object as l, _enum as n, discriminatedUnion as o, any as r, literal as s, StateConflictError as t, record as u };
+export { boolean as a, literal as c, record as d, string as f, array as i, number$1 as l, _enum as n, custom as o, union as p, any as r, discriminatedUnion as s, StateConflictError as t, object as u };
 //# sourceMappingURL=tamer.mjs.map