@dragonmastery/tamer 0.29.0 → 0.31.0

package/dist/generator-gvCy7ouY.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"generator-gvCy7ouY.mjs","names":["out: GeneratedSecretsStoreSecretBinding[]","config: WranglerConfig"],"sources":["../src/features/secrets-store/secrets-store.generate.ts","../src/core/wrangler/generator.ts"],"sourcesContent":["import type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport type {\n  StateEntry,\n  SecretsStoreResourceConfig,\n  SecretsStoreSecretBinding,\n  SecretsStoreStateEntry,\n} from \"../../types.js\";\nimport { secretsStoreDeriveName } from \"./secrets-store.naming.js\";\n\nexport interface SecretsStoreStateLike {\n  get(key: string): StateEntry | undefined;\n  getAll(): Record<string, StateEntry>;\n}\n\n/**\n * One row of wrangler's `secrets_store_secrets[]` array. Resolved from a\n * worker's declared `secretsStoreSecrets[]` by looking up the\n * Tamer-managed store's `store_id` in state. The named secret itself must\n * already exist inside the store (created out-of-band via wrangler\n * `secrets-store secret create`); Tamer never reads or writes secret\n * values.\n */\nexport interface GeneratedSecretsStoreSecretBinding {\n  binding: string;\n  store_id: string;\n  secret_name: string;\n}\n\n/**\n * Resolve `secretsStoreSecrets[]` worker bindings into wrangler-shape\n * `secrets_store_secrets[]` entries by looking up the referenced\n * Tamer-managed store's `store_id` in state. Throws with an actionable\n * message if a referenced store has never been applied — the binding\n * would otherwise be deployed against a non-existent store.\n */\nexport function secretsStoreSecretsGenerate(\n  bindings: SecretsStoreSecretBinding[],\n  env: string,\n  state: SecretsStoreStateLike,\n  naming: NamingEngine,\n  secretsStores?: SecretsStoreResourceConfig[],\n): GeneratedSecretsStoreSecretBinding[] {\n  const out: GeneratedSecretsStoreSecretBinding[] = [];\n  for (const b of bindings) {\n    const storeConfig = secretsStores?.find((s) => s.logicalName === b.store);\n    const derivedName = storeConfig\n      ? secretsStoreDeriveName(storeConfig, env, naming)\n      : naming.secretsStoreName(b.store, env);\n    const entry = state.get(`secrets_store:${derivedName}`) as\n      | SecretsStoreStateEntry\n      | undefined;\n    if (!entry || entry.type !== \"secrets_store\") {\n      throw new Error(\n        `Secrets Store binding \"${b.binding}\" references store \"${b.store}\" — ` +\n          `not in state. Declare it under \\`resources.secretsStores\\` and run ` +\n          `'tamer apply --env ${env}' first.`,\n      );\n    }\n    out.push({\n      binding: b.binding,\n      store_id: entry.cfId,\n      secret_name: b.secretName,\n    });\n  }\n  return out;\n}\n","import { writeFileSync } from \"fs\";\nimport { join } from \"path\";\nimport type { WranglerConfig } from \"../../generated/wrangler-types.js\";\nimport type { ResolvedWorkerConfig } from \"../config/resolver.js\";\nimport type { StateManager } from \"../state/StateManager.js\";\nimport type { NamingEngine } from \"../naming/NamingEngine.js\";\nimport { resourceModules } from \"../registry/registry.js\";\nimport { secretsStoreSecretsGenerate } from \"../../features/secrets-store/secrets-store.generate.js\";\n\nexport class CfiError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"CfiError\";\n  }\n}\n\n/**\n * Build the worker's `wrangler.json` by asking every registered resource\n * module for its bindings fragment, then merging on top of the\n * passthrough config (`resolved.wranglerConfig`). Adding a new resource\n * kind requires zero edits here — register the module, done.\n */\nexport function generateWranglerConfig(\n  resolved: ResolvedWorkerConfig,\n  state: StateManager,\n  naming: NamingEngine,\n): WranglerConfig {\n  let config: WranglerConfig = {\n    ...resolved.wranglerConfig,\n    $schema: \"node_modules/wrangler/config-schema.json\",\n  };\n\n  const worker = {\n    workerKey: resolved.workerKey,\n    deployedName: resolved.workerName,\n  };\n  for (const mod of resourceModules) {\n    const resources = mod.pickResources(resolved.resources);\n    const fragment = mod.generate({\n      resources,\n      env: resolved.env,\n      state,\n      naming,\n      passthrough: resolved.wranglerConfig,\n      worker,\n    });\n    config = { ...config, ...fragment };\n  }\n\n  const secretBindings = resolved.resources?.secretsStoreSecrets ?? [];\n  if (secretBindings.length > 0) {\n    const passthroughSecrets =\n      resolved.wranglerConfig.secrets_store_secrets ?? [];\n    const generated = secretsStoreSecretsGenerate(\n      secretBindings,\n      resolved.env,\n      state,\n      naming,\n      resolved.resources?.secretsStores,\n    );\n    config = {\n      ...config,\n      secrets_store_secrets: [...passthroughSecrets, ...generated],\n    };\n  }\n\n  return config;\n}\n\nexport function writeWranglerJson(\n  workerDir: string,\n  config: WranglerConfig,\n  outFile: string = \"wrangler.json\",\n): void {\n  const path = join(workerDir, outFile);\n  writeFileSync(path, JSON.stringify(config, null, 2), \"utf-8\");\n}\n"],"mappings":";;;;;;;;;;;;AAmCA,SAAgB,4BACd,UACA,KACA,OACA,QACA,eACsC;CACtC,MAAMA,MAA4C,EAAE;AACpD,MAAK,MAAM,KAAK,UAAU;EACxB,MAAM,cAAc,eAAe,MAAM,MAAM,EAAE,gBAAgB,EAAE,MAAM;EACzE,MAAM,cAAc,cAChB,uBAAuB,aAAa,KAAK,OAAO,GAChD,OAAO,iBAAiB,EAAE,OAAO,IAAI;EACzC,MAAM,QAAQ,MAAM,IAAI,iBAAiB,cAAc;AAGvD,MAAI,CAAC,SAAS,MAAM,SAAS,gBAC3B,OAAM,IAAI,MACR,0BAA0B,EAAE,QAAQ,sBAAsB,EAAE,MAAM,4FAE1C,IAAI,UAC7B;AAEH,MAAI,KAAK;GACP,SAAS,EAAE;GACX,UAAU,MAAM;GAChB,aAAa,EAAE;GAChB,CAAC;;AAEJ,QAAO;;;;;;;;;;;AC1CT,SAAgB,uBACd,UACA,OACA,QACgB;CAChB,IAAIC,SAAyB;EAC3B,GAAG,SAAS;EACZ,SAAS;EACV;CAED,MAAM,SAAS;EACb,WAAW,SAAS;EACpB,cAAc,SAAS;EACxB;AACD,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,YAAY,IAAI,cAAc,SAAS,UAAU;EACvD,MAAM,WAAW,IAAI,SAAS;GAC5B;GACA,KAAK,SAAS;GACd;GACA;GACA,aAAa,SAAS;GACtB;GACD,CAAC;AACF,WAAS;GAAE,GAAG;GAAQ,GAAG;GAAU;;CAGrC,MAAM,iBAAiB,SAAS,WAAW,uBAAuB,EAAE;AACpE,KAAI,eAAe,SAAS,GAAG;EAC7B,MAAM,qBACJ,SAAS,eAAe,yBAAyB,EAAE;EACrD,MAAM,YAAY,4BAChB,gBACA,SAAS,KACT,OACA,QACA,SAAS,WAAW,cACrB;AACD,WAAS;GACP,GAAG;GACH,uBAAuB,CAAC,GAAG,oBAAoB,GAAG,UAAU;GAC7D;;AAGH,QAAO;;AAGT,SAAgB,kBACd,WACA,QACA,UAAkB,iBACZ;AAEN,eADa,KAAK,WAAW,QAAQ,EACjB,KAAK,UAAU,QAAQ,MAAM,EAAE,EAAE,QAAQ"}

package/dist/{import-B0dlwKoQ.mjs → import-OvohE-H2.mjs}

@@ -1,9 +1,7 @@
-import { n as loadConfig, t as getWorkers } from "./loader-DAvCKLTT.mjs";
-import { n as cloudflareAccountIdFromEnv, t as CFApiClient } from "./CFApiClient-DhbyyV71.mjs";
-import { _ as namingFromConfig, a as resourceModules, i as getResourceModule, p as resolveWorkerConfig, t as fetchStackImports } from "./fetchStackImports-C-1THPYL.mjs";
-import { f as stackNameForConfig, t as StateManager } from "./StateManager-DTqtLLVX.mjs";
-import "./r2S3EmptyBucket-DD81ZWQ7.mjs";
-import { n as workerRouteStateKey, t as findZoneIdByName } from "./zoneResolver-VoxLHM4N.mjs";
+import { B as getWorkers, C as stackNameForConfig, L as CFApiClient, O as resolveWorkerConfig, P as namingFromConfig, R as cloudflareAccountIdFromEnv, V as loadConfig, d as fetchStackImports, m as StateManager } from "./tamer.mjs";
+import { n as resourceModules, t as getResourceModule } from "./registry-EWWdkLf7.mjs";
+import "./r2S3EmptyBucket-B9_pHfvB.mjs";
+import { n as workerRouteStateKey, t as findZoneIdByName } from "./zoneResolver-DNNNmO_w.mjs";
 
 //#region src/cli/commands/import.ts
 const REGISTRY_KINDS = new Set(resourceModules.map((m) => m.kind));
@@ -46,6 +44,8 @@ async function runImport(options) {
 				api,
 				state,
 				naming,
+				config,
+				baseDir,
 				ts
 			});
 		} else if (options.kind === "dispatch_namespace") await importDispatchNamespace({
@@ -110,7 +110,7 @@ async function importDnsRecord(ctx) {
 	const hit = (await api.zoneDnsRecordListAll(declared.zoneId)).find((r) => r.id === options.cfId);
 	if (!hit) throw new Error(`import dns_record: record id "${options.cfId}" not found in zone "${declared.zoneId}"`);
 	if (hit.type !== declared.type) throw new Error(`import dns_record: cf record type "${hit.type}" does not match declared type "${declared.type}"`);
-	const { dnsRecordStateKey } = await import("./dns-records.resolve-C2T0m4NG.mjs");
+	const { dnsRecordStateKey } = await import("./dns-records.resolve-8a_eHfVI.mjs");
 	const key = dnsRecordStateKey(declared.zoneId, declared.type, declared.name);
 	const existing = state.get(key);
 	state.set(key, {
@@ -161,4 +161,4 @@ async function importWorkerRoute(ctx) {
 
 //#endregion
 export { runImport };
-//# sourceMappingURL=import-B0dlwKoQ.mjs.map
+//# sourceMappingURL=import-OvohE-H2.mjs.map

package/dist/import-OvohE-H2.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-OvohE-H2.mjs","names":[],"sources":["../src/cli/commands/import.ts"],"sourcesContent":["import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { resolveWorkerConfig } from \"../../core/config/resolver.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\nimport { workerRouteStateKey } from \"../../features/worker-route/worker-route.stateKey.js\";\nimport { findZoneIdByName } from \"../../core/routes/zoneResolver.js\";\nimport {\n  getResourceModule,\n  resourceModules,\n  type ResourceKind,\n} from \"../../core/registry/registry.js\";\n\n/** All registered resource kinds plus the non-registry imports. */\nexport type ImportKind =\n  | ResourceKind\n  | \"dispatch_namespace\"\n  | \"dns_record\"\n  | \"worker_route\";\n\nexport interface ImportOptions {\n  env: string;\n  kind: ImportKind;\n  /** Logical name from `tamer.config.ts` (or worker key, for `worker_route`). */\n  logical: string;\n  /** Cloudflare resource id (D1 uuid, KV id, R2 bucket name, or namespace name). */\n  cfId?: string;\n  /** Required for sharded D1 imports (YYYY-MM-DD). */\n  shardDate?: string;\n  /** R2 buckets only: creation date (YYYY-MM-DD) used in the binding key. */\n  createdDate?: string;\n  /** worker_route only: the route id from `/zones/{id}/workers/routes`. */\n  routeId?: string;\n  /** worker_route only: zone name from `tamerRoutes`. */\n  zoneName?: string;\n  configPath?: string;\n}\n\nconst REGISTRY_KINDS = new Set<string>(resourceModules.map((m) => m.kind));\n\n/**\n * `tamer import` — register an existing Cloudflare resource into Tamer state\n * by logical name (CloudFormation `import_resources` analogue). For all\n * resource-registry kinds the work is delegated to the module's\n * `importOne` hook; `dispatch_namespace` and `worker_route` remain inline\n * because they aren't registry resources today.\n */\nexport async function runImport(options: ImportOptions): Promise<void> {\n  const env = options.env;\n  if (env === \"local\") {\n    throw new Error(\"import: --env local is not supported (no persisted state)\");\n  }\n  const baseDir = process.cwd();\n  const config = await loadConfig(options.configPath, { env });\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  state.beginOperation(\"import\", `${options.kind}:${options.logical}`);\n\n  const ts = new Date().toISOString();\n\n  try {\n    if (REGISTRY_KINDS.has(options.kind)) {\n      const mod = getResourceModule(options.kind as ResourceKind);\n      if (!mod) throw new Error(`unknown import kind \"${options.kind}\"`);\n      await mod.importOne({\n        options: {\n          env,\n          kind: options.kind,\n          logical: options.logical,\n          cfId: options.cfId,\n          shardDate: options.shardDate,\n          createdDate: options.createdDate,\n          routeId: options.routeId,\n          zoneName: options.zoneName,\n        },\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n        ts,\n      });\n    } else if (options.kind === \"dispatch_namespace\") {\n      await importDispatchNamespace({ options, env, api, state, ts });\n    } else if (options.kind === \"dns_record\") {\n      await importDnsRecord({ options, env, api, state, config, ts });\n    } else if (options.kind === \"worker_route\") {\n      await importWorkerRoute({\n        options,\n        env,\n        baseDir,\n        accountId,\n        api,\n        naming,\n        state,\n        config,\n        ts,\n      });\n    } else {\n      throw new Error(`unknown import kind \"${options.kind}\"`);\n    }\n\n    state.finishOperation(\"imported\");\n    await state.persist(api);\n    console.log(`Imported ${options.kind} \"${options.logical}\" into ${env} state.`);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    state.failOperation(msg);\n    try {\n      await state.persist(api);\n    } catch {\n      /* swallow secondary persist failure */\n    }\n    throw err;\n  }\n}\n\nasync function importDispatchNamespace(ctx: {\n  options: ImportOptions;\n  env: string;\n  api: CFApiClient;\n  state: StateManager;\n  ts: string;\n}): Promise<void> {\n  const { options, api, state, ts } = ctx;\n  const namespaces = await api.dispatchNamespaceListAll();\n  const hit = namespaces.find((n) => n.namespace_name === options.cfId);\n  if (!hit) {\n    throw new Error(\n      `import dispatch_namespace: namespace \"${options.cfId}\" not found`,\n    );\n  }\n  const derivedName = hit.namespace_name;\n  const key = `dispatch_ns:${derivedName}`;\n  const existing = state.get(key);\n  state.set(key, {\n    type: \"dispatch_namespace\",\n    logicalName: options.logical,\n    derivedName,\n    createdAt:\n      existing?.type === \"dispatch_namespace\" ? existing.createdAt : ts,\n    updatedAt: ts,\n  });\n}\n\nasync function importDnsRecord(ctx: {\n  options: ImportOptions;\n  env: string;\n  api: CFApiClient;\n  state: StateManager;\n  config: Awaited<ReturnType<typeof loadConfig>>;\n  ts: string;\n}): Promise<void> {\n  const { options, api, state, config, ts } = ctx;\n  if (!options.cfId) {\n    throw new Error(\n      \"import dns_record: --cf-id <recordId> is required (the record id from `tamer drift` or the Cloudflare dashboard URL)\",\n    );\n  }\n  const declared = (config.dnsRecords ?? []).find(\n    (r) => r.logicalName === options.logical,\n  );\n  if (!declared) {\n    throw new Error(\n      `import dns_record: no dnsRecords entry with logicalName \"${options.logical}\" in the Tamer project config`,\n    );\n  }\n  const list = await api.zoneDnsRecordListAll(declared.zoneId);\n  const hit = list.find((r) => r.id === options.cfId);\n  if (!hit) {\n    throw new Error(\n      `import dns_record: record id \"${options.cfId}\" not found in zone \"${declared.zoneId}\"`,\n    );\n  }\n  if (hit.type !== declared.type) {\n    throw new Error(\n      `import dns_record: cf record type \"${hit.type}\" does not match declared type \"${declared.type}\"`,\n    );\n  }\n  const { dnsRecordStateKey } = await import(\n    \"../../features/dns-records/dns-records.resolve.js\"\n  );\n  const key = dnsRecordStateKey(declared.zoneId, declared.type, declared.name);\n  const existing = state.get(key);\n  state.set(key, {\n    type: \"dns_record\",\n    logicalName: options.logical,\n    zoneId: declared.zoneId,\n    recordType: declared.type,\n    name: hit.name,\n    content: hit.content,\n    ttl: hit.ttl ?? 1,\n    proxied: hit.proxied ?? false,\n    priority: hit.priority,\n    comment: hit.comment ?? \"\",\n    recordId: hit.id,\n    createdAt: existing?.type === \"dns_record\" ? existing.createdAt : ts,\n    updatedAt: ts,\n  });\n}\n\nasync function importWorkerRoute(ctx: {\n  options: ImportOptions;\n  env: string;\n  baseDir: string;\n  accountId: string;\n  api: CFApiClient;\n  naming: ReturnType<typeof namingFromConfig>;\n  state: StateManager;\n  config: Awaited<ReturnType<typeof loadConfig>>;\n  ts: string;\n}): Promise<void> {\n  const { options, env, baseDir, accountId, api, naming, state, config, ts } =\n    ctx;\n  if (!options.routeId) {\n    throw new Error(\"import worker_route: --route-id <id> is required\");\n  }\n  const workers = await getWorkers(config, baseDir);\n  const wc = workers.find(([k]) => k === options.logical)?.[1];\n  if (!wc) {\n    throw new Error(\n      `import worker_route: no worker key \"${options.logical}\" in the Tamer project config`,\n    );\n  }\n  const imports = await fetchStackImports(api, config, env);\n  const resolved = await resolveWorkerConfig(\n    config,\n    options.logical,\n    wc,\n    env,\n    baseDir,\n    accountId,\n    naming,\n    state,\n    { imports },\n  );\n  if (resolved.apiManagedRoutes.length === 0) {\n    throw new Error(\n      `import worker_route: worker \"${options.logical}\" declares no api-managed tamerRoutes for env ${env}`,\n    );\n  }\n\n  const route = options.zoneName\n    ? resolved.apiManagedRoutes.find((r) => r.zone_name === options.zoneName)\n    : resolved.apiManagedRoutes[0];\n  if (!route) {\n    throw new Error(\n      `import worker_route: no route for zone \"${options.zoneName}\" in resolved config`,\n    );\n  }\n  const zoneId = await findZoneIdByName(api, route.zone_name);\n  if (!zoneId) {\n    throw new Error(`import worker_route: zone \"${route.zone_name}\" not found`);\n  }\n  const list = await api.zoneWorkerRoutesList(zoneId);\n  const hit = list.find((r) => r.id === options.routeId);\n  if (!hit) {\n    throw new Error(\n      `import worker_route: route id \"${options.routeId}\" not found in zone \"${route.zone_name}\"`,\n    );\n  }\n  if (hit.pattern !== route.pattern) {\n    throw new Error(\n      `import worker_route: cf pattern \"${hit.pattern}\" does not match resolved \"${route.pattern}\"`,\n    );\n  }\n  const key = workerRouteStateKey(zoneId, options.routeId);\n  const existing = state.get(key);\n  state.set(key, {\n    type: \"worker_route\",\n    workerKey: options.logical,\n    workerName: resolved.workerName,\n    zoneId,\n    zoneName: route.zone_name,\n    routeId: options.routeId,\n    pattern: route.pattern,\n    createdAt: existing?.type === \"worker_route\" ? existing.createdAt : ts,\n    updatedAt: ts,\n  });\n}\n"],"mappings":";;;;;;AAyCA,MAAM,iBAAiB,IAAI,IAAY,gBAAgB,KAAK,MAAM,EAAE,KAAK,CAAC;;;;;;;;AAS1E,eAAsB,UAAU,SAAuC;CACrE,MAAM,MAAM,QAAQ;AACpB,KAAI,QAAQ,QACV,OAAM,IAAI,MAAM,4DAA4D;CAE9E,MAAM,UAAU,QAAQ,KAAK;CAC7B,MAAM,SAAS,MAAM,WAAW,QAAQ,YAAY,EAAE,KAAK,CAAC;CAC5D,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAEH,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;AACxB,OAAM,eAAe,UAAU,GAAG,QAAQ,KAAK,GAAG,QAAQ,UAAU;CAEpE,MAAM,sBAAK,IAAI,MAAM,EAAC,aAAa;AAEnC,KAAI;AACF,MAAI,eAAe,IAAI,QAAQ,KAAK,EAAE;GACpC,MAAM,MAAM,kBAAkB,QAAQ,KAAqB;AAC3D,OAAI,CAAC,IAAK,OAAM,IAAI,MAAM,wBAAwB,QAAQ,KAAK,GAAG;AAClE,SAAM,IAAI,UAAU;IAClB,SAAS;KACP;KACA,MAAM,QAAQ;KACd,SAAS,QAAQ;KACjB,MAAM,QAAQ;KACd,WAAW,QAAQ;KACnB,aAAa,QAAQ;KACrB,SAAS,QAAQ;KACjB,UAAU,QAAQ;KACnB;IACD;IACA;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;aACO,QAAQ,SAAS,qBAC1B,OAAM,wBAAwB;GAAE;GAAS;GAAK;GAAK;GAAO;GAAI,CAAC;WACtD,QAAQ,SAAS,aAC1B,OAAM,gBAAgB;GAAE;GAAS;GAAK;GAAK;GAAO;GAAQ;GAAI,CAAC;WACtD,QAAQ,SAAS,eAC1B,OAAM,kBAAkB;GACtB;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACD,CAAC;MAEF,OAAM,IAAI,MAAM,wBAAwB,QAAQ,KAAK,GAAG;AAG1D,QAAM,gBAAgB,WAAW;AACjC,QAAM,MAAM,QAAQ,IAAI;AACxB,UAAQ,IAAI,YAAY,QAAQ,KAAK,IAAI,QAAQ,QAAQ,SAAS,IAAI,SAAS;UACxE,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,cAAc,IAAI;AACxB,MAAI;AACF,SAAM,MAAM,QAAQ,IAAI;UAClB;AAGR,QAAM;;;AAIV,eAAe,wBAAwB,KAMrB;CAChB,MAAM,EAAE,SAAS,KAAK,OAAO,OAAO;CAEpC,MAAM,OADa,MAAM,IAAI,0BAA0B,EAChC,MAAM,MAAM,EAAE,mBAAmB,QAAQ,KAAK;AACrE,KAAI,CAAC,IACH,OAAM,IAAI,MACR,yCAAyC,QAAQ,KAAK,aACvD;CAEH,MAAM,cAAc,IAAI;CACxB,MAAM,MAAM,eAAe;CAC3B,MAAM,WAAW,MAAM,IAAI,IAAI;AAC/B,OAAM,IAAI,KAAK;EACb,MAAM;EACN,aAAa,QAAQ;EACrB;EACA,WACE,UAAU,SAAS,uBAAuB,SAAS,YAAY;EACjE,WAAW;EACZ,CAAC;;AAGJ,eAAe,gBAAgB,KAOb;CAChB,MAAM,EAAE,SAAS,KAAK,OAAO,QAAQ,OAAO;AAC5C,KAAI,CAAC,QAAQ,KACX,OAAM,IAAI,MACR,uHACD;CAEH,MAAM,YAAY,OAAO,cAAc,EAAE,EAAE,MACxC,MAAM,EAAE,gBAAgB,QAAQ,QAClC;AACD,KAAI,CAAC,SACH,OAAM,IAAI,MACR,4DAA4D,QAAQ,QAAQ,+BAC7E;CAGH,MAAM,OADO,MAAM,IAAI,qBAAqB,SAAS,OAAO,EAC3C,MAAM,MAAM,EAAE,OAAO,QAAQ,KAAK;AACnD,KAAI,CAAC,IACH,OAAM,IAAI,MACR,iCAAiC,QAAQ,KAAK,uBAAuB,SAAS,OAAO,GACtF;AAEH,KAAI,IAAI,SAAS,SAAS,KACxB,OAAM,IAAI,MACR,sCAAsC,IAAI,KAAK,kCAAkC,SAAS,KAAK,GAChG;CAEH,MAAM,EAAE,sBAAsB,MAAM,OAClC;CAEF,MAAM,MAAM,kBAAkB,SAAS,QAAQ,SAAS,MAAM,SAAS,KAAK;CAC5E,MAAM,WAAW,MAAM,IAAI,IAAI;AAC/B,OAAM,IAAI,KAAK;EACb,MAAM;EACN,aAAa,QAAQ;EACrB,QAAQ,SAAS;EACjB,YAAY,SAAS;EACrB,MAAM,IAAI;EACV,SAAS,IAAI;EACb,KAAK,IAAI,OAAO;EAChB,SAAS,IAAI,WAAW;EACxB,UAAU,IAAI;EACd,SAAS,IAAI,WAAW;EACxB,UAAU,IAAI;EACd,WAAW,UAAU,SAAS,eAAe,SAAS,YAAY;EAClE,WAAW;EACZ,CAAC;;AAGJ,eAAe,kBAAkB,KAUf;CAChB,MAAM,EAAE,SAAS,KAAK,SAAS,WAAW,KAAK,QAAQ,OAAO,QAAQ,OACpE;AACF,KAAI,CAAC,QAAQ,QACX,OAAM,IAAI,MAAM,mDAAmD;CAGrE,MAAM,MADU,MAAM,WAAW,QAAQ,QAAQ,EAC9B,MAAM,CAAC,OAAO,MAAM,QAAQ,QAAQ,GAAG;AAC1D,KAAI,CAAC,GACH,OAAM,IAAI,MACR,uCAAuC,QAAQ,QAAQ,+BACxD;CAEH,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;CACzD,MAAM,WAAW,MAAM,oBACrB,QACA,QAAQ,SACR,IACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;AACD,KAAI,SAAS,iBAAiB,WAAW,EACvC,OAAM,IAAI,MACR,gCAAgC,QAAQ,QAAQ,gDAAgD,MACjG;CAGH,MAAM,QAAQ,QAAQ,WAClB,SAAS,iBAAiB,MAAM,MAAM,EAAE,cAAc,QAAQ,SAAS,GACvE,SAAS,iBAAiB;AAC9B,KAAI,CAAC,MACH,OAAM,IAAI,MACR,2CAA2C,QAAQ,SAAS,sBAC7D;CAEH,MAAM,SAAS,MAAM,iBAAiB,KAAK,MAAM,UAAU;AAC3D,KAAI,CAAC,OACH,OAAM,IAAI,MAAM,8BAA8B,MAAM,UAAU,aAAa;CAG7E,MAAM,OADO,MAAM,IAAI,qBAAqB,OAAO,EAClC,MAAM,MAAM,EAAE,OAAO,QAAQ,QAAQ;AACtD,KAAI,CAAC,IACH,OAAM,IAAI,MACR,kCAAkC,QAAQ,QAAQ,uBAAuB,MAAM,UAAU,GAC1F;AAEH,KAAI,IAAI,YAAY,MAAM,QACxB,OAAM,IAAI,MACR,oCAAoC,IAAI,QAAQ,6BAA6B,MAAM,QAAQ,GAC5F;CAEH,MAAM,MAAM,oBAAoB,QAAQ,QAAQ,QAAQ;CACxD,MAAM,WAAW,MAAM,IAAI,IAAI;AAC/B,OAAM,IAAI,KAAK;EACb,MAAM;EACN,WAAW,QAAQ;EACnB,YAAY,SAAS;EACrB;EACA,UAAU,MAAM;EAChB,SAAS,QAAQ;EACjB,SAAS,MAAM;EACf,WAAW,UAAU,SAAS,iBAAiB,SAAS,YAAY;EACpE,WAAW;EACZ,CAAC"}

package/dist/index.d.mts

@@ -366,10 +366,10 @@ interface RawEnvironment {
    * For reference, see https://developers.cloudflare.com/workers/wrangler/configuration/#previews
    */
   previews?: {
-    logpush?: Interface7690406478080179507690406470477942004818536;
-    observability?: Interface7690406478080179507690406470477942004818536;
-    limits?: Interface7690406478080179507690406470477942004818536;
-    cache?: Interface7690406478080179507690406470477942004818536;
+    logpush?: Interface7690406478080179507690406470491392004818536;
+    observability?: Interface7690406478080179507690406470491392004818536;
+    limits?: Interface7690406478080179507690406470491392004818536;
+    cache?: Interface7690406478080179507690406470491392004818536;
     /**
      * A map of values to substitute when deploying your Worker.
      *
@@ -696,6 +696,40 @@ interface RawEnvironment {
        */
       remote?: boolean;
     }[];
+    /**
+     * Specifies Agent Memory namespace bindings that are bound to this Worker environment.
+     *
+     * NOTE: This field is not automatically inherited from the top level environment, and so must be specified in every named environment.
+     */
+    agent_memory?: {
+      /**
+       * The binding name used to refer to the Agent Memory namespace in the Worker.
+       */
+      binding: string;
+      /**
+       * The user-chosen namespace name. Must exist in Cloudflare at deploy time.
+       */
+      namespace: string;
+      /**
+       * Whether the Agent Memory binding should be remote in local development
+       */
+      remote?: boolean;
+    }[];
+    /**
+     * Cloudflare Web Search binding. There is exactly one shared web corpus, so the binding is zero-config -- only the variable name is required, declared as a single object (not an array).
+     *
+     * NOTE: This field is not automatically inherited from the top level environment, and so must be specified in every named environment.
+     */
+    web_search?: {
+      /**
+       * The binding name used to refer to Web Search in the Worker.
+       */
+      binding: string;
+      /**
+       * Whether the Web Search binding should be remote or not in local development
+       */
+      remote?: boolean;
+    };
     /**
      * Specifies Hyperdrive configs that are bound to this Worker environment.
      *
@@ -974,9 +1008,14 @@ interface RawEnvironment {
        */
       binding: string;
       /**
-       * Name of the Pipeline to bind
+       * Id of the Stream to bind
        */
-      pipeline: string;
+      stream?: string;
+      /**
+       * @deprecated
+       * Id of the Stream to bind
+       */
+      pipeline?: string;
       /**
        * Whether the pipeline should be remote or not in local development
        */
@@ -1471,6 +1510,40 @@ interface RawEnvironment {
      */
     remote?: boolean;
   }[];
+  /**
+   * Specifies Agent Memory namespace bindings that are bound to this Worker environment.
+   *
+   * NOTE: This field is not automatically inherited from the top level environment, and so must be specified in every named environment.
+   */
+  agent_memory?: {
+    /**
+     * The binding name used to refer to the Agent Memory namespace in the Worker.
+     */
+    binding: string;
+    /**
+     * The user-chosen namespace name. Must exist in Cloudflare at deploy time.
+     */
+    namespace: string;
+    /**
+     * Whether the Agent Memory binding should be remote in local development
+     */
+    remote?: boolean;
+  }[];
+  /**
+   * Cloudflare Web Search binding. There is exactly one shared web corpus, so the binding is zero-config -- only the variable name is required, declared as a single object (not an array).
+   *
+   * NOTE: This field is not automatically inherited from the top level environment, and so must be specified in every named environment.
+   */
+  web_search?: {
+    /**
+     * The binding name used to refer to Web Search in the Worker.
+     */
+    binding: string;
+    /**
+     * Whether the Web Search binding should be remote or not in local development
+     */
+    remote?: boolean;
+  };
   /**
    * Specifies Hyperdrive configs that are bound to this Worker environment.
    *
@@ -1749,9 +1822,14 @@ interface RawEnvironment {
      */
     binding: string;
     /**
-     * Name of the Pipeline to bind
+     * Id of the Stream to bind
+     */
+    stream?: string;
+    /**
+     * @deprecated
+     * Id of the Stream to bind
      */
-    pipeline: string;
+    pipeline?: string;
     /**
      * Whether the pipeline should be remote or not in local development
      */
@@ -1994,9 +2072,9 @@ interface Rule {
  * The `EnvironmentInheritable` interface declares all the configuration fields for an environment that can be inherited (and overridden) from the top-level environment.
  *
  * This interface was referenced by `WranglerSchema`'s JSON-Schema
- * via the `definition` "interface-769040647-8080-17950-769040647-0-477942004818536".
+ * via the `definition` "interface-769040647-8080-17950-769040647-0-491392004818536".
  */
-interface Interface7690406478080179507690406470477942004818536 {
+interface Interface7690406478080179507690406470491392004818536 {
   /**
    * The name of your Worker. Alphanumeric + dashes only.
    */
@@ -2310,10 +2388,10 @@ interface Interface7690406478080179507690406470477942004818536 {
    * For reference, see https://developers.cloudflare.com/workers/wrangler/configuration/#previews
    */
   previews?: {
-    logpush?: Interface7690406478080179507690406470477942004818536;
-    observability?: Interface7690406478080179507690406470477942004818536;
-    limits?: Interface7690406478080179507690406470477942004818536;
-    cache?: Interface7690406478080179507690406470477942004818536;
+    logpush?: Interface7690406478080179507690406470491392004818536;
+    observability?: Interface7690406478080179507690406470491392004818536;
+    limits?: Interface7690406478080179507690406470491392004818536;
+    cache?: Interface7690406478080179507690406470491392004818536;
     /**
      * A map of values to substitute when deploying your Worker.
      *
@@ -2640,6 +2718,40 @@ interface Interface7690406478080179507690406470477942004818536 {
        */
       remote?: boolean;
     }[];
+    /**
+     * Specifies Agent Memory namespace bindings that are bound to this Worker environment.
+     *
+     * NOTE: This field is not automatically inherited from the top level environment, and so must be specified in every named environment.
+     */
+    agent_memory?: {
+      /**
+       * The binding name used to refer to the Agent Memory namespace in the Worker.
+       */
+      binding: string;
+      /**
+       * The user-chosen namespace name. Must exist in Cloudflare at deploy time.
+       */
+      namespace: string;
+      /**
+       * Whether the Agent Memory binding should be remote in local development
+       */
+      remote?: boolean;
+    }[];
+    /**
+     * Cloudflare Web Search binding. There is exactly one shared web corpus, so the binding is zero-config -- only the variable name is required, declared as a single object (not an array).
+     *
+     * NOTE: This field is not automatically inherited from the top level environment, and so must be specified in every named environment.
+     */
+    web_search?: {
+      /**
+       * The binding name used to refer to Web Search in the Worker.
+       */
+      binding: string;
+      /**
+       * Whether the Web Search binding should be remote or not in local development
+       */
+      remote?: boolean;
+    };
     /**
      * Specifies Hyperdrive configs that are bound to this Worker environment.
      *
@@ -2918,9 +3030,14 @@ interface Interface7690406478080179507690406470477942004818536 {
        */
       binding: string;
       /**
-       * Name of the Pipeline to bind
+       * Id of the Stream to bind
+       */
+      stream?: string;
+      /**
+       * @deprecated
+       * Id of the Stream to bind
        */
-      pipeline: string;
+      pipeline?: string;
       /**
        * Whether the pipeline should be remote or not in local development
        */
@@ -3598,10 +3715,10 @@ interface RawConfig {
    * For reference, see https://developers.cloudflare.com/workers/wrangler/configuration/#previews
    */
   previews?: {
-    logpush?: Interface7690406478080179507690406470477942004818536;
-    observability?: Interface7690406478080179507690406470477942004818536;
-    limits?: Interface7690406478080179507690406470477942004818536;
-    cache?: Interface7690406478080179507690406470477942004818536;
+    logpush?: Interface7690406478080179507690406470491392004818536;
+    observability?: Interface7690406478080179507690406470491392004818536;
+    limits?: Interface7690406478080179507690406470491392004818536;
+    cache?: Interface7690406478080179507690406470491392004818536;
     /**
      * A map of values to substitute when deploying your Worker.
      *
@@ -3928,6 +4045,40 @@ interface RawConfig {
        */
       remote?: boolean;
     }[];
+    /**
+     * Specifies Agent Memory namespace bindings that are bound to this Worker environment.
+     *
+     * NOTE: This field is not automatically inherited from the top level environment, and so must be specified in every named environment.
+     */
+    agent_memory?: {
+      /**
+       * The binding name used to refer to the Agent Memory namespace in the Worker.
+       */
+      binding: string;
+      /**
+       * The user-chosen namespace name. Must exist in Cloudflare at deploy time.
+       */
+      namespace: string;
+      /**
+       * Whether the Agent Memory binding should be remote in local development
+       */
+      remote?: boolean;
+    }[];
+    /**
+     * Cloudflare Web Search binding. There is exactly one shared web corpus, so the binding is zero-config -- only the variable name is required, declared as a single object (not an array).
+     *
+     * NOTE: This field is not automatically inherited from the top level environment, and so must be specified in every named environment.
+     */
+    web_search?: {
+      /**
+       * The binding name used to refer to Web Search in the Worker.
+       */
+      binding: string;
+      /**
+       * Whether the Web Search binding should be remote or not in local development
+       */
+      remote?: boolean;
+    };
     /**
      * Specifies Hyperdrive configs that are bound to this Worker environment.
      *
@@ -4206,9 +4357,14 @@ interface RawConfig {
        */
       binding: string;
       /**
-       * Name of the Pipeline to bind
+       * Id of the Stream to bind
+       */
+      stream?: string;
+      /**
+       * @deprecated
+       * Id of the Stream to bind
        */
-      pipeline: string;
+      pipeline?: string;
       /**
        * Whether the pipeline should be remote or not in local development
        */
@@ -4703,6 +4859,40 @@ interface RawConfig {
      */
     remote?: boolean;
   }[];
+  /**
+   * Specifies Agent Memory namespace bindings that are bound to this Worker environment.
+   *
+   * NOTE: This field is not automatically inherited from the top level environment, and so must be specified in every named environment.
+   */
+  agent_memory?: {
+    /**
+     * The binding name used to refer to the Agent Memory namespace in the Worker.
+     */
+    binding: string;
+    /**
+     * The user-chosen namespace name. Must exist in Cloudflare at deploy time.
+     */
+    namespace: string;
+    /**
+     * Whether the Agent Memory binding should be remote in local development
+     */
+    remote?: boolean;
+  }[];
+  /**
+   * Cloudflare Web Search binding. There is exactly one shared web corpus, so the binding is zero-config -- only the variable name is required, declared as a single object (not an array).
+   *
+   * NOTE: This field is not automatically inherited from the top level environment, and so must be specified in every named environment.
+   */
+  web_search?: {
+    /**
+     * The binding name used to refer to Web Search in the Worker.
+     */
+    binding: string;
+    /**
+     * Whether the Web Search binding should be remote or not in local development
+     */
+    remote?: boolean;
+  };
   /**
    * Specifies Hyperdrive configs that are bound to this Worker environment.
    *
@@ -4981,9 +5171,14 @@ interface RawConfig {
      */
     binding: string;
     /**
-     * Name of the Pipeline to bind
+     * Id of the Stream to bind
+     */
+    stream?: string;
+    /**
+     * @deprecated
+     * Id of the Stream to bind
      */
-    pipeline: string;
+    pipeline?: string;
     /**
      * Whether the pipeline should be remote or not in local development
      */
@@ -5440,6 +5635,18 @@ declare function isCfBinding(x: unknown): x is CfBinding;
  * before validation.
  */
 type TamerResolvableString = string | CfBinding;
+/** Context for per-resource Cloudflare name resolution (e.g. sharded D1 shard date). */
+interface CloudflareNameContext {
+  /** ISO `YYYY-MM-DD` shard stamp for sharded D1. */
+  shardDate?: string;
+}
+/**
+ * Per-resource Cloudflare name for the current env.
+ * No UUIDs — name only. Used for sync, plan, apply, drift, import, and generate.
+ *
+ * Resolution order when unset: stack {@link NamingConventions} hook → {@link NamingEngine} default.
+ */
+type CloudflareNameFn = (tenantId: string, env: string, ctx?: CloudflareNameContext) => string;
 /** Wrangler R2 binding with optional {@link TamerResolvableString} `bucket_name`. */
 type WranglerR2BucketResolvable = Omit<WranglerR2Bucket, "bucket_name"> & {
   bucket_name?: TamerResolvableString;
@@ -5502,13 +5709,19 @@ interface TenantMeta {
 }
 /**
  * D1 database declared on a worker's `resources.d1[]`.
- * Cloudflare **name** comes from {@link NamingConventions.d1Single} or
- * {@link NamingConventions.d1Shard}; **id** is stored in state after `sync` / `apply`.
+ * Cloudflare **name** for managed databases follows
+ * {@link D1ResourceConfig.cloudflareName} → {@link NamingConventions.d1Single} /
+ * {@link NamingConventions.d1Shard} → defaults; **id** is stored in state after `sync` / `apply`.
  */
 interface D1ResourceConfig {
   logicalName: string;
   /** `"single"`: one DB per logical name. `"sharded"`: date-stamped shards (see `d1Shard` naming hook). */
   type: "single" | "sharded";
+  /**
+   * Optional per-resource Cloudflare database name. For sharded D1, receives
+   * {@link CloudflareNameContext.shardDate}. External D1 uses {@link databaseName} instead.
+   */
+  cloudflareName?: CloudflareNameFn;
   /**
    * `managed` (default): Tamer creates the database; the Cloudflare name follows
    * `naming.d1Single` / shard rules.
@@ -5538,14 +5751,18 @@ interface D1ResourceConfig {
    */
   preserveOnDestroy?: boolean;
 }
-/** R2 bucket on `resources.r2[]`. Name from {@link NamingConventions.r2Bucket} or default. */
+/** R2 bucket on `resources.r2[]`. Name from {@link cloudflareName} → {@link NamingConventions.r2Bucket} → default. */
 interface R2ResourceConfig {
   logicalName: string;
+  /** Optional per-resource Cloudflare bucket name override. */
+  cloudflareName?: CloudflareNameFn;
   /** When set, used as the Wrangler R2 `binding` instead of the generated stable name. */
   binding?: string;
 }
 interface KVResourceConfig {
   logicalName: string;
+  /** Optional per-resource Cloudflare KV namespace name override. */
+  cloudflareName?: CloudflareNameFn;
   /** When set, used as the Wrangler KV `binding` instead of the generated name. */
   binding?: string;
 }
@@ -5558,6 +5775,8 @@ interface KVResourceConfig {
  */
 interface QueueResourceConfig {
   logicalName: string;
+  /** Optional per-resource Cloudflare queue name override. */
+  cloudflareName?: CloudflareNameFn;
   /** When set, used as the Wrangler queue `binding` instead of the generated name. */
   binding?: string;
   /**
@@ -5575,6 +5794,8 @@ interface QueueResourceConfig {
  */
 interface HyperdriveResourceConfig {
   logicalName: string;
+  /** Optional per-resource Cloudflare Hyperdrive config name override. */
+  cloudflareName?: CloudflareNameFn;
   /** When set, used as the Wrangler hyperdrive `binding` instead of the generated name. */
   binding?: string;
   /** Origin database connection. Sent to Cloudflare on create; not stored in Tamer state. */
@@ -5604,6 +5825,8 @@ interface HyperdriveResourceConfig {
  */
 interface VectorizeResourceConfig {
   logicalName: string;
+  /** Optional per-resource Cloudflare Vectorize index name override. */
+  cloudflareName?: CloudflareNameFn;
   /** When set, used as the Wrangler vectorize `binding` instead of the generated name. */
   binding?: string;
   /** Vector dimensionality (e.g. 768 for `@cf/baai/bge-base-en-v1.5`). Immutable. */
@@ -5625,6 +5848,8 @@ interface VectorizeResourceConfig {
  */
 interface AIGatewayResourceConfig {
   logicalName: string;
+  /** Optional per-resource Cloudflare AI Gateway slug override. */
+  cloudflareName?: CloudflareNameFn;
   /** Cache TTL in seconds. Default 0 (caching disabled). */
   cacheTtl?: number;
   /** Invalidate cached entries when upstream model output changes. Default false. */
@@ -5657,6 +5882,8 @@ interface AIGatewayResourceConfig {
  */
 interface PipelineResourceConfig {
   logicalName: string;
+  /** Optional per-resource Cloudflare Pipeline name override. */
+  cloudflareName?: CloudflareNameFn;
   /**
    * Arroyo SQL describing the processing flow, e.g.
    * `insert into my_sink select * from my_stream;`. Stream and sink names
@@ -5705,6 +5932,8 @@ interface HyperdriveOriginSpec {
  */
 interface WorkflowResourceConfig {
   logicalName: string;
+  /** Optional per-resource Cloudflare workflow registration name override. */
+  cloudflareName?: CloudflareNameFn;
   /**
    * Class name exported by the worker that implements this workflow
    * (`export class BillingWorkflow extends WorkflowEntrypoint {...}` →
@@ -6015,6 +6244,8 @@ interface WorkerResources {
  */
 interface SecretsStoreResourceConfig {
   logicalName: string;
+  /** Optional per-resource Cloudflare Secrets Store name override. */
+  cloudflareName?: CloudflareNameFn;
 }
 /**
  * One row in the worker's wrangler `secrets_store_secrets[]` array. Pure
@@ -6075,6 +6306,24 @@ interface RouteResourceConfig {
    */
   prodEnvs?: string[];
 }
+/**
+ * Declares secrets a worker requires at deploy/runtime.
+ *
+ * **Names only — never values.** Secret material lives in the Tamer vault
+ * (`tamer secrets set` / `load`) and reaches Cloudflare via `push` / `deploy`.
+ * {@link WorkerSecretsConfig.required} is reconciled by `plan` and `drift`
+ * against vault fingerprints and deployed worker presence.
+ */
+interface WorkerSecretsConfig {
+  /**
+   * Logical secret names this worker needs at runtime (e.g. `STRIPE_KEY`).
+   * Values are stored in the Tamer vault via `tamer secrets set` / `load` and
+   * pushed to Cloudflare on `tamer secrets push` or `tamer deploy`. Reconciled
+   * by `plan`, `drift`, and `tamer secrets verify` against vault fingerprints
+   * and {@link SecretStateEntry.lastPushedHash} — never put plaintext here.
+   */
+  required: string[];
+}
 type ManagedFields = "name" | "account_id" | "d1_databases" | "r2_buckets" | "kv_namespaces" | "queues" | "hyperdrive" | "vectorize";
 type BaseWranglerFields = Omit<WranglerConfig, ManagedFields>;
 interface EnvOverride extends Omit<BaseWranglerFields, "vars" | "r2_buckets"> {
@@ -6123,6 +6372,11 @@ interface WorkerConfig extends Omit<BaseWranglerFields, "vars" | "r2_buckets" |
    * When set, `tamer deploy` passes `--dispatch-namespace` to Wrangler (Workers for Platforms user Worker upload).
    */
   dispatchNamespace?: string;
+  /**
+   * Required worker secrets (names only). See {@link WorkerSecretsConfig}.
+   * Absent block means no declared secrets for this worker.
+   */
+  secrets?: WorkerSecretsConfig;
   local?: EnvOverride;
   env?: Record<string, EnvOverride>;
 }
@@ -6509,7 +6763,27 @@ interface WorkerRouteStateEntry {
   createdAt: string;
   updatedAt: string;
 }
-type StateEntry = D1StateEntry | R2StateEntry | KVStateEntry | QueueStateEntry | HyperdriveStateEntry | VectorizeStateEntry | AIGatewayStateEntry | PipelineStateEntry | WorkflowStateEntry | SecretsStoreStateEntry | DnsRecordStateEntry | DispatchNamespaceStateEntry | LogpushJobStateEntry | LogpushPipelinesStateEntry | WorkerRouteStateEntry;
+/**
+ * Last-pushed fingerprint for a worker secret — **no secret material**.
+ *
+ * Written by `tamer secrets push` and `tamer deploy` after a successful CF API
+ * PUT. Stored in {@link CfiState.resources} under key `secret:{worker}:{name}`.
+ * Compared to the vault row's `value_hash` to detect rotation (`vault hash !=
+ * lastPushedHash` → needs push). Keyed per secret × worker × env so the same
+ * secret can be current on one worker and stale on another.
+ */
+interface SecretStateEntry {
+  type: "secret";
+  /** Worker key from `tamer.config.ts` (e.g. `api`). */
+  worker: string;
+  /** Logical secret name (e.g. `STRIPE_KEY`). */
+  name: string;
+  /** Vault `value_hash` last PUT to this worker for this env. */
+  lastPushedHash: string;
+  /** ISO timestamp of the last successful push. */
+  lastPushedAt: string;
+}
+type StateEntry = D1StateEntry | R2StateEntry | KVStateEntry | QueueStateEntry | HyperdriveStateEntry | VectorizeStateEntry | AIGatewayStateEntry | PipelineStateEntry | WorkflowStateEntry | SecretsStoreStateEntry | DnsRecordStateEntry | DispatchNamespaceStateEntry | LogpushJobStateEntry | LogpushPipelinesStateEntry | WorkerRouteStateEntry | SecretStateEntry;
 /** Provisioning lifecycle for a workspace tenant (`product` + `workspace`). */
 type ProvisioningStatus = "pending" | "d1_created" | "migrations_applied" | "script_uploaded" | "ready" | "tombstoned";
 interface TenantD1ShardRef {
@@ -6623,20 +6897,22 @@ interface TenantStatus {
 }
 /**
  * Optional functions that derive **Cloudflare resource names** from config
- * (`logicalName`, `tenant.id`, `env`, etc.). Used by `apply`, `sync`, `plan`,
- * `drift`, and `import` through one shared naming derivation path.
+ * (`logicalName`, `tenant.id`, `env`, etc.). Used when a resource has no
+ * {@link CloudflareNameFn} override on its config.
  *
- * **Greenfield:** omit this block — Tamer uses built-in defaults below.
+ * **Resolution order (managed resources):**
+ * 1. `resource.cloudflareName?(tenantId, env, ctx?)`
+ * 2. stack `naming.{kindHook}?(...)` (this interface)
+ * 3. {@link NamingEngine} built-in default
  *
- * **Brownfield:** reproduce legacy names here (functions, not UUIDs). Config
- * holds logical names and hooks; **state** holds `cfId` after `tamer sync`.
- * Run bootstrap → sync → plan before expecting adoption to succeed.
+ * **Greenfield:** omit both per-resource overrides and this block.
  *
- * KV, queues, hyperdrive, vectorize, pipelines, AI gateway, secrets store,
- * dispatch namespaces, and DNS use fixed derived names today (no hooks).
+ * **Brownfield:** use per-resource `cloudflareName` when names differ per
+ * logical resource; use stack hooks for shared formulas. Config holds logical
+ * names and hooks; **state** holds `cfId` after `tamer sync`.
  *
  * @see docs/brownfield-adoption.md
- * @see docs/consumer-quickstart.md
+ * @see docs/per-resource-cloudflare-naming.md
  */
 interface NamingConventions {
   /**
@@ -6724,5 +7000,5 @@ declare function materializeCloudflareBindings(value: unknown): unknown;
  */
 declare function defineCloudflareConfig(config: unknown): CfiConfig;
 //#endregion
-export { AIGatewayResourceConfig, AIGatewayStateEntry, CfBinding, type CfBindingSpec, type CfLogpushPipelinesField, type CfResourceField, type CfResourceKind, CfiConfig, CfiConfigMulti, CfiConfigSingle, CfiOperationName, CfiOperationRecord, CfiOperationStatus, CfiStackConfig, CfiStackMeta, CfiStackOutputValue, CfiState, D1ResourceConfig, D1StateEntry, DispatchNamespaceResourceConfig, DispatchNamespaceStateEntry, DnsRecordResourceConfig, DnsRecordStateEntry, EnvOverride, HyperdriveOriginSpec, HyperdriveResourceConfig, HyperdriveStateEntry, KVResourceConfig, KVStateEntry, LogpushJobPipelinesAutoDestination, LogpushJobPipelinesIngestDestination, LogpushJobR2Destination, LogpushJobResourceConfig, LogpushJobStateEntry, LogpushPipelinesStateEntry, LogpushWorkersTraceDataset, NamingConventions, PipelineResourceConfig, PipelineStateEntry, ProvisioningStatus, QueueResourceConfig, QueueStateEntry, R2ResourceConfig, R2StateEntry, type RawConfig, type RawEnvironment, ResourceStatus, RouteResourceConfig, SecretsStoreResourceConfig, SecretsStoreSecretBinding, SecretsStoreStateEntry, StateEntry, TAMER_OVERLAY_ENV_KEY, TamerResolvableString, TenantD1ShardRef, TenantMeta, TenantStateEntry, TenantStatus, VectorizeResourceConfig, VectorizeStateEntry, WorkerConfig, WorkerResources, WorkerRouteStateEntry, WorkerStatus, WorkflowResourceConfig, WorkflowStateEntry, type WranglerConfig, type WranglerD1Database, type WranglerEnvironment, type WranglerKVNamespace, type WranglerR2Bucket, WranglerR2BucketResolvable, cf, cfBindingSpecToTamerRef, defineCloudflareConfig, defineConfig, defineProjectOverlay, defineWorker, getDispatchNamespaces, getDnsRecords, getLogpushJobs, isCfBinding, materializeCloudflareBindings, materializeTamerResolvable, materializeVars };
+export { AIGatewayResourceConfig, AIGatewayStateEntry, CfBinding, type CfBindingSpec, type CfLogpushPipelinesField, type CfResourceField, type CfResourceKind, CfiConfig, CfiConfigMulti, CfiConfigSingle, CfiOperationName, CfiOperationRecord, CfiOperationStatus, CfiStackConfig, CfiStackMeta, CfiStackOutputValue, CfiState, CloudflareNameContext, CloudflareNameFn, D1ResourceConfig, D1StateEntry, DispatchNamespaceResourceConfig, DispatchNamespaceStateEntry, DnsRecordResourceConfig, DnsRecordStateEntry, EnvOverride, HyperdriveOriginSpec, HyperdriveResourceConfig, HyperdriveStateEntry, KVResourceConfig, KVStateEntry, LogpushJobPipelinesAutoDestination, LogpushJobPipelinesIngestDestination, LogpushJobR2Destination, LogpushJobResourceConfig, LogpushJobStateEntry, LogpushPipelinesStateEntry, LogpushWorkersTraceDataset, NamingConventions, PipelineResourceConfig, PipelineStateEntry, ProvisioningStatus, QueueResourceConfig, QueueStateEntry, R2ResourceConfig, R2StateEntry, type RawConfig, type RawEnvironment, ResourceStatus, RouteResourceConfig, SecretStateEntry, SecretsStoreResourceConfig, SecretsStoreSecretBinding, SecretsStoreStateEntry, StateEntry, TAMER_OVERLAY_ENV_KEY, TamerResolvableString, TenantD1ShardRef, TenantMeta, TenantStateEntry, TenantStatus, VectorizeResourceConfig, VectorizeStateEntry, WorkerConfig, WorkerResources, WorkerRouteStateEntry, WorkerSecretsConfig, WorkerStatus, WorkflowResourceConfig, WorkflowStateEntry, type WranglerConfig, type WranglerD1Database, type WranglerEnvironment, type WranglerKVNamespace, type WranglerR2Bucket, WranglerR2BucketResolvable, cf, cfBindingSpecToTamerRef, defineCloudflareConfig, defineConfig, defineProjectOverlay, defineWorker, getDispatchNamespaces, getDnsRecords, getLogpushJobs, isCfBinding, materializeCloudflareBindings, materializeTamerResolvable, materializeVars };
 //# sourceMappingURL=index.d.mts.map