@dragonmastery/tamer 0.29.0 → 0.31.0

package/dist/{fetchStackImports-C-1THPYL.mjs → registry-EWWdkLf7.mjs}

@@ -1,846 +1,69 @@
-import { f as getDispatchNamespaces, n as materializeTamerResolvable, r as materializeVars } from "./normalize-DVSTRZhO.mjs";
-import { t as getWorkers } from "./loader-DAvCKLTT.mjs";
-import { f as stackNameForConfig, o as effectiveDispatchNamespaceName, s as isEphemeralEnv, t as StateManager } from "./StateManager-DTqtLLVX.mjs";
-import { n as r2S3CredentialsFromEnv, t as emptyR2BucketViaS3 } from "./r2S3EmptyBucket-DD81ZWQ7.mjs";
-import { n as logApplyChange } from "./planFormat-CJw8Kq2s.mjs";
-import { resolve } from "path";
-
-//#region src/core/naming/NamingEngine.ts
-function reLiteral(s) {
-	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-var NamingEngine = class {
-	constructor(tenant, conventions) {
-		this.tenant = tenant;
-		this.conventions = conventions;
-	}
-	d1SingleName(logicalName, env) {
-		if (this.conventions?.d1Single) return this.conventions.d1Single(logicalName, this.tenant.id, env);
-		return `db_${logicalName}_t_${this.tenant.id}_${env}`;
-	}
-	d1ShardName(logicalName, shardDate, env) {
-		if (this.conventions?.d1Shard) return this.conventions.d1Shard(logicalName, shardDate, this.tenant.id, env);
-		const dateNoDashes = shardDate.replace(/-/g, "");
-		if (logicalName === "default" || logicalName === "") return `db_${dateNoDashes}_t_${this.tenant.id}_${env}`;
-		return `db_${logicalName}_${dateNoDashes}_t_${this.tenant.id}_${env}`;
-	}
-	d1SingleBindingKey(logicalName) {
-		return `DB_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
-	}
-	d1ShardBindingKey(logicalName, shardDate) {
-		const dateNoDashes = shardDate.replace(/-/g, "");
-		return `DB_${logicalName.toUpperCase().replace(/-/g, "_")}_${dateNoDashes}_T_${this.tenant.id.toUpperCase()}`;
-	}
-	r2BucketName(logicalName, env) {
-		if (this.conventions?.r2Bucket) {
-			const dateNoDashes = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10).replace(/-/g, "");
-			return this.conventions.r2Bucket(logicalName, dateNoDashes, this.tenant.id, env);
-		}
-		return `r2-${logicalName}-t-${this.tenant.id}-${env}`;
-	}
-	/**
-	* Wrangler `r2_buckets[].binding`: logical + tenant only (same idea as {@link kvBindingKey}).
-	* Stable across envs; default {@link r2BucketName} is `r2-{logical}-t-{tenant}-{env}`.
-	*/
-	r2BindingKey(logicalName) {
-		return `R2_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
-	}
-	kvNamespaceName(logicalName, env) {
-		return `kv_${logicalName}_t_${this.tenant.id}_${env}`;
-	}
-	kvBindingKey(logicalName) {
-		return `KV_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
-	}
-	queueName(logicalName, env) {
-		return `q-${logicalName}-t-${this.tenant.id}-${env}`;
-	}
-	queueBindingKey(logicalName) {
-		return `Q_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
-	}
-	hyperdriveName(logicalName, env) {
-		return `hd-${logicalName}-t-${this.tenant.id}-${env}`;
-	}
-	hyperdriveBindingKey(logicalName) {
-		return `HD_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
-	}
-	vectorizeName(logicalName, env) {
-		return `vec-${logicalName}-t-${this.tenant.id}-${env}`;
-	}
-	vectorizeBindingKey(logicalName) {
-		return `VEC_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
-	}
-	/**
-	* AI Gateway slug (== Cloudflare gateway id). Per the Cloudflare API,
-	* gateway ids are case-sensitive lowercase ascii with `-`/`_`. Format:
-	* `aigw-{logical}-t-{tenantId}-{env}`.
-	*/
-	aiGatewayId(logicalName, env) {
-		return `aigw-${logicalName}-t-${this.tenant.id}-${env}`.toLowerCase();
-	}
-	/**
-	* Stable cross-reference binding key for AI Gateway. AI Gateway has no
-	* Wrangler binding kind today, so this is only consumed by
-	* `${tamer:ai_gateway:<logical>.binding}` interpolations.
-	*/
-	aiGatewayBindingKey(logicalName) {
-		return `AI_GW_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
-	}
-	/**
-	* Cloudflare-side pipeline name. Pipelines V1 names must be lowercase
-	* alphanumerics + hyphens (no underscores), so we mirror the R2 scheme.
-	* Pattern: `pipe-{logical}-t-{tenantId}-{env}`.
-	*/
-	pipelineName(logicalName, env) {
-		return `pipe-${logicalName}-t-${this.tenant.id}-${env}`.toLowerCase();
-	}
-	/**
-	* Wrangler binding key emitted in `pipelines[]`. Uppercased logical with
-	* the tenant id appended so two tenants can share a worker namespace
-	* without colliding bindings.
-	*/
-	pipelineBindingKey(logicalName) {
-		return `PIPE_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
-	}
-	pipelineMatchPattern(logicalName, env) {
-		const exact = this.pipelineName(logicalName, env);
-		return (name) => name === exact;
-	}
-	/**
-	* Cloudflare-side workflow name. Workflow names accept lowercase
-	* alphanumerics + hyphens; we mirror the pipelines/AI-Gateway hyphen
-	* scheme. Pattern: `wf-{logical}-t-{tenantId}-{env}`.
-	*/
-	workflowName(logicalName, env) {
-		if (this.conventions?.workflow) return this.conventions.workflow(logicalName, this.tenant.id, env);
-		return `wf-${logicalName}-t-${this.tenant.id}-${env}`.toLowerCase();
-	}
-	/**
-	* Wrangler binding key emitted in `workflows[]`. Uppercased logical with
-	* the tenant id appended so two tenants sharing a script can't collide.
-	*/
-	workflowBindingKey(logicalName) {
-		return `WF_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
-	}
-	workflowMatchPattern(logicalName, env) {
-		const exact = this.workflowName(logicalName, env);
-		return (name) => name === exact;
-	}
-	/**
-	* Cloudflare Secrets Store name. Account-scoped — the API allows free-form
-	* names (the dashboard examples use both `service_x_keys` and dashed
-	* variants), so we mirror our hyphen convention for consistency with
-	* pipelines / workflows / AI Gateway. Pattern:
-	* `sec-{logical}-t-{tenantId}-{env}`.
-	*/
-	secretsStoreName(logicalName, env) {
-		return `sec-${logicalName}-t-${this.tenant.id}-${env}`.toLowerCase();
-	}
-	/**
-	* Stable cross-reference key for the store. Secrets Store has no Wrangler
-	* binding kind directly — `secrets_store_secrets[]` references the
-	* resolved `store_id`, not the store name — so this only powers
-	* `${tamer:secret_store:<n>.binding}` interpolations.
-	*/
-	secretsStoreBindingKey(logicalName) {
-		return `SEC_${logicalName.toUpperCase().replace(/-/g, "_")}_T_${this.tenant.id.toUpperCase()}`;
-	}
-	secretsStoreMatchPattern(logicalName, env) {
-		const exact = this.secretsStoreName(logicalName, env);
-		return (name) => name === exact;
-	}
-	workerName(workerKey, env) {
-		if (this.conventions?.workerName) return this.conventions.workerName(this.tenant.slug, workerKey, env, this.tenant.id);
-		if (env === "local") return `${this.tenant.slug}-${workerKey}-${this.tenant.id}`;
-		return `${this.tenant.slug}-${workerKey}-${env}-${this.tenant.id}`;
-	}
-	d1MatchPattern(logicalName, env) {
-		if (this.conventions?.d1Shard) return (name) => {
-			const shardDate = this.extractD1ShardDate(name);
-			if (!shardDate) return false;
-			return this.d1ShardName(logicalName, shardDate, env) === name;
-		};
-		const suffix = `_t_${this.tenant.id}_${env}`;
-		if (logicalName === "default" || logicalName === "") return (name) => /^db_\d{8}_t_/.test(name) && name.endsWith(suffix);
-		const prefix = `db_${logicalName}_`;
-		return (name) => name.startsWith(prefix) && name.endsWith(suffix);
-	}
-	/**
-	* Default: exact {@link r2BucketName}, or legacy dated buckets
-	* `r2-{logical}-{YYYYMMDD}-t-{tenant}-{env}` from older Tamer versions.
-	* Custom {@link NamingConventions.r2Bucket}: exact name only (uses today's date
-	* when calling the hook, same as apply).
-	*/
-	r2MatchPattern(logicalName, env) {
-		if (this.conventions?.r2Bucket) {
-			const expected = this.r2BucketName(logicalName, env);
-			return (name) => name === expected;
-		}
-		const exactNew = `r2-${logicalName}-t-${this.tenant.id}-${env}`;
-		const legacyDated = /* @__PURE__ */ new RegExp(`^r2-${reLiteral(logicalName)}-\\d{8}-t-${reLiteral(this.tenant.id)}-${reLiteral(env)}$`);
-		return (name) => name === exactNew || legacyDated.test(name);
-	}
-	extractD1ShardDate(name) {
-		const compact = name.match(/_(\d{8})_t_/);
-		if (compact) {
-			const d = compact[1];
-			return `${d.slice(0, 4)}-${d.slice(4, 6)}-${d.slice(6, 8)}`;
-		}
-		const underscored = name.match(/_(\d{4})_(\d{2})_(\d{2})_t_/);
-		if (underscored) return `${underscored[1]}-${underscored[2]}-${underscored[3]}`;
-		return null;
-	}
-	extractR2Date(name) {
-		const match = name.match(/r2-\w+-(\d{8})-t-/);
-		if (match) {
-			const d = match[1];
-			return `${d.slice(0, 4)}-${d.slice(4, 6)}-${d.slice(6, 8)}`;
-		}
-		return null;
-	}
-};
-
-//#endregion
-//#region src/core/config/namingFromConfig.ts
-function namingFromConfig(config) {
-	const conventions = "naming" in config && config.naming ? config.naming : void 0;
-	return new NamingEngine(config.tenant, conventions);
-}
-
-//#endregion
-//#region src/core/routes/routes.resolve.ts
-const DEFAULT_PROD_ENVS = ["prod", "production"];
-const DEFAULT_SKIP_ENVS = ["local"];
-/**
-* Per `docs/handoff.md` §6:
-*   - prod / production → bare apex (`todo.com`)
-*   - any other env (including ephemeral `pr-*`) → `{env}.{apex}`
-*   - `local` (or anything in `skipEnvs`) → no route
-*
-* The resource-name `-{env}` suffix on workers/D1/R2/KV is decoupled from
-* URLs; this function only computes the URL.
-*/
-function effectiveHostForEnv(route, env) {
-	if ((route.skipEnvs ?? DEFAULT_SKIP_ENVS).includes(env)) return void 0;
-	if ((route.prodEnvs ?? DEFAULT_PROD_ENVS).includes(env)) return route.host;
-	return `${env}.${route.host}`;
-}
-/**
-* Expand one Tamer route into a wrangler `Route` (or `undefined` if the env
-* should not receive the route at all).
-*/
-function expandRouteForEnv(route, env) {
-	const host = effectiveHostForEnv(route, env);
-	if (!host) return void 0;
-	const zone = route.zone ?? route.host;
-	if (route.customDomain) return {
-		pattern: host,
-		custom_domain: true
-	};
-	return {
-		pattern: `${host}${route.path ?? "/*"}`,
-		zone_name: zone
-	};
-}
-/**
-* Expand `tamerRoutes` for the given env, dropping any that resolve to
-* `undefined` (`local`, `skipEnvs`).
-*
-* Note: ephemeral envs (matching `tenant.ephemeralEnvPattern`) follow the
-* same `{env}.{apex}` prefix rule as any non-prod env — e.g. an env named
-* `pr-1234` resolves to `pr-1234.todo.com`. Callers that want a different
-* URL scheme for ephemeral envs should special-case before calling.
-*/
-function effectiveRoutesForEnv(tamerRoutes, env) {
-	if (!tamerRoutes || tamerRoutes.length === 0) return [];
-	const out = [];
-	for (const r of tamerRoutes) {
-		const expanded = expandRouteForEnv(r, env);
-		if (expanded) out.push(expanded);
-	}
-	return out;
-}
-/**
-* Zone-name routes are attached via the Cloudflare Workers Routes HTTP API
-* (`/zones/{id}/workers/routes`), not via `wrangler.json`, so deploys stay
-* consistent with `tamer drift` / destroy.
-*/
-function isApiManagedZoneRoute(r) {
-	return typeof r === "object" && r !== null && "zone_name" in r && typeof r.zone_name === "string" && "pattern" in r && typeof r.pattern === "string" && !("custom_domain" in r && r.custom_domain === true);
-}
-/** Custom-domain `tamerRoutes` stay in wrangler until a dedicated API path exists. */
-function isWranglerOnlyTamerRoute(r) {
-	return typeof r === "object" && r !== null && "custom_domain" in r && r.custom_domain === true;
-}
-
-//#endregion
-//#region src/core/wrangler/wranglerOutFile.ts
-/** Reject path segments in generated Wrangler config filename. */
-function assertSafeWranglerOutFile(name) {
-	const trimmed = name.trim();
-	if (!trimmed) throw new Error("wranglerOutFile cannot be empty");
-	if (trimmed.includes("/") || trimmed.includes("\\") || trimmed.startsWith("..")) throw new Error(`Invalid wranglerOutFile "${name}": use a basename only (e.g. wrangler.json)`);
-	return trimmed;
-}
-/** Extra CLI args so Wrangler uses a non-default config file. */
-function wranglerConfigCliArgs(outFile) {
-	if (outFile === "wrangler.json") return [];
-	return ["--config", outFile];
-}
-
-//#endregion
-//#region src/core/references/references.ts
-var TamerReferenceError = class extends Error {
-	constructor(message, fieldPath) {
-		super(`${message} (at ${fieldPath})`);
-		this.fieldPath = fieldPath;
-		this.name = "TamerReferenceError";
-	}
-};
-const REF_RE = /\$\{tamer:([a-z0-9_]+):([a-zA-Z0-9_-]+)\.([a-zA-Z0-9_-]+)\}/g;
-/**
-* Scan a string for any `${tamer:...}` references. Returns true when at
-* least one reference is present (used for cheap pre-checks).
-*/
-function stringHasReference(s) {
-	REF_RE.lastIndex = 0;
-	return REF_RE.test(s);
-}
-/**
-* Resolve every `${tamer:...}` reference in `value`. Replacement preserves
-* surrounding text for partial-string interpolation. `fieldPath` is included
-* in any thrown {@link TamerReferenceError} for actionable diagnostics.
-*/
-function resolveReferencesInString(value, ctx, fieldPath) {
-	if (!stringHasReference(value)) return value;
-	return value.replace(REF_RE, (match, kind, logicalName, field) => {
-		try {
-			return lookupReference(kind, logicalName, field, ctx, fieldPath);
-		} catch (err) {
-			if (ctx.tolerant && err instanceof TamerReferenceError) return match;
-			throw err;
-		}
-	});
-}
-/**
-* Walk a `vars` record (or any flat string→string map) replacing references
-* in every value. Returns a new object; the input is not mutated.
-*/
-function resolveReferencesInVars(vars, ctx, fieldPathPrefix) {
-	if (!vars) return vars;
-	const out = {};
-	for (const [key, value] of Object.entries(vars)) {
-		if (typeof value !== "string") {
-			out[key] = value;
-			continue;
-		}
-		out[key] = resolveReferencesInString(value, ctx, `${fieldPathPrefix}.${key}`);
-	}
-	return out;
-}
-function lookupReference(kind, logicalName, field, ctx, fieldPath) {
-	switch (kind) {
-		case "d1": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "d1_database" && entry.logicalName === logicalName);
-		case "r2": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "r2_bucket" && entry.logicalName === logicalName);
-		case "kv": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "kv_namespace" && entry.logicalName === logicalName);
-		case "queue": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "queue" && entry.logicalName === logicalName);
-		case "hyperdrive": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "hyperdrive" && entry.logicalName === logicalName);
-		case "vectorize": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "vectorize" && entry.logicalName === logicalName);
-		case "ai_gateway": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "ai_gateway" && entry.logicalName === logicalName);
-		case "pipeline": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "pipeline" && entry.logicalName === logicalName);
-		case "workflow": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "workflow" && entry.logicalName === logicalName);
-		case "secret_store": return lookupResource(ctx, kind, logicalName, field, fieldPath, (entry) => entry.type === "secrets_store" && entry.logicalName === logicalName);
-		case "dispatch_namespace": return lookupDispatchNamespace(ctx, logicalName, field, fieldPath);
-		case "worker": return lookupWorker(ctx, logicalName, field, fieldPath);
-		case "import": return lookupImport(ctx, logicalName, field, fieldPath);
-		case "logpush_pipelines": return lookupLogpushPipelines(ctx, logicalName, field, fieldPath);
-		case "config": return lookupConfigField(ctx, logicalName, field, fieldPath);
-		default: throw new TamerReferenceError(`Unknown reference kind "${kind}" — expected one of d1 | r2 | kv | queue | hyperdrive | vectorize | ai_gateway | pipeline | workflow | secret_store | dispatch_namespace | worker | import | logpush_pipelines | config`, fieldPath);
-	}
-}
-function lookupConfigField(ctx, _logicalName, field, fieldPath) {
-	if (field === "account_id") {
-		const id = (ctx.accountId ?? ctx.config.account_id ?? "").trim();
-		if (!id) throw new TamerReferenceError(`Reference \${tamer:config:stack.account_id} needs the stack Cloudflare account id — set top-level account_id in tamer/project.config.ts or pass CLOUDFLARE_ACCOUNT_ID when running tamer.`, fieldPath);
-		return id;
-	}
-	throw new TamerReferenceError(`Unknown field "${field}" on config reference — expected account_id`, fieldPath);
-}
-function getLogpushPipelinesEntry(ctx, logicalName, fieldPath) {
-	const all = ctx.state.getAll();
-	const entry = Object.values(all).find((e) => e.type === "logpush_pipelines" && e.logicalName === logicalName);
-	if (!entry) throw new TamerReferenceError(`Reference \${tamer:logpush_pipelines:${logicalName}.…} cannot be resolved — no pipelines graph in state for logpush job "${logicalName}". Run a full \`tamer apply\` (including the Logpush / pipelinesAuto step) for env "${ctx.env}" first.`, fieldPath);
-	return entry;
-}
-/**
-* Exposes fields from the `logpush_pipelines:*` D1 state row (after
-* `ensurePipelinesLogpushProvision` has run) for `outputs` and `vars`, e.g.
-* `${tamer:logpush_pipelines:workers-trace.r2_data_catalog_table_name}`.
-*/
-function lookupLogpushPipelines(ctx, logicalName, field, fieldPath) {
-	const entry = getLogpushPipelinesEntry(ctx, logicalName, fieldPath);
-	switch (field) {
-		case "r2_data_catalog_table_name":
-		case "iceberg_table": {
-			const v = entry.r2DataCatalogTableName?.trim();
-			if (!v) throw new TamerReferenceError(`logpush_pipelines state for "${logicalName}" has no r2DataCatalogTableName (sink not yet created, or pre-upgrade state). Re-run a full \`tamer apply\` for env "${ctx.env}" after pipelinesAuto provisions the sink, or set table manually in consuming stack.`, fieldPath);
-			return v;
-		}
-		case "r2_data_catalog_table_name_pipelines":
-		case "iceberg_table_pipelines": {
-			const v = entry.r2DataCatalogTableNamePipelines?.trim();
-			if (v) return v;
-			const fallback = entry.r2DataCatalogTableName?.trim();
-			if (!fallback) throw new TamerReferenceError(`logpush_pipelines state for "${logicalName}" has no table name (sink not yet created). Re-run \`tamer apply\` for env "${ctx.env}".`, fieldPath);
-			return fallback;
-		}
-		case "r2_data_catalog_namespace":
-		case "iceberg_namespace": return (entry.r2DataCatalogNamespace ?? "default").trim() || "default";
-		case "name": return entry.pipelineName;
-		case "id": return entry.pipelineId;
-		default: throw new TamerReferenceError(`Unknown field "${field}" on logpush_pipelines reference — expected r2_data_catalog_table_name | r2_data_catalog_table_name_pipelines | r2_data_catalog_namespace | name | id | iceberg_table | iceberg_table_pipelines | iceberg_namespace`, fieldPath);
-	}
-}
-/**
-* Resolve a `${tamer:import:<stack>.<output>}` against pre-fetched sibling
-* stack outputs. The pre-fetch (`fetchStackImports`) loads every imported
-* stack's `cfi_state:{stack}` row before resolution begins; this lookup is
-* pure map access. Throws if the stack isn't in `ctx.imports` (config
-* never declared it / pre-fetch wasn't wired in for this command) or if
-* the named output hasn't been published yet (sibling stack hasn't run
-* `apply` since the output was declared, or has been destroyed).
-*/
-function lookupImport(ctx, stackName, outputName, fieldPath) {
-	const imports = ctx.imports;
-	if (!imports || !(stackName in imports)) throw new TamerReferenceError(`Reference \${tamer:import:${stackName}.${outputName}} cannot be resolved — no imported stack "${stackName}" available. Ensure stack "${stackName}" exists in env "${ctx.env}" (run 'tamer apply' there first) and that the current command pre-fetches sibling stacks.`, fieldPath);
-	const stackOutputs = imports[stackName];
-	if (!(outputName in stackOutputs)) {
-		const available = Object.keys(stackOutputs).sort();
-		throw new TamerReferenceError(`Reference \${tamer:import:${stackName}.${outputName}} cannot be resolved — output "${outputName}" not found on imported stack "${stackName}".${available.length > 0 ? ` Available outputs on stack "${stackName}": ${available.join(", ")}.` : ` Stack "${stackName}" has no published outputs — run 'tamer apply' there with an \`outputs:\` block.`}`, fieldPath);
-	}
-	return stackOutputs[outputName];
-}
-function lookupResource(ctx, kind, logicalName, field, fieldPath, predicate) {
-	const all = ctx.state.getAll();
-	const entry = Object.values(all).find(predicate);
-	if (!entry) throw new TamerReferenceError(`Reference \${tamer:${kind}:${logicalName}.${field}} cannot be resolved — no ${kind} resource named "${logicalName}" in state. Run 'tamer apply --env ${ctx.env}' first.`, fieldPath);
-	switch (field) {
-		case "name": return resourceName(entry);
-		case "id": return resourceId(entry, kind, logicalName, fieldPath);
-		case "binding": return resourceBinding(entry);
-		default: throw new TamerReferenceError(`Unknown field "${field}" on ${kind} reference — expected name | id | binding`, fieldPath);
-	}
-}
-function resourceName(entry) {
-	switch (entry.type) {
-		case "d1_database":
-		case "kv_namespace":
-		case "queue":
-		case "hyperdrive":
-		case "vectorize":
-		case "ai_gateway":
-		case "pipeline":
-		case "workflow":
-		case "secrets_store":
-		case "dispatch_namespace":
-		case "r2_bucket": return entry.derivedName;
-		case "dns_record": return entry.name;
-		case "logpush_job": return entry.derivedName;
-		case "logpush_pipelines": return entry.pipelineName;
-		case "worker_route": return entry.pattern;
-	}
-}
-function resourceId(entry, kind, logicalName, fieldPath) {
-	switch (entry.type) {
-		case "d1_database":
-		case "kv_namespace":
-		case "queue":
-		case "hyperdrive":
-		case "vectorize":
-		case "ai_gateway":
-		case "pipeline":
-		case "workflow":
-		case "secrets_store": return entry.cfId;
-		case "r2_bucket": throw new TamerReferenceError(`R2 bucket "${logicalName}" has no .id (R2 buckets are addressed by name); use \${tamer:${kind}:${logicalName}.name}`, fieldPath);
-		case "dispatch_namespace": return entry.derivedName;
-		case "dns_record": return entry.recordId;
-		case "logpush_job": return String(entry.cfJobId);
-		case "logpush_pipelines": return entry.pipelineId;
-		case "worker_route": return entry.routeId;
-	}
-}
-function resourceBinding(entry) {
-	switch (entry.type) {
-		case "d1_database":
-		case "r2_bucket":
-		case "kv_namespace":
-		case "queue":
-		case "hyperdrive":
-		case "vectorize":
-		case "ai_gateway":
-		case "pipeline":
-		case "workflow":
-		case "secrets_store": return entry.bindingKey;
-		case "dispatch_namespace": return entry.derivedName;
-		case "dns_record": throw new Error("internal: dns_record has no .binding — use .name or .id in config references");
-		case "logpush_job": throw new Error("internal: logpush_job has no .binding — use .name or .id in config references");
-		case "logpush_pipelines": throw new Error("internal: logpush_pipelines has no .binding — use .name or .id in config references");
-		case "worker_route": return entry.routeId;
-	}
-}
-function lookupDispatchNamespace(ctx, logicalName, field, fieldPath) {
-	if (!getDispatchNamespaces(ctx.config).find((d) => d.logicalName === logicalName)) throw new TamerReferenceError(`Reference \${tamer:dispatch_namespace:${logicalName}.${field}} cannot be resolved — no dispatchNamespaces entry named "${logicalName}" in the Tamer project config`, fieldPath);
-	if (field !== "name" && field !== "id") throw new TamerReferenceError(`Unknown field "${field}" on dispatch_namespace reference — expected name | id`, fieldPath);
-	const all = ctx.state.getAll();
-	const stateEntry = Object.values(all).find((e) => e.type === "dispatch_namespace" && e.logicalName === logicalName);
-	if (!stateEntry || stateEntry.type !== "dispatch_namespace") throw new TamerReferenceError(`Reference \${tamer:dispatch_namespace:${logicalName}.${field}} unresolved — no state entry. Run 'tamer apply --env ${ctx.env}' first.`, fieldPath);
-	return stateEntry.derivedName;
-}
-function lookupWorker(ctx, workerKey, field, fieldPath) {
-	let target;
-	if (ctx.config.workers && ctx.config.workers[workerKey]) target = ctx.config.workers[workerKey];
-	else if (ctx.config.worker && workerKey === "default") target = ctx.config.worker;
-	if (!target) throw new TamerReferenceError(`Reference \${tamer:worker:${workerKey}.${field}} cannot be resolved — no worker key "${workerKey}" in the Tamer project config`, fieldPath);
-	if (field !== "name") throw new TamerReferenceError(`Unknown field "${field}" on worker reference — only "name" is supported (the env-suffixed deployed script name)`, fieldPath);
-	return resolveDeployedWorkerName(ctx.config, workerKey, target, ctx.env, ctx.naming);
-}
-
-//#endregion
-//#region src/core/config/resolver.ts
-/** Wrangler script name after env suffix rules (matches `tamer deploy`). */
-function resolveDeployedWorkerName(_config, workerKey, workerConfig, env, naming) {
-	const sn = workerConfig.scriptName?.trim();
-	if (sn) {
-		if (env === "local") return sn;
-		return `${sn}-${env}`;
-	}
-	return naming.workerName(workerKey, env);
-}
-/**
-* Map from base service-binding target name (`scriptName` for envs other than
-* `local`, or the local-deployed name) → env-suffixed deployed name for every
-* worker in `config`. Used to auto-rewrite intra-stack `services[].service`
-* fields so fixtures don't have to repeat env overrides for every env.
-*/
-function buildIntraStackScriptNameMap(config, env, naming) {
-	const map = /* @__PURE__ */ new Map();
-	if (config.workers) for (const [key, wc] of Object.entries(config.workers)) {
-		const baseName = wc.scriptName?.trim() ?? naming.workerName(key, "local");
-		const deployed = resolveDeployedWorkerName(config, key, wc, env, naming);
-		map.set(baseName, deployed);
-	}
-	if (config.worker) {
-		const w = config.worker;
-		const baseName = w.scriptName?.trim() ?? naming.workerName("default", "local");
-		const deployed = resolveDeployedWorkerName(config, "default", w, env, naming);
-		map.set(baseName, deployed);
-	}
-	return map;
-}
-/** Returns a worker config copy whose `services[].service` is rewritten to env-suffixed deployed names. */
-function rewriteIntraStackServiceTargets(workerConfig, baseToDeployed) {
-	const services = workerConfig.services;
-	if (!services || services.length === 0) return workerConfig;
-	let rewroteAny = false;
-	const rewritten = services.map((s) => {
-		const target = baseToDeployed.get(s.service);
-		if (!target || target === s.service) return s;
-		rewroteAny = true;
-		return {
-			...s,
-			service: target
-		};
-	});
-	if (!rewroteAny) return workerConfig;
-	return {
-		...workerConfig,
-		services: rewritten
-	};
-}
-function mergeVars(base = {}, override = {}) {
-	return {
-		...base,
-		...override
-	};
-}
-/** Same env merge as `resolveWorkerConfig` (for deploy topo-sort service edges). */
-function mergedWorkerConfigForEnv(workerConfig, env, tenant) {
-	let merged = { ...workerConfig };
-	if (env === "local" && workerConfig.local) merged = {
-		...merged,
-		...workerConfig.local,
-		vars: mergeVars(workerConfig.vars, workerConfig.local.vars)
-	};
-	else if (workerConfig.env?.[env]) {
-		const envOverride = workerConfig.env[env];
-		merged = {
-			...merged,
-			...envOverride,
-			vars: mergeVars(workerConfig.vars, envOverride.vars)
-		};
-	}
-	const mv = merged.vars;
-	if (mv && Object.prototype.hasOwnProperty.call(mv, "BRANCH_SUFFIX")) merged = {
-		...merged,
-		vars: {
-			...mv,
-			BRANCH_SUFFIX: isEphemeralEnv(env, tenant) ? env : ""
-		}
-	};
-	return merged;
-}
-/**
-* Align `dispatch_namespaces[].namespace` and `vars.WFP_NAMESPACE` with
-* {@link effectiveDispatchNamespaceName} for envs that have no explicit
-* `worker.env[env]` block (e.g. `pr-*` shared namespace).
-*/
-function applyDispatchNamespaceEnvOverrides(config, merged, env) {
-	const dns = getDispatchNamespaces(config);
-	if (dns.length === 0) return merged;
-	const resolved = effectiveDispatchNamespaceName(dns[0], env, config.tenant);
-	const m = merged;
-	let next = merged;
-	if (m.dispatch_namespaces?.length) next = {
-		...next,
-		dispatch_namespaces: m.dispatch_namespaces.map((d) => ({
-			...d,
-			namespace: resolved
-		}))
-	};
-	if (m.vars && typeof m.vars.WFP_NAMESPACE === "string" && m.vars.WFP_NAMESPACE === dns[0].namespace) {
-		const v = next.vars;
-		next = {
-			...next,
-			vars: {
-				...v,
-				WFP_NAMESPACE: resolved
-			}
-		};
-	}
-	return next;
-}
-/**
-* Walk the merged worker config and replace `${tamer:<kind>:<logical>.<field>}`
-* references in `vars` and `tamerRoutes[].host` / `.zone` against the current
-* state snapshot. Also resolves `r2_buckets[].bucket_name`,
-* **`services[].service`**, **`dispatch_namespaces[].namespace`**, and
-* `resources.d1[].databaseName` when `ownership` is `external`. Throws
-* `TamerReferenceError` (with field path) if any
-* reference is unresolved — bubbles up to the caller as a fatal.
-*/
-function resolveCrossResourceReferences(merged, ctx) {
-	const refCtx = {
-		config: ctx.config,
-		env: ctx.env,
-		state: ctx.state,
-		naming: ctx.naming,
-		tolerant: ctx.tolerant,
-		imports: ctx.imports,
-		accountId: ctx.accountId
-	};
-	const m = merged;
-	let next = merged;
-	if (m.vars) {
-		const resolvedVars = resolveReferencesInVars(materializeVars(m.vars), refCtx, `worker[${ctx.workerKey}].vars`);
-		if (resolvedVars && resolvedVars !== m.vars) next = {
-			...next,
-			vars: resolvedVars
-		};
-	}
-	const tamerRoutes = next.tamerRoutes;
-	if (tamerRoutes && tamerRoutes.length > 0) {
-		let mutated = false;
-		const resolvedRoutes = tamerRoutes.map((r, idx) => {
-			const fieldBase = `worker[${ctx.workerKey}].tamerRoutes[${idx}]`;
-			const host = resolveReferencesInString(r.host, refCtx, `${fieldBase}.host`);
-			const zone = r.zone ? resolveReferencesInString(r.zone, refCtx, `${fieldBase}.zone`) : r.zone;
-			if (host !== r.host || zone !== r.zone) mutated = true;
-			return {
-				...r,
-				host,
-				...zone !== void 0 ? { zone } : {}
-			};
-		});
-		if (mutated) next = {
-			...next,
-			tamerRoutes: resolvedRoutes
-		};
-	}
-	const r2Buckets = next.r2_buckets;
-	if (r2Buckets && r2Buckets.length > 0) {
-		let mutated = false;
-		const resolvedBuckets = r2Buckets.map((b, idx) => {
-			const raw = b.bucket_name;
-			if (raw === void 0) return b;
-			const fieldBase = `worker[${ctx.workerKey}].r2_buckets[${idx}].bucket_name`;
-			const bucket_name = resolveReferencesInString(materializeTamerResolvable(raw), refCtx, fieldBase);
-			if (bucket_name !== raw) mutated = true;
-			return {
-				...b,
-				bucket_name
-			};
-		});
-		if (mutated) next = {
-			...next,
-			r2_buckets: resolvedBuckets
-		};
-	}
-	const svc = next.services;
-	if (svc && svc.length > 0) {
-		let mutated = false;
-		const resolvedSvc = svc.map((s, idx) => {
-			const raw = s.service;
-			const fieldBase = `worker[${ctx.workerKey}].services[${idx}].service`;
-			const service = resolveReferencesInString(materializeTamerResolvable(raw), refCtx, fieldBase);
-			if (service !== raw) mutated = true;
-			return {
-				...s,
-				service
-			};
-		});
-		if (mutated) next = {
-			...next,
-			services: resolvedSvc
-		};
-	}
-	const dispatchNsMerged = next.dispatch_namespaces;
-	if (dispatchNsMerged && dispatchNsMerged.length > 0) {
-		let mutated = false;
-		const resolvedDn = dispatchNsMerged.map((d, idx) => {
-			const raw = d.namespace;
-			const fieldBase = `worker[${ctx.workerKey}].dispatch_namespaces[${idx}].namespace`;
-			const namespace = resolveReferencesInString(materializeTamerResolvable(raw), refCtx, fieldBase);
-			if (namespace !== raw) mutated = true;
-			return {
-				...d,
-				namespace
-			};
-		});
-		if (mutated) next = {
-			...next,
-			dispatch_namespaces: resolvedDn
-		};
-	}
-	const resBlock = next.resources;
-	if (resBlock?.d1 && resBlock.d1.length > 0) {
-		let mutated = false;
-		const d1Resolved = resBlock.d1.map((d1c, idx) => {
-			if (d1c.ownership !== "external" || !d1c.databaseName) return d1c;
-			const fieldBase = `worker[${ctx.workerKey}].resources.d1[${idx}].databaseName`;
-			const databaseName = resolveReferencesInString(materializeTamerResolvable(d1c.databaseName), refCtx, fieldBase);
-			if (databaseName !== d1c.databaseName) mutated = true;
-			return {
-				...d1c,
-				databaseName
-			};
-		});
-		if (mutated) next = {
-			...next,
-			resources: {
-				...resBlock,
-				d1: d1Resolved
-			}
-		};
-	}
-	return next;
-}
-function stripTamerFields(config) {
-	const { path, config: configPath, resources, local, env, scriptName: _scriptName, wranglerOutFile: _out, dispatchNamespace: _dispatchNs, tamerRoutes: _tamerRoutes, tamerStaleRouteSweepZones: _tamerStaleRouteSweepZones, ...rest } = config;
-	return rest;
-}
-/**
-* Env merge + intra-stack `services` rewrite + sibling-stack resolution for
-* **`resources.d1[].databaseName` only** when `ownership: "external"`.
-*
-* Use before {@link ResourceModule.pickResources} during `apply` / `sync` /
-* `drift` so imported D1 names are known **without** resolving worker `vars`
-* (those references often need resources created earlier in the same `apply`).
-*/
-function mergeWorkerConfigForResourcePick(config, workerKey, workerConfig, env, accountId, naming, state, opts = {}) {
-	let merged = mergedWorkerConfigForEnv(workerConfig, env, config.tenant);
-	merged = applyDispatchNamespaceEnvOverrides(config, merged, env);
-	const intraMap = buildIntraStackScriptNameMap(config, env, naming);
-	merged = rewriteIntraStackServiceTargets(merged, intraMap);
-	const refCtx = {
-		config,
-		env,
-		state,
-		naming,
-		tolerant: opts.referencesMode === "tolerant",
-		imports: opts.imports,
-		accountId
-	};
-	const resBlock = merged.resources;
-	if (!resBlock?.d1?.length) return merged;
-	const d1Resolved = resBlock.d1.map((d1c, idx) => {
-		if (d1c.ownership !== "external" || !d1c.databaseName) return d1c;
-		const fieldBase = `worker[${workerKey}].resources.d1[${idx}].databaseName`;
-		const databaseName = resolveReferencesInString(materializeTamerResolvable(d1c.databaseName), refCtx, fieldBase);
-		return {
-			...d1c,
-			databaseName
-		};
-	});
-	return {
-		...merged,
-		resources: {
-			...resBlock,
-			d1: d1Resolved
-		}
-	};
-}
-/**
-* Env-merged worker config with every `${tamer:…}` site resolved for wrangler
-* (`vars`, `tamerRoutes`, `r2_buckets[].bucket_name`, external D1 names).
-* Used by {@link resolveWorkerConfig} after resource state is up to date.
-*/
-function mergeWorkerConfigWithResolvedRefs(config, workerKey, workerConfig, env, accountId, naming, state, opts = {}) {
-	let merged = mergedWorkerConfigForEnv(workerConfig, env, config.tenant);
-	merged = applyDispatchNamespaceEnvOverrides(config, merged, env);
-	const intraMap = buildIntraStackScriptNameMap(config, env, naming);
-	merged = rewriteIntraStackServiceTargets(merged, intraMap);
-	return resolveCrossResourceReferences(merged, {
-		config,
-		env,
-		state,
-		naming,
-		workerKey,
-		tolerant: opts.referencesMode === "tolerant",
-		imports: opts.imports,
-		accountId
-	});
-}
-async function resolveWorkerConfig(config, workerKey, workerConfig, env, baseDir, accountId, naming, state, opts = {}) {
-	const merged = mergeWorkerConfigWithResolvedRefs(config, workerKey, workerConfig, env, accountId, naming, state, opts);
-	const workerDir = workerConfig.path ? resolve(baseDir, workerConfig.path) : baseDir;
-	const m = merged;
-	const workerName = resolveDeployedWorkerName(config, workerKey, merged, env, naming);
-	const wranglerOutFile = assertSafeWranglerOutFile(m.wranglerOutFile?.trim() || "wrangler.json");
-	const dispatchNamespace = m.dispatchNamespace?.trim() || void 0;
-	const stripped = stripTamerFields(merged);
-	const tamerRoutes = merged.tamerRoutes;
-	const expandedRoutes = effectiveRoutesForEnv(tamerRoutes, env);
-	const apiManagedRoutes = expandedRoutes.filter(isApiManagedZoneRoute);
-	const wranglerTamerRoutes = expandedRoutes.filter(isWranglerOnlyTamerRoute);
-	const mergedRoutes = [...stripped.routes ?? [], ...wranglerTamerRoutes];
-	/** Non-local deploys emit `routes: []` when there are none — omitting `routes` can leave stale Wrangler-published custom domains attached from a prior config. */
-	const wranglerRoutes = mergedRoutes.length > 0 ? mergedRoutes : env === "local" ? void 0 : [];
-	return {
-		workerKey,
-		workerName,
-		workerDir,
-		env,
-		wranglerOutFile,
-		dispatchNamespace,
-		wranglerConfig: {
-			...stripped,
-			...wranglerRoutes !== void 0 ? { routes: wranglerRoutes } : {},
-			name: workerName,
-			account_id: accountId,
-			compatibility_date: stripped.compatibility_date ?? config.compatibility_date
-		},
-		resources: merged.resources ?? workerConfig.resources ?? {},
-		apiManagedRoutes
-	};
+import { B as getWorkers } from "./tamer.mjs";
+import { n as r2S3CredentialsFromEnv, t as emptyR2BucketViaS3 } from "./r2S3EmptyBucket-B9_pHfvB.mjs";
+import { n as logApplyChange } from "./planFormat-5XMJK879.mjs";
+
+//#region src/core/naming/resolveCloudflareName.ts
+function resolveOverride(fn, tenantId, env, ctx) {
+	if (!fn) return void 0;
+	return fn(tenantId, env, ctx);
+}
+/** Managed D1 Cloudflare database name (not external `databaseName`). */
+function resolveD1CloudflareName(config, env, naming, shardDate) {
+	const tenantId = naming.tenantId;
+	if (config.type === "single") {
+		const override$1 = resolveOverride(config.cloudflareName, tenantId, env);
+		if (override$1 !== void 0) return override$1;
+		return naming.d1SingleName(config.logicalName, env);
+	}
+	if (!shardDate) throw new Error(`Sharded D1 "${config.logicalName}" requires shardDate`);
+	const override = resolveOverride(config.cloudflareName, tenantId, env, { shardDate });
+	if (override !== void 0) return override;
+	return naming.d1ShardName(config.logicalName, shardDate, env);
+}
+function resolveR2CloudflareName(config, env, naming) {
+	const override = resolveOverride(config.cloudflareName, naming.tenantId, env);
+	if (override !== void 0) return override;
+	return naming.r2BucketName(config.logicalName, env);
+}
+function resolveWorkflowCloudflareName(config, env, naming) {
+	const override = resolveOverride(config.cloudflareName, naming.tenantId, env);
+	if (override !== void 0) return override;
+	return naming.workflowName(config.logicalName, env);
+}
+function resolveKVCloudflareName(config, env, naming) {
+	const override = resolveOverride(config.cloudflareName, naming.tenantId, env);
+	if (override !== void 0) return override;
+	return naming.kvNamespaceName(config.logicalName, env);
+}
+function resolveQueueCloudflareName(config, env, naming) {
+	const override = resolveOverride(config.cloudflareName, naming.tenantId, env);
+	if (override !== void 0) return override;
+	return naming.queueName(config.logicalName, env);
+}
+function resolveHyperdriveCloudflareName(config, env, naming) {
+	const override = resolveOverride(config.cloudflareName, naming.tenantId, env);
+	if (override !== void 0) return override;
+	return naming.hyperdriveName(config.logicalName, env);
+}
+function resolveVectorizeCloudflareName(config, env, naming) {
+	const override = resolveOverride(config.cloudflareName, naming.tenantId, env);
+	if (override !== void 0) return override;
+	return naming.vectorizeName(config.logicalName, env);
+}
+function resolveAIGatewayCloudflareName(config, env, naming) {
+	const override = resolveOverride(config.cloudflareName, naming.tenantId, env);
+	if (override !== void 0) return override;
+	return naming.aiGatewayId(config.logicalName, env);
+}
+function resolvePipelineCloudflareName(config, env, naming) {
+	const override = resolveOverride(config.cloudflareName, naming.tenantId, env);
+	if (override !== void 0) return override;
+	return naming.pipelineName(config.logicalName, env);
+}
+function resolveSecretsStoreCloudflareName(config, env, naming) {
+	const override = resolveOverride(config.cloudflareName, naming.tenantId, env);
+	if (override !== void 0) return override;
+	return naming.secretsStoreName(config.logicalName, env);
 }
 
 //#endregion
@@ -863,7 +86,34 @@ function d1CloudflareDatabaseName(config, env, naming) {
 		if (typeof n !== "string" || !n.trim()) throw new Error(`D1 "${config.logicalName}" has ownership "external" but databaseName is empty — ensure imports are pre-fetched and config is merged with resolveWorkerConfig / mergeWorkerConfigWithResolvedRefs.`);
 		return n.trim();
 	}
-	return naming.d1SingleName(config.logicalName, env);
+	return resolveD1CloudflareName(config, env, naming);
+}
+
+//#endregion
+//#region src/features/d1/d1.naming.ts
+function d1DeriveName(config, env, shardDate, naming) {
+	if (config.type === "single") return resolveD1CloudflareName(config, env, naming);
+	if (!shardDate) throw new Error(`Sharded D1 "${config.logicalName}" requires shardDate`);
+	return resolveD1CloudflareName(config, env, naming, shardDate);
+}
+function d1MatchPattern(config, env, naming) {
+	if (config.type === "single") {
+		const exactName = resolveD1CloudflareName(config, env, naming);
+		return (name) => name === exactName;
+	}
+	if (config.cloudflareName || naming.hasD1ShardConvention()) return (name) => {
+		const shardDate = d1ExtractShardDate(name, naming);
+		if (!shardDate) return false;
+		try {
+			return resolveD1CloudflareName(config, env, naming, shardDate) === name;
+		} catch {
+			return false;
+		}
+	};
+	return naming.d1MatchPattern(config.logicalName, env);
+}
+function d1ExtractShardDate(name, naming) {
+	return naming.extractD1ShardDate(name);
 }
 
 //#endregion
@@ -900,7 +150,7 @@ async function d1Apply(resources, tenant, env, api, state, naming, addShard) {
 		if (addShard && addShard !== config.logicalName) continue;
 		if (addShard && addShard === config.logicalName) {
 			const shardDate$1 = todayNoDashes();
-			const derivedName$1 = naming.d1ShardName(config.logicalName, shardDate$1, env);
+			const derivedName$1 = d1DeriveName(config, env, shardDate$1, naming);
 			if (state.get(derivedName$1)) continue;
 			const { uuid: uuid$1 } = await api.d1Create(derivedName$1);
 			state.set(derivedName$1, {
@@ -919,7 +169,7 @@ async function d1Apply(resources, tenant, env, api, state, naming, addShard) {
 		const allResources = state.getAll();
 		if (Object.values(allResources).filter((e) => e.type === "d1_database" && "logicalName" in e && e.logicalName === config.logicalName).length > 0) continue;
 		const shardDate = todayNoDashes();
-		const derivedName = naming.d1ShardName(config.logicalName, shardDate, env);
+		const derivedName = d1DeriveName(config, env, shardDate, naming);
 		const { uuid } = await api.d1Create(derivedName);
 		state.set(derivedName, {
 			type: "d1_database",
@@ -935,19 +185,6 @@ async function d1Apply(resources, tenant, env, api, state, naming, addShard) {
 	}
 }
 
-//#endregion
-//#region src/features/d1/d1.naming.ts
-function d1MatchPattern(config, env, naming) {
-	if (config.type === "single") {
-		const exactName = naming.d1SingleName(config.logicalName, env);
-		return (name) => name === exactName;
-	}
-	return naming.d1MatchPattern(config.logicalName, env);
-}
-function d1ExtractShardDate(name, naming) {
-	return naming.extractD1ShardDate(name);
-}
-
 //#endregion
 //#region src/features/d1/d1.sync.ts
 function d1Sync(allD1, resources, tenant, env, state, naming) {
@@ -1024,7 +261,7 @@ function d1Drift(allD1, resources, env, state, naming) {
 			});
 			continue;
 		}
-		const pattern = naming.d1MatchPattern(config.logicalName, env);
+		const pattern = d1MatchPattern(config, env, naming);
 		const cfShards = allD1.filter((db) => pattern(db.name));
 		const cfShardNames = new Set(cfShards.map((s) => s.name));
 		const stateShards = d1State.filter((e) => e.logicalName === config.logicalName && !!e.shardDate);
@@ -1175,6 +412,22 @@ function resourcesFrom(source) {
 	return source;
 }
 
+//#endregion
+//#region src/core/registry/findResourceForImport.ts
+/**
+* Find the first declared resource config matching `logical` across all workers.
+* Used by `tamer import` to validate CF names against {@link cloudflareName} overrides.
+*/
+async function findWorkerResourceByLogicalName(config, configKey, logical, baseDir) {
+	const workers = await getWorkers(config, baseDir);
+	for (const [, wc] of workers) {
+		const list = wc.resources?.[configKey];
+		if (!list) continue;
+		const hit = list.find((r) => r.logicalName === logical);
+		if (hit) return hit;
+	}
+}
+
 //#endregion
 //#region src/features/d1/d1.module.ts
 const d1Module = {
@@ -1217,11 +470,13 @@ const d1Module = {
 			console.warn(`Rollback: failed to delete D1 ${entry.derivedName}:`, err);
 		}
 	},
-	async importOne({ options, env, api, state, naming, ts }) {
+	async importOne({ options, env, api, state, naming, config, baseDir, ts }) {
 		if (!options.cfId) throw new Error("import d1: --cf-id <uuid> is required");
+		const resourceConfig = await findWorkerResourceByLogicalName(config, "d1", options.logical, baseDir);
+		if (!resourceConfig) throw new Error(`import d1: no resources.d1 entry with logicalName "${options.logical}" in the Tamer project config`);
 		const hit = (await api.d1ListAll()).find((d) => d.uuid === options.cfId);
 		if (!hit) throw new Error(`import d1: D1 database with uuid "${options.cfId}" not found in account`);
-		const derivedName = options.shardDate ? naming.d1ShardName(options.logical, options.shardDate, env) : naming.d1SingleName(options.logical, env);
+		const derivedName = options.shardDate ? d1DeriveName(resourceConfig, env, options.shardDate, naming) : d1DeriveName(resourceConfig, env, void 0, naming);
 		if (hit.name !== derivedName) throw new Error(`import d1: cf name "${hit.name}" does not match derived "${derivedName}" — wrong --logical, missing --shard-date, or naming convention drift?`);
 		const bindingKey = options.shardDate ? naming.d1ShardBindingKey(options.logical, options.shardDate) : naming.d1SingleBindingKey(options.logical);
 		const existing = state.get(derivedName);
@@ -1240,6 +495,22 @@ const d1Module = {
 	}
 };
 
+//#endregion
+//#region src/features/r2/r2.naming.ts
+function r2DeriveName(config, env, naming) {
+	return resolveR2CloudflareName(config, env, naming);
+}
+function r2MatchPattern(config, env, naming) {
+	if (config.cloudflareName) {
+		const expected = resolveR2CloudflareName(config, env, naming);
+		return (name) => name === expected;
+	}
+	return naming.r2MatchPattern(config.logicalName, env);
+}
+function r2ExtractDate(name, naming) {
+	return naming.extractR2Date(name);
+}
+
 //#endregion
 //#region src/features/r2/r2.apply.ts
 function existingR2ForLogical(state, logicalName) {
@@ -1257,7 +528,7 @@ function assertValidR2BucketName(name, logicalName) {
 }
 async function r2Apply(resources, tenant, env, api, state, naming) {
 	for (const config of resources) {
-		const derivedName = naming.r2BucketName(config.logicalName, env);
+		const derivedName = r2DeriveName(config, env, naming);
 		if (state.get(derivedName)) {
 			console.log(`R2: skip "${derivedName}" (already in state; logical "${config.logicalName}")`);
 			continue;
@@ -1282,17 +553,11 @@ async function r2Apply(resources, tenant, env, api, state, naming) {
 	}
 }
 
-//#endregion
-//#region src/features/r2/r2.naming.ts
-function r2ExtractDate(name, naming) {
-	return naming.extractR2Date(name);
-}
-
 //#endregion
 //#region src/features/r2/r2.sync.ts
 function r2Sync(allR2, resources, tenant, env, state, naming) {
 	for (const config of resources) {
-		const pattern = naming.r2MatchPattern(config.logicalName, env);
+		const pattern = r2MatchPattern(config, env, naming);
 		const match = allR2.find((b) => pattern(b.name));
 		if (match) {
 			const createdDate = r2ExtractDate(match.name, naming) ?? match.creation_date.slice(0, 10);
@@ -1329,7 +594,7 @@ function r2Drift(allR2, resources, env, state, naming) {
 	const allState = state.getAll();
 	const r2State = Object.values(allState).filter((e) => e.type === "r2_bucket");
 	for (const config of resources) {
-		const pattern = naming.r2MatchPattern(config.logicalName, env);
+		const pattern = r2MatchPattern(config, env, naming);
 		const cfMatch = allR2.find((b) => pattern(b.name));
 		const stateEntry = r2State.find((e) => e.logicalName === config.logicalName);
 		if (stateEntry && !cfNames.has(stateEntry.derivedName)) {
@@ -1407,7 +672,7 @@ function r2Status(resources, env, state, naming) {
 		const entry = Object.values(allResources).find((e) => e.type === "r2_bucket" && e.logicalName === config.logicalName);
 		results.push({
 			binding: entry?.bindingKey ?? naming.r2BindingKey(config.logicalName),
-			name: entry?.derivedName ?? naming.r2BucketName(config.logicalName, env),
+			name: entry?.derivedName ?? r2DeriveName(config, env, naming),
 			status: entry ? "ok" : "missing"
 		});
 	}
@@ -1455,12 +720,14 @@ const r2Module = {
 			console.warn(`Rollback: failed to delete R2 ${entry.derivedName}:`, err);
 		}
 	},
-	async importOne({ options, env, api, state, naming, ts }) {
+	async importOne({ options, env, api, state, naming, config, baseDir, ts }) {
 		const bucketName = options.cfId;
 		if (!bucketName) throw new Error("import r2: --cf-id <bucket-name> is required");
+		const resourceConfig = await findWorkerResourceByLogicalName(config, "r2", options.logical, baseDir);
+		if (!resourceConfig) throw new Error(`import r2: no resources.r2 entry with logicalName "${options.logical}" in the Tamer project config`);
 		const hit = (await api.r2ListAll()).find((b) => b.name === bucketName);
 		if (!hit) throw new Error(`import r2: bucket "${bucketName}" not found in account`);
-		if (!naming.r2MatchPattern(options.logical, env)(hit.name)) throw new Error(`import r2: bucket name "${hit.name}" does not match expected pattern for logical "${options.logical}" and env "${env}"`);
+		if (!r2MatchPattern(resourceConfig, env, naming)(hit.name)) throw new Error(`import r2: bucket name "${hit.name}" does not match expected pattern for logical "${options.logical}" and env "${env}"`);
 		const derivedName = hit.name;
 		const createdDate = options.createdDate ?? naming.extractR2Date(hit.name) ?? hit.creation_date.slice(0, 10);
 		const bindingKey = naming.r2BindingKey(options.logical);
@@ -1478,11 +745,17 @@ const r2Module = {
 	}
 };
 
+//#endregion
+//#region src/features/kv/kv.naming.ts
+function kvDeriveName(config, env, naming) {
+	return resolveKVCloudflareName(config, env, naming);
+}
+
 //#endregion
 //#region src/features/kv/kv.apply.ts
 async function kvApply(resources, tenant, env, api, state, naming) {
 	for (const config of resources) {
-		const derivedName = naming.kvNamespaceName(config.logicalName, env);
+		const derivedName = kvDeriveName(config, env, naming);
 		if (state.get(derivedName)) continue;
 		const { id } = await api.kvCreate(derivedName);
 		state.set(derivedName, {
@@ -1501,7 +774,7 @@ async function kvApply(resources, tenant, env, api, state, naming) {
 //#region src/features/kv/kv.sync.ts
 function kvSync(allKV, resources, tenant, env, state, naming) {
 	for (const config of resources) {
-		const derivedName = naming.kvNamespaceName(config.logicalName, env);
+		const derivedName = kvDeriveName(config, env, naming);
 		const match = allKV.find((ns) => ns.title === derivedName);
 		if (match) state.set(derivedName, {
 			type: "kv_namespace",
@@ -1528,7 +801,7 @@ function kvDrift(allKV, resources, env, state, naming) {
 	const allState = state.getAll();
 	const kvState = Object.values(allState).filter((e) => e.type === "kv_namespace");
 	for (const config of resources) {
-		const derivedName = naming.kvNamespaceName(config.logicalName, env);
+		const derivedName = kvDeriveName(config, env, naming);
 		const cfId = cfByTitle.get(derivedName);
 		const stateEntry = kvState.find((e) => e.logicalName === config.logicalName);
 		if (stateEntry && !cfId) drift.missingFromCloudflare.push({
@@ -1571,7 +844,7 @@ async function kvDestroy(_env, state, api, config, baseDir, _force) {
 function kvGenerate(resources, env, state, naming) {
 	const bindings = [];
 	for (const config of resources) {
-		const derivedName = naming.kvNamespaceName(config.logicalName, env);
+		const derivedName = kvDeriveName(config, env, naming);
 		const entry = state.get(derivedName);
 		if (!entry || entry.type !== "kv_namespace") throw new Error(`KV "${config.logicalName}" not in state. Run 'tamer apply --env ${env}' first.`);
 		bindings.push({
@@ -1587,7 +860,7 @@ function kvGenerate(resources, env, state, naming) {
 function kvStatus(resources, env, state, naming) {
 	const results = [];
 	for (const config of resources) {
-		const derivedName = naming.kvNamespaceName(config.logicalName, env);
+		const derivedName = kvDeriveName(config, env, naming);
 		const entry = state.get(derivedName);
 		results.push({
 			binding: naming.kvBindingKey(config.logicalName),
@@ -1642,11 +915,13 @@ const kvModule = {
 			console.warn(`Rollback: failed to delete KV ${entry.derivedName}:`, err);
 		}
 	},
-	async importOne({ options, env, api, state, naming, ts }) {
+	async importOne({ options, env, api, state, naming, config, baseDir, ts }) {
 		if (!options.cfId) throw new Error("import kv: --cf-id <namespace-id> is required");
+		const resourceConfig = await findWorkerResourceByLogicalName(config, "kv", options.logical, baseDir);
+		if (!resourceConfig) throw new Error(`import kv: no resources.kv entry with logicalName "${options.logical}" in the Tamer project config`);
 		const hit = (await api.kvListAll()).find((k) => k.id === options.cfId);
 		if (!hit) throw new Error(`import kv: KV namespace id "${options.cfId}" not found in account`);
-		const derivedName = naming.kvNamespaceName(options.logical, env);
+		const derivedName = kvDeriveName(resourceConfig, env, naming);
 		if (hit.title !== derivedName) throw new Error(`import kv: cf title "${hit.title}" does not match derived "${derivedName}"`);
 		const bindingKey = naming.kvBindingKey(options.logical);
 		const existing = state.get(derivedName);
@@ -1663,6 +938,12 @@ const kvModule = {
 	}
 };
 
+//#endregion
+//#region src/features/queues/queues.naming.ts
+function queueDeriveName(config, env, naming) {
+	return resolveQueueCloudflareName(config, env, naming);
+}
+
 //#endregion
 //#region src/features/queues/queues.apply.ts
 const STATE_KEY_PREFIX$6 = "queue:";
@@ -1671,7 +952,7 @@ function stateKey$6(derivedName) {
 }
 async function queuesApply(resources, _tenant, env, api, state, naming) {
 	for (const config of resources) {
-		const derivedName = naming.queueName(config.logicalName, env);
+		const derivedName = queueDeriveName(config, env, naming);
 		const key = stateKey$6(derivedName);
 		if (state.get(key)) continue;
 		const ts = (/* @__PURE__ */ new Date()).toISOString();
@@ -1693,7 +974,7 @@ async function queuesApply(resources, _tenant, env, api, state, naming) {
 //#region src/features/queues/queues.sync.ts
 function queuesSync(allQueues, resources, _tenant, env, state, naming) {
 	for (const config of resources) {
-		const derivedName = naming.queueName(config.logicalName, env);
+		const derivedName = queueDeriveName(config, env, naming);
 		const match = allQueues.find((q) => q.queue_name === derivedName);
 		if (!match) continue;
 		const key = `queue:${derivedName}`;
@@ -1724,7 +1005,7 @@ function queuesDrift(allQueues, resources, env, state, naming) {
 	const cfByName = new Map(allQueues.map((q) => [q.queue_name, q.queue_id]));
 	const stateEntries = Object.values(state.getAll()).filter((e) => e.type === "queue");
 	for (const config of resources) {
-		const derivedName = naming.queueName(config.logicalName, env);
+		const derivedName = queueDeriveName(config, env, naming);
 		const cfId = cfByName.get(derivedName);
 		const stateEntry = stateEntries.find((e) => e.logicalName === config.logicalName);
 		if (stateEntry && !cfId) drift.missingFromCloudflare.push({
@@ -1773,7 +1054,7 @@ function queuesGenerate(resources, env, state, naming) {
 	const producers = [];
 	for (const config of resources) {
 		if (config.consumerOnly) continue;
-		const derivedName = naming.queueName(config.logicalName, env);
+		const derivedName = queueDeriveName(config, env, naming);
 		const entry = state.get(`queue:${derivedName}`);
 		if (!entry || entry.type !== "queue") throw new Error(`Queue "${config.logicalName}" not in state. Run 'tamer apply --env ${env}' first.`);
 		producers.push({
@@ -1790,7 +1071,7 @@ function queuesGenerate(resources, env, state, naming) {
 function queuesStatus(resources, env, state, naming) {
 	const out = [];
 	for (const config of resources) {
-		const derivedName = naming.queueName(config.logicalName, env);
+		const derivedName = queueDeriveName(config, env, naming);
 		const entry = state.get(`queue:${derivedName}`);
 		out.push({
 			binding: config.binding?.trim() || naming.queueBindingKey(config.logicalName),
@@ -1853,11 +1134,13 @@ const queuesModule = {
 			console.warn(`Rollback: failed to delete queue ${entry.derivedName}:`, err);
 		}
 	},
-	async importOne({ options, env, api, state, naming, ts }) {
+	async importOne({ options, env, api, state, naming, config, baseDir, ts }) {
 		if (!options.cfId) throw new Error("import queue: --cf-id <queue-id> is required");
+		const resourceConfig = await findWorkerResourceByLogicalName(config, "queues", options.logical, baseDir);
+		if (!resourceConfig) throw new Error(`import queue: no resources.queues entry with logicalName "${options.logical}" in the Tamer project config`);
 		const hit = (await api.queuesListAll()).find((q) => q.queue_id === options.cfId);
 		if (!hit) throw new Error(`import queue: queue id "${options.cfId}" not found in account`);
-		const derivedName = naming.queueName(options.logical, env);
+		const derivedName = queueDeriveName(resourceConfig, env, naming);
 		if (hit.queue_name !== derivedName) throw new Error(`import queue: cf name "${hit.queue_name}" does not match derived "${derivedName}"`);
 		const bindingKey = naming.queueBindingKey(options.logical);
 		const key = `queue:${derivedName}`;
@@ -1905,13 +1188,19 @@ function resolveHyperdriveOrigin(config) {
 	};
 }
 
+//#endregion
+//#region src/features/hyperdrive/hyperdrive.naming.ts
+function hyperdriveDeriveName(config, env, naming) {
+	return resolveHyperdriveCloudflareName(config, env, naming);
+}
+
 //#endregion
 //#region src/features/hyperdrive/hyperdrive.diff.ts
 function hyperdriveDiffPlanItems(args) {
 	const { resources, env, state, naming } = args;
 	const items = [];
 	for (const config of resources) {
-		const derivedName = naming.hyperdriveName(config.logicalName, env);
+		const derivedName = hyperdriveDeriveName(config, env, naming);
 		const entry = state.get(`hyperdrive:${derivedName}`);
 		if (!entry || entry.type !== "hyperdrive") continue;
 		const changes = computeChanges$1(entry, config);
@@ -1970,7 +1259,7 @@ function stateKey$5(derivedName) {
 }
 async function hyperdriveApply(resources, _tenant, env, api, state, naming) {
 	for (const config of resources) {
-		const derivedName = naming.hyperdriveName(config.logicalName, env);
+		const derivedName = hyperdriveDeriveName(config, env, naming);
 		const key = stateKey$5(derivedName);
 		const existing = state.get(key);
 		const ts = (/* @__PURE__ */ new Date()).toISOString();
@@ -2028,7 +1317,7 @@ async function hyperdriveApply(resources, _tenant, env, api, state, naming) {
 //#region src/features/hyperdrive/hyperdrive.sync.ts
 function hyperdriveSync(allHyperdrive, resources, _tenant, env, state, naming) {
 	for (const config of resources) {
-		const derivedName = naming.hyperdriveName(config.logicalName, env);
+		const derivedName = hyperdriveDeriveName(config, env, naming);
 		const match = allHyperdrive.find((h) => h.name === derivedName);
 		if (!match) continue;
 		const key = `hyperdrive:${derivedName}`;
@@ -2061,7 +1350,7 @@ function hyperdriveDrift(allHyperdrive, resources, env, state, naming) {
 	const cfByName = new Map(allHyperdrive.map((h) => [h.name, h.id]));
 	const stateEntries = Object.values(state.getAll()).filter((e) => e.type === "hyperdrive");
 	for (const config of resources) {
-		const derivedName = naming.hyperdriveName(config.logicalName, env);
+		const derivedName = hyperdriveDeriveName(config, env, naming);
 		const cfId = cfByName.get(derivedName);
 		const stateEntry = stateEntries.find((e) => e.logicalName === config.logicalName);
 		if (stateEntry && !cfId) drift.missingFromCloudflare.push({
@@ -2104,7 +1393,7 @@ async function hyperdriveDestroy(_env, state, api, config, baseDir, _force) {
 function hyperdriveGenerate(resources, env, state, naming) {
 	const out = [];
 	for (const config of resources) {
-		const derivedName = naming.hyperdriveName(config.logicalName, env);
+		const derivedName = hyperdriveDeriveName(config, env, naming);
 		const entry = state.get(`hyperdrive:${derivedName}`);
 		if (!entry || entry.type !== "hyperdrive") throw new Error(`Hyperdrive "${config.logicalName}" not in state. Run 'tamer apply --env ${env}' first.`);
 		out.push({
@@ -2121,7 +1410,7 @@ function hyperdriveGenerate(resources, env, state, naming) {
 function hyperdriveStatus(resources, env, state, naming) {
 	const out = [];
 	for (const config of resources) {
-		const derivedName = naming.hyperdriveName(config.logicalName, env);
+		const derivedName = hyperdriveDeriveName(config, env, naming);
 		const entry = state.get(`hyperdrive:${derivedName}`);
 		out.push({
 			binding: config.binding?.trim() || naming.hyperdriveBindingKey(config.logicalName),
@@ -2187,11 +1476,13 @@ const hyperdriveModule = {
 			console.warn(`Rollback: failed to delete Hyperdrive ${entry.derivedName}:`, err);
 		}
 	},
-	async importOne({ options, env, api, state, naming, ts }) {
+	async importOne({ options, env, api, state, naming, config, baseDir, ts }) {
 		if (!options.cfId) throw new Error("import hyperdrive: --cf-id <config-id> is required");
+		const resourceConfig = await findWorkerResourceByLogicalName(config, "hyperdrive", options.logical, baseDir);
+		if (!resourceConfig) throw new Error(`import hyperdrive: no resources.hyperdrive entry with logicalName "${options.logical}" in the Tamer project config`);
 		const hit = (await api.hyperdriveListAll()).find((h) => h.id === options.cfId);
 		if (!hit) throw new Error(`import hyperdrive: config id "${options.cfId}" not found in account`);
-		const derivedName = naming.hyperdriveName(options.logical, env);
+		const derivedName = hyperdriveDeriveName(resourceConfig, env, naming);
 		if (hit.name !== derivedName) throw new Error(`import hyperdrive: cf name "${hit.name}" does not match derived "${derivedName}"`);
 		const bindingKey = naming.hyperdriveBindingKey(options.logical);
 		const key = `hyperdrive:${derivedName}`;
@@ -2213,6 +1504,12 @@ const hyperdriveModule = {
 	}
 };
 
+//#endregion
+//#region src/features/vectorize/vectorize.naming.ts
+function vectorizeDeriveName(config, env, naming) {
+	return resolveVectorizeCloudflareName(config, env, naming);
+}
+
 //#endregion
 //#region src/features/vectorize/vectorize.apply.ts
 const STATE_KEY_PREFIX$4 = "vectorize:";
@@ -2221,7 +1518,7 @@ function stateKey$4(derivedName) {
 }
 async function vectorizeApply(resources, _tenant, env, api, state, naming) {
 	for (const config of resources) {
-		const derivedName = naming.vectorizeName(config.logicalName, env);
+		const derivedName = vectorizeDeriveName(config, env, naming);
 		const key = stateKey$4(derivedName);
 		const existing = state.get(key);
 		if (existing) {
@@ -2257,7 +1554,7 @@ async function vectorizeApply(resources, _tenant, env, api, state, naming) {
 //#region src/features/vectorize/vectorize.sync.ts
 function vectorizeSync(allIndexes, resources, _tenant, env, state, naming) {
 	for (const config of resources) {
-		const derivedName = naming.vectorizeName(config.logicalName, env);
+		const derivedName = vectorizeDeriveName(config, env, naming);
 		const match = allIndexes.find((i) => i.name === derivedName);
 		if (!match) continue;
 		const key = `vectorize:${derivedName}`;
@@ -2289,7 +1586,7 @@ function vectorizeDrift(allIndexes, resources, env, state, naming) {
 	const cfByName = new Map(allIndexes.map((i) => [i.name, i.id ?? i.name]));
 	const stateEntries = Object.values(state.getAll()).filter((e) => e.type === "vectorize");
 	for (const config of resources) {
-		const derivedName = naming.vectorizeName(config.logicalName, env);
+		const derivedName = vectorizeDeriveName(config, env, naming);
 		const cfId = cfByName.get(derivedName);
 		const stateEntry = stateEntries.find((e) => e.logicalName === config.logicalName);
 		if (stateEntry && !cfId) drift.missingFromCloudflare.push({
@@ -2337,7 +1634,7 @@ async function vectorizeDestroy(_env, state, api, config, baseDir, _force) {
 function vectorizeGenerate(resources, env, state, naming) {
 	const out = [];
 	for (const config of resources) {
-		const derivedName = naming.vectorizeName(config.logicalName, env);
+		const derivedName = vectorizeDeriveName(config, env, naming);
 		const entry = state.get(`vectorize:${derivedName}`);
 		if (!entry || entry.type !== "vectorize") throw new Error(`Vectorize index "${config.logicalName}" not in state. Run 'tamer apply --env ${env}' first.`);
 		out.push({
@@ -2353,7 +1650,7 @@ function vectorizeGenerate(resources, env, state, naming) {
 function vectorizeStatus(resources, env, state, naming) {
 	const out = [];
 	for (const config of resources) {
-		const derivedName = naming.vectorizeName(config.logicalName, env);
+		const derivedName = vectorizeDeriveName(config, env, naming);
 		const entry = state.get(`vectorize:${derivedName}`);
 		out.push({
 			binding: config.binding?.trim() || naming.vectorizeBindingKey(config.logicalName),
@@ -2370,7 +1667,7 @@ function vectorizeDiffPlanItems(args) {
 	const { resources, env, state, naming } = args;
 	const items = [];
 	for (const config of resources) {
-		const derivedName = naming.vectorizeName(config.logicalName, env);
+		const derivedName = vectorizeDeriveName(config, env, naming);
 		const key = `vectorize:${derivedName}`;
 		const entry = state.get(key);
 		if (!entry || entry.type !== "vectorize") continue;
@@ -2456,12 +1753,14 @@ const vectorizeModule = {
 			console.warn(`Rollback: failed to delete Vectorize ${entry.derivedName}:`, err);
 		}
 	},
-	async importOne({ options, env, api, state, naming, ts }) {
+	async importOne({ options, env, api, state, naming, config, baseDir, ts }) {
 		const indexName = options.cfId;
 		if (!indexName) throw new Error("import vectorize: --cf-id <index-name> is required");
+		const resourceConfig = await findWorkerResourceByLogicalName(config, "vectorize", options.logical, baseDir);
+		if (!resourceConfig) throw new Error(`import vectorize: no resources.vectorize entry with logicalName "${options.logical}" in the Tamer project config`);
 		const hit = (await api.vectorizeListAll()).find((v) => v.name === indexName);
 		if (!hit) throw new Error(`import vectorize: index "${indexName}" not found in account`);
-		const derivedName = naming.vectorizeName(options.logical, env);
+		const derivedName = vectorizeDeriveName(resourceConfig, env, naming);
 		if (hit.name !== derivedName) throw new Error(`import vectorize: cf name "${hit.name}" does not match derived "${derivedName}"`);
 		if (!hit.config) throw new Error(`import vectorize: cf index "${hit.name}" returned no config (dimensions/metric)`);
 		const metric = hit.config.metric;
@@ -2511,13 +1810,19 @@ function resolveAIGatewayConfig(config) {
 	};
 }
 
+//#endregion
+//#region src/features/ai-gateway/ai-gateway.naming.ts
+function aiGatewayDeriveName(config, env, naming) {
+	return resolveAIGatewayCloudflareName(config, env, naming);
+}
+
 //#endregion
 //#region src/features/ai-gateway/ai-gateway.diff.ts
 function aiGatewayDiffPlanItems(args) {
 	const { resources, env, state, naming } = args;
 	const items = [];
 	for (const config of resources) {
-		const derivedName = naming.aiGatewayId(config.logicalName, env);
+		const derivedName = aiGatewayDeriveName(config, env, naming);
 		const entry = state.get(`ai_gateway:${derivedName}`);
 		if (!entry || entry.type !== "ai_gateway") continue;
 		const changes = computeChanges(entry, config);
@@ -2601,7 +1906,7 @@ function stateKey$3(derivedName) {
 }
 async function aiGatewayApply(resources, _tenant, env, api, state, naming) {
 	for (const config of resources) {
-		const derivedName = naming.aiGatewayId(config.logicalName, env);
+		const derivedName = aiGatewayDeriveName(config, env, naming);
 		const key = stateKey$3(derivedName);
 		const existing = state.get(key);
 		const resolved = resolveAIGatewayConfig(config);
@@ -2677,7 +1982,7 @@ async function aiGatewayApply(resources, _tenant, env, api, state, naming) {
 //#region src/features/ai-gateway/ai-gateway.sync.ts
 function aiGatewaySync(allGateways, resources, _tenant, env, state, naming) {
 	for (const config of resources) {
-		const derivedName = naming.aiGatewayId(config.logicalName, env);
+		const derivedName = aiGatewayDeriveName(config, env, naming);
 		const match = allGateways.find((g) => g.id === derivedName);
 		if (!match) continue;
 		const key = `ai_gateway:${derivedName}`;
@@ -2715,7 +2020,7 @@ function aiGatewayDrift(allGateways, resources, env, state, naming) {
 	const cfIds = new Set(allGateways.map((g) => g.id));
 	const stateEntries = Object.values(state.getAll()).filter((e) => e.type === "ai_gateway");
 	for (const config of resources) {
-		const derivedName = naming.aiGatewayId(config.logicalName, env);
+		const derivedName = aiGatewayDeriveName(config, env, naming);
 		const inCloudflare = cfIds.has(derivedName);
 		const stateEntry = stateEntries.find((e) => e.logicalName === config.logicalName);
 		if (stateEntry && !inCloudflare) drift.missingFromCloudflare.push({
@@ -2758,7 +2063,7 @@ async function aiGatewayDestroy(_env, state, api, config, baseDir, _force) {
 function aiGatewayStatus(resources, env, state, naming) {
 	const out = [];
 	for (const config of resources) {
-		const derivedName = naming.aiGatewayId(config.logicalName, env);
+		const derivedName = aiGatewayDeriveName(config, env, naming);
 		const entry = state.get(`ai_gateway:${derivedName}`);
 		out.push({
 			binding: naming.aiGatewayBindingKey(config.logicalName),
@@ -2817,12 +2122,14 @@ const aiGatewayModule = {
 			console.warn(`Rollback: failed to delete AI Gateway ${entry.derivedName}:`, err);
 		}
 	},
-	async importOne({ options, env, api, state, naming, ts }) {
+	async importOne({ options, env, api, state, naming, config, baseDir, ts }) {
 		const gatewayId = options.cfId;
 		if (!gatewayId) throw new Error("import ai_gateway: --cf-id <gateway-id> is required");
+		const resourceConfig = await findWorkerResourceByLogicalName(config, "aiGateway", options.logical, baseDir);
+		if (!resourceConfig) throw new Error(`import ai_gateway: no resources.aiGateway entry with logicalName "${options.logical}" in the Tamer project config`);
 		const hit = (await api.aiGatewayListAll()).find((g) => g.id === gatewayId);
 		if (!hit) throw new Error(`import ai_gateway: gateway "${gatewayId}" not found in account`);
-		const derivedName = naming.aiGatewayId(options.logical, env);
+		const derivedName = aiGatewayDeriveName(resourceConfig, env, naming);
 		if (hit.id !== derivedName) throw new Error(`import ai_gateway: cf id "${hit.id}" does not match derived "${derivedName}"`);
 		const key = `ai_gateway:${derivedName}`;
 		const existing = state.get(key);
@@ -2847,6 +2154,12 @@ const aiGatewayModule = {
 	}
 };
 
+//#endregion
+//#region src/features/pipelines/pipelines.naming.ts
+function pipelineDeriveName(config, env, naming) {
+	return resolvePipelineCloudflareName(config, env, naming);
+}
+
 //#endregion
 //#region src/features/pipelines/pipelines.apply.ts
 const STATE_KEY_PREFIX$2 = "pipeline:";
@@ -2861,7 +2174,7 @@ function stateKey$2(derivedName) {
 */
 async function pipelinesApply(resources, _tenant, env, api, state, naming) {
 	for (const config of resources) {
-		const derivedName = naming.pipelineName(config.logicalName, env);
+		const derivedName = pipelineDeriveName(config, env, naming);
 		const key = stateKey$2(derivedName);
 		if (state.get(key)) continue;
 		const ts = (/* @__PURE__ */ new Date()).toISOString();
@@ -2887,7 +2200,7 @@ async function pipelinesApply(resources, _tenant, env, api, state, naming) {
 //#region src/features/pipelines/pipelines.sync.ts
 function pipelinesSync(allPipelines, resources, _tenant, env, state, naming) {
 	for (const config of resources) {
-		const derivedName = naming.pipelineName(config.logicalName, env);
+		const derivedName = pipelineDeriveName(config, env, naming);
 		const match = allPipelines.find((p) => p.name === derivedName);
 		if (!match) continue;
 		const key = `pipeline:${derivedName}`;
@@ -2919,7 +2232,7 @@ function pipelinesDrift(allPipelines, resources, env, state, naming) {
 	const cfByName = new Map(allPipelines.map((p) => [p.name, p]));
 	const stateEntries = Object.values(state.getAll()).filter((e) => e.type === "pipeline");
 	for (const config of resources) {
-		const derivedName = naming.pipelineName(config.logicalName, env);
+		const derivedName = pipelineDeriveName(config, env, naming);
 		const inCloudflare = cfByName.has(derivedName);
 		const stateEntry = stateEntries.find((e) => e.logicalName === config.logicalName);
 		if (stateEntry && !inCloudflare) drift.missingFromCloudflare.push({
@@ -2972,7 +2285,7 @@ async function pipelinesDestroy(_env, state, api, config, baseDir, _force) {
 function pipelinesGenerate(resources, env, state, naming) {
 	const out = [];
 	for (const config of resources) {
-		const derivedName = naming.pipelineName(config.logicalName, env);
+		const derivedName = pipelineDeriveName(config, env, naming);
 		const entry = state.get(`pipeline:${derivedName}`);
 		if (!entry || entry.type !== "pipeline") throw new Error(`Pipeline "${config.logicalName}" not in state. Run 'tamer apply --env ${env}' first.`);
 		out.push({
@@ -2988,7 +2301,7 @@ function pipelinesGenerate(resources, env, state, naming) {
 function pipelinesStatus(resources, env, state, naming) {
 	const out = [];
 	for (const config of resources) {
-		const derivedName = naming.pipelineName(config.logicalName, env);
+		const derivedName = pipelineDeriveName(config, env, naming);
 		const entry = state.get(`pipeline:${derivedName}`);
 		out.push({
 			binding: config.binding?.trim() || naming.pipelineBindingKey(config.logicalName),
@@ -3005,7 +2318,7 @@ function pipelinesDiffPlanItems(args) {
 	const { resources, env, state, naming } = args;
 	const items = [];
 	for (const config of resources) {
-		const derivedName = naming.pipelineName(config.logicalName, env);
+		const derivedName = pipelineDeriveName(config, env, naming);
 		const key = `pipeline:${derivedName}`;
 		const entry = state.get(key);
 		if (!entry || entry.type !== "pipeline") continue;
@@ -3097,12 +2410,14 @@ const pipelinesModule = {
 			console.warn(`Rollback: failed to delete Pipeline ${entry.derivedName}:`, err);
 		}
 	},
-	async importOne({ options, env, api, state, naming, ts }) {
+	async importOne({ options, env, api, state, naming, config, baseDir, ts }) {
 		const pipelineId = options.cfId;
 		if (!pipelineId) throw new Error("import pipeline: --cf-id <pipeline-id> is required");
+		const resourceConfig = await findWorkerResourceByLogicalName(config, "pipelines", options.logical, baseDir);
+		if (!resourceConfig) throw new Error(`import pipeline: no resources.pipelines entry with logicalName "${options.logical}" in the Tamer project config`);
 		const hit = (await api.pipelineListAll()).find((p) => p.id === pipelineId);
 		if (!hit) throw new Error(`import pipeline: pipeline "${pipelineId}" not found in account`);
-		const derivedName = naming.pipelineName(options.logical, env);
+		const derivedName = pipelineDeriveName(resourceConfig, env, naming);
 		if (hit.name !== derivedName) throw new Error(`import pipeline: cf name "${hit.name}" does not match derived "${derivedName}"`);
 		const key = `pipeline:${derivedName}`;
 		const existing = state.get(key);
@@ -3121,13 +2436,23 @@ const pipelinesModule = {
 	}
 };
 
+//#endregion
+//#region src/features/workflows/workflows.naming.ts
+function workflowDeriveName(config, env, naming) {
+	return resolveWorkflowCloudflareName(config, env, naming);
+}
+function workflowMatchPattern(config, env, naming) {
+	const expected = resolveWorkflowCloudflareName(config, env, naming);
+	return (name) => name === expected;
+}
+
 //#endregion
 //#region src/features/workflows/workflows.diff.ts
 function workflowsDiffPlanItems(args) {
 	const { resources, env, state, naming, worker } = args;
 	const items = [];
 	for (const config of resources) {
-		const derivedName = naming.workflowName(config.logicalName, env);
+		const derivedName = workflowDeriveName(config, env, naming);
 		const key = `workflow:${derivedName}`;
 		const entry = state.get(key);
 		if (!entry || entry.type !== "workflow") continue;
@@ -3214,7 +2539,7 @@ function limitsEqual(a, b) {
 */
 async function workflowsApply(resources, _tenant, env, api, state, naming, worker) {
 	for (const config of resources) {
-		const derivedName = naming.workflowName(config.logicalName, env);
+		const derivedName = workflowDeriveName(config, env, naming);
 		const scriptName = resolveScriptName(config, worker);
 		const key = stateKey$1(derivedName);
 		const existing = state.get(key);
@@ -3267,8 +2592,8 @@ async function workflowsApply(resources, _tenant, env, api, state, naming, worke
 */
 function workflowsSync(allWorkflows, resources, _tenant, env, state, naming) {
 	for (const config of resources) {
-		const derivedName = naming.workflowName(config.logicalName, env);
-		const pattern = naming.workflowMatchPattern(config.logicalName, env);
+		const derivedName = workflowDeriveName(config, env, naming);
+		const pattern = workflowMatchPattern(config, env, naming);
 		const match = allWorkflows.find((w) => pattern(w.name));
 		if (!match) continue;
 		const key = `workflow:${derivedName}`;
@@ -3302,7 +2627,7 @@ function workflowsDrift(allWorkflows, resources, env, state, naming) {
 	const cfByName = new Map(allWorkflows.map((w) => [w.name, w]));
 	const stateEntries = Object.values(state.getAll()).filter((e) => e.type === "workflow");
 	for (const config of resources) {
-		const derivedName = naming.workflowName(config.logicalName, env);
+		const derivedName = workflowDeriveName(config, env, naming);
 		const inCloudflare = cfByName.has(derivedName);
 		const stateEntry = stateEntries.find((e) => e.logicalName === config.logicalName);
 		if (stateEntry && !inCloudflare) drift.missingFromCloudflare.push({
@@ -3356,7 +2681,7 @@ async function workflowsDestroy(_env, state, api, config, baseDir, _force) {
 function workflowsGenerate(resources, env, state, naming, worker) {
 	const out = [];
 	for (const config of resources) {
-		const derivedName = naming.workflowName(config.logicalName, env);
+		const derivedName = workflowDeriveName(config, env, naming);
 		const entry = state.get(`workflow:${derivedName}`);
 		if (!entry || entry.type !== "workflow") throw new Error(`Workflow "${config.logicalName}" not in state. Run 'tamer apply --env ${env}' first.`);
 		const explicitScript = config.scriptName?.trim();
@@ -3378,7 +2703,7 @@ function workflowsGenerate(resources, env, state, naming, worker) {
 function workflowsStatus(resources, env, state, naming) {
 	const out = [];
 	for (const config of resources) {
-		const derivedName = naming.workflowName(config.logicalName, env);
+		const derivedName = workflowDeriveName(config, env, naming);
 		const entry = state.get(`workflow:${derivedName}`);
 		out.push({
 			binding: config.binding?.trim() || naming.workflowBindingKey(config.logicalName),
@@ -3446,10 +2771,11 @@ const workflowsModule = {
 			console.warn(`Rollback: failed to delete Workflow ${entry.derivedName}:`, err);
 		}
 	},
-	async importOne({ options, env, api, state, naming, ts }) {
-		const all = await api.workflowListAll();
-		const derivedName = naming.workflowName(options.logical, env);
-		const hit = all.find((w) => w.name === derivedName);
+	async importOne({ options, env, api, state, naming, config, baseDir, ts }) {
+		const resourceConfig = await findWorkerResourceByLogicalName(config, "workflows", options.logical, baseDir);
+		if (!resourceConfig) throw new Error(`import workflow: no resources.workflows entry with logicalName "${options.logical}" in the Tamer project config`);
+		const derivedName = workflowDeriveName(resourceConfig, env, naming);
+		const hit = (await api.workflowListAll()).find((w) => w.name === derivedName);
 		if (!hit) throw new Error(`import workflow: no workflow named "${derivedName}" found in account`);
 		if (options.cfId && hit.id !== options.cfId) throw new Error(`import workflow: cf id "${hit.id}" does not match --cf-id "${options.cfId}"`);
 		const key = `workflow:${derivedName}`;
@@ -3470,6 +2796,12 @@ const workflowsModule = {
 	}
 };
 
+//#endregion
+//#region src/features/secrets-store/secrets-store.naming.ts
+function secretsStoreDeriveName(config, env, naming) {
+	return resolveSecretsStoreCloudflareName(config, env, naming);
+}
+
 //#endregion
 //#region src/features/secrets-store/secrets-store.apply.ts
 const STATE_KEY_PREFIX = "secrets_store:";
@@ -3488,7 +2820,7 @@ async function secretsStoreApply(resources, _tenant, env, api, state, naming) {
 	if (resources.length === 0) return;
 	let allStores = null;
 	for (const config of resources) {
-		const derivedName = naming.secretsStoreName(config.logicalName, env);
+		const derivedName = secretsStoreDeriveName(config, env, naming);
 		const key = stateKey(derivedName);
 		const existing = state.get(key);
 		const wantsBindingKey = naming.secretsStoreBindingKey(config.logicalName);
@@ -3522,7 +2854,7 @@ async function secretsStoreApply(resources, _tenant, env, api, state, naming) {
 */
 function secretsStoreSync(allStores, resources, _tenant, env, state, naming) {
 	for (const config of resources) {
-		const derivedName = naming.secretsStoreName(config.logicalName, env);
+		const derivedName = secretsStoreDeriveName(config, env, naming);
 		const match = allStores.find((s) => s.name === derivedName);
 		if (!match) continue;
 		const key = `secrets_store:${derivedName}`;
@@ -3553,7 +2885,7 @@ function secretsStoreDrift(allStores, resources, env, state, naming) {
 	const cfByName = new Map(allStores.map((s) => [s.name, s]));
 	const stateEntries = Object.values(state.getAll()).filter((e) => e.type === "secrets_store");
 	for (const config of resources) {
-		const derivedName = naming.secretsStoreName(config.logicalName, env);
+		const derivedName = secretsStoreDeriveName(config, env, naming);
 		const inCloudflare = cfByName.has(derivedName);
 		const stateEntry = stateEntries.find((e) => e.logicalName === config.logicalName);
 		if (stateEntry && !inCloudflare) drift.missingFromCloudflare.push({
@@ -3598,7 +2930,7 @@ async function secretsStoreDestroy(_env, state, api, config, baseDir, _force) {
 function secretsStoreStatus(resources, env, state, naming) {
 	const out = [];
 	for (const config of resources) {
-		const derivedName = naming.secretsStoreName(config.logicalName, env);
+		const derivedName = secretsStoreDeriveName(config, env, naming);
 		const entry = state.get(`secrets_store:${derivedName}`);
 		out.push({
 			binding: naming.secretsStoreBindingKey(config.logicalName),
@@ -3653,9 +2985,11 @@ const secretsStoreModule = {
 			console.warn(`Rollback: failed to delete Secrets Store ${entry.derivedName}:`, err);
 		}
 	},
-	async importOne({ options, env, api, state, naming, ts }) {
+	async importOne({ options, env, api, state, naming, config, baseDir, ts }) {
+		const resourceConfig = await findWorkerResourceByLogicalName(config, "secretsStores", options.logical, baseDir);
+		if (!resourceConfig) throw new Error(`import secret_store: no resources.secretsStores entry with logicalName "${options.logical}" in the Tamer project config`);
 		const all = await api.secretsStoreListAll();
-		const derivedName = naming.secretsStoreName(options.logical, env);
+		const derivedName = secretsStoreDeriveName(resourceConfig, env, naming);
 		const hit = all.find((s) => s.name === derivedName);
 		if (!hit) throw new Error(`import secret_store: no store named "${derivedName}" found in account`);
 		if (options.cfId && hit.id !== options.cfId) throw new Error(`import secret_store: cf id "${hit.id}" does not match --cf-id "${options.cfId}"`);
@@ -3695,132 +3029,5 @@ function getResourceModule(kind) {
 }
 
 //#endregion
-//#region src/core/imports/fetchStackImports.ts
-const IMPORT_RE = /\$\{tamer:import:([a-zA-Z0-9_-]+)\.([a-zA-Z0-9_-]+)\}/g;
-/**
-* Walk the merged `CfiConfig` and collect every `${tamer:import:…}` ref
-* site along with where it was found. Used both to drive the pre-fetch
-* (which sibling stacks to load) and by `tamer status` to render an
-* "inbound imports" panel even before any `apply` has run.
-*
-* Self-imports (current stack importing from its own name) are filtered
-* out — they are almost always a config typo and would otherwise
-* silently resolve via the same row this command is about to write.
-*/
-function scanConfigForImports(config) {
-	const selfStack = stackNameForConfig(config);
-	const refs = [];
-	const seen = /* @__PURE__ */ new Set();
-	const push = (raw, fieldPath) => {
-		if (!raw) return;
-		IMPORT_RE.lastIndex = 0;
-		let m;
-		while ((m = IMPORT_RE.exec(raw)) !== null) {
-			const stack = m[1];
-			const output = m[2];
-			if (stack === selfStack) continue;
-			const key = `${fieldPath}::${stack}.${output}`;
-			if (seen.has(key)) continue;
-			seen.add(key);
-			refs.push({
-				stack,
-				output,
-				fieldPath
-			});
-		}
-	};
-	const walkVars = (vars, pathPrefix) => {
-		if (!vars) return;
-		for (const [k, v] of Object.entries(vars)) push(materializeTamerResolvable(v), `${pathPrefix}.${k}`);
-	};
-	const walkR2BucketNames = (w, pathPrefix) => {
-		if (!w.r2_buckets) return;
-		w.r2_buckets.forEach((b, i) => {
-			if (b.bucket_name === void 0) return;
-			push(materializeTamerResolvable(b.bucket_name), `${pathPrefix}.r2_buckets[${i}].bucket_name`);
-		});
-	};
-	const walkD1DatabaseNames = (w, pathPrefix) => {
-		const d1 = w.resources?.d1;
-		if (!d1) return;
-		d1.forEach((d, i) => {
-			if (d.databaseName === void 0) return;
-			push(materializeTamerResolvable(d.databaseName), `${pathPrefix}.resources.d1[${i}].databaseName`);
-		});
-	};
-	/** Service bindings / WfP namespace strings may carry `${tamer:import:…}`. */
-	const walkBindingsWithRefs = (w, pathPrefix) => {
-		w.services?.forEach((s, i) => {
-			if (s.service === void 0) return;
-			push(materializeTamerResolvable(s.service), `${pathPrefix}.services[${i}].service`);
-		});
-		w.dispatch_namespaces?.forEach((d, i) => {
-			if (d.namespace === void 0) return;
-			push(materializeTamerResolvable(d.namespace), `${pathPrefix}.dispatch_namespaces[${i}].namespace`);
-		});
-	};
-	if (config.worker) {
-		walkVars(config.worker.vars, "worker.vars");
-		walkR2BucketNames(config.worker, "worker");
-		walkD1DatabaseNames(config.worker, "worker");
-		walkBindingsWithRefs(config.worker, "worker");
-		if (config.worker.tamerRoutes) config.worker.tamerRoutes.forEach((r, i) => {
-			push(r.host, `worker.tamerRoutes[${i}].host`);
-			push(r.zone, `worker.tamerRoutes[${i}].zone`);
-		});
-	}
-	if (config.workers) for (const [key, w] of Object.entries(config.workers)) {
-		walkVars(w.vars, `worker[${key}].vars`);
-		walkR2BucketNames(w, `worker[${key}]`);
-		walkD1DatabaseNames(w, `worker[${key}]`);
-		walkBindingsWithRefs(w, `worker[${key}]`);
-		if (w.tamerRoutes) w.tamerRoutes.forEach((r, i) => {
-			push(r.host, `worker[${key}].tamerRoutes[${i}].host`);
-			push(r.zone, `worker[${key}].tamerRoutes[${i}].zone`);
-		});
-	}
-	if (config.outputs) for (const [name, source] of Object.entries(config.outputs)) push(materializeTamerResolvable(source), `outputs.${name}`);
-	return refs;
-}
-/** Distinct sibling stack names referenced anywhere in `config`. */
-function importedStackNames(config) {
-	const refs = scanConfigForImports(config);
-	return [...new Set(refs.map((r) => r.stack))].sort();
-}
-/**
-* Hydrate every imported sibling stack's persisted outputs and return
-* them shaped for {@link ReferenceContext.imports}.
-*
-* - `local` env: returns `{}` immediately. Local mode never persists
-*   state, so cross-stack imports are inherently unresolvable. Callers
-*   running in tolerant mode (`plan`, `status`) will see the placeholder
-*   verbatim; strict callers (`apply`, `deploy`) will fail at resolution
-*   with a clear "no imported stack" message.
-* - Missing sibling state row: recorded as an empty outputs map, so
-*   `lookupImport` can produce a "no published outputs" diagnostic
-*   (vs. the generic "stack not pre-fetched" error).
-*
-* The {@link CFApiClient} is shared with the caller for socket reuse.
-*/
-async function fetchStackImports(api, config, env) {
-	const stacks = importedStackNames(config);
-	if (stacks.length === 0 || env === "local") return {};
-	const out = {};
-	for (const stack of stacks) {
-		const sibling = new StateManager(config.tenant.id, env, stack);
-		try {
-			await sibling.hydrate(api);
-		} catch (err) {
-			throw new Error(`Failed to hydrate imported stack "${stack}" from env "${env}": ${err instanceof Error ? err.message : String(err)}`);
-		}
-		const persisted = sibling.getStackOutputs();
-		const flat = {};
-		for (const [name, v] of Object.entries(persisted)) flat[name] = v.value;
-		out[stack] = flat;
-	}
-	return out;
-}
-
-//#endregion
-export { namingFromConfig as _, resourceModules as a, d1SkipsProvisionAndMigrate as c, mergedWorkerConfigForEnv as d, resolveDeployedWorkerName as f, wranglerConfigCliArgs as g, resolveReferencesInString as h, getResourceModule as i, buildIntraStackScriptNameMap as l, rewriteIntraStackServiceTargets as m, importedStackNames as n, logicalNamesForResourceKind as o, resolveWorkerConfig as p, scanConfigForImports as r, d1CloudflareDatabaseName as s, fetchStackImports as t, mergeWorkerConfigForResourcePick as u };
-//# sourceMappingURL=fetchStackImports-C-1THPYL.mjs.map
+export { d1CloudflareDatabaseName as a, logicalNamesForResourceKind as i, resourceModules as n, d1SkipsProvisionAndMigrate as o, secretsStoreDeriveName as r, getResourceModule as t };
+//# sourceMappingURL=registry-EWWdkLf7.mjs.map