@dragonmastery/tamer 0.33.0 → 0.34.0

package/dist/{deploy-BP65Wvm1.mjs → deploy-dNygCucr.mjs}

@@ -6,7 +6,7 @@ import { t as assertShardRegistryPresentForDeploy } from "./emit-DTpaIMkn.mjs";
 import "./logpush-job-GqVKG_HI.mjs";
 import { r as workerRoutesApply } from "./worker-route-CqBDvjgo.mjs";
 import { runSync } from "./sync-YKZ5HD8v.mjs";
-import { t as spawnWranglerSync } from "./wranglerSpawn-B3TKjpt2.mjs";
+import { n as spawnWranglerSync, t as spawnBuildSync } from "./wranglerSpawn-CqVNGkA9.mjs";
 
 //#region src/cli/commands/deploy.ts
 /**
@@ -82,7 +82,8 @@ async function runDeploy(options) {
 		});
 		let deploySecrets = null;
 		for (const [workerKey, workerConfig] of ordered) {
-			const requiredSecrets = requiredSecretsForWorker(mergedWorkerConfigForEnv(workerConfig, env, config.tenant));
+			const mergedForSecrets = mergedWorkerConfigForEnv(workerConfig, env, config.tenant);
+			const requiredSecrets = requiredSecretsForWorker(mergedForSecrets);
 			if (requiredSecrets.length > 0 && env !== "local") {
 				if (!deploySecrets) deploySecrets = await createDeploySecretsResources(api, env);
 				await pushSecretsForDeploy({
@@ -98,6 +99,19 @@ async function runDeploy(options) {
 			const resolved = await resolveWorkerConfig(config, workerKey, workerConfig, env, baseDir, accountId, naming, state, { imports });
 			const wranglerConfig = generateWranglerConfig(resolved, state, naming);
 			writeWranglerJson(resolved.workerDir, wranglerConfig, resolved.wranglerOutFile);
+			const buildConfig = mergedForSecrets.build;
+			if (buildConfig) {
+				console.log(`Building ${workerKey} (${buildConfig.command})...`);
+				const buildEnv = {};
+				if (wranglerConfig.vars) for (const [k, v] of Object.entries(wranglerConfig.vars)) buildEnv[k] = typeof v === "string" ? v : String(v);
+				const buildResult = spawnBuildSync(buildConfig.command, {
+					cwd: resolved.workerDir,
+					stdio: "inherit",
+					env: buildEnv
+				});
+				if (buildResult.status !== 0) throw new Error(`build failed for ${workerKey} (exit ${buildResult.status})`);
+				console.log(`Built ${workerKey}`);
+			}
 			if (spawnWranglerSync([
 				"wrangler",
 				...wranglerConfigCliArgs(resolved.wranglerOutFile),
@@ -139,4 +153,4 @@ async function runDeploy(options) {
 
 //#endregion
 export { runDeploy };
-//# sourceMappingURL=deploy-BP65Wvm1.mjs.map
+//# sourceMappingURL=deploy-dNygCucr.mjs.map

package/dist/deploy-dNygCucr.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-dNygCucr.mjs","names":["out: WorkerEntry[]","deploySecrets: Awaited<\n    ReturnType<typeof createDeploySecretsResources>\n  > | null","buildEnv: Record<string, string>"],"sources":["../src/cli/commands/deploy.ts"],"sourcesContent":["import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport { wranglerConfigCliArgs } from \"../../core/wrangler/wranglerOutFile.js\";\nimport { spawnWranglerSync, spawnBuildSync } from \"../../core/wrangler/wranglerSpawn.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport {\n  buildIntraStackScriptNameMap,\n  mergedWorkerConfigForEnv,\n  resolveDeployedWorkerName,\n  resolveWorkerConfig,\n  rewriteIntraStackServiceTargets,\n} from \"../../core/config/resolver.js\";\nimport { requiredSecretsForWorker } from \"../../core/secrets/declared.js\";\nimport { createDeploySecretsResources } from \"./secrets/context.js\";\nimport { pushSecretsForDeploy } from \"./secrets/push.js\";\nimport {\n  generateWranglerConfig,\n  writeWranglerJson,\n} from \"../../core/wrangler/generator.js\";\nimport { runSync } from \"./sync.js\";\nimport { workerRoutesApply } from \"../../features/worker-route/index.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\nimport { assertShardRegistryPresentForDeploy } from \"../../core/codegen/shardRegistry/index.js\";\nimport type { CfiConfig, WorkerConfig } from \"../../types.js\";\n\ntype WorkerEntry = [string, WorkerConfig];\n\n/**\n * Topologically sort workers by `services[].service` so that dependencies\n * deploy before dependents. Cloudflare rejects deploys that reference\n * service bindings to workers that don't yet exist on the account.\n * Cross-config dependencies (services not in this monorepo) are ignored.\n */\nexport function topoSortWorkersByServiceBindings(\n  workers: WorkerEntry[],\n  config: CfiConfig,\n  naming: NamingEngine,\n  env: string,\n): WorkerEntry[] {\n  const intraMap = buildIntraStackScriptNameMap(config, env, naming);\n  const scriptNameToKey = new Map<string, string>();\n  for (const [key, cfg] of workers) {\n    const name = resolveDeployedWorkerName(config, key, cfg, env, naming);\n    scriptNameToKey.set(name, key);\n  }\n\n  const byKey = new Map(workers);\n  const visited = new Set<string>();\n  const visiting = new Set<string>();\n  const out: WorkerEntry[] = [];\n\n  function visit(key: string): void {\n    if (visited.has(key)) return;\n    if (visiting.has(key)) return;\n    visiting.add(key);\n    const cfg = byKey.get(key);\n    if (cfg) {\n      const merged = rewriteIntraStackServiceTargets(\n        mergedWorkerConfigForEnv(cfg, env, config.tenant),\n        intraMap,\n      );\n      const deps = merged.services?.map((s) => s.service) ?? [];\n      for (const dep of deps) {\n        const depKey = scriptNameToKey.get(dep);\n        if (depKey && depKey !== key) visit(depKey);\n      }\n      visiting.delete(key);\n      visited.add(key);\n      out.push([key, cfg]);\n    }\n  }\n\n  for (const [key] of workers) visit(key);\n  return out;\n}\n\nexport async function runDeploy(options: {\n  worker?: string;\n  env?: string;\n  configPath?: string;\n  /** Passed to `wrangler deploy --dispatch-namespace` when the worker has no `dispatchNamespace` in config. */\n  dispatchNamespace?: string;\n}): Promise<void> {\n  const workerFilter = options.worker;\n  // `--env` is intentionally required (no silent default to \"prod\") to\n  // match every other Tamer command and to avoid the classic \"ran\n  // `tamer deploy` from the wrong shell, shipped a half-tested branch\n  // to production\" footgun.\n  const env = options.env;\n  if (!env) {\n    throw new Error(\n      \"deploy: --env is required (e.g. --env staging). \" +\n        \"Tamer no longer defaults to prod — pass the env explicitly.\",\n    );\n  }\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  console.log(`Syncing state for env: ${env}...`);\n  await runSync({ env, configPath });\n\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const imports = await fetchStackImports(api, config, env);\n  state.beginOperation(\"deploy\", workerFilter ? `worker:${workerFilter}` : undefined);\n\n  try {\n\n  const workers = await getWorkers(config, baseDir);\n  const toDeploy = workerFilter\n    ? workers.filter(([k]) => k === workerFilter)\n    : workers;\n\n  if (toDeploy.length === 0) {\n    throw new Error(\n      workerFilter\n        ? `Worker \"${workerFilter}\" not found`\n        : \"No workers configured\",\n    );\n  }\n\n  const ordered = topoSortWorkersByServiceBindings(\n    toDeploy,\n    config,\n    naming,\n    env,\n  );\n\n  await assertShardRegistryPresentForDeploy({\n    config,\n    env,\n    baseDir,\n    accountId,\n    naming,\n    state,\n    imports,\n    workers,\n  });\n\n  let deploySecrets: Awaited<\n    ReturnType<typeof createDeploySecretsResources>\n  > | null = null;\n\n  for (const [workerKey, workerConfig] of ordered) {\n    const mergedForSecrets = mergedWorkerConfigForEnv(\n      workerConfig,\n      env,\n      config.tenant,\n    );\n    const requiredSecrets = requiredSecretsForWorker(mergedForSecrets);\n\n    if (requiredSecrets.length > 0 && env !== \"local\") {\n      if (!deploySecrets) {\n        deploySecrets = await createDeploySecretsResources(api, env);\n      }\n      const deployedName = resolveDeployedWorkerName(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        naming,\n      );\n      await pushSecretsForDeploy({\n        workerKey,\n        deployedName,\n        required: requiredSecrets,\n        vault: deploySecrets.vault,\n        state,\n        api,\n        masterKey: deploySecrets.masterKey,\n      });\n    }\n\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { imports },\n    );\n    const wranglerConfig = generateWranglerConfig(resolved, state, naming);\n    writeWranglerJson(resolved.workerDir, wranglerConfig, resolved.wranglerOutFile);\n\n    const buildConfig = mergedForSecrets.build;\n    if (buildConfig) {\n      console.log(`Building ${workerKey} (${buildConfig.command})...`);\n      const buildEnv: Record<string, string> = {};\n      if (wranglerConfig.vars) {\n        for (const [k, v] of Object.entries(wranglerConfig.vars)) {\n          buildEnv[k] = typeof v === \"string\" ? v : String(v);\n        }\n      }\n      const buildResult = spawnBuildSync(buildConfig.command, {\n        cwd: resolved.workerDir,\n        stdio: \"inherit\",\n        env: buildEnv,\n      });\n      if (buildResult.status !== 0) {\n        throw new Error(\n          `build failed for ${workerKey} (exit ${buildResult.status})`,\n        );\n      }\n      console.log(`Built ${workerKey}`);\n    }\n\n    const typesArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n      \"types\",\n    ];\n    const typesResult = spawnWranglerSync(typesArgs, {\n      cwd: resolved.workerDir,\n      stdio: \"inherit\",\n    });\n    if (typesResult.status !== 0) {\n      throw new Error(`wrangler types failed for ${workerKey}`);\n    }\n\n    const dispatchNs =\n      resolved.dispatchNamespace ?? options.dispatchNamespace;\n    const deployArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n      \"deploy\",\n    ];\n    if (dispatchNs) {\n      deployArgs.push(\"--dispatch-namespace\", dispatchNs);\n    }\n\n    const deployResult = spawnWranglerSync(deployArgs, {\n      cwd: resolved.workerDir,\n      stdio: \"inherit\",\n    });\n    if (deployResult.status !== 0) {\n      throw new Error(`wrangler deploy failed for ${workerKey}`);\n    }\n    console.log(`Deployed ${workerKey}`);\n  }\n\n  if (env !== \"local\") {\n    try {\n      await workerRoutesApply(\n        env,\n        config,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        api,\n        { imports },\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      throw new Error(`worker routes apply failed after deploy: ${msg}`);\n    }\n  }\n\n  state.finishOperation();\n  await state.persist(api);\n  console.log(`Deploy complete for env: ${env}`);\n  } catch (err) {\n    state.failOperation(err instanceof Error ? err.message : String(err));\n    try {\n      await state.persist(api);\n    } catch {\n      /* swallow secondary persist failure */\n    }\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAqCA,SAAgB,iCACd,SACA,QACA,QACA,KACe;CACf,MAAM,WAAW,6BAA6B,QAAQ,KAAK,OAAO;CAClE,MAAM,kCAAkB,IAAI,KAAqB;AACjD,MAAK,MAAM,CAAC,KAAK,QAAQ,SAAS;EAChC,MAAM,OAAO,0BAA0B,QAAQ,KAAK,KAAK,KAAK,OAAO;AACrE,kBAAgB,IAAI,MAAM,IAAI;;CAGhC,MAAM,QAAQ,IAAI,IAAI,QAAQ;CAC9B,MAAM,0BAAU,IAAI,KAAa;CACjC,MAAM,2BAAW,IAAI,KAAa;CAClC,MAAMA,MAAqB,EAAE;CAE7B,SAAS,MAAM,KAAmB;AAChC,MAAI,QAAQ,IAAI,IAAI,CAAE;AACtB,MAAI,SAAS,IAAI,IAAI,CAAE;AACvB,WAAS,IAAI,IAAI;EACjB,MAAM,MAAM,MAAM,IAAI,IAAI;AAC1B,MAAI,KAAK;GAKP,MAAM,OAJS,gCACb,yBAAyB,KAAK,KAAK,OAAO,OAAO,EACjD,SACD,CACmB,UAAU,KAAK,MAAM,EAAE,QAAQ,IAAI,EAAE;AACzD,QAAK,MAAM,OAAO,MAAM;IACtB,MAAM,SAAS,gBAAgB,IAAI,IAAI;AACvC,QAAI,UAAU,WAAW,IAAK,OAAM,OAAO;;AAE7C,YAAS,OAAO,IAAI;AACpB,WAAQ,IAAI,IAAI;AAChB,OAAI,KAAK,CAAC,KAAK,IAAI,CAAC;;;AAIxB,MAAK,MAAM,CAAC,QAAQ,QAAS,OAAM,IAAI;AACvC,QAAO;;AAGT,eAAsB,UAAU,SAMd;CAChB,MAAM,eAAe,QAAQ;CAK7B,MAAM,MAAM,QAAQ;AACpB,KAAI,CAAC,IACH,OAAM,IAAI,MACR,8GAED;CAEH,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;AAGH,SAAQ,IAAI,0BAA0B,IAAI,KAAK;AAC/C,OAAM,QAAQ;EAAE;EAAK;EAAY,CAAC;CAElC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;AACzD,OAAM,eAAe,UAAU,eAAe,UAAU,iBAAiB,OAAU;AAEnF,KAAI;EAEJ,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;EACjD,MAAM,WAAW,eACb,QAAQ,QAAQ,CAAC,OAAO,MAAM,aAAa,GAC3C;AAEJ,MAAI,SAAS,WAAW,EACtB,OAAM,IAAI,MACR,eACI,WAAW,aAAa,eACxB,wBACL;EAGH,MAAM,UAAU,iCACd,UACA,QACA,QACA,IACD;AAED,QAAM,oCAAoC;GACxC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACD,CAAC;EAEF,IAAIC,gBAEO;AAEX,OAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;GAC/C,MAAM,mBAAmB,yBACvB,cACA,KACA,OAAO,OACR;GACD,MAAM,kBAAkB,yBAAyB,iBAAiB;AAElE,OAAI,gBAAgB,SAAS,KAAK,QAAQ,SAAS;AACjD,QAAI,CAAC,cACH,iBAAgB,MAAM,6BAA6B,KAAK,IAAI;AAS9D,UAAM,qBAAqB;KACzB;KACA,cATmB,0BACnB,QACA,WACA,cACA,KACA,OACD;KAIC,UAAU;KACV,OAAO,cAAc;KACrB;KACA;KACA,WAAW,cAAc;KAC1B,CAAC;;GAGJ,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;GACD,MAAM,iBAAiB,uBAAuB,UAAU,OAAO,OAAO;AACtE,qBAAkB,SAAS,WAAW,gBAAgB,SAAS,gBAAgB;GAE/E,MAAM,cAAc,iBAAiB;AACrC,OAAI,aAAa;AACf,YAAQ,IAAI,YAAY,UAAU,IAAI,YAAY,QAAQ,MAAM;IAChE,MAAMC,WAAmC,EAAE;AAC3C,QAAI,eAAe,KACjB,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,eAAe,KAAK,CACtD,UAAS,KAAK,OAAO,MAAM,WAAW,IAAI,OAAO,EAAE;IAGvD,MAAM,cAAc,eAAe,YAAY,SAAS;KACtD,KAAK,SAAS;KACd,OAAO;KACP,KAAK;KACN,CAAC;AACF,QAAI,YAAY,WAAW,EACzB,OAAM,IAAI,MACR,oBAAoB,UAAU,SAAS,YAAY,OAAO,GAC3D;AAEH,YAAQ,IAAI,SAAS,YAAY;;AAYnC,OAJoB,kBALF;IAChB;IACA,GAAG,sBAAsB,SAAS,gBAAgB;IAClD;IACD,EACgD;IAC/C,KAAK,SAAS;IACd,OAAO;IACR,CAAC,CACc,WAAW,EACzB,OAAM,IAAI,MAAM,6BAA6B,YAAY;GAG3D,MAAM,aACJ,SAAS,qBAAqB,QAAQ;GACxC,MAAM,aAAa;IACjB;IACA,GAAG,sBAAsB,SAAS,gBAAgB;IAClD;IACD;AACD,OAAI,WACF,YAAW,KAAK,wBAAwB,WAAW;AAOrD,OAJqB,kBAAkB,YAAY;IACjD,KAAK,SAAS;IACd,OAAO;IACR,CAAC,CACe,WAAW,EAC1B,OAAM,IAAI,MAAM,8BAA8B,YAAY;AAE5D,WAAQ,IAAI,YAAY,YAAY;;AAGtC,MAAI,QAAQ,QACV,KAAI;AACF,SAAM,kBACJ,KACA,QACA,SACA,WACA,QACA,OACA,KACA,EAAE,SAAS,CACZ;WACM,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,SAAM,IAAI,MAAM,4CAA4C,MAAM;;AAItE,QAAM,iBAAiB;AACvB,QAAM,MAAM,QAAQ,IAAI;AACxB,UAAQ,IAAI,4BAA4B,MAAM;UACrC,KAAK;AACZ,QAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,MAAI;AACF,SAAM,MAAM,QAAQ,IAAI;UAClB;AAGR,QAAM"}

package/dist/{destroy-DPSuQg9v.mjs → destroy-C0cKkpWe.mjs}

@@ -8,7 +8,7 @@ import { runSync } from "./sync-YKZ5HD8v.mjs";
 import { i as hashCloudflareSnapshot, t as buildCloudflareSnapshot } from "./cloudflareSnapshot-CMbPQIsN.mjs";
 import { t as verifyPlanFile } from "./verifyPlanFile-BBAwWzUo.mjs";
 import { t as destroyTamerArtifactsBucket } from "./tamerArtifactsR2-Ba29OVp9.mjs";
-import { n as workersDestroy } from "./workers-DAv1ze8_.mjs";
+import { n as workersDestroy } from "./workers-y9RTOzbC.mjs";
 
 //#region src/features/dispatch-namespace/dispatch-namespace.destroy.ts
 /**
@@ -210,4 +210,4 @@ async function runDestroy(options) {
 
 //#endregion
 export { runDestroy };
-//# sourceMappingURL=destroy-DPSuQg9v.mjs.map
+//# sourceMappingURL=destroy-C0cKkpWe.mjs.map

package/dist/{destroy-DPSuQg9v.mjs.map → destroy-C0cKkpWe.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"destroy-DPSuQg9v.mjs","names":[],"sources":["../src/features/dispatch-namespace/dispatch-namespace.destroy.ts","../src/features/dns-records/dns-records.destroy.ts","../src/cli/destroyGuard.ts","../src/cli/commands/destroy.ts"],"sourcesContent":["import type { CfiConfig } from \"../../types.js\";\nimport { getDispatchNamespaces } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { DispatchNamespaceStateEntry } from \"../../types.js\";\nimport { isEphemeralEnv } from \"./dispatch-namespace.resolve.js\";\n\n/**\n * Tear down every dispatch namespace recorded in state.\n *\n * Cloudflare refuses to delete a namespace that still contains scripts, so we\n * enumerate `/dispatch/namespaces/{ns}/scripts` and delete each (with `force`\n * so dependents like service-bind targets don't block the removal). This\n * covers tenant scripts uploaded by `tamer wfp put` / `provision-workflow`\n * that aren't otherwise tracked in Tamer state.\n */\nexport async function dispatchNamespaceDestroy(\n  env: string,\n  state: StateManager,\n  api: CFApiClient,\n  config: CfiConfig,\n  _force?: boolean,\n): Promise<void> {\n  const allowedLogical = new Set(\n    getDispatchNamespaces(config).map((d) => d.logicalName),\n  );\n  if (allowedLogical.size === 0) return;\n\n  for (const [key, entry] of Object.entries(state.getAll())) {\n    if (entry.type !== \"dispatch_namespace\") continue;\n    const ns = entry as DispatchNamespaceStateEntry;\n    if (!allowedLogical.has(ns.logicalName)) continue;\n    const isSharedEphemeral = ns.derivedName.endsWith(\"-ephemeral\");\n    try {\n      const scripts = await api.dispatchNamespaceScriptList(ns.derivedName);\n      for (const s of scripts) {\n        if (isEphemeralEnv(env, config.tenant) && isSharedEphemeral) {\n          if (!s.id.endsWith(`-${env}`)) continue;\n        }\n        try {\n          await api.dispatchNamespaceScriptDelete(ns.derivedName, s.id, {\n            force: true,\n          });\n          console.log(\n            `Deleted tenant script \"${s.id}\" from namespace ${ns.derivedName}.`,\n          );\n        } catch (err) {\n          console.warn(\n            `Failed to delete tenant script ${s.id} in ${ns.derivedName}:`,\n            err instanceof Error ? err.message : err,\n          );\n        }\n      }\n      if (isEphemeralEnv(env, config.tenant) && isSharedEphemeral) {\n        console.log(\n          `Left shared dispatch namespace ${ns.derivedName} (removed only scripts suffixed -${env}).`,\n        );\n        continue;\n      }\n      await api.dispatchNamespaceDelete(ns.derivedName);\n      state.delete(key);\n    } catch (err) {\n      console.warn(\n        `Failed to delete dispatch namespace ${ns.derivedName}:`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n  }\n}\n","import type { CfiConfig, DnsRecordStateEntry } from \"../../types.js\";\nimport { getDnsRecords } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\n\n/**\n * Tear down every DNS record this stack owns. Restricted to records\n * whose `logicalName` is declared in the current `CfiConfig.dnsRecords`\n * (matches `runDestroy` semantics for shared state rows). Records flagged\n * `preserveOnDestroy: true` are left in place but still dropped from\n * state — the operator is responsible for re-importing them later.\n */\nexport async function dnsRecordDestroy(\n  env: string,\n  state: StateManager,\n  api: CFApiClient,\n  config: CfiConfig,\n  _force?: boolean,\n): Promise<void> {\n  if (env === \"local\") return;\n  const declared = getDnsRecords(config);\n  if (declared.length === 0) return;\n  const preserve = new Map<string, boolean>(\n    declared.map((c) => [c.logicalName, !!c.preserveOnDestroy]),\n  );\n  const allowedLogical = new Set(declared.map((c) => c.logicalName));\n\n  for (const [key, entry] of Object.entries(state.getAll())) {\n    if (entry.type !== \"dns_record\") continue;\n    const rec = entry as DnsRecordStateEntry;\n    if (!allowedLogical.has(rec.logicalName)) continue;\n    if (preserve.get(rec.logicalName)) {\n      console.log(\n        `Preserved DNS record ${rec.recordType} ${rec.name} (preserveOnDestroy).`,\n      );\n      state.delete(key);\n      continue;\n    }\n    try {\n      await api.zoneDnsRecordDelete(rec.zoneId, rec.recordId);\n      state.delete(key);\n    } catch (err) {\n      console.warn(\n        `Failed to delete DNS record ${rec.recordType} ${rec.name}:`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n  }\n}\n","/** Shared envs where destroy must be confirmed with `--confirm-env <same>`. */\nexport const SHARED_ENV_DESTROY = [\n  \"dev\",\n  \"staging\",\n  \"prod\",\n  \"production\",\n] as const;\n\n/**\n * @param force When true, skips the typed confirmation (break-glass).\n */\nexport function assertDestroyEnvAllowed(\n  env: string,\n  force: boolean,\n  confirmEnv?: string,\n): void {\n  if (force) return;\n  if (!SHARED_ENV_DESTROY.includes(env as (typeof SHARED_ENV_DESTROY)[number])) {\n    return;\n  }\n  if (confirmEnv !== env) {\n    throw new Error(\n      `Destroying shared environment \"${env}\" requires --confirm-env ${env}`,\n    );\n  }\n}\n","import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { logicalNamesForResourceKind } from \"../../core/config/resourcesFromConfig.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { destroyTamerStateDatabase } from \"../../core/state/tamerStateDb.js\";\nimport { destroyTamerArtifactsBucket } from \"../../core/state/tamerArtifactsR2.js\";\nimport { getDispatchNamespaces, getDnsRecords } from \"../../types.js\";\nimport { logpushJobDestroy } from \"../../features/logpush-job/index.js\";\nimport { assertDestroyEnvAllowed } from \"../destroyGuard.js\";\nimport { dispatchNamespaceDestroy } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordDestroy } from \"../../features/dns-records/index.js\";\nimport { workersDestroy } from \"../../features/workers/index.js\";\nimport { workerRoutesDestroy } from \"../../features/worker-route/index.js\";\nimport { runSync } from \"./sync.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { verifyPlanFile } from \"../../core/plan/verifyPlanFile.js\";\nimport { hashCloudflareSnapshot } from \"../../core/plan/planFile.js\";\nimport { buildCloudflareSnapshot } from \"../../core/plan/cloudflareSnapshot.js\";\n\nexport async function runDestroy(options: {\n  env: string;\n  force?: boolean;\n  skipWorkers?: boolean;\n  confirmEnv?: string;\n  configPath?: string;\n  /** When true, delete the shared `tamer-state-{env}` D1 after other resources (use on last stack teardown). */\n  wipeMetadata?: boolean;\n  /**\n   * Path to a destroy plan file from `tamer plan --destroy --out`. Destroy\n   * recomputes the `(config, state, cloudflare)` attestation hashes and\n   * refuses to proceed if any drifted (override with `allowStale`). The\n   * pinned plan ensures the operator destroys exactly what they reviewed.\n   */\n  planFile?: string;\n  allowStale?: boolean;\n}): Promise<void> {\n  const {\n    env,\n    force = false,\n    skipWorkers = false,\n    confirmEnv,\n    configPath,\n    wipeMetadata = false,\n  } = options;\n  const baseDir = process.cwd();\n\n  assertDestroyEnvAllowed(env, force, confirmEnv);\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  if (options.planFile) {\n    const verifyApi = new CFApiClient(accountId);\n    const verifyState = new StateManager(\n      config.tenant.id,\n      env,\n      stackNameForConfig(config),\n    );\n    await verifyState.hydrate(verifyApi);\n    const liveSnapshot =\n      env === \"local\"\n        ? undefined\n        : await buildCloudflareSnapshot({\n            config,\n            env,\n            api: verifyApi,\n            baseDir,\n          });\n    verifyPlanFile({\n      planPath: options.planFile,\n      command: \"destroy\",\n      expectedMode: \"destroy\",\n      env,\n      tenantId: config.tenant.id,\n      config,\n      stateAtPlanCheck: verifyState.load(),\n      liveCloudflareHash: liveSnapshot\n        ? hashCloudflareSnapshot(liveSnapshot)\n        : undefined,\n      allowStale: !!options.allowStale,\n    });\n  }\n\n  if (env !== \"local\") {\n    console.log(`Syncing state from Cloudflare for env: ${env}...`);\n    await runSync({ env, configPath });\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  state.beginOperation(\"destroy\", wipeMetadata ? \"wipe-metadata\" : undefined);\n  try {\n    await state.persist(api);\n  } catch {\n    /* in-progress marker best-effort */\n  }\n\n  try {\n    if (!skipWorkers) {\n      await workerRoutesDestroy(env, config, baseDir, state, api);\n      await state.persist(api);\n      await workersDestroy(env, baseDir, accountId, config, state, api, force);\n    }\n\n    const ownedByKind = await Promise.all(\n      resourceModules.map((m) =>\n        logicalNamesForResourceKind(config, baseDir, m.kind).then((set) => ({\n          mod: m,\n          owned: set,\n        })),\n      ),\n    );\n    const workers = await getWorkers(config, baseDir);\n\n    // Always run Logpush + Pipelines teardown: state may still hold\n    // `logpush_pipelines` even if logpush was removed from tamer.config.ts,\n    // and destroy must still delete the Pipelines stream/sink in that case.\n    await logpushJobDestroy(env, state, api, config);\n    await state.persist(api);\n\n    for (const { mod, owned } of ownedByKind) {\n      if (owned.size === 0) continue;\n      // Aggregate this kind's resources across all workers in the config — the\n      // destroy hook only needs them for stack-scope filtering and may walk\n      // state directly. Empty array is acceptable when state holds entries\n      // owned by another stack we still want to filter against `owned`.\n      const resources = workers.flatMap(([, wc]) => mod.pickResources(wc));\n      await mod.destroy({\n        resources,\n        tenant: config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n        force,\n      });\n    }\n\n    if (getDispatchNamespaces(config).length > 0) {\n      await dispatchNamespaceDestroy(env, state, api, config, force);\n    }\n\n    if (getDnsRecords(config).length > 0) {\n      await dnsRecordDestroy(env, state, api, config, force);\n    }\n\n    // Clear `stackOutputs` after every successful destroy — the values\n    // pointed at resources we just deleted, so leaving them in state would\n    // mislead a future `tamer status` and (post-imports) leak dangling\n    // refs into sibling stacks. The state row itself is dropped further\n    // below when `wipeMetadata` is set.\n    state.replaceStackOutputs({});\n\n    if (env !== \"local\" && wipeMetadata) {\n      const deletedDb = await destroyTamerStateDatabase(api, env);\n      if (deletedDb) {\n        console.log(`Deleted Tamer metadata database tamer-state-${env}.`);\n      }\n      try {\n        const deletedBucket = await destroyTamerArtifactsBucket(api, env);\n        if (deletedBucket) {\n          console.log(\n            `Deleted Tamer artifacts bucket tamer-artifacts-${env}.`,\n          );\n        }\n      } catch (err) {\n        console.warn(\n          `Failed to delete Tamer artifacts bucket tamer-artifacts-${env} (likely non-empty; remove objects and re-run with --wipe-metadata):`,\n          err instanceof Error ? err.message : err,\n        );\n      }\n    }\n\n    if (env !== \"local\" && !wipeMetadata) {\n      state.finishOperation();\n      try {\n        await state.persist(api);\n      } catch {\n        /* state row may have been wiped by sub-steps */\n      }\n    }\n    state.clearDirty();\n    console.log(`Destroyed all resources for env: ${env}`);\n  } catch (err) {\n    if (env !== \"local\") {\n      state.failOperation(err instanceof Error ? err.message : String(err));\n      try {\n        await state.persist(api);\n      } catch {\n        /* swallow secondary persist failure */\n      }\n    }\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgBA,eAAsB,yBACpB,KACA,OACA,KACA,QACA,QACe;CACf,MAAM,iBAAiB,IAAI,IACzB,sBAAsB,OAAO,CAAC,KAAK,MAAM,EAAE,YAAY,CACxD;AACD,KAAI,eAAe,SAAS,EAAG;AAE/B,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACzD,MAAI,MAAM,SAAS,qBAAsB;EACzC,MAAM,KAAK;AACX,MAAI,CAAC,eAAe,IAAI,GAAG,YAAY,CAAE;EACzC,MAAM,oBAAoB,GAAG,YAAY,SAAS,aAAa;AAC/D,MAAI;GACF,MAAM,UAAU,MAAM,IAAI,4BAA4B,GAAG,YAAY;AACrE,QAAK,MAAM,KAAK,SAAS;AACvB,QAAI,eAAe,KAAK,OAAO,OAAO,IAAI,mBACxC;SAAI,CAAC,EAAE,GAAG,SAAS,IAAI,MAAM,CAAE;;AAEjC,QAAI;AACF,WAAM,IAAI,8BAA8B,GAAG,aAAa,EAAE,IAAI,EAC5D,OAAO,MACR,CAAC;AACF,aAAQ,IACN,0BAA0B,EAAE,GAAG,mBAAmB,GAAG,YAAY,GAClE;aACM,KAAK;AACZ,aAAQ,KACN,kCAAkC,EAAE,GAAG,MAAM,GAAG,YAAY,IAC5D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;AAGL,OAAI,eAAe,KAAK,OAAO,OAAO,IAAI,mBAAmB;AAC3D,YAAQ,IACN,kCAAkC,GAAG,YAAY,mCAAmC,IAAI,IACzF;AACD;;AAEF,SAAM,IAAI,wBAAwB,GAAG,YAAY;AACjD,SAAM,OAAO,IAAI;WACV,KAAK;AACZ,WAAQ,KACN,uCAAuC,GAAG,YAAY,IACtD,eAAe,QAAQ,IAAI,UAAU,IACtC;;;;;;;;;;;;;;ACrDP,eAAsB,iBACpB,KACA,OACA,KACA,QACA,QACe;AACf,KAAI,QAAQ,QAAS;CACrB,MAAM,WAAW,cAAc,OAAO;AACtC,KAAI,SAAS,WAAW,EAAG;CAC3B,MAAM,WAAW,IAAI,IACnB,SAAS,KAAK,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAC5D;CACD,MAAM,iBAAiB,IAAI,IAAI,SAAS,KAAK,MAAM,EAAE,YAAY,CAAC;AAElE,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACzD,MAAI,MAAM,SAAS,aAAc;EACjC,MAAM,MAAM;AACZ,MAAI,CAAC,eAAe,IAAI,IAAI,YAAY,CAAE;AAC1C,MAAI,SAAS,IAAI,IAAI,YAAY,EAAE;AACjC,WAAQ,IACN,wBAAwB,IAAI,WAAW,GAAG,IAAI,KAAK,uBACpD;AACD,SAAM,OAAO,IAAI;AACjB;;AAEF,MAAI;AACF,SAAM,IAAI,oBAAoB,IAAI,QAAQ,IAAI,SAAS;AACvD,SAAM,OAAO,IAAI;WACV,KAAK;AACZ,WAAQ,KACN,+BAA+B,IAAI,WAAW,GAAG,IAAI,KAAK,IAC1D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;;;;;;AC5CP,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACD;;;;AAKD,SAAgB,wBACd,KACA,OACA,YACM;AACN,KAAI,MAAO;AACX,KAAI,CAAC,mBAAmB,SAAS,IAA2C,CAC1E;AAEF,KAAI,eAAe,IACjB,OAAM,IAAI,MACR,kCAAkC,IAAI,2BAA2B,MAClE;;;;;ACDL,eAAsB,WAAW,SAgBf;CAChB,MAAM,EACJ,KACA,QAAQ,OACR,cAAc,OACd,YACA,YACA,eAAe,UACb;CACJ,MAAM,UAAU,QAAQ,KAAK;AAE7B,yBAAwB,KAAK,OAAO,WAAW;CAE/C,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;AAGH,KAAI,QAAQ,UAAU;EACpB,MAAM,YAAY,IAAI,YAAY,UAAU;EAC5C,MAAM,cAAc,IAAI,aACtB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,QAAM,YAAY,QAAQ,UAAU;EACpC,MAAM,eACJ,QAAQ,UACJ,SACA,MAAM,wBAAwB;GAC5B;GACA;GACA,KAAK;GACL;GACD,CAAC;AACR,iBAAe;GACb,UAAU,QAAQ;GAClB,SAAS;GACT,cAAc;GACd;GACA,UAAU,OAAO,OAAO;GACxB;GACA,kBAAkB,YAAY,MAAM;GACpC,oBAAoB,eAChB,uBAAuB,aAAa,GACpC;GACJ,YAAY,CAAC,CAAC,QAAQ;GACvB,CAAC;;AAGJ,KAAI,QAAQ,SAAS;AACnB,UAAQ,IAAI,0CAA0C,IAAI,KAAK;AAC/D,QAAM,QAAQ;GAAE;GAAK;GAAY,CAAC;;CAGpC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;AACxB,OAAM,eAAe,WAAW,eAAe,kBAAkB,OAAU;AAC3E,KAAI;AACF,QAAM,MAAM,QAAQ,IAAI;SAClB;AAIR,KAAI;AACF,MAAI,CAAC,aAAa;AAChB,SAAM,oBAAoB,KAAK,QAAQ,SAAS,OAAO,IAAI;AAC3D,SAAM,MAAM,QAAQ,IAAI;AACxB,SAAM,eAAe,KAAK,SAAS,WAAW,QAAQ,OAAO,KAAK,MAAM;;EAG1E,MAAM,cAAc,MAAM,QAAQ,IAChC,gBAAgB,KAAK,MACnB,4BAA4B,QAAQ,SAAS,EAAE,KAAK,CAAC,MAAM,SAAS;GAClE,KAAK;GACL,OAAO;GACR,EAAE,CACJ,CACF;EACD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AAKjD,QAAM,kBAAkB,KAAK,OAAO,KAAK,OAAO;AAChD,QAAM,MAAM,QAAQ,IAAI;AAExB,OAAK,MAAM,EAAE,KAAK,WAAW,aAAa;AACxC,OAAI,MAAM,SAAS,EAAG;GAKtB,MAAM,YAAY,QAAQ,SAAS,GAAG,QAAQ,IAAI,cAAc,GAAG,CAAC;AACpE,SAAM,IAAI,QAAQ;IAChB;IACA,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;;AAGJ,MAAI,sBAAsB,OAAO,CAAC,SAAS,EACzC,OAAM,yBAAyB,KAAK,OAAO,KAAK,QAAQ,MAAM;AAGhE,MAAI,cAAc,OAAO,CAAC,SAAS,EACjC,OAAM,iBAAiB,KAAK,OAAO,KAAK,QAAQ,MAAM;AAQxD,QAAM,oBAAoB,EAAE,CAAC;AAE7B,MAAI,QAAQ,WAAW,cAAc;AAEnC,OADkB,MAAM,0BAA0B,KAAK,IAAI,CAEzD,SAAQ,IAAI,+CAA+C,IAAI,GAAG;AAEpE,OAAI;AAEF,QADsB,MAAM,4BAA4B,KAAK,IAAI,CAE/D,SAAQ,IACN,kDAAkD,IAAI,GACvD;YAEI,KAAK;AACZ,YAAQ,KACN,2DAA2D,IAAI,uEAC/D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;AAIL,MAAI,QAAQ,WAAW,CAAC,cAAc;AACpC,SAAM,iBAAiB;AACvB,OAAI;AACF,UAAM,MAAM,QAAQ,IAAI;WAClB;;AAIV,QAAM,YAAY;AAClB,UAAQ,IAAI,oCAAoC,MAAM;UAC/C,KAAK;AACZ,MAAI,QAAQ,SAAS;AACnB,SAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,OAAI;AACF,UAAM,MAAM,QAAQ,IAAI;WAClB;;AAIV,QAAM"}
+{"version":3,"file":"destroy-C0cKkpWe.mjs","names":[],"sources":["../src/features/dispatch-namespace/dispatch-namespace.destroy.ts","../src/features/dns-records/dns-records.destroy.ts","../src/cli/destroyGuard.ts","../src/cli/commands/destroy.ts"],"sourcesContent":["import type { CfiConfig } from \"../../types.js\";\nimport { getDispatchNamespaces } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { DispatchNamespaceStateEntry } from \"../../types.js\";\nimport { isEphemeralEnv } from \"./dispatch-namespace.resolve.js\";\n\n/**\n * Tear down every dispatch namespace recorded in state.\n *\n * Cloudflare refuses to delete a namespace that still contains scripts, so we\n * enumerate `/dispatch/namespaces/{ns}/scripts` and delete each (with `force`\n * so dependents like service-bind targets don't block the removal). This\n * covers tenant scripts uploaded by `tamer wfp put` / `provision-workflow`\n * that aren't otherwise tracked in Tamer state.\n */\nexport async function dispatchNamespaceDestroy(\n  env: string,\n  state: StateManager,\n  api: CFApiClient,\n  config: CfiConfig,\n  _force?: boolean,\n): Promise<void> {\n  const allowedLogical = new Set(\n    getDispatchNamespaces(config).map((d) => d.logicalName),\n  );\n  if (allowedLogical.size === 0) return;\n\n  for (const [key, entry] of Object.entries(state.getAll())) {\n    if (entry.type !== \"dispatch_namespace\") continue;\n    const ns = entry as DispatchNamespaceStateEntry;\n    if (!allowedLogical.has(ns.logicalName)) continue;\n    const isSharedEphemeral = ns.derivedName.endsWith(\"-ephemeral\");\n    try {\n      const scripts = await api.dispatchNamespaceScriptList(ns.derivedName);\n      for (const s of scripts) {\n        if (isEphemeralEnv(env, config.tenant) && isSharedEphemeral) {\n          if (!s.id.endsWith(`-${env}`)) continue;\n        }\n        try {\n          await api.dispatchNamespaceScriptDelete(ns.derivedName, s.id, {\n            force: true,\n          });\n          console.log(\n            `Deleted tenant script \"${s.id}\" from namespace ${ns.derivedName}.`,\n          );\n        } catch (err) {\n          console.warn(\n            `Failed to delete tenant script ${s.id} in ${ns.derivedName}:`,\n            err instanceof Error ? err.message : err,\n          );\n        }\n      }\n      if (isEphemeralEnv(env, config.tenant) && isSharedEphemeral) {\n        console.log(\n          `Left shared dispatch namespace ${ns.derivedName} (removed only scripts suffixed -${env}).`,\n        );\n        continue;\n      }\n      await api.dispatchNamespaceDelete(ns.derivedName);\n      state.delete(key);\n    } catch (err) {\n      console.warn(\n        `Failed to delete dispatch namespace ${ns.derivedName}:`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n  }\n}\n","import type { CfiConfig, DnsRecordStateEntry } from \"../../types.js\";\nimport { getDnsRecords } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\n\n/**\n * Tear down every DNS record this stack owns. Restricted to records\n * whose `logicalName` is declared in the current `CfiConfig.dnsRecords`\n * (matches `runDestroy` semantics for shared state rows). Records flagged\n * `preserveOnDestroy: true` are left in place but still dropped from\n * state — the operator is responsible for re-importing them later.\n */\nexport async function dnsRecordDestroy(\n  env: string,\n  state: StateManager,\n  api: CFApiClient,\n  config: CfiConfig,\n  _force?: boolean,\n): Promise<void> {\n  if (env === \"local\") return;\n  const declared = getDnsRecords(config);\n  if (declared.length === 0) return;\n  const preserve = new Map<string, boolean>(\n    declared.map((c) => [c.logicalName, !!c.preserveOnDestroy]),\n  );\n  const allowedLogical = new Set(declared.map((c) => c.logicalName));\n\n  for (const [key, entry] of Object.entries(state.getAll())) {\n    if (entry.type !== \"dns_record\") continue;\n    const rec = entry as DnsRecordStateEntry;\n    if (!allowedLogical.has(rec.logicalName)) continue;\n    if (preserve.get(rec.logicalName)) {\n      console.log(\n        `Preserved DNS record ${rec.recordType} ${rec.name} (preserveOnDestroy).`,\n      );\n      state.delete(key);\n      continue;\n    }\n    try {\n      await api.zoneDnsRecordDelete(rec.zoneId, rec.recordId);\n      state.delete(key);\n    } catch (err) {\n      console.warn(\n        `Failed to delete DNS record ${rec.recordType} ${rec.name}:`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n  }\n}\n","/** Shared envs where destroy must be confirmed with `--confirm-env <same>`. */\nexport const SHARED_ENV_DESTROY = [\n  \"dev\",\n  \"staging\",\n  \"prod\",\n  \"production\",\n] as const;\n\n/**\n * @param force When true, skips the typed confirmation (break-glass).\n */\nexport function assertDestroyEnvAllowed(\n  env: string,\n  force: boolean,\n  confirmEnv?: string,\n): void {\n  if (force) return;\n  if (!SHARED_ENV_DESTROY.includes(env as (typeof SHARED_ENV_DESTROY)[number])) {\n    return;\n  }\n  if (confirmEnv !== env) {\n    throw new Error(\n      `Destroying shared environment \"${env}\" requires --confirm-env ${env}`,\n    );\n  }\n}\n","import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { logicalNamesForResourceKind } from \"../../core/config/resourcesFromConfig.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { destroyTamerStateDatabase } from \"../../core/state/tamerStateDb.js\";\nimport { destroyTamerArtifactsBucket } from \"../../core/state/tamerArtifactsR2.js\";\nimport { getDispatchNamespaces, getDnsRecords } from \"../../types.js\";\nimport { logpushJobDestroy } from \"../../features/logpush-job/index.js\";\nimport { assertDestroyEnvAllowed } from \"../destroyGuard.js\";\nimport { dispatchNamespaceDestroy } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordDestroy } from \"../../features/dns-records/index.js\";\nimport { workersDestroy } from \"../../features/workers/index.js\";\nimport { workerRoutesDestroy } from \"../../features/worker-route/index.js\";\nimport { runSync } from \"./sync.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { verifyPlanFile } from \"../../core/plan/verifyPlanFile.js\";\nimport { hashCloudflareSnapshot } from \"../../core/plan/planFile.js\";\nimport { buildCloudflareSnapshot } from \"../../core/plan/cloudflareSnapshot.js\";\n\nexport async function runDestroy(options: {\n  env: string;\n  force?: boolean;\n  skipWorkers?: boolean;\n  confirmEnv?: string;\n  configPath?: string;\n  /** When true, delete the shared `tamer-state-{env}` D1 after other resources (use on last stack teardown). */\n  wipeMetadata?: boolean;\n  /**\n   * Path to a destroy plan file from `tamer plan --destroy --out`. Destroy\n   * recomputes the `(config, state, cloudflare)` attestation hashes and\n   * refuses to proceed if any drifted (override with `allowStale`). The\n   * pinned plan ensures the operator destroys exactly what they reviewed.\n   */\n  planFile?: string;\n  allowStale?: boolean;\n}): Promise<void> {\n  const {\n    env,\n    force = false,\n    skipWorkers = false,\n    confirmEnv,\n    configPath,\n    wipeMetadata = false,\n  } = options;\n  const baseDir = process.cwd();\n\n  assertDestroyEnvAllowed(env, force, confirmEnv);\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  if (options.planFile) {\n    const verifyApi = new CFApiClient(accountId);\n    const verifyState = new StateManager(\n      config.tenant.id,\n      env,\n      stackNameForConfig(config),\n    );\n    await verifyState.hydrate(verifyApi);\n    const liveSnapshot =\n      env === \"local\"\n        ? undefined\n        : await buildCloudflareSnapshot({\n            config,\n            env,\n            api: verifyApi,\n            baseDir,\n          });\n    verifyPlanFile({\n      planPath: options.planFile,\n      command: \"destroy\",\n      expectedMode: \"destroy\",\n      env,\n      tenantId: config.tenant.id,\n      config,\n      stateAtPlanCheck: verifyState.load(),\n      liveCloudflareHash: liveSnapshot\n        ? hashCloudflareSnapshot(liveSnapshot)\n        : undefined,\n      allowStale: !!options.allowStale,\n    });\n  }\n\n  if (env !== \"local\") {\n    console.log(`Syncing state from Cloudflare for env: ${env}...`);\n    await runSync({ env, configPath });\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  state.beginOperation(\"destroy\", wipeMetadata ? \"wipe-metadata\" : undefined);\n  try {\n    await state.persist(api);\n  } catch {\n    /* in-progress marker best-effort */\n  }\n\n  try {\n    if (!skipWorkers) {\n      await workerRoutesDestroy(env, config, baseDir, state, api);\n      await state.persist(api);\n      await workersDestroy(env, baseDir, accountId, config, state, api, force);\n    }\n\n    const ownedByKind = await Promise.all(\n      resourceModules.map((m) =>\n        logicalNamesForResourceKind(config, baseDir, m.kind).then((set) => ({\n          mod: m,\n          owned: set,\n        })),\n      ),\n    );\n    const workers = await getWorkers(config, baseDir);\n\n    // Always run Logpush + Pipelines teardown: state may still hold\n    // `logpush_pipelines` even if logpush was removed from tamer.config.ts,\n    // and destroy must still delete the Pipelines stream/sink in that case.\n    await logpushJobDestroy(env, state, api, config);\n    await state.persist(api);\n\n    for (const { mod, owned } of ownedByKind) {\n      if (owned.size === 0) continue;\n      // Aggregate this kind's resources across all workers in the config — the\n      // destroy hook only needs them for stack-scope filtering and may walk\n      // state directly. Empty array is acceptable when state holds entries\n      // owned by another stack we still want to filter against `owned`.\n      const resources = workers.flatMap(([, wc]) => mod.pickResources(wc));\n      await mod.destroy({\n        resources,\n        tenant: config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n        force,\n      });\n    }\n\n    if (getDispatchNamespaces(config).length > 0) {\n      await dispatchNamespaceDestroy(env, state, api, config, force);\n    }\n\n    if (getDnsRecords(config).length > 0) {\n      await dnsRecordDestroy(env, state, api, config, force);\n    }\n\n    // Clear `stackOutputs` after every successful destroy — the values\n    // pointed at resources we just deleted, so leaving them in state would\n    // mislead a future `tamer status` and (post-imports) leak dangling\n    // refs into sibling stacks. The state row itself is dropped further\n    // below when `wipeMetadata` is set.\n    state.replaceStackOutputs({});\n\n    if (env !== \"local\" && wipeMetadata) {\n      const deletedDb = await destroyTamerStateDatabase(api, env);\n      if (deletedDb) {\n        console.log(`Deleted Tamer metadata database tamer-state-${env}.`);\n      }\n      try {\n        const deletedBucket = await destroyTamerArtifactsBucket(api, env);\n        if (deletedBucket) {\n          console.log(\n            `Deleted Tamer artifacts bucket tamer-artifacts-${env}.`,\n          );\n        }\n      } catch (err) {\n        console.warn(\n          `Failed to delete Tamer artifacts bucket tamer-artifacts-${env} (likely non-empty; remove objects and re-run with --wipe-metadata):`,\n          err instanceof Error ? err.message : err,\n        );\n      }\n    }\n\n    if (env !== \"local\" && !wipeMetadata) {\n      state.finishOperation();\n      try {\n        await state.persist(api);\n      } catch {\n        /* state row may have been wiped by sub-steps */\n      }\n    }\n    state.clearDirty();\n    console.log(`Destroyed all resources for env: ${env}`);\n  } catch (err) {\n    if (env !== \"local\") {\n      state.failOperation(err instanceof Error ? err.message : String(err));\n      try {\n        await state.persist(api);\n      } catch {\n        /* swallow secondary persist failure */\n      }\n    }\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgBA,eAAsB,yBACpB,KACA,OACA,KACA,QACA,QACe;CACf,MAAM,iBAAiB,IAAI,IACzB,sBAAsB,OAAO,CAAC,KAAK,MAAM,EAAE,YAAY,CACxD;AACD,KAAI,eAAe,SAAS,EAAG;AAE/B,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACzD,MAAI,MAAM,SAAS,qBAAsB;EACzC,MAAM,KAAK;AACX,MAAI,CAAC,eAAe,IAAI,GAAG,YAAY,CAAE;EACzC,MAAM,oBAAoB,GAAG,YAAY,SAAS,aAAa;AAC/D,MAAI;GACF,MAAM,UAAU,MAAM,IAAI,4BAA4B,GAAG,YAAY;AACrE,QAAK,MAAM,KAAK,SAAS;AACvB,QAAI,eAAe,KAAK,OAAO,OAAO,IAAI,mBACxC;SAAI,CAAC,EAAE,GAAG,SAAS,IAAI,MAAM,CAAE;;AAEjC,QAAI;AACF,WAAM,IAAI,8BAA8B,GAAG,aAAa,EAAE,IAAI,EAC5D,OAAO,MACR,CAAC;AACF,aAAQ,IACN,0BAA0B,EAAE,GAAG,mBAAmB,GAAG,YAAY,GAClE;aACM,KAAK;AACZ,aAAQ,KACN,kCAAkC,EAAE,GAAG,MAAM,GAAG,YAAY,IAC5D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;AAGL,OAAI,eAAe,KAAK,OAAO,OAAO,IAAI,mBAAmB;AAC3D,YAAQ,IACN,kCAAkC,GAAG,YAAY,mCAAmC,IAAI,IACzF;AACD;;AAEF,SAAM,IAAI,wBAAwB,GAAG,YAAY;AACjD,SAAM,OAAO,IAAI;WACV,KAAK;AACZ,WAAQ,KACN,uCAAuC,GAAG,YAAY,IACtD,eAAe,QAAQ,IAAI,UAAU,IACtC;;;;;;;;;;;;;;ACrDP,eAAsB,iBACpB,KACA,OACA,KACA,QACA,QACe;AACf,KAAI,QAAQ,QAAS;CACrB,MAAM,WAAW,cAAc,OAAO;AACtC,KAAI,SAAS,WAAW,EAAG;CAC3B,MAAM,WAAW,IAAI,IACnB,SAAS,KAAK,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAC5D;CACD,MAAM,iBAAiB,IAAI,IAAI,SAAS,KAAK,MAAM,EAAE,YAAY,CAAC;AAElE,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACzD,MAAI,MAAM,SAAS,aAAc;EACjC,MAAM,MAAM;AACZ,MAAI,CAAC,eAAe,IAAI,IAAI,YAAY,CAAE;AAC1C,MAAI,SAAS,IAAI,IAAI,YAAY,EAAE;AACjC,WAAQ,IACN,wBAAwB,IAAI,WAAW,GAAG,IAAI,KAAK,uBACpD;AACD,SAAM,OAAO,IAAI;AACjB;;AAEF,MAAI;AACF,SAAM,IAAI,oBAAoB,IAAI,QAAQ,IAAI,SAAS;AACvD,SAAM,OAAO,IAAI;WACV,KAAK;AACZ,WAAQ,KACN,+BAA+B,IAAI,WAAW,GAAG,IAAI,KAAK,IAC1D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;;;;;;AC5CP,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACD;;;;AAKD,SAAgB,wBACd,KACA,OACA,YACM;AACN,KAAI,MAAO;AACX,KAAI,CAAC,mBAAmB,SAAS,IAA2C,CAC1E;AAEF,KAAI,eAAe,IACjB,OAAM,IAAI,MACR,kCAAkC,IAAI,2BAA2B,MAClE;;;;;ACDL,eAAsB,WAAW,SAgBf;CAChB,MAAM,EACJ,KACA,QAAQ,OACR,cAAc,OACd,YACA,YACA,eAAe,UACb;CACJ,MAAM,UAAU,QAAQ,KAAK;AAE7B,yBAAwB,KAAK,OAAO,WAAW;CAE/C,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;AAGH,KAAI,QAAQ,UAAU;EACpB,MAAM,YAAY,IAAI,YAAY,UAAU;EAC5C,MAAM,cAAc,IAAI,aACtB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,QAAM,YAAY,QAAQ,UAAU;EACpC,MAAM,eACJ,QAAQ,UACJ,SACA,MAAM,wBAAwB;GAC5B;GACA;GACA,KAAK;GACL;GACD,CAAC;AACR,iBAAe;GACb,UAAU,QAAQ;GAClB,SAAS;GACT,cAAc;GACd;GACA,UAAU,OAAO,OAAO;GACxB;GACA,kBAAkB,YAAY,MAAM;GACpC,oBAAoB,eAChB,uBAAuB,aAAa,GACpC;GACJ,YAAY,CAAC,CAAC,QAAQ;GACvB,CAAC;;AAGJ,KAAI,QAAQ,SAAS;AACnB,UAAQ,IAAI,0CAA0C,IAAI,KAAK;AAC/D,QAAM,QAAQ;GAAE;GAAK;GAAY,CAAC;;CAGpC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;AACxB,OAAM,eAAe,WAAW,eAAe,kBAAkB,OAAU;AAC3E,KAAI;AACF,QAAM,MAAM,QAAQ,IAAI;SAClB;AAIR,KAAI;AACF,MAAI,CAAC,aAAa;AAChB,SAAM,oBAAoB,KAAK,QAAQ,SAAS,OAAO,IAAI;AAC3D,SAAM,MAAM,QAAQ,IAAI;AACxB,SAAM,eAAe,KAAK,SAAS,WAAW,QAAQ,OAAO,KAAK,MAAM;;EAG1E,MAAM,cAAc,MAAM,QAAQ,IAChC,gBAAgB,KAAK,MACnB,4BAA4B,QAAQ,SAAS,EAAE,KAAK,CAAC,MAAM,SAAS;GAClE,KAAK;GACL,OAAO;GACR,EAAE,CACJ,CACF;EACD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AAKjD,QAAM,kBAAkB,KAAK,OAAO,KAAK,OAAO;AAChD,QAAM,MAAM,QAAQ,IAAI;AAExB,OAAK,MAAM,EAAE,KAAK,WAAW,aAAa;AACxC,OAAI,MAAM,SAAS,EAAG;GAKtB,MAAM,YAAY,QAAQ,SAAS,GAAG,QAAQ,IAAI,cAAc,GAAG,CAAC;AACpE,SAAM,IAAI,QAAQ;IAChB;IACA,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;;AAGJ,MAAI,sBAAsB,OAAO,CAAC,SAAS,EACzC,OAAM,yBAAyB,KAAK,OAAO,KAAK,QAAQ,MAAM;AAGhE,MAAI,cAAc,OAAO,CAAC,SAAS,EACjC,OAAM,iBAAiB,KAAK,OAAO,KAAK,QAAQ,MAAM;AAQxD,QAAM,oBAAoB,EAAE,CAAC;AAE7B,MAAI,QAAQ,WAAW,cAAc;AAEnC,OADkB,MAAM,0BAA0B,KAAK,IAAI,CAEzD,SAAQ,IAAI,+CAA+C,IAAI,GAAG;AAEpE,OAAI;AAEF,QADsB,MAAM,4BAA4B,KAAK,IAAI,CAE/D,SAAQ,IACN,kDAAkD,IAAI,GACvD;YAEI,KAAK;AACZ,YAAQ,KACN,2DAA2D,IAAI,uEAC/D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;AAIL,MAAI,QAAQ,WAAW,CAAC,cAAc;AACpC,SAAM,iBAAiB;AACvB,OAAI;AACF,UAAM,MAAM,QAAQ,IAAI;WAClB;;AAIV,QAAM,YAAY;AAClB,UAAQ,IAAI,oCAAoC,MAAM;UAC/C,KAAK;AACZ,MAAI,QAAQ,SAAS;AACnB,SAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,OAAI;AACF,UAAM,MAAM,QAAQ,IAAI;WAClB;;AAIV,QAAM"}

package/dist/{drift-Bp-P13-B.mjs → drift-B5y9LF5X.mjs}

@@ -4,7 +4,7 @@ import { n as resourceModules } from "./registry-BlHEOKlN.mjs";
 import { n as dnsRecordCommentMarker, r as dnsRecordStateKey, t as dnsRecordAppliesToEnv } from "./dns-records.resolve-DV6XBZf3.mjs";
 import { r as logpushJobDrift } from "./logpush-job-GqVKG_HI.mjs";
 import { t as workerRoutesDrift } from "./worker-route-CqBDvjgo.mjs";
-import { t as workersDrift } from "./workers-DAv1ze8_.mjs";
+import { t as workersDrift } from "./workers-y9RTOzbC.mjs";
 
 //#region src/features/dispatch-namespace/dispatch-namespace.drift.ts
 function dispatchNamespaceDrift(allDispatch, resources, env, tenant, state) {
@@ -348,4 +348,4 @@ async function buildSecretWorkerInputs(workers, config, env, baseDir, accountId,
 
 //#endregion
 export { runDrift as n, computeDriftReport as t };
-//# sourceMappingURL=drift-Bp-P13-B.mjs.map
+//# sourceMappingURL=drift-B5y9LF5X.mjs.map

package/dist/{drift-Bp-P13-B.mjs.map → drift-B5y9LF5X.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"drift-Bp-P13-B.mjs","names":["drift: ResourceDrift","drift: ResourceDrift","drift: ResourceDrift","byZone: DnsRecordsByZone","out: T[]","REGISTRY_LABELS: Record<string, string>","out: Array<{\n    workerKey: string;\n    required: string[];\n    workerSecretNames: string[];\n  }>","workerSecretNames: string[]"],"sources":["../src/features/dispatch-namespace/dispatch-namespace.drift.ts","../src/features/dns-records/dns-records.drift.ts","../src/core/drift/drift.types.ts","../src/core/drift/tenantDrift.ts","../src/cli/commands/drift.ts"],"sourcesContent":["import type {\n  DispatchNamespaceResourceConfig,\n  DispatchNamespaceStateEntry,\n  TenantMeta,\n} from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { ResourceDrift } from \"../../core/drift/drift.types.js\";\nimport { effectiveDispatchNamespaceName } from \"./dispatch-namespace.resolve.js\";\n\ninterface CFDispatchNamespace {\n  namespace_name: string;\n}\n\nexport function dispatchNamespaceDrift(\n  allDispatch: CFDispatchNamespace[],\n  resources: DispatchNamespaceResourceConfig[],\n  env: string,\n  tenant: TenantMeta,\n  state: StateManager,\n): ResourceDrift {\n  const drift: ResourceDrift = {\n    kind: \"dispatch_namespace\",\n    missingFromCloudflare: [],\n    unrecordedInState: [],\n    undeployed: [],\n  };\n\n  const cfNames = new Set(allDispatch.map((d) => d.namespace_name));\n  const allState = state.getAll();\n  const nsState = Object.values(allState).filter(\n    (e): e is DispatchNamespaceStateEntry => e.type === \"dispatch_namespace\",\n  );\n\n  for (const config of resources) {\n    const derivedName = effectiveDispatchNamespaceName(config, env, tenant);\n    const stateEntry = nsState.find(\n      (e) => e.logicalName === config.logicalName && e.derivedName === derivedName,\n    );\n    const onCf = cfNames.has(derivedName);\n\n    if (stateEntry && !onCf) {\n      drift.missingFromCloudflare.push({\n        logicalName: stateEntry.logicalName,\n        derivedName: stateEntry.derivedName,\n      });\n    } else if (onCf && !stateEntry) {\n      drift.unrecordedInState.push({\n        logicalName: config.logicalName,\n        derivedName,\n      });\n    } else if (!onCf && !stateEntry) {\n      drift.undeployed.push({\n        logicalName: config.logicalName,\n        derivedName,\n      });\n    }\n  }\n\n  return drift;\n}\n","import type {\n  DnsRecordResourceConfig,\n  DnsRecordStateEntry,\n  TenantMeta,\n} from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { ResourceDrift } from \"../../core/drift/drift.types.js\";\nimport {\n  dnsRecordAppliesToEnv,\n  dnsRecordCommentMarker,\n  dnsRecordStateKey,\n} from \"./dns-records.resolve.js\";\n\ninterface CFDnsRecord {\n  id: string;\n  type: string;\n  name: string;\n  content: string;\n  ttl?: number;\n  proxied?: boolean;\n  priority?: number;\n  comment?: string | null;\n}\n\n/**\n * Map of `zoneId → live records`. The drift caller pre-fetches because\n * other resource modules also iterate zones (worker routes), so we\n * accept the snapshot rather than refetching here.\n */\nexport type DnsRecordsByZone = Map<string, CFDnsRecord[]>;\n\nexport function dnsRecordDrift(\n  byZone: DnsRecordsByZone,\n  resources: DnsRecordResourceConfig[],\n  tenant: TenantMeta,\n  env: string,\n  state: StateManager,\n): ResourceDrift {\n  const drift: ResourceDrift = {\n    kind: \"dns_record\",\n    missingFromCloudflare: [],\n    unrecordedInState: [],\n    undeployed: [],\n  };\n\n  const stateRecords = Object.values(state.getAll()).filter(\n    (e): e is DnsRecordStateEntry => e.type === \"dns_record\",\n  );\n\n  for (const config of resources) {\n    if (!dnsRecordAppliesToEnv(config, env)) continue;\n    const live = byZone.get(config.zoneId) ?? [];\n    const marker = dnsRecordCommentMarker(tenant, env, config.logicalName);\n    const stateKey = dnsRecordStateKey(config.zoneId, config.type, config.name);\n    const entry = stateRecords.find(\n      (e) =>\n        e.zoneId === config.zoneId &&\n        e.recordType === config.type &&\n        e.logicalName === config.logicalName,\n    );\n    const onCf = entry\n      ? live.find((r) => r.id === entry.recordId)\n      : live.find(\n          (r) =>\n            r.type === config.type &&\n            typeof r.comment === \"string\" &&\n            r.comment.startsWith(marker),\n        );\n\n    if (entry && !onCf) {\n      drift.missingFromCloudflare.push({\n        logicalName: entry.logicalName,\n        derivedName: `${entry.recordType} ${entry.name}`,\n        cfId: entry.recordId,\n      });\n    } else if (onCf && !entry) {\n      drift.unrecordedInState.push({\n        logicalName: config.logicalName,\n        derivedName: `${config.type} ${onCf.name}`,\n        cfId: onCf.id,\n      });\n    } else if (!onCf && !entry) {\n      drift.undeployed.push({\n        logicalName: config.logicalName,\n        derivedName: `${config.type} ${config.name}`,\n        detail: stateKey,\n      });\n    }\n  }\n\n  return drift;\n}\n","/**\n * Read-only drift report comparing recorded state vs. Cloudflare reality vs.\n * the current `tamer.config.ts`.\n */\n\nexport type DriftKind =\n  | \"d1\"\n  | \"r2\"\n  | \"kv\"\n  | \"queue\"\n  | \"hyperdrive\"\n  | \"vectorize\"\n  | \"ai_gateway\"\n  | \"pipeline\"\n  | \"workflow\"\n  | \"secret_store\"\n  | \"secret\"\n  | \"dns_record\"\n  | \"dispatch_namespace\"\n  | \"logpush_job\"\n  | \"tenant\"\n  | \"worker_route\"\n  | \"worker_script\";\n\nexport interface DriftEntry {\n  /** Logical resource name from `tamer.config.ts`. */\n  logicalName: string;\n  /** Cloudflare-side name (or `(unknown)` when no CF or state side knows it). */\n  derivedName: string;\n  /** Cloudflare resource ID, when known (D1 uuid, KV id). */\n  cfId?: string;\n  /** Optional human-readable detail (e.g. shard date). */\n  detail?: string;\n}\n\nexport interface ResourceDrift {\n  kind: DriftKind;\n  /** Tracked in state but no longer present on Cloudflare. */\n  missingFromCloudflare: DriftEntry[];\n  /**\n   * Present on Cloudflare and matches a declared resource in this config,\n   * but no state entry tracks it (e.g. created out-of-band).\n   */\n  unrecordedInState: DriftEntry[];\n  /**\n   * Declared in this stack's config but neither tracked in state nor present\n   * on Cloudflare (run `tamer apply`).\n   */\n  undeployed: DriftEntry[];\n}\n\nexport interface DriftReport {\n  tenantId: string;\n  env: string;\n  generatedAt: string;\n  resources: ResourceDrift[];\n  /** True iff any of the three categories has at least one entry. */\n  hasDrift: boolean;\n}\n\nexport function resourceDriftIsClean(d: ResourceDrift): boolean {\n  return (\n    d.missingFromCloudflare.length === 0 &&\n    d.unrecordedInState.length === 0 &&\n    d.undeployed.length === 0\n  );\n}\n\nexport function reportHasDrift(resources: ResourceDrift[]): boolean {\n  return resources.some((d) => !resourceDriftIsClean(d));\n}\n","import type { CFApiClient } from \"../api/CFApiClient.js\";\nimport type { StateManager } from \"../state/StateManager.js\";\nimport type { ResourceDrift } from \"./drift.types.js\";\nimport { tenantStateKey } from \"../tenant/tenantKeys.js\";\n\ninterface CFD1 {\n  uuid: string;\n  name: string;\n}\n\n/**\n * Drift for workspace tenants in {@link CfiState.tenants}: dispatch script and\n * recorded D1 shards must still exist on Cloudflare.\n *\n * `unrecordedInState` / `undeployed` are intentionally empty here — tenant\n * discovery from CF alone is heuristic until product/script naming is fully\n * pinned (`docs/scope-remaining.md` D-1).\n */\nexport async function tenantDrift(\n  state: StateManager,\n  api: CFApiClient,\n  allD1: CFD1[],\n): Promise<ResourceDrift> {\n  const drift: ResourceDrift = {\n    kind: \"tenant\",\n    missingFromCloudflare: [],\n    unrecordedInState: [],\n    undeployed: [],\n  };\n\n  const d1ById = new Map(allD1.map((d) => [d.uuid, d.name]));\n  const tenants = state\n    .listTenants()\n    .filter((t) => t.provisioningStatus !== \"tombstoned\");\n  if (tenants.length === 0) return drift;\n\n  const scriptLists = new Map<string, Set<string>>();\n  async function scriptsInNs(ns: string): Promise<Set<string>> {\n    let set = scriptLists.get(ns);\n    if (!set) {\n      const list = await api.dispatchNamespaceScriptList(ns);\n      set = new Set(list.map((s) => s.id));\n      scriptLists.set(ns, set);\n    }\n    return set;\n  }\n\n  for (const t of tenants) {\n    const logical = tenantStateKey(t.product, t.workspace);\n    try {\n      const ids = await scriptsInNs(t.dispatchNamespaceName);\n      if (!ids.has(t.scriptName)) {\n        drift.missingFromCloudflare.push({\n          logicalName: logical,\n          derivedName: t.scriptName,\n          detail: \"dispatch_script\",\n        });\n      }\n    } catch {\n      drift.missingFromCloudflare.push({\n        logicalName: logical,\n        derivedName: t.dispatchNamespaceName,\n        detail: \"dispatch_namespace_list_failed\",\n      });\n    }\n\n    for (const shard of t.d1Shards ?? []) {\n      if (!d1ById.has(shard.cfId)) {\n        drift.missingFromCloudflare.push({\n          logicalName: logical,\n          derivedName: shard.derivedName,\n          cfId: shard.cfId,\n          detail: `d1:${shard.role}`,\n        });\n      }\n    }\n  }\n\n  return drift;\n}\n","import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { dispatchNamespaceDrift } from \"../../features/dispatch-namespace/index.js\";\nimport {\n  dnsRecordDrift,\n  type DnsRecordsByZone,\n} from \"../../features/dns-records/index.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobDrift } from \"../../features/logpush-job/index.js\";\nimport type {\n  DriftReport,\n  ResourceDrift,\n} from \"../../core/drift/drift.types.js\";\nimport { reportHasDrift } from \"../../core/drift/drift.types.js\";\nimport { tenantDrift } from \"../../core/drift/tenantDrift.js\";\nimport { workerRoutesDrift } from \"../../features/worker-route/index.js\";\nimport { workersDrift } from \"../../features/workers/index.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\nimport { mergeWorkerConfigForResourcePick } from \"../../core/config/resolver.js\";\nimport { resolveDeployedWorkerName } from \"../../core/config/resolver.js\";\nimport { requiredSecretsForWorker } from \"../../core/secrets/declared.js\";\nimport {\n  reconcileSecrets,\n  secretsDrift,\n  vaultReaderFromMap,\n  type SecretsVaultReader,\n} from \"../../core/secrets/reconcile.js\";\n\n/**\n * Compute a read-only drift report for the given env.\n *\n * Compares Tamer state (D1 `tamer-state-{env}`) against the Cloudflare API\n * and the resources declared in `tamer.config.ts`. Reports three categories:\n *\n * - `missingFromCloudflare` — tracked in state but the CF resource is gone.\n * - `unrecordedInState` — exists on CF and matches a declared resource, but\n *   no state entry tracks it (e.g. created out-of-band; run `tamer sync`).\n * - `undeployed` — declared in this stack's config, present in neither\n *   state nor CF (run `tamer apply`).\n *\n * Pure: never writes to state. Returns the report so callers can choose how to\n * render or consume it.\n */\nexport async function computeDriftReport(options: {\n  env?: string;\n  configPath?: string;\n  /** Optional vault reader for secret reconciliation (defaults to empty). */\n  secretsVault?: SecretsVaultReader;\n}): Promise<DriftReport> {\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  // Tolerant pre-fetch keeps drift accurate when worker `tamerRoutes`\n  // depend on sibling-stack outputs (otherwise the placeholder pattern\n  // would never match anything CF returned).\n  const imports = await fetchStackImports(api, config, env).catch(() => ({}));\n\n  async function safeList<T>(\n    label: string,\n    fn: () => Promise<T[]>,\n  ): Promise<T[]> {\n    try {\n      return await fn();\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[drift] skipping ${label}: ${msg}`);\n      return [];\n    }\n  }\n\n  const lists = await Promise.all(\n    resourceModules.map((m) =>\n      safeList(`${m.label} list`, () => m.fetchAll(api)),\n    ),\n  );\n\n  const allDispatch =\n    getDispatchNamespaces(config).length > 0\n      ? await safeList(\"dispatch namespaces\", () =>\n          api.dispatchNamespaceListAll(),\n        )\n      : [];\n\n  const allLogpushJobs =\n    getLogpushJobs(config).length > 0 && env !== \"local\"\n      ? await safeList(\"logpush jobs\", () => api.logpushAccountJobsList())\n      : [];\n\n  const workers = await getWorkers(config, baseDir);\n\n  const aggregated = new Map<string, ResourceDrift>();\n  function merge(d: ResourceDrift): void {\n    const existing = aggregated.get(d.kind);\n    if (!existing) {\n      aggregated.set(d.kind, d);\n      return;\n    }\n    existing.missingFromCloudflare.push(...d.missingFromCloudflare);\n    existing.unrecordedInState.push(...d.unrecordedInState);\n    existing.undeployed.push(...d.undeployed);\n  }\n\n  for (const [workerKey, workerConfig] of workers) {\n    const mergedWorker = mergeWorkerConfigForResourcePick(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports },\n    );\n    resourceModules.forEach((mod, i) => {\n      const resources = mod.pickResources(mergedWorker);\n      if (resources.length === 0) return;\n      merge(\n        mod.drift({\n          resources,\n          all: lists[i],\n          tenant: config.tenant,\n          env,\n          api,\n          state,\n          naming,\n          config,\n          baseDir,\n        }),\n      );\n    });\n  }\n\n  const dispatchResources = getDispatchNamespaces(config);\n  if (dispatchResources.length > 0) {\n    merge(\n      dispatchNamespaceDrift(\n        allDispatch,\n        dispatchResources,\n        env,\n        config.tenant,\n        state,\n      ),\n    );\n  }\n\n  const dnsResources = getDnsRecords(config);\n  if (dnsResources.length > 0 && env !== \"local\") {\n    const byZone: DnsRecordsByZone = new Map();\n    const zones = Array.from(new Set(dnsResources.map((r) => r.zoneId)));\n    for (const zoneId of zones) {\n      const live = await safeList(`dns records (zone ${zoneId})`, () =>\n        api.zoneDnsRecordListAll(zoneId),\n      );\n      byZone.set(zoneId, live);\n    }\n    merge(dnsRecordDrift(byZone, dnsResources, config.tenant, env, state));\n  }\n\n  const logpushResources = getLogpushJobs(config);\n  if (logpushResources.length > 0 && env !== \"local\") {\n    merge(\n      logpushJobDrift(\n        allLogpushJobs,\n        logpushResources,\n        env,\n        config.tenant,\n        state,\n      ),\n    );\n  }\n\n  if (state.listTenants().length > 0) {\n    const allD1Idx = resourceModules.findIndex((m) => m.kind === \"d1\");\n    const allD1 =\n      allD1Idx >= 0\n        ? (lists[allD1Idx] as Array<{ uuid: string; name: string }>)\n        : [];\n    merge(await tenantDrift(state, api, allD1));\n  }\n\n  const workerRouteReport = await workerRoutesDrift(\n    env,\n    config,\n    baseDir,\n    accountId,\n    naming,\n    state,\n    api,\n    { imports },\n  );\n  if (workerRouteReport) merge(workerRouteReport);\n\n  const workerScriptReport = await workersDrift(\n    env,\n    config,\n    baseDir,\n    accountId,\n    naming,\n    state,\n    api,\n    { imports },\n  );\n  if (workerScriptReport) merge(workerScriptReport);\n\n  const secretWorkers = await buildSecretWorkerInputs(\n    workers,\n    config,\n    env,\n    baseDir,\n    accountId,\n    naming,\n    state,\n    api,\n    imports,\n  );\n  if (secretWorkers.length > 0) {\n    const secretEntries = await reconcileSecrets({\n      workers: secretWorkers,\n      vault: options.secretsVault ?? vaultReaderFromMap({}),\n      state,\n    });\n    merge(secretsDrift(secretEntries));\n  }\n\n  const dedupedResources = Array.from(aggregated.values()).map((d) => ({\n    ...d,\n    missingFromCloudflare: dedupe(d.missingFromCloudflare),\n    unrecordedInState: dedupe(d.unrecordedInState),\n    undeployed: dedupe(d.undeployed),\n  }));\n\n  return {\n    tenantId: config.tenant.id,\n    env,\n    generatedAt: new Date().toISOString(),\n    resources: dedupedResources,\n    hasDrift: reportHasDrift(dedupedResources),\n  };\n}\n\nfunction dedupe<T extends { logicalName: string; derivedName: string }>(\n  list: T[],\n): T[] {\n  const seen = new Set<string>();\n  const out: T[] = [];\n  for (const item of list) {\n    const key = `${item.logicalName}::${item.derivedName}`;\n    if (seen.has(key)) continue;\n    seen.add(key);\n    out.push(item);\n  }\n  return out;\n}\n\n/**\n * CLI entry point. Prints a human report (or JSON when `--json`) and sets a\n * non-zero process exit code when drift is found.\n */\nexport async function runDrift(options: {\n  env?: string;\n  configPath?: string;\n  json?: boolean;\n}): Promise<number> {\n  const report = await computeDriftReport({\n    env: options.env,\n    configPath: options.configPath,\n  });\n\n  if (options.json) {\n    console.log(JSON.stringify(report, null, 2));\n  } else {\n    printHumanReport(report);\n  }\n\n  return report.hasDrift ? 1 : 0;\n}\n\nfunction printHumanReport(report: DriftReport): void {\n  console.log(\n    `\\nDrift report — tenant ${report.tenantId}, env ${report.env}\\n`,\n  );\n  if (report.resources.length === 0) {\n    console.log(\"  (no managed resource kinds in this config)\\n\");\n    return;\n  }\n  for (const d of report.resources) {\n    const total =\n      d.missingFromCloudflare.length +\n      d.unrecordedInState.length +\n      d.undeployed.length;\n    console.log(`${labelFor(d.kind)} (${total} drift):`);\n    if (total === 0) {\n      console.log(\"  ok\");\n      continue;\n    }\n    if (d.missingFromCloudflare.length) {\n      console.log(\"  missing from Cloudflare (state references gone):\");\n      for (const e of d.missingFromCloudflare) {\n        console.log(`    - ${e.logicalName} -> ${e.derivedName}${suffix(e.cfId)}`);\n      }\n    }\n    if (d.unrecordedInState.length) {\n      console.log(\"  unrecorded in state (run `tamer sync`):\");\n      for (const e of d.unrecordedInState) {\n        console.log(`    - ${e.logicalName} -> ${e.derivedName}${suffix(e.cfId)}`);\n      }\n    }\n    if (d.undeployed.length) {\n      console.log(\"  undeployed (run `tamer apply`):\");\n      for (const e of d.undeployed) {\n        console.log(`    - ${e.logicalName} -> ${e.derivedName}`);\n      }\n    }\n  }\n  console.log(report.hasDrift ? \"\\nDrift detected.\\n\" : \"\\nNo drift.\\n\");\n}\n\nconst REGISTRY_LABELS: Record<string, string> = Object.fromEntries(\n  resourceModules.map((m) => [m.kind, m.label]),\n);\n\nfunction labelFor(kind: ResourceDrift[\"kind\"]): string {\n  if (REGISTRY_LABELS[kind]) return REGISTRY_LABELS[kind];\n  switch (kind) {\n    case \"dispatch_namespace\":\n      return \"Dispatch namespaces\";\n    case \"logpush_job\":\n      return \"Logpush jobs\";\n    case \"dns_record\":\n      return \"DNS records\";\n    case \"tenant\":\n      return \"Workspace tenants\";\n    case \"worker_route\":\n      return \"HTTP routes (Workers Routes API)\";\n    case \"worker_script\":\n      return \"Worker scripts\";\n    case \"secret\":\n      return \"Worker secrets\";\n    default:\n      return kind;\n  }\n}\n\nfunction suffix(cfId?: string): string {\n  return cfId ? ` [${cfId}]` : \"\";\n}\n\nasync function buildSecretWorkerInputs(\n  workers: Awaited<ReturnType<typeof getWorkers>>,\n  config: Awaited<ReturnType<typeof loadConfig>>,\n  env: string,\n  baseDir: string,\n  accountId: string,\n  naming: ReturnType<typeof namingFromConfig>,\n  state: StateManager,\n  api: CFApiClient,\n  imports: Awaited<ReturnType<typeof fetchStackImports>>,\n): Promise<\n  Array<{\n    workerKey: string;\n    required: string[];\n    workerSecretNames: string[];\n  }>\n> {\n  const out: Array<{\n    workerKey: string;\n    required: string[];\n    workerSecretNames: string[];\n  }> = [];\n\n  for (const [workerKey, workerConfig] of workers) {\n    const merged = mergeWorkerConfigForResourcePick(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports },\n    );\n    const required = requiredSecretsForWorker(merged);\n    if (required.length === 0) continue;\n\n    const deployedName = resolveDeployedWorkerName(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      naming,\n    );\n    let workerSecretNames: string[] = [];\n    if (env !== \"local\") {\n      try {\n        workerSecretNames = await api.workersSecretsList(deployedName);\n      } catch {\n        workerSecretNames = [];\n      }\n    }\n\n    out.push({ workerKey, required, workerSecretNames });\n  }\n\n  return out;\n}\n"],"mappings":";;;;;;;;;AAaA,SAAgB,uBACd,aACA,WACA,KACA,QACA,OACe;CACf,MAAMA,QAAuB;EAC3B,MAAM;EACN,uBAAuB,EAAE;EACzB,mBAAmB,EAAE;EACrB,YAAY,EAAE;EACf;CAED,MAAM,UAAU,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE,eAAe,CAAC;CACjE,MAAM,WAAW,MAAM,QAAQ;CAC/B,MAAM,UAAU,OAAO,OAAO,SAAS,CAAC,QACrC,MAAwC,EAAE,SAAS,qBACrD;AAED,MAAK,MAAM,UAAU,WAAW;EAC9B,MAAM,cAAc,+BAA+B,QAAQ,KAAK,OAAO;EACvE,MAAM,aAAa,QAAQ,MACxB,MAAM,EAAE,gBAAgB,OAAO,eAAe,EAAE,gBAAgB,YAClE;EACD,MAAM,OAAO,QAAQ,IAAI,YAAY;AAErC,MAAI,cAAc,CAAC,KACjB,OAAM,sBAAsB,KAAK;GAC/B,aAAa,WAAW;GACxB,aAAa,WAAW;GACzB,CAAC;WACO,QAAQ,CAAC,WAClB,OAAM,kBAAkB,KAAK;GAC3B,aAAa,OAAO;GACpB;GACD,CAAC;WACO,CAAC,QAAQ,CAAC,WACnB,OAAM,WAAW,KAAK;GACpB,aAAa,OAAO;GACpB;GACD,CAAC;;AAIN,QAAO;;;;;AC3BT,SAAgB,eACd,QACA,WACA,QACA,KACA,OACe;CACf,MAAMC,QAAuB;EAC3B,MAAM;EACN,uBAAuB,EAAE;EACzB,mBAAmB,EAAE;EACrB,YAAY,EAAE;EACf;CAED,MAAM,eAAe,OAAO,OAAO,MAAM,QAAQ,CAAC,CAAC,QAChD,MAAgC,EAAE,SAAS,aAC7C;AAED,MAAK,MAAM,UAAU,WAAW;AAC9B,MAAI,CAAC,sBAAsB,QAAQ,IAAI,CAAE;EACzC,MAAM,OAAO,OAAO,IAAI,OAAO,OAAO,IAAI,EAAE;EAC5C,MAAM,SAAS,uBAAuB,QAAQ,KAAK,OAAO,YAAY;EACtE,MAAM,WAAW,kBAAkB,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK;EAC3E,MAAM,QAAQ,aAAa,MACxB,MACC,EAAE,WAAW,OAAO,UACpB,EAAE,eAAe,OAAO,QACxB,EAAE,gBAAgB,OAAO,YAC5B;EACD,MAAM,OAAO,QACT,KAAK,MAAM,MAAM,EAAE,OAAO,MAAM,SAAS,GACzC,KAAK,MACF,MACC,EAAE,SAAS,OAAO,QAClB,OAAO,EAAE,YAAY,YACrB,EAAE,QAAQ,WAAW,OAAO,CAC/B;AAEL,MAAI,SAAS,CAAC,KACZ,OAAM,sBAAsB,KAAK;GAC/B,aAAa,MAAM;GACnB,aAAa,GAAG,MAAM,WAAW,GAAG,MAAM;GAC1C,MAAM,MAAM;GACb,CAAC;WACO,QAAQ,CAAC,MAClB,OAAM,kBAAkB,KAAK;GAC3B,aAAa,OAAO;GACpB,aAAa,GAAG,OAAO,KAAK,GAAG,KAAK;GACpC,MAAM,KAAK;GACZ,CAAC;WACO,CAAC,QAAQ,CAAC,MACnB,OAAM,WAAW,KAAK;GACpB,aAAa,OAAO;GACpB,aAAa,GAAG,OAAO,KAAK,GAAG,OAAO;GACtC,QAAQ;GACT,CAAC;;AAIN,QAAO;;;;;AC9BT,SAAgB,qBAAqB,GAA2B;AAC9D,QACE,EAAE,sBAAsB,WAAW,KACnC,EAAE,kBAAkB,WAAW,KAC/B,EAAE,WAAW,WAAW;;AAI5B,SAAgB,eAAe,WAAqC;AAClE,QAAO,UAAU,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;;;;;;;;;;;;;ACnDxD,eAAsB,YACpB,OACA,KACA,OACwB;CACxB,MAAMC,QAAuB;EAC3B,MAAM;EACN,uBAAuB,EAAE;EACzB,mBAAmB,EAAE;EACrB,YAAY,EAAE;EACf;CAED,MAAM,SAAS,IAAI,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;CAC1D,MAAM,UAAU,MACb,aAAa,CACb,QAAQ,MAAM,EAAE,uBAAuB,aAAa;AACvD,KAAI,QAAQ,WAAW,EAAG,QAAO;CAEjC,MAAM,8BAAc,IAAI,KAA0B;CAClD,eAAe,YAAY,IAAkC;EAC3D,IAAI,MAAM,YAAY,IAAI,GAAG;AAC7B,MAAI,CAAC,KAAK;GACR,MAAM,OAAO,MAAM,IAAI,4BAA4B,GAAG;AACtD,SAAM,IAAI,IAAI,KAAK,KAAK,MAAM,EAAE,GAAG,CAAC;AACpC,eAAY,IAAI,IAAI,IAAI;;AAE1B,SAAO;;AAGT,MAAK,MAAM,KAAK,SAAS;EACvB,MAAM,UAAU,eAAe,EAAE,SAAS,EAAE,UAAU;AACtD,MAAI;AAEF,OAAI,EADQ,MAAM,YAAY,EAAE,sBAAsB,EAC7C,IAAI,EAAE,WAAW,CACxB,OAAM,sBAAsB,KAAK;IAC/B,aAAa;IACb,aAAa,EAAE;IACf,QAAQ;IACT,CAAC;UAEE;AACN,SAAM,sBAAsB,KAAK;IAC/B,aAAa;IACb,aAAa,EAAE;IACf,QAAQ;IACT,CAAC;;AAGJ,OAAK,MAAM,SAAS,EAAE,YAAY,EAAE,CAClC,KAAI,CAAC,OAAO,IAAI,MAAM,KAAK,CACzB,OAAM,sBAAsB,KAAK;GAC/B,aAAa;GACb,aAAa,MAAM;GACnB,MAAM,MAAM;GACZ,QAAQ,MAAM,MAAM;GACrB,CAAC;;AAKR,QAAO;;;;;;;;;;;;;;;;;;;;AC9BT,eAAsB,mBAAmB,SAKhB;CACvB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAIxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI,CAAC,aAAa,EAAE,EAAE;CAE3E,eAAe,SACb,OACA,IACc;AACd,MAAI;AACF,UAAO,MAAM,IAAI;WACV,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,oBAAoB,MAAM,IAAI,MAAM;AACjD,UAAO,EAAE;;;CAIb,MAAM,QAAQ,MAAM,QAAQ,IAC1B,gBAAgB,KAAK,MACnB,SAAS,GAAG,EAAE,MAAM,cAAc,EAAE,SAAS,IAAI,CAAC,CACnD,CACF;CAED,MAAM,cACJ,sBAAsB,OAAO,CAAC,SAAS,IACnC,MAAM,SAAS,6BACb,IAAI,0BAA0B,CAC/B,GACD,EAAE;CAER,MAAM,iBACJ,eAAe,OAAO,CAAC,SAAS,KAAK,QAAQ,UACzC,MAAM,SAAS,sBAAsB,IAAI,wBAAwB,CAAC,GAClE,EAAE;CAER,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CAEjD,MAAM,6BAAa,IAAI,KAA4B;CACnD,SAAS,MAAM,GAAwB;EACrC,MAAM,WAAW,WAAW,IAAI,EAAE,KAAK;AACvC,MAAI,CAAC,UAAU;AACb,cAAW,IAAI,EAAE,MAAM,EAAE;AACzB;;AAEF,WAAS,sBAAsB,KAAK,GAAG,EAAE,sBAAsB;AAC/D,WAAS,kBAAkB,KAAK,GAAG,EAAE,kBAAkB;AACvD,WAAS,WAAW,KAAK,GAAG,EAAE,WAAW;;AAG3C,MAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;EAC/C,MAAM,eAAe,iCACnB,QACA,WACA,cACA,KACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY;GAAS,CACxC;AACD,kBAAgB,SAAS,KAAK,MAAM;GAClC,MAAM,YAAY,IAAI,cAAc,aAAa;AACjD,OAAI,UAAU,WAAW,EAAG;AAC5B,SACE,IAAI,MAAM;IACR;IACA,KAAK,MAAM;IACX,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACD,CAAC,CACH;IACD;;CAGJ,MAAM,oBAAoB,sBAAsB,OAAO;AACvD,KAAI,kBAAkB,SAAS,EAC7B,OACE,uBACE,aACA,mBACA,KACA,OAAO,QACP,MACD,CACF;CAGH,MAAM,eAAe,cAAc,OAAO;AAC1C,KAAI,aAAa,SAAS,KAAK,QAAQ,SAAS;EAC9C,MAAMC,yBAA2B,IAAI,KAAK;EAC1C,MAAM,QAAQ,MAAM,KAAK,IAAI,IAAI,aAAa,KAAK,MAAM,EAAE,OAAO,CAAC,CAAC;AACpE,OAAK,MAAM,UAAU,OAAO;GAC1B,MAAM,OAAO,MAAM,SAAS,qBAAqB,OAAO,UACtD,IAAI,qBAAqB,OAAO,CACjC;AACD,UAAO,IAAI,QAAQ,KAAK;;AAE1B,QAAM,eAAe,QAAQ,cAAc,OAAO,QAAQ,KAAK,MAAM,CAAC;;CAGxE,MAAM,mBAAmB,eAAe,OAAO;AAC/C,KAAI,iBAAiB,SAAS,KAAK,QAAQ,QACzC,OACE,gBACE,gBACA,kBACA,KACA,OAAO,QACP,MACD,CACF;AAGH,KAAI,MAAM,aAAa,CAAC,SAAS,GAAG;EAClC,MAAM,WAAW,gBAAgB,WAAW,MAAM,EAAE,SAAS,KAAK;AAKlE,QAAM,MAAM,YAAY,OAAO,KAH7B,YAAY,IACP,MAAM,YACP,EAAE,CACkC,CAAC;;CAG7C,MAAM,oBAAoB,MAAM,kBAC9B,KACA,QACA,SACA,WACA,QACA,OACA,KACA,EAAE,SAAS,CACZ;AACD,KAAI,kBAAmB,OAAM,kBAAkB;CAE/C,MAAM,qBAAqB,MAAM,aAC/B,KACA,QACA,SACA,WACA,QACA,OACA,KACA,EAAE,SAAS,CACZ;AACD,KAAI,mBAAoB,OAAM,mBAAmB;CAEjD,MAAM,gBAAgB,MAAM,wBAC1B,SACA,QACA,KACA,SACA,WACA,QACA,OACA,KACA,QACD;AACD,KAAI,cAAc,SAAS,EAMzB,OAAM,aALgB,MAAM,iBAAiB;EAC3C,SAAS;EACT,OAAO,QAAQ,gBAAgB,mBAAmB,EAAE,CAAC;EACrD;EACD,CAAC,CAC+B,CAAC;CAGpC,MAAM,mBAAmB,MAAM,KAAK,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO;EACnE,GAAG;EACH,uBAAuB,OAAO,EAAE,sBAAsB;EACtD,mBAAmB,OAAO,EAAE,kBAAkB;EAC9C,YAAY,OAAO,EAAE,WAAW;EACjC,EAAE;AAEH,QAAO;EACL,UAAU,OAAO,OAAO;EACxB;EACA,8BAAa,IAAI,MAAM,EAAC,aAAa;EACrC,WAAW;EACX,UAAU,eAAe,iBAAiB;EAC3C;;AAGH,SAAS,OACP,MACK;CACL,MAAM,uBAAO,IAAI,KAAa;CAC9B,MAAMC,MAAW,EAAE;AACnB,MAAK,MAAM,QAAQ,MAAM;EACvB,MAAM,MAAM,GAAG,KAAK,YAAY,IAAI,KAAK;AACzC,MAAI,KAAK,IAAI,IAAI,CAAE;AACnB,OAAK,IAAI,IAAI;AACb,MAAI,KAAK,KAAK;;AAEhB,QAAO;;;;;;AAOT,eAAsB,SAAS,SAIX;CAClB,MAAM,SAAS,MAAM,mBAAmB;EACtC,KAAK,QAAQ;EACb,YAAY,QAAQ;EACrB,CAAC;AAEF,KAAI,QAAQ,KACV,SAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC;KAE5C,kBAAiB,OAAO;AAG1B,QAAO,OAAO,WAAW,IAAI;;AAG/B,SAAS,iBAAiB,QAA2B;AACnD,SAAQ,IACN,2BAA2B,OAAO,SAAS,QAAQ,OAAO,IAAI,IAC/D;AACD,KAAI,OAAO,UAAU,WAAW,GAAG;AACjC,UAAQ,IAAI,iDAAiD;AAC7D;;AAEF,MAAK,MAAM,KAAK,OAAO,WAAW;EAChC,MAAM,QACJ,EAAE,sBAAsB,SACxB,EAAE,kBAAkB,SACpB,EAAE,WAAW;AACf,UAAQ,IAAI,GAAG,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,UAAU;AACpD,MAAI,UAAU,GAAG;AACf,WAAQ,IAAI,OAAO;AACnB;;AAEF,MAAI,EAAE,sBAAsB,QAAQ;AAClC,WAAQ,IAAI,qDAAqD;AACjE,QAAK,MAAM,KAAK,EAAE,sBAChB,SAAQ,IAAI,SAAS,EAAE,YAAY,MAAM,EAAE,cAAc,OAAO,EAAE,KAAK,GAAG;;AAG9E,MAAI,EAAE,kBAAkB,QAAQ;AAC9B,WAAQ,IAAI,4CAA4C;AACxD,QAAK,MAAM,KAAK,EAAE,kBAChB,SAAQ,IAAI,SAAS,EAAE,YAAY,MAAM,EAAE,cAAc,OAAO,EAAE,KAAK,GAAG;;AAG9E,MAAI,EAAE,WAAW,QAAQ;AACvB,WAAQ,IAAI,oCAAoC;AAChD,QAAK,MAAM,KAAK,EAAE,WAChB,SAAQ,IAAI,SAAS,EAAE,YAAY,MAAM,EAAE,cAAc;;;AAI/D,SAAQ,IAAI,OAAO,WAAW,wBAAwB,gBAAgB;;AAGxE,MAAMC,kBAA0C,OAAO,YACrD,gBAAgB,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAC9C;AAED,SAAS,SAAS,MAAqC;AACrD,KAAI,gBAAgB,MAAO,QAAO,gBAAgB;AAClD,SAAQ,MAAR;EACE,KAAK,qBACH,QAAO;EACT,KAAK,cACH,QAAO;EACT,KAAK,aACH,QAAO;EACT,KAAK,SACH,QAAO;EACT,KAAK,eACH,QAAO;EACT,KAAK,gBACH,QAAO;EACT,KAAK,SACH,QAAO;EACT,QACE,QAAO;;;AAIb,SAAS,OAAO,MAAuB;AACrC,QAAO,OAAO,KAAK,KAAK,KAAK;;AAG/B,eAAe,wBACb,SACA,QACA,KACA,SACA,WACA,QACA,OACA,KACA,SAOA;CACA,MAAMC,MAID,EAAE;AAEP,MAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;EAW/C,MAAM,WAAW,yBAVF,iCACb,QACA,WACA,cACA,KACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY;GAAS,CACxC,CACgD;AACjD,MAAI,SAAS,WAAW,EAAG;EAE3B,MAAM,eAAe,0BACnB,QACA,WACA,cACA,KACA,OACD;EACD,IAAIC,oBAA8B,EAAE;AACpC,MAAI,QAAQ,QACV,KAAI;AACF,uBAAoB,MAAM,IAAI,mBAAmB,aAAa;UACxD;AACN,uBAAoB,EAAE;;AAI1B,MAAI,KAAK;GAAE;GAAW;GAAU;GAAmB,CAAC;;AAGtD,QAAO"}
+{"version":3,"file":"drift-B5y9LF5X.mjs","names":["drift: ResourceDrift","drift: ResourceDrift","drift: ResourceDrift","byZone: DnsRecordsByZone","out: T[]","REGISTRY_LABELS: Record<string, string>","out: Array<{\n    workerKey: string;\n    required: string[];\n    workerSecretNames: string[];\n  }>","workerSecretNames: string[]"],"sources":["../src/features/dispatch-namespace/dispatch-namespace.drift.ts","../src/features/dns-records/dns-records.drift.ts","../src/core/drift/drift.types.ts","../src/core/drift/tenantDrift.ts","../src/cli/commands/drift.ts"],"sourcesContent":["import type {\n  DispatchNamespaceResourceConfig,\n  DispatchNamespaceStateEntry,\n  TenantMeta,\n} from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { ResourceDrift } from \"../../core/drift/drift.types.js\";\nimport { effectiveDispatchNamespaceName } from \"./dispatch-namespace.resolve.js\";\n\ninterface CFDispatchNamespace {\n  namespace_name: string;\n}\n\nexport function dispatchNamespaceDrift(\n  allDispatch: CFDispatchNamespace[],\n  resources: DispatchNamespaceResourceConfig[],\n  env: string,\n  tenant: TenantMeta,\n  state: StateManager,\n): ResourceDrift {\n  const drift: ResourceDrift = {\n    kind: \"dispatch_namespace\",\n    missingFromCloudflare: [],\n    unrecordedInState: [],\n    undeployed: [],\n  };\n\n  const cfNames = new Set(allDispatch.map((d) => d.namespace_name));\n  const allState = state.getAll();\n  const nsState = Object.values(allState).filter(\n    (e): e is DispatchNamespaceStateEntry => e.type === \"dispatch_namespace\",\n  );\n\n  for (const config of resources) {\n    const derivedName = effectiveDispatchNamespaceName(config, env, tenant);\n    const stateEntry = nsState.find(\n      (e) => e.logicalName === config.logicalName && e.derivedName === derivedName,\n    );\n    const onCf = cfNames.has(derivedName);\n\n    if (stateEntry && !onCf) {\n      drift.missingFromCloudflare.push({\n        logicalName: stateEntry.logicalName,\n        derivedName: stateEntry.derivedName,\n      });\n    } else if (onCf && !stateEntry) {\n      drift.unrecordedInState.push({\n        logicalName: config.logicalName,\n        derivedName,\n      });\n    } else if (!onCf && !stateEntry) {\n      drift.undeployed.push({\n        logicalName: config.logicalName,\n        derivedName,\n      });\n    }\n  }\n\n  return drift;\n}\n","import type {\n  DnsRecordResourceConfig,\n  DnsRecordStateEntry,\n  TenantMeta,\n} from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { ResourceDrift } from \"../../core/drift/drift.types.js\";\nimport {\n  dnsRecordAppliesToEnv,\n  dnsRecordCommentMarker,\n  dnsRecordStateKey,\n} from \"./dns-records.resolve.js\";\n\ninterface CFDnsRecord {\n  id: string;\n  type: string;\n  name: string;\n  content: string;\n  ttl?: number;\n  proxied?: boolean;\n  priority?: number;\n  comment?: string | null;\n}\n\n/**\n * Map of `zoneId → live records`. The drift caller pre-fetches because\n * other resource modules also iterate zones (worker routes), so we\n * accept the snapshot rather than refetching here.\n */\nexport type DnsRecordsByZone = Map<string, CFDnsRecord[]>;\n\nexport function dnsRecordDrift(\n  byZone: DnsRecordsByZone,\n  resources: DnsRecordResourceConfig[],\n  tenant: TenantMeta,\n  env: string,\n  state: StateManager,\n): ResourceDrift {\n  const drift: ResourceDrift = {\n    kind: \"dns_record\",\n    missingFromCloudflare: [],\n    unrecordedInState: [],\n    undeployed: [],\n  };\n\n  const stateRecords = Object.values(state.getAll()).filter(\n    (e): e is DnsRecordStateEntry => e.type === \"dns_record\",\n  );\n\n  for (const config of resources) {\n    if (!dnsRecordAppliesToEnv(config, env)) continue;\n    const live = byZone.get(config.zoneId) ?? [];\n    const marker = dnsRecordCommentMarker(tenant, env, config.logicalName);\n    const stateKey = dnsRecordStateKey(config.zoneId, config.type, config.name);\n    const entry = stateRecords.find(\n      (e) =>\n        e.zoneId === config.zoneId &&\n        e.recordType === config.type &&\n        e.logicalName === config.logicalName,\n    );\n    const onCf = entry\n      ? live.find((r) => r.id === entry.recordId)\n      : live.find(\n          (r) =>\n            r.type === config.type &&\n            typeof r.comment === \"string\" &&\n            r.comment.startsWith(marker),\n        );\n\n    if (entry && !onCf) {\n      drift.missingFromCloudflare.push({\n        logicalName: entry.logicalName,\n        derivedName: `${entry.recordType} ${entry.name}`,\n        cfId: entry.recordId,\n      });\n    } else if (onCf && !entry) {\n      drift.unrecordedInState.push({\n        logicalName: config.logicalName,\n        derivedName: `${config.type} ${onCf.name}`,\n        cfId: onCf.id,\n      });\n    } else if (!onCf && !entry) {\n      drift.undeployed.push({\n        logicalName: config.logicalName,\n        derivedName: `${config.type} ${config.name}`,\n        detail: stateKey,\n      });\n    }\n  }\n\n  return drift;\n}\n","/**\n * Read-only drift report comparing recorded state vs. Cloudflare reality vs.\n * the current `tamer.config.ts`.\n */\n\nexport type DriftKind =\n  | \"d1\"\n  | \"r2\"\n  | \"kv\"\n  | \"queue\"\n  | \"hyperdrive\"\n  | \"vectorize\"\n  | \"ai_gateway\"\n  | \"pipeline\"\n  | \"workflow\"\n  | \"secret_store\"\n  | \"secret\"\n  | \"dns_record\"\n  | \"dispatch_namespace\"\n  | \"logpush_job\"\n  | \"tenant\"\n  | \"worker_route\"\n  | \"worker_script\";\n\nexport interface DriftEntry {\n  /** Logical resource name from `tamer.config.ts`. */\n  logicalName: string;\n  /** Cloudflare-side name (or `(unknown)` when no CF or state side knows it). */\n  derivedName: string;\n  /** Cloudflare resource ID, when known (D1 uuid, KV id). */\n  cfId?: string;\n  /** Optional human-readable detail (e.g. shard date). */\n  detail?: string;\n}\n\nexport interface ResourceDrift {\n  kind: DriftKind;\n  /** Tracked in state but no longer present on Cloudflare. */\n  missingFromCloudflare: DriftEntry[];\n  /**\n   * Present on Cloudflare and matches a declared resource in this config,\n   * but no state entry tracks it (e.g. created out-of-band).\n   */\n  unrecordedInState: DriftEntry[];\n  /**\n   * Declared in this stack's config but neither tracked in state nor present\n   * on Cloudflare (run `tamer apply`).\n   */\n  undeployed: DriftEntry[];\n}\n\nexport interface DriftReport {\n  tenantId: string;\n  env: string;\n  generatedAt: string;\n  resources: ResourceDrift[];\n  /** True iff any of the three categories has at least one entry. */\n  hasDrift: boolean;\n}\n\nexport function resourceDriftIsClean(d: ResourceDrift): boolean {\n  return (\n    d.missingFromCloudflare.length === 0 &&\n    d.unrecordedInState.length === 0 &&\n    d.undeployed.length === 0\n  );\n}\n\nexport function reportHasDrift(resources: ResourceDrift[]): boolean {\n  return resources.some((d) => !resourceDriftIsClean(d));\n}\n","import type { CFApiClient } from \"../api/CFApiClient.js\";\nimport type { StateManager } from \"../state/StateManager.js\";\nimport type { ResourceDrift } from \"./drift.types.js\";\nimport { tenantStateKey } from \"../tenant/tenantKeys.js\";\n\ninterface CFD1 {\n  uuid: string;\n  name: string;\n}\n\n/**\n * Drift for workspace tenants in {@link CfiState.tenants}: dispatch script and\n * recorded D1 shards must still exist on Cloudflare.\n *\n * `unrecordedInState` / `undeployed` are intentionally empty here — tenant\n * discovery from CF alone is heuristic until product/script naming is fully\n * pinned (`docs/scope-remaining.md` D-1).\n */\nexport async function tenantDrift(\n  state: StateManager,\n  api: CFApiClient,\n  allD1: CFD1[],\n): Promise<ResourceDrift> {\n  const drift: ResourceDrift = {\n    kind: \"tenant\",\n    missingFromCloudflare: [],\n    unrecordedInState: [],\n    undeployed: [],\n  };\n\n  const d1ById = new Map(allD1.map((d) => [d.uuid, d.name]));\n  const tenants = state\n    .listTenants()\n    .filter((t) => t.provisioningStatus !== \"tombstoned\");\n  if (tenants.length === 0) return drift;\n\n  const scriptLists = new Map<string, Set<string>>();\n  async function scriptsInNs(ns: string): Promise<Set<string>> {\n    let set = scriptLists.get(ns);\n    if (!set) {\n      const list = await api.dispatchNamespaceScriptList(ns);\n      set = new Set(list.map((s) => s.id));\n      scriptLists.set(ns, set);\n    }\n    return set;\n  }\n\n  for (const t of tenants) {\n    const logical = tenantStateKey(t.product, t.workspace);\n    try {\n      const ids = await scriptsInNs(t.dispatchNamespaceName);\n      if (!ids.has(t.scriptName)) {\n        drift.missingFromCloudflare.push({\n          logicalName: logical,\n          derivedName: t.scriptName,\n          detail: \"dispatch_script\",\n        });\n      }\n    } catch {\n      drift.missingFromCloudflare.push({\n        logicalName: logical,\n        derivedName: t.dispatchNamespaceName,\n        detail: \"dispatch_namespace_list_failed\",\n      });\n    }\n\n    for (const shard of t.d1Shards ?? []) {\n      if (!d1ById.has(shard.cfId)) {\n        drift.missingFromCloudflare.push({\n          logicalName: logical,\n          derivedName: shard.derivedName,\n          cfId: shard.cfId,\n          detail: `d1:${shard.role}`,\n        });\n      }\n    }\n  }\n\n  return drift;\n}\n","import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { dispatchNamespaceDrift } from \"../../features/dispatch-namespace/index.js\";\nimport {\n  dnsRecordDrift,\n  type DnsRecordsByZone,\n} from \"../../features/dns-records/index.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobDrift } from \"../../features/logpush-job/index.js\";\nimport type {\n  DriftReport,\n  ResourceDrift,\n} from \"../../core/drift/drift.types.js\";\nimport { reportHasDrift } from \"../../core/drift/drift.types.js\";\nimport { tenantDrift } from \"../../core/drift/tenantDrift.js\";\nimport { workerRoutesDrift } from \"../../features/worker-route/index.js\";\nimport { workersDrift } from \"../../features/workers/index.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\nimport { mergeWorkerConfigForResourcePick } from \"../../core/config/resolver.js\";\nimport { resolveDeployedWorkerName } from \"../../core/config/resolver.js\";\nimport { requiredSecretsForWorker } from \"../../core/secrets/declared.js\";\nimport {\n  reconcileSecrets,\n  secretsDrift,\n  vaultReaderFromMap,\n  type SecretsVaultReader,\n} from \"../../core/secrets/reconcile.js\";\n\n/**\n * Compute a read-only drift report for the given env.\n *\n * Compares Tamer state (D1 `tamer-state-{env}`) against the Cloudflare API\n * and the resources declared in `tamer.config.ts`. Reports three categories:\n *\n * - `missingFromCloudflare` — tracked in state but the CF resource is gone.\n * - `unrecordedInState` — exists on CF and matches a declared resource, but\n *   no state entry tracks it (e.g. created out-of-band; run `tamer sync`).\n * - `undeployed` — declared in this stack's config, present in neither\n *   state nor CF (run `tamer apply`).\n *\n * Pure: never writes to state. Returns the report so callers can choose how to\n * render or consume it.\n */\nexport async function computeDriftReport(options: {\n  env?: string;\n  configPath?: string;\n  /** Optional vault reader for secret reconciliation (defaults to empty). */\n  secretsVault?: SecretsVaultReader;\n}): Promise<DriftReport> {\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  // Tolerant pre-fetch keeps drift accurate when worker `tamerRoutes`\n  // depend on sibling-stack outputs (otherwise the placeholder pattern\n  // would never match anything CF returned).\n  const imports = await fetchStackImports(api, config, env).catch(() => ({}));\n\n  async function safeList<T>(\n    label: string,\n    fn: () => Promise<T[]>,\n  ): Promise<T[]> {\n    try {\n      return await fn();\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[drift] skipping ${label}: ${msg}`);\n      return [];\n    }\n  }\n\n  const lists = await Promise.all(\n    resourceModules.map((m) =>\n      safeList(`${m.label} list`, () => m.fetchAll(api)),\n    ),\n  );\n\n  const allDispatch =\n    getDispatchNamespaces(config).length > 0\n      ? await safeList(\"dispatch namespaces\", () =>\n          api.dispatchNamespaceListAll(),\n        )\n      : [];\n\n  const allLogpushJobs =\n    getLogpushJobs(config).length > 0 && env !== \"local\"\n      ? await safeList(\"logpush jobs\", () => api.logpushAccountJobsList())\n      : [];\n\n  const workers = await getWorkers(config, baseDir);\n\n  const aggregated = new Map<string, ResourceDrift>();\n  function merge(d: ResourceDrift): void {\n    const existing = aggregated.get(d.kind);\n    if (!existing) {\n      aggregated.set(d.kind, d);\n      return;\n    }\n    existing.missingFromCloudflare.push(...d.missingFromCloudflare);\n    existing.unrecordedInState.push(...d.unrecordedInState);\n    existing.undeployed.push(...d.undeployed);\n  }\n\n  for (const [workerKey, workerConfig] of workers) {\n    const mergedWorker = mergeWorkerConfigForResourcePick(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports },\n    );\n    resourceModules.forEach((mod, i) => {\n      const resources = mod.pickResources(mergedWorker);\n      if (resources.length === 0) return;\n      merge(\n        mod.drift({\n          resources,\n          all: lists[i],\n          tenant: config.tenant,\n          env,\n          api,\n          state,\n          naming,\n          config,\n          baseDir,\n        }),\n      );\n    });\n  }\n\n  const dispatchResources = getDispatchNamespaces(config);\n  if (dispatchResources.length > 0) {\n    merge(\n      dispatchNamespaceDrift(\n        allDispatch,\n        dispatchResources,\n        env,\n        config.tenant,\n        state,\n      ),\n    );\n  }\n\n  const dnsResources = getDnsRecords(config);\n  if (dnsResources.length > 0 && env !== \"local\") {\n    const byZone: DnsRecordsByZone = new Map();\n    const zones = Array.from(new Set(dnsResources.map((r) => r.zoneId)));\n    for (const zoneId of zones) {\n      const live = await safeList(`dns records (zone ${zoneId})`, () =>\n        api.zoneDnsRecordListAll(zoneId),\n      );\n      byZone.set(zoneId, live);\n    }\n    merge(dnsRecordDrift(byZone, dnsResources, config.tenant, env, state));\n  }\n\n  const logpushResources = getLogpushJobs(config);\n  if (logpushResources.length > 0 && env !== \"local\") {\n    merge(\n      logpushJobDrift(\n        allLogpushJobs,\n        logpushResources,\n        env,\n        config.tenant,\n        state,\n      ),\n    );\n  }\n\n  if (state.listTenants().length > 0) {\n    const allD1Idx = resourceModules.findIndex((m) => m.kind === \"d1\");\n    const allD1 =\n      allD1Idx >= 0\n        ? (lists[allD1Idx] as Array<{ uuid: string; name: string }>)\n        : [];\n    merge(await tenantDrift(state, api, allD1));\n  }\n\n  const workerRouteReport = await workerRoutesDrift(\n    env,\n    config,\n    baseDir,\n    accountId,\n    naming,\n    state,\n    api,\n    { imports },\n  );\n  if (workerRouteReport) merge(workerRouteReport);\n\n  const workerScriptReport = await workersDrift(\n    env,\n    config,\n    baseDir,\n    accountId,\n    naming,\n    state,\n    api,\n    { imports },\n  );\n  if (workerScriptReport) merge(workerScriptReport);\n\n  const secretWorkers = await buildSecretWorkerInputs(\n    workers,\n    config,\n    env,\n    baseDir,\n    accountId,\n    naming,\n    state,\n    api,\n    imports,\n  );\n  if (secretWorkers.length > 0) {\n    const secretEntries = await reconcileSecrets({\n      workers: secretWorkers,\n      vault: options.secretsVault ?? vaultReaderFromMap({}),\n      state,\n    });\n    merge(secretsDrift(secretEntries));\n  }\n\n  const dedupedResources = Array.from(aggregated.values()).map((d) => ({\n    ...d,\n    missingFromCloudflare: dedupe(d.missingFromCloudflare),\n    unrecordedInState: dedupe(d.unrecordedInState),\n    undeployed: dedupe(d.undeployed),\n  }));\n\n  return {\n    tenantId: config.tenant.id,\n    env,\n    generatedAt: new Date().toISOString(),\n    resources: dedupedResources,\n    hasDrift: reportHasDrift(dedupedResources),\n  };\n}\n\nfunction dedupe<T extends { logicalName: string; derivedName: string }>(\n  list: T[],\n): T[] {\n  const seen = new Set<string>();\n  const out: T[] = [];\n  for (const item of list) {\n    const key = `${item.logicalName}::${item.derivedName}`;\n    if (seen.has(key)) continue;\n    seen.add(key);\n    out.push(item);\n  }\n  return out;\n}\n\n/**\n * CLI entry point. Prints a human report (or JSON when `--json`) and sets a\n * non-zero process exit code when drift is found.\n */\nexport async function runDrift(options: {\n  env?: string;\n  configPath?: string;\n  json?: boolean;\n}): Promise<number> {\n  const report = await computeDriftReport({\n    env: options.env,\n    configPath: options.configPath,\n  });\n\n  if (options.json) {\n    console.log(JSON.stringify(report, null, 2));\n  } else {\n    printHumanReport(report);\n  }\n\n  return report.hasDrift ? 1 : 0;\n}\n\nfunction printHumanReport(report: DriftReport): void {\n  console.log(\n    `\\nDrift report — tenant ${report.tenantId}, env ${report.env}\\n`,\n  );\n  if (report.resources.length === 0) {\n    console.log(\"  (no managed resource kinds in this config)\\n\");\n    return;\n  }\n  for (const d of report.resources) {\n    const total =\n      d.missingFromCloudflare.length +\n      d.unrecordedInState.length +\n      d.undeployed.length;\n    console.log(`${labelFor(d.kind)} (${total} drift):`);\n    if (total === 0) {\n      console.log(\"  ok\");\n      continue;\n    }\n    if (d.missingFromCloudflare.length) {\n      console.log(\"  missing from Cloudflare (state references gone):\");\n      for (const e of d.missingFromCloudflare) {\n        console.log(`    - ${e.logicalName} -> ${e.derivedName}${suffix(e.cfId)}`);\n      }\n    }\n    if (d.unrecordedInState.length) {\n      console.log(\"  unrecorded in state (run `tamer sync`):\");\n      for (const e of d.unrecordedInState) {\n        console.log(`    - ${e.logicalName} -> ${e.derivedName}${suffix(e.cfId)}`);\n      }\n    }\n    if (d.undeployed.length) {\n      console.log(\"  undeployed (run `tamer apply`):\");\n      for (const e of d.undeployed) {\n        console.log(`    - ${e.logicalName} -> ${e.derivedName}`);\n      }\n    }\n  }\n  console.log(report.hasDrift ? \"\\nDrift detected.\\n\" : \"\\nNo drift.\\n\");\n}\n\nconst REGISTRY_LABELS: Record<string, string> = Object.fromEntries(\n  resourceModules.map((m) => [m.kind, m.label]),\n);\n\nfunction labelFor(kind: ResourceDrift[\"kind\"]): string {\n  if (REGISTRY_LABELS[kind]) return REGISTRY_LABELS[kind];\n  switch (kind) {\n    case \"dispatch_namespace\":\n      return \"Dispatch namespaces\";\n    case \"logpush_job\":\n      return \"Logpush jobs\";\n    case \"dns_record\":\n      return \"DNS records\";\n    case \"tenant\":\n      return \"Workspace tenants\";\n    case \"worker_route\":\n      return \"HTTP routes (Workers Routes API)\";\n    case \"worker_script\":\n      return \"Worker scripts\";\n    case \"secret\":\n      return \"Worker secrets\";\n    default:\n      return kind;\n  }\n}\n\nfunction suffix(cfId?: string): string {\n  return cfId ? ` [${cfId}]` : \"\";\n}\n\nasync function buildSecretWorkerInputs(\n  workers: Awaited<ReturnType<typeof getWorkers>>,\n  config: Awaited<ReturnType<typeof loadConfig>>,\n  env: string,\n  baseDir: string,\n  accountId: string,\n  naming: ReturnType<typeof namingFromConfig>,\n  state: StateManager,\n  api: CFApiClient,\n  imports: Awaited<ReturnType<typeof fetchStackImports>>,\n): Promise<\n  Array<{\n    workerKey: string;\n    required: string[];\n    workerSecretNames: string[];\n  }>\n> {\n  const out: Array<{\n    workerKey: string;\n    required: string[];\n    workerSecretNames: string[];\n  }> = [];\n\n  for (const [workerKey, workerConfig] of workers) {\n    const merged = mergeWorkerConfigForResourcePick(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports },\n    );\n    const required = requiredSecretsForWorker(merged);\n    if (required.length === 0) continue;\n\n    const deployedName = resolveDeployedWorkerName(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      naming,\n    );\n    let workerSecretNames: string[] = [];\n    if (env !== \"local\") {\n      try {\n        workerSecretNames = await api.workersSecretsList(deployedName);\n      } catch {\n        workerSecretNames = [];\n      }\n    }\n\n    out.push({ workerKey, required, workerSecretNames });\n  }\n\n  return out;\n}\n"],"mappings":";;;;;;;;;AAaA,SAAgB,uBACd,aACA,WACA,KACA,QACA,OACe;CACf,MAAMA,QAAuB;EAC3B,MAAM;EACN,uBAAuB,EAAE;EACzB,mBAAmB,EAAE;EACrB,YAAY,EAAE;EACf;CAED,MAAM,UAAU,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE,eAAe,CAAC;CACjE,MAAM,WAAW,MAAM,QAAQ;CAC/B,MAAM,UAAU,OAAO,OAAO,SAAS,CAAC,QACrC,MAAwC,EAAE,SAAS,qBACrD;AAED,MAAK,MAAM,UAAU,WAAW;EAC9B,MAAM,cAAc,+BAA+B,QAAQ,KAAK,OAAO;EACvE,MAAM,aAAa,QAAQ,MACxB,MAAM,EAAE,gBAAgB,OAAO,eAAe,EAAE,gBAAgB,YAClE;EACD,MAAM,OAAO,QAAQ,IAAI,YAAY;AAErC,MAAI,cAAc,CAAC,KACjB,OAAM,sBAAsB,KAAK;GAC/B,aAAa,WAAW;GACxB,aAAa,WAAW;GACzB,CAAC;WACO,QAAQ,CAAC,WAClB,OAAM,kBAAkB,KAAK;GAC3B,aAAa,OAAO;GACpB;GACD,CAAC;WACO,CAAC,QAAQ,CAAC,WACnB,OAAM,WAAW,KAAK;GACpB,aAAa,OAAO;GACpB;GACD,CAAC;;AAIN,QAAO;;;;;AC3BT,SAAgB,eACd,QACA,WACA,QACA,KACA,OACe;CACf,MAAMC,QAAuB;EAC3B,MAAM;EACN,uBAAuB,EAAE;EACzB,mBAAmB,EAAE;EACrB,YAAY,EAAE;EACf;CAED,MAAM,eAAe,OAAO,OAAO,MAAM,QAAQ,CAAC,CAAC,QAChD,MAAgC,EAAE,SAAS,aAC7C;AAED,MAAK,MAAM,UAAU,WAAW;AAC9B,MAAI,CAAC,sBAAsB,QAAQ,IAAI,CAAE;EACzC,MAAM,OAAO,OAAO,IAAI,OAAO,OAAO,IAAI,EAAE;EAC5C,MAAM,SAAS,uBAAuB,QAAQ,KAAK,OAAO,YAAY;EACtE,MAAM,WAAW,kBAAkB,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK;EAC3E,MAAM,QAAQ,aAAa,MACxB,MACC,EAAE,WAAW,OAAO,UACpB,EAAE,eAAe,OAAO,QACxB,EAAE,gBAAgB,OAAO,YAC5B;EACD,MAAM,OAAO,QACT,KAAK,MAAM,MAAM,EAAE,OAAO,MAAM,SAAS,GACzC,KAAK,MACF,MACC,EAAE,SAAS,OAAO,QAClB,OAAO,EAAE,YAAY,YACrB,EAAE,QAAQ,WAAW,OAAO,CAC/B;AAEL,MAAI,SAAS,CAAC,KACZ,OAAM,sBAAsB,KAAK;GAC/B,aAAa,MAAM;GACnB,aAAa,GAAG,MAAM,WAAW,GAAG,MAAM;GAC1C,MAAM,MAAM;GACb,CAAC;WACO,QAAQ,CAAC,MAClB,OAAM,kBAAkB,KAAK;GAC3B,aAAa,OAAO;GACpB,aAAa,GAAG,OAAO,KAAK,GAAG,KAAK;GACpC,MAAM,KAAK;GACZ,CAAC;WACO,CAAC,QAAQ,CAAC,MACnB,OAAM,WAAW,KAAK;GACpB,aAAa,OAAO;GACpB,aAAa,GAAG,OAAO,KAAK,GAAG,OAAO;GACtC,QAAQ;GACT,CAAC;;AAIN,QAAO;;;;;AC9BT,SAAgB,qBAAqB,GAA2B;AAC9D,QACE,EAAE,sBAAsB,WAAW,KACnC,EAAE,kBAAkB,WAAW,KAC/B,EAAE,WAAW,WAAW;;AAI5B,SAAgB,eAAe,WAAqC;AAClE,QAAO,UAAU,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;;;;;;;;;;;;;ACnDxD,eAAsB,YACpB,OACA,KACA,OACwB;CACxB,MAAMC,QAAuB;EAC3B,MAAM;EACN,uBAAuB,EAAE;EACzB,mBAAmB,EAAE;EACrB,YAAY,EAAE;EACf;CAED,MAAM,SAAS,IAAI,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;CAC1D,MAAM,UAAU,MACb,aAAa,CACb,QAAQ,MAAM,EAAE,uBAAuB,aAAa;AACvD,KAAI,QAAQ,WAAW,EAAG,QAAO;CAEjC,MAAM,8BAAc,IAAI,KAA0B;CAClD,eAAe,YAAY,IAAkC;EAC3D,IAAI,MAAM,YAAY,IAAI,GAAG;AAC7B,MAAI,CAAC,KAAK;GACR,MAAM,OAAO,MAAM,IAAI,4BAA4B,GAAG;AACtD,SAAM,IAAI,IAAI,KAAK,KAAK,MAAM,EAAE,GAAG,CAAC;AACpC,eAAY,IAAI,IAAI,IAAI;;AAE1B,SAAO;;AAGT,MAAK,MAAM,KAAK,SAAS;EACvB,MAAM,UAAU,eAAe,EAAE,SAAS,EAAE,UAAU;AACtD,MAAI;AAEF,OAAI,EADQ,MAAM,YAAY,EAAE,sBAAsB,EAC7C,IAAI,EAAE,WAAW,CACxB,OAAM,sBAAsB,KAAK;IAC/B,aAAa;IACb,aAAa,EAAE;IACf,QAAQ;IACT,CAAC;UAEE;AACN,SAAM,sBAAsB,KAAK;IAC/B,aAAa;IACb,aAAa,EAAE;IACf,QAAQ;IACT,CAAC;;AAGJ,OAAK,MAAM,SAAS,EAAE,YAAY,EAAE,CAClC,KAAI,CAAC,OAAO,IAAI,MAAM,KAAK,CACzB,OAAM,sBAAsB,KAAK;GAC/B,aAAa;GACb,aAAa,MAAM;GACnB,MAAM,MAAM;GACZ,QAAQ,MAAM,MAAM;GACrB,CAAC;;AAKR,QAAO;;;;;;;;;;;;;;;;;;;;AC9BT,eAAsB,mBAAmB,SAKhB;CACvB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAIxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI,CAAC,aAAa,EAAE,EAAE;CAE3E,eAAe,SACb,OACA,IACc;AACd,MAAI;AACF,UAAO,MAAM,IAAI;WACV,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,oBAAoB,MAAM,IAAI,MAAM;AACjD,UAAO,EAAE;;;CAIb,MAAM,QAAQ,MAAM,QAAQ,IAC1B,gBAAgB,KAAK,MACnB,SAAS,GAAG,EAAE,MAAM,cAAc,EAAE,SAAS,IAAI,CAAC,CACnD,CACF;CAED,MAAM,cACJ,sBAAsB,OAAO,CAAC,SAAS,IACnC,MAAM,SAAS,6BACb,IAAI,0BAA0B,CAC/B,GACD,EAAE;CAER,MAAM,iBACJ,eAAe,OAAO,CAAC,SAAS,KAAK,QAAQ,UACzC,MAAM,SAAS,sBAAsB,IAAI,wBAAwB,CAAC,GAClE,EAAE;CAER,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CAEjD,MAAM,6BAAa,IAAI,KAA4B;CACnD,SAAS,MAAM,GAAwB;EACrC,MAAM,WAAW,WAAW,IAAI,EAAE,KAAK;AACvC,MAAI,CAAC,UAAU;AACb,cAAW,IAAI,EAAE,MAAM,EAAE;AACzB;;AAEF,WAAS,sBAAsB,KAAK,GAAG,EAAE,sBAAsB;AAC/D,WAAS,kBAAkB,KAAK,GAAG,EAAE,kBAAkB;AACvD,WAAS,WAAW,KAAK,GAAG,EAAE,WAAW;;AAG3C,MAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;EAC/C,MAAM,eAAe,iCACnB,QACA,WACA,cACA,KACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY;GAAS,CACxC;AACD,kBAAgB,SAAS,KAAK,MAAM;GAClC,MAAM,YAAY,IAAI,cAAc,aAAa;AACjD,OAAI,UAAU,WAAW,EAAG;AAC5B,SACE,IAAI,MAAM;IACR;IACA,KAAK,MAAM;IACX,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACD,CAAC,CACH;IACD;;CAGJ,MAAM,oBAAoB,sBAAsB,OAAO;AACvD,KAAI,kBAAkB,SAAS,EAC7B,OACE,uBACE,aACA,mBACA,KACA,OAAO,QACP,MACD,CACF;CAGH,MAAM,eAAe,cAAc,OAAO;AAC1C,KAAI,aAAa,SAAS,KAAK,QAAQ,SAAS;EAC9C,MAAMC,yBAA2B,IAAI,KAAK;EAC1C,MAAM,QAAQ,MAAM,KAAK,IAAI,IAAI,aAAa,KAAK,MAAM,EAAE,OAAO,CAAC,CAAC;AACpE,OAAK,MAAM,UAAU,OAAO;GAC1B,MAAM,OAAO,MAAM,SAAS,qBAAqB,OAAO,UACtD,IAAI,qBAAqB,OAAO,CACjC;AACD,UAAO,IAAI,QAAQ,KAAK;;AAE1B,QAAM,eAAe,QAAQ,cAAc,OAAO,QAAQ,KAAK,MAAM,CAAC;;CAGxE,MAAM,mBAAmB,eAAe,OAAO;AAC/C,KAAI,iBAAiB,SAAS,KAAK,QAAQ,QACzC,OACE,gBACE,gBACA,kBACA,KACA,OAAO,QACP,MACD,CACF;AAGH,KAAI,MAAM,aAAa,CAAC,SAAS,GAAG;EAClC,MAAM,WAAW,gBAAgB,WAAW,MAAM,EAAE,SAAS,KAAK;AAKlE,QAAM,MAAM,YAAY,OAAO,KAH7B,YAAY,IACP,MAAM,YACP,EAAE,CACkC,CAAC;;CAG7C,MAAM,oBAAoB,MAAM,kBAC9B,KACA,QACA,SACA,WACA,QACA,OACA,KACA,EAAE,SAAS,CACZ;AACD,KAAI,kBAAmB,OAAM,kBAAkB;CAE/C,MAAM,qBAAqB,MAAM,aAC/B,KACA,QACA,SACA,WACA,QACA,OACA,KACA,EAAE,SAAS,CACZ;AACD,KAAI,mBAAoB,OAAM,mBAAmB;CAEjD,MAAM,gBAAgB,MAAM,wBAC1B,SACA,QACA,KACA,SACA,WACA,QACA,OACA,KACA,QACD;AACD,KAAI,cAAc,SAAS,EAMzB,OAAM,aALgB,MAAM,iBAAiB;EAC3C,SAAS;EACT,OAAO,QAAQ,gBAAgB,mBAAmB,EAAE,CAAC;EACrD;EACD,CAAC,CAC+B,CAAC;CAGpC,MAAM,mBAAmB,MAAM,KAAK,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO;EACnE,GAAG;EACH,uBAAuB,OAAO,EAAE,sBAAsB;EACtD,mBAAmB,OAAO,EAAE,kBAAkB;EAC9C,YAAY,OAAO,EAAE,WAAW;EACjC,EAAE;AAEH,QAAO;EACL,UAAU,OAAO,OAAO;EACxB;EACA,8BAAa,IAAI,MAAM,EAAC,aAAa;EACrC,WAAW;EACX,UAAU,eAAe,iBAAiB;EAC3C;;AAGH,SAAS,OACP,MACK;CACL,MAAM,uBAAO,IAAI,KAAa;CAC9B,MAAMC,MAAW,EAAE;AACnB,MAAK,MAAM,QAAQ,MAAM;EACvB,MAAM,MAAM,GAAG,KAAK,YAAY,IAAI,KAAK;AACzC,MAAI,KAAK,IAAI,IAAI,CAAE;AACnB,OAAK,IAAI,IAAI;AACb,MAAI,KAAK,KAAK;;AAEhB,QAAO;;;;;;AAOT,eAAsB,SAAS,SAIX;CAClB,MAAM,SAAS,MAAM,mBAAmB;EACtC,KAAK,QAAQ;EACb,YAAY,QAAQ;EACrB,CAAC;AAEF,KAAI,QAAQ,KACV,SAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC;KAE5C,kBAAiB,OAAO;AAG1B,QAAO,OAAO,WAAW,IAAI;;AAG/B,SAAS,iBAAiB,QAA2B;AACnD,SAAQ,IACN,2BAA2B,OAAO,SAAS,QAAQ,OAAO,IAAI,IAC/D;AACD,KAAI,OAAO,UAAU,WAAW,GAAG;AACjC,UAAQ,IAAI,iDAAiD;AAC7D;;AAEF,MAAK,MAAM,KAAK,OAAO,WAAW;EAChC,MAAM,QACJ,EAAE,sBAAsB,SACxB,EAAE,kBAAkB,SACpB,EAAE,WAAW;AACf,UAAQ,IAAI,GAAG,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,UAAU;AACpD,MAAI,UAAU,GAAG;AACf,WAAQ,IAAI,OAAO;AACnB;;AAEF,MAAI,EAAE,sBAAsB,QAAQ;AAClC,WAAQ,IAAI,qDAAqD;AACjE,QAAK,MAAM,KAAK,EAAE,sBAChB,SAAQ,IAAI,SAAS,EAAE,YAAY,MAAM,EAAE,cAAc,OAAO,EAAE,KAAK,GAAG;;AAG9E,MAAI,EAAE,kBAAkB,QAAQ;AAC9B,WAAQ,IAAI,4CAA4C;AACxD,QAAK,MAAM,KAAK,EAAE,kBAChB,SAAQ,IAAI,SAAS,EAAE,YAAY,MAAM,EAAE,cAAc,OAAO,EAAE,KAAK,GAAG;;AAG9E,MAAI,EAAE,WAAW,QAAQ;AACvB,WAAQ,IAAI,oCAAoC;AAChD,QAAK,MAAM,KAAK,EAAE,WAChB,SAAQ,IAAI,SAAS,EAAE,YAAY,MAAM,EAAE,cAAc;;;AAI/D,SAAQ,IAAI,OAAO,WAAW,wBAAwB,gBAAgB;;AAGxE,MAAMC,kBAA0C,OAAO,YACrD,gBAAgB,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAC9C;AAED,SAAS,SAAS,MAAqC;AACrD,KAAI,gBAAgB,MAAO,QAAO,gBAAgB;AAClD,SAAQ,MAAR;EACE,KAAK,qBACH,QAAO;EACT,KAAK,cACH,QAAO;EACT,KAAK,aACH,QAAO;EACT,KAAK,SACH,QAAO;EACT,KAAK,eACH,QAAO;EACT,KAAK,gBACH,QAAO;EACT,KAAK,SACH,QAAO;EACT,QACE,QAAO;;;AAIb,SAAS,OAAO,MAAuB;AACrC,QAAO,OAAO,KAAK,KAAK,KAAK;;AAG/B,eAAe,wBACb,SACA,QACA,KACA,SACA,WACA,QACA,OACA,KACA,SAOA;CACA,MAAMC,MAID,EAAE;AAEP,MAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;EAW/C,MAAM,WAAW,yBAVF,iCACb,QACA,WACA,cACA,KACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY;GAAS,CACxC,CACgD;AACjD,MAAI,SAAS,WAAW,EAAG;EAE3B,MAAM,eAAe,0BACnB,QACA,WACA,cACA,KACA,OACD;EACD,IAAIC,oBAA8B,EAAE;AACpC,MAAI,QAAQ,QACV,KAAI;AACF,uBAAoB,MAAM,IAAI,mBAAmB,aAAa;UACxD;AACN,uBAAoB,EAAE;;AAI1B,MAAI,KAAK;GAAE;GAAW;GAAU;GAAmB,CAAC;;AAGtD,QAAO"}

package/dist/{drift-RM0vq3uF.mjs → drift-DENAf1Oe.mjs}

@@ -1,8 +1,8 @@
 import "./registry-BlHEOKlN.mjs";
 import "./r2S3EmptyBucket-B9_pHfvB.mjs";
-import { n as runDrift, t as computeDriftReport } from "./drift-Bp-P13-B.mjs";
+import { n as runDrift, t as computeDriftReport } from "./drift-B5y9LF5X.mjs";
 import "./logpush-job-GqVKG_HI.mjs";
 import "./worker-route-CqBDvjgo.mjs";
-import "./workers-DAv1ze8_.mjs";
+import "./workers-y9RTOzbC.mjs";
 
 export { runDrift };

package/dist/index.d.mts

@@ -6419,6 +6419,24 @@ interface WorkerSecretsConfig {
    */
   required: string[];
 }
+/**
+ * Pre-deploy build step for a worker (e.g. SPA asset compilation via
+ * `vite build`). When set, `tamer deploy` spawns `command` in the worker's
+ * `path` directory with the worker's resolved `vars` (references resolved
+ * against state for the target env) as environment variables, so compile-time
+ * substitution tools (Vite `VITE_*`, esbuild `define`, etc.) read values
+ * authored in Tamer config directly — no `.env` file or codegen step.
+ * See [docs/spa-build-config.md](../docs/spa-build-config.md).
+ */
+interface WorkerBuildConfig {
+  /**
+   * Shell command run in the worker's `path` directory after `wrangler.json`
+   * is written but before `wrangler types` / `wrangler deploy`. The worker's
+   * resolved `vars` are passed as environment variables (merged onto
+   * `process.env`).
+   */
+  command: string;
+}
 type ManagedFields = "name" | "account_id" | "d1_databases" | "r2_buckets" | "kv_namespaces" | "queues" | "hyperdrive" | "vectorize";
 type BaseWranglerFields = Omit<WranglerConfig, ManagedFields>;
 interface EnvOverride extends Omit<BaseWranglerFields, "vars" | "r2_buckets"> {
@@ -6437,6 +6455,8 @@ interface EnvOverride extends Omit<BaseWranglerFields, "vars" | "r2_buckets"> {
    * `tamerRoutes`. Omit or leave empty for no pruning.
    */
   tamerStaleRouteSweepZones?: string[];
+  /** Per-env override for the worker's pre-deploy {@link WorkerBuildConfig}. */
+  build?: WorkerBuildConfig;
 }
 interface WorkerConfig extends Omit<BaseWranglerFields, "vars" | "r2_buckets" | "env" | "local"> {
   path?: string;
@@ -6472,6 +6492,8 @@ interface WorkerConfig extends Omit<BaseWranglerFields, "vars" | "r2_buckets" |
    * Absent block means no declared secrets for this worker.
    */
   secrets?: WorkerSecretsConfig;
+  /** Pre-deploy build step (e.g. `vite build` for SPA workers). See {@link WorkerBuildConfig}. */
+  build?: WorkerBuildConfig;
   local?: EnvOverride;
   env?: Record<string, EnvOverride>;
 }
@@ -7100,5 +7122,5 @@ declare function materializeCloudflareBindings(value: unknown): unknown;
  */
 declare function defineCloudflareConfig(config: unknown): CfiConfig;
 //#endregion
-export { AIGatewayResourceConfig, AIGatewayStateEntry, CfBinding, type CfBindingSpec, type CfLogpushPipelinesField, type CfResourceField, type CfResourceKind, CfiConfig, CfiConfigMulti, CfiConfigSingle, CfiOperationName, CfiOperationRecord, CfiOperationStatus, CfiStackConfig, CfiStackMeta, CfiStackOutputValue, CfiState, CloudflareNameContext, CloudflareNameFn, CodegenConfig, D1ResourceConfig, D1StateEntry, DispatchNamespaceResourceConfig, DispatchNamespaceStateEntry, DnsRecordResourceConfig, DnsRecordStateEntry, EnvOverride, HyperdriveOriginSpec, HyperdriveResourceConfig, HyperdriveStateEntry, KVResourceConfig, KVStateEntry, LogpushJobPipelinesAutoDestination, LogpushJobPipelinesIngestDestination, LogpushJobR2Destination, LogpushJobResourceConfig, LogpushJobStateEntry, LogpushPipelinesStateEntry, LogpushWorkersTraceDataset, NamingConventions, PipelineResourceConfig, PipelineStateEntry, ProvisioningStatus, QueueResourceConfig, QueueStateEntry, R2ResourceConfig, R2StateEntry, type RawConfig, type RawEnvironment, ResourceStatus, RouteResourceConfig, SecretStateEntry, SecretsStoreResourceConfig, SecretsStoreSecretBinding, SecretsStoreStateEntry, ShardRegistryCodegenConfig, ShardRegistryEntryV1, ShardRegistryV1, StateEntry, TAMER_OVERLAY_ENV_KEY, TamerResolvableString, TenantD1ShardRef, TenantMeta, TenantStateEntry, TenantStatus, VectorizeResourceConfig, VectorizeStateEntry, WorkerConfig, WorkerResources, WorkerRouteStateEntry, WorkerSecretsConfig, WorkerStatus, WorkflowResourceConfig, WorkflowStateEntry, type WranglerConfig, type WranglerD1Database, type WranglerEnvironment, type WranglerKVNamespace, type WranglerR2Bucket, WranglerR2BucketResolvable, cf, cfBindingSpecToTamerRef, defineCloudflareConfig, defineConfig, defineProjectOverlay, defineWorker, getDispatchNamespaces, getDnsRecords, getLogpushJobs, isCfBinding, materializeCloudflareBindings, materializeTamerResolvable, materializeVars };
+export { AIGatewayResourceConfig, AIGatewayStateEntry, CfBinding, type CfBindingSpec, type CfLogpushPipelinesField, type CfResourceField, type CfResourceKind, CfiConfig, CfiConfigMulti, CfiConfigSingle, CfiOperationName, CfiOperationRecord, CfiOperationStatus, CfiStackConfig, CfiStackMeta, CfiStackOutputValue, CfiState, CloudflareNameContext, CloudflareNameFn, CodegenConfig, D1ResourceConfig, D1StateEntry, DispatchNamespaceResourceConfig, DispatchNamespaceStateEntry, DnsRecordResourceConfig, DnsRecordStateEntry, EnvOverride, HyperdriveOriginSpec, HyperdriveResourceConfig, HyperdriveStateEntry, KVResourceConfig, KVStateEntry, LogpushJobPipelinesAutoDestination, LogpushJobPipelinesIngestDestination, LogpushJobR2Destination, LogpushJobResourceConfig, LogpushJobStateEntry, LogpushPipelinesStateEntry, LogpushWorkersTraceDataset, NamingConventions, PipelineResourceConfig, PipelineStateEntry, ProvisioningStatus, QueueResourceConfig, QueueStateEntry, R2ResourceConfig, R2StateEntry, type RawConfig, type RawEnvironment, ResourceStatus, RouteResourceConfig, SecretStateEntry, SecretsStoreResourceConfig, SecretsStoreSecretBinding, SecretsStoreStateEntry, ShardRegistryCodegenConfig, ShardRegistryEntryV1, ShardRegistryV1, StateEntry, TAMER_OVERLAY_ENV_KEY, TamerResolvableString, TenantD1ShardRef, TenantMeta, TenantStateEntry, TenantStatus, VectorizeResourceConfig, VectorizeStateEntry, WorkerBuildConfig, WorkerConfig, WorkerResources, WorkerRouteStateEntry, WorkerSecretsConfig, WorkerStatus, WorkflowResourceConfig, WorkflowStateEntry, type WranglerConfig, type WranglerD1Database, type WranglerEnvironment, type WranglerKVNamespace, type WranglerR2Bucket, WranglerR2BucketResolvable, cf, cfBindingSpecToTamerRef, defineCloudflareConfig, defineConfig, defineProjectOverlay, defineWorker, getDispatchNamespaces, getDnsRecords, getLogpushJobs, isCfBinding, materializeCloudflareBindings, materializeTamerResolvable, materializeVars };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/generated/wrangler-types.generated.ts","../src/generated/wrangler-types.ts","../src/dx/cloudflare-bindings.ts","../src/types.ts","../src/dx/normalize.ts","../src/dx/index.ts"],"sourcesContent":[],"mappings":";;AASA;;;;;AAOA;AAYA;AAaY,KAhCA,KAAA,GAgCA,MAAA,GAhCiB,WAgCI,GAhCU,aAgCV,GAhC0B,iBAgC1B;AA+mEjC;;;;;;AAiHU,KAzvEE,oBAAA,GAyvEF,UAAA,GAAA,UAAA,GAAA,cAAA,GAAA,MAAA,GAAA,MAAA,GAAA,cAAA,GAAA,mBAAA;;;;;AAiOkB,KA98EhB,IAAA,GA88EgB,MAAA,GAAA,MAAA,GAAA,OAAA,GAAA,IAAA,GAz8ExB,IAy8EwB,EAAA,GAAA;EA2BZ,CAAA,CAAA,EAAA,MAAA,CAAA,EAl+EG,IAk+EH;CAOA;;;;;AAozBF,KAvxGF,qBAAA,GAuxGE;EAOA;;;EAoiBe,IAAA,EAAA,MAAA;EAAqB;AAyOlD;AASA;EASiB,UAAA,EAAA,MAAA;EAYA;AA+BjB;AAWA;EAsDW,WAAA,CAAA,EAAA,MAAA;EAMQ;;;EAoBL,WAAA,CAAA,EAAA,MAAA;CAiCL,EAAA;;;;;;;;;UArnEQ,cAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAsDN;;;;;;mBAMQ,cAAc,gBAAgB;;;;;;;;;;;;;;;;;;;;eAoBlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAiCL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA6MI;oBACM;aACP;YACD;;;;;;;;;;;;;;;;;4BAiBgB;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2BZ;;;;;;;gBAOA;;;;;;;;;;;;;;;;;;;iBAmBC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA2gBI;;;;;;+BAMU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAqPL;;;;;;;;;;;;;;;;;;;;;;;;;;;cA2BZ;;;;;;;cAOA;;;;;;;;;;;;;;;;;;;eAmBC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA2gBI;;;;;;6BAMU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAyOZ,WAAA;;;;;;;;;UASA,aAAA;;;;;;;;;UASA,iBAAA;;;;;;;;;;;;UAYA,sBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA+BA,IAAA;QACT;;;;;;;;;;UAUS,oDAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAsDN;;;;;;mBAMQ,cAAc,gBAAgB;;;;;;;;;;;;;;;;;;;;cAoBnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAiCL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA6MK;oBACM;aACP;YACD;;;;;;;;;;;;;;;;;4BAiBgB;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2BZ;;;;;;;gBAOA;;;;;;;;;;;;;;;;;;;iBAmBC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA2gBI;;;;;;+BAMU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA0Od,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAyCA,YAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA0GA,YAAA;;;;;;;;;;;;;;UAcA,qBAAA;;;;;;;;;;UAUA,mBAAA;;;;;;;;;;;;;;UAcA,SAAA;;;;;;;;;;;;;iBAaA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAuDN;;;;;;mBAMQ,cAAc,gBAAgB;;;;;;;;;;;;;;;;;;;;eAoBlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAiCL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA6MI;oBACM;aACP;YACD;;;;;;;;;;;;;;;;;4BAiBgB;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2BZ;;;;;;;gBAOA;;;;;;;;;;;;;;;;;;;iBAmBC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA2gBI;;;;;;+BAMU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAqPL;;;;;;;;;;;;;;;;;;;;;;;;;;;cA2BZ;;;;;;;cAOA;;;;;;;;;;;;;;;;;;;eAmBC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA2gBI;;;;;;6BAMU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAiSN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAz8OvB;AAYY,KCVA,cAAA,GAAiB,SDiBN;AAMvB;AA+mEiB,KCnoEL,mBAAA,GAAsB,cDmoEH;;AA4DZ,KC5rEP,kBAAA,GAAqB,WD4rEd,CC5rE0B,SD4rE1B,CAAA,cAAA,CAAA,CAAA,CAAA,MAAA,CAAA;;AAA8B,KCzrErC,gBAAA,GAAmB,WDyrEkB,CCzrEN,SDyrEM,CAAA,YAAA,CAAA,CAAA,CAAA,MAAA,CAAA;;AAqDvC,KC3uEE,mBAAA,GAAsB,WD2uExB,CC3uEoC,SD2uEpC,CAAA,eAAA,CAAA,CAAA,CAAA,MAAA,CAAA;;;;AAhwEV;;;;;AAOA;AAYY,KEpBA,cAAA,GF2BO,IAAA,GAAI,IAAA,GAAA,IAAA,GAAA,OAAA,GAAA,YAAA,GAAA,WAAA,GAAA,YAAA,GAAA,UAAA,GAAA,UAAA,GAAA,cAAA;AAMX,KErBA,eAAA,GFqBqB,MAAA,GAAA,IAAA,GAAA,SAAA;AA+mEhB,KEloEL,uBAAA,GFkoEmB,4BAAA,GAAA,sCAAA,GAAA,2BAAA,GAAA,MAAA,GAAA,IAAA,GAAA,eAAA,GAAA,yBAAA,GAAA,mBAAA;AAsDpB,KE9qEC,aAAA,GF8qED;EAMQ,CAAA,EAAA,UAAA;EAAc,IAAA,EEnrEN,cFmrEM;EAAgB,OAAA,EAAA,MAAA;EAoBlC,KAAA,EEvsEoD,eFusEpD;CAiCL,GAAA;EA6MI,CAAA,EAAA,oBAAA;EACM,OAAA,EAAA,MAAA;EACP,KAAA,EAAA,MAAA,GAAA,IAAA;CACD,GAAA;EAiBgB,CAAA,EAAA,QAAA;EA2BZ,SAAA,EAAA,MAAA;EAOA,KAAA,EAAA,MAAA;CAmBC,GAAA;EA2gBI,CAAA,EAAA,mBAAA;EAMU,OAAA,EAAA,MAAA;EAqPL,KAAA,EEjwG4B,uBFiwG5B;CA2BZ,GAAA;EAOA,CAAA,EAAA,QAAA;EAmBC,OAAA,EAAA,OAAA;EA2gBI,KAAA,EAAA,YAAA;CAMU,GAAA;EAAqB,CAAA,EAAA,QAAA;EAyOjC,KAAA,EAAA,MAAA;EASA,MAAA,EAAA,MAAA;AASjB,CAAA;AAYA;AA+BA;AAWA;AAsDW,cEvqIE,SAAA,CFuqIF;EAMQ,SAAA,IAAA,EE5qIiB,aF4qIjB;EAAc,WAAA,CAAA,IAAA,EE5qIG,aF4qIH;EAAgB,WAAA,CAAA,CAAA,EAAA,MAAA;;AAqDxC,iBE1tIO,uBAAA,CF0tIP,IAAA,EE1tIqC,aF0tIrC,CAAA,EAAA,MAAA;;;;;;;;;;;;AAihCQ,cE7rKJ,EF6rKmB,EAAA;EAyCf,SAAA,EAAA,EAAA,CAAA,OAAY,EAAA,MAAA,EAAA,GAAA;IA0GZ,SAAA,IAAY,EEv2Kb,SFu2Ka;IAcZ,SAAA,EAAA,EEl3KH,SFk3KwB;IAUrB,SAAA,OAAA,EEz3KE,SFy3KiB;EAcnB,CAAA;EAaA,SAAA,EAAA,EAAA,CAAA,OAAA,EAAA,MAAA,EAAA,GAAA;IAuDN,SAAA,IAAA,EEj9KK,SFi9KL;IAMQ,SAAA,EAAA,EEp9KL,SFo9KK;IAAc,SAAA,OAAA,EEj9Kd,SFi9Kc;EAAgB,CAAA;EAoBlC,SAAA,EAAA,EAAA,CAAA,OAAA,EAAA,MAAA,EAAA,GAAA;IAiCL,SAAA,IAAA,EE5gLM,SF4gLN;IA6MI,SAAA,EAAA,EEttLA,SFstLA;IACM,SAAA,OAAA,EEptLD,SFotLC;EACP,CAAA;EACD,SAAA,KAAA,EAAA,CAAA,OAAA,EAAA,MAAA,EAAA,GAAA;IAiBgB,SAAA,IAAA,EE7uLZ,SF6uLY;IA2BZ,SAAA,EAAA,EErwLF,SFqwLE;IAOA,SAAA,OAAA,EEzwLG,SFywLH;EAmBC,CAAA;EA2gBI,SAAA,UAAA,EAAA,CAAA,OAAA,EAAA,MAAA,EAAA,GAAA;IAMU,SAAA,IAAA,EEnzMf,SFmzMe;IAqPL,SAAA,EAAA,EEriNZ,SFqiNY;IA2BZ,SAAA,OAAA,EE7jNK,SF6jNL;EAOA,CAAA;EAmBC,SAAA,SAAA,EAAA,CAAA,OAAA,EAAA,MAAA,EAAA,GAAA;IA2gBI,SAAA,IAAA,EExmOH,SFwmOG;IAMU,SAAA,EAAA,EE3mOf,SF2mOe;IAiSN,SAAA,OAAA,EEz4OJ,SFy4OI;EAAmB,CAAA;;mBE/4O1B;iBAGF;ID3DF,SAAA,OAAc,EC8DP,SD9DU;EAGjB,CAAA;EAGA,SAAA,QAAA,EAAA,CAAA,OAAkB,EAAA,MAAe,EAAA,GAAA;IAGjC,SAAA,IAAA,EC+CI,SD/CY;IAGhB,SAAA,EAAA,EC+CE,SD/CiB;sBCkDZ;;;IAxEP,SAAA,IAAc,EAkEV,SAlEU;IAYd,SAAA,EAAA,EAyDE,SAzDa;IAEf,SAAA,OAAA,EA0DO,SA1DgB;EAUvB,CAAA;EACe,SAAA,WAAA,EAAA,CAAA,OAAA,EAAA,MAAA,EAAA,GAAA;IAAwC,SAAA,IAAA,EAyCnD,SAzCmD;IAGb,SAAA,EAAA,EAyCxC,SAzCwC;IAAuB,SAAA,OAAA,EA4C1D,SA5C0D;EAOhE,CAAA;EAQG,SAAA,iBAAuB,EAAA,CAAA,OAAA,EAAO,MAAA,EAAA,GAAA;IA8CjC,SAmFH,IAAA,EAtEM,SAsEN;IA1GM,SAAA,EAAA,EAuCF,SAvCE;EAGF,CAAA;EAGK;EANH,SAAA,MAAA,EAAA,CAAA,SAAA,EAAA,MAAA,EAAA,GAAA;IAGF,SAAA,IAAA,EA2CE,SA3CF;EAGK,CAAA;EANH,SAAA,gBAAA,EAAA,CAAA,OAAA,EAAA,MAAA,EAAA,GAAA;IAGF,SAAA,sBAAA,EAiDoB,SAjDpB;IAGK,SAAA,+BAAA,EAqDwB,SArDxB;IANH,SAAA,sBAAA,EAkEkB,SAlElB;IAGF,SAAA,YAAA,EAsEU,SAtEV;IAGK,SAAA,UAAA,EAsEG,SAtEH;IANH;IAGF,SAAA,YAAA,EA6EU,SA7EV;IAGK;IANH,SAAA,qBAAA,EAoFiB,SApFjB;IAGF;IAGK,SAAA,gBAAA,EAsFS,SAtFT;EANH,CAAA;EAGF,SAAA,KAAA,EAAA;IAGK,SAAA,SAAA,EA4FE,SA5FF;EANH,CAAA;EAGF;EAGK,SAAA,MAAA,EAAA,CAAA,KAAA,EAAA,MAAA,EAAA,MAAA,EAAA,MAAA,EAAA,GAkGqB,SAlGrB;CANH;AAGF,iBAyGE,WAAA,CAzGF,CAAA,EAAA,OAAA,CAAA,EAAA,CAAA,IAyGgC,SAzGhC;;;;;;AF7Dd;AAYA;AAaY,KG5BA,qBAAA,GH4BqB,MAAA,GG5BY,SH4BZ;AA+mEjC;AAsDW,UG9rEM,qBAAA,CH8rEN;EAMQ;EAAc,SAAA,CAAA,EAAA,MAAA;;;;;;;;AAsRL,KG/8EhB,gBAAA,GH+8EgB,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,EAAA,MAAA,EAAA,GAAA,CAAA,EG58EpB,qBH48EoB,EAAA,GAAA,MAAA;;AAkCZ,KG1+EJ,0BAAA,GAA6B,IH0+EzB,CGz+Ed,gBHy+Ec,EAAA,aAAA,CAAA,GAAA;EAmBC,WAAA,CAAA,EGz/ED,qBHy/EC;CA2gBI;;;;;;AA2zBF,UGrzHF,UAAA,CHqzHE;EAMU,EAAA,EAAA,MAAA;EAAqB,IAAA,EAAA,MAAA;EAyOjC,IAAA,EAAA,MAAA;EASA;AASjB;AAYA;AA+BA;AAWA;;;;;;;;;;;;;;;EAk5BqB,QAAA,CAAA,EAAA,MAAA,EAAA;EAMU;;AA0O/B;AAyCA;AA0GA;AAcA;AAUA;AAcA;;;;EA0EiC,aAAA,CAAA,EAAA,MAAA,EAAA;EAAgB;;;;;;;;;;;;;EAilCvB,mBAAA,CAAA,EAAA,MAAA;;;;;;;;UGtgNT,gBAAA;;;EF1FL,IAAA,EAAA,QAAA,GAAc,SAAA;EAGd;AAGZ;AAGA;AAGA;mBEsFmB;;;AD5GnB;AAYA;AAEA;AAUA;;;EAIsD,SAAA,CAAA,EAAA,SAAA,GAAA,UAAA;EAAuB;AAO7E;AAQA;AA8CA;;EApBc,YAAA,CAAA,ECsDG,qBDtDH;EAGK;;;;EANH,OAAA,CAAA,EAAA,MAAA;EAGF;;;;EAGK,SAAA,CAAA,EAAA,MAAA;EANH;;;EAAA,YAAA,CAAA,EAAA,MAAA;EAGF;EAGK,SAAA,CAAA,EAAA,MAAA,EAAA;EANH;EAGF,cAAA,CAAA,EAAA,MAAA,EAAA;EAGK;EANH,OAAA,CAAA,EAAA,OAAA;EAGF,aAAA,CAAA,EAAA,MAAA;EAGK,eAAA,CAAA,EAAA,MAAA;EANH;;;;;;;;EA8CA,iBAAA,CAAA,EAAA,OAAA;;;AAoBkB,UC0BjB,oBAAA,CD1BiB;EAOV;EAGF,EAAA,EAAA,MAAA;EAIE;EAIS,IAAA,EAAA,MAAA;EAQL;EAMP,OAAA,EAAA,MAAA;EAMmB;EAAA,YAAA,EAAA,MAAA;EAIxB,SAAA,CAAA,EAAA,MAAW;;;;ECzKf,SAAA,CAAA,EAAA,MAAA,EAAA;AAGZ;AAWA;AAOY,UAqJK,eAAA,CArJqB;EACpC,OAAA,EAAA,CAAA;EADuC,MAAA,EAuJ/B,oBAvJ+B,EAAA;;;AAcxB,UA6IA,0BAAA,CA7IU;EA4DV;AA0DjB;AAiBA;AAMA;EAYiB,MAAA,CAAA,EAAA,MAAA;EAMA;EAQA,OAAA,CAAA,EAAA,MAAA;EAeA;EAoBA,UAAA,CAAA,EAAA,MAAA;AA6BjB;AAwBiB,UAtGA,aAAA,CAsGuB;EAmCvB;EAmBA,aAAA,CAAA,EA1JC,0BA0JmB;AA6BrC;AA0DA;AAMiB,UAnPA,gBAAA,CAmPuB;EAoBvB,WAAA,EAAA,MAAA;EAwBA;EAkCA,cAAA,CAAA,EA9TE,gBA8TsB;EAE9B;EAOJ,OAAA,CAAA,EAAA,MAAA;;AAYW,UA9UD,gBAAA,CA8UC;EAAkC,WAAA,EAAA,MAAA;EA0CnC;EAuEA,cAAA,CAAA,EA5bE,gBA4bF;EAWA;EACV,OAAA,CAAA,EAAA,MAAA;;;;;;;;;AAiBW,UA7cD,mBAAA,CA6cC;EASM,WAAA,EAAA,MAAA;EAAyB;EAgBhC,cAAA,CAAA,EAneE,gBAmewB;EAa1B;EAwBA,OAAA,CAAA,EAAA,MAAA;EAsCA;AAShB;AAIiB;;EAS6B,YAAA,CAAA,EAAA,OAAA;;;AAE/C;;;;;;AAAqC,UArjBpB,wBAAA,CAqjBoB;EAAI,WAAA,EAAA,MAAA;EAqBxB;EACf,cAAA,CAAA,EAxkBiB,gBAwkBjB;EAKY;EAEC,OAAA,CAAA,EAAA,MAAA;EAEC;EAMN,MAAA,EAnlBA,oBAmlBA;EACc;EAAf,OAAA,CAAA,EAAA;IAmBG,QAAA,CAAA,EAAA,OAAA;IACF,OAAA,CAAA,EAAA,MAAA;IACa,sBAAA,CAAA,EAAA,MAAA;EAAf,CAAA;EAtC8B;EAAI,IAAA,CAAA,EAAA;IAoDzB,iBAAc,CAAA,EAAA,MAAA;IAarB,mBAAa,CAAA,EAAA,MAAA;EACb,CAAA;EAUC;EAED,qBAAA,CAAA,EAAA,MAAA;;;;;;;;AAwDV;AAMA;;AACW,UA1rBM,uBAAA,CA0rBN;EAD6B,WAAA,EAAA,MAAA;EAAa;EAUzC,cAAS,CAAA,EAhsBF,gBAgsBK;EAiBR;EAQH,OAAA,CAAA,EAAA,MAAA;EAcG;EAEJ,UAAA,EAAA,MAAA;EACF;EAAa,MAAA,EAAA,QAAA,GAAA,WAAA,GAAA,aAAA;EAAI;EAAmB,WAAA,CAAA,EAAA,MAAA;;;AAC9C;;;;;AA8BA;AAIA;AAMA;AAIA;AAMiB,UAxwBA,uBAAA,CAwwBY;EAcZ,WAAA,EAAA,MAAY;EAUZ;EAUA,cAAA,CAAA,EAvyBE,gBAuyBa;EAaf;EAeA,QAAA,CAAA,EAAA,MAAA;EAiBA;EAmBA,uBAAkB,CAAA,EAAA,OAAA;EAiBlB;EAsBA,WAAA,CAAA,EAAA,OAAA;EAaA;EAkCA,cAAA,CAAA,EAAA,OAAA;EASA;EAgBA,oBAAA,CAAA,EAAA,MAA0B;EA6C1B;EAsBA,iBAAA,CAAA,EAAgB,MAAA;EAYrB;EACR,qBAAA,CAAA,EAAA,OAAA,GAAA,SAAA;;;;;;;;;;;;;;;;;AAkBQ,UAxhCK,sBAAA,CAwhCa;EAQb,WAAA,EAAA,MAAgB;EAUhB;EAgBA,cAAA,CAAY,EAvjCV,gBAujCU;EAUjB;AAUZ;AAEA;AAUA;;EAKa,GAAA,EAAA,MAAA;EAIc;;;;;EAYT,OAAA,CAAA,EAAA,MAAA;;;AAaD,UAzmCA,oBAAA,CAymCmB;EAWxB,MAAA,EAAA,UAAc,GAAA,YAAA,GAAA,OAAA;EAET,IAAA,EAAA,MAAA;EAIP,IAAA,CAAA,EAAA,MAAA;EAKE,QAAA,EAAA,MAAA;EAJN,IAAA,EAAA,MAAA;EAM+C;;;AAIrD;EA2BiB,QAAA,EAAA,MAAA,GAAA;;;;ECjgDD,gBAAA,CAAA,EAAA,MAAA;EAIA,oBAAe,CAAA,EAAA,MAAA,GAAA;IACR,OAAA,EAAA,MAAA;EAAf,CAAA;;;AAaR;;;;ACMA;;;;;;;;UFsWiB,sBAAA;;;mBAGE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAuDP,0BAAA;;;;;UAMK,uBAAA;;;;;;;;;;;;;;;;;;;UAoBA,oCAAA;;;;;;;;;;;;;;;;;;;;;;;UAwBA,kCAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkCA,wBAAA;;WAEN;;;;;;;OAOJ;;;;;;;oBAOa;;;;;kBAKF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA0CD,uBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAuEA,+BAAA;;;;;;;;;;UAWA,eAAA;OACV;OACA;OACA;WACI;eACI;cACD;cACA;cACA;cACA;;;;;;;;;kBASI;;;;;;;;;wBASM;;;;;;;;;;;;;;;UAgBP,0BAAA;;;mBAGE;;;;;;;;;UAUF,yBAAA;;;;;;;;;;;;;;;;;;;;;;;UAwBA,mBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAsCA,mBAAA;;;;;;;;;;KAaZ,aAAA;KASA,kBAAA,GAAqB,KAAK,gBAAgB;UAE9B,WAAA,SAAoB,KACnC;SAGO,eAAe;;eAET;;;;;;gBAMC;;;;;;;;UASC,YAAA,SAAqB,KACpC;;;cAKY;;eAEC;;gBAEC;;;;;;UAMN;SACD,eAAe;;;;;;;;;;;;;;;;;;;YAmBZ;UACF;QACF,eAAe;;;;;;;;;;;UAcN,cAAA;;;;;;;;;;;;UAaP,aAAA;UACA;;;;;;;;;;WAUC;;UAED;;uBAEa;;;;;;;;;;;;eAYR;;;;;;;gBAOC;;;;;;;;;;;;;;;;;;;;;;;;;;YA0BJ,eAAe;;;;;YAKf;;;UAIK,eAAA,SAAwB;UAC/B;;;;UAKO,cAAA,SAAuB;WAC7B,eAAe;;;;;;;;KASd,SAAA,GAAY,kBAAkB;;;;;;;;;;;;;;iBAiB1B,YAAA,SAAqB,YAAY;;;;;cAQpC;;;;;;;;;;;;;iBAcG,iDAEJ,iCACF,aAAa,IAAI,mBAAmB,wBAAwB;iBACtD,+BAA+B,mCACnC,IACT;;;;;iBA4Ba,YAAA,SAAqB,eAAe;iBAIpC,qBAAA,SACN,YACP;iBAIa,aAAA,SAAsB,YAAY;iBAIlC,cAAA,SAAuB,YAAY;UAMlC,YAAA;;;;;;;;;;;;;UAcA,YAAA;;;;;;;;;UAUA,YAAA;;;;;;;;;UAUA,eAAA;;;;;;;;;;;;UAaA,mBAAA;;;;;;;;;;;;;;UAeA,oBAAA;;;;;;;;;;;;;;;;UAiBA,mBAAA;;;;;;;;;;;;;;;;;;UAmBA,kBAAA;;;;;;;;;;;;;;;;UAiBA,kBAAA;;;;;;;;;;;;;;;;;;;;;;;UAsBA,sBAAA;;;;;;;;;;;;UAaA,mBAAA;;;;;;;;;;;;;;;;;;;;;;UAkCA,2BAAA;;;;;;;;UASA,oBAAA;;;;;;;;;;;;;;;UAgBA,0BAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6CA,qBAAA;;;;;;;;;;;;;;;;;;;;;UAsBA,gBAAA;;;;;;;;;;;KAYL,UAAA,GACR,eACA,eACA,eACA,kBACA,uBACA,sBACA,sBACA,qBACA,qBACA,yBACA,sBACA,8BACA,uBACA,6BACA,wBACA;;KAGQ,kBAAA;UAQK,gBAAA;;;;;;;;;UAUA,gBAAA;;;sBAGK;;;aAGT;;;;;;;;;UAUI,YAAA;;;;;;;;;KAUL,gBAAA;KAUA,kBAAA;UAEK,kBAAA;WACN;UACD;;;;;;;UAQO,QAAA;;;;;aAKJ,eAAe;;;;YAIhB,eAAe;;UAEjB;;;;;;;;iBAQO,eAAe;;kBAEd;;;;;qBAKG;;;;;;;UAQJ,mBAAA;;;;;;;;KAWL,cAAA;UAEK,YAAA;;;;UAIP;MACJ;;;;YAIM;;MAEN;;;YAA+C;;;;UAIpC,YAAA;UACP;;WAEC;;;;;;;;;;;;;;;;;;;;;UAwBM,iBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AH5/CjB;AAA6B,iBILb,0BAAA,CJKa,CAAA,EILiB,qBJKjB,CAAA,EAAA,MAAA;AAAc,iBID3B,eAAA,CJC2B,IAAA,EIAnC,MJAmC,CAAA,MAAA,EIApB,qBJAoB,CAAA,GAAA,SAAA,CAAA,EICxC,MJDwC,CAAA,MAAA,EAAA,MAAA,CAAA,GAAA,SAAA;;;AAO3C;AAYA;AAaA;AA+mEiB,iBIloED,6BAAA,CJkoEe,KAAA,EAAA,OAAA,CAAA,EAAA,OAAA;;;;;;AAxoE/B;AAYA;AAaA;AA+mEA;;AA4DmB,iBKxrEH,sBAAA,CLwrEG,MAAA,EAAA,OAAA,CAAA,EKxrEsC,SLwrEtC"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/generated/wrangler-types.generated.ts","../src/generated/wrangler-types.ts","../src/dx/cloudflare-bindings.ts","../src/types.ts","../src/dx/normalize.ts","../src/dx/index.ts"],"sourcesContent":[],"mappings":";;AASA;;;;;AAOA;AAYA;AAaY,KAhCA,KAAA,GAgCA,MAAA,GAhCiB,WAgCI,GAhCU,aAgCV,GAhC0B,iBAgC1B;AA+mEjC;;;;;;AAiHU,KAzvEE,oBAAA,GAyvEF,UAAA,GAAA,UAAA,GAAA,cAAA,GAAA,MAAA,GAAA,MAAA,GAAA,cAAA,GAAA,mBAAA;;;;;AAiOkB,KA98EhB,IAAA,GA88EgB,MAAA,GAAA,MAAA,GAAA,OAAA,GAAA,IAAA,GAz8ExB,IAy8EwB,EAAA,GAAA;EA2BZ,CAAA,CAAA,EAAA,MAAA,CAAA,EAl+EG,IAk+EH;CAOA;;;;;AAozBF,KAvxGF,qBAAA,GAuxGE;EAOA;;;EAoiBe,IAAA,EAAA,MAAA;EAAqB;AAyOlD;AASA;EASiB,UAAA,EAAA,MAAA;EAYA;AA+BjB;AAWA;EAsDW,WAAA,CAAA,EAAA,MAAA;EAMQ;;;EAoBL,WAAA,CAAA,EAAA,MAAA;CAiCL,EAAA;;;;;;;;;UArnEQ,cAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAsDN;;;;;;mBAMQ,cAAc,gBAAgB;;;;;;;;;;;;;;;;;;;;eAoBlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAiCL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA6MI;oBACM;aACP;YACD;;;;;;;;;;;;;;;;;4BAiBgB;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2BZ;;;;;;;gBAOA;;;;;;;;;;;;;;;;;;;iBAmBC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA2gBI;;;;;;+BAMU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAqPL;;;;;;;;;;;;;;;;;;;;;;;;;;;cA2BZ;;;;;;;cAOA;;;;;;;;;;;;;;;;;;;eAmBC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA2gBI;;;;;;6BAMU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAyOZ,WAAA;;;;;;;;;UASA,aAAA;;;;;;;;;UASA,iBAAA;;;;;;;;;;;;UAYA,sBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA+BA,IAAA;QACT;;;;;;;;;;UAUS,oDAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAsDN;;;;;;mBAMQ,cAAc,gBAAgB;;;;;;;;;;;;;;;;;;;;cAoBnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAiCL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA6MK;oBACM;aACP;YACD;;;;;;;;;;;;;;;;;4BAiBgB;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2BZ;;;;;;;gBAOA;;;;;;;;;;;;;;;;;;;iBAmBC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA2gBI;;;;;;+BAMU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA0Od,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAyCA,YAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA0GA,YAAA;;;;;;;;;;;;;;UAcA,qBAAA;;;;;;;;;;UAUA,mBAAA;;;;;;;;;;;;;;UAcA,SAAA;;;;;;;;;;;;;iBAaA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAuDN;;;;;;mBAMQ,cAAc,gBAAgB;;;;;;;;;;;;;;;;;;;;eAoBlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAiCL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA6MI;oBACM;aACP;YACD;;;;;;;;;;;;;;;;;4BAiBgB;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2BZ;;;;;;;gBAOA;;;;;;;;;;;;;;;;;;;iBAmBC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA2gBI;;;;;;+BAMU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAqPL;;;;;;;;;;;;;;;;;;;;;;;;;;;cA2BZ;;;;;;;cAOA;;;;;;;;;;;;;;;;;;;eAmBC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA2gBI;;;;;;6BAMU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAiSN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAz8OvB;AAYY,KCVA,cAAA,GAAiB,SDiBN;AAMvB;AA+mEiB,KCnoEL,mBAAA,GAAsB,cDmoEH;;AA4DZ,KC5rEP,kBAAA,GAAqB,WD4rEd,CC5rE0B,SD4rE1B,CAAA,cAAA,CAAA,CAAA,CAAA,MAAA,CAAA;;AAA8B,KCzrErC,gBAAA,GAAmB,WDyrEkB,CCzrEN,SDyrEM,CAAA,YAAA,CAAA,CAAA,CAAA,MAAA,CAAA;;AAqDvC,KC3uEE,mBAAA,GAAsB,WD2uExB,CC3uEoC,SD2uEpC,CAAA,eAAA,CAAA,CAAA,CAAA,MAAA,CAAA;;;;AAhwEV;;;;;AAOA;AAYY,KEpBA,cAAA,GF2BO,IAAA,GAAI,IAAA,GAAA,IAAA,GAAA,OAAA,GAAA,YAAA,GAAA,WAAA,GAAA,YAAA,GAAA,UAAA,GAAA,UAAA,GAAA,cAAA;AAMX,KErBA,eAAA,GFqBqB,MAAA,GAAA,IAAA,GAAA,SAAA;AA+mEhB,KEloEL,uBAAA,GFkoEmB,4BAAA,GAAA,sCAAA,GAAA,2BAAA,GAAA,MAAA,GAAA,IAAA,GAAA,eAAA,GAAA,yBAAA,GAAA,mBAAA;AAsDpB,KE9qEC,aAAA,GF8qED;EAMQ,CAAA,EAAA,UAAA;EAAc,IAAA,EEnrEN,cFmrEM;EAAgB,OAAA,EAAA,MAAA;EAoBlC,KAAA,EEvsEoD,eFusEpD;CAiCL,GAAA;EA6MI,CAAA,EAAA,oBAAA;EACM,OAAA,EAAA,MAAA;EACP,KAAA,EAAA,MAAA,GAAA,IAAA;CACD,GAAA;EAiBgB,CAAA,EAAA,QAAA;EA2BZ,SAAA,EAAA,MAAA;EAOA,KAAA,EAAA,MAAA;CAmBC,GAAA;EA2gBI,CAAA,EAAA,mBAAA;EAMU,OAAA,EAAA,MAAA;EAqPL,KAAA,EEjwG4B,uBFiwG5B;CA2BZ,GAAA;EAOA,CAAA,EAAA,QAAA;EAmBC,OAAA,EAAA,OAAA;EA2gBI,KAAA,EAAA,YAAA;CAMU,GAAA;EAAqB,CAAA,EAAA,QAAA;EAyOjC,KAAA,EAAA,MAAA;EASA,MAAA,EAAA,MAAA;AASjB,CAAA;AAYA;AA+BA;AAWA;AAsDW,cEvqIE,SAAA,CFuqIF;EAMQ,SAAA,IAAA,EE5qIiB,aF4qIjB;EAAc,WAAA,CAAA,IAAA,EE5qIG,aF4qIH;EAAgB,WAAA,CAAA,CAAA,EAAA,MAAA;;AAqDxC,iBE1tIO,uBAAA,CF0tIP,IAAA,EE1tIqC,aF0tIrC,CAAA,EAAA,MAAA;;;;;;;;;;;;AAihCQ,cE7rKJ,EF6rKmB,EAAA;EAyCf,SAAA,EAAA,EAAA,CAAA,OAAY,EAAA,MAAA,EAAA,GAAA;IA0GZ,SAAA,IAAY,EEv2Kb,SFu2Ka;IAcZ,SAAA,EAAA,EEl3KH,SFk3KwB;IAUrB,SAAA,OAAA,EEz3KE,SFy3KiB;EAcnB,CAAA;EAaA,SAAA,EAAA,EAAA,CAAA,OAAA,EAAA,MAAA,EAAA,GAAA;IAuDN,SAAA,IAAA,EEj9KK,SFi9KL;IAMQ,SAAA,EAAA,EEp9KL,SFo9KK;IAAc,SAAA,OAAA,EEj9Kd,SFi9Kc;EAAgB,CAAA;EAoBlC,SAAA,EAAA,EAAA,CAAA,OAAA,EAAA,MAAA,EAAA,GAAA;IAiCL,SAAA,IAAA,EE5gLM,SF4gLN;IA6MI,SAAA,EAAA,EEttLA,SFstLA;IACM,SAAA,OAAA,EEptLD,SFotLC;EACP,CAAA;EACD,SAAA,KAAA,EAAA,CAAA,OAAA,EAAA,MAAA,EAAA,GAAA;IAiBgB,SAAA,IAAA,EE7uLZ,SF6uLY;IA2BZ,SAAA,EAAA,EErwLF,SFqwLE;IAOA,SAAA,OAAA,EEzwLG,SFywLH;EAmBC,CAAA;EA2gBI,SAAA,UAAA,EAAA,CAAA,OAAA,EAAA,MAAA,EAAA,GAAA;IAMU,SAAA,IAAA,EEnzMf,SFmzMe;IAqPL,SAAA,EAAA,EEriNZ,SFqiNY;IA2BZ,SAAA,OAAA,EE7jNK,SF6jNL;EAOA,CAAA;EAmBC,SAAA,SAAA,EAAA,CAAA,OAAA,EAAA,MAAA,EAAA,GAAA;IA2gBI,SAAA,IAAA,EExmOH,SFwmOG;IAMU,SAAA,EAAA,EE3mOf,SF2mOe;IAiSN,SAAA,OAAA,EEz4OJ,SFy4OI;EAAmB,CAAA;;mBE/4O1B;iBAGF;ID3DF,SAAA,OAAc,EC8DP,SD9DU;EAGjB,CAAA;EAGA,SAAA,QAAA,EAAA,CAAA,OAAkB,EAAA,MAAe,EAAA,GAAA;IAGjC,SAAA,IAAA,EC+CI,SD/CY;IAGhB,SAAA,EAAA,EC+CE,SD/CiB;sBCkDZ;;;IAxEP,SAAA,IAAc,EAkEV,SAlEU;IAYd,SAAA,EAAA,EAyDE,SAzDa;IAEf,SAAA,OAAA,EA0DO,SA1DgB;EAUvB,CAAA;EACe,SAAA,WAAA,EAAA,CAAA,OAAA,EAAA,MAAA,EAAA,GAAA;IAAwC,SAAA,IAAA,EAyCnD,SAzCmD;IAGb,SAAA,EAAA,EAyCxC,SAzCwC;IAAuB,SAAA,OAAA,EA4C1D,SA5C0D;EAOhE,CAAA;EAQG,SAAA,iBAAuB,EAAA,CAAA,OAAA,EAAO,MAAA,EAAA,GAAA;IA8CjC,SAmFH,IAAA,EAtEM,SAsEN;IA1GM,SAAA,EAAA,EAuCF,SAvCE;EAGF,CAAA;EAGK;EANH,SAAA,MAAA,EAAA,CAAA,SAAA,EAAA,MAAA,EAAA,GAAA;IAGF,SAAA,IAAA,EA2CE,SA3CF;EAGK,CAAA;EANH,SAAA,gBAAA,EAAA,CAAA,OAAA,EAAA,MAAA,EAAA,GAAA;IAGF,SAAA,sBAAA,EAiDoB,SAjDpB;IAGK,SAAA,+BAAA,EAqDwB,SArDxB;IANH,SAAA,sBAAA,EAkEkB,SAlElB;IAGF,SAAA,YAAA,EAsEU,SAtEV;IAGK,SAAA,UAAA,EAsEG,SAtEH;IANH;IAGF,SAAA,YAAA,EA6EU,SA7EV;IAGK;IANH,SAAA,qBAAA,EAoFiB,SApFjB;IAGF;IAGK,SAAA,gBAAA,EAsFS,SAtFT;EANH,CAAA;EAGF,SAAA,KAAA,EAAA;IAGK,SAAA,SAAA,EA4FE,SA5FF;EANH,CAAA;EAGF;EAGK,SAAA,MAAA,EAAA,CAAA,KAAA,EAAA,MAAA,EAAA,MAAA,EAAA,MAAA,EAAA,GAkGqB,SAlGrB;CANH;AAGF,iBAyGE,WAAA,CAzGF,CAAA,EAAA,OAAA,CAAA,EAAA,CAAA,IAyGgC,SAzGhC;;;;;;AF7Dd;AAYA;AAaY,KG5BA,qBAAA,GH4BqB,MAAA,GG5BY,SH4BZ;AA+mEjC;AAsDW,UG9rEM,qBAAA,CH8rEN;EAMQ;EAAc,SAAA,CAAA,EAAA,MAAA;;;;;;;;AAsRL,KG/8EhB,gBAAA,GH+8EgB,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,EAAA,MAAA,EAAA,GAAA,CAAA,EG58EpB,qBH48EoB,EAAA,GAAA,MAAA;;AAkCZ,KG1+EJ,0BAAA,GAA6B,IH0+EzB,CGz+Ed,gBHy+Ec,EAAA,aAAA,CAAA,GAAA;EAmBC,WAAA,CAAA,EGz/ED,qBHy/EC;CA2gBI;;;;;;AA2zBF,UGrzHF,UAAA,CHqzHE;EAMU,EAAA,EAAA,MAAA;EAAqB,IAAA,EAAA,MAAA;EAyOjC,IAAA,EAAA,MAAA;EASA;AASjB;AAYA;AA+BA;AAWA;;;;;;;;;;;;;;;EAk5BqB,QAAA,CAAA,EAAA,MAAA,EAAA;EAMU;;AA0O/B;AAyCA;AA0GA;AAcA;AAUA;AAcA;;;;EA0EiC,aAAA,CAAA,EAAA,MAAA,EAAA;EAAgB;;;;;;;;;;;;;EAilCvB,mBAAA,CAAA,EAAA,MAAA;;;;;;;;UGtgNT,gBAAA;;;EF1FL,IAAA,EAAA,QAAA,GAAc,SAAA;EAGd;AAGZ;AAGA;AAGA;mBEsFmB;;;AD5GnB;AAYA;AAEA;AAUA;;;EAIsD,SAAA,CAAA,EAAA,SAAA,GAAA,UAAA;EAAuB;AAO7E;AAQA;AA8CA;;EApBc,YAAA,CAAA,ECsDG,qBDtDH;EAGK;;;;EANH,OAAA,CAAA,EAAA,MAAA;EAGF;;;;EAGK,SAAA,CAAA,EAAA,MAAA;EANH;;;EAAA,YAAA,CAAA,EAAA,MAAA;EAGF;EAGK,SAAA,CAAA,EAAA,MAAA,EAAA;EANH;EAGF,cAAA,CAAA,EAAA,MAAA,EAAA;EAGK;EANH,OAAA,CAAA,EAAA,OAAA;EAGF,aAAA,CAAA,EAAA,MAAA;EAGK,eAAA,CAAA,EAAA,MAAA;EANH;;;;;;;;EA8CA,iBAAA,CAAA,EAAA,OAAA;;;AAoBkB,UC0BjB,oBAAA,CD1BiB;EAOV;EAGF,EAAA,EAAA,MAAA;EAIE;EAIS,IAAA,EAAA,MAAA;EAQL;EAMP,OAAA,EAAA,MAAA;EAMmB;EAAA,YAAA,EAAA,MAAA;EAIxB,SAAA,CAAA,EAAA,MAAW;;;;ECzKf,SAAA,CAAA,EAAA,MAAA,EAAA;AAGZ;AAWA;AAOY,UAqJK,eAAA,CArJqB;EACpC,OAAA,EAAA,CAAA;EADuC,MAAA,EAuJ/B,oBAvJ+B,EAAA;;;AAcxB,UA6IA,0BAAA,CA7IU;EA4DV;AA0DjB;AAiBA;AAMA;EAYiB,MAAA,CAAA,EAAA,MAAA;EAMA;EAQA,OAAA,CAAA,EAAA,MAAA;EAeA;EAoBA,UAAA,CAAA,EAAA,MAAA;AA6BjB;AAwBiB,UAtGA,aAAA,CAsGuB;EAmCvB;EAmBA,aAAA,CAAA,EA1JC,0BA0JmB;AA6BrC;AA0DA;AAMiB,UAnPA,gBAAA,CAmPuB;EAoBvB,WAAA,EAAA,MAAA;EAwBA;EAkCA,cAAA,CAAA,EA9TE,gBA8TsB;EAE9B;EAOJ,OAAA,CAAA,EAAA,MAAA;;AAYW,UA9UD,gBAAA,CA8UC;EAAkC,WAAA,EAAA,MAAA;EA0CnC;EAuEA,cAAA,CAAA,EA5bE,gBA4bF;EAWA;EACV,OAAA,CAAA,EAAA,MAAA;;;;;;;;;AAiBW,UA7cD,mBAAA,CA6cC;EASM,WAAA,EAAA,MAAA;EAAyB;EAgBhC,cAAA,CAAA,EAneE,gBAmewB;EAa1B;EAwBA,OAAA,CAAA,EAAA,MAAA;EAsCA;AAsBjB;AAQC;AAEiB;EASa,YAAA,CAAA,EAAA,OAAA;;;;AAE/B;;;;;AAYgB,UAplBC,wBAAA,CAolBD;EAQN,WAAA,EAAA,MAAA;EApB2B;EAAI,cAAA,CAAA,EArkBtB,gBAqkBsB;EAuBxB;EACf,OAAA,CAAA,EAAA,MAAA;EAKY;EAEC,MAAA,EAhmBL,oBAgmBK;EAEC;EAMN,OAAA,CAAA,EAAA;IACc,QAAA,CAAA,EAAA,OAAA;IAAf,OAAA,CAAA,EAAA,MAAA;IAmBG,sBAAA,CAAA,EAAA,MAAA;EAEF,CAAA;EACA;EACa,IAAA,CAAA,EAAA;IAAf,iBAAA,CAAA,EAAA,MAAA;IAxC8B,mBAAA,CAAA,EAAA,MAAA;EAAI,CAAA;EAsDzB;EAaP,qBAAa,CAAA,EAAA,MAAA;;;;;;;;;;;AAqEN,UA1sBA,uBAAA,CA2sBP;EAKO,WAAA,EAAA,MAAe;EACN;EAAf,cAAA,CAAA,EA9sBQ,gBA8sBR;EAD6B;EAAa,OAAA,CAAA,EAAA,MAAA;EAUzC;EAiBI,UAAA,EAAA,MAAY;EAQf;EAcG,MAAA,EAAA,QAAA,GAAA,WAAoB,GAAA,aAAA;EAExB;EACF,WAAA,CAAA,EAAA,MAAA;;;;;;AACV;;;;;AA8BA;AAIgB,UA/wBC,uBAAA,CAgxBP;EAKM,WAAA,EAAA,MAAa;EAIb;EAMC,cAAA,CAAY,EA5xBV,gBA4xBU;EAcZ;EAUA,QAAA,CAAA,EAAA,MAAY;EAUZ;EAaA,uBAAmB,CAAA,EAAA,OAAA;EAenB;EAiBA,WAAA,CAAA,EAAA,OAAA;EAmBA;EAiBA,cAAA,CAAA,EAAA,OAAkB;EAsBlB;EAaA,oBAAA,CAAA,EAAmB,MAAA;EAkCnB;EASA,iBAAA,CAAA,EAAA,MAAoB;EAgBpB;EA6CA,qBAAA,CAAA,EAAqB,OAAA,GAAA,SAAA;AAsBtC;AAYA;;;;;;;;;;;;;;;AAeI,UA3iCa,sBAAA,CA2iCb;EACA,WAAA,EAAA,MAAA;EAAgB;EAGR,cAAA,CAAA,EA5iCO,gBA4iCW;EAQb;AAUjB;AAgBA;AAUA;AAUA;EAEiB,GAAA,EAAA,MAAA;EAUA;;;;;EAWP,OAAA,CAAA,EAAA,MAAA;;;AAUQ,UAnnCD,oBAAA,CAmnCC;EAKG,MAAA,EAAA,UAAA,GAAA,YAAA,GAAA,OAAA;EAAkB,IAAA,EAAA,MAAA;EAQtB,IAAA,CAAA,EAAA,MAAA;EAWL,QAAA,EAAA,MAAA;EAEK,IAAA,EAAA,MAAA;EAIP;;;;EAOJ,QAAA,EAAA,MAAA,GAAA;IAAK,OAAA,EAAA,MAAA;EAIM,CAAA;EA2BA;;;;ECxhDD,CAAA;AAIhB;;;;;AAcA;;;;ACMA;;;;;UFsWiB,sBAAA;;;mBAGE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAuDP,0BAAA;;;;;UAMK,uBAAA;;;;;;;;;;;;;;;;;;;UAoBA,oCAAA;;;;;;;;;;;;;;;;;;;;;;;UAwBA,kCAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkCA,wBAAA;;WAEN;;;;;;;OAOJ;;;;;;;oBAOa;;;;;kBAKF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA0CD,uBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAuEA,+BAAA;;;;;;;;;;UAWA,eAAA;OACV;OACA;OACA;WACI;eACI;cACD;cACA;cACA;cACA;;;;;;;;;kBASI;;;;;;;;;wBASM;;;;;;;;;;;;;;;UAgBP,0BAAA;;;mBAGE;;;;;;;;;UAUF,yBAAA;;;;;;;;;;;;;;;;;;;;;;;UAwBA,mBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAsCA,mBAAA;;;;;;;;;;;;;;;;;;;UAsBA,iBAAA;;;;;;;;;KAUZ,aAAA;KASA,kBAAA,GAAqB,KAAK,gBAAgB;UAE9B,WAAA,SAAoB,KACnC;SAGO,eAAe;;eAET;;;;;;gBAMC;;;;;;;;UAQN;;UAGO,YAAA,SAAqB,KACpC;;;cAKY;;eAEC;;gBAEC;;;;;;UAMN;SACD,eAAe;;;;;;;;;;;;;;;;;;;YAmBZ;;UAEF;UACA;QACF,eAAe;;;;;;;;;;;UAcN,cAAA;;;;;;;;;;;;UAaP,aAAA;UACA;;;;;;;;;;WAUC;;UAED;;uBAEa;;;;;;;;;;;;eAYR;;;;;;;gBAOC;;;;;;;;;;;;;;;;;;;;;;;;;;YA0BJ,eAAe;;;;;YAKf;;;UAIK,eAAA,SAAwB;UAC/B;;;;UAKO,cAAA,SAAuB;WAC7B,eAAe;;;;;;;;KASd,SAAA,GAAY,kBAAkB;;;;;;;;;;;;;;iBAiB1B,YAAA,SAAqB,YAAY;;;;;cAQpC;;;;;;;;;;;;;iBAcG,iDAEJ,iCACF,aAAa,IAAI,mBAAmB,wBAAwB;iBACtD,+BAA+B,mCACnC,IACT;;;;;iBA4Ba,YAAA,SAAqB,eAAe;iBAIpC,qBAAA,SACN,YACP;iBAIa,aAAA,SAAsB,YAAY;iBAIlC,cAAA,SAAuB,YAAY;UAMlC,YAAA;;;;;;;;;;;;;UAcA,YAAA;;;;;;;;;UAUA,YAAA;;;;;;;;;UAUA,eAAA;;;;;;;;;;;;UAaA,mBAAA;;;;;;;;;;;;;;UAeA,oBAAA;;;;;;;;;;;;;;;;UAiBA,mBAAA;;;;;;;;;;;;;;;;;;UAmBA,kBAAA;;;;;;;;;;;;;;;;UAiBA,kBAAA;;;;;;;;;;;;;;;;;;;;;;;UAsBA,sBAAA;;;;;;;;;;;;UAaA,mBAAA;;;;;;;;;;;;;;;;;;;;;;UAkCA,2BAAA;;;;;;;;UASA,oBAAA;;;;;;;;;;;;;;;UAgBA,0BAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6CA,qBAAA;;;;;;;;;;;;;;;;;;;;;UAsBA,gBAAA;;;;;;;;;;;KAYL,UAAA,GACR,eACA,eACA,eACA,kBACA,uBACA,sBACA,sBACA,qBACA,qBACA,yBACA,sBACA,8BACA,uBACA,6BACA,wBACA;;KAGQ,kBAAA;UAQK,gBAAA;;;;;;;;;UAUA,gBAAA;;;sBAGK;;;aAGT;;;;;;;;;UAUI,YAAA;;;;;;;;;KAUL,gBAAA;KAUA,kBAAA;UAEK,kBAAA;WACN;UACD;;;;;;;UAQO,QAAA;;;;;aAKJ,eAAe;;;;YAIhB,eAAe;;UAEjB;;;;;;;;iBAQO,eAAe;;kBAEd;;;;;qBAKG;;;;;;;UAQJ,mBAAA;;;;;;;;KAWL,cAAA;UAEK,YAAA;;;;UAIP;MACJ;;;;YAIM;;MAEN;;;YAA+C;;;;UAIpC,YAAA;UACP;;WAEC;;;;;;;;;;;;;;;;;;;;;UAwBM,iBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AHnhDjB;AAA6B,iBILb,0BAAA,CJKa,CAAA,EILiB,qBJKjB,CAAA,EAAA,MAAA;AAAc,iBID3B,eAAA,CJC2B,IAAA,EIAnC,MJAmC,CAAA,MAAA,EIApB,qBJAoB,CAAA,GAAA,SAAA,CAAA,EICxC,MJDwC,CAAA,MAAA,EAAA,MAAA,CAAA,GAAA,SAAA;;;AAO3C;AAYA;AAaA;AA+mEiB,iBIloED,6BAAA,CJkoEe,KAAA,EAAA,OAAA,CAAA,EAAA,OAAA;;;;;;AAxoE/B;AAYA;AAaA;AA+mEA;;AA4DmB,iBKxrEH,sBAAA,CLwrEG,MAAA,EAAA,OAAA,CAAA,EKxrEsC,SLwrEtC"}

package/dist/{migrate-ODEnh6Tv.mjs → migrate-DWyUVN1I.mjs}

@@ -2,7 +2,7 @@ import { B as getWorkers, L as CFApiClient, M as wranglerConfigCliArgs, R as clo
 import { a as d1CloudflareDatabaseName, o as d1SkipsProvisionAndMigrate } from "./registry-BlHEOKlN.mjs";
 import "./r2S3EmptyBucket-B9_pHfvB.mjs";
 import { n as writeWranglerJson, t as generateWranglerConfig } from "./generator-ZTEeHlft.mjs";
-import { t as spawnWranglerSync } from "./wranglerSpawn-B3TKjpt2.mjs";
+import { n as spawnWranglerSync } from "./wranglerSpawn-CqVNGkA9.mjs";
 
 //#region src/features/d1/d1.migrate.ts
 /**
@@ -82,4 +82,4 @@ async function runMigrate(options) {
 
 //#endregion
 export { runMigrate };
-//# sourceMappingURL=migrate-ODEnh6Tv.mjs.map
+//# sourceMappingURL=migrate-DWyUVN1I.mjs.map

package/dist/{migrate-ODEnh6Tv.mjs.map → migrate-DWyUVN1I.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"migrate-ODEnh6Tv.mjs","names":["databases: string[]"],"sources":["../src/features/d1/d1.migrate.ts","../src/cli/commands/migrate.ts"],"sourcesContent":["import type { D1ResourceConfig, D1StateEntry } from \"./d1.types.js\";\nimport { wranglerConfigCliArgs } from \"../../core/wrangler/wranglerOutFile.js\";\nimport { spawnWranglerSync } from \"../../core/wrangler/wranglerSpawn.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport {\n  d1CloudflareDatabaseName,\n  d1SkipsProvisionAndMigrate,\n} from \"./d1.ownership.js\";\n\n/**\n * Apply Cloudflare D1 migrations for every D1 in `resources`.\n *\n * Wrangler requires `d1 migrations apply <DATABASE>` (positional). Tamer\n * resolves the derived database name per env (single) or per shard, and\n * invokes wrangler once per database.\n *\n * Adds `--remote` for non-`local` envs so migrations target the live D1, not\n * the local SQLite cache. Skips D1s owned externally or flagged\n * `preserveOnDestroy` (cross-stack).\n */\nexport async function d1Migrate(\n  resources: D1ResourceConfig[],\n  workerDir: string,\n  env: string,\n  wranglerOutFile: string = \"wrangler.json\",\n  naming: NamingEngine,\n  state: StateManager,\n): Promise<void> {\n  const d1Configs = resources.filter(\n    (r) => r.migrationsDir && !d1SkipsProvisionAndMigrate(r),\n  );\n  if (d1Configs.length === 0) return;\n\n  const databases: string[] = [];\n  for (const config of d1Configs) {\n    if (config.type === \"single\") {\n      databases.push(d1CloudflareDatabaseName(config, env, naming));\n      continue;\n    }\n    const all = state.getAll();\n    const shards = Object.values(all).filter(\n      (e): e is D1StateEntry =>\n        e.type === \"d1_database\" && e.logicalName === config.logicalName,\n    );\n    for (const s of shards) databases.push(s.derivedName);\n  }\n\n  for (const dbName of databases) {\n    const args = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(wranglerOutFile),\n      \"d1\",\n      \"migrations\",\n      \"apply\",\n      dbName,\n    ];\n    if (env !== \"local\") args.push(\"--remote\");\n\n    // Wrangler prompts for confirmation when stdin is a TTY. Tamer is an\n    // automation path (CI / scripts): skip prompts like `d1 migrations apply`\n    // does when `CI` is set or stdin is not a TTY (see wrangler help text).\n    const result = spawnWranglerSync(args, {\n      cwd: workerDir,\n      stdio: [\"ignore\", \"inherit\", \"inherit\"],\n      env: { CI: \"1\" },\n    });\n\n    if (result.status !== 0) {\n      throw new Error(\n        `wrangler d1 migrations apply failed for ${dbName} (exit ${result.status})`,\n      );\n    }\n  }\n}\n","import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { resolveWorkerConfig } from \"../../core/config/resolver.js\";\nimport {\n  generateWranglerConfig,\n  writeWranglerJson,\n} from \"../../core/wrangler/generator.js\";\nimport { d1Migrate } from \"../../features/d1/index.js\";\n\nexport async function runMigrate(options: {\n  worker?: string;\n  env?: string;\n  configPath?: string;\n}): Promise<void> {\n  const workerFilter = options.worker;\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const imports = await fetchStackImports(api, config, env);\n\n  const workers = await getWorkers(config, baseDir);\n  const toRun = workerFilter\n    ? workers.filter(([k]) => k === workerFilter)\n    : workers;\n\n  if (toRun.length === 0) {\n    throw new Error(\n      workerFilter\n        ? `Worker \"${workerFilter}\" not found`\n        : \"No workers configured\",\n    );\n  }\n\n  for (const [workerKey, workerConfig] of toRun) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { imports },\n    );\n    const wranglerConfig = generateWranglerConfig(resolved, state, naming);\n    writeWranglerJson(resolved.workerDir, wranglerConfig, resolved.wranglerOutFile);\n\n    const resources = resolved.resources ?? {};\n    await d1Migrate(\n      resources.d1 ?? [],\n      resolved.workerDir,\n      env,\n      resolved.wranglerOutFile,\n      naming,\n      state,\n    );\n    console.log(`Migrations applied for ${workerKey}`);\n  }\n\n  console.log(`Migrate complete for env: ${env}`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAqBA,eAAsB,UACpB,WACA,WACA,KACA,kBAA0B,iBAC1B,QACA,OACe;CACf,MAAM,YAAY,UAAU,QACzB,MAAM,EAAE,iBAAiB,CAAC,2BAA2B,EAAE,CACzD;AACD,KAAI,UAAU,WAAW,EAAG;CAE5B,MAAMA,YAAsB,EAAE;AAC9B,MAAK,MAAM,UAAU,WAAW;AAC9B,MAAI,OAAO,SAAS,UAAU;AAC5B,aAAU,KAAK,yBAAyB,QAAQ,KAAK,OAAO,CAAC;AAC7D;;EAEF,MAAM,MAAM,MAAM,QAAQ;EAC1B,MAAM,SAAS,OAAO,OAAO,IAAI,CAAC,QAC/B,MACC,EAAE,SAAS,iBAAiB,EAAE,gBAAgB,OAAO,YACxD;AACD,OAAK,MAAM,KAAK,OAAQ,WAAU,KAAK,EAAE,YAAY;;AAGvD,MAAK,MAAM,UAAU,WAAW;EAC9B,MAAM,OAAO;GACX;GACA,GAAG,sBAAsB,gBAAgB;GACzC;GACA;GACA;GACA;GACD;AACD,MAAI,QAAQ,QAAS,MAAK,KAAK,WAAW;EAK1C,MAAM,SAAS,kBAAkB,MAAM;GACrC,KAAK;GACL,OAAO;IAAC;IAAU;IAAW;IAAU;GACvC,KAAK,EAAE,IAAI,KAAK;GACjB,CAAC;AAEF,MAAI,OAAO,WAAW,EACpB,OAAM,IAAI,MACR,2CAA2C,OAAO,SAAS,OAAO,OAAO,GAC1E;;;;;;ACzDP,eAAsB,WAAW,SAIf;CAChB,MAAM,eAAe,QAAQ;CAC7B,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;CAEzD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CACjD,MAAM,QAAQ,eACV,QAAQ,QAAQ,CAAC,OAAO,MAAM,aAAa,GAC3C;AAEJ,KAAI,MAAM,WAAW,EACnB,OAAM,IAAI,MACR,eACI,WAAW,aAAa,eACxB,wBACL;AAGH,MAAK,MAAM,CAAC,WAAW,iBAAiB,OAAO;EAC7C,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;EACD,MAAM,iBAAiB,uBAAuB,UAAU,OAAO,OAAO;AACtE,oBAAkB,SAAS,WAAW,gBAAgB,SAAS,gBAAgB;AAG/E,QAAM,WADY,SAAS,aAAa,EAAE,EAE9B,MAAM,EAAE,EAClB,SAAS,WACT,KACA,SAAS,iBACT,QACA,MACD;AACD,UAAQ,IAAI,0BAA0B,YAAY;;AAGpD,SAAQ,IAAI,6BAA6B,MAAM"}
+{"version":3,"file":"migrate-DWyUVN1I.mjs","names":["databases: string[]"],"sources":["../src/features/d1/d1.migrate.ts","../src/cli/commands/migrate.ts"],"sourcesContent":["import type { D1ResourceConfig, D1StateEntry } from \"./d1.types.js\";\nimport { wranglerConfigCliArgs } from \"../../core/wrangler/wranglerOutFile.js\";\nimport { spawnWranglerSync } from \"../../core/wrangler/wranglerSpawn.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport {\n  d1CloudflareDatabaseName,\n  d1SkipsProvisionAndMigrate,\n} from \"./d1.ownership.js\";\n\n/**\n * Apply Cloudflare D1 migrations for every D1 in `resources`.\n *\n * Wrangler requires `d1 migrations apply <DATABASE>` (positional). Tamer\n * resolves the derived database name per env (single) or per shard, and\n * invokes wrangler once per database.\n *\n * Adds `--remote` for non-`local` envs so migrations target the live D1, not\n * the local SQLite cache. Skips D1s owned externally or flagged\n * `preserveOnDestroy` (cross-stack).\n */\nexport async function d1Migrate(\n  resources: D1ResourceConfig[],\n  workerDir: string,\n  env: string,\n  wranglerOutFile: string = \"wrangler.json\",\n  naming: NamingEngine,\n  state: StateManager,\n): Promise<void> {\n  const d1Configs = resources.filter(\n    (r) => r.migrationsDir && !d1SkipsProvisionAndMigrate(r),\n  );\n  if (d1Configs.length === 0) return;\n\n  const databases: string[] = [];\n  for (const config of d1Configs) {\n    if (config.type === \"single\") {\n      databases.push(d1CloudflareDatabaseName(config, env, naming));\n      continue;\n    }\n    const all = state.getAll();\n    const shards = Object.values(all).filter(\n      (e): e is D1StateEntry =>\n        e.type === \"d1_database\" && e.logicalName === config.logicalName,\n    );\n    for (const s of shards) databases.push(s.derivedName);\n  }\n\n  for (const dbName of databases) {\n    const args = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(wranglerOutFile),\n      \"d1\",\n      \"migrations\",\n      \"apply\",\n      dbName,\n    ];\n    if (env !== \"local\") args.push(\"--remote\");\n\n    // Wrangler prompts for confirmation when stdin is a TTY. Tamer is an\n    // automation path (CI / scripts): skip prompts like `d1 migrations apply`\n    // does when `CI` is set or stdin is not a TTY (see wrangler help text).\n    const result = spawnWranglerSync(args, {\n      cwd: workerDir,\n      stdio: [\"ignore\", \"inherit\", \"inherit\"],\n      env: { CI: \"1\" },\n    });\n\n    if (result.status !== 0) {\n      throw new Error(\n        `wrangler d1 migrations apply failed for ${dbName} (exit ${result.status})`,\n      );\n    }\n  }\n}\n","import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { resolveWorkerConfig } from \"../../core/config/resolver.js\";\nimport {\n  generateWranglerConfig,\n  writeWranglerJson,\n} from \"../../core/wrangler/generator.js\";\nimport { d1Migrate } from \"../../features/d1/index.js\";\n\nexport async function runMigrate(options: {\n  worker?: string;\n  env?: string;\n  configPath?: string;\n}): Promise<void> {\n  const workerFilter = options.worker;\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const imports = await fetchStackImports(api, config, env);\n\n  const workers = await getWorkers(config, baseDir);\n  const toRun = workerFilter\n    ? workers.filter(([k]) => k === workerFilter)\n    : workers;\n\n  if (toRun.length === 0) {\n    throw new Error(\n      workerFilter\n        ? `Worker \"${workerFilter}\" not found`\n        : \"No workers configured\",\n    );\n  }\n\n  for (const [workerKey, workerConfig] of toRun) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { imports },\n    );\n    const wranglerConfig = generateWranglerConfig(resolved, state, naming);\n    writeWranglerJson(resolved.workerDir, wranglerConfig, resolved.wranglerOutFile);\n\n    const resources = resolved.resources ?? {};\n    await d1Migrate(\n      resources.d1 ?? [],\n      resolved.workerDir,\n      env,\n      resolved.wranglerOutFile,\n      naming,\n      state,\n    );\n    console.log(`Migrations applied for ${workerKey}`);\n  }\n\n  console.log(`Migrate complete for env: ${env}`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAqBA,eAAsB,UACpB,WACA,WACA,KACA,kBAA0B,iBAC1B,QACA,OACe;CACf,MAAM,YAAY,UAAU,QACzB,MAAM,EAAE,iBAAiB,CAAC,2BAA2B,EAAE,CACzD;AACD,KAAI,UAAU,WAAW,EAAG;CAE5B,MAAMA,YAAsB,EAAE;AAC9B,MAAK,MAAM,UAAU,WAAW;AAC9B,MAAI,OAAO,SAAS,UAAU;AAC5B,aAAU,KAAK,yBAAyB,QAAQ,KAAK,OAAO,CAAC;AAC7D;;EAEF,MAAM,MAAM,MAAM,QAAQ;EAC1B,MAAM,SAAS,OAAO,OAAO,IAAI,CAAC,QAC/B,MACC,EAAE,SAAS,iBAAiB,EAAE,gBAAgB,OAAO,YACxD;AACD,OAAK,MAAM,KAAK,OAAQ,WAAU,KAAK,EAAE,YAAY;;AAGvD,MAAK,MAAM,UAAU,WAAW;EAC9B,MAAM,OAAO;GACX;GACA,GAAG,sBAAsB,gBAAgB;GACzC;GACA;GACA;GACA;GACD;AACD,MAAI,QAAQ,QAAS,MAAK,KAAK,WAAW;EAK1C,MAAM,SAAS,kBAAkB,MAAM;GACrC,KAAK;GACL,OAAO;IAAC;IAAU;IAAW;IAAU;GACvC,KAAK,EAAE,IAAI,KAAK;GACjB,CAAC;AAEF,MAAI,OAAO,WAAW,EACpB,OAAM,IAAI,MACR,2CAA2C,OAAO,SAAS,OAAO,OAAO,GAC1E;;;;;;ACzDP,eAAsB,WAAW,SAIf;CAChB,MAAM,eAAe,QAAQ;CAC7B,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;CAEzD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CACjD,MAAM,QAAQ,eACV,QAAQ,QAAQ,CAAC,OAAO,MAAM,aAAa,GAC3C;AAEJ,KAAI,MAAM,WAAW,EACnB,OAAM,IAAI,MACR,eACI,WAAW,aAAa,eACxB,wBACL;AAGH,MAAK,MAAM,CAAC,WAAW,iBAAiB,OAAO;EAC7C,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;EACD,MAAM,iBAAiB,uBAAuB,UAAU,OAAO,OAAO;AACtE,oBAAkB,SAAS,WAAW,gBAAgB,SAAS,gBAAgB;AAG/E,QAAM,WADY,SAAS,aAAa,EAAE,EAE9B,MAAM,EAAE,EAClB,SAAS,WACT,KACA,SAAS,iBACT,QACA,MACD;AACD,UAAQ,IAAI,0BAA0B,YAAY;;AAGpD,SAAQ,IAAI,6BAA6B,MAAM"}