@dragonmastery/tamer 0.35.3 → 0.35.4

package/dist/{plan-Dot2VV7R.mjs.map → plan-C8oQWM35.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"plan-Dot2VV7R.mjs","names":["items: PlanItem[]","byKind: Record<PlanResourceKind, number>","byAction: Record<PlanAction, number>","attestation"],"sources":["../src/core/plan/computePlan.ts","../src/core/plan/plan.types.ts","../src/cli/commands/plan.ts"],"sourcesContent":["import { loadConfig, getWorkers } from \"../config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../cloudflareEnv.js\";\nimport { namingFromConfig } from \"../config/namingFromConfig.js\";\nimport { StateManager } from \"../state/StateManager.js\";\nimport { stackNameForConfig } from \"../state/stackName.js\";\nimport { fetchStackImports } from \"../imports/fetchStackImports.js\";\nimport { CFApiClient } from \"../api/CFApiClient.js\";\nimport { computeDriftReport } from \"../../cli/commands/drift.js\";\nimport { resolveWorkerConfig } from \"../config/resolver.js\";\nimport { resourceModules } from \"../registry/registry.js\";\nimport { logicalNamesForResourceKind } from \"../config/resourcesFromConfig.js\";\nimport { resolveDeployedWorkerName } from \"../config/resolver.js\";\nimport { requiredSecretsForWorker } from \"../secrets/declared.js\";\nimport {\n  reconcileSecrets,\n  secretsPlanItems,\n  vaultReaderFromMap,\n  type SecretsVaultReader,\n  type VaultSecretMeta,\n} from \"../secrets/reconcile.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobStateKey } from \"../../features/logpush-job/logpush-job.resolve.js\";\nimport { logpushJobDiffPlanItems } from \"../../features/logpush-job/logpush-job.diff.js\";\nimport {\n  dnsRecordDiffPlanItems,\n} from \"../../features/dns-records/dns-records.diff.js\";\nimport { dnsRecordStateKey } from \"../../features/dns-records/dns-records.resolve.js\";\nimport type { StateEntry } from \"../../types.js\";\nimport type { PlanItem, PlanReport, PlanResourceKind } from \"./plan.types.js\";\nimport {\n  filterPlanItemsForTarget,\n  type ApplyTarget,\n} from \"../apply/applyTarget.js\";\n\n/**\n * Compute the planned set of changes for `env` given the current\n * `tamer.config.ts` and recorded state. Read-only: hits the Cloudflare API to\n * detect what is missing but never writes.\n *\n * The \"would create\" set is derived from `computeDriftReport().undeployed`:\n * declared in config, present neither in state nor on Cloudflare. Worker\n * **scripts** are queried directly (`workersScriptGet`) since they are not\n * tracked as state resources today.\n */\nexport async function computePlan(options: {\n  env?: string;\n  configPath?: string;\n  /** When set, only plan items for this `kind:logical` are returned. */\n  target?: ApplyTarget;\n  /** Optional vault reader for secret reconciliation (defaults to empty). */\n  secretsVault?: SecretsVaultReader;\n}): Promise<PlanReport> {\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n  const target = options.target;\n\n  const config = await loadConfig(configPath, { env });\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const drift = await computeDriftReport({ env, configPath });\n\n  const items: PlanItem[] = [];\n\n  for (const r of drift.resources) {\n    const kind = mapDriftKind(r.kind);\n    if (!kind) continue;\n    for (const e of r.undeployed) {\n      items.push({\n        kind,\n        action: \"create\",\n        logicalName: e.logicalName,\n        derivedName: e.derivedName,\n        detail: e.detail,\n      });\n    }\n  }\n\n  if (env !== \"local\") {\n    const api = new CFApiClient(accountId);\n    const naming = namingFromConfig(config);\n    const state = new StateManager(\n      config.tenant.id,\n      env,\n      stackNameForConfig(config),\n    );\n    await state.hydrate(api);\n    // Tolerant pre-fetch: missing sibling state isn't fatal here (plan\n    // is read-only) but populating imports lets the resolver substitute\n    // real values instead of leaving placeholders.\n    const imports = await fetchStackImports(api, config, env);\n\n    const dnsItems = dnsRecordDiffPlanItems({\n      resources: getDnsRecords(config),\n      tenant: config.tenant,\n      env,\n      state,\n    });\n    items.push(...dnsItems);\n\n    const logpushPlanItems = await logpushJobDiffPlanItems({\n      resources: getLogpushJobs(config),\n      tenant: config.tenant,\n      env,\n      state,\n      api,\n      accountId,\n    });\n    items.push(...logpushPlanItems);\n\n    const workers = await getWorkers(config, baseDir);\n    for (const [workerKey, wc] of workers) {\n      const resolved = await resolveWorkerConfig(\n        config,\n        workerKey,\n        wc,\n        env,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        { referencesMode: \"tolerant\", imports },\n      );\n      if (resolved.dispatchNamespace) continue;\n\n      const deployedName = resolveDeployedWorkerName(\n        config,\n        workerKey,\n        wc,\n        env,\n        naming,\n      );\n      for (const mod of resourceModules) {\n        if (!mod.diff) continue;\n        const resources = mod.pickResources(wc);\n        if (resources.length === 0) continue;\n        const diffItems = mod.diff({\n          resources,\n          tenant: config.tenant,\n          env,\n          state,\n          naming,\n          worker: { workerKey, deployedName },\n        });\n        items.push(...diffItems);\n      }\n\n      let script;\n      try {\n        script = await api.workersScriptGet(resolved.workerName);\n      } catch {\n        continue;\n      }\n      if (!script) {\n        items.push({\n          kind: \"worker_script\",\n          action: \"create\",\n          logicalName: workerKey,\n          derivedName: resolved.workerName,\n        });\n      }\n\n      const required = requiredSecretsForWorker(wc);\n      if (required.length > 0) {\n        const workerSecretNames = await safeWorkersSecretsList(\n          api,\n          resolved.workerName,\n        );\n        const secretEntries = await reconcileSecrets({\n          workers: [\n            {\n              workerKey,\n              required,\n              workerSecretNames,\n            },\n          ],\n          vault: options.secretsVault ?? emptySecretsVault(),\n          state,\n        });\n        items.push(...secretsPlanItems(secretEntries));\n      }\n    }\n  }\n\n  const filtered = target ? filterPlanItemsForTarget(items, target) : items;\n\n  return {\n    tenantId: config.tenant.id,\n    env,\n    generatedAt: new Date().toISOString(),\n    items: filtered,\n    hasChanges: filtered.some((i) => i.action !== \"no_change\"),\n    mode: \"forward\",\n  };\n}\n\n/**\n * Compute the planned set of **deletions** for `env` — what `tamer destroy`\n * would remove given the current `tamer.config.ts` and recorded state.\n *\n * Read-only: hits the Cloudflare API only to confirm worker scripts exist,\n * never writes. Items are stack-scoped: only state entries whose\n * `logicalName` is declared on a worker in the current config are emitted —\n * resources owned by another stack sharing the same `tamer-state-{env}` row\n * are **not** included (matches `runDestroy` semantics).\n *\n * Worker scripts are listed when the deployed name actually exists on\n * Cloudflare; dispatch-namespace tenant scripts are intentionally excluded\n * (they are managed via `provision-tenant` / `destroy-tenant`).\n */\nexport async function computeDestroyPlan(options: {\n  env?: string;\n  configPath?: string;\n  target?: ApplyTarget;\n}): Promise<PlanReport> {\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n  const target = options.target;\n\n  const config = await loadConfig(configPath, { env });\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const items: PlanItem[] = [];\n  const generatedAt = new Date().toISOString();\n\n  if (env === \"local\") {\n    return {\n      tenantId: config.tenant.id,\n      env,\n      generatedAt,\n      items,\n      hasChanges: false,\n      mode: \"destroy\",\n    };\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const imports = await fetchStackImports(api, config, env);\n\n  const stateEntries = state.getAll();\n\n  for (const mod of resourceModules) {\n    const owned = await logicalNamesForResourceKind(config, baseDir, mod.kind);\n    if (owned.size === 0) continue;\n    const kind = mapDriftKind(mod.kind);\n    if (!kind) continue;\n    for (const [, entry] of Object.entries(stateEntries)) {\n      if (entry.type !== mod.stateEntryType) continue;\n      const logicalName = (entry as { logicalName?: string }).logicalName;\n      if (!logicalName || !owned.has(logicalName)) continue;\n      items.push({\n        kind,\n        action: \"delete\",\n        logicalName,\n        derivedName: derivedNameOf(entry),\n      });\n    }\n  }\n\n  for (const [, entry] of Object.entries(stateEntries)) {\n    if (entry.type !== \"worker_route\") continue;\n    items.push({\n      kind: \"worker_route\",\n      action: \"delete\",\n      logicalName: entry.workerKey,\n      derivedName: entry.pattern,\n      detail: entry.zoneName,\n    });\n  }\n\n  for (const ns of getDispatchNamespaces(config)) {\n    const stateKey = `dispatch_namespace:${ns.logicalName}`;\n    const entry = stateEntries[stateKey];\n    if (!entry || entry.type !== \"dispatch_namespace\") continue;\n    items.push({\n      kind: \"dispatch_namespace\",\n      action: \"delete\",\n      logicalName: ns.logicalName,\n      derivedName: entry.derivedName,\n    });\n  }\n\n  for (const dns of getDnsRecords(config)) {\n    if (dns.preserveOnDestroy) continue;\n    const key = dnsRecordStateKey(dns.zoneId, dns.type, dns.name);\n    const entry = stateEntries[key];\n    if (!entry || entry.type !== \"dns_record\") continue;\n    items.push({\n      kind: \"dns_record\",\n      action: \"delete\",\n      logicalName: dns.logicalName,\n      derivedName: `${entry.recordType} ${entry.name}`,\n      detail: entry.recordId,\n    });\n  }\n\n  for (const lp of getLogpushJobs(config)) {\n    const key = logpushJobStateKey(config.tenant.id, lp.logicalName, env);\n    const entry = stateEntries[key];\n    if (!entry || entry.type !== \"logpush_job\") continue;\n    items.push({\n      kind: \"logpush_job\",\n      action: \"delete\",\n      logicalName: lp.logicalName,\n      derivedName: entry.derivedName,\n      detail: String(entry.cfJobId),\n    });\n  }\n\n  const workers = await getWorkers(config, baseDir);\n  for (const [workerKey, wc] of workers) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      wc,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports },\n    );\n    if (resolved.dispatchNamespace) continue;\n    const deployedName = resolveDeployedWorkerName(\n      config,\n      workerKey,\n      wc,\n      env,\n      naming,\n    );\n    let script;\n    try {\n      script = await api.workersScriptGet(deployedName);\n    } catch {\n      continue;\n    }\n    if (script) {\n      items.push({\n        kind: \"worker_script\",\n        action: \"delete\",\n        logicalName: workerKey,\n        derivedName: deployedName,\n      });\n    }\n  }\n\n  const filtered = target ? filterPlanItemsForTarget(items, target) : items;\n\n  return {\n    tenantId: config.tenant.id,\n    env,\n    generatedAt,\n    items: filtered,\n    hasChanges: filtered.length > 0,\n    mode: \"destroy\",\n  };\n}\n\nfunction derivedNameOf(entry: StateEntry): string {\n  switch (entry.type) {\n    case \"d1_database\":\n    case \"r2_bucket\":\n    case \"kv_namespace\":\n    case \"queue\":\n    case \"hyperdrive\":\n    case \"vectorize\":\n    case \"ai_gateway\":\n    case \"pipeline\":\n    case \"workflow\":\n    case \"secrets_store\":\n    case \"dispatch_namespace\":\n      return entry.derivedName;\n    case \"dns_record\":\n      return `${entry.recordType} ${entry.name}`;\n    case \"worker_route\":\n      return entry.pattern;\n    case \"logpush_job\":\n      return entry.derivedName;\n    case \"logpush_pipelines\":\n      return entry.pipelineName;\n    case \"secret\":\n      return `${entry.worker}:${entry.name}`;\n  }\n}\n\nfunction emptySecretsVault(): SecretsVaultReader {\n  return vaultReaderFromMap({});\n}\n\nasync function safeWorkersSecretsList(\n  api: CFApiClient,\n  scriptName: string,\n): Promise<string[]> {\n  try {\n    return await api.workersSecretsList(scriptName);\n  } catch {\n    return [];\n  }\n}\n\nfunction mapDriftKind(kind: string): PlanResourceKind | undefined {\n  switch (kind) {\n    case \"d1\":\n    case \"r2\":\n    case \"kv\":\n    case \"queue\":\n    case \"hyperdrive\":\n    case \"vectorize\":\n    case \"ai_gateway\":\n    case \"pipeline\":\n    case \"workflow\":\n    case \"secret_store\":\n    case \"secret\":\n    case \"dns_record\":\n    case \"dispatch_namespace\":\n    case \"logpush_job\":\n    case \"worker_route\":\n      return kind;\n    default:\n      return undefined;\n  }\n}\n","/**\n * Read-only \"plan\" — the CloudFormation-style preview of changes Tamer would\n * make if you ran `apply` and then `deploy` against the current state +\n * config. Pure: never writes to state or to Cloudflare.\n */\n\nexport type PlanResourceKind =\n  | \"d1\"\n  | \"r2\"\n  | \"kv\"\n  | \"queue\"\n  | \"hyperdrive\"\n  | \"vectorize\"\n  | \"ai_gateway\"\n  | \"pipeline\"\n  | \"workflow\"\n  | \"secret_store\"\n  | \"secret\"\n  | \"dns_record\"\n  | \"dispatch_namespace\"\n  | \"logpush_job\"\n  | \"worker_route\"\n  | \"worker_script\";\n\n/**\n * Plan actions, in CloudFormation / Terraform terms:\n *\n * - `create` — declared in config, missing on Cloudflare and in state.\n * - `update` — tracked + present, but **mutable** fields drifted from config →\n *   `apply` would PATCH in place. No replacement.\n * - `replace` — tracked + present, but **immutable** fields drifted from\n *   config → `apply` must delete + recreate (Cloudflare APIs that reject\n *   PATCH on the changed field, e.g. DNS record `type`, Vectorize\n *   `dimensions` / `metric`, Pipelines V1 `sql`). The state row's `cfId`\n *   will change.\n * - `delete` — destroy-plan only.\n * - `no_change` — declared, present, fully in sync.\n */\nexport type PlanAction =\n  | \"create\"\n  | \"update\"\n  | \"replace\"\n  | \"delete\"\n  | \"no_change\";\n\n/**\n * Direction of the plan: forward (the default — what `apply` + `deploy` would\n * change) or destroy (what `destroy` would remove). Plans are mutually\n * exclusive: a forward plan never includes `delete`, and a destroy plan\n * never includes `create` / `update` / `replace`.\n */\nexport type PlanMode = \"forward\" | \"destroy\";\n\n/**\n * Describes one drifted field in an `update` / `replace` plan item — the\n * field path, what state currently holds, and what config wants. Surfaced in\n * `tamer plan --json` so reviewers can audit the change exactly the way\n * `terraform plan` shows attribute diffs.\n */\nexport interface PlanFieldChange {\n  field: string;\n  from: unknown;\n  to: unknown;\n  /**\n   * `mutable` → would patch in place; `immutable` → forces `replace` (the\n   * underlying Cloudflare resource will be destroyed + recreated, and the\n   * state row's `cfId` will change).\n   */\n  kind: \"mutable\" | \"immutable\";\n}\n\nexport interface PlanItem {\n  kind: PlanResourceKind;\n  action: PlanAction;\n  /** Logical name from `tamer.config.ts` (or worker key for scripts/routes). */\n  logicalName: string;\n  /** Cloudflare-side identifier (resource name or pattern). */\n  derivedName: string;\n  /** Optional human-readable detail. */\n  detail?: string;\n  /**\n   * Field-level diff for `update` / `replace` items. Empty for `create` /\n   * `delete` / `no_change`. Each entry shows what state has (`from`) and what\n   * config asks for (`to`).\n   */\n  changes?: PlanFieldChange[];\n}\n\nexport interface PlanReport {\n  tenantId: string;\n  env: string;\n  generatedAt: string;\n  items: PlanItem[];\n  /** True iff at least one item has `action !== \"no_change\"`. */\n  hasChanges: boolean;\n  /** Plan direction. Defaults to `\"forward\"` for back-compat with v0.11 plans. */\n  mode?: PlanMode;\n}\n\nexport function planSummary(items: PlanItem[]): {\n  byKind: Record<PlanResourceKind, number>;\n  byAction: Record<PlanAction, number>;\n} {\n  const byKind: Record<PlanResourceKind, number> = {\n    d1: 0,\n    r2: 0,\n    kv: 0,\n    queue: 0,\n    hyperdrive: 0,\n    vectorize: 0,\n    ai_gateway: 0,\n    pipeline: 0,\n    workflow: 0,\n    secret_store: 0,\n    secret: 0,\n    dns_record: 0,\n    dispatch_namespace: 0,\n    logpush_job: 0,\n    worker_route: 0,\n    worker_script: 0,\n  };\n  const byAction: Record<PlanAction, number> = {\n    create: 0,\n    update: 0,\n    replace: 0,\n    delete: 0,\n    no_change: 0,\n  };\n  for (const it of items) {\n    if (it.action === \"no_change\") continue;\n    byKind[it.kind]++;\n    byAction[it.action]++;\n  }\n  return { byKind, byAction };\n}\n","import { computePlan, computeDestroyPlan } from \"../../core/plan/computePlan.js\";\nimport { planSummary } from \"../../core/plan/plan.types.js\";\nimport type {\n  PlanItem,\n  PlanReport,\n  PlanResourceKind,\n} from \"../../core/plan/plan.types.js\";\nimport { formatPlanFieldChanges, signFor } from \"../../core/plan/planFormat.js\";\nimport { loadConfig } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport {\n  PLAN_FILE_FORMAT,\n  computeAttestation,\n  writePlanFile,\n} from \"../../core/plan/planFile.js\";\nimport { createEmptyCfiState } from \"../../core/state/tamerStateDb.js\";\nimport { buildCloudflareSnapshot } from \"../../core/plan/cloudflareSnapshot.js\";\nimport {\n  parseApplyTarget,\n  assertApplyTargetDeclared,\n} from \"../../core/apply/applyTarget.js\";\n\n/**\n * `tamer plan` — print a CloudFormation-style preview of `apply` + `deploy`\n * against the current state, config, and Cloudflare reality. Never mutates.\n *\n * Exit codes:\n *   0 — plan succeeded; with `--detailed-exitcode`, also \"no changes\".\n *   2 — plan succeeded **and** has at least one create/update (with\n *       `--detailed-exitcode`); useful for CI gates that want to fail when\n *       infra would change.\n */\nexport async function runPlan(options: {\n  env?: string;\n  configPath?: string;\n  json?: boolean;\n  detailedExitcode?: boolean;\n  /** When set, write the plan + attestation hashes to this path. */\n  out?: string;\n  /**\n   * When true, compute a **destroy plan** (what `tamer destroy` would remove\n   * from state and Cloudflare) instead of the default forward plan. Mutually\n   * exclusive with the forward plan — destroy plans only contain `delete`\n   * items, never `create` / `update`. Read-only.\n   */\n  destroy?: boolean;\n  /** `kind:logicalName` — restrict plan items to that resource. */\n  target?: string;\n}): Promise<number> {\n  if (options.out && options.target) {\n    throw new Error(\n      \"Cannot combine --out with --target: saved plans must cover the full stack.\",\n    );\n  }\n\n  const target = options.target\n    ? parseApplyTarget(options.target)\n    : undefined;\n  if (target) {\n    const config = await loadConfig(options.configPath, {\n      env: options.env ?? \"local\",\n    });\n    await assertApplyTargetDeclared(config, process.cwd(), target);\n  }\n\n  const report = options.destroy\n    ? await computeDestroyPlan({\n        env: options.env,\n        configPath: options.configPath,\n        target,\n      })\n    : await computePlan({\n        env: options.env,\n        configPath: options.configPath,\n        target,\n      });\n\n  if (options.out) {\n    await writePlanForApply(options.out, report, options.configPath);\n  }\n\n  if (options.json) {\n    console.log(JSON.stringify(report, null, 2));\n  } else {\n    printHumanPlan(report);\n    if (options.out) {\n      console.log(`Plan written to ${options.out}\\n`);\n    }\n  }\n\n  if (options.detailedExitcode && report.hasChanges) {\n    return 2;\n  }\n  return 0;\n}\n\n/**\n * Hydrate the same `(config, state)` pair `computePlan` consumed and write\n * a {@link PlanFile} with the attestation hashes pinned. `apply --plan`\n * recomputes both hashes and refuses to proceed if either drifted, so a\n * stale plan can never silently apply against changed inputs.\n */\nasync function writePlanForApply(\n  outPath: string,\n  report: PlanReport,\n  configPath: string | undefined,\n): Promise<void> {\n  const config = await loadConfig(configPath, { env: report.env });\n  if (report.env === \"local\") {\n    const attestation = computeAttestation(\n      config,\n      createEmptyCfiState(config.tenant.id, \"local\"),\n    );\n    writePlanFile(outPath, {\n      format: PLAN_FILE_FORMAT,\n      tenantId: config.tenant.id,\n      env: report.env,\n      generatedAt: report.generatedAt,\n      report,\n      attestation,\n    });\n    return;\n  }\n\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    report.env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const cloudflareSnapshot = await buildCloudflareSnapshot({\n    config,\n    env: report.env,\n    api,\n    baseDir: process.cwd(),\n  });\n  const attestation = computeAttestation(\n    config,\n    state.load(),\n    cloudflareSnapshot,\n  );\n  writePlanFile(outPath, {\n    format: PLAN_FILE_FORMAT,\n    tenantId: config.tenant.id,\n    env: report.env,\n    generatedAt: report.generatedAt,\n    report,\n    attestation,\n  });\n}\n\nfunction printHumanPlan(report: PlanReport): void {\n  const isDestroy = report.mode === \"destroy\";\n  const heading = isDestroy ? \"Destroy plan\" : \"Plan\";\n  console.log(\n    `\\n${heading} — tenant ${report.tenantId}, env ${report.env}\\n`,\n  );\n  if (report.items.length === 0) {\n    if (isDestroy) {\n      console.log(\"  (nothing to destroy — no managed resources in state)\\n\");\n    } else {\n      console.log(\"  (no changes — infrastructure matches config)\\n\");\n    }\n    return;\n  }\n  const grouped = new Map<PlanResourceKind, PlanItem[]>();\n  for (const it of report.items) {\n    const arr = grouped.get(it.kind) ?? [];\n    arr.push(it);\n    grouped.set(it.kind, arr);\n  }\n  for (const [kind, items] of grouped) {\n    console.log(`${labelFor(kind)} (${items.length}):`);\n    for (const it of items) {\n      const sign = signFor(it.action);\n      // Suppress `detail` on update/replace items when we have a structured\n      // `changes[]` block — the per-field renderer below already shows the\n      // same drift in terraform-style form, and printing both duplicates\n      // the diff and clutters the output.\n      const hasChanges = it.changes && it.changes.length > 0;\n      const detail = it.detail && !hasChanges ? ` (${it.detail})` : \"\";\n      console.log(`  ${sign} ${it.logicalName} -> ${it.derivedName}${detail}`);\n      for (const line of formatPlanFieldChanges(it.changes)) {\n        console.log(line);\n      }\n    }\n  }\n  const { byAction } = planSummary(report.items);\n  if (isDestroy) {\n    console.log(`\\nSummary: ${byAction.delete} to delete.\\n`);\n  } else {\n    console.log(\n      `\\nSummary: ${byAction.create} to create, ${byAction.update} to update, ${byAction.replace} to replace.\\n`,\n    );\n  }\n}\n\nfunction labelFor(kind: PlanResourceKind): string {\n  switch (kind) {\n    case \"d1\":\n      return \"D1\";\n    case \"r2\":\n      return \"R2\";\n    case \"kv\":\n      return \"KV\";\n    case \"queue\":\n      return \"Queues\";\n    case \"hyperdrive\":\n      return \"Hyperdrive\";\n    case \"vectorize\":\n      return \"Vectorize\";\n    case \"ai_gateway\":\n      return \"AI Gateway\";\n    case \"pipeline\":\n      return \"Pipeline\";\n    case \"workflow\":\n      return \"Workflow\";\n    case \"secret_store\":\n      return \"Secrets Store\";\n    case \"secret\":\n      return \"Worker secrets\";\n    case \"dns_record\":\n      return \"DNS records\";\n    case \"dispatch_namespace\":\n      return \"Dispatch namespaces\";\n    case \"logpush_job\":\n      return \"Logpush jobs\";\n    case \"worker_route\":\n      return \"Workers zone routes\";\n    case \"worker_script\":\n      return \"Worker scripts\";\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA4CA,eAAsB,YAAY,SAOV;CACtB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAC7B,MAAM,SAAS,QAAQ;CAEvB,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,QAAQ,MAAM,mBAAmB;EAAE;EAAK;EAAY,CAAC;CAE3D,MAAMA,QAAoB,EAAE;AAE5B,MAAK,MAAM,KAAK,MAAM,WAAW;EAC/B,MAAM,OAAO,aAAa,EAAE,KAAK;AACjC,MAAI,CAAC,KAAM;AACX,OAAK,MAAM,KAAK,EAAE,WAChB,OAAM,KAAK;GACT;GACA,QAAQ;GACR,aAAa,EAAE;GACf,aAAa,EAAE;GACf,QAAQ,EAAE;GACX,CAAC;;AAIN,KAAI,QAAQ,SAAS;EACnB,MAAM,MAAM,IAAI,YAAY,UAAU;EACtC,MAAM,SAAS,iBAAiB,OAAO;EACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,QAAM,MAAM,QAAQ,IAAI;EAIxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;EAEzD,MAAM,WAAW,uBAAuB;GACtC,WAAW,cAAc,OAAO;GAChC,QAAQ,OAAO;GACf;GACA;GACD,CAAC;AACF,QAAM,KAAK,GAAG,SAAS;EAEvB,MAAM,mBAAmB,MAAM,wBAAwB;GACrD,WAAW,eAAe,OAAO;GACjC,QAAQ,OAAO;GACf;GACA;GACA;GACA;GACD,CAAC;AACF,QAAM,KAAK,GAAG,iBAAiB;EAE/B,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,OAAK,MAAM,CAAC,WAAW,OAAO,SAAS;GACrC,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,IACA,KACA,SACA,WACA,QACA,OACA;IAAE,gBAAgB;IAAY;IAAS,CACxC;AACD,OAAI,SAAS,kBAAmB;GAEhC,MAAM,eAAe,0BACnB,QACA,WACA,IACA,KACA,OACD;AACD,QAAK,MAAM,OAAO,iBAAiB;AACjC,QAAI,CAAC,IAAI,KAAM;IACf,MAAM,YAAY,IAAI,cAAc,GAAG;AACvC,QAAI,UAAU,WAAW,EAAG;IAC5B,MAAM,YAAY,IAAI,KAAK;KACzB;KACA,QAAQ,OAAO;KACf;KACA;KACA;KACA,QAAQ;MAAE;MAAW;MAAc;KACpC,CAAC;AACF,UAAM,KAAK,GAAG,UAAU;;GAG1B,IAAI;AACJ,OAAI;AACF,aAAS,MAAM,IAAI,iBAAiB,SAAS,WAAW;WAClD;AACN;;AAEF,OAAI,CAAC,OACH,OAAM,KAAK;IACT,MAAM;IACN,QAAQ;IACR,aAAa;IACb,aAAa,SAAS;IACvB,CAAC;GAGJ,MAAM,WAAW,yBAAyB,GAAG;AAC7C,OAAI,SAAS,SAAS,GAAG;IAKvB,MAAM,gBAAgB,MAAM,iBAAiB;KAC3C,SAAS,CACP;MACE;MACA;MACA,mBAToB,MAAM,uBAC9B,KACA,SAAS,WACV;MAOI,CACF;KACD,OAAO,QAAQ,gBAAgB,mBAAmB;KAClD;KACD,CAAC;AACF,UAAM,KAAK,GAAG,iBAAiB,cAAc,CAAC;;;;CAKpD,MAAM,WAAW,SAAS,yBAAyB,OAAO,OAAO,GAAG;AAEpE,QAAO;EACL,UAAU,OAAO,OAAO;EACxB;EACA,8BAAa,IAAI,MAAM,EAAC,aAAa;EACrC,OAAO;EACP,YAAY,SAAS,MAAM,MAAM,EAAE,WAAW,YAAY;EAC1D,MAAM;EACP;;;;;;;;;;;;;;;;AAiBH,eAAsB,mBAAmB,SAIjB;CACtB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAC7B,MAAM,SAAS,QAAQ;CAEvB,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAMA,QAAoB,EAAE;CAC5B,MAAM,+BAAc,IAAI,MAAM,EAAC,aAAa;AAE5C,KAAI,QAAQ,QACV,QAAO;EACL,UAAU,OAAO,OAAO;EACxB;EACA;EACA;EACA,YAAY;EACZ,MAAM;EACP;CAGH,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;CAEzD,MAAM,eAAe,MAAM,QAAQ;AAEnC,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,QAAQ,MAAM,4BAA4B,QAAQ,SAAS,IAAI,KAAK;AAC1E,MAAI,MAAM,SAAS,EAAG;EACtB,MAAM,OAAO,aAAa,IAAI,KAAK;AACnC,MAAI,CAAC,KAAM;AACX,OAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,aAAa,EAAE;AACpD,OAAI,MAAM,SAAS,IAAI,eAAgB;GACvC,MAAM,cAAe,MAAmC;AACxD,OAAI,CAAC,eAAe,CAAC,MAAM,IAAI,YAAY,CAAE;AAC7C,SAAM,KAAK;IACT;IACA,QAAQ;IACR;IACA,aAAa,cAAc,MAAM;IAClC,CAAC;;;AAIN,MAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,aAAa,EAAE;AACpD,MAAI,MAAM,SAAS,eAAgB;AACnC,QAAM,KAAK;GACT,MAAM;GACN,QAAQ;GACR,aAAa,MAAM;GACnB,aAAa,MAAM;GACnB,QAAQ,MAAM;GACf,CAAC;;AAGJ,MAAK,MAAM,MAAM,sBAAsB,OAAO,EAAE;EAE9C,MAAM,QAAQ,aADG,sBAAsB,GAAG;AAE1C,MAAI,CAAC,SAAS,MAAM,SAAS,qBAAsB;AACnD,QAAM,KAAK;GACT,MAAM;GACN,QAAQ;GACR,aAAa,GAAG;GAChB,aAAa,MAAM;GACpB,CAAC;;AAGJ,MAAK,MAAM,OAAO,cAAc,OAAO,EAAE;AACvC,MAAI,IAAI,kBAAmB;EAE3B,MAAM,QAAQ,aADF,kBAAkB,IAAI,QAAQ,IAAI,MAAM,IAAI,KAAK;AAE7D,MAAI,CAAC,SAAS,MAAM,SAAS,aAAc;AAC3C,QAAM,KAAK;GACT,MAAM;GACN,QAAQ;GACR,aAAa,IAAI;GACjB,aAAa,GAAG,MAAM,WAAW,GAAG,MAAM;GAC1C,QAAQ,MAAM;GACf,CAAC;;AAGJ,MAAK,MAAM,MAAM,eAAe,OAAO,EAAE;EAEvC,MAAM,QAAQ,aADF,mBAAmB,OAAO,OAAO,IAAI,GAAG,aAAa,IAAI;AAErE,MAAI,CAAC,SAAS,MAAM,SAAS,cAAe;AAC5C,QAAM,KAAK;GACT,MAAM;GACN,QAAQ;GACR,aAAa,GAAG;GAChB,aAAa,MAAM;GACnB,QAAQ,OAAO,MAAM,QAAQ;GAC9B,CAAC;;CAGJ,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,MAAK,MAAM,CAAC,WAAW,OAAO,SAAS;AAYrC,OAXiB,MAAM,oBACrB,QACA,WACA,IACA,KACA,SACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY;GAAS,CACxC,EACY,kBAAmB;EAChC,MAAM,eAAe,0BACnB,QACA,WACA,IACA,KACA,OACD;EACD,IAAI;AACJ,MAAI;AACF,YAAS,MAAM,IAAI,iBAAiB,aAAa;UAC3C;AACN;;AAEF,MAAI,OACF,OAAM,KAAK;GACT,MAAM;GACN,QAAQ;GACR,aAAa;GACb,aAAa;GACd,CAAC;;CAIN,MAAM,WAAW,SAAS,yBAAyB,OAAO,OAAO,GAAG;AAEpE,QAAO;EACL,UAAU,OAAO,OAAO;EACxB;EACA;EACA,OAAO;EACP,YAAY,SAAS,SAAS;EAC9B,MAAM;EACP;;AAGH,SAAS,cAAc,OAA2B;AAChD,SAAQ,MAAM,MAAd;EACE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,qBACH,QAAO,MAAM;EACf,KAAK,aACH,QAAO,GAAG,MAAM,WAAW,GAAG,MAAM;EACtC,KAAK,eACH,QAAO,MAAM;EACf,KAAK,cACH,QAAO,MAAM;EACf,KAAK,oBACH,QAAO,MAAM;EACf,KAAK,SACH,QAAO,GAAG,MAAM,OAAO,GAAG,MAAM;;;AAItC,SAAS,oBAAwC;AAC/C,QAAO,mBAAmB,EAAE,CAAC;;AAG/B,eAAe,uBACb,KACA,YACmB;AACnB,KAAI;AACF,SAAO,MAAM,IAAI,mBAAmB,WAAW;SACzC;AACN,SAAO,EAAE;;;AAIb,SAAS,aAAa,MAA4C;AAChE,SAAQ,MAAR;EACE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,eACH,QAAO;EACT,QACE;;;;;;AClVN,SAAgB,YAAY,OAG1B;CACA,MAAMC,SAA2C;EAC/C,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,OAAO;EACP,YAAY;EACZ,WAAW;EACX,YAAY;EACZ,UAAU;EACV,UAAU;EACV,cAAc;EACd,QAAQ;EACR,YAAY;EACZ,oBAAoB;EACpB,aAAa;EACb,cAAc;EACd,eAAe;EAChB;CACD,MAAMC,WAAuC;EAC3C,QAAQ;EACR,QAAQ;EACR,SAAS;EACT,QAAQ;EACR,WAAW;EACZ;AACD,MAAK,MAAM,MAAM,OAAO;AACtB,MAAI,GAAG,WAAW,YAAa;AAC/B,SAAO,GAAG;AACV,WAAS,GAAG;;AAEd,QAAO;EAAE;EAAQ;EAAU;;;;;;;;;;;;;;;AClG7B,eAAsB,QAAQ,SAgBV;AAClB,KAAI,QAAQ,OAAO,QAAQ,OACzB,OAAM,IAAI,MACR,6EACD;CAGH,MAAM,SAAS,QAAQ,SACnB,iBAAiB,QAAQ,OAAO,GAChC;AACJ,KAAI,OAIF,OAAM,0BAHS,MAAM,WAAW,QAAQ,YAAY,EAClD,KAAK,QAAQ,OAAO,SACrB,CAAC,EACsC,QAAQ,KAAK,EAAE,OAAO;CAGhE,MAAM,SAAS,QAAQ,UACnB,MAAM,mBAAmB;EACvB,KAAK,QAAQ;EACb,YAAY,QAAQ;EACpB;EACD,CAAC,GACF,MAAM,YAAY;EAChB,KAAK,QAAQ;EACb,YAAY,QAAQ;EACpB;EACD,CAAC;AAEN,KAAI,QAAQ,IACV,OAAM,kBAAkB,QAAQ,KAAK,QAAQ,QAAQ,WAAW;AAGlE,KAAI,QAAQ,KACV,SAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC;MACvC;AACL,iBAAe,OAAO;AACtB,MAAI,QAAQ,IACV,SAAQ,IAAI,mBAAmB,QAAQ,IAAI,IAAI;;AAInD,KAAI,QAAQ,oBAAoB,OAAO,WACrC,QAAO;AAET,QAAO;;;;;;;;AAST,eAAe,kBACb,SACA,QACA,YACe;CACf,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,OAAO,KAAK,CAAC;AAChE,KAAI,OAAO,QAAQ,SAAS;EAC1B,MAAMC,gBAAc,mBAClB,QACA,oBAAoB,OAAO,OAAO,IAAI,QAAQ,CAC/C;AACD,gBAAc,SAAS;GACrB,QAAQ;GACR,UAAU,OAAO,OAAO;GACxB,KAAK,OAAO;GACZ,aAAa,OAAO;GACpB;GACA;GACD,CAAC;AACF;;CAGF,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAEH,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,OAAO,KACP,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,qBAAqB,MAAM,wBAAwB;EACvD;EACA,KAAK,OAAO;EACZ;EACA,SAAS,QAAQ,KAAK;EACvB,CAAC;CACF,MAAM,cAAc,mBAClB,QACA,MAAM,MAAM,EACZ,mBACD;AACD,eAAc,SAAS;EACrB,QAAQ;EACR,UAAU,OAAO,OAAO;EACxB,KAAK,OAAO;EACZ,aAAa,OAAO;EACpB;EACA;EACD,CAAC;;AAGJ,SAAS,eAAe,QAA0B;CAChD,MAAM,YAAY,OAAO,SAAS;CAClC,MAAM,UAAU,YAAY,iBAAiB;AAC7C,SAAQ,IACN,KAAK,QAAQ,YAAY,OAAO,SAAS,QAAQ,OAAO,IAAI,IAC7D;AACD,KAAI,OAAO,MAAM,WAAW,GAAG;AAC7B,MAAI,UACF,SAAQ,IAAI,2DAA2D;MAEvE,SAAQ,IAAI,mDAAmD;AAEjE;;CAEF,MAAM,0BAAU,IAAI,KAAmC;AACvD,MAAK,MAAM,MAAM,OAAO,OAAO;EAC7B,MAAM,MAAM,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE;AACtC,MAAI,KAAK,GAAG;AACZ,UAAQ,IAAI,GAAG,MAAM,IAAI;;AAE3B,MAAK,MAAM,CAAC,MAAM,UAAU,SAAS;AACnC,UAAQ,IAAI,GAAG,SAAS,KAAK,CAAC,IAAI,MAAM,OAAO,IAAI;AACnD,OAAK,MAAM,MAAM,OAAO;GACtB,MAAM,OAAO,QAAQ,GAAG,OAAO;GAK/B,MAAM,aAAa,GAAG,WAAW,GAAG,QAAQ,SAAS;GACrD,MAAM,SAAS,GAAG,UAAU,CAAC,aAAa,KAAK,GAAG,OAAO,KAAK;AAC9D,WAAQ,IAAI,KAAK,KAAK,GAAG,GAAG,YAAY,MAAM,GAAG,cAAc,SAAS;AACxE,QAAK,MAAM,QAAQ,uBAAuB,GAAG,QAAQ,CACnD,SAAQ,IAAI,KAAK;;;CAIvB,MAAM,EAAE,aAAa,YAAY,OAAO,MAAM;AAC9C,KAAI,UACF,SAAQ,IAAI,cAAc,SAAS,OAAO,eAAe;KAEzD,SAAQ,IACN,cAAc,SAAS,OAAO,cAAc,SAAS,OAAO,cAAc,SAAS,QAAQ,gBAC5F;;AAIL,SAAS,SAAS,MAAgC;AAChD,SAAQ,MAAR;EACE,KAAK,KACH,QAAO;EACT,KAAK,KACH,QAAO;EACT,KAAK,KACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,KAAK,aACH,QAAO;EACT,KAAK,YACH,QAAO;EACT,KAAK,aACH,QAAO;EACT,KAAK,WACH,QAAO;EACT,KAAK,WACH,QAAO;EACT,KAAK,eACH,QAAO;EACT,KAAK,SACH,QAAO;EACT,KAAK,aACH,QAAO;EACT,KAAK,qBACH,QAAO;EACT,KAAK,cACH,QAAO;EACT,KAAK,eACH,QAAO;EACT,KAAK,gBACH,QAAO"}
+{"version":3,"file":"plan-C8oQWM35.mjs","names":["items: PlanItem[]","byKind: Record<PlanResourceKind, number>","byAction: Record<PlanAction, number>","attestation"],"sources":["../src/core/plan/computePlan.ts","../src/core/plan/plan.types.ts","../src/cli/commands/plan.ts"],"sourcesContent":["import { loadConfig, getWorkers } from \"../config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../cloudflareEnv.js\";\nimport { namingFromConfig } from \"../config/namingFromConfig.js\";\nimport { StateManager } from \"../state/StateManager.js\";\nimport { stackNameForConfig } from \"../state/stackName.js\";\nimport { fetchStackImports } from \"../imports/fetchStackImports.js\";\nimport { CFApiClient } from \"../api/CFApiClient.js\";\nimport { computeDriftReport } from \"../../cli/commands/drift.js\";\nimport { resolveWorkerConfig } from \"../config/resolver.js\";\nimport { resourceModules } from \"../registry/registry.js\";\nimport { logicalNamesForResourceKind } from \"../config/resourcesFromConfig.js\";\nimport { resolveDeployedWorkerName } from \"../config/resolver.js\";\nimport { requiredSecretsForWorker } from \"../secrets/declared.js\";\nimport {\n  reconcileSecrets,\n  secretsPlanItems,\n  vaultReaderFromMap,\n  type SecretsVaultReader,\n  type VaultSecretMeta,\n} from \"../secrets/reconcile.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobStateKey } from \"../../features/logpush-job/logpush-job.resolve.js\";\nimport { logpushJobDiffPlanItems } from \"../../features/logpush-job/logpush-job.diff.js\";\nimport {\n  dnsRecordDiffPlanItems,\n} from \"../../features/dns-records/dns-records.diff.js\";\nimport { dnsRecordStateKey } from \"../../features/dns-records/dns-records.resolve.js\";\nimport type { StateEntry } from \"../../types.js\";\nimport type { PlanItem, PlanReport, PlanResourceKind } from \"./plan.types.js\";\nimport {\n  filterPlanItemsForTarget,\n  type ApplyTarget,\n} from \"../apply/applyTarget.js\";\n\n/**\n * Compute the planned set of changes for `env` given the current\n * `tamer.config.ts` and recorded state. Read-only: hits the Cloudflare API to\n * detect what is missing but never writes.\n *\n * The \"would create\" set is derived from `computeDriftReport().undeployed`:\n * declared in config, present neither in state nor on Cloudflare. Worker\n * **scripts** are queried directly (`workersScriptGet`) since they are not\n * tracked as state resources today.\n */\nexport async function computePlan(options: {\n  env?: string;\n  configPath?: string;\n  /** When set, only plan items for this `kind:logical` are returned. */\n  target?: ApplyTarget;\n  /** Optional vault reader for secret reconciliation (defaults to empty). */\n  secretsVault?: SecretsVaultReader;\n}): Promise<PlanReport> {\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n  const target = options.target;\n\n  const config = await loadConfig(configPath, { env });\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const drift = await computeDriftReport({ env, configPath });\n\n  const items: PlanItem[] = [];\n\n  for (const r of drift.resources) {\n    const kind = mapDriftKind(r.kind);\n    if (!kind) continue;\n    for (const e of r.undeployed) {\n      items.push({\n        kind,\n        action: \"create\",\n        logicalName: e.logicalName,\n        derivedName: e.derivedName,\n        detail: e.detail,\n      });\n    }\n  }\n\n  if (env !== \"local\") {\n    const api = new CFApiClient(accountId);\n    const naming = namingFromConfig(config);\n    const state = new StateManager(\n      config.tenant.id,\n      env,\n      stackNameForConfig(config),\n    );\n    await state.hydrate(api);\n    // Tolerant pre-fetch: missing sibling state isn't fatal here (plan\n    // is read-only) but populating imports lets the resolver substitute\n    // real values instead of leaving placeholders.\n    const imports = await fetchStackImports(api, config, env);\n\n    const dnsItems = dnsRecordDiffPlanItems({\n      resources: getDnsRecords(config),\n      tenant: config.tenant,\n      env,\n      state,\n    });\n    items.push(...dnsItems);\n\n    const logpushPlanItems = await logpushJobDiffPlanItems({\n      resources: getLogpushJobs(config),\n      tenant: config.tenant,\n      env,\n      state,\n      api,\n      accountId,\n    });\n    items.push(...logpushPlanItems);\n\n    const workers = await getWorkers(config, baseDir);\n    for (const [workerKey, wc] of workers) {\n      const resolved = await resolveWorkerConfig(\n        config,\n        workerKey,\n        wc,\n        env,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        { referencesMode: \"tolerant\", imports },\n      );\n      if (resolved.dispatchNamespace) continue;\n\n      const deployedName = resolveDeployedWorkerName(\n        config,\n        workerKey,\n        wc,\n        env,\n        naming,\n      );\n      for (const mod of resourceModules) {\n        if (!mod.diff) continue;\n        const resources = mod.pickResources(wc);\n        if (resources.length === 0) continue;\n        const diffItems = mod.diff({\n          resources,\n          tenant: config.tenant,\n          env,\n          state,\n          naming,\n          worker: { workerKey, deployedName },\n        });\n        items.push(...diffItems);\n      }\n\n      let script;\n      try {\n        script = await api.workersScriptGet(resolved.workerName);\n      } catch {\n        continue;\n      }\n      if (!script) {\n        items.push({\n          kind: \"worker_script\",\n          action: \"create\",\n          logicalName: workerKey,\n          derivedName: resolved.workerName,\n        });\n      }\n\n      const required = requiredSecretsForWorker(wc);\n      if (required.length > 0) {\n        const workerSecretNames = await safeWorkersSecretsList(\n          api,\n          resolved.workerName,\n        );\n        const secretEntries = await reconcileSecrets({\n          workers: [\n            {\n              workerKey,\n              required,\n              workerSecretNames,\n            },\n          ],\n          vault: options.secretsVault ?? emptySecretsVault(),\n          state,\n        });\n        items.push(...secretsPlanItems(secretEntries));\n      }\n    }\n  }\n\n  const filtered = target ? filterPlanItemsForTarget(items, target) : items;\n\n  return {\n    tenantId: config.tenant.id,\n    env,\n    generatedAt: new Date().toISOString(),\n    items: filtered,\n    hasChanges: filtered.some((i) => i.action !== \"no_change\"),\n    mode: \"forward\",\n  };\n}\n\n/**\n * Compute the planned set of **deletions** for `env` — what `tamer destroy`\n * would remove given the current `tamer.config.ts` and recorded state.\n *\n * Read-only: hits the Cloudflare API only to confirm worker scripts exist,\n * never writes. Items are stack-scoped: only state entries whose\n * `logicalName` is declared on a worker in the current config are emitted —\n * resources owned by another stack sharing the same `tamer-state-{env}` row\n * are **not** included (matches `runDestroy` semantics).\n *\n * Worker scripts are listed when the deployed name actually exists on\n * Cloudflare; dispatch-namespace tenant scripts are intentionally excluded\n * (they are managed via `provision-tenant` / `destroy-tenant`).\n */\nexport async function computeDestroyPlan(options: {\n  env?: string;\n  configPath?: string;\n  target?: ApplyTarget;\n}): Promise<PlanReport> {\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n  const target = options.target;\n\n  const config = await loadConfig(configPath, { env });\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const items: PlanItem[] = [];\n  const generatedAt = new Date().toISOString();\n\n  if (env === \"local\") {\n    return {\n      tenantId: config.tenant.id,\n      env,\n      generatedAt,\n      items,\n      hasChanges: false,\n      mode: \"destroy\",\n    };\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const imports = await fetchStackImports(api, config, env);\n\n  const stateEntries = state.getAll();\n\n  for (const mod of resourceModules) {\n    const owned = await logicalNamesForResourceKind(config, baseDir, mod.kind);\n    if (owned.size === 0) continue;\n    const kind = mapDriftKind(mod.kind);\n    if (!kind) continue;\n    for (const [, entry] of Object.entries(stateEntries)) {\n      if (entry.type !== mod.stateEntryType) continue;\n      const logicalName = (entry as { logicalName?: string }).logicalName;\n      if (!logicalName || !owned.has(logicalName)) continue;\n      items.push({\n        kind,\n        action: \"delete\",\n        logicalName,\n        derivedName: derivedNameOf(entry),\n      });\n    }\n  }\n\n  for (const [, entry] of Object.entries(stateEntries)) {\n    if (entry.type !== \"worker_route\") continue;\n    items.push({\n      kind: \"worker_route\",\n      action: \"delete\",\n      logicalName: entry.workerKey,\n      derivedName: entry.pattern,\n      detail: entry.zoneName,\n    });\n  }\n\n  for (const ns of getDispatchNamespaces(config)) {\n    const stateKey = `dispatch_namespace:${ns.logicalName}`;\n    const entry = stateEntries[stateKey];\n    if (!entry || entry.type !== \"dispatch_namespace\") continue;\n    items.push({\n      kind: \"dispatch_namespace\",\n      action: \"delete\",\n      logicalName: ns.logicalName,\n      derivedName: entry.derivedName,\n    });\n  }\n\n  for (const dns of getDnsRecords(config)) {\n    if (dns.preserveOnDestroy) continue;\n    const key = dnsRecordStateKey(dns.zoneId, dns.type, dns.name);\n    const entry = stateEntries[key];\n    if (!entry || entry.type !== \"dns_record\") continue;\n    items.push({\n      kind: \"dns_record\",\n      action: \"delete\",\n      logicalName: dns.logicalName,\n      derivedName: `${entry.recordType} ${entry.name}`,\n      detail: entry.recordId,\n    });\n  }\n\n  for (const lp of getLogpushJobs(config)) {\n    const key = logpushJobStateKey(config.tenant.id, lp.logicalName, env);\n    const entry = stateEntries[key];\n    if (!entry || entry.type !== \"logpush_job\") continue;\n    items.push({\n      kind: \"logpush_job\",\n      action: \"delete\",\n      logicalName: lp.logicalName,\n      derivedName: entry.derivedName,\n      detail: String(entry.cfJobId),\n    });\n  }\n\n  const workers = await getWorkers(config, baseDir);\n  for (const [workerKey, wc] of workers) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      wc,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports },\n    );\n    if (resolved.dispatchNamespace) continue;\n    const deployedName = resolveDeployedWorkerName(\n      config,\n      workerKey,\n      wc,\n      env,\n      naming,\n    );\n    let script;\n    try {\n      script = await api.workersScriptGet(deployedName);\n    } catch {\n      continue;\n    }\n    if (script) {\n      items.push({\n        kind: \"worker_script\",\n        action: \"delete\",\n        logicalName: workerKey,\n        derivedName: deployedName,\n      });\n    }\n  }\n\n  const filtered = target ? filterPlanItemsForTarget(items, target) : items;\n\n  return {\n    tenantId: config.tenant.id,\n    env,\n    generatedAt,\n    items: filtered,\n    hasChanges: filtered.length > 0,\n    mode: \"destroy\",\n  };\n}\n\nfunction derivedNameOf(entry: StateEntry): string {\n  switch (entry.type) {\n    case \"d1_database\":\n    case \"r2_bucket\":\n    case \"kv_namespace\":\n    case \"queue\":\n    case \"hyperdrive\":\n    case \"vectorize\":\n    case \"ai_gateway\":\n    case \"pipeline\":\n    case \"workflow\":\n    case \"secrets_store\":\n    case \"dispatch_namespace\":\n      return entry.derivedName;\n    case \"dns_record\":\n      return `${entry.recordType} ${entry.name}`;\n    case \"worker_route\":\n      return entry.pattern;\n    case \"logpush_job\":\n      return entry.derivedName;\n    case \"logpush_pipelines\":\n      return entry.pipelineName;\n    case \"secret\":\n      return `${entry.worker}:${entry.name}`;\n  }\n}\n\nfunction emptySecretsVault(): SecretsVaultReader {\n  return vaultReaderFromMap({});\n}\n\nasync function safeWorkersSecretsList(\n  api: CFApiClient,\n  scriptName: string,\n): Promise<string[]> {\n  try {\n    return await api.workersSecretsList(scriptName);\n  } catch {\n    return [];\n  }\n}\n\nfunction mapDriftKind(kind: string): PlanResourceKind | undefined {\n  switch (kind) {\n    case \"d1\":\n    case \"r2\":\n    case \"kv\":\n    case \"queue\":\n    case \"hyperdrive\":\n    case \"vectorize\":\n    case \"ai_gateway\":\n    case \"pipeline\":\n    case \"workflow\":\n    case \"secret_store\":\n    case \"secret\":\n    case \"dns_record\":\n    case \"dispatch_namespace\":\n    case \"logpush_job\":\n    case \"worker_route\":\n      return kind;\n    default:\n      return undefined;\n  }\n}\n","/**\n * Read-only \"plan\" — the CloudFormation-style preview of changes Tamer would\n * make if you ran `apply` and then `deploy` against the current state +\n * config. Pure: never writes to state or to Cloudflare.\n */\n\nexport type PlanResourceKind =\n  | \"d1\"\n  | \"r2\"\n  | \"kv\"\n  | \"queue\"\n  | \"hyperdrive\"\n  | \"vectorize\"\n  | \"ai_gateway\"\n  | \"pipeline\"\n  | \"workflow\"\n  | \"secret_store\"\n  | \"secret\"\n  | \"dns_record\"\n  | \"dispatch_namespace\"\n  | \"logpush_job\"\n  | \"worker_route\"\n  | \"worker_script\";\n\n/**\n * Plan actions, in CloudFormation / Terraform terms:\n *\n * - `create` — declared in config, missing on Cloudflare and in state.\n * - `update` — tracked + present, but **mutable** fields drifted from config →\n *   `apply` would PATCH in place. No replacement.\n * - `replace` — tracked + present, but **immutable** fields drifted from\n *   config → `apply` must delete + recreate (Cloudflare APIs that reject\n *   PATCH on the changed field, e.g. DNS record `type`, Vectorize\n *   `dimensions` / `metric`, Pipelines V1 `sql`). The state row's `cfId`\n *   will change.\n * - `delete` — destroy-plan only.\n * - `no_change` — declared, present, fully in sync.\n */\nexport type PlanAction =\n  | \"create\"\n  | \"update\"\n  | \"replace\"\n  | \"delete\"\n  | \"no_change\";\n\n/**\n * Direction of the plan: forward (the default — what `apply` + `deploy` would\n * change) or destroy (what `destroy` would remove). Plans are mutually\n * exclusive: a forward plan never includes `delete`, and a destroy plan\n * never includes `create` / `update` / `replace`.\n */\nexport type PlanMode = \"forward\" | \"destroy\";\n\n/**\n * Describes one drifted field in an `update` / `replace` plan item — the\n * field path, what state currently holds, and what config wants. Surfaced in\n * `tamer plan --json` so reviewers can audit the change exactly the way\n * `terraform plan` shows attribute diffs.\n */\nexport interface PlanFieldChange {\n  field: string;\n  from: unknown;\n  to: unknown;\n  /**\n   * `mutable` → would patch in place; `immutable` → forces `replace` (the\n   * underlying Cloudflare resource will be destroyed + recreated, and the\n   * state row's `cfId` will change).\n   */\n  kind: \"mutable\" | \"immutable\";\n}\n\nexport interface PlanItem {\n  kind: PlanResourceKind;\n  action: PlanAction;\n  /** Logical name from `tamer.config.ts` (or worker key for scripts/routes). */\n  logicalName: string;\n  /** Cloudflare-side identifier (resource name or pattern). */\n  derivedName: string;\n  /** Optional human-readable detail. */\n  detail?: string;\n  /**\n   * Field-level diff for `update` / `replace` items. Empty for `create` /\n   * `delete` / `no_change`. Each entry shows what state has (`from`) and what\n   * config asks for (`to`).\n   */\n  changes?: PlanFieldChange[];\n}\n\nexport interface PlanReport {\n  tenantId: string;\n  env: string;\n  generatedAt: string;\n  items: PlanItem[];\n  /** True iff at least one item has `action !== \"no_change\"`. */\n  hasChanges: boolean;\n  /** Plan direction. Defaults to `\"forward\"` for back-compat with v0.11 plans. */\n  mode?: PlanMode;\n}\n\nexport function planSummary(items: PlanItem[]): {\n  byKind: Record<PlanResourceKind, number>;\n  byAction: Record<PlanAction, number>;\n} {\n  const byKind: Record<PlanResourceKind, number> = {\n    d1: 0,\n    r2: 0,\n    kv: 0,\n    queue: 0,\n    hyperdrive: 0,\n    vectorize: 0,\n    ai_gateway: 0,\n    pipeline: 0,\n    workflow: 0,\n    secret_store: 0,\n    secret: 0,\n    dns_record: 0,\n    dispatch_namespace: 0,\n    logpush_job: 0,\n    worker_route: 0,\n    worker_script: 0,\n  };\n  const byAction: Record<PlanAction, number> = {\n    create: 0,\n    update: 0,\n    replace: 0,\n    delete: 0,\n    no_change: 0,\n  };\n  for (const it of items) {\n    if (it.action === \"no_change\") continue;\n    byKind[it.kind]++;\n    byAction[it.action]++;\n  }\n  return { byKind, byAction };\n}\n","import { computePlan, computeDestroyPlan } from \"../../core/plan/computePlan.js\";\nimport { planSummary } from \"../../core/plan/plan.types.js\";\nimport type {\n  PlanItem,\n  PlanReport,\n  PlanResourceKind,\n} from \"../../core/plan/plan.types.js\";\nimport { formatPlanFieldChanges, signFor } from \"../../core/plan/planFormat.js\";\nimport { loadConfig } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport {\n  PLAN_FILE_FORMAT,\n  computeAttestation,\n  writePlanFile,\n} from \"../../core/plan/planFile.js\";\nimport { createEmptyCfiState } from \"../../core/state/tamerStateDb.js\";\nimport { buildCloudflareSnapshot } from \"../../core/plan/cloudflareSnapshot.js\";\nimport {\n  parseApplyTarget,\n  assertApplyTargetDeclared,\n} from \"../../core/apply/applyTarget.js\";\n\n/**\n * `tamer plan` — print a CloudFormation-style preview of `apply` + `deploy`\n * against the current state, config, and Cloudflare reality. Never mutates.\n *\n * Exit codes:\n *   0 — plan succeeded; with `--detailed-exitcode`, also \"no changes\".\n *   2 — plan succeeded **and** has at least one create/update (with\n *       `--detailed-exitcode`); useful for CI gates that want to fail when\n *       infra would change.\n */\nexport async function runPlan(options: {\n  env?: string;\n  configPath?: string;\n  json?: boolean;\n  detailedExitcode?: boolean;\n  /** When set, write the plan + attestation hashes to this path. */\n  out?: string;\n  /**\n   * When true, compute a **destroy plan** (what `tamer destroy` would remove\n   * from state and Cloudflare) instead of the default forward plan. Mutually\n   * exclusive with the forward plan — destroy plans only contain `delete`\n   * items, never `create` / `update`. Read-only.\n   */\n  destroy?: boolean;\n  /** `kind:logicalName` — restrict plan items to that resource. */\n  target?: string;\n}): Promise<number> {\n  if (options.out && options.target) {\n    throw new Error(\n      \"Cannot combine --out with --target: saved plans must cover the full stack.\",\n    );\n  }\n\n  const target = options.target\n    ? parseApplyTarget(options.target)\n    : undefined;\n  if (target) {\n    const config = await loadConfig(options.configPath, {\n      env: options.env ?? \"local\",\n    });\n    await assertApplyTargetDeclared(config, process.cwd(), target);\n  }\n\n  const report = options.destroy\n    ? await computeDestroyPlan({\n        env: options.env,\n        configPath: options.configPath,\n        target,\n      })\n    : await computePlan({\n        env: options.env,\n        configPath: options.configPath,\n        target,\n      });\n\n  if (options.out) {\n    await writePlanForApply(options.out, report, options.configPath);\n  }\n\n  if (options.json) {\n    console.log(JSON.stringify(report, null, 2));\n  } else {\n    printHumanPlan(report);\n    if (options.out) {\n      console.log(`Plan written to ${options.out}\\n`);\n    }\n  }\n\n  if (options.detailedExitcode && report.hasChanges) {\n    return 2;\n  }\n  return 0;\n}\n\n/**\n * Hydrate the same `(config, state)` pair `computePlan` consumed and write\n * a {@link PlanFile} with the attestation hashes pinned. `apply --plan`\n * recomputes both hashes and refuses to proceed if either drifted, so a\n * stale plan can never silently apply against changed inputs.\n */\nasync function writePlanForApply(\n  outPath: string,\n  report: PlanReport,\n  configPath: string | undefined,\n): Promise<void> {\n  const config = await loadConfig(configPath, { env: report.env });\n  if (report.env === \"local\") {\n    const attestation = computeAttestation(\n      config,\n      createEmptyCfiState(config.tenant.id, \"local\"),\n    );\n    writePlanFile(outPath, {\n      format: PLAN_FILE_FORMAT,\n      tenantId: config.tenant.id,\n      env: report.env,\n      generatedAt: report.generatedAt,\n      report,\n      attestation,\n    });\n    return;\n  }\n\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    report.env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const cloudflareSnapshot = await buildCloudflareSnapshot({\n    config,\n    env: report.env,\n    api,\n    baseDir: process.cwd(),\n  });\n  const attestation = computeAttestation(\n    config,\n    state.load(),\n    cloudflareSnapshot,\n  );\n  writePlanFile(outPath, {\n    format: PLAN_FILE_FORMAT,\n    tenantId: config.tenant.id,\n    env: report.env,\n    generatedAt: report.generatedAt,\n    report,\n    attestation,\n  });\n}\n\nfunction printHumanPlan(report: PlanReport): void {\n  const isDestroy = report.mode === \"destroy\";\n  const heading = isDestroy ? \"Destroy plan\" : \"Plan\";\n  console.log(\n    `\\n${heading} — tenant ${report.tenantId}, env ${report.env}\\n`,\n  );\n  if (report.items.length === 0) {\n    if (isDestroy) {\n      console.log(\"  (nothing to destroy — no managed resources in state)\\n\");\n    } else {\n      console.log(\"  (no changes — infrastructure matches config)\\n\");\n    }\n    return;\n  }\n  const grouped = new Map<PlanResourceKind, PlanItem[]>();\n  for (const it of report.items) {\n    const arr = grouped.get(it.kind) ?? [];\n    arr.push(it);\n    grouped.set(it.kind, arr);\n  }\n  for (const [kind, items] of grouped) {\n    console.log(`${labelFor(kind)} (${items.length}):`);\n    for (const it of items) {\n      const sign = signFor(it.action);\n      // Suppress `detail` on update/replace items when we have a structured\n      // `changes[]` block — the per-field renderer below already shows the\n      // same drift in terraform-style form, and printing both duplicates\n      // the diff and clutters the output.\n      const hasChanges = it.changes && it.changes.length > 0;\n      const detail = it.detail && !hasChanges ? ` (${it.detail})` : \"\";\n      console.log(`  ${sign} ${it.logicalName} -> ${it.derivedName}${detail}`);\n      for (const line of formatPlanFieldChanges(it.changes)) {\n        console.log(line);\n      }\n    }\n  }\n  const { byAction } = planSummary(report.items);\n  if (isDestroy) {\n    console.log(`\\nSummary: ${byAction.delete} to delete.\\n`);\n  } else {\n    console.log(\n      `\\nSummary: ${byAction.create} to create, ${byAction.update} to update, ${byAction.replace} to replace.\\n`,\n    );\n  }\n}\n\nfunction labelFor(kind: PlanResourceKind): string {\n  switch (kind) {\n    case \"d1\":\n      return \"D1\";\n    case \"r2\":\n      return \"R2\";\n    case \"kv\":\n      return \"KV\";\n    case \"queue\":\n      return \"Queues\";\n    case \"hyperdrive\":\n      return \"Hyperdrive\";\n    case \"vectorize\":\n      return \"Vectorize\";\n    case \"ai_gateway\":\n      return \"AI Gateway\";\n    case \"pipeline\":\n      return \"Pipeline\";\n    case \"workflow\":\n      return \"Workflow\";\n    case \"secret_store\":\n      return \"Secrets Store\";\n    case \"secret\":\n      return \"Worker secrets\";\n    case \"dns_record\":\n      return \"DNS records\";\n    case \"dispatch_namespace\":\n      return \"Dispatch namespaces\";\n    case \"logpush_job\":\n      return \"Logpush jobs\";\n    case \"worker_route\":\n      return \"Workers zone routes\";\n    case \"worker_script\":\n      return \"Worker scripts\";\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA4CA,eAAsB,YAAY,SAOV;CACtB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAC7B,MAAM,SAAS,QAAQ;CAEvB,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,QAAQ,MAAM,mBAAmB;EAAE;EAAK;EAAY,CAAC;CAE3D,MAAMA,QAAoB,EAAE;AAE5B,MAAK,MAAM,KAAK,MAAM,WAAW;EAC/B,MAAM,OAAO,aAAa,EAAE,KAAK;AACjC,MAAI,CAAC,KAAM;AACX,OAAK,MAAM,KAAK,EAAE,WAChB,OAAM,KAAK;GACT;GACA,QAAQ;GACR,aAAa,EAAE;GACf,aAAa,EAAE;GACf,QAAQ,EAAE;GACX,CAAC;;AAIN,KAAI,QAAQ,SAAS;EACnB,MAAM,MAAM,IAAI,YAAY,UAAU;EACtC,MAAM,SAAS,iBAAiB,OAAO;EACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,QAAM,MAAM,QAAQ,IAAI;EAIxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;EAEzD,MAAM,WAAW,uBAAuB;GACtC,WAAW,cAAc,OAAO;GAChC,QAAQ,OAAO;GACf;GACA;GACD,CAAC;AACF,QAAM,KAAK,GAAG,SAAS;EAEvB,MAAM,mBAAmB,MAAM,wBAAwB;GACrD,WAAW,eAAe,OAAO;GACjC,QAAQ,OAAO;GACf;GACA;GACA;GACA;GACD,CAAC;AACF,QAAM,KAAK,GAAG,iBAAiB;EAE/B,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,OAAK,MAAM,CAAC,WAAW,OAAO,SAAS;GACrC,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,IACA,KACA,SACA,WACA,QACA,OACA;IAAE,gBAAgB;IAAY;IAAS,CACxC;AACD,OAAI,SAAS,kBAAmB;GAEhC,MAAM,eAAe,0BACnB,QACA,WACA,IACA,KACA,OACD;AACD,QAAK,MAAM,OAAO,iBAAiB;AACjC,QAAI,CAAC,IAAI,KAAM;IACf,MAAM,YAAY,IAAI,cAAc,GAAG;AACvC,QAAI,UAAU,WAAW,EAAG;IAC5B,MAAM,YAAY,IAAI,KAAK;KACzB;KACA,QAAQ,OAAO;KACf;KACA;KACA;KACA,QAAQ;MAAE;MAAW;MAAc;KACpC,CAAC;AACF,UAAM,KAAK,GAAG,UAAU;;GAG1B,IAAI;AACJ,OAAI;AACF,aAAS,MAAM,IAAI,iBAAiB,SAAS,WAAW;WAClD;AACN;;AAEF,OAAI,CAAC,OACH,OAAM,KAAK;IACT,MAAM;IACN,QAAQ;IACR,aAAa;IACb,aAAa,SAAS;IACvB,CAAC;GAGJ,MAAM,WAAW,yBAAyB,GAAG;AAC7C,OAAI,SAAS,SAAS,GAAG;IAKvB,MAAM,gBAAgB,MAAM,iBAAiB;KAC3C,SAAS,CACP;MACE;MACA;MACA,mBAToB,MAAM,uBAC9B,KACA,SAAS,WACV;MAOI,CACF;KACD,OAAO,QAAQ,gBAAgB,mBAAmB;KAClD;KACD,CAAC;AACF,UAAM,KAAK,GAAG,iBAAiB,cAAc,CAAC;;;;CAKpD,MAAM,WAAW,SAAS,yBAAyB,OAAO,OAAO,GAAG;AAEpE,QAAO;EACL,UAAU,OAAO,OAAO;EACxB;EACA,8BAAa,IAAI,MAAM,EAAC,aAAa;EACrC,OAAO;EACP,YAAY,SAAS,MAAM,MAAM,EAAE,WAAW,YAAY;EAC1D,MAAM;EACP;;;;;;;;;;;;;;;;AAiBH,eAAsB,mBAAmB,SAIjB;CACtB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAC7B,MAAM,SAAS,QAAQ;CAEvB,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAMA,QAAoB,EAAE;CAC5B,MAAM,+BAAc,IAAI,MAAM,EAAC,aAAa;AAE5C,KAAI,QAAQ,QACV,QAAO;EACL,UAAU,OAAO,OAAO;EACxB;EACA;EACA;EACA,YAAY;EACZ,MAAM;EACP;CAGH,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;CAEzD,MAAM,eAAe,MAAM,QAAQ;AAEnC,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,QAAQ,MAAM,4BAA4B,QAAQ,SAAS,IAAI,KAAK;AAC1E,MAAI,MAAM,SAAS,EAAG;EACtB,MAAM,OAAO,aAAa,IAAI,KAAK;AACnC,MAAI,CAAC,KAAM;AACX,OAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,aAAa,EAAE;AACpD,OAAI,MAAM,SAAS,IAAI,eAAgB;GACvC,MAAM,cAAe,MAAmC;AACxD,OAAI,CAAC,eAAe,CAAC,MAAM,IAAI,YAAY,CAAE;AAC7C,SAAM,KAAK;IACT;IACA,QAAQ;IACR;IACA,aAAa,cAAc,MAAM;IAClC,CAAC;;;AAIN,MAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,aAAa,EAAE;AACpD,MAAI,MAAM,SAAS,eAAgB;AACnC,QAAM,KAAK;GACT,MAAM;GACN,QAAQ;GACR,aAAa,MAAM;GACnB,aAAa,MAAM;GACnB,QAAQ,MAAM;GACf,CAAC;;AAGJ,MAAK,MAAM,MAAM,sBAAsB,OAAO,EAAE;EAE9C,MAAM,QAAQ,aADG,sBAAsB,GAAG;AAE1C,MAAI,CAAC,SAAS,MAAM,SAAS,qBAAsB;AACnD,QAAM,KAAK;GACT,MAAM;GACN,QAAQ;GACR,aAAa,GAAG;GAChB,aAAa,MAAM;GACpB,CAAC;;AAGJ,MAAK,MAAM,OAAO,cAAc,OAAO,EAAE;AACvC,MAAI,IAAI,kBAAmB;EAE3B,MAAM,QAAQ,aADF,kBAAkB,IAAI,QAAQ,IAAI,MAAM,IAAI,KAAK;AAE7D,MAAI,CAAC,SAAS,MAAM,SAAS,aAAc;AAC3C,QAAM,KAAK;GACT,MAAM;GACN,QAAQ;GACR,aAAa,IAAI;GACjB,aAAa,GAAG,MAAM,WAAW,GAAG,MAAM;GAC1C,QAAQ,MAAM;GACf,CAAC;;AAGJ,MAAK,MAAM,MAAM,eAAe,OAAO,EAAE;EAEvC,MAAM,QAAQ,aADF,mBAAmB,OAAO,OAAO,IAAI,GAAG,aAAa,IAAI;AAErE,MAAI,CAAC,SAAS,MAAM,SAAS,cAAe;AAC5C,QAAM,KAAK;GACT,MAAM;GACN,QAAQ;GACR,aAAa,GAAG;GAChB,aAAa,MAAM;GACnB,QAAQ,OAAO,MAAM,QAAQ;GAC9B,CAAC;;CAGJ,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,MAAK,MAAM,CAAC,WAAW,OAAO,SAAS;AAYrC,OAXiB,MAAM,oBACrB,QACA,WACA,IACA,KACA,SACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY;GAAS,CACxC,EACY,kBAAmB;EAChC,MAAM,eAAe,0BACnB,QACA,WACA,IACA,KACA,OACD;EACD,IAAI;AACJ,MAAI;AACF,YAAS,MAAM,IAAI,iBAAiB,aAAa;UAC3C;AACN;;AAEF,MAAI,OACF,OAAM,KAAK;GACT,MAAM;GACN,QAAQ;GACR,aAAa;GACb,aAAa;GACd,CAAC;;CAIN,MAAM,WAAW,SAAS,yBAAyB,OAAO,OAAO,GAAG;AAEpE,QAAO;EACL,UAAU,OAAO,OAAO;EACxB;EACA;EACA,OAAO;EACP,YAAY,SAAS,SAAS;EAC9B,MAAM;EACP;;AAGH,SAAS,cAAc,OAA2B;AAChD,SAAQ,MAAM,MAAd;EACE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,qBACH,QAAO,MAAM;EACf,KAAK,aACH,QAAO,GAAG,MAAM,WAAW,GAAG,MAAM;EACtC,KAAK,eACH,QAAO,MAAM;EACf,KAAK,cACH,QAAO,MAAM;EACf,KAAK,oBACH,QAAO,MAAM;EACf,KAAK,SACH,QAAO,GAAG,MAAM,OAAO,GAAG,MAAM;;;AAItC,SAAS,oBAAwC;AAC/C,QAAO,mBAAmB,EAAE,CAAC;;AAG/B,eAAe,uBACb,KACA,YACmB;AACnB,KAAI;AACF,SAAO,MAAM,IAAI,mBAAmB,WAAW;SACzC;AACN,SAAO,EAAE;;;AAIb,SAAS,aAAa,MAA4C;AAChE,SAAQ,MAAR;EACE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,eACH,QAAO;EACT,QACE;;;;;;AClVN,SAAgB,YAAY,OAG1B;CACA,MAAMC,SAA2C;EAC/C,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,OAAO;EACP,YAAY;EACZ,WAAW;EACX,YAAY;EACZ,UAAU;EACV,UAAU;EACV,cAAc;EACd,QAAQ;EACR,YAAY;EACZ,oBAAoB;EACpB,aAAa;EACb,cAAc;EACd,eAAe;EAChB;CACD,MAAMC,WAAuC;EAC3C,QAAQ;EACR,QAAQ;EACR,SAAS;EACT,QAAQ;EACR,WAAW;EACZ;AACD,MAAK,MAAM,MAAM,OAAO;AACtB,MAAI,GAAG,WAAW,YAAa;AAC/B,SAAO,GAAG;AACV,WAAS,GAAG;;AAEd,QAAO;EAAE;EAAQ;EAAU;;;;;;;;;;;;;;;AClG7B,eAAsB,QAAQ,SAgBV;AAClB,KAAI,QAAQ,OAAO,QAAQ,OACzB,OAAM,IAAI,MACR,6EACD;CAGH,MAAM,SAAS,QAAQ,SACnB,iBAAiB,QAAQ,OAAO,GAChC;AACJ,KAAI,OAIF,OAAM,0BAHS,MAAM,WAAW,QAAQ,YAAY,EAClD,KAAK,QAAQ,OAAO,SACrB,CAAC,EACsC,QAAQ,KAAK,EAAE,OAAO;CAGhE,MAAM,SAAS,QAAQ,UACnB,MAAM,mBAAmB;EACvB,KAAK,QAAQ;EACb,YAAY,QAAQ;EACpB;EACD,CAAC,GACF,MAAM,YAAY;EAChB,KAAK,QAAQ;EACb,YAAY,QAAQ;EACpB;EACD,CAAC;AAEN,KAAI,QAAQ,IACV,OAAM,kBAAkB,QAAQ,KAAK,QAAQ,QAAQ,WAAW;AAGlE,KAAI,QAAQ,KACV,SAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC;MACvC;AACL,iBAAe,OAAO;AACtB,MAAI,QAAQ,IACV,SAAQ,IAAI,mBAAmB,QAAQ,IAAI,IAAI;;AAInD,KAAI,QAAQ,oBAAoB,OAAO,WACrC,QAAO;AAET,QAAO;;;;;;;;AAST,eAAe,kBACb,SACA,QACA,YACe;CACf,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,OAAO,KAAK,CAAC;AAChE,KAAI,OAAO,QAAQ,SAAS;EAC1B,MAAMC,gBAAc,mBAClB,QACA,oBAAoB,OAAO,OAAO,IAAI,QAAQ,CAC/C;AACD,gBAAc,SAAS;GACrB,QAAQ;GACR,UAAU,OAAO,OAAO;GACxB,KAAK,OAAO;GACZ,aAAa,OAAO;GACpB;GACA;GACD,CAAC;AACF;;CAGF,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAEH,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,OAAO,KACP,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,qBAAqB,MAAM,wBAAwB;EACvD;EACA,KAAK,OAAO;EACZ;EACA,SAAS,QAAQ,KAAK;EACvB,CAAC;CACF,MAAM,cAAc,mBAClB,QACA,MAAM,MAAM,EACZ,mBACD;AACD,eAAc,SAAS;EACrB,QAAQ;EACR,UAAU,OAAO,OAAO;EACxB,KAAK,OAAO;EACZ,aAAa,OAAO;EACpB;EACA;EACD,CAAC;;AAGJ,SAAS,eAAe,QAA0B;CAChD,MAAM,YAAY,OAAO,SAAS;CAClC,MAAM,UAAU,YAAY,iBAAiB;AAC7C,SAAQ,IACN,KAAK,QAAQ,YAAY,OAAO,SAAS,QAAQ,OAAO,IAAI,IAC7D;AACD,KAAI,OAAO,MAAM,WAAW,GAAG;AAC7B,MAAI,UACF,SAAQ,IAAI,2DAA2D;MAEvE,SAAQ,IAAI,mDAAmD;AAEjE;;CAEF,MAAM,0BAAU,IAAI,KAAmC;AACvD,MAAK,MAAM,MAAM,OAAO,OAAO;EAC7B,MAAM,MAAM,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE;AACtC,MAAI,KAAK,GAAG;AACZ,UAAQ,IAAI,GAAG,MAAM,IAAI;;AAE3B,MAAK,MAAM,CAAC,MAAM,UAAU,SAAS;AACnC,UAAQ,IAAI,GAAG,SAAS,KAAK,CAAC,IAAI,MAAM,OAAO,IAAI;AACnD,OAAK,MAAM,MAAM,OAAO;GACtB,MAAM,OAAO,QAAQ,GAAG,OAAO;GAK/B,MAAM,aAAa,GAAG,WAAW,GAAG,QAAQ,SAAS;GACrD,MAAM,SAAS,GAAG,UAAU,CAAC,aAAa,KAAK,GAAG,OAAO,KAAK;AAC9D,WAAQ,IAAI,KAAK,KAAK,GAAG,GAAG,YAAY,MAAM,GAAG,cAAc,SAAS;AACxE,QAAK,MAAM,QAAQ,uBAAuB,GAAG,QAAQ,CACnD,SAAQ,IAAI,KAAK;;;CAIvB,MAAM,EAAE,aAAa,YAAY,OAAO,MAAM;AAC9C,KAAI,UACF,SAAQ,IAAI,cAAc,SAAS,OAAO,eAAe;KAEzD,SAAQ,IACN,cAAc,SAAS,OAAO,cAAc,SAAS,OAAO,cAAc,SAAS,QAAQ,gBAC5F;;AAIL,SAAS,SAAS,MAAgC;AAChD,SAAQ,MAAR;EACE,KAAK,KACH,QAAO;EACT,KAAK,KACH,QAAO;EACT,KAAK,KACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,KAAK,aACH,QAAO;EACT,KAAK,YACH,QAAO;EACT,KAAK,aACH,QAAO;EACT,KAAK,WACH,QAAO;EACT,KAAK,WACH,QAAO;EACT,KAAK,eACH,QAAO;EACT,KAAK,SACH,QAAO;EACT,KAAK,aACH,QAAO;EACT,KAAK,qBACH,QAAO;EACT,KAAK,cACH,QAAO;EACT,KAAK,eACH,QAAO;EACT,KAAK,gBACH,QAAO"}

package/dist/{provision-tenant-C2EL79oz.mjs → provision-tenant-Dh3-p5ZK.mjs}

@@ -1,5 +1,5 @@
 import { f as getDispatchNamespaces } from "./normalize-DVSTRZhO.mjs";
-import { B as loadConfig, C as stackNameForConfig, I as CFApiClient, L as cloudflareAccountIdFromEnv, M as effectiveDispatchNamespaceName, _ as tenantDispatchScriptName, g as parseTenantShardRoles, h as StateManager, v as tenantShardDatabaseName, y as tenantStateKey } from "./tamer.mjs";
+import { C as stackNameForConfig, I as CFApiClient, L as cloudflareAccountIdFromEnv, M as effectiveDispatchNamespaceName, V as loadConfig, _ as tenantDispatchScriptName, g as parseTenantShardRoles, h as StateManager, v as tenantShardDatabaseName, y as tenantStateKey } from "./tamer.mjs";
 import "./r2S3EmptyBucket-B9_pHfvB.mjs";
 import { n as logApplyChange } from "./planFormat-5XMJK879.mjs";
 import { i as tamerArtifactsKeyPrefix, r as tamerArtifactsBucketName } from "./tamerArtifactsR2-7qUbhOLD.mjs";
@@ -188,4 +188,4 @@ async function provisionTenantInner(options) {
 
 //#endregion
 export { runProvisionTenant };
-//# sourceMappingURL=provision-tenant-C2EL79oz.mjs.map
+//# sourceMappingURL=provision-tenant-Dh3-p5ZK.mjs.map

package/dist/{provision-tenant-C2EL79oz.mjs.map → provision-tenant-Dh3-p5ZK.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"provision-tenant-C2EL79oz.mjs","names":["result: ProvisionTenantResult","allD1: Awaited<ReturnType<typeof api.d1ListAll>> | null","shards: TenantD1ShardRef[]","form: FormData"],"sources":["../src/cli/commands/provision-tenant.ts"],"sourcesContent":["import { basename, resolve } from \"path\";\nimport { loadConfig } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { getDispatchNamespaces } from \"../../types.js\";\nimport { effectiveDispatchNamespaceName } from \"../../features/dispatch-namespace/dispatch-namespace.resolve.js\";\nimport {\n  parseTenantShardRoles,\n  tenantDispatchScriptName,\n  tenantShardDatabaseName,\n  tenantStateKey,\n} from \"../../core/tenant/tenantKeys.js\";\nimport {\n  buildSingleModuleDispatchForm,\n  buildSingleModuleDispatchFormFromBuffer,\n} from \"../../core/wfp/buildDispatchUploadForm.js\";\nimport { tamerArtifactsBucketName, tamerArtifactsKeyPrefix } from \"../../core/state/tamerArtifactsR2.js\";\nimport { logApplyChange } from \"../../core/plan/planFormat.js\";\nimport type { TenantD1ShardRef, TenantStateEntry } from \"../../types.js\";\n\nconst now = (): string => new Date().toISOString();\n\nfunction buildTenantEntry(\n  options: {\n    product: string;\n    workspace: string;\n    dispatchNamespaceName: string;\n    scriptName: string;\n  },\n  status: TenantStateEntry[\"provisioningStatus\"],\n  existing: TenantStateEntry | undefined,\n  patch?: Partial<Pick<TenantStateEntry, \"d1Shards\">>,\n): TenantStateEntry {\n  return {\n    product: options.product,\n    workspace: options.workspace,\n    provisioningStatus: status,\n    dispatchNamespaceName: options.dispatchNamespaceName,\n    scriptName: options.scriptName,\n    d1Shards: patch?.d1Shards ?? existing?.d1Shards,\n    createdAt: existing?.createdAt ?? now(),\n    updatedAt: now(),\n  };\n}\n\n/**\n * Resolve the effective shard set for this provision call.\n *\n *   1. The configured layout (`tenant.d1Shards` in `tamer.config.ts`)\n *      is the source of truth — any role used by `--shards` must\n *      appear here, and `apply` / `drift` / other operators read the\n *      same shape.\n *   2. When `--shards a,b` is passed, trim to that subset (preserving\n *      configured order so plan/provision logs stay deterministic).\n *      Extending the layout is an edit to `tamer.config.ts`, not a\n *      CLI flag — that's why `parseTenantShardRoles` rejects roles\n *      outside the configured set.\n *   3. When the config has no `tenant.d1Shards`, the resolved set is\n *      empty: `provision-tenant` only uploads the dispatch script\n *      (truly generic single-Worker tenant case).\n */\nfunction resolveShardRoles(\n  configured: readonly string[],\n  shardsRaw: string | undefined,\n): string[] {\n  if (shardsRaw == null || shardsRaw.trim() === \"\") return [...configured];\n  return parseTenantShardRoles(shardsRaw, configured);\n}\n\n/**\n * Idempotent tenant provisioning. Each call:\n *\n *   1. Marks the tenant `pending` if there's no record yet.\n *   2. For every shard role declared in `tenant.d1Shards` in\n *      `tamer.config.ts` (or a `--shards` subset): looks up an\n *      existing D1 by derived name (`tenantShardDatabaseName(role,\n *      …)`), creating it via `d1Create` only when missing. Persists\n *      the `(role, derivedName, cfId)` triple to\n *      `state.tenants[…].d1Shards[]`.\n *   3. Marks the tenant `d1_created` once *all* requested shards\n *      exist in state.\n *   4. Uploads the dispatch script (from `--main` or `--artifact-key`)\n *      via the WFP dispatch namespace.\n *   5. Marks the tenant `ready`.\n *\n * When `tenant.d1Shards` is omitted, step 2/3 collapse to a no-op\n * (truly generic single-Worker tenant — only the dispatch script is\n * provisioned). Re-running with the same shard set is a no-op (state\n * already has those rows). Editing `tamer.config.ts` to **extend**\n * the layout (e.g. adding a new role) and re-running picks up the\n * missing shards without disturbing existing ones, so a tenant\n * created with `[\"app\"]` can be migrated to `[\"system\",\"app\",\n * \"history\"]` (or `[\"primary\",\"audit\"]`, or any other set) with one\n * config edit + one `provision-tenant` invocation. Re-running after\n * a config that **shrinks** the layout never deletes shards (use\n * `destroy-tenant` for that).\n */\n/**\n * Machine-readable result envelope emitted on the final stdout line\n * when `--json` is passed. Designed for the Cloudflare Container caller\n * (`provision-workflow`, see `docs/handoff.md` §7) so the Worker can\n * parse the result without scraping human logs. On success the Workflow\n * sees `status: \"ready\"` plus the materialized tenant shape; on\n * failure it sees `status: \"failed\"` with `error` + best-effort\n * `partial` state, and the process exits non-zero.\n */\nexport interface ProvisionTenantResult {\n  status: \"ready\" | \"failed\" | \"noop\";\n  tenantKey: string;\n  product: string;\n  workspace: string;\n  env: string;\n  scriptName: string;\n  dispatchNamespaceName: string;\n  shards: { role: string; derivedName: string; cfId: string }[];\n  error?: string;\n}\n\nexport async function runProvisionTenant(options: {\n  env: string;\n  product: string;\n  workspace: string;\n  main?: string;\n  artifactKey?: string;\n  moduleName?: string;\n  configPath?: string;\n  compatibilityDate?: string;\n  compatibilityFlags?: string[];\n  /**\n   * Raw `--shards` value (`\"system,app\"` etc.) — validated against\n   * `tenant.d1Shards` from the loaded config. Omit to provision every\n   * configured shard.\n   */\n  shardsRaw?: string;\n  json?: boolean;\n}): Promise<void> {\n  const env = options.env;\n  if (env === \"local\") {\n    throw new Error(\n      \"provision-tenant requires a non-local --env (Cloudflare-backed state).\",\n    );\n  }\n\n  try {\n    await provisionTenantInner(options);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    if (options.json) {\n      // Failure envelope: we may have died before loadConfig, so we\n      // can't ask `tenant.ephemeralEnvPattern` whether `env` would\n      // get the `-{env}` suffix. Emit the non-ephemeral form as a\n      // best-effort hint — `error` carries the real signal.\n      const result: ProvisionTenantResult = {\n        status: \"failed\",\n        tenantKey: tenantStateKey(options.product, options.workspace),\n        product: options.product,\n        workspace: options.workspace,\n        env,\n        scriptName: `${options.product}-${options.workspace}`,\n        dispatchNamespaceName: \"\",\n        shards: [],\n        error: msg,\n      };\n      process.stdout.write(JSON.stringify(result) + \"\\n\");\n    }\n    // Container caller (provision-workflow) reads exit code as\n    // primary success/failure signal; JSON envelope on stdout is\n    // secondary detail. Re-throw so the CLI surfaces the original\n    // error in human mode.\n    throw err;\n  }\n}\n\nasync function provisionTenantInner(options: {\n  env: string;\n  product: string;\n  workspace: string;\n  main?: string;\n  artifactKey?: string;\n  moduleName?: string;\n  configPath?: string;\n  compatibilityDate?: string;\n  compatibilityFlags?: string[];\n  shardsRaw?: string;\n  json?: boolean;\n}): Promise<void> {\n  const env = options.env;\n  const config = await loadConfig(options.configPath, { env });\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const dns = getDispatchNamespaces(config);\n  if (dns.length === 0) {\n    throw new Error(\n      \"provision-tenant requires at least one dispatch namespace in the Tamer project config (dispatchNamespaces).\",\n    );\n  }\n  const nsConfig = dns[0]!;\n  const dispatchNamespaceName = effectiveDispatchNamespaceName(\n    nsConfig,\n    env,\n    config.tenant,\n  );\n  const scriptName = tenantDispatchScriptName(\n    options.product,\n    options.workspace,\n    env,\n    config.tenant,\n  );\n  const desiredRoles = resolveShardRoles(\n    config.tenant.d1Shards ?? [],\n    options.shardsRaw,\n  );\n\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n\n  let existing = state.getTenant(options.product, options.workspace);\n  // \"ready\" is a no-op only when the existing layout already covers\n  // every requested shard role. Adding a new role re-opens the tenant\n  // for incremental provisioning without forcing a full re-deploy.\n  if (existing?.provisioningStatus === \"ready\") {\n    const have = new Set((existing.d1Shards ?? []).map((s) => s.role));\n    const missing = desiredRoles.filter((r) => !have.has(r));\n    if (missing.length === 0) {\n      console.log(\n        `Tenant ${tenantStateKey(options.product, options.workspace)} already ready; nothing to do.`,\n      );\n      if (options.json) {\n        const result: ProvisionTenantResult = {\n          status: \"noop\",\n          tenantKey: tenantStateKey(options.product, options.workspace),\n          product: options.product,\n          workspace: options.workspace,\n          env,\n          scriptName,\n          dispatchNamespaceName,\n          shards: (existing.d1Shards ?? []).map((s) => ({\n            role: s.role,\n            derivedName: s.derivedName,\n            cfId: s.cfId,\n          })),\n        };\n        process.stdout.write(JSON.stringify(result) + \"\\n\");\n      }\n      return;\n    }\n    console.log(\n      `Tenant ${tenantStateKey(options.product, options.workspace)} ready but missing shards: ${missing.join(\", \")}; extending layout.`,\n    );\n  }\n\n  const compatDate =\n    options.compatibilityDate ??\n    config.compatibility_date ??\n    new Date().toISOString().slice(0, 10);\n\n  const entryOpts = {\n    product: options.product,\n    workspace: options.workspace,\n    dispatchNamespaceName,\n    scriptName,\n  };\n\n  if (!existing) {\n    state.setTenant(buildTenantEntry(entryOpts, \"pending\", undefined));\n    await state.persist(api);\n    existing = state.getTenant(options.product, options.workspace)!;\n  }\n\n  // Reconcile each requested shard role. We list D1 once per call when\n  // we need to (some role is missing from state) and reuse the result\n  // for every subsequent role.\n  let allD1: Awaited<ReturnType<typeof api.d1ListAll>> | null = null;\n  const shards: TenantD1ShardRef[] = [...(existing.d1Shards ?? [])];\n\n  for (const role of desiredRoles) {\n    if (shards.find((s) => s.role === role)) continue;\n    const derivedName = tenantShardDatabaseName(\n      role,\n      options.workspace,\n      options.product,\n      config.tenant.id,\n      env,\n    );\n    if (allD1 === null) {\n      allD1 = await api.d1ListAll();\n    }\n    let cfId = allD1.find((d) => d.name === derivedName)?.uuid;\n    if (cfId) {\n      // Adopt an existing D1 (e.g. partial-failure resume, or\n      // operator created it out-of-band) without re-issuing POST.\n      logApplyChange({\n        kind: \"d1\",\n        action: \"no_change\",\n        logical: `${role}-shard`,\n        derived: derivedName,\n      });\n    } else {\n      logApplyChange({\n        kind: \"d1\",\n        action: \"create\",\n        logical: `${role}-shard`,\n        derived: derivedName,\n      });\n      const created = await api.d1Create(derivedName);\n      cfId = created.uuid;\n    }\n    shards.push({ role, derivedName, cfId });\n    // Persist after each shard so a network failure mid-loop leaves\n    // the already-created shards recorded — `provision-tenant` is\n    // resumable role-by-role.\n    state.setTenant(\n      buildTenantEntry(entryOpts, \"d1_created\", existing, { d1Shards: shards }),\n    );\n    await state.persist(api);\n    existing = state.getTenant(options.product, options.workspace)!;\n  }\n\n  let form: FormData;\n  if (options.main) {\n    const mainPath = resolve(process.cwd(), options.main);\n    form = buildSingleModuleDispatchForm(mainPath, {\n      compatibility_date: compatDate,\n      compatibility_flags: options.compatibilityFlags,\n    });\n  } else if (options.artifactKey) {\n    const bucket = tamerArtifactsBucketName();\n    const fullKey = `${tamerArtifactsKeyPrefix(env)}${options.artifactKey}`;\n    const body = await api.r2GetObject(bucket, fullKey);\n    const mod =\n      options.moduleName?.trim() ||\n      basename(options.artifactKey).replace(/\\.(zip|tar|gz)$/i, \"\") ||\n      \"worker.js\";\n    form = buildSingleModuleDispatchFormFromBuffer(mod, body, {\n      compatibility_date: compatDate,\n      compatibility_flags: options.compatibilityFlags,\n    });\n  } else {\n    throw new Error(\"provision-tenant: provide --main or --artifact-key\");\n  }\n\n  await api.dispatchNamespaceScriptPut(dispatchNamespaceName, scriptName, form);\n\n  state.setTenant(\n    buildTenantEntry(entryOpts, \"ready\", existing, { d1Shards: shards }),\n  );\n  await state.persist(api);\n\n  const shardsSummary =\n    shards.length > 0\n      ? `shards: ${shards.map((s) => s.role).join(\", \")}`\n      : \"no shards declared\";\n  console.log(\n    `Provisioned tenant ${tenantStateKey(options.product, options.workspace)} → script ${scriptName} in ${dispatchNamespaceName} (${shardsSummary})`,\n  );\n\n  if (options.json) {\n    const result: ProvisionTenantResult = {\n      status: \"ready\",\n      tenantKey: tenantStateKey(options.product, options.workspace),\n      product: options.product,\n      workspace: options.workspace,\n      env,\n      scriptName,\n      dispatchNamespaceName,\n      shards: shards.map((s) => ({\n        role: s.role,\n        derivedName: s.derivedName,\n        cfId: s.cfId,\n      })),\n    };\n    process.stdout.write(JSON.stringify(result) + \"\\n\");\n  }\n}\n"],"mappings":";;;;;;;;;AAsBA,MAAM,6BAAoB,IAAI,MAAM,EAAC,aAAa;AAElD,SAAS,iBACP,SAMA,QACA,UACA,OACkB;AAClB,QAAO;EACL,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB,oBAAoB;EACpB,uBAAuB,QAAQ;EAC/B,YAAY,QAAQ;EACpB,UAAU,OAAO,YAAY,UAAU;EACvC,WAAW,UAAU,aAAa,KAAK;EACvC,WAAW,KAAK;EACjB;;;;;;;;;;;;;;;;;;AAmBH,SAAS,kBACP,YACA,WACU;AACV,KAAI,aAAa,QAAQ,UAAU,MAAM,KAAK,GAAI,QAAO,CAAC,GAAG,WAAW;AACxE,QAAO,sBAAsB,WAAW,WAAW;;AAoDrD,eAAsB,mBAAmB,SAiBvB;CAChB,MAAM,MAAM,QAAQ;AACpB,KAAI,QAAQ,QACV,OAAM,IAAI,MACR,yEACD;AAGH,KAAI;AACF,QAAM,qBAAqB,QAAQ;UAC5B,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,MAAI,QAAQ,MAAM;GAKhB,MAAMA,SAAgC;IACpC,QAAQ;IACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;IAC7D,SAAS,QAAQ;IACjB,WAAW,QAAQ;IACnB;IACA,YAAY,GAAG,QAAQ,QAAQ,GAAG,QAAQ;IAC1C,uBAAuB;IACvB,QAAQ,EAAE;IACV,OAAO;IACR;AACD,WAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK;;AAMrD,QAAM;;;AAIV,eAAe,qBAAqB,SAYlB;CAChB,MAAM,MAAM,QAAQ;CACpB,MAAM,SAAS,MAAM,WAAW,QAAQ,YAAY,EAAE,KAAK,CAAC;CAC5D,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,MAAM,sBAAsB,OAAO;AACzC,KAAI,IAAI,WAAW,EACjB,OAAM,IAAI,MACR,8GACD;CAEH,MAAM,WAAW,IAAI;CACrB,MAAM,wBAAwB,+BAC5B,UACA,KACA,OAAO,OACR;CACD,MAAM,aAAa,yBACjB,QAAQ,SACR,QAAQ,WACR,KACA,OAAO,OACR;CACD,MAAM,eAAe,kBACnB,OAAO,OAAO,YAAY,EAAE,EAC5B,QAAQ,UACT;CAED,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,IAAI,WAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;AAIlE,KAAI,UAAU,uBAAuB,SAAS;EAC5C,MAAM,OAAO,IAAI,KAAK,SAAS,YAAY,EAAE,EAAE,KAAK,MAAM,EAAE,KAAK,CAAC;EAClE,MAAM,UAAU,aAAa,QAAQ,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;AACxD,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAQ,IACN,UAAU,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,gCAC9D;AACD,OAAI,QAAQ,MAAM;IAChB,MAAMA,SAAgC;KACpC,QAAQ;KACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;KAC7D,SAAS,QAAQ;KACjB,WAAW,QAAQ;KACnB;KACA;KACA;KACA,SAAS,SAAS,YAAY,EAAE,EAAE,KAAK,OAAO;MAC5C,MAAM,EAAE;MACR,aAAa,EAAE;MACf,MAAM,EAAE;MACT,EAAE;KACJ;AACD,YAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK;;AAErD;;AAEF,UAAQ,IACN,UAAU,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,6BAA6B,QAAQ,KAAK,KAAK,CAAC,qBAC9G;;CAGH,MAAM,aACJ,QAAQ,qBACR,OAAO,uCACP,IAAI,MAAM,EAAC,aAAa,CAAC,MAAM,GAAG,GAAG;CAEvC,MAAM,YAAY;EAChB,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB;EACA;EACD;AAED,KAAI,CAAC,UAAU;AACb,QAAM,UAAU,iBAAiB,WAAW,WAAW,OAAU,CAAC;AAClE,QAAM,MAAM,QAAQ,IAAI;AACxB,aAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;;CAMhE,IAAIC,QAA0D;CAC9D,MAAMC,SAA6B,CAAC,GAAI,SAAS,YAAY,EAAE,CAAE;AAEjE,MAAK,MAAM,QAAQ,cAAc;AAC/B,MAAI,OAAO,MAAM,MAAM,EAAE,SAAS,KAAK,CAAE;EACzC,MAAM,cAAc,wBAClB,MACA,QAAQ,WACR,QAAQ,SACR,OAAO,OAAO,IACd,IACD;AACD,MAAI,UAAU,KACZ,SAAQ,MAAM,IAAI,WAAW;EAE/B,IAAI,OAAO,MAAM,MAAM,MAAM,EAAE,SAAS,YAAY,EAAE;AACtD,MAAI,KAGF,gBAAe;GACb,MAAM;GACN,QAAQ;GACR,SAAS,GAAG,KAAK;GACjB,SAAS;GACV,CAAC;OACG;AACL,kBAAe;IACb,MAAM;IACN,QAAQ;IACR,SAAS,GAAG,KAAK;IACjB,SAAS;IACV,CAAC;AAEF,WADgB,MAAM,IAAI,SAAS,YAAY,EAChC;;AAEjB,SAAO,KAAK;GAAE;GAAM;GAAa;GAAM,CAAC;AAIxC,QAAM,UACJ,iBAAiB,WAAW,cAAc,UAAU,EAAE,UAAU,QAAQ,CAAC,CAC1E;AACD,QAAM,MAAM,QAAQ,IAAI;AACxB,aAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;;CAGhE,IAAIC;AACJ,KAAI,QAAQ,KAEV,QAAO,8BADU,QAAQ,QAAQ,KAAK,EAAE,QAAQ,KAAK,EACN;EAC7C,oBAAoB;EACpB,qBAAqB,QAAQ;EAC9B,CAAC;UACO,QAAQ,aAAa;EAC9B,MAAM,SAAS,0BAA0B;EACzC,MAAM,UAAU,GAAG,wBAAwB,IAAI,GAAG,QAAQ;EAC1D,MAAM,OAAO,MAAM,IAAI,YAAY,QAAQ,QAAQ;AAKnD,SAAO,wCAHL,QAAQ,YAAY,MAAM,IAC1B,SAAS,QAAQ,YAAY,CAAC,QAAQ,oBAAoB,GAAG,IAC7D,aACkD,MAAM;GACxD,oBAAoB;GACpB,qBAAqB,QAAQ;GAC9B,CAAC;OAEF,OAAM,IAAI,MAAM,qDAAqD;AAGvE,OAAM,IAAI,2BAA2B,uBAAuB,YAAY,KAAK;AAE7E,OAAM,UACJ,iBAAiB,WAAW,SAAS,UAAU,EAAE,UAAU,QAAQ,CAAC,CACrE;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,MAAM,gBACJ,OAAO,SAAS,IACZ,WAAW,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK,KAC/C;AACN,SAAQ,IACN,sBAAsB,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,YAAY,WAAW,MAAM,sBAAsB,IAAI,cAAc,GAC/I;AAED,KAAI,QAAQ,MAAM;EAChB,MAAMH,SAAgC;GACpC,QAAQ;GACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;GAC7D,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB;GACA;GACA;GACA,QAAQ,OAAO,KAAK,OAAO;IACzB,MAAM,EAAE;IACR,aAAa,EAAE;IACf,MAAM,EAAE;IACT,EAAE;GACJ;AACD,UAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK"}
+{"version":3,"file":"provision-tenant-Dh3-p5ZK.mjs","names":["result: ProvisionTenantResult","allD1: Awaited<ReturnType<typeof api.d1ListAll>> | null","shards: TenantD1ShardRef[]","form: FormData"],"sources":["../src/cli/commands/provision-tenant.ts"],"sourcesContent":["import { basename, resolve } from \"path\";\nimport { loadConfig } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { getDispatchNamespaces } from \"../../types.js\";\nimport { effectiveDispatchNamespaceName } from \"../../features/dispatch-namespace/dispatch-namespace.resolve.js\";\nimport {\n  parseTenantShardRoles,\n  tenantDispatchScriptName,\n  tenantShardDatabaseName,\n  tenantStateKey,\n} from \"../../core/tenant/tenantKeys.js\";\nimport {\n  buildSingleModuleDispatchForm,\n  buildSingleModuleDispatchFormFromBuffer,\n} from \"../../core/wfp/buildDispatchUploadForm.js\";\nimport { tamerArtifactsBucketName, tamerArtifactsKeyPrefix } from \"../../core/state/tamerArtifactsR2.js\";\nimport { logApplyChange } from \"../../core/plan/planFormat.js\";\nimport type { TenantD1ShardRef, TenantStateEntry } from \"../../types.js\";\n\nconst now = (): string => new Date().toISOString();\n\nfunction buildTenantEntry(\n  options: {\n    product: string;\n    workspace: string;\n    dispatchNamespaceName: string;\n    scriptName: string;\n  },\n  status: TenantStateEntry[\"provisioningStatus\"],\n  existing: TenantStateEntry | undefined,\n  patch?: Partial<Pick<TenantStateEntry, \"d1Shards\">>,\n): TenantStateEntry {\n  return {\n    product: options.product,\n    workspace: options.workspace,\n    provisioningStatus: status,\n    dispatchNamespaceName: options.dispatchNamespaceName,\n    scriptName: options.scriptName,\n    d1Shards: patch?.d1Shards ?? existing?.d1Shards,\n    createdAt: existing?.createdAt ?? now(),\n    updatedAt: now(),\n  };\n}\n\n/**\n * Resolve the effective shard set for this provision call.\n *\n *   1. The configured layout (`tenant.d1Shards` in `tamer.config.ts`)\n *      is the source of truth — any role used by `--shards` must\n *      appear here, and `apply` / `drift` / other operators read the\n *      same shape.\n *   2. When `--shards a,b` is passed, trim to that subset (preserving\n *      configured order so plan/provision logs stay deterministic).\n *      Extending the layout is an edit to `tamer.config.ts`, not a\n *      CLI flag — that's why `parseTenantShardRoles` rejects roles\n *      outside the configured set.\n *   3. When the config has no `tenant.d1Shards`, the resolved set is\n *      empty: `provision-tenant` only uploads the dispatch script\n *      (truly generic single-Worker tenant case).\n */\nfunction resolveShardRoles(\n  configured: readonly string[],\n  shardsRaw: string | undefined,\n): string[] {\n  if (shardsRaw == null || shardsRaw.trim() === \"\") return [...configured];\n  return parseTenantShardRoles(shardsRaw, configured);\n}\n\n/**\n * Idempotent tenant provisioning. Each call:\n *\n *   1. Marks the tenant `pending` if there's no record yet.\n *   2. For every shard role declared in `tenant.d1Shards` in\n *      `tamer.config.ts` (or a `--shards` subset): looks up an\n *      existing D1 by derived name (`tenantShardDatabaseName(role,\n *      …)`), creating it via `d1Create` only when missing. Persists\n *      the `(role, derivedName, cfId)` triple to\n *      `state.tenants[…].d1Shards[]`.\n *   3. Marks the tenant `d1_created` once *all* requested shards\n *      exist in state.\n *   4. Uploads the dispatch script (from `--main` or `--artifact-key`)\n *      via the WFP dispatch namespace.\n *   5. Marks the tenant `ready`.\n *\n * When `tenant.d1Shards` is omitted, step 2/3 collapse to a no-op\n * (truly generic single-Worker tenant — only the dispatch script is\n * provisioned). Re-running with the same shard set is a no-op (state\n * already has those rows). Editing `tamer.config.ts` to **extend**\n * the layout (e.g. adding a new role) and re-running picks up the\n * missing shards without disturbing existing ones, so a tenant\n * created with `[\"app\"]` can be migrated to `[\"system\",\"app\",\n * \"history\"]` (or `[\"primary\",\"audit\"]`, or any other set) with one\n * config edit + one `provision-tenant` invocation. Re-running after\n * a config that **shrinks** the layout never deletes shards (use\n * `destroy-tenant` for that).\n */\n/**\n * Machine-readable result envelope emitted on the final stdout line\n * when `--json` is passed. Designed for the Cloudflare Container caller\n * (`provision-workflow`, see `docs/handoff.md` §7) so the Worker can\n * parse the result without scraping human logs. On success the Workflow\n * sees `status: \"ready\"` plus the materialized tenant shape; on\n * failure it sees `status: \"failed\"` with `error` + best-effort\n * `partial` state, and the process exits non-zero.\n */\nexport interface ProvisionTenantResult {\n  status: \"ready\" | \"failed\" | \"noop\";\n  tenantKey: string;\n  product: string;\n  workspace: string;\n  env: string;\n  scriptName: string;\n  dispatchNamespaceName: string;\n  shards: { role: string; derivedName: string; cfId: string }[];\n  error?: string;\n}\n\nexport async function runProvisionTenant(options: {\n  env: string;\n  product: string;\n  workspace: string;\n  main?: string;\n  artifactKey?: string;\n  moduleName?: string;\n  configPath?: string;\n  compatibilityDate?: string;\n  compatibilityFlags?: string[];\n  /**\n   * Raw `--shards` value (`\"system,app\"` etc.) — validated against\n   * `tenant.d1Shards` from the loaded config. Omit to provision every\n   * configured shard.\n   */\n  shardsRaw?: string;\n  json?: boolean;\n}): Promise<void> {\n  const env = options.env;\n  if (env === \"local\") {\n    throw new Error(\n      \"provision-tenant requires a non-local --env (Cloudflare-backed state).\",\n    );\n  }\n\n  try {\n    await provisionTenantInner(options);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    if (options.json) {\n      // Failure envelope: we may have died before loadConfig, so we\n      // can't ask `tenant.ephemeralEnvPattern` whether `env` would\n      // get the `-{env}` suffix. Emit the non-ephemeral form as a\n      // best-effort hint — `error` carries the real signal.\n      const result: ProvisionTenantResult = {\n        status: \"failed\",\n        tenantKey: tenantStateKey(options.product, options.workspace),\n        product: options.product,\n        workspace: options.workspace,\n        env,\n        scriptName: `${options.product}-${options.workspace}`,\n        dispatchNamespaceName: \"\",\n        shards: [],\n        error: msg,\n      };\n      process.stdout.write(JSON.stringify(result) + \"\\n\");\n    }\n    // Container caller (provision-workflow) reads exit code as\n    // primary success/failure signal; JSON envelope on stdout is\n    // secondary detail. Re-throw so the CLI surfaces the original\n    // error in human mode.\n    throw err;\n  }\n}\n\nasync function provisionTenantInner(options: {\n  env: string;\n  product: string;\n  workspace: string;\n  main?: string;\n  artifactKey?: string;\n  moduleName?: string;\n  configPath?: string;\n  compatibilityDate?: string;\n  compatibilityFlags?: string[];\n  shardsRaw?: string;\n  json?: boolean;\n}): Promise<void> {\n  const env = options.env;\n  const config = await loadConfig(options.configPath, { env });\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const dns = getDispatchNamespaces(config);\n  if (dns.length === 0) {\n    throw new Error(\n      \"provision-tenant requires at least one dispatch namespace in the Tamer project config (dispatchNamespaces).\",\n    );\n  }\n  const nsConfig = dns[0]!;\n  const dispatchNamespaceName = effectiveDispatchNamespaceName(\n    nsConfig,\n    env,\n    config.tenant,\n  );\n  const scriptName = tenantDispatchScriptName(\n    options.product,\n    options.workspace,\n    env,\n    config.tenant,\n  );\n  const desiredRoles = resolveShardRoles(\n    config.tenant.d1Shards ?? [],\n    options.shardsRaw,\n  );\n\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n\n  let existing = state.getTenant(options.product, options.workspace);\n  // \"ready\" is a no-op only when the existing layout already covers\n  // every requested shard role. Adding a new role re-opens the tenant\n  // for incremental provisioning without forcing a full re-deploy.\n  if (existing?.provisioningStatus === \"ready\") {\n    const have = new Set((existing.d1Shards ?? []).map((s) => s.role));\n    const missing = desiredRoles.filter((r) => !have.has(r));\n    if (missing.length === 0) {\n      console.log(\n        `Tenant ${tenantStateKey(options.product, options.workspace)} already ready; nothing to do.`,\n      );\n      if (options.json) {\n        const result: ProvisionTenantResult = {\n          status: \"noop\",\n          tenantKey: tenantStateKey(options.product, options.workspace),\n          product: options.product,\n          workspace: options.workspace,\n          env,\n          scriptName,\n          dispatchNamespaceName,\n          shards: (existing.d1Shards ?? []).map((s) => ({\n            role: s.role,\n            derivedName: s.derivedName,\n            cfId: s.cfId,\n          })),\n        };\n        process.stdout.write(JSON.stringify(result) + \"\\n\");\n      }\n      return;\n    }\n    console.log(\n      `Tenant ${tenantStateKey(options.product, options.workspace)} ready but missing shards: ${missing.join(\", \")}; extending layout.`,\n    );\n  }\n\n  const compatDate =\n    options.compatibilityDate ??\n    config.compatibility_date ??\n    new Date().toISOString().slice(0, 10);\n\n  const entryOpts = {\n    product: options.product,\n    workspace: options.workspace,\n    dispatchNamespaceName,\n    scriptName,\n  };\n\n  if (!existing) {\n    state.setTenant(buildTenantEntry(entryOpts, \"pending\", undefined));\n    await state.persist(api);\n    existing = state.getTenant(options.product, options.workspace)!;\n  }\n\n  // Reconcile each requested shard role. We list D1 once per call when\n  // we need to (some role is missing from state) and reuse the result\n  // for every subsequent role.\n  let allD1: Awaited<ReturnType<typeof api.d1ListAll>> | null = null;\n  const shards: TenantD1ShardRef[] = [...(existing.d1Shards ?? [])];\n\n  for (const role of desiredRoles) {\n    if (shards.find((s) => s.role === role)) continue;\n    const derivedName = tenantShardDatabaseName(\n      role,\n      options.workspace,\n      options.product,\n      config.tenant.id,\n      env,\n    );\n    if (allD1 === null) {\n      allD1 = await api.d1ListAll();\n    }\n    let cfId = allD1.find((d) => d.name === derivedName)?.uuid;\n    if (cfId) {\n      // Adopt an existing D1 (e.g. partial-failure resume, or\n      // operator created it out-of-band) without re-issuing POST.\n      logApplyChange({\n        kind: \"d1\",\n        action: \"no_change\",\n        logical: `${role}-shard`,\n        derived: derivedName,\n      });\n    } else {\n      logApplyChange({\n        kind: \"d1\",\n        action: \"create\",\n        logical: `${role}-shard`,\n        derived: derivedName,\n      });\n      const created = await api.d1Create(derivedName);\n      cfId = created.uuid;\n    }\n    shards.push({ role, derivedName, cfId });\n    // Persist after each shard so a network failure mid-loop leaves\n    // the already-created shards recorded — `provision-tenant` is\n    // resumable role-by-role.\n    state.setTenant(\n      buildTenantEntry(entryOpts, \"d1_created\", existing, { d1Shards: shards }),\n    );\n    await state.persist(api);\n    existing = state.getTenant(options.product, options.workspace)!;\n  }\n\n  let form: FormData;\n  if (options.main) {\n    const mainPath = resolve(process.cwd(), options.main);\n    form = buildSingleModuleDispatchForm(mainPath, {\n      compatibility_date: compatDate,\n      compatibility_flags: options.compatibilityFlags,\n    });\n  } else if (options.artifactKey) {\n    const bucket = tamerArtifactsBucketName();\n    const fullKey = `${tamerArtifactsKeyPrefix(env)}${options.artifactKey}`;\n    const body = await api.r2GetObject(bucket, fullKey);\n    const mod =\n      options.moduleName?.trim() ||\n      basename(options.artifactKey).replace(/\\.(zip|tar|gz)$/i, \"\") ||\n      \"worker.js\";\n    form = buildSingleModuleDispatchFormFromBuffer(mod, body, {\n      compatibility_date: compatDate,\n      compatibility_flags: options.compatibilityFlags,\n    });\n  } else {\n    throw new Error(\"provision-tenant: provide --main or --artifact-key\");\n  }\n\n  await api.dispatchNamespaceScriptPut(dispatchNamespaceName, scriptName, form);\n\n  state.setTenant(\n    buildTenantEntry(entryOpts, \"ready\", existing, { d1Shards: shards }),\n  );\n  await state.persist(api);\n\n  const shardsSummary =\n    shards.length > 0\n      ? `shards: ${shards.map((s) => s.role).join(\", \")}`\n      : \"no shards declared\";\n  console.log(\n    `Provisioned tenant ${tenantStateKey(options.product, options.workspace)} → script ${scriptName} in ${dispatchNamespaceName} (${shardsSummary})`,\n  );\n\n  if (options.json) {\n    const result: ProvisionTenantResult = {\n      status: \"ready\",\n      tenantKey: tenantStateKey(options.product, options.workspace),\n      product: options.product,\n      workspace: options.workspace,\n      env,\n      scriptName,\n      dispatchNamespaceName,\n      shards: shards.map((s) => ({\n        role: s.role,\n        derivedName: s.derivedName,\n        cfId: s.cfId,\n      })),\n    };\n    process.stdout.write(JSON.stringify(result) + \"\\n\");\n  }\n}\n"],"mappings":";;;;;;;;;AAsBA,MAAM,6BAAoB,IAAI,MAAM,EAAC,aAAa;AAElD,SAAS,iBACP,SAMA,QACA,UACA,OACkB;AAClB,QAAO;EACL,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB,oBAAoB;EACpB,uBAAuB,QAAQ;EAC/B,YAAY,QAAQ;EACpB,UAAU,OAAO,YAAY,UAAU;EACvC,WAAW,UAAU,aAAa,KAAK;EACvC,WAAW,KAAK;EACjB;;;;;;;;;;;;;;;;;;AAmBH,SAAS,kBACP,YACA,WACU;AACV,KAAI,aAAa,QAAQ,UAAU,MAAM,KAAK,GAAI,QAAO,CAAC,GAAG,WAAW;AACxE,QAAO,sBAAsB,WAAW,WAAW;;AAoDrD,eAAsB,mBAAmB,SAiBvB;CAChB,MAAM,MAAM,QAAQ;AACpB,KAAI,QAAQ,QACV,OAAM,IAAI,MACR,yEACD;AAGH,KAAI;AACF,QAAM,qBAAqB,QAAQ;UAC5B,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,MAAI,QAAQ,MAAM;GAKhB,MAAMA,SAAgC;IACpC,QAAQ;IACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;IAC7D,SAAS,QAAQ;IACjB,WAAW,QAAQ;IACnB;IACA,YAAY,GAAG,QAAQ,QAAQ,GAAG,QAAQ;IAC1C,uBAAuB;IACvB,QAAQ,EAAE;IACV,OAAO;IACR;AACD,WAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK;;AAMrD,QAAM;;;AAIV,eAAe,qBAAqB,SAYlB;CAChB,MAAM,MAAM,QAAQ;CACpB,MAAM,SAAS,MAAM,WAAW,QAAQ,YAAY,EAAE,KAAK,CAAC;CAC5D,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,MAAM,sBAAsB,OAAO;AACzC,KAAI,IAAI,WAAW,EACjB,OAAM,IAAI,MACR,8GACD;CAEH,MAAM,WAAW,IAAI;CACrB,MAAM,wBAAwB,+BAC5B,UACA,KACA,OAAO,OACR;CACD,MAAM,aAAa,yBACjB,QAAQ,SACR,QAAQ,WACR,KACA,OAAO,OACR;CACD,MAAM,eAAe,kBACnB,OAAO,OAAO,YAAY,EAAE,EAC5B,QAAQ,UACT;CAED,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,IAAI,WAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;AAIlE,KAAI,UAAU,uBAAuB,SAAS;EAC5C,MAAM,OAAO,IAAI,KAAK,SAAS,YAAY,EAAE,EAAE,KAAK,MAAM,EAAE,KAAK,CAAC;EAClE,MAAM,UAAU,aAAa,QAAQ,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;AACxD,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAQ,IACN,UAAU,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,gCAC9D;AACD,OAAI,QAAQ,MAAM;IAChB,MAAMA,SAAgC;KACpC,QAAQ;KACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;KAC7D,SAAS,QAAQ;KACjB,WAAW,QAAQ;KACnB;KACA;KACA;KACA,SAAS,SAAS,YAAY,EAAE,EAAE,KAAK,OAAO;MAC5C,MAAM,EAAE;MACR,aAAa,EAAE;MACf,MAAM,EAAE;MACT,EAAE;KACJ;AACD,YAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK;;AAErD;;AAEF,UAAQ,IACN,UAAU,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,6BAA6B,QAAQ,KAAK,KAAK,CAAC,qBAC9G;;CAGH,MAAM,aACJ,QAAQ,qBACR,OAAO,uCACP,IAAI,MAAM,EAAC,aAAa,CAAC,MAAM,GAAG,GAAG;CAEvC,MAAM,YAAY;EAChB,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB;EACA;EACD;AAED,KAAI,CAAC,UAAU;AACb,QAAM,UAAU,iBAAiB,WAAW,WAAW,OAAU,CAAC;AAClE,QAAM,MAAM,QAAQ,IAAI;AACxB,aAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;;CAMhE,IAAIC,QAA0D;CAC9D,MAAMC,SAA6B,CAAC,GAAI,SAAS,YAAY,EAAE,CAAE;AAEjE,MAAK,MAAM,QAAQ,cAAc;AAC/B,MAAI,OAAO,MAAM,MAAM,EAAE,SAAS,KAAK,CAAE;EACzC,MAAM,cAAc,wBAClB,MACA,QAAQ,WACR,QAAQ,SACR,OAAO,OAAO,IACd,IACD;AACD,MAAI,UAAU,KACZ,SAAQ,MAAM,IAAI,WAAW;EAE/B,IAAI,OAAO,MAAM,MAAM,MAAM,EAAE,SAAS,YAAY,EAAE;AACtD,MAAI,KAGF,gBAAe;GACb,MAAM;GACN,QAAQ;GACR,SAAS,GAAG,KAAK;GACjB,SAAS;GACV,CAAC;OACG;AACL,kBAAe;IACb,MAAM;IACN,QAAQ;IACR,SAAS,GAAG,KAAK;IACjB,SAAS;IACV,CAAC;AAEF,WADgB,MAAM,IAAI,SAAS,YAAY,EAChC;;AAEjB,SAAO,KAAK;GAAE;GAAM;GAAa;GAAM,CAAC;AAIxC,QAAM,UACJ,iBAAiB,WAAW,cAAc,UAAU,EAAE,UAAU,QAAQ,CAAC,CAC1E;AACD,QAAM,MAAM,QAAQ,IAAI;AACxB,aAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;;CAGhE,IAAIC;AACJ,KAAI,QAAQ,KAEV,QAAO,8BADU,QAAQ,QAAQ,KAAK,EAAE,QAAQ,KAAK,EACN;EAC7C,oBAAoB;EACpB,qBAAqB,QAAQ;EAC9B,CAAC;UACO,QAAQ,aAAa;EAC9B,MAAM,SAAS,0BAA0B;EACzC,MAAM,UAAU,GAAG,wBAAwB,IAAI,GAAG,QAAQ;EAC1D,MAAM,OAAO,MAAM,IAAI,YAAY,QAAQ,QAAQ;AAKnD,SAAO,wCAHL,QAAQ,YAAY,MAAM,IAC1B,SAAS,QAAQ,YAAY,CAAC,QAAQ,oBAAoB,GAAG,IAC7D,aACkD,MAAM;GACxD,oBAAoB;GACpB,qBAAqB,QAAQ;GAC9B,CAAC;OAEF,OAAM,IAAI,MAAM,qDAAqD;AAGvE,OAAM,IAAI,2BAA2B,uBAAuB,YAAY,KAAK;AAE7E,OAAM,UACJ,iBAAiB,WAAW,SAAS,UAAU,EAAE,UAAU,QAAQ,CAAC,CACrE;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,MAAM,gBACJ,OAAO,SAAS,IACZ,WAAW,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK,KAC/C;AACN,SAAQ,IACN,sBAAsB,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,YAAY,WAAW,MAAM,sBAAsB,IAAI,cAAc,GAC/I;AAED,KAAI,QAAQ,MAAM;EAChB,MAAMH,SAAgC;GACpC,QAAQ;GACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;GAC7D,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB;GACA;GACA;GACA,QAAQ,OAAO,KAAK,OAAO;IACzB,MAAM,EAAE;IACR,aAAa,EAAE;IACf,MAAM,EAAE;IACT,EAAE;GACJ;AACD,UAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK"}

package/dist/{registry-D-vo1TTV.mjs → registry-BlHEOKlN.mjs}

@@ -1,4 +1,4 @@
-import { z as getWorkers } from "./tamer.mjs";
+import { B as getWorkers } from "./tamer.mjs";
 import { n as r2S3CredentialsFromEnv, t as emptyR2BucketViaS3 } from "./r2S3EmptyBucket-B9_pHfvB.mjs";
 import { n as logApplyChange } from "./planFormat-5XMJK879.mjs";
 
@@ -3077,4 +3077,4 @@ function getResourceModule(kind) {
 
 //#endregion
 export { d1CloudflareDatabaseName as a, logicalNamesForResourceKind as i, resourceModules as n, d1SkipsProvisionAndMigrate as o, secretsStoreDeriveName as r, getResourceModule as t };
-//# sourceMappingURL=registry-D-vo1TTV.mjs.map
+//# sourceMappingURL=registry-BlHEOKlN.mjs.map