@dragonmastery/tamer 0.35.3 → 0.36.0

package/dist/{types-CqmFeIBf.mjs → types-CN3DpOC2.mjs}

@@ -1,7 +1,7 @@
-import { B as loadConfig, C as stackNameForConfig, I as CFApiClient, L as cloudflareAccountIdFromEnv, O as resolveWorkerConfig, f as fetchStackImports, h as StateManager, j as wranglerConfigCliArgs, u as namingFromConfig, z as getWorkers } from "./tamer.mjs";
-import "./registry-D-vo1TTV.mjs";
+import { B as getWorkers, C as stackNameForConfig, I as CFApiClient, L as cloudflareAccountIdFromEnv, O as resolveWorkerConfig, V as loadConfig, f as fetchStackImports, h as StateManager, j as wranglerConfigCliArgs, u as namingFromConfig, z as getConfigBaseDir } from "./tamer.mjs";
+import "./registry-BlHEOKlN.mjs";
 import "./r2S3EmptyBucket-B9_pHfvB.mjs";
-import { n as writeWranglerJson, t as generateWranglerConfig } from "./generator-7b97QsuM.mjs";
+import { n as writeWranglerJson, t as generateWranglerConfig } from "./generator-ZTEeHlft.mjs";
 import { n as spawnWranglerSync } from "./wranglerSpawn-CqVNGkA9.mjs";
 
 //#region src/cli/commands/types.ts
@@ -9,8 +9,8 @@ async function runTypes(options) {
 	const workerFilter = options.worker;
 	const env = options.env ?? "local";
 	const configPath = options.configPath;
-	const baseDir = process.cwd();
 	const config = await loadConfig(configPath, { env });
+	const baseDir = getConfigBaseDir();
 	const accountId = config.account_id ?? cloudflareAccountIdFromEnv();
 	if (!accountId) throw new Error("account_id required in config or CLOUDFLARE_ACCOUNT_ID env var");
 	const naming = namingFromConfig(config);
@@ -39,4 +39,4 @@ async function runTypes(options) {
 
 //#endregion
 export { runTypes };
-//# sourceMappingURL=types-CqmFeIBf.mjs.map
+//# sourceMappingURL=types-CN3DpOC2.mjs.map

package/dist/types-CN3DpOC2.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-CN3DpOC2.mjs","names":[],"sources":["../src/cli/commands/types.ts"],"sourcesContent":["import { loadConfig, getWorkers, getConfigBaseDir } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { wranglerConfigCliArgs } from \"../../core/wrangler/wranglerOutFile.js\";\nimport { spawnWranglerSync } from \"../../core/wrangler/wranglerSpawn.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { resolveWorkerConfig } from \"../../core/config/resolver.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\nimport {\n  generateWranglerConfig,\n  writeWranglerJson,\n} from \"../../core/wrangler/generator.js\";\n\nexport async function runTypes(options: {\n  worker?: string;\n  env?: string;\n  configPath?: string;\n}): Promise<void> {\n  const workerFilter = options.worker;\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n\n  const config = await loadConfig(configPath, { env });\n  const baseDir = getConfigBaseDir();\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const imports = await fetchStackImports(api, config, env);\n\n  const workers = await getWorkers(config, baseDir);\n  const toRun = workerFilter\n    ? workers.filter(([k]) => k === workerFilter)\n    : workers;\n\n  if (toRun.length === 0) {\n    throw new Error(\n      workerFilter\n        ? `Worker \"${workerFilter}\" not found`\n        : \"No workers configured\",\n    );\n  }\n\n  for (const [workerKey, workerConfig] of toRun) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { imports },\n    );\n    const wranglerConfig = generateWranglerConfig(resolved, state, naming);\n    writeWranglerJson(resolved.workerDir, wranglerConfig, resolved.wranglerOutFile);\n\n    const typesArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n      \"types\",\n    ];\n    const result = spawnWranglerSync(typesArgs, {\n      cwd: resolved.workerDir,\n      stdio: \"inherit\",\n    });\n    if (result.status !== 0) {\n      throw new Error(`wrangler types failed for ${workerKey}`);\n    }\n    console.log(`Generated types for ${workerKey}`);\n  }\n}\n"],"mappings":";;;;;;;AAeA,eAAsB,SAAS,SAIb;CAChB,MAAM,eAAe,QAAQ;CAC7B,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAE3B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,UAAU,kBAAkB;CAClC,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;CAEzD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CACjD,MAAM,QAAQ,eACV,QAAQ,QAAQ,CAAC,OAAO,MAAM,aAAa,GAC3C;AAEJ,KAAI,MAAM,WAAW,EACnB,OAAM,IAAI,MACR,eACI,WAAW,aAAa,eACxB,wBACL;AAGH,MAAK,MAAM,CAAC,WAAW,iBAAiB,OAAO;EAC7C,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;EACD,MAAM,iBAAiB,uBAAuB,UAAU,OAAO,OAAO;AACtE,oBAAkB,SAAS,WAAW,gBAAgB,SAAS,gBAAgB;AAW/E,MAJe,kBALG;GAChB;GACA,GAAG,sBAAsB,SAAS,gBAAgB;GAClD;GACD,EAC2C;GAC1C,KAAK,SAAS;GACd,OAAO;GACR,CAAC,CACS,WAAW,EACpB,OAAM,IAAI,MAAM,6BAA6B,YAAY;AAE3D,UAAQ,IAAI,uBAAuB,YAAY"}

package/dist/{verifyPlanFile-DSO-yS64.mjs → verifyPlanFile-DxO0Ad6o.mjs}

@@ -1,4 +1,4 @@
-import { a as readPlanFile, r as computeAttestation } from "./cloudflareSnapshot-CpNFH4zd.mjs";
+import { a as readPlanFile, r as computeAttestation } from "./cloudflareSnapshot-CjPk6xYL.mjs";
 
 //#region src/core/plan/verifyPlanFile.ts
 function verifyPlanFile(args) {
@@ -30,4 +30,4 @@ function verifyPlanFile(args) {
 
 //#endregion
 export { verifyPlanFile as t };
-//# sourceMappingURL=verifyPlanFile-DSO-yS64.mjs.map
+//# sourceMappingURL=verifyPlanFile-DxO0Ad6o.mjs.map

package/dist/{verifyPlanFile-DSO-yS64.mjs.map → verifyPlanFile-DxO0Ad6o.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"verifyPlanFile-DSO-yS64.mjs","names":["reasons: string[]"],"sources":["../src/core/plan/verifyPlanFile.ts"],"sourcesContent":["/**\n * Cross-check a saved {@link PlanFile} against the current `(config, state,\n * live Cloudflare)` triple. Shared by `tamer apply --plan` and `tamer\n * destroy --plan`: both commands must refuse to execute against drifted\n * inputs unless the operator explicitly passes `--allow-stale`.\n *\n * The hashes are produced by {@link computeAttestation} (config + state)\n * and {@link hashCloudflareSnapshot} (live CF snapshot). Same algorithm on\n * both sides; if either side ever changes its canonical-JSON contract,\n * older plans must be regenerated.\n */\n\nimport type { CfiConfig, CfiState } from \"../../types.js\";\nimport { computeAttestation, readPlanFile } from \"./planFile.js\";\nimport type { PlanMode } from \"./plan.types.js\";\n\nexport function verifyPlanFile(args: {\n  /** Filesystem path passed by the operator (`--plan plan.json`). */\n  planPath: string;\n  /** \"apply\" or \"destroy\" — used for diagnostics only. */\n  command: \"apply\" | \"destroy\";\n  /**\n   * Required mode for the plan. `apply --plan` accepts only forward plans;\n   * `destroy --plan` accepts only destroy plans. Mismatch is a hard error\n   * (no `--allow-stale` override) since the actions are different.\n   */\n  expectedMode: PlanMode;\n  env: string;\n  tenantId: string;\n  config: CfiConfig;\n  stateAtPlanCheck: CfiState;\n  /**\n   * Hash of the live Cloudflare snapshot computed at run time. When the\n   * plan was generated with `attestation.cloudflareHash`, mismatches mean\n   * infra drifted out-of-band between plan and run. Omitted for\n   * `env: local` and for older plan files written before drift-aware\n   * refresh.\n   */\n  liveCloudflareHash: string | undefined;\n  allowStale: boolean;\n}): void {\n  const plan = readPlanFile(args.planPath);\n  const cmd = args.command;\n\n  if (plan.tenantId !== args.tenantId) {\n    throw new Error(\n      `${cmd} --plan: plan tenant \"${plan.tenantId}\" does not match current config tenant \"${args.tenantId}\"`,\n    );\n  }\n  if (plan.env !== args.env) {\n    throw new Error(\n      `${cmd} --plan: plan env \"${plan.env}\" does not match --env \"${args.env}\"`,\n    );\n  }\n\n  const planMode = plan.report.mode ?? \"forward\";\n  if (planMode !== args.expectedMode) {\n    throw new Error(\n      `${cmd} --plan: plan mode \"${planMode}\" does not match expected mode \"${args.expectedMode}\". ` +\n        `Use \\`tamer plan${args.expectedMode === \"destroy\" ? \" --destroy\" : \"\"} --out ${args.planPath}\\` to regenerate.`,\n    );\n  }\n\n  const current = computeAttestation(args.config, args.stateAtPlanCheck);\n  const configMatches = current.configHash === plan.attestation.configHash;\n  const stateMatches = current.stateHash === plan.attestation.stateHash;\n  const cloudflareMatches =\n    plan.attestation.cloudflareHash === undefined ||\n    args.liveCloudflareHash === undefined ||\n    plan.attestation.cloudflareHash === args.liveCloudflareHash;\n\n  if (configMatches && stateMatches && cloudflareMatches) {\n    console.log(`Plan attestation verified (${args.planPath}).`);\n    return;\n  }\n\n  const reasons: string[] = [];\n  if (!configMatches) reasons.push(\"config has changed since plan was generated\");\n  if (!stateMatches) reasons.push(\"recorded state has changed since plan was generated\");\n  if (!cloudflareMatches)\n    reasons.push(\n      \"Cloudflare-side resources drifted since plan was generated (out-of-band create/delete)\",\n    );\n  const detail = reasons.join(\"; \");\n\n  if (args.allowStale) {\n    console.warn(\n      `Plan attestation mismatch (${detail}). Proceeding anyway because --allow-stale was set.`,\n    );\n    return;\n  }\n  throw new Error(\n    `${cmd} --plan refused: ${detail}. Re-run \"tamer plan${args.expectedMode === \"destroy\" ? \" --destroy\" : \"\"} --out ${args.planPath}\" or pass --allow-stale to override.`,\n  );\n}\n"],"mappings":";;;AAgBA,SAAgB,eAAe,MAwBtB;CACP,MAAM,OAAO,aAAa,KAAK,SAAS;CACxC,MAAM,MAAM,KAAK;AAEjB,KAAI,KAAK,aAAa,KAAK,SACzB,OAAM,IAAI,MACR,GAAG,IAAI,wBAAwB,KAAK,SAAS,0CAA0C,KAAK,SAAS,GACtG;AAEH,KAAI,KAAK,QAAQ,KAAK,IACpB,OAAM,IAAI,MACR,GAAG,IAAI,qBAAqB,KAAK,IAAI,0BAA0B,KAAK,IAAI,GACzE;CAGH,MAAM,WAAW,KAAK,OAAO,QAAQ;AACrC,KAAI,aAAa,KAAK,aACpB,OAAM,IAAI,MACR,GAAG,IAAI,sBAAsB,SAAS,kCAAkC,KAAK,aAAa,qBACrE,KAAK,iBAAiB,YAAY,eAAe,GAAG,SAAS,KAAK,SAAS,mBACjG;CAGH,MAAM,UAAU,mBAAmB,KAAK,QAAQ,KAAK,iBAAiB;CACtE,MAAM,gBAAgB,QAAQ,eAAe,KAAK,YAAY;CAC9D,MAAM,eAAe,QAAQ,cAAc,KAAK,YAAY;CAC5D,MAAM,oBACJ,KAAK,YAAY,mBAAmB,UACpC,KAAK,uBAAuB,UAC5B,KAAK,YAAY,mBAAmB,KAAK;AAE3C,KAAI,iBAAiB,gBAAgB,mBAAmB;AACtD,UAAQ,IAAI,8BAA8B,KAAK,SAAS,IAAI;AAC5D;;CAGF,MAAMA,UAAoB,EAAE;AAC5B,KAAI,CAAC,cAAe,SAAQ,KAAK,8CAA8C;AAC/E,KAAI,CAAC,aAAc,SAAQ,KAAK,sDAAsD;AACtF,KAAI,CAAC,kBACH,SAAQ,KACN,yFACD;CACH,MAAM,SAAS,QAAQ,KAAK,KAAK;AAEjC,KAAI,KAAK,YAAY;AACnB,UAAQ,KACN,8BAA8B,OAAO,qDACtC;AACD;;AAEF,OAAM,IAAI,MACR,GAAG,IAAI,mBAAmB,OAAO,sBAAsB,KAAK,iBAAiB,YAAY,eAAe,GAAG,SAAS,KAAK,SAAS,sCACnI"}
+{"version":3,"file":"verifyPlanFile-DxO0Ad6o.mjs","names":["reasons: string[]"],"sources":["../src/core/plan/verifyPlanFile.ts"],"sourcesContent":["/**\n * Cross-check a saved {@link PlanFile} against the current `(config, state,\n * live Cloudflare)` triple. Shared by `tamer apply --plan` and `tamer\n * destroy --plan`: both commands must refuse to execute against drifted\n * inputs unless the operator explicitly passes `--allow-stale`.\n *\n * The hashes are produced by {@link computeAttestation} (config + state)\n * and {@link hashCloudflareSnapshot} (live CF snapshot). Same algorithm on\n * both sides; if either side ever changes its canonical-JSON contract,\n * older plans must be regenerated.\n */\n\nimport type { CfiConfig, CfiState } from \"../../types.js\";\nimport { computeAttestation, readPlanFile } from \"./planFile.js\";\nimport type { PlanMode } from \"./plan.types.js\";\n\nexport function verifyPlanFile(args: {\n  /** Filesystem path passed by the operator (`--plan plan.json`). */\n  planPath: string;\n  /** \"apply\" or \"destroy\" — used for diagnostics only. */\n  command: \"apply\" | \"destroy\";\n  /**\n   * Required mode for the plan. `apply --plan` accepts only forward plans;\n   * `destroy --plan` accepts only destroy plans. Mismatch is a hard error\n   * (no `--allow-stale` override) since the actions are different.\n   */\n  expectedMode: PlanMode;\n  env: string;\n  tenantId: string;\n  config: CfiConfig;\n  stateAtPlanCheck: CfiState;\n  /**\n   * Hash of the live Cloudflare snapshot computed at run time. When the\n   * plan was generated with `attestation.cloudflareHash`, mismatches mean\n   * infra drifted out-of-band between plan and run. Omitted for\n   * `env: local` and for older plan files written before drift-aware\n   * refresh.\n   */\n  liveCloudflareHash: string | undefined;\n  allowStale: boolean;\n}): void {\n  const plan = readPlanFile(args.planPath);\n  const cmd = args.command;\n\n  if (plan.tenantId !== args.tenantId) {\n    throw new Error(\n      `${cmd} --plan: plan tenant \"${plan.tenantId}\" does not match current config tenant \"${args.tenantId}\"`,\n    );\n  }\n  if (plan.env !== args.env) {\n    throw new Error(\n      `${cmd} --plan: plan env \"${plan.env}\" does not match --env \"${args.env}\"`,\n    );\n  }\n\n  const planMode = plan.report.mode ?? \"forward\";\n  if (planMode !== args.expectedMode) {\n    throw new Error(\n      `${cmd} --plan: plan mode \"${planMode}\" does not match expected mode \"${args.expectedMode}\". ` +\n        `Use \\`tamer plan${args.expectedMode === \"destroy\" ? \" --destroy\" : \"\"} --out ${args.planPath}\\` to regenerate.`,\n    );\n  }\n\n  const current = computeAttestation(args.config, args.stateAtPlanCheck);\n  const configMatches = current.configHash === plan.attestation.configHash;\n  const stateMatches = current.stateHash === plan.attestation.stateHash;\n  const cloudflareMatches =\n    plan.attestation.cloudflareHash === undefined ||\n    args.liveCloudflareHash === undefined ||\n    plan.attestation.cloudflareHash === args.liveCloudflareHash;\n\n  if (configMatches && stateMatches && cloudflareMatches) {\n    console.log(`Plan attestation verified (${args.planPath}).`);\n    return;\n  }\n\n  const reasons: string[] = [];\n  if (!configMatches) reasons.push(\"config has changed since plan was generated\");\n  if (!stateMatches) reasons.push(\"recorded state has changed since plan was generated\");\n  if (!cloudflareMatches)\n    reasons.push(\n      \"Cloudflare-side resources drifted since plan was generated (out-of-band create/delete)\",\n    );\n  const detail = reasons.join(\"; \");\n\n  if (args.allowStale) {\n    console.warn(\n      `Plan attestation mismatch (${detail}). Proceeding anyway because --allow-stale was set.`,\n    );\n    return;\n  }\n  throw new Error(\n    `${cmd} --plan refused: ${detail}. Re-run \"tamer plan${args.expectedMode === \"destroy\" ? \" --destroy\" : \"\"} --out ${args.planPath}\" or pass --allow-stale to override.`,\n  );\n}\n"],"mappings":";;;AAgBA,SAAgB,eAAe,MAwBtB;CACP,MAAM,OAAO,aAAa,KAAK,SAAS;CACxC,MAAM,MAAM,KAAK;AAEjB,KAAI,KAAK,aAAa,KAAK,SACzB,OAAM,IAAI,MACR,GAAG,IAAI,wBAAwB,KAAK,SAAS,0CAA0C,KAAK,SAAS,GACtG;AAEH,KAAI,KAAK,QAAQ,KAAK,IACpB,OAAM,IAAI,MACR,GAAG,IAAI,qBAAqB,KAAK,IAAI,0BAA0B,KAAK,IAAI,GACzE;CAGH,MAAM,WAAW,KAAK,OAAO,QAAQ;AACrC,KAAI,aAAa,KAAK,aACpB,OAAM,IAAI,MACR,GAAG,IAAI,sBAAsB,SAAS,kCAAkC,KAAK,aAAa,qBACrE,KAAK,iBAAiB,YAAY,eAAe,GAAG,SAAS,KAAK,SAAS,mBACjG;CAGH,MAAM,UAAU,mBAAmB,KAAK,QAAQ,KAAK,iBAAiB;CACtE,MAAM,gBAAgB,QAAQ,eAAe,KAAK,YAAY;CAC9D,MAAM,eAAe,QAAQ,cAAc,KAAK,YAAY;CAC5D,MAAM,oBACJ,KAAK,YAAY,mBAAmB,UACpC,KAAK,uBAAuB,UAC5B,KAAK,YAAY,mBAAmB,KAAK;AAE3C,KAAI,iBAAiB,gBAAgB,mBAAmB;AACtD,UAAQ,IAAI,8BAA8B,KAAK,SAAS,IAAI;AAC5D;;CAGF,MAAMA,UAAoB,EAAE;AAC5B,KAAI,CAAC,cAAe,SAAQ,KAAK,8CAA8C;AAC/E,KAAI,CAAC,aAAc,SAAQ,KAAK,sDAAsD;AACtF,KAAI,CAAC,kBACH,SAAQ,KACN,yFACD;CACH,MAAM,SAAS,QAAQ,KAAK,KAAK;AAEjC,KAAI,KAAK,YAAY;AACnB,UAAQ,KACN,8BAA8B,OAAO,qDACtC;AACD;;AAEF,OAAM,IAAI,MACR,GAAG,IAAI,mBAAmB,OAAO,sBAAsB,KAAK,iBAAiB,YAAY,eAAe,GAAG,SAAS,KAAK,SAAS,sCACnI"}

package/dist/{wfp-delete-C-1pIY3Z.mjs → wfp-delete-DJXpe2B7.mjs}

@@ -1,4 +1,4 @@
-import { B as loadConfig, I as CFApiClient, L as cloudflareAccountIdFromEnv } from "./tamer.mjs";
+import { I as CFApiClient, L as cloudflareAccountIdFromEnv, V as loadConfig } from "./tamer.mjs";
 
 //#region src/cli/commands/wfp-delete.ts
 function parseWfpDeleteArgs(argv) {
@@ -32,4 +32,4 @@ async function runWfpDelete(options) {
 
 //#endregion
 export { parseWfpDeleteArgs, runWfpDelete };
-//# sourceMappingURL=wfp-delete-C-1pIY3Z.mjs.map
+//# sourceMappingURL=wfp-delete-DJXpe2B7.mjs.map

package/dist/{wfp-delete-C-1pIY3Z.mjs.map → wfp-delete-DJXpe2B7.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"wfp-delete-C-1pIY3Z.mjs","names":["opts: Record<string, string | boolean>"],"sources":["../src/cli/commands/wfp-delete.ts"],"sourcesContent":["import { loadConfig } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\n\nexport function parseWfpDeleteArgs(argv: string[]): {\n  namespace: string;\n  scriptName: string;\n  force?: boolean;\n  configPath?: string;\n} {\n  const opts: Record<string, string | boolean> = {};\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i];\n    if (!arg.startsWith(\"--\")) continue;\n    const key = arg.slice(2).replace(/-/g, \"_\");\n    const next = argv[i + 1];\n    if (next && !next.startsWith(\"--\")) {\n      opts[key] = next;\n      i++;\n    } else {\n      opts[key] = true;\n    }\n  }\n  const namespace = opts.namespace as string | undefined;\n  const scriptName = opts.script_name as string | undefined;\n  if (!namespace || !scriptName) {\n    throw new Error(\n      \"usage: tamer wfp delete --namespace <name> --script-name <name> [--force] [--config <project.config.ts>]\",\n    );\n  }\n  return {\n    namespace,\n    scriptName,\n    force: opts.force === true || opts.force === \"true\",\n    configPath: opts.config as string | undefined,\n  };\n}\n\nexport async function runWfpDelete(options: {\n  namespace: string;\n  scriptName: string;\n  force?: boolean;\n  configPath?: string;\n}): Promise<void> {\n  const config = await loadConfig(options.configPath, { env: \"local\" });\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const api = new CFApiClient(accountId);\n  await api.dispatchNamespaceScriptDelete(options.namespace, options.scriptName, {\n    force: options.force,\n  });\n  console.log(\n    `Deleted script \"${options.scriptName}\" from dispatch namespace \"${options.namespace}\".`,\n  );\n}\n"],"mappings":";;;AAIA,SAAgB,mBAAmB,MAKjC;CACA,MAAMA,OAAyC,EAAE;AACjD,MAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,MAAM,KAAK;AACjB,MAAI,CAAC,IAAI,WAAW,KAAK,CAAE;EAC3B,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC,QAAQ,MAAM,IAAI;EAC3C,MAAM,OAAO,KAAK,IAAI;AACtB,MAAI,QAAQ,CAAC,KAAK,WAAW,KAAK,EAAE;AAClC,QAAK,OAAO;AACZ;QAEA,MAAK,OAAO;;CAGhB,MAAM,YAAY,KAAK;CACvB,MAAM,aAAa,KAAK;AACxB,KAAI,CAAC,aAAa,CAAC,WACjB,OAAM,IAAI,MACR,2GACD;AAEH,QAAO;EACL;EACA;EACA,OAAO,KAAK,UAAU,QAAQ,KAAK,UAAU;EAC7C,YAAY,KAAK;EAClB;;AAGH,eAAsB,aAAa,SAKjB;CAEhB,MAAM,aADS,MAAM,WAAW,QAAQ,YAAY,EAAE,KAAK,SAAS,CAAC,EAC5C,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;AAIH,OADY,IAAI,YAAY,UAAU,CAC5B,8BAA8B,QAAQ,WAAW,QAAQ,YAAY,EAC7E,OAAO,QAAQ,OAChB,CAAC;AACF,SAAQ,IACN,mBAAmB,QAAQ,WAAW,6BAA6B,QAAQ,UAAU,IACtF"}
+{"version":3,"file":"wfp-delete-DJXpe2B7.mjs","names":["opts: Record<string, string | boolean>"],"sources":["../src/cli/commands/wfp-delete.ts"],"sourcesContent":["import { loadConfig } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\n\nexport function parseWfpDeleteArgs(argv: string[]): {\n  namespace: string;\n  scriptName: string;\n  force?: boolean;\n  configPath?: string;\n} {\n  const opts: Record<string, string | boolean> = {};\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i];\n    if (!arg.startsWith(\"--\")) continue;\n    const key = arg.slice(2).replace(/-/g, \"_\");\n    const next = argv[i + 1];\n    if (next && !next.startsWith(\"--\")) {\n      opts[key] = next;\n      i++;\n    } else {\n      opts[key] = true;\n    }\n  }\n  const namespace = opts.namespace as string | undefined;\n  const scriptName = opts.script_name as string | undefined;\n  if (!namespace || !scriptName) {\n    throw new Error(\n      \"usage: tamer wfp delete --namespace <name> --script-name <name> [--force] [--config <project.config.ts>]\",\n    );\n  }\n  return {\n    namespace,\n    scriptName,\n    force: opts.force === true || opts.force === \"true\",\n    configPath: opts.config as string | undefined,\n  };\n}\n\nexport async function runWfpDelete(options: {\n  namespace: string;\n  scriptName: string;\n  force?: boolean;\n  configPath?: string;\n}): Promise<void> {\n  const config = await loadConfig(options.configPath, { env: \"local\" });\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const api = new CFApiClient(accountId);\n  await api.dispatchNamespaceScriptDelete(options.namespace, options.scriptName, {\n    force: options.force,\n  });\n  console.log(\n    `Deleted script \"${options.scriptName}\" from dispatch namespace \"${options.namespace}\".`,\n  );\n}\n"],"mappings":";;;AAIA,SAAgB,mBAAmB,MAKjC;CACA,MAAMA,OAAyC,EAAE;AACjD,MAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,MAAM,KAAK;AACjB,MAAI,CAAC,IAAI,WAAW,KAAK,CAAE;EAC3B,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC,QAAQ,MAAM,IAAI;EAC3C,MAAM,OAAO,KAAK,IAAI;AACtB,MAAI,QAAQ,CAAC,KAAK,WAAW,KAAK,EAAE;AAClC,QAAK,OAAO;AACZ;QAEA,MAAK,OAAO;;CAGhB,MAAM,YAAY,KAAK;CACvB,MAAM,aAAa,KAAK;AACxB,KAAI,CAAC,aAAa,CAAC,WACjB,OAAM,IAAI,MACR,2GACD;AAEH,QAAO;EACL;EACA;EACA,OAAO,KAAK,UAAU,QAAQ,KAAK,UAAU;EAC7C,YAAY,KAAK;EAClB;;AAGH,eAAsB,aAAa,SAKjB;CAEhB,MAAM,aADS,MAAM,WAAW,QAAQ,YAAY,EAAE,KAAK,SAAS,CAAC,EAC5C,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;AAIH,OADY,IAAI,YAAY,UAAU,CAC5B,8BAA8B,QAAQ,WAAW,QAAQ,YAAY,EAC7E,OAAO,QAAQ,OAChB,CAAC;AACF,SAAQ,IACN,mBAAmB,QAAQ,WAAW,6BAA6B,QAAQ,UAAU,IACtF"}

package/dist/{wfp-put-D0tDs0J5.mjs → wfp-put-BMSAGpZ6.mjs}

@@ -1,4 +1,4 @@
-import { B as loadConfig, I as CFApiClient, L as cloudflareAccountIdFromEnv } from "./tamer.mjs";
+import { I as CFApiClient, L as cloudflareAccountIdFromEnv, V as loadConfig } from "./tamer.mjs";
 import { t as buildSingleModuleDispatchForm } from "./buildDispatchUploadForm-BNDcS5_9.mjs";
 import { resolve } from "path";
 
@@ -48,4 +48,4 @@ async function runWfpPut(options) {
 
 //#endregion
 export { parseWfpPutArgs, runWfpPut };
-//# sourceMappingURL=wfp-put-D0tDs0J5.mjs.map
+//# sourceMappingURL=wfp-put-BMSAGpZ6.mjs.map

package/dist/{wfp-put-D0tDs0J5.mjs.map → wfp-put-BMSAGpZ6.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"wfp-put-D0tDs0J5.mjs","names":["opts: Record<string, string | boolean | string[]>"],"sources":["../src/cli/commands/wfp-put.ts"],"sourcesContent":["import { resolve } from \"path\";\nimport { loadConfig } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { buildSingleModuleDispatchForm } from \"../../core/wfp/buildDispatchUploadForm.js\";\n\nexport function parseWfpPutArgs(argv: string[]): {\n  namespace: string;\n  scriptName: string;\n  main: string;\n  compatDate?: string;\n  flags?: string[];\n  configPath?: string;\n} {\n  const opts: Record<string, string | boolean | string[]> = {};\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i];\n    if (!arg.startsWith(\"--\")) continue;\n    const key = arg.slice(2).replace(/-/g, \"_\");\n    const next = argv[i + 1];\n    if (key === \"compat_flags\") {\n      if (next && !next.startsWith(\"--\")) {\n        opts[key] = next.split(\",\").map((s) => s.trim()).filter(Boolean);\n        i++;\n      }\n    } else if (next && !next.startsWith(\"--\")) {\n      opts[key] = next;\n      i++;\n    }\n  }\n  const namespace = opts.namespace as string | undefined;\n  const scriptName = opts.script_name as string | undefined;\n  const main = opts.main as string | undefined;\n  if (!namespace || !scriptName || !main) {\n    throw new Error(\n      \"usage: tamer wfp put --namespace <name> --script-name <name> --main <file> [--compatibility-date <yyyy-mm-dd>] [--compat-flags a,b] [--config <project.config.ts>]\",\n    );\n  }\n  return {\n    namespace,\n    scriptName,\n    main: resolve(process.cwd(), main),\n    compatDate:\n      (opts.compatibility_date as string | undefined) ??\n      (opts.compat_date as string | undefined),\n    flags: opts.compat_flags as string[] | undefined,\n    configPath: opts.config as string | undefined,\n  };\n}\n\nexport async function runWfpPut(options: {\n  namespace: string;\n  scriptName: string;\n  main: string;\n  compatDate?: string;\n  flags?: string[];\n  configPath?: string;\n}): Promise<void> {\n  const config = await loadConfig(options.configPath, { env: \"local\" });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const compatDate =\n    options.compatDate ??\n    config.compatibility_date ??\n    new Date().toISOString().slice(0, 10);\n\n  const form = buildSingleModuleDispatchForm(options.main, {\n    compatibility_date: compatDate,\n    compatibility_flags: options.flags,\n  });\n\n  const api = new CFApiClient(accountId);\n  await api.dispatchNamespaceScriptPut(\n    options.namespace,\n    options.scriptName,\n    form,\n  );\n  console.log(\n    `Uploaded script \"${options.scriptName}\" to dispatch namespace \"${options.namespace}\".`,\n  );\n}\n"],"mappings":";;;;;AAMA,SAAgB,gBAAgB,MAO9B;CACA,MAAMA,OAAoD,EAAE;AAC5D,MAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,MAAM,KAAK;AACjB,MAAI,CAAC,IAAI,WAAW,KAAK,CAAE;EAC3B,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC,QAAQ,MAAM,IAAI;EAC3C,MAAM,OAAO,KAAK,IAAI;AACtB,MAAI,QAAQ,gBACV;OAAI,QAAQ,CAAC,KAAK,WAAW,KAAK,EAAE;AAClC,SAAK,OAAO,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,EAAE,MAAM,CAAC,CAAC,OAAO,QAAQ;AAChE;;aAEO,QAAQ,CAAC,KAAK,WAAW,KAAK,EAAE;AACzC,QAAK,OAAO;AACZ;;;CAGJ,MAAM,YAAY,KAAK;CACvB,MAAM,aAAa,KAAK;CACxB,MAAM,OAAO,KAAK;AAClB,KAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAChC,OAAM,IAAI,MACR,qKACD;AAEH,QAAO;EACL;EACA;EACA,MAAM,QAAQ,QAAQ,KAAK,EAAE,KAAK;EAClC,YACG,KAAK,sBACL,KAAK;EACR,OAAO,KAAK;EACZ,YAAY,KAAK;EAClB;;AAGH,eAAsB,UAAU,SAOd;CAChB,MAAM,SAAS,MAAM,WAAW,QAAQ,YAAY,EAAE,KAAK,SAAS,CAAC;CACrE,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,aACJ,QAAQ,cACR,OAAO,uCACP,IAAI,MAAM,EAAC,aAAa,CAAC,MAAM,GAAG,GAAG;CAEvC,MAAM,OAAO,8BAA8B,QAAQ,MAAM;EACvD,oBAAoB;EACpB,qBAAqB,QAAQ;EAC9B,CAAC;AAGF,OADY,IAAI,YAAY,UAAU,CAC5B,2BACR,QAAQ,WACR,QAAQ,YACR,KACD;AACD,SAAQ,IACN,oBAAoB,QAAQ,WAAW,2BAA2B,QAAQ,UAAU,IACrF"}
+{"version":3,"file":"wfp-put-BMSAGpZ6.mjs","names":["opts: Record<string, string | boolean | string[]>"],"sources":["../src/cli/commands/wfp-put.ts"],"sourcesContent":["import { resolve } from \"path\";\nimport { loadConfig } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { buildSingleModuleDispatchForm } from \"../../core/wfp/buildDispatchUploadForm.js\";\n\nexport function parseWfpPutArgs(argv: string[]): {\n  namespace: string;\n  scriptName: string;\n  main: string;\n  compatDate?: string;\n  flags?: string[];\n  configPath?: string;\n} {\n  const opts: Record<string, string | boolean | string[]> = {};\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i];\n    if (!arg.startsWith(\"--\")) continue;\n    const key = arg.slice(2).replace(/-/g, \"_\");\n    const next = argv[i + 1];\n    if (key === \"compat_flags\") {\n      if (next && !next.startsWith(\"--\")) {\n        opts[key] = next.split(\",\").map((s) => s.trim()).filter(Boolean);\n        i++;\n      }\n    } else if (next && !next.startsWith(\"--\")) {\n      opts[key] = next;\n      i++;\n    }\n  }\n  const namespace = opts.namespace as string | undefined;\n  const scriptName = opts.script_name as string | undefined;\n  const main = opts.main as string | undefined;\n  if (!namespace || !scriptName || !main) {\n    throw new Error(\n      \"usage: tamer wfp put --namespace <name> --script-name <name> --main <file> [--compatibility-date <yyyy-mm-dd>] [--compat-flags a,b] [--config <project.config.ts>]\",\n    );\n  }\n  return {\n    namespace,\n    scriptName,\n    main: resolve(process.cwd(), main),\n    compatDate:\n      (opts.compatibility_date as string | undefined) ??\n      (opts.compat_date as string | undefined),\n    flags: opts.compat_flags as string[] | undefined,\n    configPath: opts.config as string | undefined,\n  };\n}\n\nexport async function runWfpPut(options: {\n  namespace: string;\n  scriptName: string;\n  main: string;\n  compatDate?: string;\n  flags?: string[];\n  configPath?: string;\n}): Promise<void> {\n  const config = await loadConfig(options.configPath, { env: \"local\" });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const compatDate =\n    options.compatDate ??\n    config.compatibility_date ??\n    new Date().toISOString().slice(0, 10);\n\n  const form = buildSingleModuleDispatchForm(options.main, {\n    compatibility_date: compatDate,\n    compatibility_flags: options.flags,\n  });\n\n  const api = new CFApiClient(accountId);\n  await api.dispatchNamespaceScriptPut(\n    options.namespace,\n    options.scriptName,\n    form,\n  );\n  console.log(\n    `Uploaded script \"${options.scriptName}\" to dispatch namespace \"${options.namespace}\".`,\n  );\n}\n"],"mappings":";;;;;AAMA,SAAgB,gBAAgB,MAO9B;CACA,MAAMA,OAAoD,EAAE;AAC5D,MAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,MAAM,KAAK;AACjB,MAAI,CAAC,IAAI,WAAW,KAAK,CAAE;EAC3B,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC,QAAQ,MAAM,IAAI;EAC3C,MAAM,OAAO,KAAK,IAAI;AACtB,MAAI,QAAQ,gBACV;OAAI,QAAQ,CAAC,KAAK,WAAW,KAAK,EAAE;AAClC,SAAK,OAAO,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,EAAE,MAAM,CAAC,CAAC,OAAO,QAAQ;AAChE;;aAEO,QAAQ,CAAC,KAAK,WAAW,KAAK,EAAE;AACzC,QAAK,OAAO;AACZ;;;CAGJ,MAAM,YAAY,KAAK;CACvB,MAAM,aAAa,KAAK;CACxB,MAAM,OAAO,KAAK;AAClB,KAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAChC,OAAM,IAAI,MACR,qKACD;AAEH,QAAO;EACL;EACA;EACA,MAAM,QAAQ,QAAQ,KAAK,EAAE,KAAK;EAClC,YACG,KAAK,sBACL,KAAK;EACR,OAAO,KAAK;EACZ,YAAY,KAAK;EAClB;;AAGH,eAAsB,UAAU,SAOd;CAChB,MAAM,SAAS,MAAM,WAAW,QAAQ,YAAY,EAAE,KAAK,SAAS,CAAC;CACrE,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,aACJ,QAAQ,cACR,OAAO,uCACP,IAAI,MAAM,EAAC,aAAa,CAAC,MAAM,GAAG,GAAG;CAEvC,MAAM,OAAO,8BAA8B,QAAQ,MAAM;EACvD,oBAAoB;EACpB,qBAAqB,QAAQ;EAC9B,CAAC;AAGF,OADY,IAAI,YAAY,UAAU,CAC5B,2BACR,QAAQ,WACR,QAAQ,YACR,KACD;AACD,SAAQ,IACN,oBAAoB,QAAQ,WAAW,2BAA2B,QAAQ,UAAU,IACrF"}

package/dist/{worker-route-RexL6xCk.mjs → worker-route-C7kgtUXH.mjs}

@@ -1,4 +1,4 @@
-import { E as mergedWorkerConfigForEnv, O as resolveWorkerConfig, z as getWorkers } from "./tamer.mjs";
+import { B as getWorkers, E as mergedWorkerConfigForEnv, O as resolveWorkerConfig } from "./tamer.mjs";
 import { n as workerRouteStateKey, t as findZoneIdByName } from "./zoneResolver-D9bz6-0l.mjs";
 
 //#region src/features/worker-route/worker-route.sync.ts
@@ -259,4 +259,4 @@ async function workerRoutesDrift(env, config, baseDir, accountId, naming, state,
 
 //#endregion
 export { workerRouteSync as i, workerRoutesDestroy as n, workerRoutesApply as r, workerRoutesDrift as t };
-//# sourceMappingURL=worker-route-RexL6xCk.mjs.map
+//# sourceMappingURL=worker-route-C7kgtUXH.mjs.map

package/dist/{worker-route-RexL6xCk.mjs.map → worker-route-C7kgtUXH.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"worker-route-RexL6xCk.mjs","names":["list: Array<{ id: string; pattern: string; script: string }>","entry: WorkerRouteStateEntry","list: Array<{ id: string; pattern: string; script: string }>","key","entry: WorkerRouteStateEntry","drift: ResourceDrift","list: Array<{ id: string; pattern: string; script: string }>"],"sources":["../src/features/worker-route/worker-route.sync.ts","../src/features/worker-route/worker-route.prune.ts","../src/features/worker-route/worker-route.apply.ts","../src/features/worker-route/worker-route.destroy.ts","../src/features/worker-route/worker-route.drift.ts"],"sourcesContent":["import type { CfiConfig } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport { getWorkers } from \"../../core/config/loader.js\";\nimport { resolveWorkerConfig } from \"../../core/config/resolver.js\";\nimport { findZoneIdByName } from \"../../core/routes/zoneResolver.js\";\nimport { workerRouteStateKey } from \"./worker-route.stateKey.js\";\nimport type { WorkerRouteStateEntry } from \"../../types.js\";\n\n/**\n * Merge Workers zone routes for `tamerRoutes` (API-managed) into state from\n * Cloudflare listings. Drops stale `worker_route` rows for workers in this\n * config when the route no longer exists on CF.\n */\nexport async function workerRouteSync(\n  env: string,\n  config: CfiConfig,\n  baseDir: string,\n  accountId: string,\n  naming: NamingEngine,\n  state: StateManager,\n  api: CFApiClient,\n  opts: {\n    /**\n     * Pre-fetched sibling stack outputs so cross-stack route hosts/zones\n     * resolve to real patterns (else they stay as placeholders and never\n     * match anything CF returned). Optional — sync is tolerant mode.\n     */\n    imports?: Record<string, Record<string, string>>;\n  } = {},\n): Promise<void> {\n  if (env === \"local\") return;\n\n  const workers = await getWorkers(config, baseDir);\n  const workerKeys = new Set(workers.map(([k]) => k));\n  const touchedKeys = new Set<string>();\n  const ts = new Date().toISOString();\n\n  for (const [workerKey, wc] of workers) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      wc,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports: opts.imports },\n    );\n    for (const route of resolved.apiManagedRoutes) {\n      const zoneId = await findZoneIdByName(api, route.zone_name);\n      if (!zoneId) {\n        console.warn(\n          `[sync] worker routes: zone \"${route.zone_name}\" not found; skip ${route.pattern}`,\n        );\n        continue;\n      }\n      let list: Array<{ id: string; pattern: string; script: string }>;\n      try {\n        list = await api.zoneWorkerRoutesList(zoneId);\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        console.warn(\n          `[sync] worker routes: list failed for zone ${route.zone_name}: ${msg}`,\n        );\n        continue;\n      }\n      const hit = list.find(\n        (r) => r.pattern === route.pattern && r.script === resolved.workerName,\n      );\n      if (!hit) continue;\n\n      const key = workerRouteStateKey(zoneId, hit.id);\n      touchedKeys.add(key);\n      const existing = state.get(key);\n      const prev =\n        existing?.type === \"worker_route\" ? existing : undefined;\n      const entry: WorkerRouteStateEntry = {\n        type: \"worker_route\",\n        workerKey,\n        workerName: resolved.workerName,\n        zoneId,\n        zoneName: route.zone_name,\n        routeId: hit.id,\n        pattern: route.pattern,\n        createdAt: prev?.createdAt ?? ts,\n        updatedAt: ts,\n      };\n      state.set(key, entry);\n    }\n  }\n\n  /**\n   * Dropping stale `worker_route` state without calling Cloudflare's zone route\n   * delete API leaves orphaned public URL patterns on the script (common after\n   * removing `tamerRoutes`).\n   */\n  for (const [k, e] of Object.entries(state.getAll())) {\n    if (e.type !== \"worker_route\") continue;\n    if (!workerKeys.has(e.workerKey)) continue;\n    if (touchedKeys.has(k)) continue;\n    try {\n      await api.zoneWorkerRouteDelete(e.zoneId, e.routeId);\n      console.log(\n        `[sync] deleted stale Workers zone route ${e.pattern} → ${e.workerName} (${e.zoneName})`,\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] failed to delete stale zone route ${e.pattern}: ${msg}`);\n    }\n    state.delete(k);\n  }\n}\n","import type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { ResolvedWorkerConfig } from \"../../core/config/resolver.js\";\nimport { findZoneIdByName } from \"../../core/routes/zoneResolver.js\";\nimport { workerRouteStateKey } from \"./worker-route.stateKey.js\";\n\n/**\n * Remove Workers **zone routes** (`/zones/{id}/workers/routes`) that still point\n * at {@link ResolvedWorkerConfig.workerName} but are **not** in the resolved\n * desired set ({@link ResolvedWorkerConfig.apiManagedRoutes}), scoped to\n * {@link staleSweepZones}.\n *\n * Used on **`tamer deploy`** after removing `tamerRoutes` so orphaned patterns\n * are not left on the account. Wrangler **`routes`** / custom domains are a\n * separate surface — this only touches API-managed zone routes.\n *\n * When {@link staleSweepZones} is omitted or empty, this is a no-op (safe default).\n */\nexport async function pruneStaleApiManagedZoneRoutesForWorker(\n  api: CFApiClient,\n  state: StateManager,\n  resolved: ResolvedWorkerConfig,\n  staleSweepZones: string[] | undefined,\n): Promise<void> {\n  if (!staleSweepZones?.length) return;\n\n  const desired = new Set(\n    resolved.apiManagedRoutes.map((r) => `${r.zone_name}\\0${r.pattern}`),\n  );\n\n  for (const zoneName of staleSweepZones) {\n    const zoneId = await findZoneIdByName(api, zoneName);\n    if (!zoneId) {\n      console.warn(\n        `[deploy] stale route prune: zone \"${zoneName}\" not found; skip`,\n      );\n      continue;\n    }\n\n    let list: Array<{ id: string; pattern: string; script: string }>;\n    try {\n      list = await api.zoneWorkerRoutesList(zoneId);\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(\n        `[deploy] stale route prune: list failed for \"${zoneName}\": ${msg}`,\n      );\n      continue;\n    }\n\n    for (const r of list) {\n      if (r.script !== resolved.workerName) continue;\n      const sig = `${zoneName}\\0${r.pattern}`;\n      if (desired.has(sig)) continue;\n\n      try {\n        await api.zoneWorkerRouteDelete(zoneId, r.id);\n        console.log(\n          `[deploy] pruned stale zone route ${r.pattern} → ${resolved.workerName} (${zoneName})`,\n        );\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        console.warn(\n          `[deploy] stale route prune: failed to delete ${r.pattern}: ${msg}`,\n        );\n      }\n      state.delete(workerRouteStateKey(zoneId, r.id));\n    }\n  }\n}\n","import type { CfiConfig } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport { getWorkers } from \"../../core/config/loader.js\";\nimport {\n  mergedWorkerConfigForEnv,\n  resolveWorkerConfig,\n} from \"../../core/config/resolver.js\";\nimport { findZoneIdByName } from \"../../core/routes/zoneResolver.js\";\nimport { pruneStaleApiManagedZoneRoutesForWorker } from \"./worker-route.prune.js\";\nimport { workerRouteStateKey } from \"./worker-route.stateKey.js\";\nimport type { WorkerRouteStateEntry } from \"../../types.js\";\n\n/**\n * Ensure API-managed zone routes exist after the Worker script exists (call\n * after successful `wrangler deploy`).\n */\nexport async function workerRoutesApply(\n  env: string,\n  config: CfiConfig,\n  baseDir: string,\n  accountId: string,\n  naming: NamingEngine,\n  state: StateManager,\n  api: CFApiClient,\n  opts: {\n    /**\n     * Pre-fetched sibling stack outputs for `${tamer:import:…}` references\n     * in `tamerRoutes[].host` / `.zone`. Caller (`deploy`) is expected to\n     * load these once and reuse across worker iterations to avoid repeated\n     * D1 hydrate calls.\n     */\n    imports?: Record<string, Record<string, string>>;\n  } = {},\n): Promise<void> {\n  if (env === \"local\") return;\n\n  const workers = await getWorkers(config, baseDir);\n  const ts = new Date().toISOString();\n\n  for (const [workerKey, wc] of workers) {\n    const declared = mergedWorkerConfigForEnv(wc, env, config.tenant);\n    const staleSweepZones = declared.tamerStaleRouteSweepZones;\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      wc,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { imports: opts.imports },\n    );\n    await pruneStaleApiManagedZoneRoutesForWorker(\n      api,\n      state,\n      resolved,\n      staleSweepZones,\n    );\n    for (const route of resolved.apiManagedRoutes) {\n      const zoneId = await findZoneIdByName(api, route.zone_name);\n      if (!zoneId) {\n        throw new Error(\n          `worker routes: zone \"${route.zone_name}\" not found (check DNS / account access)`,\n        );\n      }\n      const list = await api.zoneWorkerRoutesList(zoneId);\n      const exists = list.find(\n        (r) => r.pattern === route.pattern && r.script === resolved.workerName,\n      );\n      if (exists) {\n        const key = workerRouteStateKey(zoneId, exists.id);\n        const existing = state.get(key);\n        const prev =\n          existing?.type === \"worker_route\" ? existing : undefined;\n        state.set(key, {\n          type: \"worker_route\",\n          workerKey,\n          workerName: resolved.workerName,\n          zoneId,\n          zoneName: route.zone_name,\n          routeId: exists.id,\n          pattern: route.pattern,\n          createdAt: prev?.createdAt ?? ts,\n          updatedAt: ts,\n        });\n        continue;\n      }\n\n      const created = await api.zoneWorkerRouteCreate(zoneId, {\n        pattern: route.pattern,\n        script: resolved.workerName,\n      });\n      const key = workerRouteStateKey(zoneId, created.id);\n      const entry: WorkerRouteStateEntry = {\n        type: \"worker_route\",\n        workerKey,\n        workerName: resolved.workerName,\n        zoneId,\n        zoneName: route.zone_name,\n        routeId: created.id,\n        pattern: route.pattern,\n        createdAt: ts,\n        updatedAt: ts,\n      };\n      state.set(key, entry);\n    }\n  }\n}\n","import type { CfiConfig } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport { getWorkers } from \"../../core/config/loader.js\";\n\n/**\n * Delete API-managed zone routes for workers declared in this stack's config\n * (before deleting Workers so routes are not left orphaned).\n */\nexport async function workerRoutesDestroy(\n  env: string,\n  config: CfiConfig,\n  baseDir: string,\n  state: StateManager,\n  api: CFApiClient,\n): Promise<void> {\n  if (env === \"local\") return;\n\n  const workers = await getWorkers(config, baseDir);\n  const allowed = new Set(workers.map(([k]) => k));\n\n  for (const [k, e] of Object.entries(state.getAll())) {\n    if (e.type !== \"worker_route\") continue;\n    if (!allowed.has(e.workerKey)) continue;\n    try {\n      await api.zoneWorkerRouteDelete(e.zoneId, e.routeId);\n      console.log(\n        `Deleted zone route ${e.pattern} (${e.routeId}) → ${e.workerName}`,\n      );\n    } catch (err) {\n      console.warn(\n        `Failed to delete zone route ${e.pattern}:`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n    state.delete(k);\n  }\n}\n","import type { CfiConfig } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport type { ResourceDrift } from \"../../core/drift/drift.types.js\";\nimport { getWorkers } from \"../../core/config/loader.js\";\nimport { resolveWorkerConfig } from \"../../core/config/resolver.js\";\nimport { findZoneIdByName } from \"../../core/routes/zoneResolver.js\";\nimport type { WorkerRouteStateEntry } from \"../../types.js\";\n\nfunction stateRouteForWorkerPattern(\n  state: StateManager,\n  workerKey: string,\n  pattern: string,\n): WorkerRouteStateEntry | undefined {\n  for (const e of Object.values(state.getAll())) {\n    if (\n      e.type === \"worker_route\" &&\n      e.workerKey === workerKey &&\n      e.pattern === pattern\n    ) {\n      return e;\n    }\n  }\n  return undefined;\n}\n\nexport async function workerRoutesDrift(\n  env: string,\n  config: CfiConfig,\n  baseDir: string,\n  accountId: string,\n  naming: NamingEngine,\n  state: StateManager,\n  api: CFApiClient,\n  opts: {\n    /** Pre-fetched sibling stack outputs; tolerant lookup. */\n    imports?: Record<string, Record<string, string>>;\n  } = {},\n): Promise<ResourceDrift | null> {\n  if (env === \"local\") return null;\n\n  const workers = await getWorkers(config, baseDir);\n  const drift: ResourceDrift = {\n    kind: \"worker_route\",\n    missingFromCloudflare: [],\n    unrecordedInState: [],\n    undeployed: [],\n  };\n  let sawAnyApiRoute = false;\n\n  for (const [workerKey, wc] of workers) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      wc,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports: opts.imports },\n    );\n    for (const route of resolved.apiManagedRoutes) {\n      sawAnyApiRoute = true;\n      const zoneId = await findZoneIdByName(api, route.zone_name);\n      if (!zoneId) {\n        drift.undeployed.push({\n          logicalName: workerKey,\n          derivedName: route.pattern,\n          detail: `zone \"${route.zone_name}\" not found`,\n        });\n        continue;\n      }\n      let list: Array<{ id: string; pattern: string; script: string }>;\n      try {\n        list = await api.zoneWorkerRoutesList(zoneId);\n      } catch {\n        continue;\n      }\n      const hit = list.find(\n        (r) => r.pattern === route.pattern && r.script === resolved.workerName,\n      );\n      const st = stateRouteForWorkerPattern(state, workerKey, route.pattern);\n      if (hit) {\n        if (!st || st.routeId !== hit.id) {\n          drift.unrecordedInState.push({\n            logicalName: workerKey,\n            derivedName: route.pattern,\n            cfId: hit.id,\n          });\n        }\n      } else if (st) {\n        drift.missingFromCloudflare.push({\n          logicalName: workerKey,\n          derivedName: route.pattern,\n          cfId: st.routeId,\n        });\n      } else {\n        drift.undeployed.push({\n          logicalName: workerKey,\n          derivedName: route.pattern,\n        });\n      }\n    }\n  }\n\n  return sawAnyApiRoute ? drift : null;\n}\n"],"mappings":";;;;;;;;;AAeA,eAAsB,gBACpB,KACA,QACA,SACA,WACA,QACA,OACA,KACA,OAOI,EAAE,EACS;AACf,KAAI,QAAQ,QAAS;CAErB,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CACjD,MAAM,aAAa,IAAI,IAAI,QAAQ,KAAK,CAAC,OAAO,EAAE,CAAC;CACnD,MAAM,8BAAc,IAAI,KAAa;CACrC,MAAM,sBAAK,IAAI,MAAM,EAAC,aAAa;AAEnC,MAAK,MAAM,CAAC,WAAW,OAAO,SAAS;EACrC,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,IACA,KACA,SACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY,SAAS,KAAK;GAAS,CACtD;AACD,OAAK,MAAM,SAAS,SAAS,kBAAkB;GAC7C,MAAM,SAAS,MAAM,iBAAiB,KAAK,MAAM,UAAU;AAC3D,OAAI,CAAC,QAAQ;AACX,YAAQ,KACN,+BAA+B,MAAM,UAAU,oBAAoB,MAAM,UAC1E;AACD;;GAEF,IAAIA;AACJ,OAAI;AACF,WAAO,MAAM,IAAI,qBAAqB,OAAO;YACtC,KAAK;IACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,YAAQ,KACN,8CAA8C,MAAM,UAAU,IAAI,MACnE;AACD;;GAEF,MAAM,MAAM,KAAK,MACd,MAAM,EAAE,YAAY,MAAM,WAAW,EAAE,WAAW,SAAS,WAC7D;AACD,OAAI,CAAC,IAAK;GAEV,MAAM,MAAM,oBAAoB,QAAQ,IAAI,GAAG;AAC/C,eAAY,IAAI,IAAI;GACpB,MAAM,WAAW,MAAM,IAAI,IAAI;GAC/B,MAAM,OACJ,UAAU,SAAS,iBAAiB,WAAW;GACjD,MAAMC,QAA+B;IACnC,MAAM;IACN;IACA,YAAY,SAAS;IACrB;IACA,UAAU,MAAM;IAChB,SAAS,IAAI;IACb,SAAS,MAAM;IACf,WAAW,MAAM,aAAa;IAC9B,WAAW;IACZ;AACD,SAAM,IAAI,KAAK,MAAM;;;;;;;;AASzB,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACnD,MAAI,EAAE,SAAS,eAAgB;AAC/B,MAAI,CAAC,WAAW,IAAI,EAAE,UAAU,CAAE;AAClC,MAAI,YAAY,IAAI,EAAE,CAAE;AACxB,MAAI;AACF,SAAM,IAAI,sBAAsB,EAAE,QAAQ,EAAE,QAAQ;AACpD,WAAQ,IACN,2CAA2C,EAAE,QAAQ,KAAK,EAAE,WAAW,IAAI,EAAE,SAAS,GACvF;WACM,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,4CAA4C,EAAE,QAAQ,IAAI,MAAM;;AAE/E,QAAM,OAAO,EAAE;;;;;;;;;;;;;;;;;;AC9FnB,eAAsB,wCACpB,KACA,OACA,UACA,iBACe;AACf,KAAI,CAAC,iBAAiB,OAAQ;CAE9B,MAAM,UAAU,IAAI,IAClB,SAAS,iBAAiB,KAAK,MAAM,GAAG,EAAE,UAAU,IAAI,EAAE,UAAU,CACrE;AAED,MAAK,MAAM,YAAY,iBAAiB;EACtC,MAAM,SAAS,MAAM,iBAAiB,KAAK,SAAS;AACpD,MAAI,CAAC,QAAQ;AACX,WAAQ,KACN,qCAAqC,SAAS,mBAC/C;AACD;;EAGF,IAAIC;AACJ,MAAI;AACF,UAAO,MAAM,IAAI,qBAAqB,OAAO;WACtC,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KACN,gDAAgD,SAAS,KAAK,MAC/D;AACD;;AAGF,OAAK,MAAM,KAAK,MAAM;AACpB,OAAI,EAAE,WAAW,SAAS,WAAY;GACtC,MAAM,MAAM,GAAG,SAAS,IAAI,EAAE;AAC9B,OAAI,QAAQ,IAAI,IAAI,CAAE;AAEtB,OAAI;AACF,UAAM,IAAI,sBAAsB,QAAQ,EAAE,GAAG;AAC7C,YAAQ,IACN,oCAAoC,EAAE,QAAQ,KAAK,SAAS,WAAW,IAAI,SAAS,GACrF;YACM,KAAK;IACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,YAAQ,KACN,gDAAgD,EAAE,QAAQ,IAAI,MAC/D;;AAEH,SAAM,OAAO,oBAAoB,QAAQ,EAAE,GAAG,CAAC;;;;;;;;;;;AChDrD,eAAsB,kBACpB,KACA,QACA,SACA,WACA,QACA,OACA,KACA,OAQI,EAAE,EACS;AACf,KAAI,QAAQ,QAAS;CAErB,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CACjD,MAAM,sBAAK,IAAI,MAAM,EAAC,aAAa;AAEnC,MAAK,MAAM,CAAC,WAAW,OAAO,SAAS;EAErC,MAAM,kBADW,yBAAyB,IAAI,KAAK,OAAO,OAAO,CAChC;EACjC,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,IACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,KAAK,SAAS,CAC1B;AACD,QAAM,wCACJ,KACA,OACA,UACA,gBACD;AACD,OAAK,MAAM,SAAS,SAAS,kBAAkB;GAC7C,MAAM,SAAS,MAAM,iBAAiB,KAAK,MAAM,UAAU;AAC3D,OAAI,CAAC,OACH,OAAM,IAAI,MACR,wBAAwB,MAAM,UAAU,0CACzC;GAGH,MAAM,UADO,MAAM,IAAI,qBAAqB,OAAO,EAC/B,MACjB,MAAM,EAAE,YAAY,MAAM,WAAW,EAAE,WAAW,SAAS,WAC7D;AACD,OAAI,QAAQ;IACV,MAAMC,QAAM,oBAAoB,QAAQ,OAAO,GAAG;IAClD,MAAM,WAAW,MAAM,IAAIA,MAAI;IAC/B,MAAM,OACJ,UAAU,SAAS,iBAAiB,WAAW;AACjD,UAAM,IAAIA,OAAK;KACb,MAAM;KACN;KACA,YAAY,SAAS;KACrB;KACA,UAAU,MAAM;KAChB,SAAS,OAAO;KAChB,SAAS,MAAM;KACf,WAAW,MAAM,aAAa;KAC9B,WAAW;KACZ,CAAC;AACF;;GAGF,MAAM,UAAU,MAAM,IAAI,sBAAsB,QAAQ;IACtD,SAAS,MAAM;IACf,QAAQ,SAAS;IAClB,CAAC;GACF,MAAM,MAAM,oBAAoB,QAAQ,QAAQ,GAAG;GACnD,MAAMC,QAA+B;IACnC,MAAM;IACN;IACA,YAAY,SAAS;IACrB;IACA,UAAU,MAAM;IAChB,SAAS,QAAQ;IACjB,SAAS,MAAM;IACf,WAAW;IACX,WAAW;IACZ;AACD,SAAM,IAAI,KAAK,MAAM;;;;;;;;;;;AClG3B,eAAsB,oBACpB,KACA,QACA,SACA,OACA,KACe;AACf,KAAI,QAAQ,QAAS;CAErB,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CACjD,MAAM,UAAU,IAAI,IAAI,QAAQ,KAAK,CAAC,OAAO,EAAE,CAAC;AAEhD,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACnD,MAAI,EAAE,SAAS,eAAgB;AAC/B,MAAI,CAAC,QAAQ,IAAI,EAAE,UAAU,CAAE;AAC/B,MAAI;AACF,SAAM,IAAI,sBAAsB,EAAE,QAAQ,EAAE,QAAQ;AACpD,WAAQ,IACN,sBAAsB,EAAE,QAAQ,IAAI,EAAE,QAAQ,MAAM,EAAE,aACvD;WACM,KAAK;AACZ,WAAQ,KACN,+BAA+B,EAAE,QAAQ,IACzC,eAAe,QAAQ,IAAI,UAAU,IACtC;;AAEH,QAAM,OAAO,EAAE;;;;;;ACzBnB,SAAS,2BACP,OACA,WACA,SACmC;AACnC,MAAK,MAAM,KAAK,OAAO,OAAO,MAAM,QAAQ,CAAC,CAC3C,KACE,EAAE,SAAS,kBACX,EAAE,cAAc,aAChB,EAAE,YAAY,QAEd,QAAO;;AAMb,eAAsB,kBACpB,KACA,QACA,SACA,WACA,QACA,OACA,KACA,OAGI,EAAE,EACyB;AAC/B,KAAI,QAAQ,QAAS,QAAO;CAE5B,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CACjD,MAAMC,QAAuB;EAC3B,MAAM;EACN,uBAAuB,EAAE;EACzB,mBAAmB,EAAE;EACrB,YAAY,EAAE;EACf;CACD,IAAI,iBAAiB;AAErB,MAAK,MAAM,CAAC,WAAW,OAAO,SAAS;EACrC,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,IACA,KACA,SACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY,SAAS,KAAK;GAAS,CACtD;AACD,OAAK,MAAM,SAAS,SAAS,kBAAkB;AAC7C,oBAAiB;GACjB,MAAM,SAAS,MAAM,iBAAiB,KAAK,MAAM,UAAU;AAC3D,OAAI,CAAC,QAAQ;AACX,UAAM,WAAW,KAAK;KACpB,aAAa;KACb,aAAa,MAAM;KACnB,QAAQ,SAAS,MAAM,UAAU;KAClC,CAAC;AACF;;GAEF,IAAIC;AACJ,OAAI;AACF,WAAO,MAAM,IAAI,qBAAqB,OAAO;WACvC;AACN;;GAEF,MAAM,MAAM,KAAK,MACd,MAAM,EAAE,YAAY,MAAM,WAAW,EAAE,WAAW,SAAS,WAC7D;GACD,MAAM,KAAK,2BAA2B,OAAO,WAAW,MAAM,QAAQ;AACtE,OAAI,KACF;QAAI,CAAC,MAAM,GAAG,YAAY,IAAI,GAC5B,OAAM,kBAAkB,KAAK;KAC3B,aAAa;KACb,aAAa,MAAM;KACnB,MAAM,IAAI;KACX,CAAC;cAEK,GACT,OAAM,sBAAsB,KAAK;IAC/B,aAAa;IACb,aAAa,MAAM;IACnB,MAAM,GAAG;IACV,CAAC;OAEF,OAAM,WAAW,KAAK;IACpB,aAAa;IACb,aAAa,MAAM;IACpB,CAAC;;;AAKR,QAAO,iBAAiB,QAAQ"}
+{"version":3,"file":"worker-route-C7kgtUXH.mjs","names":["list: Array<{ id: string; pattern: string; script: string }>","entry: WorkerRouteStateEntry","list: Array<{ id: string; pattern: string; script: string }>","key","entry: WorkerRouteStateEntry","drift: ResourceDrift","list: Array<{ id: string; pattern: string; script: string }>"],"sources":["../src/features/worker-route/worker-route.sync.ts","../src/features/worker-route/worker-route.prune.ts","../src/features/worker-route/worker-route.apply.ts","../src/features/worker-route/worker-route.destroy.ts","../src/features/worker-route/worker-route.drift.ts"],"sourcesContent":["import type { CfiConfig } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport { getWorkers } from \"../../core/config/loader.js\";\nimport { resolveWorkerConfig } from \"../../core/config/resolver.js\";\nimport { findZoneIdByName } from \"../../core/routes/zoneResolver.js\";\nimport { workerRouteStateKey } from \"./worker-route.stateKey.js\";\nimport type { WorkerRouteStateEntry } from \"../../types.js\";\n\n/**\n * Merge Workers zone routes for `tamerRoutes` (API-managed) into state from\n * Cloudflare listings. Drops stale `worker_route` rows for workers in this\n * config when the route no longer exists on CF.\n */\nexport async function workerRouteSync(\n  env: string,\n  config: CfiConfig,\n  baseDir: string,\n  accountId: string,\n  naming: NamingEngine,\n  state: StateManager,\n  api: CFApiClient,\n  opts: {\n    /**\n     * Pre-fetched sibling stack outputs so cross-stack route hosts/zones\n     * resolve to real patterns (else they stay as placeholders and never\n     * match anything CF returned). Optional — sync is tolerant mode.\n     */\n    imports?: Record<string, Record<string, string>>;\n  } = {},\n): Promise<void> {\n  if (env === \"local\") return;\n\n  const workers = await getWorkers(config, baseDir);\n  const workerKeys = new Set(workers.map(([k]) => k));\n  const touchedKeys = new Set<string>();\n  const ts = new Date().toISOString();\n\n  for (const [workerKey, wc] of workers) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      wc,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports: opts.imports },\n    );\n    for (const route of resolved.apiManagedRoutes) {\n      const zoneId = await findZoneIdByName(api, route.zone_name);\n      if (!zoneId) {\n        console.warn(\n          `[sync] worker routes: zone \"${route.zone_name}\" not found; skip ${route.pattern}`,\n        );\n        continue;\n      }\n      let list: Array<{ id: string; pattern: string; script: string }>;\n      try {\n        list = await api.zoneWorkerRoutesList(zoneId);\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        console.warn(\n          `[sync] worker routes: list failed for zone ${route.zone_name}: ${msg}`,\n        );\n        continue;\n      }\n      const hit = list.find(\n        (r) => r.pattern === route.pattern && r.script === resolved.workerName,\n      );\n      if (!hit) continue;\n\n      const key = workerRouteStateKey(zoneId, hit.id);\n      touchedKeys.add(key);\n      const existing = state.get(key);\n      const prev =\n        existing?.type === \"worker_route\" ? existing : undefined;\n      const entry: WorkerRouteStateEntry = {\n        type: \"worker_route\",\n        workerKey,\n        workerName: resolved.workerName,\n        zoneId,\n        zoneName: route.zone_name,\n        routeId: hit.id,\n        pattern: route.pattern,\n        createdAt: prev?.createdAt ?? ts,\n        updatedAt: ts,\n      };\n      state.set(key, entry);\n    }\n  }\n\n  /**\n   * Dropping stale `worker_route` state without calling Cloudflare's zone route\n   * delete API leaves orphaned public URL patterns on the script (common after\n   * removing `tamerRoutes`).\n   */\n  for (const [k, e] of Object.entries(state.getAll())) {\n    if (e.type !== \"worker_route\") continue;\n    if (!workerKeys.has(e.workerKey)) continue;\n    if (touchedKeys.has(k)) continue;\n    try {\n      await api.zoneWorkerRouteDelete(e.zoneId, e.routeId);\n      console.log(\n        `[sync] deleted stale Workers zone route ${e.pattern} → ${e.workerName} (${e.zoneName})`,\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] failed to delete stale zone route ${e.pattern}: ${msg}`);\n    }\n    state.delete(k);\n  }\n}\n","import type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { ResolvedWorkerConfig } from \"../../core/config/resolver.js\";\nimport { findZoneIdByName } from \"../../core/routes/zoneResolver.js\";\nimport { workerRouteStateKey } from \"./worker-route.stateKey.js\";\n\n/**\n * Remove Workers **zone routes** (`/zones/{id}/workers/routes`) that still point\n * at {@link ResolvedWorkerConfig.workerName} but are **not** in the resolved\n * desired set ({@link ResolvedWorkerConfig.apiManagedRoutes}), scoped to\n * {@link staleSweepZones}.\n *\n * Used on **`tamer deploy`** after removing `tamerRoutes` so orphaned patterns\n * are not left on the account. Wrangler **`routes`** / custom domains are a\n * separate surface — this only touches API-managed zone routes.\n *\n * When {@link staleSweepZones} is omitted or empty, this is a no-op (safe default).\n */\nexport async function pruneStaleApiManagedZoneRoutesForWorker(\n  api: CFApiClient,\n  state: StateManager,\n  resolved: ResolvedWorkerConfig,\n  staleSweepZones: string[] | undefined,\n): Promise<void> {\n  if (!staleSweepZones?.length) return;\n\n  const desired = new Set(\n    resolved.apiManagedRoutes.map((r) => `${r.zone_name}\\0${r.pattern}`),\n  );\n\n  for (const zoneName of staleSweepZones) {\n    const zoneId = await findZoneIdByName(api, zoneName);\n    if (!zoneId) {\n      console.warn(\n        `[deploy] stale route prune: zone \"${zoneName}\" not found; skip`,\n      );\n      continue;\n    }\n\n    let list: Array<{ id: string; pattern: string; script: string }>;\n    try {\n      list = await api.zoneWorkerRoutesList(zoneId);\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(\n        `[deploy] stale route prune: list failed for \"${zoneName}\": ${msg}`,\n      );\n      continue;\n    }\n\n    for (const r of list) {\n      if (r.script !== resolved.workerName) continue;\n      const sig = `${zoneName}\\0${r.pattern}`;\n      if (desired.has(sig)) continue;\n\n      try {\n        await api.zoneWorkerRouteDelete(zoneId, r.id);\n        console.log(\n          `[deploy] pruned stale zone route ${r.pattern} → ${resolved.workerName} (${zoneName})`,\n        );\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        console.warn(\n          `[deploy] stale route prune: failed to delete ${r.pattern}: ${msg}`,\n        );\n      }\n      state.delete(workerRouteStateKey(zoneId, r.id));\n    }\n  }\n}\n","import type { CfiConfig } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport { getWorkers } from \"../../core/config/loader.js\";\nimport {\n  mergedWorkerConfigForEnv,\n  resolveWorkerConfig,\n} from \"../../core/config/resolver.js\";\nimport { findZoneIdByName } from \"../../core/routes/zoneResolver.js\";\nimport { pruneStaleApiManagedZoneRoutesForWorker } from \"./worker-route.prune.js\";\nimport { workerRouteStateKey } from \"./worker-route.stateKey.js\";\nimport type { WorkerRouteStateEntry } from \"../../types.js\";\n\n/**\n * Ensure API-managed zone routes exist after the Worker script exists (call\n * after successful `wrangler deploy`).\n */\nexport async function workerRoutesApply(\n  env: string,\n  config: CfiConfig,\n  baseDir: string,\n  accountId: string,\n  naming: NamingEngine,\n  state: StateManager,\n  api: CFApiClient,\n  opts: {\n    /**\n     * Pre-fetched sibling stack outputs for `${tamer:import:…}` references\n     * in `tamerRoutes[].host` / `.zone`. Caller (`deploy`) is expected to\n     * load these once and reuse across worker iterations to avoid repeated\n     * D1 hydrate calls.\n     */\n    imports?: Record<string, Record<string, string>>;\n  } = {},\n): Promise<void> {\n  if (env === \"local\") return;\n\n  const workers = await getWorkers(config, baseDir);\n  const ts = new Date().toISOString();\n\n  for (const [workerKey, wc] of workers) {\n    const declared = mergedWorkerConfigForEnv(wc, env, config.tenant);\n    const staleSweepZones = declared.tamerStaleRouteSweepZones;\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      wc,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { imports: opts.imports },\n    );\n    await pruneStaleApiManagedZoneRoutesForWorker(\n      api,\n      state,\n      resolved,\n      staleSweepZones,\n    );\n    for (const route of resolved.apiManagedRoutes) {\n      const zoneId = await findZoneIdByName(api, route.zone_name);\n      if (!zoneId) {\n        throw new Error(\n          `worker routes: zone \"${route.zone_name}\" not found (check DNS / account access)`,\n        );\n      }\n      const list = await api.zoneWorkerRoutesList(zoneId);\n      const exists = list.find(\n        (r) => r.pattern === route.pattern && r.script === resolved.workerName,\n      );\n      if (exists) {\n        const key = workerRouteStateKey(zoneId, exists.id);\n        const existing = state.get(key);\n        const prev =\n          existing?.type === \"worker_route\" ? existing : undefined;\n        state.set(key, {\n          type: \"worker_route\",\n          workerKey,\n          workerName: resolved.workerName,\n          zoneId,\n          zoneName: route.zone_name,\n          routeId: exists.id,\n          pattern: route.pattern,\n          createdAt: prev?.createdAt ?? ts,\n          updatedAt: ts,\n        });\n        continue;\n      }\n\n      const created = await api.zoneWorkerRouteCreate(zoneId, {\n        pattern: route.pattern,\n        script: resolved.workerName,\n      });\n      const key = workerRouteStateKey(zoneId, created.id);\n      const entry: WorkerRouteStateEntry = {\n        type: \"worker_route\",\n        workerKey,\n        workerName: resolved.workerName,\n        zoneId,\n        zoneName: route.zone_name,\n        routeId: created.id,\n        pattern: route.pattern,\n        createdAt: ts,\n        updatedAt: ts,\n      };\n      state.set(key, entry);\n    }\n  }\n}\n","import type { CfiConfig } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport { getWorkers } from \"../../core/config/loader.js\";\n\n/**\n * Delete API-managed zone routes for workers declared in this stack's config\n * (before deleting Workers so routes are not left orphaned).\n */\nexport async function workerRoutesDestroy(\n  env: string,\n  config: CfiConfig,\n  baseDir: string,\n  state: StateManager,\n  api: CFApiClient,\n): Promise<void> {\n  if (env === \"local\") return;\n\n  const workers = await getWorkers(config, baseDir);\n  const allowed = new Set(workers.map(([k]) => k));\n\n  for (const [k, e] of Object.entries(state.getAll())) {\n    if (e.type !== \"worker_route\") continue;\n    if (!allowed.has(e.workerKey)) continue;\n    try {\n      await api.zoneWorkerRouteDelete(e.zoneId, e.routeId);\n      console.log(\n        `Deleted zone route ${e.pattern} (${e.routeId}) → ${e.workerName}`,\n      );\n    } catch (err) {\n      console.warn(\n        `Failed to delete zone route ${e.pattern}:`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n    state.delete(k);\n  }\n}\n","import type { CfiConfig } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport type { ResourceDrift } from \"../../core/drift/drift.types.js\";\nimport { getWorkers } from \"../../core/config/loader.js\";\nimport { resolveWorkerConfig } from \"../../core/config/resolver.js\";\nimport { findZoneIdByName } from \"../../core/routes/zoneResolver.js\";\nimport type { WorkerRouteStateEntry } from \"../../types.js\";\n\nfunction stateRouteForWorkerPattern(\n  state: StateManager,\n  workerKey: string,\n  pattern: string,\n): WorkerRouteStateEntry | undefined {\n  for (const e of Object.values(state.getAll())) {\n    if (\n      e.type === \"worker_route\" &&\n      e.workerKey === workerKey &&\n      e.pattern === pattern\n    ) {\n      return e;\n    }\n  }\n  return undefined;\n}\n\nexport async function workerRoutesDrift(\n  env: string,\n  config: CfiConfig,\n  baseDir: string,\n  accountId: string,\n  naming: NamingEngine,\n  state: StateManager,\n  api: CFApiClient,\n  opts: {\n    /** Pre-fetched sibling stack outputs; tolerant lookup. */\n    imports?: Record<string, Record<string, string>>;\n  } = {},\n): Promise<ResourceDrift | null> {\n  if (env === \"local\") return null;\n\n  const workers = await getWorkers(config, baseDir);\n  const drift: ResourceDrift = {\n    kind: \"worker_route\",\n    missingFromCloudflare: [],\n    unrecordedInState: [],\n    undeployed: [],\n  };\n  let sawAnyApiRoute = false;\n\n  for (const [workerKey, wc] of workers) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      wc,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports: opts.imports },\n    );\n    for (const route of resolved.apiManagedRoutes) {\n      sawAnyApiRoute = true;\n      const zoneId = await findZoneIdByName(api, route.zone_name);\n      if (!zoneId) {\n        drift.undeployed.push({\n          logicalName: workerKey,\n          derivedName: route.pattern,\n          detail: `zone \"${route.zone_name}\" not found`,\n        });\n        continue;\n      }\n      let list: Array<{ id: string; pattern: string; script: string }>;\n      try {\n        list = await api.zoneWorkerRoutesList(zoneId);\n      } catch {\n        continue;\n      }\n      const hit = list.find(\n        (r) => r.pattern === route.pattern && r.script === resolved.workerName,\n      );\n      const st = stateRouteForWorkerPattern(state, workerKey, route.pattern);\n      if (hit) {\n        if (!st || st.routeId !== hit.id) {\n          drift.unrecordedInState.push({\n            logicalName: workerKey,\n            derivedName: route.pattern,\n            cfId: hit.id,\n          });\n        }\n      } else if (st) {\n        drift.missingFromCloudflare.push({\n          logicalName: workerKey,\n          derivedName: route.pattern,\n          cfId: st.routeId,\n        });\n      } else {\n        drift.undeployed.push({\n          logicalName: workerKey,\n          derivedName: route.pattern,\n        });\n      }\n    }\n  }\n\n  return sawAnyApiRoute ? drift : null;\n}\n"],"mappings":";;;;;;;;;AAeA,eAAsB,gBACpB,KACA,QACA,SACA,WACA,QACA,OACA,KACA,OAOI,EAAE,EACS;AACf,KAAI,QAAQ,QAAS;CAErB,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CACjD,MAAM,aAAa,IAAI,IAAI,QAAQ,KAAK,CAAC,OAAO,EAAE,CAAC;CACnD,MAAM,8BAAc,IAAI,KAAa;CACrC,MAAM,sBAAK,IAAI,MAAM,EAAC,aAAa;AAEnC,MAAK,MAAM,CAAC,WAAW,OAAO,SAAS;EACrC,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,IACA,KACA,SACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY,SAAS,KAAK;GAAS,CACtD;AACD,OAAK,MAAM,SAAS,SAAS,kBAAkB;GAC7C,MAAM,SAAS,MAAM,iBAAiB,KAAK,MAAM,UAAU;AAC3D,OAAI,CAAC,QAAQ;AACX,YAAQ,KACN,+BAA+B,MAAM,UAAU,oBAAoB,MAAM,UAC1E;AACD;;GAEF,IAAIA;AACJ,OAAI;AACF,WAAO,MAAM,IAAI,qBAAqB,OAAO;YACtC,KAAK;IACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,YAAQ,KACN,8CAA8C,MAAM,UAAU,IAAI,MACnE;AACD;;GAEF,MAAM,MAAM,KAAK,MACd,MAAM,EAAE,YAAY,MAAM,WAAW,EAAE,WAAW,SAAS,WAC7D;AACD,OAAI,CAAC,IAAK;GAEV,MAAM,MAAM,oBAAoB,QAAQ,IAAI,GAAG;AAC/C,eAAY,IAAI,IAAI;GACpB,MAAM,WAAW,MAAM,IAAI,IAAI;GAC/B,MAAM,OACJ,UAAU,SAAS,iBAAiB,WAAW;GACjD,MAAMC,QAA+B;IACnC,MAAM;IACN;IACA,YAAY,SAAS;IACrB;IACA,UAAU,MAAM;IAChB,SAAS,IAAI;IACb,SAAS,MAAM;IACf,WAAW,MAAM,aAAa;IAC9B,WAAW;IACZ;AACD,SAAM,IAAI,KAAK,MAAM;;;;;;;;AASzB,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACnD,MAAI,EAAE,SAAS,eAAgB;AAC/B,MAAI,CAAC,WAAW,IAAI,EAAE,UAAU,CAAE;AAClC,MAAI,YAAY,IAAI,EAAE,CAAE;AACxB,MAAI;AACF,SAAM,IAAI,sBAAsB,EAAE,QAAQ,EAAE,QAAQ;AACpD,WAAQ,IACN,2CAA2C,EAAE,QAAQ,KAAK,EAAE,WAAW,IAAI,EAAE,SAAS,GACvF;WACM,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,4CAA4C,EAAE,QAAQ,IAAI,MAAM;;AAE/E,QAAM,OAAO,EAAE;;;;;;;;;;;;;;;;;;AC9FnB,eAAsB,wCACpB,KACA,OACA,UACA,iBACe;AACf,KAAI,CAAC,iBAAiB,OAAQ;CAE9B,MAAM,UAAU,IAAI,IAClB,SAAS,iBAAiB,KAAK,MAAM,GAAG,EAAE,UAAU,IAAI,EAAE,UAAU,CACrE;AAED,MAAK,MAAM,YAAY,iBAAiB;EACtC,MAAM,SAAS,MAAM,iBAAiB,KAAK,SAAS;AACpD,MAAI,CAAC,QAAQ;AACX,WAAQ,KACN,qCAAqC,SAAS,mBAC/C;AACD;;EAGF,IAAIC;AACJ,MAAI;AACF,UAAO,MAAM,IAAI,qBAAqB,OAAO;WACtC,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KACN,gDAAgD,SAAS,KAAK,MAC/D;AACD;;AAGF,OAAK,MAAM,KAAK,MAAM;AACpB,OAAI,EAAE,WAAW,SAAS,WAAY;GACtC,MAAM,MAAM,GAAG,SAAS,IAAI,EAAE;AAC9B,OAAI,QAAQ,IAAI,IAAI,CAAE;AAEtB,OAAI;AACF,UAAM,IAAI,sBAAsB,QAAQ,EAAE,GAAG;AAC7C,YAAQ,IACN,oCAAoC,EAAE,QAAQ,KAAK,SAAS,WAAW,IAAI,SAAS,GACrF;YACM,KAAK;IACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,YAAQ,KACN,gDAAgD,EAAE,QAAQ,IAAI,MAC/D;;AAEH,SAAM,OAAO,oBAAoB,QAAQ,EAAE,GAAG,CAAC;;;;;;;;;;;AChDrD,eAAsB,kBACpB,KACA,QACA,SACA,WACA,QACA,OACA,KACA,OAQI,EAAE,EACS;AACf,KAAI,QAAQ,QAAS;CAErB,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CACjD,MAAM,sBAAK,IAAI,MAAM,EAAC,aAAa;AAEnC,MAAK,MAAM,CAAC,WAAW,OAAO,SAAS;EAErC,MAAM,kBADW,yBAAyB,IAAI,KAAK,OAAO,OAAO,CAChC;EACjC,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,IACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,KAAK,SAAS,CAC1B;AACD,QAAM,wCACJ,KACA,OACA,UACA,gBACD;AACD,OAAK,MAAM,SAAS,SAAS,kBAAkB;GAC7C,MAAM,SAAS,MAAM,iBAAiB,KAAK,MAAM,UAAU;AAC3D,OAAI,CAAC,OACH,OAAM,IAAI,MACR,wBAAwB,MAAM,UAAU,0CACzC;GAGH,MAAM,UADO,MAAM,IAAI,qBAAqB,OAAO,EAC/B,MACjB,MAAM,EAAE,YAAY,MAAM,WAAW,EAAE,WAAW,SAAS,WAC7D;AACD,OAAI,QAAQ;IACV,MAAMC,QAAM,oBAAoB,QAAQ,OAAO,GAAG;IAClD,MAAM,WAAW,MAAM,IAAIA,MAAI;IAC/B,MAAM,OACJ,UAAU,SAAS,iBAAiB,WAAW;AACjD,UAAM,IAAIA,OAAK;KACb,MAAM;KACN;KACA,YAAY,SAAS;KACrB;KACA,UAAU,MAAM;KAChB,SAAS,OAAO;KAChB,SAAS,MAAM;KACf,WAAW,MAAM,aAAa;KAC9B,WAAW;KACZ,CAAC;AACF;;GAGF,MAAM,UAAU,MAAM,IAAI,sBAAsB,QAAQ;IACtD,SAAS,MAAM;IACf,QAAQ,SAAS;IAClB,CAAC;GACF,MAAM,MAAM,oBAAoB,QAAQ,QAAQ,GAAG;GACnD,MAAMC,QAA+B;IACnC,MAAM;IACN;IACA,YAAY,SAAS;IACrB;IACA,UAAU,MAAM;IAChB,SAAS,QAAQ;IACjB,SAAS,MAAM;IACf,WAAW;IACX,WAAW;IACZ;AACD,SAAM,IAAI,KAAK,MAAM;;;;;;;;;;;AClG3B,eAAsB,oBACpB,KACA,QACA,SACA,OACA,KACe;AACf,KAAI,QAAQ,QAAS;CAErB,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CACjD,MAAM,UAAU,IAAI,IAAI,QAAQ,KAAK,CAAC,OAAO,EAAE,CAAC;AAEhD,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACnD,MAAI,EAAE,SAAS,eAAgB;AAC/B,MAAI,CAAC,QAAQ,IAAI,EAAE,UAAU,CAAE;AAC/B,MAAI;AACF,SAAM,IAAI,sBAAsB,EAAE,QAAQ,EAAE,QAAQ;AACpD,WAAQ,IACN,sBAAsB,EAAE,QAAQ,IAAI,EAAE,QAAQ,MAAM,EAAE,aACvD;WACM,KAAK;AACZ,WAAQ,KACN,+BAA+B,EAAE,QAAQ,IACzC,eAAe,QAAQ,IAAI,UAAU,IACtC;;AAEH,QAAM,OAAO,EAAE;;;;;;ACzBnB,SAAS,2BACP,OACA,WACA,SACmC;AACnC,MAAK,MAAM,KAAK,OAAO,OAAO,MAAM,QAAQ,CAAC,CAC3C,KACE,EAAE,SAAS,kBACX,EAAE,cAAc,aAChB,EAAE,YAAY,QAEd,QAAO;;AAMb,eAAsB,kBACpB,KACA,QACA,SACA,WACA,QACA,OACA,KACA,OAGI,EAAE,EACyB;AAC/B,KAAI,QAAQ,QAAS,QAAO;CAE5B,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CACjD,MAAMC,QAAuB;EAC3B,MAAM;EACN,uBAAuB,EAAE;EACzB,mBAAmB,EAAE;EACrB,YAAY,EAAE;EACf;CACD,IAAI,iBAAiB;AAErB,MAAK,MAAM,CAAC,WAAW,OAAO,SAAS;EACrC,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,IACA,KACA,SACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY,SAAS,KAAK;GAAS,CACtD;AACD,OAAK,MAAM,SAAS,SAAS,kBAAkB;AAC7C,oBAAiB;GACjB,MAAM,SAAS,MAAM,iBAAiB,KAAK,MAAM,UAAU;AAC3D,OAAI,CAAC,QAAQ;AACX,UAAM,WAAW,KAAK;KACpB,aAAa;KACb,aAAa,MAAM;KACnB,QAAQ,SAAS,MAAM,UAAU;KAClC,CAAC;AACF;;GAEF,IAAIC;AACJ,OAAI;AACF,WAAO,MAAM,IAAI,qBAAqB,OAAO;WACvC;AACN;;GAEF,MAAM,MAAM,KAAK,MACd,MAAM,EAAE,YAAY,MAAM,WAAW,EAAE,WAAW,SAAS,WAC7D;GACD,MAAM,KAAK,2BAA2B,OAAO,WAAW,MAAM,QAAQ;AACtE,OAAI,KACF;QAAI,CAAC,MAAM,GAAG,YAAY,IAAI,GAC5B,OAAM,kBAAkB,KAAK;KAC3B,aAAa;KACb,aAAa,MAAM;KACnB,MAAM,IAAI;KACX,CAAC;cAEK,GACT,OAAM,sBAAsB,KAAK;IAC/B,aAAa;IACb,aAAa,MAAM;IACnB,MAAM,GAAG;IACV,CAAC;OAEF,OAAM,WAAW,KAAK;IACpB,aAAa;IACb,aAAa,MAAM;IACpB,CAAC;;;AAKR,QAAO,iBAAiB,QAAQ"}

package/dist/{workers-CS0tlbdk.mjs → workers-Bq1AY8aB.mjs}

@@ -1,4 +1,4 @@
-import { O as resolveWorkerConfig, u as namingFromConfig, z as getWorkers } from "./tamer.mjs";
+import { B as getWorkers, O as resolveWorkerConfig, u as namingFromConfig } from "./tamer.mjs";
 import { n as spawnWranglerSync } from "./wranglerSpawn-CqVNGkA9.mjs";
 
 //#region src/features/workers/workers.destroy.ts
@@ -83,4 +83,4 @@ async function workersDrift(env, config, baseDir, accountId, naming, state, api,
 
 //#endregion
 export { workersDestroy as n, workersDrift as t };
-//# sourceMappingURL=workers-CS0tlbdk.mjs.map
+//# sourceMappingURL=workers-Bq1AY8aB.mjs.map

package/dist/{workers-CS0tlbdk.mjs.map → workers-Bq1AY8aB.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"workers-CS0tlbdk.mjs","names":["resolved: Awaited<ReturnType<typeof resolveWorkerConfig>>[]","drift: ResourceDrift","exists: boolean"],"sources":["../src/features/workers/workers.destroy.ts","../src/features/workers/workers.drift.ts"],"sourcesContent":["import type { CfiConfig } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport { getWorkers } from \"../../core/config/loader.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { resolveWorkerConfig } from \"../../core/config/resolver.js\";\nimport { spawnWranglerSync } from \"../../core/wrangler/wranglerSpawn.js\";\n\n/**\n * Remove deployed Workers: dispatch-namespace scripts via CF API, then global scripts via `wrangler delete`.\n * Call before deleting D1/R2/KV/dispatch namespaces so bindings and namespace script counts are cleared.\n */\nexport async function workersDestroy(\n  env: string,\n  baseDir: string,\n  accountId: string,\n  config: CfiConfig,\n  state: StateManager,\n  api: CFApiClient,\n  _force?: boolean,\n): Promise<void> {\n  const naming = namingFromConfig(config);\n  const workers = await getWorkers(config, baseDir);\n  const resolved: Awaited<ReturnType<typeof resolveWorkerConfig>>[] = [];\n\n  for (const [workerKey, workerConfig] of workers) {\n    // Tolerant resolution: destroy only consumes `workerName` and\n    // `dispatchNamespace` — both derived from naming, not references —\n    // so unresolved `${tamer:import:…}` placeholders in `vars` /\n    // `tamerRoutes` must not crash teardown of a stack whose siblings\n    // have already been destroyed.\n    resolved.push(\n      await resolveWorkerConfig(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        { referencesMode: \"tolerant\" },\n      ),\n    );\n  }\n\n  const inNamespace = resolved.filter((r) => r.dispatchNamespace);\n  const globalWorkers = resolved.filter((r) => !r.dispatchNamespace);\n\n  for (const r of inNamespace) {\n    const ns = r.dispatchNamespace!;\n    try {\n      await api.dispatchNamespaceScriptDelete(ns, r.workerName, {\n        force: true,\n      });\n      console.log(`Deleted Worker \"${r.workerName}\" from dispatch namespace \"${ns}\"`);\n    } catch (err) {\n      console.warn(\n        `Failed to delete dispatch Worker \"${r.workerName}\" in \"${ns}\":`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n  }\n\n  for (const r of globalWorkers) {\n    // Do not pass `--config` here: per-worker `wrangler.*.json` files are often\n    // absent (gitignored / only emitted by apply/deploy). `wrangler delete` only\n    // needs the script name plus account credentials from the environment.\n    // Using `cwd: baseDir` keeps `.env` loading consistent with other commands\n    // (stack root). Passing `--config` with a missing file also breaks on\n    // Windows (malformed path: cwd + absolute config).\n    const args = [\"wrangler\", \"delete\", r.workerName, \"--force\"];\n    const result = spawnWranglerSync(args, {\n      cwd: baseDir,\n      stdio: \"inherit\",\n      shell: false,\n    });\n    if (result.status !== 0) {\n      console.warn(\n        `wrangler delete failed for \"${r.workerName}\" (cwd: ${baseDir}); script may not exist.`,\n      );\n    } else {\n      console.log(`Deleted Worker \"${r.workerName}\"`);\n    }\n  }\n}\n","import type { CfiConfig } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport type { ResourceDrift } from \"../../core/drift/drift.types.js\";\nimport { getWorkers } from \"../../core/config/loader.js\";\nimport { resolveWorkerConfig } from \"../../core/config/resolver.js\";\n\n/**\n * Drift for declared **global** Worker scripts (not dispatch-namespace\n * tenant scripts — those are owned by `provision-tenant` / WFP).\n *\n * Tamer does not store deployed worker script ids in state today, so this\n * report only emits `undeployed` (declared but missing on Cloudflare). It\n * never claims `unrecordedInState` for scripts because the state model has\n * no `worker_script` entry to be missing.\n *\n * Returns `null` for `local` env or when there are no global workers (so\n * `computeDriftReport` can skip emitting the section entirely).\n */\nexport async function workersDrift(\n  env: string,\n  config: CfiConfig,\n  baseDir: string,\n  accountId: string,\n  naming: NamingEngine,\n  state: StateManager,\n  api: CFApiClient,\n  opts: {\n    /** Pre-fetched sibling stack outputs; tolerant lookup. */\n    imports?: Record<string, Record<string, string>>;\n  } = {},\n): Promise<ResourceDrift | null> {\n  if (env === \"local\") return null;\n\n  const workers = await getWorkers(config, baseDir);\n  if (workers.length === 0) return null;\n\n  const drift: ResourceDrift = {\n    kind: \"worker_script\",\n    missingFromCloudflare: [],\n    unrecordedInState: [],\n    undeployed: [],\n  };\n\n  let sawGlobalWorker = false;\n  for (const [workerKey, wc] of workers) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      wc,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports: opts.imports },\n    );\n    if (resolved.dispatchNamespace) continue;\n    sawGlobalWorker = true;\n\n    let exists: boolean;\n    try {\n      const script = await api.workersScriptGet(resolved.workerName);\n      exists = !!script;\n    } catch {\n      continue;\n    }\n    if (!exists) {\n      drift.undeployed.push({\n        logicalName: workerKey,\n        derivedName: resolved.workerName,\n      });\n    }\n  }\n\n  return sawGlobalWorker ? drift : null;\n}\n"],"mappings":";;;;;;;;AAYA,eAAsB,eACpB,KACA,SACA,WACA,QACA,OACA,KACA,QACe;CACf,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CACjD,MAAMA,WAA8D,EAAE;AAEtE,MAAK,MAAM,CAAC,WAAW,iBAAiB,QAMtC,UAAS,KACP,MAAM,oBACJ,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,gBAAgB,YAAY,CAC/B,CACF;CAGH,MAAM,cAAc,SAAS,QAAQ,MAAM,EAAE,kBAAkB;CAC/D,MAAM,gBAAgB,SAAS,QAAQ,MAAM,CAAC,EAAE,kBAAkB;AAElE,MAAK,MAAM,KAAK,aAAa;EAC3B,MAAM,KAAK,EAAE;AACb,MAAI;AACF,SAAM,IAAI,8BAA8B,IAAI,EAAE,YAAY,EACxD,OAAO,MACR,CAAC;AACF,WAAQ,IAAI,mBAAmB,EAAE,WAAW,6BAA6B,GAAG,GAAG;WACxE,KAAK;AACZ,WAAQ,KACN,qCAAqC,EAAE,WAAW,QAAQ,GAAG,KAC7D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;AAIL,MAAK,MAAM,KAAK,cAad,KALe,kBADF;EAAC;EAAY;EAAU,EAAE;EAAY;EAAU,EACrB;EACrC,KAAK;EACL,OAAO;EACP,OAAO;EACR,CAAC,CACS,WAAW,EACpB,SAAQ,KACN,+BAA+B,EAAE,WAAW,UAAU,QAAQ,0BAC/D;KAED,SAAQ,IAAI,mBAAmB,EAAE,WAAW,GAAG;;;;;;;;;;;;;;;;;AC9DrD,eAAsB,aACpB,KACA,QACA,SACA,WACA,QACA,OACA,KACA,OAGI,EAAE,EACyB;AAC/B,KAAI,QAAQ,QAAS,QAAO;CAE5B,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,KAAI,QAAQ,WAAW,EAAG,QAAO;CAEjC,MAAMC,QAAuB;EAC3B,MAAM;EACN,uBAAuB,EAAE;EACzB,mBAAmB,EAAE;EACrB,YAAY,EAAE;EACf;CAED,IAAI,kBAAkB;AACtB,MAAK,MAAM,CAAC,WAAW,OAAO,SAAS;EACrC,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,IACA,KACA,SACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY,SAAS,KAAK;GAAS,CACtD;AACD,MAAI,SAAS,kBAAmB;AAChC,oBAAkB;EAElB,IAAIC;AACJ,MAAI;AAEF,YAAS,CAAC,CADK,MAAM,IAAI,iBAAiB,SAAS,WAAW;UAExD;AACN;;AAEF,MAAI,CAAC,OACH,OAAM,WAAW,KAAK;GACpB,aAAa;GACb,aAAa,SAAS;GACvB,CAAC;;AAIN,QAAO,kBAAkB,QAAQ"}
+{"version":3,"file":"workers-Bq1AY8aB.mjs","names":["resolved: Awaited<ReturnType<typeof resolveWorkerConfig>>[]","drift: ResourceDrift","exists: boolean"],"sources":["../src/features/workers/workers.destroy.ts","../src/features/workers/workers.drift.ts"],"sourcesContent":["import type { CfiConfig } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport { getWorkers } from \"../../core/config/loader.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { resolveWorkerConfig } from \"../../core/config/resolver.js\";\nimport { spawnWranglerSync } from \"../../core/wrangler/wranglerSpawn.js\";\n\n/**\n * Remove deployed Workers: dispatch-namespace scripts via CF API, then global scripts via `wrangler delete`.\n * Call before deleting D1/R2/KV/dispatch namespaces so bindings and namespace script counts are cleared.\n */\nexport async function workersDestroy(\n  env: string,\n  baseDir: string,\n  accountId: string,\n  config: CfiConfig,\n  state: StateManager,\n  api: CFApiClient,\n  _force?: boolean,\n): Promise<void> {\n  const naming = namingFromConfig(config);\n  const workers = await getWorkers(config, baseDir);\n  const resolved: Awaited<ReturnType<typeof resolveWorkerConfig>>[] = [];\n\n  for (const [workerKey, workerConfig] of workers) {\n    // Tolerant resolution: destroy only consumes `workerName` and\n    // `dispatchNamespace` — both derived from naming, not references —\n    // so unresolved `${tamer:import:…}` placeholders in `vars` /\n    // `tamerRoutes` must not crash teardown of a stack whose siblings\n    // have already been destroyed.\n    resolved.push(\n      await resolveWorkerConfig(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        { referencesMode: \"tolerant\" },\n      ),\n    );\n  }\n\n  const inNamespace = resolved.filter((r) => r.dispatchNamespace);\n  const globalWorkers = resolved.filter((r) => !r.dispatchNamespace);\n\n  for (const r of inNamespace) {\n    const ns = r.dispatchNamespace!;\n    try {\n      await api.dispatchNamespaceScriptDelete(ns, r.workerName, {\n        force: true,\n      });\n      console.log(`Deleted Worker \"${r.workerName}\" from dispatch namespace \"${ns}\"`);\n    } catch (err) {\n      console.warn(\n        `Failed to delete dispatch Worker \"${r.workerName}\" in \"${ns}\":`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n  }\n\n  for (const r of globalWorkers) {\n    // Do not pass `--config` here: per-worker `wrangler.*.json` files are often\n    // absent (gitignored / only emitted by apply/deploy). `wrangler delete` only\n    // needs the script name plus account credentials from the environment.\n    // Using `cwd: baseDir` keeps `.env` loading consistent with other commands\n    // (stack root). Passing `--config` with a missing file also breaks on\n    // Windows (malformed path: cwd + absolute config).\n    const args = [\"wrangler\", \"delete\", r.workerName, \"--force\"];\n    const result = spawnWranglerSync(args, {\n      cwd: baseDir,\n      stdio: \"inherit\",\n      shell: false,\n    });\n    if (result.status !== 0) {\n      console.warn(\n        `wrangler delete failed for \"${r.workerName}\" (cwd: ${baseDir}); script may not exist.`,\n      );\n    } else {\n      console.log(`Deleted Worker \"${r.workerName}\"`);\n    }\n  }\n}\n","import type { CfiConfig } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport type { ResourceDrift } from \"../../core/drift/drift.types.js\";\nimport { getWorkers } from \"../../core/config/loader.js\";\nimport { resolveWorkerConfig } from \"../../core/config/resolver.js\";\n\n/**\n * Drift for declared **global** Worker scripts (not dispatch-namespace\n * tenant scripts — those are owned by `provision-tenant` / WFP).\n *\n * Tamer does not store deployed worker script ids in state today, so this\n * report only emits `undeployed` (declared but missing on Cloudflare). It\n * never claims `unrecordedInState` for scripts because the state model has\n * no `worker_script` entry to be missing.\n *\n * Returns `null` for `local` env or when there are no global workers (so\n * `computeDriftReport` can skip emitting the section entirely).\n */\nexport async function workersDrift(\n  env: string,\n  config: CfiConfig,\n  baseDir: string,\n  accountId: string,\n  naming: NamingEngine,\n  state: StateManager,\n  api: CFApiClient,\n  opts: {\n    /** Pre-fetched sibling stack outputs; tolerant lookup. */\n    imports?: Record<string, Record<string, string>>;\n  } = {},\n): Promise<ResourceDrift | null> {\n  if (env === \"local\") return null;\n\n  const workers = await getWorkers(config, baseDir);\n  if (workers.length === 0) return null;\n\n  const drift: ResourceDrift = {\n    kind: \"worker_script\",\n    missingFromCloudflare: [],\n    unrecordedInState: [],\n    undeployed: [],\n  };\n\n  let sawGlobalWorker = false;\n  for (const [workerKey, wc] of workers) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      wc,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports: opts.imports },\n    );\n    if (resolved.dispatchNamespace) continue;\n    sawGlobalWorker = true;\n\n    let exists: boolean;\n    try {\n      const script = await api.workersScriptGet(resolved.workerName);\n      exists = !!script;\n    } catch {\n      continue;\n    }\n    if (!exists) {\n      drift.undeployed.push({\n        logicalName: workerKey,\n        derivedName: resolved.workerName,\n      });\n    }\n  }\n\n  return sawGlobalWorker ? drift : null;\n}\n"],"mappings":";;;;;;;;AAYA,eAAsB,eACpB,KACA,SACA,WACA,QACA,OACA,KACA,QACe;CACf,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CACjD,MAAMA,WAA8D,EAAE;AAEtE,MAAK,MAAM,CAAC,WAAW,iBAAiB,QAMtC,UAAS,KACP,MAAM,oBACJ,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,gBAAgB,YAAY,CAC/B,CACF;CAGH,MAAM,cAAc,SAAS,QAAQ,MAAM,EAAE,kBAAkB;CAC/D,MAAM,gBAAgB,SAAS,QAAQ,MAAM,CAAC,EAAE,kBAAkB;AAElE,MAAK,MAAM,KAAK,aAAa;EAC3B,MAAM,KAAK,EAAE;AACb,MAAI;AACF,SAAM,IAAI,8BAA8B,IAAI,EAAE,YAAY,EACxD,OAAO,MACR,CAAC;AACF,WAAQ,IAAI,mBAAmB,EAAE,WAAW,6BAA6B,GAAG,GAAG;WACxE,KAAK;AACZ,WAAQ,KACN,qCAAqC,EAAE,WAAW,QAAQ,GAAG,KAC7D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;AAIL,MAAK,MAAM,KAAK,cAad,KALe,kBADF;EAAC;EAAY;EAAU,EAAE;EAAY;EAAU,EACrB;EACrC,KAAK;EACL,OAAO;EACP,OAAO;EACR,CAAC,CACS,WAAW,EACpB,SAAQ,KACN,+BAA+B,EAAE,WAAW,UAAU,QAAQ,0BAC/D;KAED,SAAQ,IAAI,mBAAmB,EAAE,WAAW,GAAG;;;;;;;;;;;;;;;;;AC9DrD,eAAsB,aACpB,KACA,QACA,SACA,WACA,QACA,OACA,KACA,OAGI,EAAE,EACyB;AAC/B,KAAI,QAAQ,QAAS,QAAO;CAE5B,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,KAAI,QAAQ,WAAW,EAAG,QAAO;CAEjC,MAAMC,QAAuB;EAC3B,MAAM;EACN,uBAAuB,EAAE;EACzB,mBAAmB,EAAE;EACrB,YAAY,EAAE;EACf;CAED,IAAI,kBAAkB;AACtB,MAAK,MAAM,CAAC,WAAW,OAAO,SAAS;EACrC,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,IACA,KACA,SACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY,SAAS,KAAK;GAAS,CACtD;AACD,MAAI,SAAS,kBAAmB;AAChC,oBAAkB;EAElB,IAAIC;AACJ,MAAI;AAEF,YAAS,CAAC,CADK,MAAM,IAAI,iBAAiB,SAAS,WAAW;UAExD;AACN;;AAEF,MAAI,CAAC,OACH,OAAM,WAAW,KAAK;GACpB,aAAa;GACb,aAAa,SAAS;GACvB,CAAC;;AAIN,QAAO,kBAAkB,QAAQ"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dragonmastery/tamer",
-  "version": "0.35.3",
+  "version": "0.36.0",
   "description": "Tamer: Cloudflare Workers infra CLI (sync, apply, deploy, migrate, destroy) and Wrangler-oriented TypeScript types.",
   "author": "DragonMastery",
   "license": "SEE LICENSE IN LICENSE",

package/dist/apply-Cz1lxAOp.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"apply-Cz1lxAOp.mjs","names":["out: Array<{ config: DispatchNamespaceResourceConfig; name: string }>","adoptedEntry: DnsRecordStateEntry","patch: Partial<{\n    content: string;\n    ttl: number;\n    proxied: boolean;\n    priority: number;\n    comment: string;\n  }>","entry: DnsRecordStateEntry","target: ApplyTarget | undefined","opDetail: string[]"],"sources":["../src/features/dispatch-namespace/dispatch-namespace.apply.ts","../src/features/dns-records/dns-records.apply.ts","../src/cli/commands/apply.ts"],"sourcesContent":["import type { TenantMeta, DispatchNamespaceResourceConfig } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { effectiveDispatchNamespaceName } from \"./dispatch-namespace.resolve.js\";\n\nfunction uniqueResolvedNamespaces(\n  configs: DispatchNamespaceResourceConfig[],\n  env: string,\n  tenant: TenantMeta,\n): Array<{ config: DispatchNamespaceResourceConfig; name: string }> {\n  const seen = new Set<string>();\n  const out: Array<{ config: DispatchNamespaceResourceConfig; name: string }> =\n    [];\n  for (const c of configs) {\n    const name = effectiveDispatchNamespaceName(c, env, tenant);\n    if (seen.has(name)) continue;\n    seen.add(name);\n    out.push({ config: c, name });\n  }\n  return out;\n}\n\nexport async function dispatchNamespaceApply(\n  resources: DispatchNamespaceResourceConfig[],\n  tenant: TenantMeta,\n  env: string,\n  api: CFApiClient,\n  state: StateManager,\n): Promise<void> {\n  if (resources.length === 0) return;\n  if (env === \"local\") return;\n\n  const unique = uniqueResolvedNamespaces(resources, env, tenant);\n  const needsCreateLookup = unique.some(\n    ({ name }) => !state.get(`dispatch_ns:${name}`),\n  );\n\n  // CF is the source of truth: avoid POSTing for namespaces that already exist\n  // (state may be empty in CI / first-time apply). Cloudflare's create error\n  // for duplicates conflates with \"invalid name\", so a pre-check is clearer.\n  const existingNames = needsCreateLookup\n    ? new Set((await api.dispatchNamespaceListAll()).map((n) => n.namespace_name))\n    : new Set<string>();\n\n  for (const { config, name } of unique) {\n    const key = `dispatch_ns:${name}`;\n    if (state.get(key)) continue;\n\n    if (!existingNames.has(name)) {\n      await api.dispatchNamespaceCreate(name);\n    }\n\n    state.set(key, {\n      type: \"dispatch_namespace\",\n      logicalName: config.logicalName,\n      derivedName: name,\n      createdAt: new Date().toISOString(),\n      updatedAt: new Date().toISOString(),\n    });\n  }\n}\n","import type {\n  DnsRecordResourceConfig,\n  DnsRecordStateEntry,\n  TenantMeta,\n} from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport {\n  dnsRecordAppliesToEnv,\n  dnsRecordCommentMarker,\n  dnsRecordStateKey,\n  effectiveDnsRecordComment,\n  effectiveDnsRecordProxied,\n  effectiveDnsRecordTtl,\n} from \"./dns-records.resolve.js\";\nimport { computeDnsRecordMutableChanges } from \"./dns-records.diff.js\";\nimport { logApplyChange } from \"../../core/plan/planFormat.js\";\n\n/**\n * Reconcile every declared DNS record for `env` with Cloudflare. For each\n * config entry:\n *\n * 1. **Skip** if `env` is excluded (always: `local`; or via `skipEnvs`).\n * 2. **Resume after state loss** by scanning `/zones/{id}/dns_records` for\n *    any record carrying Tamer's attribution marker comment (`tamer:\n *    <tenant>:<env>:<logical>`) on the matching `(type, name)` tuple, and\n *    re-adopting it into state.\n * 3. **Create** when nothing matches in state or on the zone.\n * 4. **Patch** mutable fields (`content`, `ttl`, `proxied`, `priority`,\n *    `comment`) when state knows about the record but its fields drifted.\n * 5. **Replace** (delete + create) when the record `type` itself changed —\n *    Cloudflare rejects type changes via PATCH per the API docs.\n */\nexport async function dnsRecordApply(\n  resources: DnsRecordResourceConfig[],\n  tenant: TenantMeta,\n  env: string,\n  api: CFApiClient,\n  state: StateManager,\n): Promise<void> {\n  if (resources.length === 0) return;\n  const applicable = resources.filter((r) => dnsRecordAppliesToEnv(r, env));\n  if (applicable.length === 0) return;\n\n  const zoneCache = new Map<\n    string,\n    Awaited<ReturnType<CFApiClient[\"zoneDnsRecordListAll\"]>>\n  >();\n  const loadZone = async (\n    zoneId: string,\n  ): Promise<\n    Awaited<ReturnType<CFApiClient[\"zoneDnsRecordListAll\"]>>\n  > => {\n    let cached = zoneCache.get(zoneId);\n    if (cached) return cached;\n    cached = await api.zoneDnsRecordListAll(zoneId);\n    zoneCache.set(zoneId, cached);\n    return cached;\n  };\n\n  for (const config of applicable) {\n    const stateKey = dnsRecordStateKey(config.zoneId, config.type, config.name);\n    const expected = expectedFromConfig(config, tenant, env);\n    const existingEntry = state.get(stateKey);\n\n    const stateEntry =\n      existingEntry?.type === \"dns_record\"\n        ? (existingEntry as DnsRecordStateEntry)\n        : undefined;\n\n    if (stateEntry) {\n      if (recordTypeChanged(stateEntry, config)) {\n        logApplyChange({\n          kind: \"dns_record\",\n          action: \"replace\",\n          logical: config.logicalName,\n          derived: `${config.type} ${config.name}`,\n          changes: [\n            {\n              field: \"type\",\n              from: stateEntry.recordType,\n              to: config.type,\n              kind: \"immutable\",\n            },\n          ],\n        });\n        await api.zoneDnsRecordDelete(config.zoneId, stateEntry.recordId);\n        const created = await api.zoneDnsRecordCreate(config.zoneId, {\n          type: config.type,\n          name: config.name,\n          content: expected.content,\n          ttl: expected.ttl,\n          proxied: expected.proxied,\n          priority: expected.priority,\n          comment: expected.comment,\n        });\n        persistCreated(state, stateKey, config, expected, created.id);\n        continue;\n      }\n      const patch = computePatch(stateEntry, expected);\n      if (patch) {\n        const changes = computeDnsRecordMutableChanges(\n          stateEntry,\n          config,\n          tenant,\n          env,\n        );\n        logApplyChange({\n          kind: \"dns_record\",\n          action: \"update\",\n          logical: config.logicalName,\n          derived: `${config.type} ${config.name}`,\n          changes,\n        });\n        await api.zoneDnsRecordPatch(config.zoneId, stateEntry.recordId, patch);\n        persistUpdated(state, stateKey, stateEntry, expected);\n      }\n      continue;\n    }\n\n    const live = await loadZone(config.zoneId);\n    const marker = dnsRecordCommentMarker(tenant, env, config.logicalName);\n    const adopted = live.find(\n      (r) =>\n        r.type === config.type &&\n        normalizeName(r.name, config.name) &&\n        typeof r.comment === \"string\" &&\n        r.comment.startsWith(marker),\n    );\n    if (adopted) {\n      const adoptedEntry: DnsRecordStateEntry = {\n        type: \"dns_record\",\n        logicalName: config.logicalName,\n        zoneId: config.zoneId,\n        recordType: config.type,\n        name: adopted.name,\n        content: adopted.content,\n        ttl: adopted.ttl ?? expected.ttl,\n        proxied: adopted.proxied ?? false,\n        priority: adopted.priority,\n        comment: adopted.comment ?? marker,\n        recordId: adopted.id,\n        createdAt: new Date().toISOString(),\n        updatedAt: new Date().toISOString(),\n      };\n      state.set(stateKey, adoptedEntry);\n      const patch = computePatch(adoptedEntry, expected);\n      if (patch) {\n        const changes = computeDnsRecordMutableChanges(\n          adoptedEntry,\n          config,\n          tenant,\n          env,\n        );\n        logApplyChange({\n          kind: \"dns_record\",\n          action: \"update\",\n          logical: config.logicalName,\n          derived: `${config.type} ${config.name}`,\n          changes,\n        });\n        await api.zoneDnsRecordPatch(config.zoneId, adopted.id, patch);\n        persistUpdated(state, stateKey, adoptedEntry, expected);\n      }\n      continue;\n    }\n\n    logApplyChange({\n      kind: \"dns_record\",\n      action: \"create\",\n      logical: config.logicalName,\n      derived: `${config.type} ${config.name}`,\n    });\n    const created = await api.zoneDnsRecordCreate(config.zoneId, {\n      type: config.type,\n      name: config.name,\n      content: expected.content,\n      ttl: expected.ttl,\n      proxied: expected.proxied,\n      priority: expected.priority,\n      comment: expected.comment,\n    });\n    persistCreated(state, stateKey, config, expected, created.id);\n  }\n}\n\ninterface ExpectedFields {\n  content: string;\n  ttl: number;\n  proxied: boolean;\n  priority?: number;\n  comment: string;\n}\n\nfunction expectedFromConfig(\n  config: DnsRecordResourceConfig,\n  tenant: TenantMeta,\n  env: string,\n): ExpectedFields {\n  return {\n    content: config.content,\n    ttl: effectiveDnsRecordTtl(config),\n    proxied: effectiveDnsRecordProxied(config),\n    priority: config.priority,\n    comment: effectiveDnsRecordComment(config, tenant, env),\n  };\n}\n\nfunction recordTypeChanged(\n  state: DnsRecordStateEntry,\n  config: DnsRecordResourceConfig,\n): boolean {\n  return state.recordType !== config.type;\n}\n\nfunction computePatch(\n  state: DnsRecordStateEntry,\n  expected: ExpectedFields,\n): Partial<{\n  content: string;\n  ttl: number;\n  proxied: boolean;\n  priority: number;\n  comment: string;\n}> | undefined {\n  const patch: Partial<{\n    content: string;\n    ttl: number;\n    proxied: boolean;\n    priority: number;\n    comment: string;\n  }> = {};\n  if (state.content !== expected.content) patch.content = expected.content;\n  if (state.ttl !== expected.ttl) patch.ttl = expected.ttl;\n  if (state.proxied !== expected.proxied) patch.proxied = expected.proxied;\n  if (\n    expected.priority !== undefined &&\n    state.priority !== expected.priority\n  ) {\n    patch.priority = expected.priority;\n  }\n  if (state.comment !== expected.comment) patch.comment = expected.comment;\n  return Object.keys(patch).length > 0 ? patch : undefined;\n}\n\nfunction persistCreated(\n  state: StateManager,\n  key: string,\n  config: DnsRecordResourceConfig,\n  expected: ExpectedFields,\n  recordId: string,\n): void {\n  const ts = new Date().toISOString();\n  const entry: DnsRecordStateEntry = {\n    type: \"dns_record\",\n    logicalName: config.logicalName,\n    zoneId: config.zoneId,\n    recordType: config.type,\n    name: config.name,\n    content: expected.content,\n    ttl: expected.ttl,\n    proxied: expected.proxied,\n    priority: expected.priority,\n    comment: expected.comment,\n    recordId,\n    createdAt: ts,\n    updatedAt: ts,\n  };\n  state.set(key, entry);\n}\n\nfunction persistUpdated(\n  state: StateManager,\n  key: string,\n  prior: DnsRecordStateEntry,\n  expected: ExpectedFields,\n): void {\n  const entry: DnsRecordStateEntry = {\n    ...prior,\n    content: expected.content,\n    ttl: expected.ttl,\n    proxied: expected.proxied,\n    priority: expected.priority,\n    comment: expected.comment,\n    updatedAt: new Date().toISOString(),\n  };\n  state.set(key, entry);\n}\n\n/**\n * Cloudflare normalizes DNS names to FQDN ('app.example.com'). The user\n * may declare them either as an apex (`@`) or as a partial — match by\n * exact equality when both look fully-qualified, otherwise by suffix.\n */\nfunction normalizeName(cfName: string, configName: string): boolean {\n  if (cfName === configName) return true;\n  if (configName === \"@\") return true;\n  return cfName.endsWith(`.${configName}`) || cfName.endsWith(configName);\n}\n","import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport {\n  resolveWorkerConfig,\n  resolveDeployedWorkerName,\n  mergeWorkerConfigForResourcePick,\n} from \"../../core/config/resolver.js\";\nimport {\n  generateWranglerConfig,\n  writeWranglerJson,\n} from \"../../core/wrangler/generator.js\";\nimport type { WranglerConfig } from \"../../generated/wrangler-types.js\";\nimport { emitShardRegistryOnApply } from \"../../core/codegen/shardRegistry/index.js\";\nimport { dispatchNamespaceApply } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordApply } from \"../../features/dns-records/index.js\";\nimport {\n  getDispatchNamespaces,\n  getDnsRecords,\n  getLogpushJobs,\n} from \"../../types.js\";\nimport { logpushJobApply } from \"../../features/logpush-job/index.js\";\nimport { resolveStackOutputs } from \"../../core/outputs/stackOutputs.js\";\nimport {\n  fetchStackImports,\n  importedStackNames,\n} from \"../../core/imports/fetchStackImports.js\";\nimport { runSync } from \"./sync.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport { hashCloudflareSnapshot } from \"../../core/plan/planFile.js\";\nimport { buildCloudflareSnapshot } from \"../../core/plan/cloudflareSnapshot.js\";\nimport { verifyPlanFile } from \"../../core/plan/verifyPlanFile.js\";\nimport {\n  printApplySummary,\n  resetApplySummary,\n} from \"../../core/plan/planFormat.js\";\nimport type { StateEntry } from \"../../types.js\";\nimport {\n  parseApplyTarget,\n  assertApplyTargetDeclared,\n  type ApplyTarget,\n} from \"../../core/apply/applyTarget.js\";\n\nexport async function runApply(options: {\n  env?: string;\n  addShard?: string;\n  configPath?: string;\n  /**\n   * Path to a plan file from `tamer plan --out`. Apply recomputes the\n   * `(config, state)` attestation hashes and refuses to proceed if either\n   * differs (override with `allowStale`).\n   */\n  planFile?: string;\n  allowStale?: boolean;\n  /**\n   * Track every state entry created during this apply. On any failure,\n   * delete the matching Cloudflare resources (best-effort) so partial\n   * applies do not leak orphans into the account.\n   */\n  rollbackOnFailure?: boolean;\n  /**\n   * `kind:logicalName` — create/update only that declared resource; still\n   * regenerates all wrangler.json files and resolves full `outputs:`.\n   */\n  target?: string;\n}): Promise<void> {\n  const env = options.env ?? \"local\";\n  const addShard = options.addShard;\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  let target: ApplyTarget | undefined;\n  if (options.target) {\n    target = parseApplyTarget(options.target);\n    if (options.planFile) {\n      throw new Error(\n        \"Cannot combine --plan with --target: plan files attest the full stack. Omit --target, or apply without --plan.\",\n      );\n    }\n  }\n\n  if (options.planFile) {\n    const verifyApi = new CFApiClient(accountId);\n    const verifyState = new StateManager(\n      config.tenant.id,\n      env,\n      stackNameForConfig(config),\n    );\n    await verifyState.hydrate(verifyApi);\n    const liveSnapshot =\n      env === \"local\"\n        ? undefined\n        : await buildCloudflareSnapshot({\n            config,\n            env,\n            api: verifyApi,\n            baseDir,\n          });\n    verifyPlanFile({\n      planPath: options.planFile,\n      command: \"apply\",\n      expectedMode: \"forward\",\n      env,\n      tenantId: config.tenant.id,\n      config,\n      stateAtPlanCheck: verifyState.load(),\n      liveCloudflareHash: liveSnapshot\n        ? hashCloudflareSnapshot(liveSnapshot)\n        : undefined,\n      allowStale: !!options.allowStale,\n    });\n  }\n\n  if (env !== \"local\") {\n    console.log(`Syncing state from Cloudflare for env: ${env}...`);\n    await runSync({ env, configPath });\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const referencedStacks = importedStackNames(config);\n  if (referencedStacks.length > 0) {\n    console.log(\n      `Pre-fetching tamer:import outputs from stack(s): ${referencedStacks.join(\", \")}…`,\n    );\n  }\n  const imports = await fetchStackImports(api, config, env);\n  console.log(\"Applying…\");\n\n  if (target) {\n    if (addShard) {\n      if (target.kind !== \"d1\") {\n        throw new Error(\n          \"--add-shard only applies to D1; drop --target or use --target d1:<logical>.\",\n        );\n      }\n      if (addShard !== target.logical) {\n        throw new Error(\n          `--add-shard ${addShard} does not match --target d1:${target.logical}.`,\n        );\n      }\n    }\n    await assertApplyTargetDeclared(config, baseDir, target);\n  }\n\n  // Imports were pre-fetched above (before this block) so every subsequent\n  // `${tamer:import:<stack>.<output>}` resolution is a pure map lookup.\n\n  const opDetail: string[] = [];\n  if (addShard) opDetail.push(`add-shard ${addShard}`);\n  if (target) opDetail.push(`target=${target.kind}:${target.logical}`);\n  state.beginOperation(\n    \"apply\",\n    opDetail.length ? opDetail.join(\"; \") : undefined,\n  );\n\n  if (target) {\n    console.log(\n      `Scoped apply: only ${target.kind}:${target.logical} (wrangler outputs still generated for every worker)`,\n    );\n  }\n\n  const baselineKeys = options.rollbackOnFailure\n    ? new Set(Object.keys(state.getAll()))\n    : null;\n\n  // Reset the per-action counter so the summary at the end of this run\n  // reflects only what *this* `runApply` did (matters for tests and for\n  // back-to-back apply invocations from a single process).\n  resetApplySummary();\n\n  try {\n    const dispatchResources =\n      !target\n        ? getDispatchNamespaces(config)\n        : target.kind === \"dispatch_namespace\"\n          ? getDispatchNamespaces(config).filter(\n              (n) => n.logicalName === target!.logical,\n            )\n          : [];\n\n    await dispatchNamespaceApply(\n      dispatchResources,\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n\n    const dnsResources =\n      !target\n        ? getDnsRecords(config)\n        : target.kind === \"dns_record\"\n          ? getDnsRecords(config).filter(\n              (d) => d.logicalName === target!.logical,\n            )\n          : [];\n\n    await dnsRecordApply(\n      dnsResources,\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n\n    const workers = await getWorkers(config, baseDir);\n    for (const [workerKey, workerConfig] of workers) {\n      const deployedName = resolveDeployedWorkerName(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        naming,\n      );\n      const mergedWorker = mergeWorkerConfigForResourcePick(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        accountId,\n        naming,\n        state,\n        { imports },\n      );\n      for (const mod of resourceModules) {\n        if (target) {\n          if (target.kind === \"logpush_job\") {\n            if (mod.kind !== \"r2\") continue;\n          } else if (mod.kind !== target.kind) {\n            continue;\n          }\n        }\n        const picked = mod.pickResources(mergedWorker);\n        const resources =\n          target && mod.kind === target.kind\n            ? picked.filter(\n                (r) =>\n                  (r as { logicalName?: string }).logicalName ===\n                  target.logical,\n              )\n            : picked;\n        if (resources.length === 0) continue;\n        await mod.apply({\n          resources,\n          tenant: config.tenant,\n          env,\n          api,\n          state,\n          naming,\n          config,\n          baseDir,\n          addShard,\n          worker: { workerKey, deployedName },\n        });\n      }\n    }\n\n    const logpushResources = !target\n      ? getLogpushJobs(config)\n      : target.kind === \"logpush_job\"\n        ? getLogpushJobs(config).filter(\n            (j) => j.logicalName === target.logical,\n          )\n        : [];\n\n    await logpushJobApply(\n      logpushResources,\n      config.tenant,\n      env,\n      accountId,\n      api,\n      state,\n    );\n\n    await state.persist(api);\n\n    const wranglerByWorker = new Map<string, WranglerConfig>();\n    for (const [workerKey, workerConfig] of workers) {\n      const resolved = await resolveWorkerConfig(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        { imports },\n      );\n      const wranglerConfig = generateWranglerConfig(resolved, state, naming);\n      writeWranglerJson(\n        resolved.workerDir,\n        wranglerConfig,\n        resolved.wranglerOutFile,\n      );\n      wranglerByWorker.set(workerKey, wranglerConfig);\n      console.log(`Generated ${resolved.wranglerOutFile} for ${workerKey}`);\n    }\n\n    await emitShardRegistryOnApply({\n      config,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      imports,\n      workers,\n      wranglerByWorker,\n    });\n\n    // Resolve + persist `outputs:` last — every dependency is already in\n    // state by this point, so a strict resolve here surfaces typos in\n    // `outputs` as a fail-the-apply error instead of a silent half-write.\n    // `replaceStackOutputs` is a no-op when nothing changed, so reruns\n    // don't bump `revision` unnecessarily.\n    const resolvedOutputs = resolveStackOutputs(config, {\n      env,\n      state,\n      naming,\n      imports,\n      accountId,\n    });\n    state.replaceStackOutputs(resolvedOutputs);\n    if (Object.keys(resolvedOutputs).length > 0) {\n      console.log(\n        `Stack outputs: resolved ${Object.keys(resolvedOutputs).length} (${Object.keys(resolvedOutputs).join(\", \")})`,\n      );\n    } else if (config.outputs == null) {\n      // Nothing declared, nothing to print — quiet path.\n    } else {\n      // `outputs: {}` (empty record) — config explicitly cleared.\n      console.log(\"Stack outputs: cleared (empty `outputs` block in config)\");\n    }\n\n    state.finishOperation();\n    await state.persist(api);\n    console.log(`Apply complete for env: ${env}`);\n    printApplySummary();\n  } catch (err) {\n    if (baselineKeys) {\n      await rollbackCreatedResources({\n        api,\n        state,\n        baselineKeys,\n        cause: err,\n      });\n    }\n    state.failOperation(err instanceof Error ? err.message : String(err));\n    try {\n      await state.persist(api);\n    } catch {\n      /* swallow secondary persist failure */\n    }\n    throw err;\n  }\n}\n\n/**\n * Best-effort undo for a partially failed apply. Walks every state entry\n * created during this run (i.e. not present at apply start) in reverse\n * insertion order and asks the owning module to delete it. Failures are\n * logged and swallowed — rollback never throws so the original error from\n * apply propagates intact.\n */\nasync function rollbackCreatedResources(args: {\n  api: CFApiClient;\n  state: StateManager;\n  baselineKeys: Set<string>;\n  cause: unknown;\n}): Promise<void> {\n  const { api, state, baselineKeys, cause } = args;\n  const all = state.getAll();\n  const newKeys = Object.keys(all).filter((k) => !baselineKeys.has(k));\n  if (newKeys.length === 0) {\n    console.warn(\n      `Apply failed; --rollback-on-failure had nothing to undo (no new state entries).`,\n    );\n    return;\n  }\n  const causeMsg = cause instanceof Error ? cause.message : String(cause);\n  console.warn(\n    `Apply failed (${causeMsg}); rolling back ${newKeys.length} new resource(s)...`,\n  );\n  const moduleByEntryType = new Map<\n    StateEntry[\"type\"],\n    (typeof resourceModules)[number]\n  >(resourceModules.map((m) => [m.stateEntryType, m]));\n  for (const key of newKeys.reverse()) {\n    const entry = all[key];\n    if (!entry) continue;\n    if (entry.type === \"logpush_job\") {\n      try {\n        await api.logpushAccountJobDelete(entry.cfJobId);\n        state.delete(key);\n      } catch (err) {\n        console.warn(\n          `Rollback: failed to delete Logpush job ${entry.cfJobId}:`,\n          err,\n        );\n      }\n      continue;\n    }\n    const mod = moduleByEntryType.get(entry.type);\n    if (!mod) {\n      console.warn(\n        `Rollback: no module owns state type \"${entry.type}\" (key \"${key}\"); leaving in place.`,\n      );\n      continue;\n    }\n    await mod.destroyOne({ api, state, key, entry });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAKA,SAAS,yBACP,SACA,KACA,QACkE;CAClE,MAAM,uBAAO,IAAI,KAAa;CAC9B,MAAMA,MACJ,EAAE;AACJ,MAAK,MAAM,KAAK,SAAS;EACvB,MAAM,OAAO,+BAA+B,GAAG,KAAK,OAAO;AAC3D,MAAI,KAAK,IAAI,KAAK,CAAE;AACpB,OAAK,IAAI,KAAK;AACd,MAAI,KAAK;GAAE,QAAQ;GAAG;GAAM,CAAC;;AAE/B,QAAO;;AAGT,eAAsB,uBACpB,WACA,QACA,KACA,KACA,OACe;AACf,KAAI,UAAU,WAAW,EAAG;AAC5B,KAAI,QAAQ,QAAS;CAErB,MAAM,SAAS,yBAAyB,WAAW,KAAK,OAAO;CAQ/D,MAAM,gBAPoB,OAAO,MAC9B,EAAE,WAAW,CAAC,MAAM,IAAI,eAAe,OAAO,CAChD,GAMG,IAAI,KAAK,MAAM,IAAI,0BAA0B,EAAE,KAAK,MAAM,EAAE,eAAe,CAAC,mBAC5E,IAAI,KAAa;AAErB,MAAK,MAAM,EAAE,QAAQ,UAAU,QAAQ;EACrC,MAAM,MAAM,eAAe;AAC3B,MAAI,MAAM,IAAI,IAAI,CAAE;AAEpB,MAAI,CAAC,cAAc,IAAI,KAAK,CAC1B,OAAM,IAAI,wBAAwB,KAAK;AAGzC,QAAM,IAAI,KAAK;GACb,MAAM;GACN,aAAa,OAAO;GACpB,aAAa;GACb,4BAAW,IAAI,MAAM,EAAC,aAAa;GACnC,4BAAW,IAAI,MAAM,EAAC,aAAa;GACpC,CAAC;;;;;;;;;;;;;;;;;;;;;ACzBN,eAAsB,eACpB,WACA,QACA,KACA,KACA,OACe;AACf,KAAI,UAAU,WAAW,EAAG;CAC5B,MAAM,aAAa,UAAU,QAAQ,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACzE,KAAI,WAAW,WAAW,EAAG;CAE7B,MAAM,4BAAY,IAAI,KAGnB;CACH,MAAM,WAAW,OACf,WAGG;EACH,IAAI,SAAS,UAAU,IAAI,OAAO;AAClC,MAAI,OAAQ,QAAO;AACnB,WAAS,MAAM,IAAI,qBAAqB,OAAO;AAC/C,YAAU,IAAI,QAAQ,OAAO;AAC7B,SAAO;;AAGT,MAAK,MAAM,UAAU,YAAY;EAC/B,MAAM,WAAW,kBAAkB,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK;EAC3E,MAAM,WAAW,mBAAmB,QAAQ,QAAQ,IAAI;EACxD,MAAM,gBAAgB,MAAM,IAAI,SAAS;EAEzC,MAAM,aACJ,eAAe,SAAS,eACnB,gBACD;AAEN,MAAI,YAAY;AACd,OAAI,kBAAkB,YAAY,OAAO,EAAE;AACzC,mBAAe;KACb,MAAM;KACN,QAAQ;KACR,SAAS,OAAO;KAChB,SAAS,GAAG,OAAO,KAAK,GAAG,OAAO;KAClC,SAAS,CACP;MACE,OAAO;MACP,MAAM,WAAW;MACjB,IAAI,OAAO;MACX,MAAM;MACP,CACF;KACF,CAAC;AACF,UAAM,IAAI,oBAAoB,OAAO,QAAQ,WAAW,SAAS;AAUjE,mBAAe,OAAO,UAAU,QAAQ,WATxB,MAAM,IAAI,oBAAoB,OAAO,QAAQ;KAC3D,MAAM,OAAO;KACb,MAAM,OAAO;KACb,SAAS,SAAS;KAClB,KAAK,SAAS;KACd,SAAS,SAAS;KAClB,UAAU,SAAS;KACnB,SAAS,SAAS;KACnB,CAAC,EACwD,GAAG;AAC7D;;GAEF,MAAM,QAAQ,aAAa,YAAY,SAAS;AAChD,OAAI,OAAO;IACT,MAAM,UAAU,+BACd,YACA,QACA,QACA,IACD;AACD,mBAAe;KACb,MAAM;KACN,QAAQ;KACR,SAAS,OAAO;KAChB,SAAS,GAAG,OAAO,KAAK,GAAG,OAAO;KAClC;KACD,CAAC;AACF,UAAM,IAAI,mBAAmB,OAAO,QAAQ,WAAW,UAAU,MAAM;AACvE,mBAAe,OAAO,UAAU,YAAY,SAAS;;AAEvD;;EAGF,MAAM,OAAO,MAAM,SAAS,OAAO,OAAO;EAC1C,MAAM,SAAS,uBAAuB,QAAQ,KAAK,OAAO,YAAY;EACtE,MAAM,UAAU,KAAK,MAClB,MACC,EAAE,SAAS,OAAO,QAClB,cAAc,EAAE,MAAM,OAAO,KAAK,IAClC,OAAO,EAAE,YAAY,YACrB,EAAE,QAAQ,WAAW,OAAO,CAC/B;AACD,MAAI,SAAS;GACX,MAAMC,eAAoC;IACxC,MAAM;IACN,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,YAAY,OAAO;IACnB,MAAM,QAAQ;IACd,SAAS,QAAQ;IACjB,KAAK,QAAQ,OAAO,SAAS;IAC7B,SAAS,QAAQ,WAAW;IAC5B,UAAU,QAAQ;IAClB,SAAS,QAAQ,WAAW;IAC5B,UAAU,QAAQ;IAClB,4BAAW,IAAI,MAAM,EAAC,aAAa;IACnC,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AACD,SAAM,IAAI,UAAU,aAAa;GACjC,MAAM,QAAQ,aAAa,cAAc,SAAS;AAClD,OAAI,OAAO;IACT,MAAM,UAAU,+BACd,cACA,QACA,QACA,IACD;AACD,mBAAe;KACb,MAAM;KACN,QAAQ;KACR,SAAS,OAAO;KAChB,SAAS,GAAG,OAAO,KAAK,GAAG,OAAO;KAClC;KACD,CAAC;AACF,UAAM,IAAI,mBAAmB,OAAO,QAAQ,QAAQ,IAAI,MAAM;AAC9D,mBAAe,OAAO,UAAU,cAAc,SAAS;;AAEzD;;AAGF,iBAAe;GACb,MAAM;GACN,QAAQ;GACR,SAAS,OAAO;GAChB,SAAS,GAAG,OAAO,KAAK,GAAG,OAAO;GACnC,CAAC;AAUF,iBAAe,OAAO,UAAU,QAAQ,WATxB,MAAM,IAAI,oBAAoB,OAAO,QAAQ;GAC3D,MAAM,OAAO;GACb,MAAM,OAAO;GACb,SAAS,SAAS;GAClB,KAAK,SAAS;GACd,SAAS,SAAS;GAClB,UAAU,SAAS;GACnB,SAAS,SAAS;GACnB,CAAC,EACwD,GAAG;;;AAYjE,SAAS,mBACP,QACA,QACA,KACgB;AAChB,QAAO;EACL,SAAS,OAAO;EAChB,KAAK,sBAAsB,OAAO;EAClC,SAAS,0BAA0B,OAAO;EAC1C,UAAU,OAAO;EACjB,SAAS,0BAA0B,QAAQ,QAAQ,IAAI;EACxD;;AAGH,SAAS,kBACP,OACA,QACS;AACT,QAAO,MAAM,eAAe,OAAO;;AAGrC,SAAS,aACP,OACA,UAOa;CACb,MAAMC,QAMD,EAAE;AACP,KAAI,MAAM,YAAY,SAAS,QAAS,OAAM,UAAU,SAAS;AACjE,KAAI,MAAM,QAAQ,SAAS,IAAK,OAAM,MAAM,SAAS;AACrD,KAAI,MAAM,YAAY,SAAS,QAAS,OAAM,UAAU,SAAS;AACjE,KACE,SAAS,aAAa,UACtB,MAAM,aAAa,SAAS,SAE5B,OAAM,WAAW,SAAS;AAE5B,KAAI,MAAM,YAAY,SAAS,QAAS,OAAM,UAAU,SAAS;AACjE,QAAO,OAAO,KAAK,MAAM,CAAC,SAAS,IAAI,QAAQ;;AAGjD,SAAS,eACP,OACA,KACA,QACA,UACA,UACM;CACN,MAAM,sBAAK,IAAI,MAAM,EAAC,aAAa;CACnC,MAAMC,QAA6B;EACjC,MAAM;EACN,aAAa,OAAO;EACpB,QAAQ,OAAO;EACf,YAAY,OAAO;EACnB,MAAM,OAAO;EACb,SAAS,SAAS;EAClB,KAAK,SAAS;EACd,SAAS,SAAS;EAClB,UAAU,SAAS;EACnB,SAAS,SAAS;EAClB;EACA,WAAW;EACX,WAAW;EACZ;AACD,OAAM,IAAI,KAAK,MAAM;;AAGvB,SAAS,eACP,OACA,KACA,OACA,UACM;CACN,MAAMA,QAA6B;EACjC,GAAG;EACH,SAAS,SAAS;EAClB,KAAK,SAAS;EACd,SAAS,SAAS;EAClB,UAAU,SAAS;EACnB,SAAS,SAAS;EAClB,4BAAW,IAAI,MAAM,EAAC,aAAa;EACpC;AACD,OAAM,IAAI,KAAK,MAAM;;;;;;;AAQvB,SAAS,cAAc,QAAgB,YAA6B;AAClE,KAAI,WAAW,WAAY,QAAO;AAClC,KAAI,eAAe,IAAK,QAAO;AAC/B,QAAO,OAAO,SAAS,IAAI,aAAa,IAAI,OAAO,SAAS,WAAW;;;;;AC3PzE,eAAsB,SAAS,SAsBb;CAChB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,WAAW,QAAQ;CACzB,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,IAAIC;AACJ,KAAI,QAAQ,QAAQ;AAClB,WAAS,iBAAiB,QAAQ,OAAO;AACzC,MAAI,QAAQ,SACV,OAAM,IAAI,MACR,iHACD;;AAIL,KAAI,QAAQ,UAAU;EACpB,MAAM,YAAY,IAAI,YAAY,UAAU;EAC5C,MAAM,cAAc,IAAI,aACtB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,QAAM,YAAY,QAAQ,UAAU;EACpC,MAAM,eACJ,QAAQ,UACJ,SACA,MAAM,wBAAwB;GAC5B;GACA;GACA,KAAK;GACL;GACD,CAAC;AACR,iBAAe;GACb,UAAU,QAAQ;GAClB,SAAS;GACT,cAAc;GACd;GACA,UAAU,OAAO,OAAO;GACxB;GACA,kBAAkB,YAAY,MAAM;GACpC,oBAAoB,eAChB,uBAAuB,aAAa,GACpC;GACJ,YAAY,CAAC,CAAC,QAAQ;GACvB,CAAC;;AAGJ,KAAI,QAAQ,SAAS;AACnB,UAAQ,IAAI,0CAA0C,IAAI,KAAK;AAC/D,QAAM,QAAQ;GAAE;GAAK;GAAY,CAAC;;CAGpC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,mBAAmB,mBAAmB,OAAO;AACnD,KAAI,iBAAiB,SAAS,EAC5B,SAAQ,IACN,oDAAoD,iBAAiB,KAAK,KAAK,CAAC,GACjF;CAEH,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;AACzD,SAAQ,IAAI,YAAY;AAExB,KAAI,QAAQ;AACV,MAAI,UAAU;AACZ,OAAI,OAAO,SAAS,KAClB,OAAM,IAAI,MACR,8EACD;AAEH,OAAI,aAAa,OAAO,QACtB,OAAM,IAAI,MACR,eAAe,SAAS,8BAA8B,OAAO,QAAQ,GACtE;;AAGL,QAAM,0BAA0B,QAAQ,SAAS,OAAO;;CAM1D,MAAMC,WAAqB,EAAE;AAC7B,KAAI,SAAU,UAAS,KAAK,aAAa,WAAW;AACpD,KAAI,OAAQ,UAAS,KAAK,UAAU,OAAO,KAAK,GAAG,OAAO,UAAU;AACpE,OAAM,eACJ,SACA,SAAS,SAAS,SAAS,KAAK,KAAK,GAAG,OACzC;AAED,KAAI,OACF,SAAQ,IACN,sBAAsB,OAAO,KAAK,GAAG,OAAO,QAAQ,sDACrD;CAGH,MAAM,eAAe,QAAQ,oBACzB,IAAI,IAAI,OAAO,KAAK,MAAM,QAAQ,CAAC,CAAC,GACpC;AAKJ,oBAAmB;AAEnB,KAAI;AAUF,QAAM,uBARJ,CAAC,SACG,sBAAsB,OAAO,GAC7B,OAAO,SAAS,uBACd,sBAAsB,OAAO,CAAC,QAC3B,MAAM,EAAE,gBAAgB,OAAQ,QAClC,GACD,EAAE,EAIR,OAAO,QACP,KACA,KACA,MACD;AAWD,QAAM,eARJ,CAAC,SACG,cAAc,OAAO,GACrB,OAAO,SAAS,eACd,cAAc,OAAO,CAAC,QACnB,MAAM,EAAE,gBAAgB,OAAQ,QAClC,GACD,EAAE,EAIR,OAAO,QACP,KACA,KACA,MACD;EAED,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,OAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;GAC/C,MAAM,eAAe,0BACnB,QACA,WACA,cACA,KACA,OACD;GACD,MAAM,eAAe,iCACnB,QACA,WACA,cACA,KACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;AACD,QAAK,MAAM,OAAO,iBAAiB;AACjC,QAAI,QACF;SAAI,OAAO,SAAS,eAClB;UAAI,IAAI,SAAS,KAAM;gBACd,IAAI,SAAS,OAAO,KAC7B;;IAGJ,MAAM,SAAS,IAAI,cAAc,aAAa;IAC9C,MAAM,YACJ,UAAU,IAAI,SAAS,OAAO,OAC1B,OAAO,QACJ,MACE,EAA+B,gBAChC,OAAO,QACV,GACD;AACN,QAAI,UAAU,WAAW,EAAG;AAC5B,UAAM,IAAI,MAAM;KACd;KACA,QAAQ,OAAO;KACf;KACA;KACA;KACA;KACA;KACA;KACA;KACA,QAAQ;MAAE;MAAW;MAAc;KACpC,CAAC;;;AAYN,QAAM,gBARmB,CAAC,SACtB,eAAe,OAAO,GACtB,OAAO,SAAS,gBACd,eAAe,OAAO,CAAC,QACpB,MAAM,EAAE,gBAAgB,OAAO,QACjC,GACD,EAAE,EAIN,OAAO,QACP,KACA,WACA,KACA,MACD;AAED,QAAM,MAAM,QAAQ,IAAI;EAExB,MAAM,mCAAmB,IAAI,KAA6B;AAC1D,OAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;GAC/C,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;GACD,MAAM,iBAAiB,uBAAuB,UAAU,OAAO,OAAO;AACtE,qBACE,SAAS,WACT,gBACA,SAAS,gBACV;AACD,oBAAiB,IAAI,WAAW,eAAe;AAC/C,WAAQ,IAAI,aAAa,SAAS,gBAAgB,OAAO,YAAY;;AAGvE,QAAM,yBAAyB;GAC7B;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACD,CAAC;EAOF,MAAM,kBAAkB,oBAAoB,QAAQ;GAClD;GACA;GACA;GACA;GACA;GACD,CAAC;AACF,QAAM,oBAAoB,gBAAgB;AAC1C,MAAI,OAAO,KAAK,gBAAgB,CAAC,SAAS,EACxC,SAAQ,IACN,2BAA2B,OAAO,KAAK,gBAAgB,CAAC,OAAO,IAAI,OAAO,KAAK,gBAAgB,CAAC,KAAK,KAAK,CAAC,GAC5G;WACQ,OAAO,WAAW,MAAM,OAIjC,SAAQ,IAAI,2DAA2D;AAGzE,QAAM,iBAAiB;AACvB,QAAM,MAAM,QAAQ,IAAI;AACxB,UAAQ,IAAI,2BAA2B,MAAM;AAC7C,qBAAmB;UACZ,KAAK;AACZ,MAAI,aACF,OAAM,yBAAyB;GAC7B;GACA;GACA;GACA,OAAO;GACR,CAAC;AAEJ,QAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,MAAI;AACF,SAAM,MAAM,QAAQ,IAAI;UAClB;AAGR,QAAM;;;;;;;;;;AAWV,eAAe,yBAAyB,MAKtB;CAChB,MAAM,EAAE,KAAK,OAAO,cAAc,UAAU;CAC5C,MAAM,MAAM,MAAM,QAAQ;CAC1B,MAAM,UAAU,OAAO,KAAK,IAAI,CAAC,QAAQ,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;AACpE,KAAI,QAAQ,WAAW,GAAG;AACxB,UAAQ,KACN,kFACD;AACD;;CAEF,MAAM,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACvE,SAAQ,KACN,iBAAiB,SAAS,kBAAkB,QAAQ,OAAO,qBAC5D;CACD,MAAM,oBAAoB,IAAI,IAG5B,gBAAgB,KAAK,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACpD,MAAK,MAAM,OAAO,QAAQ,SAAS,EAAE;EACnC,MAAM,QAAQ,IAAI;AAClB,MAAI,CAAC,MAAO;AACZ,MAAI,MAAM,SAAS,eAAe;AAChC,OAAI;AACF,UAAM,IAAI,wBAAwB,MAAM,QAAQ;AAChD,UAAM,OAAO,IAAI;YACV,KAAK;AACZ,YAAQ,KACN,0CAA0C,MAAM,QAAQ,IACxD,IACD;;AAEH;;EAEF,MAAM,MAAM,kBAAkB,IAAI,MAAM,KAAK;AAC7C,MAAI,CAAC,KAAK;AACR,WAAQ,KACN,wCAAwC,MAAM,KAAK,UAAU,IAAI,uBAClE;AACD;;AAEF,QAAM,IAAI,WAAW;GAAE;GAAK;GAAO;GAAK;GAAO,CAAC"}

package/dist/deploy-D2tQrtN9.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"deploy-D2tQrtN9.mjs","names":["out: WorkerEntry[]","deploySecrets: Awaited<\n    ReturnType<typeof createDeploySecretsResources>\n  > | null","buildEnv: Record<string, string>"],"sources":["../src/cli/commands/deploy.ts"],"sourcesContent":["import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport { wranglerConfigCliArgs } from \"../../core/wrangler/wranglerOutFile.js\";\nimport { spawnWranglerSync, spawnBuildSync } from \"../../core/wrangler/wranglerSpawn.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport {\n  buildIntraStackScriptNameMap,\n  mergedWorkerConfigForEnv,\n  resolveDeployedWorkerName,\n  resolveWorkerConfig,\n  rewriteIntraStackServiceTargets,\n} from \"../../core/config/resolver.js\";\nimport { requiredSecretsForWorker } from \"../../core/secrets/declared.js\";\nimport { createDeploySecretsResources } from \"./secrets/context.js\";\nimport { pushSecretsForDeploy } from \"./secrets/push.js\";\nimport {\n  generateWranglerConfig,\n  writeWranglerJson,\n} from \"../../core/wrangler/generator.js\";\nimport { runSync } from \"./sync.js\";\nimport { workerRoutesApply } from \"../../features/worker-route/index.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\nimport { assertShardRegistryPresentForDeploy } from \"../../core/codegen/shardRegistry/index.js\";\nimport type { CfiConfig, WorkerConfig } from \"../../types.js\";\n\ntype WorkerEntry = [string, WorkerConfig];\n\n/**\n * Topologically sort workers by `services[].service` so that dependencies\n * deploy before dependents. Cloudflare rejects deploys that reference\n * service bindings to workers that don't yet exist on the account.\n * Cross-config dependencies (services not in this monorepo) are ignored.\n */\nexport function topoSortWorkersByServiceBindings(\n  workers: WorkerEntry[],\n  config: CfiConfig,\n  naming: NamingEngine,\n  env: string,\n): WorkerEntry[] {\n  const intraMap = buildIntraStackScriptNameMap(config, env, naming);\n  const scriptNameToKey = new Map<string, string>();\n  for (const [key, cfg] of workers) {\n    const name = resolveDeployedWorkerName(config, key, cfg, env, naming);\n    scriptNameToKey.set(name, key);\n  }\n\n  const byKey = new Map(workers);\n  const visited = new Set<string>();\n  const visiting = new Set<string>();\n  const out: WorkerEntry[] = [];\n\n  function visit(key: string): void {\n    if (visited.has(key)) return;\n    if (visiting.has(key)) return;\n    visiting.add(key);\n    const cfg = byKey.get(key);\n    if (cfg) {\n      const merged = rewriteIntraStackServiceTargets(\n        mergedWorkerConfigForEnv(cfg, env, config.tenant),\n        intraMap,\n      );\n      const deps = merged.services?.map((s) => s.service) ?? [];\n      for (const dep of deps) {\n        const depKey = scriptNameToKey.get(dep);\n        if (depKey && depKey !== key) visit(depKey);\n      }\n      visiting.delete(key);\n      visited.add(key);\n      out.push([key, cfg]);\n    }\n  }\n\n  for (const [key] of workers) visit(key);\n  return out;\n}\n\nexport async function runDeploy(options: {\n  worker?: string;\n  env?: string;\n  configPath?: string;\n  /** Passed to `wrangler deploy --dispatch-namespace` when the worker has no `dispatchNamespace` in config. */\n  dispatchNamespace?: string;\n}): Promise<void> {\n  const workerFilter = options.worker;\n  // `--env` is intentionally required (no silent default to \"prod\") to\n  // match every other Tamer command and to avoid the classic \"ran\n  // `tamer deploy` from the wrong shell, shipped a half-tested branch\n  // to production\" footgun.\n  const env = options.env;\n  if (!env) {\n    throw new Error(\n      \"deploy: --env is required (e.g. --env staging). \" +\n        \"Tamer no longer defaults to prod — pass the env explicitly.\",\n    );\n  }\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  console.log(`Syncing state for env: ${env}...`);\n  await runSync({ env, configPath });\n\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const imports = await fetchStackImports(api, config, env);\n  state.beginOperation(\"deploy\", workerFilter ? `worker:${workerFilter}` : undefined);\n\n  try {\n\n  const workers = await getWorkers(config, baseDir);\n  const toDeploy = workerFilter\n    ? workers.filter(([k]) => k === workerFilter)\n    : workers;\n\n  if (toDeploy.length === 0) {\n    throw new Error(\n      workerFilter\n        ? `Worker \"${workerFilter}\" not found`\n        : \"No workers configured\",\n    );\n  }\n\n  const ordered = topoSortWorkersByServiceBindings(\n    toDeploy,\n    config,\n    naming,\n    env,\n  );\n\n  await assertShardRegistryPresentForDeploy({\n    config,\n    env,\n    baseDir,\n    accountId,\n    naming,\n    state,\n    imports,\n    workers,\n  });\n\n  let deploySecrets: Awaited<\n    ReturnType<typeof createDeploySecretsResources>\n  > | null = null;\n\n  for (const [workerKey, workerConfig] of ordered) {\n    const mergedForSecrets = mergedWorkerConfigForEnv(\n      workerConfig,\n      env,\n      config.tenant,\n    );\n    const requiredSecrets = requiredSecretsForWorker(mergedForSecrets);\n\n    if (requiredSecrets.length > 0 && env !== \"local\") {\n      if (!deploySecrets) {\n        deploySecrets = await createDeploySecretsResources(api, env);\n      }\n      const deployedName = resolveDeployedWorkerName(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        naming,\n      );\n      await pushSecretsForDeploy({\n        workerKey,\n        deployedName,\n        required: requiredSecrets,\n        vault: deploySecrets.vault,\n        state,\n        api,\n        masterKey: deploySecrets.masterKey,\n      });\n    }\n\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { imports },\n    );\n    const wranglerConfig = generateWranglerConfig(resolved, state, naming);\n    writeWranglerJson(resolved.workerDir, wranglerConfig, resolved.wranglerOutFile);\n\n    const buildConfig = mergedForSecrets.build;\n    if (buildConfig) {\n      console.log(`Building ${workerKey} (${buildConfig.command})...`);\n      const buildEnv: Record<string, string> = {};\n      if (wranglerConfig.vars) {\n        for (const [k, v] of Object.entries(wranglerConfig.vars)) {\n          buildEnv[k] = typeof v === \"string\" ? v : String(v);\n        }\n      }\n      const buildResult = spawnBuildSync(buildConfig.command, {\n        cwd: resolved.workerDir,\n        stdio: \"inherit\",\n        env: buildEnv,\n      });\n      if (buildResult.status !== 0) {\n        throw new Error(\n          `build failed for ${workerKey} (exit ${buildResult.status})`,\n        );\n      }\n      console.log(`Built ${workerKey}`);\n    }\n\n    const typesArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n      \"types\",\n    ];\n    const typesResult = spawnWranglerSync(typesArgs, {\n      cwd: resolved.workerDir,\n      stdio: \"inherit\",\n    });\n    if (typesResult.status !== 0) {\n      throw new Error(`wrangler types failed for ${workerKey}`);\n    }\n\n    const dispatchNs =\n      resolved.dispatchNamespace ?? options.dispatchNamespace;\n    const deployArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n      \"deploy\",\n    ];\n    if (dispatchNs) {\n      deployArgs.push(\"--dispatch-namespace\", dispatchNs);\n    }\n\n    const deployResult = spawnWranglerSync(deployArgs, {\n      cwd: resolved.workerDir,\n      stdio: \"inherit\",\n    });\n    if (deployResult.status !== 0) {\n      throw new Error(`wrangler deploy failed for ${workerKey}`);\n    }\n    console.log(`Deployed ${workerKey}`);\n  }\n\n  if (env !== \"local\") {\n    try {\n      await workerRoutesApply(\n        env,\n        config,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        api,\n        { imports },\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      throw new Error(`worker routes apply failed after deploy: ${msg}`);\n    }\n  }\n\n  state.finishOperation();\n  await state.persist(api);\n  console.log(`Deploy complete for env: ${env}`);\n  } catch (err) {\n    state.failOperation(err instanceof Error ? err.message : String(err));\n    try {\n      await state.persist(api);\n    } catch {\n      /* swallow secondary persist failure */\n    }\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAqCA,SAAgB,iCACd,SACA,QACA,QACA,KACe;CACf,MAAM,WAAW,6BAA6B,QAAQ,KAAK,OAAO;CAClE,MAAM,kCAAkB,IAAI,KAAqB;AACjD,MAAK,MAAM,CAAC,KAAK,QAAQ,SAAS;EAChC,MAAM,OAAO,0BAA0B,QAAQ,KAAK,KAAK,KAAK,OAAO;AACrE,kBAAgB,IAAI,MAAM,IAAI;;CAGhC,MAAM,QAAQ,IAAI,IAAI,QAAQ;CAC9B,MAAM,0BAAU,IAAI,KAAa;CACjC,MAAM,2BAAW,IAAI,KAAa;CAClC,MAAMA,MAAqB,EAAE;CAE7B,SAAS,MAAM,KAAmB;AAChC,MAAI,QAAQ,IAAI,IAAI,CAAE;AACtB,MAAI,SAAS,IAAI,IAAI,CAAE;AACvB,WAAS,IAAI,IAAI;EACjB,MAAM,MAAM,MAAM,IAAI,IAAI;AAC1B,MAAI,KAAK;GAKP,MAAM,OAJS,gCACb,yBAAyB,KAAK,KAAK,OAAO,OAAO,EACjD,SACD,CACmB,UAAU,KAAK,MAAM,EAAE,QAAQ,IAAI,EAAE;AACzD,QAAK,MAAM,OAAO,MAAM;IACtB,MAAM,SAAS,gBAAgB,IAAI,IAAI;AACvC,QAAI,UAAU,WAAW,IAAK,OAAM,OAAO;;AAE7C,YAAS,OAAO,IAAI;AACpB,WAAQ,IAAI,IAAI;AAChB,OAAI,KAAK,CAAC,KAAK,IAAI,CAAC;;;AAIxB,MAAK,MAAM,CAAC,QAAQ,QAAS,OAAM,IAAI;AACvC,QAAO;;AAGT,eAAsB,UAAU,SAMd;CAChB,MAAM,eAAe,QAAQ;CAK7B,MAAM,MAAM,QAAQ;AACpB,KAAI,CAAC,IACH,OAAM,IAAI,MACR,8GAED;CAEH,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;AAGH,SAAQ,IAAI,0BAA0B,IAAI,KAAK;AAC/C,OAAM,QAAQ;EAAE;EAAK;EAAY,CAAC;CAElC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;AACzD,OAAM,eAAe,UAAU,eAAe,UAAU,iBAAiB,OAAU;AAEnF,KAAI;EAEJ,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;EACjD,MAAM,WAAW,eACb,QAAQ,QAAQ,CAAC,OAAO,MAAM,aAAa,GAC3C;AAEJ,MAAI,SAAS,WAAW,EACtB,OAAM,IAAI,MACR,eACI,WAAW,aAAa,eACxB,wBACL;EAGH,MAAM,UAAU,iCACd,UACA,QACA,QACA,IACD;AAED,QAAM,oCAAoC;GACxC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACD,CAAC;EAEF,IAAIC,gBAEO;AAEX,OAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;GAC/C,MAAM,mBAAmB,yBACvB,cACA,KACA,OAAO,OACR;GACD,MAAM,kBAAkB,yBAAyB,iBAAiB;AAElE,OAAI,gBAAgB,SAAS,KAAK,QAAQ,SAAS;AACjD,QAAI,CAAC,cACH,iBAAgB,MAAM,6BAA6B,KAAK,IAAI;AAS9D,UAAM,qBAAqB;KACzB;KACA,cATmB,0BACnB,QACA,WACA,cACA,KACA,OACD;KAIC,UAAU;KACV,OAAO,cAAc;KACrB;KACA;KACA,WAAW,cAAc;KAC1B,CAAC;;GAGJ,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;GACD,MAAM,iBAAiB,uBAAuB,UAAU,OAAO,OAAO;AACtE,qBAAkB,SAAS,WAAW,gBAAgB,SAAS,gBAAgB;GAE/E,MAAM,cAAc,iBAAiB;AACrC,OAAI,aAAa;AACf,YAAQ,IAAI,YAAY,UAAU,IAAI,YAAY,QAAQ,MAAM;IAChE,MAAMC,WAAmC,EAAE;AAC3C,QAAI,eAAe,KACjB,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,eAAe,KAAK,CACtD,UAAS,KAAK,OAAO,MAAM,WAAW,IAAI,OAAO,EAAE;IAGvD,MAAM,cAAc,eAAe,YAAY,SAAS;KACtD,KAAK,SAAS;KACd,OAAO;KACP,KAAK;KACN,CAAC;AACF,QAAI,YAAY,WAAW,EACzB,OAAM,IAAI,MACR,oBAAoB,UAAU,SAAS,YAAY,OAAO,GAC3D;AAEH,YAAQ,IAAI,SAAS,YAAY;;AAYnC,OAJoB,kBALF;IAChB;IACA,GAAG,sBAAsB,SAAS,gBAAgB;IAClD;IACD,EACgD;IAC/C,KAAK,SAAS;IACd,OAAO;IACR,CAAC,CACc,WAAW,EACzB,OAAM,IAAI,MAAM,6BAA6B,YAAY;GAG3D,MAAM,aACJ,SAAS,qBAAqB,QAAQ;GACxC,MAAM,aAAa;IACjB;IACA,GAAG,sBAAsB,SAAS,gBAAgB;IAClD;IACD;AACD,OAAI,WACF,YAAW,KAAK,wBAAwB,WAAW;AAOrD,OAJqB,kBAAkB,YAAY;IACjD,KAAK,SAAS;IACd,OAAO;IACR,CAAC,CACe,WAAW,EAC1B,OAAM,IAAI,MAAM,8BAA8B,YAAY;AAE5D,WAAQ,IAAI,YAAY,YAAY;;AAGtC,MAAI,QAAQ,QACV,KAAI;AACF,SAAM,kBACJ,KACA,QACA,SACA,WACA,QACA,OACA,KACA,EAAE,SAAS,CACZ;WACM,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,SAAM,IAAI,MAAM,4CAA4C,MAAM;;AAItE,QAAM,iBAAiB;AACvB,QAAM,MAAM,QAAQ,IAAI;AACxB,UAAQ,IAAI,4BAA4B,MAAM;UACrC,KAAK;AACZ,QAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,MAAI;AACF,SAAM,MAAM,QAAQ,IAAI;UAClB;AAGR,QAAM"}

package/dist/destroy-CEv14T0X.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"destroy-CEv14T0X.mjs","names":[],"sources":["../src/features/dispatch-namespace/dispatch-namespace.destroy.ts","../src/features/dns-records/dns-records.destroy.ts","../src/cli/destroyGuard.ts","../src/cli/commands/destroy.ts"],"sourcesContent":["import type { CfiConfig } from \"../../types.js\";\nimport { getDispatchNamespaces } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { DispatchNamespaceStateEntry } from \"../../types.js\";\nimport { isEphemeralEnv } from \"./dispatch-namespace.resolve.js\";\n\n/**\n * Tear down every dispatch namespace recorded in state.\n *\n * Cloudflare refuses to delete a namespace that still contains scripts, so we\n * enumerate `/dispatch/namespaces/{ns}/scripts` and delete each (with `force`\n * so dependents like service-bind targets don't block the removal). This\n * covers tenant scripts uploaded by `tamer wfp put` / `provision-workflow`\n * that aren't otherwise tracked in Tamer state.\n */\nexport async function dispatchNamespaceDestroy(\n  env: string,\n  state: StateManager,\n  api: CFApiClient,\n  config: CfiConfig,\n  _force?: boolean,\n): Promise<void> {\n  const allowedLogical = new Set(\n    getDispatchNamespaces(config).map((d) => d.logicalName),\n  );\n  if (allowedLogical.size === 0) return;\n\n  for (const [key, entry] of Object.entries(state.getAll())) {\n    if (entry.type !== \"dispatch_namespace\") continue;\n    const ns = entry as DispatchNamespaceStateEntry;\n    if (!allowedLogical.has(ns.logicalName)) continue;\n    const isSharedEphemeral = ns.derivedName.endsWith(\"-ephemeral\");\n    try {\n      const scripts = await api.dispatchNamespaceScriptList(ns.derivedName);\n      for (const s of scripts) {\n        if (isEphemeralEnv(env, config.tenant) && isSharedEphemeral) {\n          if (!s.id.endsWith(`-${env}`)) continue;\n        }\n        try {\n          await api.dispatchNamespaceScriptDelete(ns.derivedName, s.id, {\n            force: true,\n          });\n          console.log(\n            `Deleted tenant script \"${s.id}\" from namespace ${ns.derivedName}.`,\n          );\n        } catch (err) {\n          console.warn(\n            `Failed to delete tenant script ${s.id} in ${ns.derivedName}:`,\n            err instanceof Error ? err.message : err,\n          );\n        }\n      }\n      if (isEphemeralEnv(env, config.tenant) && isSharedEphemeral) {\n        console.log(\n          `Left shared dispatch namespace ${ns.derivedName} (removed only scripts suffixed -${env}).`,\n        );\n        continue;\n      }\n      await api.dispatchNamespaceDelete(ns.derivedName);\n      state.delete(key);\n    } catch (err) {\n      console.warn(\n        `Failed to delete dispatch namespace ${ns.derivedName}:`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n  }\n}\n","import type { CfiConfig, DnsRecordStateEntry } from \"../../types.js\";\nimport { getDnsRecords } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\n\n/**\n * Tear down every DNS record this stack owns. Restricted to records\n * whose `logicalName` is declared in the current `CfiConfig.dnsRecords`\n * (matches `runDestroy` semantics for shared state rows). Records flagged\n * `preserveOnDestroy: true` are left in place but still dropped from\n * state — the operator is responsible for re-importing them later.\n */\nexport async function dnsRecordDestroy(\n  env: string,\n  state: StateManager,\n  api: CFApiClient,\n  config: CfiConfig,\n  _force?: boolean,\n): Promise<void> {\n  if (env === \"local\") return;\n  const declared = getDnsRecords(config);\n  if (declared.length === 0) return;\n  const preserve = new Map<string, boolean>(\n    declared.map((c) => [c.logicalName, !!c.preserveOnDestroy]),\n  );\n  const allowedLogical = new Set(declared.map((c) => c.logicalName));\n\n  for (const [key, entry] of Object.entries(state.getAll())) {\n    if (entry.type !== \"dns_record\") continue;\n    const rec = entry as DnsRecordStateEntry;\n    if (!allowedLogical.has(rec.logicalName)) continue;\n    if (preserve.get(rec.logicalName)) {\n      console.log(\n        `Preserved DNS record ${rec.recordType} ${rec.name} (preserveOnDestroy).`,\n      );\n      state.delete(key);\n      continue;\n    }\n    try {\n      await api.zoneDnsRecordDelete(rec.zoneId, rec.recordId);\n      state.delete(key);\n    } catch (err) {\n      console.warn(\n        `Failed to delete DNS record ${rec.recordType} ${rec.name}:`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n  }\n}\n","/** Shared envs where destroy must be confirmed with `--confirm-env <same>`. */\nexport const SHARED_ENV_DESTROY = [\n  \"dev\",\n  \"staging\",\n  \"prod\",\n  \"production\",\n] as const;\n\n/**\n * @param force When true, skips the typed confirmation (break-glass).\n */\nexport function assertDestroyEnvAllowed(\n  env: string,\n  force: boolean,\n  confirmEnv?: string,\n): void {\n  if (force) return;\n  if (!SHARED_ENV_DESTROY.includes(env as (typeof SHARED_ENV_DESTROY)[number])) {\n    return;\n  }\n  if (confirmEnv !== env) {\n    throw new Error(\n      `Destroying shared environment \"${env}\" requires --confirm-env ${env}`,\n    );\n  }\n}\n","import { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { logicalNamesForResourceKind } from \"../../core/config/resourcesFromConfig.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { deleteEnvStateRows } from \"../../core/state/tamerStateDb.js\";\nimport { deleteEnvArtifacts } from \"../../core/state/tamerArtifactsR2.js\";\nimport { deleteEnvSecretRows } from \"../../core/secrets/secretsDb.js\";\nimport { getDispatchNamespaces, getDnsRecords } from \"../../types.js\";\nimport { logpushJobDestroy } from \"../../features/logpush-job/index.js\";\nimport { assertDestroyEnvAllowed } from \"../destroyGuard.js\";\nimport { dispatchNamespaceDestroy } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordDestroy } from \"../../features/dns-records/index.js\";\nimport { workersDestroy } from \"../../features/workers/index.js\";\nimport { workerRoutesDestroy } from \"../../features/worker-route/index.js\";\nimport { runSync } from \"./sync.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { verifyPlanFile } from \"../../core/plan/verifyPlanFile.js\";\nimport { hashCloudflareSnapshot } from \"../../core/plan/planFile.js\";\nimport { buildCloudflareSnapshot } from \"../../core/plan/cloudflareSnapshot.js\";\n\nexport async function runDestroy(options: {\n  env: string;\n  force?: boolean;\n  skipWorkers?: boolean;\n  confirmEnv?: string;\n  configPath?: string;\n  /** When true, delete the shared `tamer-state-{env}` D1 after other resources (use on last stack teardown). */\n  wipeMetadata?: boolean;\n  /**\n   * Path to a destroy plan file from `tamer plan --destroy --out`. Destroy\n   * recomputes the `(config, state, cloudflare)` attestation hashes and\n   * refuses to proceed if any drifted (override with `allowStale`). The\n   * pinned plan ensures the operator destroys exactly what they reviewed.\n   */\n  planFile?: string;\n  allowStale?: boolean;\n}): Promise<void> {\n  const {\n    env,\n    force = false,\n    skipWorkers = false,\n    confirmEnv,\n    configPath,\n    wipeMetadata = false,\n  } = options;\n  const baseDir = process.cwd();\n\n  assertDestroyEnvAllowed(env, force, confirmEnv);\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  if (options.planFile) {\n    const verifyApi = new CFApiClient(accountId);\n    const verifyState = new StateManager(\n      config.tenant.id,\n      env,\n      stackNameForConfig(config),\n    );\n    await verifyState.hydrate(verifyApi);\n    const liveSnapshot =\n      env === \"local\"\n        ? undefined\n        : await buildCloudflareSnapshot({\n            config,\n            env,\n            api: verifyApi,\n            baseDir,\n          });\n    verifyPlanFile({\n      planPath: options.planFile,\n      command: \"destroy\",\n      expectedMode: \"destroy\",\n      env,\n      tenantId: config.tenant.id,\n      config,\n      stateAtPlanCheck: verifyState.load(),\n      liveCloudflareHash: liveSnapshot\n        ? hashCloudflareSnapshot(liveSnapshot)\n        : undefined,\n      allowStale: !!options.allowStale,\n    });\n  }\n\n  if (env !== \"local\") {\n    console.log(`Syncing state from Cloudflare for env: ${env}...`);\n    await runSync({ env, configPath });\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  state.beginOperation(\"destroy\", wipeMetadata ? \"wipe-metadata\" : undefined);\n  try {\n    await state.persist(api);\n  } catch {\n    /* in-progress marker best-effort */\n  }\n\n  try {\n    if (!skipWorkers) {\n      await workerRoutesDestroy(env, config, baseDir, state, api);\n      await state.persist(api);\n      await workersDestroy(env, baseDir, accountId, config, state, api, force);\n    }\n\n    const ownedByKind = await Promise.all(\n      resourceModules.map((m) =>\n        logicalNamesForResourceKind(config, baseDir, m.kind).then((set) => ({\n          mod: m,\n          owned: set,\n        })),\n      ),\n    );\n    const workers = await getWorkers(config, baseDir);\n\n    // Always run Logpush + Pipelines teardown: state may still hold\n    // `logpush_pipelines` even if logpush was removed from tamer.config.ts,\n    // and destroy must still delete the Pipelines stream/sink in that case.\n    await logpushJobDestroy(env, state, api, config);\n    await state.persist(api);\n\n    for (const { mod, owned } of ownedByKind) {\n      if (owned.size === 0) continue;\n      // Aggregate this kind's resources across all workers in the config — the\n      // destroy hook only needs them for stack-scope filtering and may walk\n      // state directly. Empty array is acceptable when state holds entries\n      // owned by another stack we still want to filter against `owned`.\n      const resources = workers.flatMap(([, wc]) => mod.pickResources(wc));\n      await mod.destroy({\n        resources,\n        tenant: config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n        force,\n      });\n    }\n\n    if (getDispatchNamespaces(config).length > 0) {\n      await dispatchNamespaceDestroy(env, state, api, config, force);\n    }\n\n    if (getDnsRecords(config).length > 0) {\n      await dnsRecordDestroy(env, state, api, config, force);\n    }\n\n    // Clear `stackOutputs` after every successful destroy — the values\n    // pointed at resources we just deleted, so leaving them in state would\n    // mislead a future `tamer status` and (post-imports) leak dangling\n    // refs into sibling stacks. The state row itself is dropped further\n    // below when `wipeMetadata` is set.\n    state.replaceStackOutputs({});\n\n    if (env !== \"local\" && wipeMetadata) {\n      state.clearDirty();\n      const deletedState = await deleteEnvStateRows(api, env);\n      if (deletedState) {\n        console.log(`Cleared Tamer state rows for env ${env}.`);\n      }\n      try {\n        await deleteEnvArtifacts(api, env);\n      } catch (err) {\n        console.warn(\n          `Failed to clean Tamer artifacts for env ${env}:`,\n          err instanceof Error ? err.message : err,\n        );\n      }\n      try {\n        const deletedSecrets = await deleteEnvSecretRows(api, env);\n        if (deletedSecrets) {\n          console.log(`Cleared Tamer secret rows for env ${env}.`);\n        }\n      } catch (err) {\n        console.warn(\n          `Failed to clean Tamer secrets for env ${env}:`,\n          err instanceof Error ? err.message : err,\n        );\n      }\n    }\n\n    if (env !== \"local\" && !wipeMetadata) {\n      state.finishOperation();\n      try {\n        await state.persist(api);\n      } catch {\n        /* state row may have been wiped by sub-steps */\n      }\n    }\n    state.clearDirty();\n    console.log(`Destroyed all resources for env: ${env}`);\n  } catch (err) {\n    if (env !== \"local\") {\n      state.failOperation(err instanceof Error ? err.message : String(err));\n      try {\n        await state.persist(api);\n      } catch {\n        /* swallow secondary persist failure */\n      }\n    }\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgBA,eAAsB,yBACpB,KACA,OACA,KACA,QACA,QACe;CACf,MAAM,iBAAiB,IAAI,IACzB,sBAAsB,OAAO,CAAC,KAAK,MAAM,EAAE,YAAY,CACxD;AACD,KAAI,eAAe,SAAS,EAAG;AAE/B,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACzD,MAAI,MAAM,SAAS,qBAAsB;EACzC,MAAM,KAAK;AACX,MAAI,CAAC,eAAe,IAAI,GAAG,YAAY,CAAE;EACzC,MAAM,oBAAoB,GAAG,YAAY,SAAS,aAAa;AAC/D,MAAI;GACF,MAAM,UAAU,MAAM,IAAI,4BAA4B,GAAG,YAAY;AACrE,QAAK,MAAM,KAAK,SAAS;AACvB,QAAI,eAAe,KAAK,OAAO,OAAO,IAAI,mBACxC;SAAI,CAAC,EAAE,GAAG,SAAS,IAAI,MAAM,CAAE;;AAEjC,QAAI;AACF,WAAM,IAAI,8BAA8B,GAAG,aAAa,EAAE,IAAI,EAC5D,OAAO,MACR,CAAC;AACF,aAAQ,IACN,0BAA0B,EAAE,GAAG,mBAAmB,GAAG,YAAY,GAClE;aACM,KAAK;AACZ,aAAQ,KACN,kCAAkC,EAAE,GAAG,MAAM,GAAG,YAAY,IAC5D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;AAGL,OAAI,eAAe,KAAK,OAAO,OAAO,IAAI,mBAAmB;AAC3D,YAAQ,IACN,kCAAkC,GAAG,YAAY,mCAAmC,IAAI,IACzF;AACD;;AAEF,SAAM,IAAI,wBAAwB,GAAG,YAAY;AACjD,SAAM,OAAO,IAAI;WACV,KAAK;AACZ,WAAQ,KACN,uCAAuC,GAAG,YAAY,IACtD,eAAe,QAAQ,IAAI,UAAU,IACtC;;;;;;;;;;;;;;ACrDP,eAAsB,iBACpB,KACA,OACA,KACA,QACA,QACe;AACf,KAAI,QAAQ,QAAS;CACrB,MAAM,WAAW,cAAc,OAAO;AACtC,KAAI,SAAS,WAAW,EAAG;CAC3B,MAAM,WAAW,IAAI,IACnB,SAAS,KAAK,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAC5D;CACD,MAAM,iBAAiB,IAAI,IAAI,SAAS,KAAK,MAAM,EAAE,YAAY,CAAC;AAElE,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACzD,MAAI,MAAM,SAAS,aAAc;EACjC,MAAM,MAAM;AACZ,MAAI,CAAC,eAAe,IAAI,IAAI,YAAY,CAAE;AAC1C,MAAI,SAAS,IAAI,IAAI,YAAY,EAAE;AACjC,WAAQ,IACN,wBAAwB,IAAI,WAAW,GAAG,IAAI,KAAK,uBACpD;AACD,SAAM,OAAO,IAAI;AACjB;;AAEF,MAAI;AACF,SAAM,IAAI,oBAAoB,IAAI,QAAQ,IAAI,SAAS;AACvD,SAAM,OAAO,IAAI;WACV,KAAK;AACZ,WAAQ,KACN,+BAA+B,IAAI,WAAW,GAAG,IAAI,KAAK,IAC1D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;;;;;;AC5CP,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACD;;;;AAKD,SAAgB,wBACd,KACA,OACA,YACM;AACN,KAAI,MAAO;AACX,KAAI,CAAC,mBAAmB,SAAS,IAA2C,CAC1E;AAEF,KAAI,eAAe,IACjB,OAAM,IAAI,MACR,kCAAkC,IAAI,2BAA2B,MAClE;;;;;ACAL,eAAsB,WAAW,SAgBf;CAChB,MAAM,EACJ,KACA,QAAQ,OACR,cAAc,OACd,YACA,YACA,eAAe,UACb;CACJ,MAAM,UAAU,QAAQ,KAAK;AAE7B,yBAAwB,KAAK,OAAO,WAAW;CAE/C,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;AAGH,KAAI,QAAQ,UAAU;EACpB,MAAM,YAAY,IAAI,YAAY,UAAU;EAC5C,MAAM,cAAc,IAAI,aACtB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,QAAM,YAAY,QAAQ,UAAU;EACpC,MAAM,eACJ,QAAQ,UACJ,SACA,MAAM,wBAAwB;GAC5B;GACA;GACA,KAAK;GACL;GACD,CAAC;AACR,iBAAe;GACb,UAAU,QAAQ;GAClB,SAAS;GACT,cAAc;GACd;GACA,UAAU,OAAO,OAAO;GACxB;GACA,kBAAkB,YAAY,MAAM;GACpC,oBAAoB,eAChB,uBAAuB,aAAa,GACpC;GACJ,YAAY,CAAC,CAAC,QAAQ;GACvB,CAAC;;AAGJ,KAAI,QAAQ,SAAS;AACnB,UAAQ,IAAI,0CAA0C,IAAI,KAAK;AAC/D,QAAM,QAAQ;GAAE;GAAK;GAAY,CAAC;;CAGpC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;AACxB,OAAM,eAAe,WAAW,eAAe,kBAAkB,OAAU;AAC3E,KAAI;AACF,QAAM,MAAM,QAAQ,IAAI;SAClB;AAIR,KAAI;AACF,MAAI,CAAC,aAAa;AAChB,SAAM,oBAAoB,KAAK,QAAQ,SAAS,OAAO,IAAI;AAC3D,SAAM,MAAM,QAAQ,IAAI;AACxB,SAAM,eAAe,KAAK,SAAS,WAAW,QAAQ,OAAO,KAAK,MAAM;;EAG1E,MAAM,cAAc,MAAM,QAAQ,IAChC,gBAAgB,KAAK,MACnB,4BAA4B,QAAQ,SAAS,EAAE,KAAK,CAAC,MAAM,SAAS;GAClE,KAAK;GACL,OAAO;GACR,EAAE,CACJ,CACF;EACD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AAKjD,QAAM,kBAAkB,KAAK,OAAO,KAAK,OAAO;AAChD,QAAM,MAAM,QAAQ,IAAI;AAExB,OAAK,MAAM,EAAE,KAAK,WAAW,aAAa;AACxC,OAAI,MAAM,SAAS,EAAG;GAKtB,MAAM,YAAY,QAAQ,SAAS,GAAG,QAAQ,IAAI,cAAc,GAAG,CAAC;AACpE,SAAM,IAAI,QAAQ;IAChB;IACA,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;;AAGJ,MAAI,sBAAsB,OAAO,CAAC,SAAS,EACzC,OAAM,yBAAyB,KAAK,OAAO,KAAK,QAAQ,MAAM;AAGhE,MAAI,cAAc,OAAO,CAAC,SAAS,EACjC,OAAM,iBAAiB,KAAK,OAAO,KAAK,QAAQ,MAAM;AAQxD,QAAM,oBAAoB,EAAE,CAAC;AAE7B,MAAI,QAAQ,WAAW,cAAc;AACnC,SAAM,YAAY;AAElB,OADqB,MAAM,mBAAmB,KAAK,IAAI,CAErD,SAAQ,IAAI,oCAAoC,IAAI,GAAG;AAEzD,OAAI;AACF,UAAM,mBAAmB,KAAK,IAAI;YAC3B,KAAK;AACZ,YAAQ,KACN,2CAA2C,IAAI,IAC/C,eAAe,QAAQ,IAAI,UAAU,IACtC;;AAEH,OAAI;AAEF,QADuB,MAAM,oBAAoB,KAAK,IAAI,CAExD,SAAQ,IAAI,qCAAqC,IAAI,GAAG;YAEnD,KAAK;AACZ,YAAQ,KACN,yCAAyC,IAAI,IAC7C,eAAe,QAAQ,IAAI,UAAU,IACtC;;;AAIL,MAAI,QAAQ,WAAW,CAAC,cAAc;AACpC,SAAM,iBAAiB;AACvB,OAAI;AACF,UAAM,MAAM,QAAQ,IAAI;WAClB;;AAIV,QAAM,YAAY;AAClB,UAAQ,IAAI,oCAAoC,MAAM;UAC/C,KAAK;AACZ,MAAI,QAAQ,SAAS;AACnB,SAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,OAAI;AACF,UAAM,MAAM,QAAQ,IAAI;WAClB;;AAIV,QAAM"}

package/dist/dev-vGQIP7tD.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"dev-vGQIP7tD.mjs","names":["workerKey","workerConfig","resolved","children: ChildProcess[]"],"sources":["../src/cli/commands/dev.ts"],"sourcesContent":["import type { ChildProcess } from \"child_process\";\nimport { spawn } from \"child_process\";\nimport { loadConfig, getWorkers } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { wranglerConfigCliArgs } from \"../../core/wrangler/wranglerOutFile.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { resolveWorkerConfig } from \"../../core/config/resolver.js\";\nimport {\n  generateWranglerConfig,\n  writeWranglerJson,\n} from \"../../core/wrangler/generator.js\";\nimport { runSync } from \"./sync.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\n\nexport async function runDev(options: {\n  worker?: string;\n  env?: string;\n  configPath?: string;\n  /** Run every selected worker as a separate `wrangler dev` on incrementing ports (from TAMER_DEV_BASE_PORT or 8787). */\n  all?: boolean;\n}): Promise<void> {\n  const workerFilter = options.worker;\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n  const baseDir = process.cwd();\n\n  const config = await loadConfig(configPath, { env });\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n\n  if (\n    env !== \"local\" &&\n    Object.keys(state.load().resources).length === 0\n  ) {\n    console.log(\"Tamer state is empty; running sync...\");\n    await runSync({ env, configPath });\n    state.reset();\n    await state.hydrate(api);\n  }\n\n  // Pre-fetch sibling stack outputs so worker `vars` / `tamerRoutes`\n  // can reference `${tamer:import:<stack>.<output>}` even in dev mode.\n  // No-op in local env (returns `{}`); when missing in non-local, the\n  // import resolver will throw with a clear \"run apply on <stack>\" hint.\n  const imports = await fetchStackImports(api, config, env);\n\n  const workers = await getWorkers(config, baseDir);\n  const toRun = workerFilter\n    ? workers.filter(([k]) => k === workerFilter)\n    : workers;\n\n  if (toRun.length === 0) {\n    throw new Error(\n      workerFilter\n        ? `Worker \"${workerFilter}\" not found`\n        : \"No workers configured\",\n    );\n  }\n\n  for (const [workerKey, workerConfig] of toRun) {\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { imports },\n    );\n    const wranglerConfig = generateWranglerConfig(resolved, state, naming);\n    writeWranglerJson(resolved.workerDir, wranglerConfig, resolved.wranglerOutFile);\n  }\n\n  if (options.all && toRun.length > 0) {\n    const basePort = Number(process.env.TAMER_DEV_BASE_PORT) || 8787;\n    const children: ChildProcess[] = [];\n\n    for (let i = 0; i < toRun.length; i++) {\n      const [workerKey, workerConfig] = toRun[i];\n      const resolved = await resolveWorkerConfig(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        { imports },\n      );\n      const port = basePort + i;\n      const devArgs = [\n        \"wrangler\",\n        ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n        \"dev\",\n        \"--port\",\n        String(port),\n      ];\n      console.log(`Starting ${workerKey} on http://127.0.0.1:${port}`);\n      const proc = spawn(\"bunx\", devArgs, {\n        cwd: resolved.workerDir,\n        stdio: \"inherit\",\n        shell: true,\n      });\n      children.push(proc);\n    }\n\n    const shutdown = () => {\n      for (const c of children) {\n        if (!c.killed) c.kill(\"SIGTERM\");\n      }\n    };\n    process.once(\"SIGINT\", () => {\n      shutdown();\n      process.exit(0);\n    });\n    process.once(\"SIGTERM\", () => {\n      shutdown();\n      process.exit(0);\n    });\n\n    await new Promise<void>((resolve) => {\n      let remaining = children.length;\n      for (const c of children) {\n        c.on(\"exit\", () => {\n          remaining -= 1;\n          if (remaining <= 0) resolve();\n        });\n      }\n    });\n    return;\n  }\n\n  const [workerKey, workerConfig] = toRun[0];\n  const resolved = await resolveWorkerConfig(\n    config,\n    workerKey,\n    workerConfig,\n    env,\n    baseDir,\n    accountId,\n    naming,\n    state,\n    { imports },\n  );\n\n  console.log(`Starting wrangler dev for ${workerKey}...`);\n  const devArgs = [\n    \"wrangler\",\n    ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n    \"dev\",\n  ];\n  const proc = spawn(\"bunx\", devArgs, {\n    cwd: resolved.workerDir,\n    stdio: \"inherit\",\n    shell: true,\n  });\n\n  proc.on(\"exit\", (code) => {\n    process.exit(code ?? 0);\n  });\n}\n"],"mappings":";;;;;;;;;;AAiBA,eAAsB,OAAO,SAMX;CAChB,MAAM,eAAe,QAAQ;CAC7B,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAC3B,MAAM,UAAU,QAAQ,KAAK;CAE7B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;AAExB,KACE,QAAQ,WACR,OAAO,KAAK,MAAM,MAAM,CAAC,UAAU,CAAC,WAAW,GAC/C;AACA,UAAQ,IAAI,wCAAwC;AACpD,QAAM,QAAQ;GAAE;GAAK;GAAY,CAAC;AAClC,QAAM,OAAO;AACb,QAAM,MAAM,QAAQ,IAAI;;CAO1B,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;CAEzD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;CACjD,MAAM,QAAQ,eACV,QAAQ,QAAQ,CAAC,OAAO,MAAM,aAAa,GAC3C;AAEJ,KAAI,MAAM,WAAW,EACnB,OAAM,IAAI,MACR,eACI,WAAW,aAAa,eACxB,wBACL;AAGH,MAAK,MAAM,CAACA,aAAWC,mBAAiB,OAAO;EAC7C,MAAMC,aAAW,MAAM,oBACrB,QACAF,aACAC,gBACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;EACD,MAAM,iBAAiB,uBAAuBC,YAAU,OAAO,OAAO;AACtE,oBAAkBA,WAAS,WAAW,gBAAgBA,WAAS,gBAAgB;;AAGjF,KAAI,QAAQ,OAAO,MAAM,SAAS,GAAG;EACnC,MAAM,WAAW,OAAO,QAAQ,IAAI,oBAAoB,IAAI;EAC5D,MAAMC,WAA2B,EAAE;AAEnC,OAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;GACrC,MAAM,CAACH,aAAWC,kBAAgB,MAAM;GACxC,MAAMC,aAAW,MAAM,oBACrB,QACAF,aACAC,gBACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;GACD,MAAM,OAAO,WAAW;GACxB,MAAM,UAAU;IACd;IACA,GAAG,sBAAsBC,WAAS,gBAAgB;IAClD;IACA;IACA,OAAO,KAAK;IACb;AACD,WAAQ,IAAI,YAAYF,YAAU,uBAAuB,OAAO;GAChE,MAAM,OAAO,MAAM,QAAQ,SAAS;IAClC,KAAKE,WAAS;IACd,OAAO;IACP,OAAO;IACR,CAAC;AACF,YAAS,KAAK,KAAK;;EAGrB,MAAM,iBAAiB;AACrB,QAAK,MAAM,KAAK,SACd,KAAI,CAAC,EAAE,OAAQ,GAAE,KAAK,UAAU;;AAGpC,UAAQ,KAAK,gBAAgB;AAC3B,aAAU;AACV,WAAQ,KAAK,EAAE;IACf;AACF,UAAQ,KAAK,iBAAiB;AAC5B,aAAU;AACV,WAAQ,KAAK,EAAE;IACf;AAEF,QAAM,IAAI,SAAe,YAAY;GACnC,IAAI,YAAY,SAAS;AACzB,QAAK,MAAM,KAAK,SACd,GAAE,GAAG,cAAc;AACjB,iBAAa;AACb,QAAI,aAAa,EAAG,UAAS;KAC7B;IAEJ;AACF;;CAGF,MAAM,CAAC,WAAW,gBAAgB,MAAM;CACxC,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;AAED,SAAQ,IAAI,6BAA6B,UAAU,KAAK;AAYxD,CANa,MAAM,QALH;EACd;EACA,GAAG,sBAAsB,SAAS,gBAAgB;EAClD;EACD,EACmC;EAClC,KAAK,SAAS;EACd,OAAO;EACP,OAAO;EACR,CAAC,CAEG,GAAG,SAAS,SAAS;AACxB,UAAQ,KAAK,QAAQ,EAAE;GACvB"}