@dragonmastery/tamer 0.36.3 → 0.36.4

package/dist/{apply-CSQ2lLYY.mjs → apply-DPkTNVwz.mjs}

@@ -1,18 +1,18 @@
 import { f as getDispatchNamespaces, m as getLogpushJobs, p as getDnsRecords } from "./normalize-DVSTRZhO.mjs";
 import { B as getWorkers, C as stackNameForConfig, D as resolveDeployedWorkerName, I as CFApiClient, L as cloudflareAccountIdFromEnv, M as effectiveDispatchNamespaceName, O as resolveWorkerConfig, T as mergeWorkerConfigForResourcePick, V as loadConfig, f as fetchStackImports, h as StateManager, p as importedStackNames, u as namingFromConfig, z as getConfigBaseDir } from "./tamer.mjs";
-import { n as resourceModules } from "./registry-Du91dVUE.mjs";
+import { n as resourceModules } from "./registry-BlTu3xMp.mjs";
 import "./r2S3EmptyBucket-B9_pHfvB.mjs";
 import { i as resetApplySummary, n as logApplyChange, r as printApplySummary } from "./planFormat-5XMJK879.mjs";
-import { n as writeWranglerJson, t as generateWranglerConfig } from "./generator-vDl0esL-.mjs";
-import { n as emitShardRegistryOnApply } from "./emit-D0p7CKFk.mjs";
+import { n as writeWranglerJson, t as generateWranglerConfig } from "./generator-qyqB1_Yv.mjs";
+import { n as emitShardRegistryOnApply } from "./emit-BxHhy1ZC.mjs";
 import { a as effectiveDnsRecordProxied, i as effectiveDnsRecordComment, n as dnsRecordCommentMarker, o as effectiveDnsRecordTtl, r as dnsRecordStateKey, t as dnsRecordAppliesToEnv } from "./dns-records.resolve-DV6XBZf3.mjs";
-import { i as computeDnsRecordMutableChanges, r as parseApplyTarget, t as assertApplyTargetDeclared } from "./applyTarget-q8lQlmL6.mjs";
+import { i as computeDnsRecordMutableChanges, r as parseApplyTarget, t as assertApplyTargetDeclared } from "./applyTarget-IwJLJY-2.mjs";
 import { a as logpushJobApply } from "./logpush-job-GqVKG_HI.mjs";
 import { n as resolveStackOutputs } from "./stackOutputs-CuLa76D4.mjs";
 import "./worker-route-C7kgtUXH.mjs";
-import { runSync } from "./sync-nkUmYv5B.mjs";
-import { i as hashCloudflareSnapshot, t as buildCloudflareSnapshot } from "./cloudflareSnapshot-D9LAgUVP.mjs";
-import { t as verifyPlanFile } from "./verifyPlanFile-B6Wxl2m2.mjs";
+import { runSync } from "./sync-B6vBSAKa.mjs";
+import { i as hashCloudflareSnapshot, t as buildCloudflareSnapshot } from "./cloudflareSnapshot-DOphOBnH.mjs";
+import { t as verifyPlanFile } from "./verifyPlanFile-CuG9sooo.mjs";
 
 //#region src/features/dispatch-namespace/dispatch-namespace.apply.ts
 function uniqueResolvedNamespaces(configs, env, tenant) {
@@ -432,4 +432,4 @@ async function rollbackCreatedResources(args) {
 
 //#endregion
 export { runApply };
-//# sourceMappingURL=apply-CSQ2lLYY.mjs.map
+//# sourceMappingURL=apply-DPkTNVwz.mjs.map

package/dist/{apply-CSQ2lLYY.mjs.map → apply-DPkTNVwz.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"apply-CSQ2lLYY.mjs","names":["out: Array<{ config: DispatchNamespaceResourceConfig; name: string }>","adoptedEntry: DnsRecordStateEntry","patch: Partial<{\n    content: string;\n    ttl: number;\n    proxied: boolean;\n    priority: number;\n    comment: string;\n  }>","entry: DnsRecordStateEntry","target: ApplyTarget | undefined","opDetail: string[]"],"sources":["../src/features/dispatch-namespace/dispatch-namespace.apply.ts","../src/features/dns-records/dns-records.apply.ts","../src/cli/commands/apply.ts"],"sourcesContent":["import type { TenantMeta, DispatchNamespaceResourceConfig } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { effectiveDispatchNamespaceName } from \"./dispatch-namespace.resolve.js\";\n\nfunction uniqueResolvedNamespaces(\n  configs: DispatchNamespaceResourceConfig[],\n  env: string,\n  tenant: TenantMeta,\n): Array<{ config: DispatchNamespaceResourceConfig; name: string }> {\n  const seen = new Set<string>();\n  const out: Array<{ config: DispatchNamespaceResourceConfig; name: string }> =\n    [];\n  for (const c of configs) {\n    const name = effectiveDispatchNamespaceName(c, env, tenant);\n    if (seen.has(name)) continue;\n    seen.add(name);\n    out.push({ config: c, name });\n  }\n  return out;\n}\n\nexport async function dispatchNamespaceApply(\n  resources: DispatchNamespaceResourceConfig[],\n  tenant: TenantMeta,\n  env: string,\n  api: CFApiClient,\n  state: StateManager,\n): Promise<void> {\n  if (resources.length === 0) return;\n  if (env === \"local\") return;\n\n  const unique = uniqueResolvedNamespaces(resources, env, tenant);\n  const needsCreateLookup = unique.some(\n    ({ name }) => !state.get(`dispatch_ns:${name}`),\n  );\n\n  // CF is the source of truth: avoid POSTing for namespaces that already exist\n  // (state may be empty in CI / first-time apply). Cloudflare's create error\n  // for duplicates conflates with \"invalid name\", so a pre-check is clearer.\n  const existingNames = needsCreateLookup\n    ? new Set((await api.dispatchNamespaceListAll()).map((n) => n.namespace_name))\n    : new Set<string>();\n\n  for (const { config, name } of unique) {\n    const key = `dispatch_ns:${name}`;\n    if (state.get(key)) continue;\n\n    if (!existingNames.has(name)) {\n      await api.dispatchNamespaceCreate(name);\n    }\n\n    state.set(key, {\n      type: \"dispatch_namespace\",\n      logicalName: config.logicalName,\n      derivedName: name,\n      createdAt: new Date().toISOString(),\n      updatedAt: new Date().toISOString(),\n    });\n  }\n}\n","import type {\n  DnsRecordResourceConfig,\n  DnsRecordStateEntry,\n  TenantMeta,\n} from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport {\n  dnsRecordAppliesToEnv,\n  dnsRecordCommentMarker,\n  dnsRecordStateKey,\n  effectiveDnsRecordComment,\n  effectiveDnsRecordProxied,\n  effectiveDnsRecordTtl,\n} from \"./dns-records.resolve.js\";\nimport { computeDnsRecordMutableChanges } from \"./dns-records.diff.js\";\nimport { logApplyChange } from \"../../core/plan/planFormat.js\";\n\n/**\n * Reconcile every declared DNS record for `env` with Cloudflare. For each\n * config entry:\n *\n * 1. **Skip** if `env` is excluded (always: `local`; or via `skipEnvs`).\n * 2. **Resume after state loss** by scanning `/zones/{id}/dns_records` for\n *    any record carrying Tamer's attribution marker comment (`tamer:\n *    <tenant>:<env>:<logical>`) on the matching `(type, name)` tuple, and\n *    re-adopting it into state.\n * 3. **Create** when nothing matches in state or on the zone.\n * 4. **Patch** mutable fields (`content`, `ttl`, `proxied`, `priority`,\n *    `comment`) when state knows about the record but its fields drifted.\n * 5. **Replace** (delete + create) when the record `type` itself changed —\n *    Cloudflare rejects type changes via PATCH per the API docs.\n */\nexport async function dnsRecordApply(\n  resources: DnsRecordResourceConfig[],\n  tenant: TenantMeta,\n  env: string,\n  api: CFApiClient,\n  state: StateManager,\n): Promise<void> {\n  if (resources.length === 0) return;\n  const applicable = resources.filter((r) => dnsRecordAppliesToEnv(r, env));\n  if (applicable.length === 0) return;\n\n  const zoneCache = new Map<\n    string,\n    Awaited<ReturnType<CFApiClient[\"zoneDnsRecordListAll\"]>>\n  >();\n  const loadZone = async (\n    zoneId: string,\n  ): Promise<\n    Awaited<ReturnType<CFApiClient[\"zoneDnsRecordListAll\"]>>\n  > => {\n    let cached = zoneCache.get(zoneId);\n    if (cached) return cached;\n    cached = await api.zoneDnsRecordListAll(zoneId);\n    zoneCache.set(zoneId, cached);\n    return cached;\n  };\n\n  for (const config of applicable) {\n    const stateKey = dnsRecordStateKey(config.zoneId, config.type, config.name);\n    const expected = expectedFromConfig(config, tenant, env);\n    const existingEntry = state.get(stateKey);\n\n    const stateEntry =\n      existingEntry?.type === \"dns_record\"\n        ? (existingEntry as DnsRecordStateEntry)\n        : undefined;\n\n    if (stateEntry) {\n      if (recordTypeChanged(stateEntry, config)) {\n        logApplyChange({\n          kind: \"dns_record\",\n          action: \"replace\",\n          logical: config.logicalName,\n          derived: `${config.type} ${config.name}`,\n          changes: [\n            {\n              field: \"type\",\n              from: stateEntry.recordType,\n              to: config.type,\n              kind: \"immutable\",\n            },\n          ],\n        });\n        await api.zoneDnsRecordDelete(config.zoneId, stateEntry.recordId);\n        const created = await api.zoneDnsRecordCreate(config.zoneId, {\n          type: config.type,\n          name: config.name,\n          content: expected.content,\n          ttl: expected.ttl,\n          proxied: expected.proxied,\n          priority: expected.priority,\n          comment: expected.comment,\n        });\n        persistCreated(state, stateKey, config, expected, created.id);\n        continue;\n      }\n      const patch = computePatch(stateEntry, expected);\n      if (patch) {\n        const changes = computeDnsRecordMutableChanges(\n          stateEntry,\n          config,\n          tenant,\n          env,\n        );\n        logApplyChange({\n          kind: \"dns_record\",\n          action: \"update\",\n          logical: config.logicalName,\n          derived: `${config.type} ${config.name}`,\n          changes,\n        });\n        await api.zoneDnsRecordPatch(config.zoneId, stateEntry.recordId, patch);\n        persistUpdated(state, stateKey, stateEntry, expected);\n      }\n      continue;\n    }\n\n    const live = await loadZone(config.zoneId);\n    const marker = dnsRecordCommentMarker(tenant, env, config.logicalName);\n    const adopted = live.find(\n      (r) =>\n        r.type === config.type &&\n        normalizeName(r.name, config.name) &&\n        typeof r.comment === \"string\" &&\n        r.comment.startsWith(marker),\n    );\n    if (adopted) {\n      const adoptedEntry: DnsRecordStateEntry = {\n        type: \"dns_record\",\n        logicalName: config.logicalName,\n        zoneId: config.zoneId,\n        recordType: config.type,\n        name: adopted.name,\n        content: adopted.content,\n        ttl: adopted.ttl ?? expected.ttl,\n        proxied: adopted.proxied ?? false,\n        priority: adopted.priority,\n        comment: adopted.comment ?? marker,\n        recordId: adopted.id,\n        createdAt: new Date().toISOString(),\n        updatedAt: new Date().toISOString(),\n      };\n      state.set(stateKey, adoptedEntry);\n      const patch = computePatch(adoptedEntry, expected);\n      if (patch) {\n        const changes = computeDnsRecordMutableChanges(\n          adoptedEntry,\n          config,\n          tenant,\n          env,\n        );\n        logApplyChange({\n          kind: \"dns_record\",\n          action: \"update\",\n          logical: config.logicalName,\n          derived: `${config.type} ${config.name}`,\n          changes,\n        });\n        await api.zoneDnsRecordPatch(config.zoneId, adopted.id, patch);\n        persistUpdated(state, stateKey, adoptedEntry, expected);\n      }\n      continue;\n    }\n\n    logApplyChange({\n      kind: \"dns_record\",\n      action: \"create\",\n      logical: config.logicalName,\n      derived: `${config.type} ${config.name}`,\n    });\n    const created = await api.zoneDnsRecordCreate(config.zoneId, {\n      type: config.type,\n      name: config.name,\n      content: expected.content,\n      ttl: expected.ttl,\n      proxied: expected.proxied,\n      priority: expected.priority,\n      comment: expected.comment,\n    });\n    persistCreated(state, stateKey, config, expected, created.id);\n  }\n}\n\ninterface ExpectedFields {\n  content: string;\n  ttl: number;\n  proxied: boolean;\n  priority?: number;\n  comment: string;\n}\n\nfunction expectedFromConfig(\n  config: DnsRecordResourceConfig,\n  tenant: TenantMeta,\n  env: string,\n): ExpectedFields {\n  return {\n    content: config.content,\n    ttl: effectiveDnsRecordTtl(config),\n    proxied: effectiveDnsRecordProxied(config),\n    priority: config.priority,\n    comment: effectiveDnsRecordComment(config, tenant, env),\n  };\n}\n\nfunction recordTypeChanged(\n  state: DnsRecordStateEntry,\n  config: DnsRecordResourceConfig,\n): boolean {\n  return state.recordType !== config.type;\n}\n\nfunction computePatch(\n  state: DnsRecordStateEntry,\n  expected: ExpectedFields,\n): Partial<{\n  content: string;\n  ttl: number;\n  proxied: boolean;\n  priority: number;\n  comment: string;\n}> | undefined {\n  const patch: Partial<{\n    content: string;\n    ttl: number;\n    proxied: boolean;\n    priority: number;\n    comment: string;\n  }> = {};\n  if (state.content !== expected.content) patch.content = expected.content;\n  if (state.ttl !== expected.ttl) patch.ttl = expected.ttl;\n  if (state.proxied !== expected.proxied) patch.proxied = expected.proxied;\n  if (\n    expected.priority !== undefined &&\n    state.priority !== expected.priority\n  ) {\n    patch.priority = expected.priority;\n  }\n  if (state.comment !== expected.comment) patch.comment = expected.comment;\n  return Object.keys(patch).length > 0 ? patch : undefined;\n}\n\nfunction persistCreated(\n  state: StateManager,\n  key: string,\n  config: DnsRecordResourceConfig,\n  expected: ExpectedFields,\n  recordId: string,\n): void {\n  const ts = new Date().toISOString();\n  const entry: DnsRecordStateEntry = {\n    type: \"dns_record\",\n    logicalName: config.logicalName,\n    zoneId: config.zoneId,\n    recordType: config.type,\n    name: config.name,\n    content: expected.content,\n    ttl: expected.ttl,\n    proxied: expected.proxied,\n    priority: expected.priority,\n    comment: expected.comment,\n    recordId,\n    createdAt: ts,\n    updatedAt: ts,\n  };\n  state.set(key, entry);\n}\n\nfunction persistUpdated(\n  state: StateManager,\n  key: string,\n  prior: DnsRecordStateEntry,\n  expected: ExpectedFields,\n): void {\n  const entry: DnsRecordStateEntry = {\n    ...prior,\n    content: expected.content,\n    ttl: expected.ttl,\n    proxied: expected.proxied,\n    priority: expected.priority,\n    comment: expected.comment,\n    updatedAt: new Date().toISOString(),\n  };\n  state.set(key, entry);\n}\n\n/**\n * Cloudflare normalizes DNS names to FQDN ('app.example.com'). The user\n * may declare them either as an apex (`@`) or as a partial — match by\n * exact equality when both look fully-qualified, otherwise by suffix.\n */\nfunction normalizeName(cfName: string, configName: string): boolean {\n  if (cfName === configName) return true;\n  if (configName === \"@\") return true;\n  return cfName.endsWith(`.${configName}`) || cfName.endsWith(configName);\n}\n","import { loadConfig, getWorkers, getConfigBaseDir } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport {\n  resolveWorkerConfig,\n  resolveDeployedWorkerName,\n  mergeWorkerConfigForResourcePick,\n} from \"../../core/config/resolver.js\";\nimport {\n  generateWranglerConfig,\n  writeWranglerJson,\n} from \"../../core/wrangler/generator.js\";\nimport type { WranglerConfig } from \"../../generated/wrangler-types.js\";\nimport { emitShardRegistryOnApply } from \"../../core/codegen/shardRegistry/index.js\";\nimport { dispatchNamespaceApply } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordApply } from \"../../features/dns-records/index.js\";\nimport {\n  getDispatchNamespaces,\n  getDnsRecords,\n  getLogpushJobs,\n} from \"../../types.js\";\nimport { logpushJobApply } from \"../../features/logpush-job/index.js\";\nimport { resolveStackOutputs } from \"../../core/outputs/stackOutputs.js\";\nimport {\n  fetchStackImports,\n  importedStackNames,\n} from \"../../core/imports/fetchStackImports.js\";\nimport { runSync } from \"./sync.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport { hashCloudflareSnapshot } from \"../../core/plan/planFile.js\";\nimport { buildCloudflareSnapshot } from \"../../core/plan/cloudflareSnapshot.js\";\nimport { verifyPlanFile } from \"../../core/plan/verifyPlanFile.js\";\nimport {\n  printApplySummary,\n  resetApplySummary,\n} from \"../../core/plan/planFormat.js\";\nimport type { StateEntry } from \"../../types.js\";\nimport {\n  parseApplyTarget,\n  assertApplyTargetDeclared,\n  type ApplyTarget,\n} from \"../../core/apply/applyTarget.js\";\n\nexport async function runApply(options: {\n  env?: string;\n  addShard?: string;\n  configPath?: string;\n  /**\n   * Path to a plan file from `tamer plan --out`. Apply recomputes the\n   * `(config, state)` attestation hashes and refuses to proceed if either\n   * differs (override with `allowStale`).\n   */\n  planFile?: string;\n  allowStale?: boolean;\n  /**\n   * Track every state entry created during this apply. On any failure,\n   * delete the matching Cloudflare resources (best-effort) so partial\n   * applies do not leak orphans into the account.\n   */\n  rollbackOnFailure?: boolean;\n  /**\n   * `kind:logicalName` — create/update only that declared resource; still\n   * regenerates all wrangler.json files and resolves full `outputs:`.\n   */\n  target?: string;\n}): Promise<void> {\n  const env = options.env ?? \"local\";\n  const addShard = options.addShard;\n  const configPath = options.configPath;\n\n  const config = await loadConfig(configPath, { env });\n  const baseDir = getConfigBaseDir();\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  let target: ApplyTarget | undefined;\n  if (options.target) {\n    target = parseApplyTarget(options.target);\n    if (options.planFile) {\n      throw new Error(\n        \"Cannot combine --plan with --target: plan files attest the full stack. Omit --target, or apply without --plan.\",\n      );\n    }\n  }\n\n  if (options.planFile) {\n    const verifyApi = new CFApiClient(accountId);\n    const verifyState = new StateManager(\n      config.tenant.id,\n      env,\n      stackNameForConfig(config),\n    );\n    await verifyState.hydrate(verifyApi);\n    const liveSnapshot =\n      env === \"local\"\n        ? undefined\n        : await buildCloudflareSnapshot({\n            config,\n            env,\n            api: verifyApi,\n            baseDir,\n          });\n    verifyPlanFile({\n      planPath: options.planFile,\n      command: \"apply\",\n      expectedMode: \"forward\",\n      env,\n      tenantId: config.tenant.id,\n      config,\n      stateAtPlanCheck: verifyState.load(),\n      liveCloudflareHash: liveSnapshot\n        ? hashCloudflareSnapshot(liveSnapshot)\n        : undefined,\n      allowStale: !!options.allowStale,\n    });\n  }\n\n  if (env !== \"local\") {\n    console.log(`Syncing state from Cloudflare for env: ${env}...`);\n    await runSync({ env, configPath });\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const referencedStacks = importedStackNames(config);\n  if (referencedStacks.length > 0) {\n    console.log(\n      `Pre-fetching tamer:import outputs from stack(s): ${referencedStacks.join(\", \")}…`,\n    );\n  }\n  const imports = await fetchStackImports(api, config, env);\n  console.log(\"Applying…\");\n\n  if (target) {\n    if (addShard) {\n      if (target.kind !== \"d1\") {\n        throw new Error(\n          \"--add-shard only applies to D1; drop --target or use --target d1:<logical>.\",\n        );\n      }\n      if (addShard !== target.logical) {\n        throw new Error(\n          `--add-shard ${addShard} does not match --target d1:${target.logical}.`,\n        );\n      }\n    }\n    await assertApplyTargetDeclared(config, baseDir, target);\n  }\n\n  // Imports were pre-fetched above (before this block) so every subsequent\n  // `${tamer:import:<stack>.<output>}` resolution is a pure map lookup.\n\n  const opDetail: string[] = [];\n  if (addShard) opDetail.push(`add-shard ${addShard}`);\n  if (target) opDetail.push(`target=${target.kind}:${target.logical}`);\n  state.beginOperation(\n    \"apply\",\n    opDetail.length ? opDetail.join(\"; \") : undefined,\n  );\n\n  if (target) {\n    console.log(\n      `Scoped apply: only ${target.kind}:${target.logical} (wrangler outputs still generated for every worker)`,\n    );\n  }\n\n  const baselineKeys = options.rollbackOnFailure\n    ? new Set(Object.keys(state.getAll()))\n    : null;\n\n  // Reset the per-action counter so the summary at the end of this run\n  // reflects only what *this* `runApply` did (matters for tests and for\n  // back-to-back apply invocations from a single process).\n  resetApplySummary();\n\n  try {\n    const dispatchResources =\n      !target\n        ? getDispatchNamespaces(config)\n        : target.kind === \"dispatch_namespace\"\n          ? getDispatchNamespaces(config).filter(\n              (n) => n.logicalName === target!.logical,\n            )\n          : [];\n\n    await dispatchNamespaceApply(\n      dispatchResources,\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n\n    const dnsResources =\n      !target\n        ? getDnsRecords(config)\n        : target.kind === \"dns_record\"\n          ? getDnsRecords(config).filter(\n              (d) => d.logicalName === target!.logical,\n            )\n          : [];\n\n    await dnsRecordApply(\n      dnsResources,\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n\n    const workers = await getWorkers(config, baseDir);\n    for (const [workerKey, workerConfig] of workers) {\n      const deployedName = resolveDeployedWorkerName(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        naming,\n      );\n      const mergedWorker = mergeWorkerConfigForResourcePick(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        accountId,\n        naming,\n        state,\n        { imports },\n      );\n      for (const mod of resourceModules) {\n        if (target) {\n          if (target.kind === \"logpush_job\") {\n            if (mod.kind !== \"r2\") continue;\n          } else if (mod.kind !== target.kind) {\n            continue;\n          }\n        }\n        const picked = mod.pickResources(mergedWorker);\n        const resources =\n          target && mod.kind === target.kind\n            ? picked.filter(\n                (r) =>\n                  (r as { logicalName?: string }).logicalName ===\n                  target.logical,\n              )\n            : picked;\n        if (resources.length === 0) continue;\n        await mod.apply({\n          resources,\n          tenant: config.tenant,\n          env,\n          api,\n          state,\n          naming,\n          config,\n          baseDir,\n          addShard,\n          worker: { workerKey, deployedName },\n        });\n      }\n    }\n\n    const logpushResources = !target\n      ? getLogpushJobs(config)\n      : target.kind === \"logpush_job\"\n        ? getLogpushJobs(config).filter(\n            (j) => j.logicalName === target.logical,\n          )\n        : [];\n\n    await logpushJobApply(\n      logpushResources,\n      config.tenant,\n      env,\n      accountId,\n      api,\n      state,\n    );\n\n    await state.persist(api);\n\n    const wranglerByWorker = new Map<string, WranglerConfig>();\n    for (const [workerKey, workerConfig] of workers) {\n      const resolved = await resolveWorkerConfig(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        { imports },\n      );\n      const wranglerConfig = generateWranglerConfig(resolved, state, naming);\n      writeWranglerJson(\n        resolved.workerDir,\n        wranglerConfig,\n        resolved.wranglerOutFile,\n      );\n      wranglerByWorker.set(workerKey, wranglerConfig);\n      console.log(`Generated ${resolved.wranglerOutFile} for ${workerKey}`);\n    }\n\n    await emitShardRegistryOnApply({\n      config,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      imports,\n      workers,\n      wranglerByWorker,\n    });\n\n    // Resolve + persist `outputs:` last — every dependency is already in\n    // state by this point, so a strict resolve here surfaces typos in\n    // `outputs` as a fail-the-apply error instead of a silent half-write.\n    // `replaceStackOutputs` is a no-op when nothing changed, so reruns\n    // don't bump `revision` unnecessarily.\n    const resolvedOutputs = resolveStackOutputs(config, {\n      env,\n      state,\n      naming,\n      imports,\n      accountId,\n    });\n    state.replaceStackOutputs(resolvedOutputs);\n    if (Object.keys(resolvedOutputs).length > 0) {\n      console.log(\n        `Stack outputs: resolved ${Object.keys(resolvedOutputs).length} (${Object.keys(resolvedOutputs).join(\", \")})`,\n      );\n    } else if (config.outputs == null) {\n      // Nothing declared, nothing to print — quiet path.\n    } else {\n      // `outputs: {}` (empty record) — config explicitly cleared.\n      console.log(\"Stack outputs: cleared (empty `outputs` block in config)\");\n    }\n\n    state.finishOperation();\n    await state.persist(api);\n    console.log(`Apply complete for env: ${env}`);\n    printApplySummary();\n  } catch (err) {\n    if (baselineKeys) {\n      await rollbackCreatedResources({\n        api,\n        state,\n        baselineKeys,\n        cause: err,\n      });\n    }\n    state.failOperation(err instanceof Error ? err.message : String(err));\n    try {\n      await state.persist(api);\n    } catch {\n      /* swallow secondary persist failure */\n    }\n    throw err;\n  }\n}\n\n/**\n * Best-effort undo for a partially failed apply. Walks every state entry\n * created during this run (i.e. not present at apply start) in reverse\n * insertion order and asks the owning module to delete it. Failures are\n * logged and swallowed — rollback never throws so the original error from\n * apply propagates intact.\n */\nasync function rollbackCreatedResources(args: {\n  api: CFApiClient;\n  state: StateManager;\n  baselineKeys: Set<string>;\n  cause: unknown;\n}): Promise<void> {\n  const { api, state, baselineKeys, cause } = args;\n  const all = state.getAll();\n  const newKeys = Object.keys(all).filter((k) => !baselineKeys.has(k));\n  if (newKeys.length === 0) {\n    console.warn(\n      `Apply failed; --rollback-on-failure had nothing to undo (no new state entries).`,\n    );\n    return;\n  }\n  const causeMsg = cause instanceof Error ? cause.message : String(cause);\n  console.warn(\n    `Apply failed (${causeMsg}); rolling back ${newKeys.length} new resource(s)...`,\n  );\n  const moduleByEntryType = new Map<\n    StateEntry[\"type\"],\n    (typeof resourceModules)[number]\n  >(resourceModules.map((m) => [m.stateEntryType, m]));\n  for (const key of newKeys.reverse()) {\n    const entry = all[key];\n    if (!entry) continue;\n    if (entry.type === \"logpush_job\") {\n      try {\n        await api.logpushAccountJobDelete(entry.cfJobId);\n        state.delete(key);\n      } catch (err) {\n        console.warn(\n          `Rollback: failed to delete Logpush job ${entry.cfJobId}:`,\n          err,\n        );\n      }\n      continue;\n    }\n    const mod = moduleByEntryType.get(entry.type);\n    if (!mod) {\n      console.warn(\n        `Rollback: no module owns state type \"${entry.type}\" (key \"${key}\"); leaving in place.`,\n      );\n      continue;\n    }\n    await mod.destroyOne({ api, state, key, entry });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAKA,SAAS,yBACP,SACA,KACA,QACkE;CAClE,MAAM,uBAAO,IAAI,KAAa;CAC9B,MAAMA,MACJ,EAAE;AACJ,MAAK,MAAM,KAAK,SAAS;EACvB,MAAM,OAAO,+BAA+B,GAAG,KAAK,OAAO;AAC3D,MAAI,KAAK,IAAI,KAAK,CAAE;AACpB,OAAK,IAAI,KAAK;AACd,MAAI,KAAK;GAAE,QAAQ;GAAG;GAAM,CAAC;;AAE/B,QAAO;;AAGT,eAAsB,uBACpB,WACA,QACA,KACA,KACA,OACe;AACf,KAAI,UAAU,WAAW,EAAG;AAC5B,KAAI,QAAQ,QAAS;CAErB,MAAM,SAAS,yBAAyB,WAAW,KAAK,OAAO;CAQ/D,MAAM,gBAPoB,OAAO,MAC9B,EAAE,WAAW,CAAC,MAAM,IAAI,eAAe,OAAO,CAChD,GAMG,IAAI,KAAK,MAAM,IAAI,0BAA0B,EAAE,KAAK,MAAM,EAAE,eAAe,CAAC,mBAC5E,IAAI,KAAa;AAErB,MAAK,MAAM,EAAE,QAAQ,UAAU,QAAQ;EACrC,MAAM,MAAM,eAAe;AAC3B,MAAI,MAAM,IAAI,IAAI,CAAE;AAEpB,MAAI,CAAC,cAAc,IAAI,KAAK,CAC1B,OAAM,IAAI,wBAAwB,KAAK;AAGzC,QAAM,IAAI,KAAK;GACb,MAAM;GACN,aAAa,OAAO;GACpB,aAAa;GACb,4BAAW,IAAI,MAAM,EAAC,aAAa;GACnC,4BAAW,IAAI,MAAM,EAAC,aAAa;GACpC,CAAC;;;;;;;;;;;;;;;;;;;;;ACzBN,eAAsB,eACpB,WACA,QACA,KACA,KACA,OACe;AACf,KAAI,UAAU,WAAW,EAAG;CAC5B,MAAM,aAAa,UAAU,QAAQ,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACzE,KAAI,WAAW,WAAW,EAAG;CAE7B,MAAM,4BAAY,IAAI,KAGnB;CACH,MAAM,WAAW,OACf,WAGG;EACH,IAAI,SAAS,UAAU,IAAI,OAAO;AAClC,MAAI,OAAQ,QAAO;AACnB,WAAS,MAAM,IAAI,qBAAqB,OAAO;AAC/C,YAAU,IAAI,QAAQ,OAAO;AAC7B,SAAO;;AAGT,MAAK,MAAM,UAAU,YAAY;EAC/B,MAAM,WAAW,kBAAkB,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK;EAC3E,MAAM,WAAW,mBAAmB,QAAQ,QAAQ,IAAI;EACxD,MAAM,gBAAgB,MAAM,IAAI,SAAS;EAEzC,MAAM,aACJ,eAAe,SAAS,eACnB,gBACD;AAEN,MAAI,YAAY;AACd,OAAI,kBAAkB,YAAY,OAAO,EAAE;AACzC,mBAAe;KACb,MAAM;KACN,QAAQ;KACR,SAAS,OAAO;KAChB,SAAS,GAAG,OAAO,KAAK,GAAG,OAAO;KAClC,SAAS,CACP;MACE,OAAO;MACP,MAAM,WAAW;MACjB,IAAI,OAAO;MACX,MAAM;MACP,CACF;KACF,CAAC;AACF,UAAM,IAAI,oBAAoB,OAAO,QAAQ,WAAW,SAAS;AAUjE,mBAAe,OAAO,UAAU,QAAQ,WATxB,MAAM,IAAI,oBAAoB,OAAO,QAAQ;KAC3D,MAAM,OAAO;KACb,MAAM,OAAO;KACb,SAAS,SAAS;KAClB,KAAK,SAAS;KACd,SAAS,SAAS;KAClB,UAAU,SAAS;KACnB,SAAS,SAAS;KACnB,CAAC,EACwD,GAAG;AAC7D;;GAEF,MAAM,QAAQ,aAAa,YAAY,SAAS;AAChD,OAAI,OAAO;IACT,MAAM,UAAU,+BACd,YACA,QACA,QACA,IACD;AACD,mBAAe;KACb,MAAM;KACN,QAAQ;KACR,SAAS,OAAO;KAChB,SAAS,GAAG,OAAO,KAAK,GAAG,OAAO;KAClC;KACD,CAAC;AACF,UAAM,IAAI,mBAAmB,OAAO,QAAQ,WAAW,UAAU,MAAM;AACvE,mBAAe,OAAO,UAAU,YAAY,SAAS;;AAEvD;;EAGF,MAAM,OAAO,MAAM,SAAS,OAAO,OAAO;EAC1C,MAAM,SAAS,uBAAuB,QAAQ,KAAK,OAAO,YAAY;EACtE,MAAM,UAAU,KAAK,MAClB,MACC,EAAE,SAAS,OAAO,QAClB,cAAc,EAAE,MAAM,OAAO,KAAK,IAClC,OAAO,EAAE,YAAY,YACrB,EAAE,QAAQ,WAAW,OAAO,CAC/B;AACD,MAAI,SAAS;GACX,MAAMC,eAAoC;IACxC,MAAM;IACN,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,YAAY,OAAO;IACnB,MAAM,QAAQ;IACd,SAAS,QAAQ;IACjB,KAAK,QAAQ,OAAO,SAAS;IAC7B,SAAS,QAAQ,WAAW;IAC5B,UAAU,QAAQ;IAClB,SAAS,QAAQ,WAAW;IAC5B,UAAU,QAAQ;IAClB,4BAAW,IAAI,MAAM,EAAC,aAAa;IACnC,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AACD,SAAM,IAAI,UAAU,aAAa;GACjC,MAAM,QAAQ,aAAa,cAAc,SAAS;AAClD,OAAI,OAAO;IACT,MAAM,UAAU,+BACd,cACA,QACA,QACA,IACD;AACD,mBAAe;KACb,MAAM;KACN,QAAQ;KACR,SAAS,OAAO;KAChB,SAAS,GAAG,OAAO,KAAK,GAAG,OAAO;KAClC;KACD,CAAC;AACF,UAAM,IAAI,mBAAmB,OAAO,QAAQ,QAAQ,IAAI,MAAM;AAC9D,mBAAe,OAAO,UAAU,cAAc,SAAS;;AAEzD;;AAGF,iBAAe;GACb,MAAM;GACN,QAAQ;GACR,SAAS,OAAO;GAChB,SAAS,GAAG,OAAO,KAAK,GAAG,OAAO;GACnC,CAAC;AAUF,iBAAe,OAAO,UAAU,QAAQ,WATxB,MAAM,IAAI,oBAAoB,OAAO,QAAQ;GAC3D,MAAM,OAAO;GACb,MAAM,OAAO;GACb,SAAS,SAAS;GAClB,KAAK,SAAS;GACd,SAAS,SAAS;GAClB,UAAU,SAAS;GACnB,SAAS,SAAS;GACnB,CAAC,EACwD,GAAG;;;AAYjE,SAAS,mBACP,QACA,QACA,KACgB;AAChB,QAAO;EACL,SAAS,OAAO;EAChB,KAAK,sBAAsB,OAAO;EAClC,SAAS,0BAA0B,OAAO;EAC1C,UAAU,OAAO;EACjB,SAAS,0BAA0B,QAAQ,QAAQ,IAAI;EACxD;;AAGH,SAAS,kBACP,OACA,QACS;AACT,QAAO,MAAM,eAAe,OAAO;;AAGrC,SAAS,aACP,OACA,UAOa;CACb,MAAMC,QAMD,EAAE;AACP,KAAI,MAAM,YAAY,SAAS,QAAS,OAAM,UAAU,SAAS;AACjE,KAAI,MAAM,QAAQ,SAAS,IAAK,OAAM,MAAM,SAAS;AACrD,KAAI,MAAM,YAAY,SAAS,QAAS,OAAM,UAAU,SAAS;AACjE,KACE,SAAS,aAAa,UACtB,MAAM,aAAa,SAAS,SAE5B,OAAM,WAAW,SAAS;AAE5B,KAAI,MAAM,YAAY,SAAS,QAAS,OAAM,UAAU,SAAS;AACjE,QAAO,OAAO,KAAK,MAAM,CAAC,SAAS,IAAI,QAAQ;;AAGjD,SAAS,eACP,OACA,KACA,QACA,UACA,UACM;CACN,MAAM,sBAAK,IAAI,MAAM,EAAC,aAAa;CACnC,MAAMC,QAA6B;EACjC,MAAM;EACN,aAAa,OAAO;EACpB,QAAQ,OAAO;EACf,YAAY,OAAO;EACnB,MAAM,OAAO;EACb,SAAS,SAAS;EAClB,KAAK,SAAS;EACd,SAAS,SAAS;EAClB,UAAU,SAAS;EACnB,SAAS,SAAS;EAClB;EACA,WAAW;EACX,WAAW;EACZ;AACD,OAAM,IAAI,KAAK,MAAM;;AAGvB,SAAS,eACP,OACA,KACA,OACA,UACM;CACN,MAAMA,QAA6B;EACjC,GAAG;EACH,SAAS,SAAS;EAClB,KAAK,SAAS;EACd,SAAS,SAAS;EAClB,UAAU,SAAS;EACnB,SAAS,SAAS;EAClB,4BAAW,IAAI,MAAM,EAAC,aAAa;EACpC;AACD,OAAM,IAAI,KAAK,MAAM;;;;;;;AAQvB,SAAS,cAAc,QAAgB,YAA6B;AAClE,KAAI,WAAW,WAAY,QAAO;AAClC,KAAI,eAAe,IAAK,QAAO;AAC/B,QAAO,OAAO,SAAS,IAAI,aAAa,IAAI,OAAO,SAAS,WAAW;;;;;AC3PzE,eAAsB,SAAS,SAsBb;CAChB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,WAAW,QAAQ;CACzB,MAAM,aAAa,QAAQ;CAE3B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,UAAU,kBAAkB;CAClC,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,IAAIC;AACJ,KAAI,QAAQ,QAAQ;AAClB,WAAS,iBAAiB,QAAQ,OAAO;AACzC,MAAI,QAAQ,SACV,OAAM,IAAI,MACR,iHACD;;AAIL,KAAI,QAAQ,UAAU;EACpB,MAAM,YAAY,IAAI,YAAY,UAAU;EAC5C,MAAM,cAAc,IAAI,aACtB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,QAAM,YAAY,QAAQ,UAAU;EACpC,MAAM,eACJ,QAAQ,UACJ,SACA,MAAM,wBAAwB;GAC5B;GACA;GACA,KAAK;GACL;GACD,CAAC;AACR,iBAAe;GACb,UAAU,QAAQ;GAClB,SAAS;GACT,cAAc;GACd;GACA,UAAU,OAAO,OAAO;GACxB;GACA,kBAAkB,YAAY,MAAM;GACpC,oBAAoB,eAChB,uBAAuB,aAAa,GACpC;GACJ,YAAY,CAAC,CAAC,QAAQ;GACvB,CAAC;;AAGJ,KAAI,QAAQ,SAAS;AACnB,UAAQ,IAAI,0CAA0C,IAAI,KAAK;AAC/D,QAAM,QAAQ;GAAE;GAAK;GAAY,CAAC;;CAGpC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,mBAAmB,mBAAmB,OAAO;AACnD,KAAI,iBAAiB,SAAS,EAC5B,SAAQ,IACN,oDAAoD,iBAAiB,KAAK,KAAK,CAAC,GACjF;CAEH,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;AACzD,SAAQ,IAAI,YAAY;AAExB,KAAI,QAAQ;AACV,MAAI,UAAU;AACZ,OAAI,OAAO,SAAS,KAClB,OAAM,IAAI,MACR,8EACD;AAEH,OAAI,aAAa,OAAO,QACtB,OAAM,IAAI,MACR,eAAe,SAAS,8BAA8B,OAAO,QAAQ,GACtE;;AAGL,QAAM,0BAA0B,QAAQ,SAAS,OAAO;;CAM1D,MAAMC,WAAqB,EAAE;AAC7B,KAAI,SAAU,UAAS,KAAK,aAAa,WAAW;AACpD,KAAI,OAAQ,UAAS,KAAK,UAAU,OAAO,KAAK,GAAG,OAAO,UAAU;AACpE,OAAM,eACJ,SACA,SAAS,SAAS,SAAS,KAAK,KAAK,GAAG,OACzC;AAED,KAAI,OACF,SAAQ,IACN,sBAAsB,OAAO,KAAK,GAAG,OAAO,QAAQ,sDACrD;CAGH,MAAM,eAAe,QAAQ,oBACzB,IAAI,IAAI,OAAO,KAAK,MAAM,QAAQ,CAAC,CAAC,GACpC;AAKJ,oBAAmB;AAEnB,KAAI;AAUF,QAAM,uBARJ,CAAC,SACG,sBAAsB,OAAO,GAC7B,OAAO,SAAS,uBACd,sBAAsB,OAAO,CAAC,QAC3B,MAAM,EAAE,gBAAgB,OAAQ,QAClC,GACD,EAAE,EAIR,OAAO,QACP,KACA,KACA,MACD;AAWD,QAAM,eARJ,CAAC,SACG,cAAc,OAAO,GACrB,OAAO,SAAS,eACd,cAAc,OAAO,CAAC,QACnB,MAAM,EAAE,gBAAgB,OAAQ,QAClC,GACD,EAAE,EAIR,OAAO,QACP,KACA,KACA,MACD;EAED,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,OAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;GAC/C,MAAM,eAAe,0BACnB,QACA,WACA,cACA,KACA,OACD;GACD,MAAM,eAAe,iCACnB,QACA,WACA,cACA,KACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;AACD,QAAK,MAAM,OAAO,iBAAiB;AACjC,QAAI,QACF;SAAI,OAAO,SAAS,eAClB;UAAI,IAAI,SAAS,KAAM;gBACd,IAAI,SAAS,OAAO,KAC7B;;IAGJ,MAAM,SAAS,IAAI,cAAc,aAAa;IAC9C,MAAM,YACJ,UAAU,IAAI,SAAS,OAAO,OAC1B,OAAO,QACJ,MACE,EAA+B,gBAChC,OAAO,QACV,GACD;AACN,QAAI,UAAU,WAAW,EAAG;AAC5B,UAAM,IAAI,MAAM;KACd;KACA,QAAQ,OAAO;KACf;KACA;KACA;KACA;KACA;KACA;KACA;KACA,QAAQ;MAAE;MAAW;MAAc;KACpC,CAAC;;;AAYN,QAAM,gBARmB,CAAC,SACtB,eAAe,OAAO,GACtB,OAAO,SAAS,gBACd,eAAe,OAAO,CAAC,QACpB,MAAM,EAAE,gBAAgB,OAAO,QACjC,GACD,EAAE,EAIN,OAAO,QACP,KACA,WACA,KACA,MACD;AAED,QAAM,MAAM,QAAQ,IAAI;EAExB,MAAM,mCAAmB,IAAI,KAA6B;AAC1D,OAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;GAC/C,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;GACD,MAAM,iBAAiB,uBAAuB,UAAU,OAAO,OAAO;AACtE,qBACE,SAAS,WACT,gBACA,SAAS,gBACV;AACD,oBAAiB,IAAI,WAAW,eAAe;AAC/C,WAAQ,IAAI,aAAa,SAAS,gBAAgB,OAAO,YAAY;;AAGvE,QAAM,yBAAyB;GAC7B;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACD,CAAC;EAOF,MAAM,kBAAkB,oBAAoB,QAAQ;GAClD;GACA;GACA;GACA;GACA;GACD,CAAC;AACF,QAAM,oBAAoB,gBAAgB;AAC1C,MAAI,OAAO,KAAK,gBAAgB,CAAC,SAAS,EACxC,SAAQ,IACN,2BAA2B,OAAO,KAAK,gBAAgB,CAAC,OAAO,IAAI,OAAO,KAAK,gBAAgB,CAAC,KAAK,KAAK,CAAC,GAC5G;WACQ,OAAO,WAAW,MAAM,OAIjC,SAAQ,IAAI,2DAA2D;AAGzE,QAAM,iBAAiB;AACvB,QAAM,MAAM,QAAQ,IAAI;AACxB,UAAQ,IAAI,2BAA2B,MAAM;AAC7C,qBAAmB;UACZ,KAAK;AACZ,MAAI,aACF,OAAM,yBAAyB;GAC7B;GACA;GACA;GACA,OAAO;GACR,CAAC;AAEJ,QAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,MAAI;AACF,SAAM,MAAM,QAAQ,IAAI;UAClB;AAGR,QAAM;;;;;;;;;;AAWV,eAAe,yBAAyB,MAKtB;CAChB,MAAM,EAAE,KAAK,OAAO,cAAc,UAAU;CAC5C,MAAM,MAAM,MAAM,QAAQ;CAC1B,MAAM,UAAU,OAAO,KAAK,IAAI,CAAC,QAAQ,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;AACpE,KAAI,QAAQ,WAAW,GAAG;AACxB,UAAQ,KACN,kFACD;AACD;;CAEF,MAAM,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACvE,SAAQ,KACN,iBAAiB,SAAS,kBAAkB,QAAQ,OAAO,qBAC5D;CACD,MAAM,oBAAoB,IAAI,IAG5B,gBAAgB,KAAK,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACpD,MAAK,MAAM,OAAO,QAAQ,SAAS,EAAE;EACnC,MAAM,QAAQ,IAAI;AAClB,MAAI,CAAC,MAAO;AACZ,MAAI,MAAM,SAAS,eAAe;AAChC,OAAI;AACF,UAAM,IAAI,wBAAwB,MAAM,QAAQ;AAChD,UAAM,OAAO,IAAI;YACV,KAAK;AACZ,YAAQ,KACN,0CAA0C,MAAM,QAAQ,IACxD,IACD;;AAEH;;EAEF,MAAM,MAAM,kBAAkB,IAAI,MAAM,KAAK;AAC7C,MAAI,CAAC,KAAK;AACR,WAAQ,KACN,wCAAwC,MAAM,KAAK,UAAU,IAAI,uBAClE;AACD;;AAEF,QAAM,IAAI,WAAW;GAAE;GAAK;GAAO;GAAK;GAAO,CAAC"}
+{"version":3,"file":"apply-DPkTNVwz.mjs","names":["out: Array<{ config: DispatchNamespaceResourceConfig; name: string }>","adoptedEntry: DnsRecordStateEntry","patch: Partial<{\n    content: string;\n    ttl: number;\n    proxied: boolean;\n    priority: number;\n    comment: string;\n  }>","entry: DnsRecordStateEntry","target: ApplyTarget | undefined","opDetail: string[]"],"sources":["../src/features/dispatch-namespace/dispatch-namespace.apply.ts","../src/features/dns-records/dns-records.apply.ts","../src/cli/commands/apply.ts"],"sourcesContent":["import type { TenantMeta, DispatchNamespaceResourceConfig } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { effectiveDispatchNamespaceName } from \"./dispatch-namespace.resolve.js\";\n\nfunction uniqueResolvedNamespaces(\n  configs: DispatchNamespaceResourceConfig[],\n  env: string,\n  tenant: TenantMeta,\n): Array<{ config: DispatchNamespaceResourceConfig; name: string }> {\n  const seen = new Set<string>();\n  const out: Array<{ config: DispatchNamespaceResourceConfig; name: string }> =\n    [];\n  for (const c of configs) {\n    const name = effectiveDispatchNamespaceName(c, env, tenant);\n    if (seen.has(name)) continue;\n    seen.add(name);\n    out.push({ config: c, name });\n  }\n  return out;\n}\n\nexport async function dispatchNamespaceApply(\n  resources: DispatchNamespaceResourceConfig[],\n  tenant: TenantMeta,\n  env: string,\n  api: CFApiClient,\n  state: StateManager,\n): Promise<void> {\n  if (resources.length === 0) return;\n  if (env === \"local\") return;\n\n  const unique = uniqueResolvedNamespaces(resources, env, tenant);\n  const needsCreateLookup = unique.some(\n    ({ name }) => !state.get(`dispatch_ns:${name}`),\n  );\n\n  // CF is the source of truth: avoid POSTing for namespaces that already exist\n  // (state may be empty in CI / first-time apply). Cloudflare's create error\n  // for duplicates conflates with \"invalid name\", so a pre-check is clearer.\n  const existingNames = needsCreateLookup\n    ? new Set((await api.dispatchNamespaceListAll()).map((n) => n.namespace_name))\n    : new Set<string>();\n\n  for (const { config, name } of unique) {\n    const key = `dispatch_ns:${name}`;\n    if (state.get(key)) continue;\n\n    if (!existingNames.has(name)) {\n      await api.dispatchNamespaceCreate(name);\n    }\n\n    state.set(key, {\n      type: \"dispatch_namespace\",\n      logicalName: config.logicalName,\n      derivedName: name,\n      createdAt: new Date().toISOString(),\n      updatedAt: new Date().toISOString(),\n    });\n  }\n}\n","import type {\n  DnsRecordResourceConfig,\n  DnsRecordStateEntry,\n  TenantMeta,\n} from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport {\n  dnsRecordAppliesToEnv,\n  dnsRecordCommentMarker,\n  dnsRecordStateKey,\n  effectiveDnsRecordComment,\n  effectiveDnsRecordProxied,\n  effectiveDnsRecordTtl,\n} from \"./dns-records.resolve.js\";\nimport { computeDnsRecordMutableChanges } from \"./dns-records.diff.js\";\nimport { logApplyChange } from \"../../core/plan/planFormat.js\";\n\n/**\n * Reconcile every declared DNS record for `env` with Cloudflare. For each\n * config entry:\n *\n * 1. **Skip** if `env` is excluded (always: `local`; or via `skipEnvs`).\n * 2. **Resume after state loss** by scanning `/zones/{id}/dns_records` for\n *    any record carrying Tamer's attribution marker comment (`tamer:\n *    <tenant>:<env>:<logical>`) on the matching `(type, name)` tuple, and\n *    re-adopting it into state.\n * 3. **Create** when nothing matches in state or on the zone.\n * 4. **Patch** mutable fields (`content`, `ttl`, `proxied`, `priority`,\n *    `comment`) when state knows about the record but its fields drifted.\n * 5. **Replace** (delete + create) when the record `type` itself changed —\n *    Cloudflare rejects type changes via PATCH per the API docs.\n */\nexport async function dnsRecordApply(\n  resources: DnsRecordResourceConfig[],\n  tenant: TenantMeta,\n  env: string,\n  api: CFApiClient,\n  state: StateManager,\n): Promise<void> {\n  if (resources.length === 0) return;\n  const applicable = resources.filter((r) => dnsRecordAppliesToEnv(r, env));\n  if (applicable.length === 0) return;\n\n  const zoneCache = new Map<\n    string,\n    Awaited<ReturnType<CFApiClient[\"zoneDnsRecordListAll\"]>>\n  >();\n  const loadZone = async (\n    zoneId: string,\n  ): Promise<\n    Awaited<ReturnType<CFApiClient[\"zoneDnsRecordListAll\"]>>\n  > => {\n    let cached = zoneCache.get(zoneId);\n    if (cached) return cached;\n    cached = await api.zoneDnsRecordListAll(zoneId);\n    zoneCache.set(zoneId, cached);\n    return cached;\n  };\n\n  for (const config of applicable) {\n    const stateKey = dnsRecordStateKey(config.zoneId, config.type, config.name);\n    const expected = expectedFromConfig(config, tenant, env);\n    const existingEntry = state.get(stateKey);\n\n    const stateEntry =\n      existingEntry?.type === \"dns_record\"\n        ? (existingEntry as DnsRecordStateEntry)\n        : undefined;\n\n    if (stateEntry) {\n      if (recordTypeChanged(stateEntry, config)) {\n        logApplyChange({\n          kind: \"dns_record\",\n          action: \"replace\",\n          logical: config.logicalName,\n          derived: `${config.type} ${config.name}`,\n          changes: [\n            {\n              field: \"type\",\n              from: stateEntry.recordType,\n              to: config.type,\n              kind: \"immutable\",\n            },\n          ],\n        });\n        await api.zoneDnsRecordDelete(config.zoneId, stateEntry.recordId);\n        const created = await api.zoneDnsRecordCreate(config.zoneId, {\n          type: config.type,\n          name: config.name,\n          content: expected.content,\n          ttl: expected.ttl,\n          proxied: expected.proxied,\n          priority: expected.priority,\n          comment: expected.comment,\n        });\n        persistCreated(state, stateKey, config, expected, created.id);\n        continue;\n      }\n      const patch = computePatch(stateEntry, expected);\n      if (patch) {\n        const changes = computeDnsRecordMutableChanges(\n          stateEntry,\n          config,\n          tenant,\n          env,\n        );\n        logApplyChange({\n          kind: \"dns_record\",\n          action: \"update\",\n          logical: config.logicalName,\n          derived: `${config.type} ${config.name}`,\n          changes,\n        });\n        await api.zoneDnsRecordPatch(config.zoneId, stateEntry.recordId, patch);\n        persistUpdated(state, stateKey, stateEntry, expected);\n      }\n      continue;\n    }\n\n    const live = await loadZone(config.zoneId);\n    const marker = dnsRecordCommentMarker(tenant, env, config.logicalName);\n    const adopted = live.find(\n      (r) =>\n        r.type === config.type &&\n        normalizeName(r.name, config.name) &&\n        typeof r.comment === \"string\" &&\n        r.comment.startsWith(marker),\n    );\n    if (adopted) {\n      const adoptedEntry: DnsRecordStateEntry = {\n        type: \"dns_record\",\n        logicalName: config.logicalName,\n        zoneId: config.zoneId,\n        recordType: config.type,\n        name: adopted.name,\n        content: adopted.content,\n        ttl: adopted.ttl ?? expected.ttl,\n        proxied: adopted.proxied ?? false,\n        priority: adopted.priority,\n        comment: adopted.comment ?? marker,\n        recordId: adopted.id,\n        createdAt: new Date().toISOString(),\n        updatedAt: new Date().toISOString(),\n      };\n      state.set(stateKey, adoptedEntry);\n      const patch = computePatch(adoptedEntry, expected);\n      if (patch) {\n        const changes = computeDnsRecordMutableChanges(\n          adoptedEntry,\n          config,\n          tenant,\n          env,\n        );\n        logApplyChange({\n          kind: \"dns_record\",\n          action: \"update\",\n          logical: config.logicalName,\n          derived: `${config.type} ${config.name}`,\n          changes,\n        });\n        await api.zoneDnsRecordPatch(config.zoneId, adopted.id, patch);\n        persistUpdated(state, stateKey, adoptedEntry, expected);\n      }\n      continue;\n    }\n\n    logApplyChange({\n      kind: \"dns_record\",\n      action: \"create\",\n      logical: config.logicalName,\n      derived: `${config.type} ${config.name}`,\n    });\n    const created = await api.zoneDnsRecordCreate(config.zoneId, {\n      type: config.type,\n      name: config.name,\n      content: expected.content,\n      ttl: expected.ttl,\n      proxied: expected.proxied,\n      priority: expected.priority,\n      comment: expected.comment,\n    });\n    persistCreated(state, stateKey, config, expected, created.id);\n  }\n}\n\ninterface ExpectedFields {\n  content: string;\n  ttl: number;\n  proxied: boolean;\n  priority?: number;\n  comment: string;\n}\n\nfunction expectedFromConfig(\n  config: DnsRecordResourceConfig,\n  tenant: TenantMeta,\n  env: string,\n): ExpectedFields {\n  return {\n    content: config.content,\n    ttl: effectiveDnsRecordTtl(config),\n    proxied: effectiveDnsRecordProxied(config),\n    priority: config.priority,\n    comment: effectiveDnsRecordComment(config, tenant, env),\n  };\n}\n\nfunction recordTypeChanged(\n  state: DnsRecordStateEntry,\n  config: DnsRecordResourceConfig,\n): boolean {\n  return state.recordType !== config.type;\n}\n\nfunction computePatch(\n  state: DnsRecordStateEntry,\n  expected: ExpectedFields,\n): Partial<{\n  content: string;\n  ttl: number;\n  proxied: boolean;\n  priority: number;\n  comment: string;\n}> | undefined {\n  const patch: Partial<{\n    content: string;\n    ttl: number;\n    proxied: boolean;\n    priority: number;\n    comment: string;\n  }> = {};\n  if (state.content !== expected.content) patch.content = expected.content;\n  if (state.ttl !== expected.ttl) patch.ttl = expected.ttl;\n  if (state.proxied !== expected.proxied) patch.proxied = expected.proxied;\n  if (\n    expected.priority !== undefined &&\n    state.priority !== expected.priority\n  ) {\n    patch.priority = expected.priority;\n  }\n  if (state.comment !== expected.comment) patch.comment = expected.comment;\n  return Object.keys(patch).length > 0 ? patch : undefined;\n}\n\nfunction persistCreated(\n  state: StateManager,\n  key: string,\n  config: DnsRecordResourceConfig,\n  expected: ExpectedFields,\n  recordId: string,\n): void {\n  const ts = new Date().toISOString();\n  const entry: DnsRecordStateEntry = {\n    type: \"dns_record\",\n    logicalName: config.logicalName,\n    zoneId: config.zoneId,\n    recordType: config.type,\n    name: config.name,\n    content: expected.content,\n    ttl: expected.ttl,\n    proxied: expected.proxied,\n    priority: expected.priority,\n    comment: expected.comment,\n    recordId,\n    createdAt: ts,\n    updatedAt: ts,\n  };\n  state.set(key, entry);\n}\n\nfunction persistUpdated(\n  state: StateManager,\n  key: string,\n  prior: DnsRecordStateEntry,\n  expected: ExpectedFields,\n): void {\n  const entry: DnsRecordStateEntry = {\n    ...prior,\n    content: expected.content,\n    ttl: expected.ttl,\n    proxied: expected.proxied,\n    priority: expected.priority,\n    comment: expected.comment,\n    updatedAt: new Date().toISOString(),\n  };\n  state.set(key, entry);\n}\n\n/**\n * Cloudflare normalizes DNS names to FQDN ('app.example.com'). The user\n * may declare them either as an apex (`@`) or as a partial — match by\n * exact equality when both look fully-qualified, otherwise by suffix.\n */\nfunction normalizeName(cfName: string, configName: string): boolean {\n  if (cfName === configName) return true;\n  if (configName === \"@\") return true;\n  return cfName.endsWith(`.${configName}`) || cfName.endsWith(configName);\n}\n","import { loadConfig, getWorkers, getConfigBaseDir } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport {\n  resolveWorkerConfig,\n  resolveDeployedWorkerName,\n  mergeWorkerConfigForResourcePick,\n} from \"../../core/config/resolver.js\";\nimport {\n  generateWranglerConfig,\n  writeWranglerJson,\n} from \"../../core/wrangler/generator.js\";\nimport type { WranglerConfig } from \"../../generated/wrangler-types.js\";\nimport { emitShardRegistryOnApply } from \"../../core/codegen/shardRegistry/index.js\";\nimport { dispatchNamespaceApply } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordApply } from \"../../features/dns-records/index.js\";\nimport {\n  getDispatchNamespaces,\n  getDnsRecords,\n  getLogpushJobs,\n} from \"../../types.js\";\nimport { logpushJobApply } from \"../../features/logpush-job/index.js\";\nimport { resolveStackOutputs } from \"../../core/outputs/stackOutputs.js\";\nimport {\n  fetchStackImports,\n  importedStackNames,\n} from \"../../core/imports/fetchStackImports.js\";\nimport { runSync } from \"./sync.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport { hashCloudflareSnapshot } from \"../../core/plan/planFile.js\";\nimport { buildCloudflareSnapshot } from \"../../core/plan/cloudflareSnapshot.js\";\nimport { verifyPlanFile } from \"../../core/plan/verifyPlanFile.js\";\nimport {\n  printApplySummary,\n  resetApplySummary,\n} from \"../../core/plan/planFormat.js\";\nimport type { StateEntry } from \"../../types.js\";\nimport {\n  parseApplyTarget,\n  assertApplyTargetDeclared,\n  type ApplyTarget,\n} from \"../../core/apply/applyTarget.js\";\n\nexport async function runApply(options: {\n  env?: string;\n  addShard?: string;\n  configPath?: string;\n  /**\n   * Path to a plan file from `tamer plan --out`. Apply recomputes the\n   * `(config, state)` attestation hashes and refuses to proceed if either\n   * differs (override with `allowStale`).\n   */\n  planFile?: string;\n  allowStale?: boolean;\n  /**\n   * Track every state entry created during this apply. On any failure,\n   * delete the matching Cloudflare resources (best-effort) so partial\n   * applies do not leak orphans into the account.\n   */\n  rollbackOnFailure?: boolean;\n  /**\n   * `kind:logicalName` — create/update only that declared resource; still\n   * regenerates all wrangler.json files and resolves full `outputs:`.\n   */\n  target?: string;\n}): Promise<void> {\n  const env = options.env ?? \"local\";\n  const addShard = options.addShard;\n  const configPath = options.configPath;\n\n  const config = await loadConfig(configPath, { env });\n  const baseDir = getConfigBaseDir();\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  let target: ApplyTarget | undefined;\n  if (options.target) {\n    target = parseApplyTarget(options.target);\n    if (options.planFile) {\n      throw new Error(\n        \"Cannot combine --plan with --target: plan files attest the full stack. Omit --target, or apply without --plan.\",\n      );\n    }\n  }\n\n  if (options.planFile) {\n    const verifyApi = new CFApiClient(accountId);\n    const verifyState = new StateManager(\n      config.tenant.id,\n      env,\n      stackNameForConfig(config),\n    );\n    await verifyState.hydrate(verifyApi);\n    const liveSnapshot =\n      env === \"local\"\n        ? undefined\n        : await buildCloudflareSnapshot({\n            config,\n            env,\n            api: verifyApi,\n            baseDir,\n          });\n    verifyPlanFile({\n      planPath: options.planFile,\n      command: \"apply\",\n      expectedMode: \"forward\",\n      env,\n      tenantId: config.tenant.id,\n      config,\n      stateAtPlanCheck: verifyState.load(),\n      liveCloudflareHash: liveSnapshot\n        ? hashCloudflareSnapshot(liveSnapshot)\n        : undefined,\n      allowStale: !!options.allowStale,\n    });\n  }\n\n  if (env !== \"local\") {\n    console.log(`Syncing state from Cloudflare for env: ${env}...`);\n    await runSync({ env, configPath });\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const referencedStacks = importedStackNames(config);\n  if (referencedStacks.length > 0) {\n    console.log(\n      `Pre-fetching tamer:import outputs from stack(s): ${referencedStacks.join(\", \")}…`,\n    );\n  }\n  const imports = await fetchStackImports(api, config, env);\n  console.log(\"Applying…\");\n\n  if (target) {\n    if (addShard) {\n      if (target.kind !== \"d1\") {\n        throw new Error(\n          \"--add-shard only applies to D1; drop --target or use --target d1:<logical>.\",\n        );\n      }\n      if (addShard !== target.logical) {\n        throw new Error(\n          `--add-shard ${addShard} does not match --target d1:${target.logical}.`,\n        );\n      }\n    }\n    await assertApplyTargetDeclared(config, baseDir, target);\n  }\n\n  // Imports were pre-fetched above (before this block) so every subsequent\n  // `${tamer:import:<stack>.<output>}` resolution is a pure map lookup.\n\n  const opDetail: string[] = [];\n  if (addShard) opDetail.push(`add-shard ${addShard}`);\n  if (target) opDetail.push(`target=${target.kind}:${target.logical}`);\n  state.beginOperation(\n    \"apply\",\n    opDetail.length ? opDetail.join(\"; \") : undefined,\n  );\n\n  if (target) {\n    console.log(\n      `Scoped apply: only ${target.kind}:${target.logical} (wrangler outputs still generated for every worker)`,\n    );\n  }\n\n  const baselineKeys = options.rollbackOnFailure\n    ? new Set(Object.keys(state.getAll()))\n    : null;\n\n  // Reset the per-action counter so the summary at the end of this run\n  // reflects only what *this* `runApply` did (matters for tests and for\n  // back-to-back apply invocations from a single process).\n  resetApplySummary();\n\n  try {\n    const dispatchResources =\n      !target\n        ? getDispatchNamespaces(config)\n        : target.kind === \"dispatch_namespace\"\n          ? getDispatchNamespaces(config).filter(\n              (n) => n.logicalName === target!.logical,\n            )\n          : [];\n\n    await dispatchNamespaceApply(\n      dispatchResources,\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n\n    const dnsResources =\n      !target\n        ? getDnsRecords(config)\n        : target.kind === \"dns_record\"\n          ? getDnsRecords(config).filter(\n              (d) => d.logicalName === target!.logical,\n            )\n          : [];\n\n    await dnsRecordApply(\n      dnsResources,\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n\n    const workers = await getWorkers(config, baseDir);\n    for (const [workerKey, workerConfig] of workers) {\n      const deployedName = resolveDeployedWorkerName(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        naming,\n      );\n      const mergedWorker = mergeWorkerConfigForResourcePick(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        accountId,\n        naming,\n        state,\n        { imports },\n      );\n      for (const mod of resourceModules) {\n        if (target) {\n          if (target.kind === \"logpush_job\") {\n            if (mod.kind !== \"r2\") continue;\n          } else if (mod.kind !== target.kind) {\n            continue;\n          }\n        }\n        const picked = mod.pickResources(mergedWorker);\n        const resources =\n          target && mod.kind === target.kind\n            ? picked.filter(\n                (r) =>\n                  (r as { logicalName?: string }).logicalName ===\n                  target.logical,\n              )\n            : picked;\n        if (resources.length === 0) continue;\n        await mod.apply({\n          resources,\n          tenant: config.tenant,\n          env,\n          api,\n          state,\n          naming,\n          config,\n          baseDir,\n          addShard,\n          worker: { workerKey, deployedName },\n        });\n      }\n    }\n\n    const logpushResources = !target\n      ? getLogpushJobs(config)\n      : target.kind === \"logpush_job\"\n        ? getLogpushJobs(config).filter(\n            (j) => j.logicalName === target.logical,\n          )\n        : [];\n\n    await logpushJobApply(\n      logpushResources,\n      config.tenant,\n      env,\n      accountId,\n      api,\n      state,\n    );\n\n    await state.persist(api);\n\n    const wranglerByWorker = new Map<string, WranglerConfig>();\n    for (const [workerKey, workerConfig] of workers) {\n      const resolved = await resolveWorkerConfig(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        { imports },\n      );\n      const wranglerConfig = generateWranglerConfig(resolved, state, naming);\n      writeWranglerJson(\n        resolved.workerDir,\n        wranglerConfig,\n        resolved.wranglerOutFile,\n      );\n      wranglerByWorker.set(workerKey, wranglerConfig);\n      console.log(`Generated ${resolved.wranglerOutFile} for ${workerKey}`);\n    }\n\n    await emitShardRegistryOnApply({\n      config,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      imports,\n      workers,\n      wranglerByWorker,\n    });\n\n    // Resolve + persist `outputs:` last — every dependency is already in\n    // state by this point, so a strict resolve here surfaces typos in\n    // `outputs` as a fail-the-apply error instead of a silent half-write.\n    // `replaceStackOutputs` is a no-op when nothing changed, so reruns\n    // don't bump `revision` unnecessarily.\n    const resolvedOutputs = resolveStackOutputs(config, {\n      env,\n      state,\n      naming,\n      imports,\n      accountId,\n    });\n    state.replaceStackOutputs(resolvedOutputs);\n    if (Object.keys(resolvedOutputs).length > 0) {\n      console.log(\n        `Stack outputs: resolved ${Object.keys(resolvedOutputs).length} (${Object.keys(resolvedOutputs).join(\", \")})`,\n      );\n    } else if (config.outputs == null) {\n      // Nothing declared, nothing to print — quiet path.\n    } else {\n      // `outputs: {}` (empty record) — config explicitly cleared.\n      console.log(\"Stack outputs: cleared (empty `outputs` block in config)\");\n    }\n\n    state.finishOperation();\n    await state.persist(api);\n    console.log(`Apply complete for env: ${env}`);\n    printApplySummary();\n  } catch (err) {\n    if (baselineKeys) {\n      await rollbackCreatedResources({\n        api,\n        state,\n        baselineKeys,\n        cause: err,\n      });\n    }\n    state.failOperation(err instanceof Error ? err.message : String(err));\n    try {\n      await state.persist(api);\n    } catch {\n      /* swallow secondary persist failure */\n    }\n    throw err;\n  }\n}\n\n/**\n * Best-effort undo for a partially failed apply. Walks every state entry\n * created during this run (i.e. not present at apply start) in reverse\n * insertion order and asks the owning module to delete it. Failures are\n * logged and swallowed — rollback never throws so the original error from\n * apply propagates intact.\n */\nasync function rollbackCreatedResources(args: {\n  api: CFApiClient;\n  state: StateManager;\n  baselineKeys: Set<string>;\n  cause: unknown;\n}): Promise<void> {\n  const { api, state, baselineKeys, cause } = args;\n  const all = state.getAll();\n  const newKeys = Object.keys(all).filter((k) => !baselineKeys.has(k));\n  if (newKeys.length === 0) {\n    console.warn(\n      `Apply failed; --rollback-on-failure had nothing to undo (no new state entries).`,\n    );\n    return;\n  }\n  const causeMsg = cause instanceof Error ? cause.message : String(cause);\n  console.warn(\n    `Apply failed (${causeMsg}); rolling back ${newKeys.length} new resource(s)...`,\n  );\n  const moduleByEntryType = new Map<\n    StateEntry[\"type\"],\n    (typeof resourceModules)[number]\n  >(resourceModules.map((m) => [m.stateEntryType, m]));\n  for (const key of newKeys.reverse()) {\n    const entry = all[key];\n    if (!entry) continue;\n    if (entry.type === \"logpush_job\") {\n      try {\n        await api.logpushAccountJobDelete(entry.cfJobId);\n        state.delete(key);\n      } catch (err) {\n        console.warn(\n          `Rollback: failed to delete Logpush job ${entry.cfJobId}:`,\n          err,\n        );\n      }\n      continue;\n    }\n    const mod = moduleByEntryType.get(entry.type);\n    if (!mod) {\n      console.warn(\n        `Rollback: no module owns state type \"${entry.type}\" (key \"${key}\"); leaving in place.`,\n      );\n      continue;\n    }\n    await mod.destroyOne({ api, state, key, entry });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAKA,SAAS,yBACP,SACA,KACA,QACkE;CAClE,MAAM,uBAAO,IAAI,KAAa;CAC9B,MAAMA,MACJ,EAAE;AACJ,MAAK,MAAM,KAAK,SAAS;EACvB,MAAM,OAAO,+BAA+B,GAAG,KAAK,OAAO;AAC3D,MAAI,KAAK,IAAI,KAAK,CAAE;AACpB,OAAK,IAAI,KAAK;AACd,MAAI,KAAK;GAAE,QAAQ;GAAG;GAAM,CAAC;;AAE/B,QAAO;;AAGT,eAAsB,uBACpB,WACA,QACA,KACA,KACA,OACe;AACf,KAAI,UAAU,WAAW,EAAG;AAC5B,KAAI,QAAQ,QAAS;CAErB,MAAM,SAAS,yBAAyB,WAAW,KAAK,OAAO;CAQ/D,MAAM,gBAPoB,OAAO,MAC9B,EAAE,WAAW,CAAC,MAAM,IAAI,eAAe,OAAO,CAChD,GAMG,IAAI,KAAK,MAAM,IAAI,0BAA0B,EAAE,KAAK,MAAM,EAAE,eAAe,CAAC,mBAC5E,IAAI,KAAa;AAErB,MAAK,MAAM,EAAE,QAAQ,UAAU,QAAQ;EACrC,MAAM,MAAM,eAAe;AAC3B,MAAI,MAAM,IAAI,IAAI,CAAE;AAEpB,MAAI,CAAC,cAAc,IAAI,KAAK,CAC1B,OAAM,IAAI,wBAAwB,KAAK;AAGzC,QAAM,IAAI,KAAK;GACb,MAAM;GACN,aAAa,OAAO;GACpB,aAAa;GACb,4BAAW,IAAI,MAAM,EAAC,aAAa;GACnC,4BAAW,IAAI,MAAM,EAAC,aAAa;GACpC,CAAC;;;;;;;;;;;;;;;;;;;;;ACzBN,eAAsB,eACpB,WACA,QACA,KACA,KACA,OACe;AACf,KAAI,UAAU,WAAW,EAAG;CAC5B,MAAM,aAAa,UAAU,QAAQ,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACzE,KAAI,WAAW,WAAW,EAAG;CAE7B,MAAM,4BAAY,IAAI,KAGnB;CACH,MAAM,WAAW,OACf,WAGG;EACH,IAAI,SAAS,UAAU,IAAI,OAAO;AAClC,MAAI,OAAQ,QAAO;AACnB,WAAS,MAAM,IAAI,qBAAqB,OAAO;AAC/C,YAAU,IAAI,QAAQ,OAAO;AAC7B,SAAO;;AAGT,MAAK,MAAM,UAAU,YAAY;EAC/B,MAAM,WAAW,kBAAkB,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK;EAC3E,MAAM,WAAW,mBAAmB,QAAQ,QAAQ,IAAI;EACxD,MAAM,gBAAgB,MAAM,IAAI,SAAS;EAEzC,MAAM,aACJ,eAAe,SAAS,eACnB,gBACD;AAEN,MAAI,YAAY;AACd,OAAI,kBAAkB,YAAY,OAAO,EAAE;AACzC,mBAAe;KACb,MAAM;KACN,QAAQ;KACR,SAAS,OAAO;KAChB,SAAS,GAAG,OAAO,KAAK,GAAG,OAAO;KAClC,SAAS,CACP;MACE,OAAO;MACP,MAAM,WAAW;MACjB,IAAI,OAAO;MACX,MAAM;MACP,CACF;KACF,CAAC;AACF,UAAM,IAAI,oBAAoB,OAAO,QAAQ,WAAW,SAAS;AAUjE,mBAAe,OAAO,UAAU,QAAQ,WATxB,MAAM,IAAI,oBAAoB,OAAO,QAAQ;KAC3D,MAAM,OAAO;KACb,MAAM,OAAO;KACb,SAAS,SAAS;KAClB,KAAK,SAAS;KACd,SAAS,SAAS;KAClB,UAAU,SAAS;KACnB,SAAS,SAAS;KACnB,CAAC,EACwD,GAAG;AAC7D;;GAEF,MAAM,QAAQ,aAAa,YAAY,SAAS;AAChD,OAAI,OAAO;IACT,MAAM,UAAU,+BACd,YACA,QACA,QACA,IACD;AACD,mBAAe;KACb,MAAM;KACN,QAAQ;KACR,SAAS,OAAO;KAChB,SAAS,GAAG,OAAO,KAAK,GAAG,OAAO;KAClC;KACD,CAAC;AACF,UAAM,IAAI,mBAAmB,OAAO,QAAQ,WAAW,UAAU,MAAM;AACvE,mBAAe,OAAO,UAAU,YAAY,SAAS;;AAEvD;;EAGF,MAAM,OAAO,MAAM,SAAS,OAAO,OAAO;EAC1C,MAAM,SAAS,uBAAuB,QAAQ,KAAK,OAAO,YAAY;EACtE,MAAM,UAAU,KAAK,MAClB,MACC,EAAE,SAAS,OAAO,QAClB,cAAc,EAAE,MAAM,OAAO,KAAK,IAClC,OAAO,EAAE,YAAY,YACrB,EAAE,QAAQ,WAAW,OAAO,CAC/B;AACD,MAAI,SAAS;GACX,MAAMC,eAAoC;IACxC,MAAM;IACN,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,YAAY,OAAO;IACnB,MAAM,QAAQ;IACd,SAAS,QAAQ;IACjB,KAAK,QAAQ,OAAO,SAAS;IAC7B,SAAS,QAAQ,WAAW;IAC5B,UAAU,QAAQ;IAClB,SAAS,QAAQ,WAAW;IAC5B,UAAU,QAAQ;IAClB,4BAAW,IAAI,MAAM,EAAC,aAAa;IACnC,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AACD,SAAM,IAAI,UAAU,aAAa;GACjC,MAAM,QAAQ,aAAa,cAAc,SAAS;AAClD,OAAI,OAAO;IACT,MAAM,UAAU,+BACd,cACA,QACA,QACA,IACD;AACD,mBAAe;KACb,MAAM;KACN,QAAQ;KACR,SAAS,OAAO;KAChB,SAAS,GAAG,OAAO,KAAK,GAAG,OAAO;KAClC;KACD,CAAC;AACF,UAAM,IAAI,mBAAmB,OAAO,QAAQ,QAAQ,IAAI,MAAM;AAC9D,mBAAe,OAAO,UAAU,cAAc,SAAS;;AAEzD;;AAGF,iBAAe;GACb,MAAM;GACN,QAAQ;GACR,SAAS,OAAO;GAChB,SAAS,GAAG,OAAO,KAAK,GAAG,OAAO;GACnC,CAAC;AAUF,iBAAe,OAAO,UAAU,QAAQ,WATxB,MAAM,IAAI,oBAAoB,OAAO,QAAQ;GAC3D,MAAM,OAAO;GACb,MAAM,OAAO;GACb,SAAS,SAAS;GAClB,KAAK,SAAS;GACd,SAAS,SAAS;GAClB,UAAU,SAAS;GACnB,SAAS,SAAS;GACnB,CAAC,EACwD,GAAG;;;AAYjE,SAAS,mBACP,QACA,QACA,KACgB;AAChB,QAAO;EACL,SAAS,OAAO;EAChB,KAAK,sBAAsB,OAAO;EAClC,SAAS,0BAA0B,OAAO;EAC1C,UAAU,OAAO;EACjB,SAAS,0BAA0B,QAAQ,QAAQ,IAAI;EACxD;;AAGH,SAAS,kBACP,OACA,QACS;AACT,QAAO,MAAM,eAAe,OAAO;;AAGrC,SAAS,aACP,OACA,UAOa;CACb,MAAMC,QAMD,EAAE;AACP,KAAI,MAAM,YAAY,SAAS,QAAS,OAAM,UAAU,SAAS;AACjE,KAAI,MAAM,QAAQ,SAAS,IAAK,OAAM,MAAM,SAAS;AACrD,KAAI,MAAM,YAAY,SAAS,QAAS,OAAM,UAAU,SAAS;AACjE,KACE,SAAS,aAAa,UACtB,MAAM,aAAa,SAAS,SAE5B,OAAM,WAAW,SAAS;AAE5B,KAAI,MAAM,YAAY,SAAS,QAAS,OAAM,UAAU,SAAS;AACjE,QAAO,OAAO,KAAK,MAAM,CAAC,SAAS,IAAI,QAAQ;;AAGjD,SAAS,eACP,OACA,KACA,QACA,UACA,UACM;CACN,MAAM,sBAAK,IAAI,MAAM,EAAC,aAAa;CACnC,MAAMC,QAA6B;EACjC,MAAM;EACN,aAAa,OAAO;EACpB,QAAQ,OAAO;EACf,YAAY,OAAO;EACnB,MAAM,OAAO;EACb,SAAS,SAAS;EAClB,KAAK,SAAS;EACd,SAAS,SAAS;EAClB,UAAU,SAAS;EACnB,SAAS,SAAS;EAClB;EACA,WAAW;EACX,WAAW;EACZ;AACD,OAAM,IAAI,KAAK,MAAM;;AAGvB,SAAS,eACP,OACA,KACA,OACA,UACM;CACN,MAAMA,QAA6B;EACjC,GAAG;EACH,SAAS,SAAS;EAClB,KAAK,SAAS;EACd,SAAS,SAAS;EAClB,UAAU,SAAS;EACnB,SAAS,SAAS;EAClB,4BAAW,IAAI,MAAM,EAAC,aAAa;EACpC;AACD,OAAM,IAAI,KAAK,MAAM;;;;;;;AAQvB,SAAS,cAAc,QAAgB,YAA6B;AAClE,KAAI,WAAW,WAAY,QAAO;AAClC,KAAI,eAAe,IAAK,QAAO;AAC/B,QAAO,OAAO,SAAS,IAAI,aAAa,IAAI,OAAO,SAAS,WAAW;;;;;AC3PzE,eAAsB,SAAS,SAsBb;CAChB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,WAAW,QAAQ;CACzB,MAAM,aAAa,QAAQ;CAE3B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,UAAU,kBAAkB;CAClC,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,IAAIC;AACJ,KAAI,QAAQ,QAAQ;AAClB,WAAS,iBAAiB,QAAQ,OAAO;AACzC,MAAI,QAAQ,SACV,OAAM,IAAI,MACR,iHACD;;AAIL,KAAI,QAAQ,UAAU;EACpB,MAAM,YAAY,IAAI,YAAY,UAAU;EAC5C,MAAM,cAAc,IAAI,aACtB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,QAAM,YAAY,QAAQ,UAAU;EACpC,MAAM,eACJ,QAAQ,UACJ,SACA,MAAM,wBAAwB;GAC5B;GACA;GACA,KAAK;GACL;GACD,CAAC;AACR,iBAAe;GACb,UAAU,QAAQ;GAClB,SAAS;GACT,cAAc;GACd;GACA,UAAU,OAAO,OAAO;GACxB;GACA,kBAAkB,YAAY,MAAM;GACpC,oBAAoB,eAChB,uBAAuB,aAAa,GACpC;GACJ,YAAY,CAAC,CAAC,QAAQ;GACvB,CAAC;;AAGJ,KAAI,QAAQ,SAAS;AACnB,UAAQ,IAAI,0CAA0C,IAAI,KAAK;AAC/D,QAAM,QAAQ;GAAE;GAAK;GAAY,CAAC;;CAGpC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,mBAAmB,mBAAmB,OAAO;AACnD,KAAI,iBAAiB,SAAS,EAC5B,SAAQ,IACN,oDAAoD,iBAAiB,KAAK,KAAK,CAAC,GACjF;CAEH,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;AACzD,SAAQ,IAAI,YAAY;AAExB,KAAI,QAAQ;AACV,MAAI,UAAU;AACZ,OAAI,OAAO,SAAS,KAClB,OAAM,IAAI,MACR,8EACD;AAEH,OAAI,aAAa,OAAO,QACtB,OAAM,IAAI,MACR,eAAe,SAAS,8BAA8B,OAAO,QAAQ,GACtE;;AAGL,QAAM,0BAA0B,QAAQ,SAAS,OAAO;;CAM1D,MAAMC,WAAqB,EAAE;AAC7B,KAAI,SAAU,UAAS,KAAK,aAAa,WAAW;AACpD,KAAI,OAAQ,UAAS,KAAK,UAAU,OAAO,KAAK,GAAG,OAAO,UAAU;AACpE,OAAM,eACJ,SACA,SAAS,SAAS,SAAS,KAAK,KAAK,GAAG,OACzC;AAED,KAAI,OACF,SAAQ,IACN,sBAAsB,OAAO,KAAK,GAAG,OAAO,QAAQ,sDACrD;CAGH,MAAM,eAAe,QAAQ,oBACzB,IAAI,IAAI,OAAO,KAAK,MAAM,QAAQ,CAAC,CAAC,GACpC;AAKJ,oBAAmB;AAEnB,KAAI;AAUF,QAAM,uBARJ,CAAC,SACG,sBAAsB,OAAO,GAC7B,OAAO,SAAS,uBACd,sBAAsB,OAAO,CAAC,QAC3B,MAAM,EAAE,gBAAgB,OAAQ,QAClC,GACD,EAAE,EAIR,OAAO,QACP,KACA,KACA,MACD;AAWD,QAAM,eARJ,CAAC,SACG,cAAc,OAAO,GACrB,OAAO,SAAS,eACd,cAAc,OAAO,CAAC,QACnB,MAAM,EAAE,gBAAgB,OAAQ,QAClC,GACD,EAAE,EAIR,OAAO,QACP,KACA,KACA,MACD;EAED,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,OAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;GAC/C,MAAM,eAAe,0BACnB,QACA,WACA,cACA,KACA,OACD;GACD,MAAM,eAAe,iCACnB,QACA,WACA,cACA,KACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;AACD,QAAK,MAAM,OAAO,iBAAiB;AACjC,QAAI,QACF;SAAI,OAAO,SAAS,eAClB;UAAI,IAAI,SAAS,KAAM;gBACd,IAAI,SAAS,OAAO,KAC7B;;IAGJ,MAAM,SAAS,IAAI,cAAc,aAAa;IAC9C,MAAM,YACJ,UAAU,IAAI,SAAS,OAAO,OAC1B,OAAO,QACJ,MACE,EAA+B,gBAChC,OAAO,QACV,GACD;AACN,QAAI,UAAU,WAAW,EAAG;AAC5B,UAAM,IAAI,MAAM;KACd;KACA,QAAQ,OAAO;KACf;KACA;KACA;KACA;KACA;KACA;KACA;KACA,QAAQ;MAAE;MAAW;MAAc;KACpC,CAAC;;;AAYN,QAAM,gBARmB,CAAC,SACtB,eAAe,OAAO,GACtB,OAAO,SAAS,gBACd,eAAe,OAAO,CAAC,QACpB,MAAM,EAAE,gBAAgB,OAAO,QACjC,GACD,EAAE,EAIN,OAAO,QACP,KACA,WACA,KACA,MACD;AAED,QAAM,MAAM,QAAQ,IAAI;EAExB,MAAM,mCAAmB,IAAI,KAA6B;AAC1D,OAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;GAC/C,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;GACD,MAAM,iBAAiB,uBAAuB,UAAU,OAAO,OAAO;AACtE,qBACE,SAAS,WACT,gBACA,SAAS,gBACV;AACD,oBAAiB,IAAI,WAAW,eAAe;AAC/C,WAAQ,IAAI,aAAa,SAAS,gBAAgB,OAAO,YAAY;;AAGvE,QAAM,yBAAyB;GAC7B;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACD,CAAC;EAOF,MAAM,kBAAkB,oBAAoB,QAAQ;GAClD;GACA;GACA;GACA;GACA;GACD,CAAC;AACF,QAAM,oBAAoB,gBAAgB;AAC1C,MAAI,OAAO,KAAK,gBAAgB,CAAC,SAAS,EACxC,SAAQ,IACN,2BAA2B,OAAO,KAAK,gBAAgB,CAAC,OAAO,IAAI,OAAO,KAAK,gBAAgB,CAAC,KAAK,KAAK,CAAC,GAC5G;WACQ,OAAO,WAAW,MAAM,OAIjC,SAAQ,IAAI,2DAA2D;AAGzE,QAAM,iBAAiB;AACvB,QAAM,MAAM,QAAQ,IAAI;AACxB,UAAQ,IAAI,2BAA2B,MAAM;AAC7C,qBAAmB;UACZ,KAAK;AACZ,MAAI,aACF,OAAM,yBAAyB;GAC7B;GACA;GACA;GACA,OAAO;GACR,CAAC;AAEJ,QAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,MAAI;AACF,SAAM,MAAM,QAAQ,IAAI;UAClB;AAGR,QAAM;;;;;;;;;;AAWV,eAAe,yBAAyB,MAKtB;CAChB,MAAM,EAAE,KAAK,OAAO,cAAc,UAAU;CAC5C,MAAM,MAAM,MAAM,QAAQ;CAC1B,MAAM,UAAU,OAAO,KAAK,IAAI,CAAC,QAAQ,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;AACpE,KAAI,QAAQ,WAAW,GAAG;AACxB,UAAQ,KACN,kFACD;AACD;;CAEF,MAAM,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACvE,SAAQ,KACN,iBAAiB,SAAS,kBAAkB,QAAQ,OAAO,qBAC5D;CACD,MAAM,oBAAoB,IAAI,IAG5B,gBAAgB,KAAK,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACpD,MAAK,MAAM,OAAO,QAAQ,SAAS,EAAE;EACnC,MAAM,QAAQ,IAAI;AAClB,MAAI,CAAC,MAAO;AACZ,MAAI,MAAM,SAAS,eAAe;AAChC,OAAI;AACF,UAAM,IAAI,wBAAwB,MAAM,QAAQ;AAChD,UAAM,OAAO,IAAI;YACV,KAAK;AACZ,YAAQ,KACN,0CAA0C,MAAM,QAAQ,IACxD,IACD;;AAEH;;EAEF,MAAM,MAAM,kBAAkB,IAAI,MAAM,KAAK;AAC7C,MAAI,CAAC,KAAK;AACR,WAAQ,KACN,wCAAwC,MAAM,KAAK,UAAU,IAAI,uBAClE;AACD;;AAEF,QAAM,IAAI,WAAW;GAAE;GAAK;GAAO;GAAK;GAAO,CAAC"}

package/dist/{applyTarget-q8lQlmL6.mjs → applyTarget-IwJLJY-2.mjs}

@@ -1,5 +1,5 @@
 import { f as getDispatchNamespaces, m as getLogpushJobs, p as getDnsRecords } from "./normalize-DVSTRZhO.mjs";
-import { a as logicalNamesForResourceKind, n as resourceModules } from "./registry-Du91dVUE.mjs";
+import { a as logicalNamesForResourceKind, n as resourceModules } from "./registry-BlTu3xMp.mjs";
 import { a as effectiveDnsRecordProxied, i as effectiveDnsRecordComment, o as effectiveDnsRecordTtl, r as dnsRecordStateKey, t as dnsRecordAppliesToEnv } from "./dns-records.resolve-DV6XBZf3.mjs";
 
 //#region src/features/dns-records/dns-records.diff.ts
@@ -149,4 +149,4 @@ function filterPlanItemsForTarget(items, target) {
 
 //#endregion
 export { dnsRecordDiffPlanItems as a, computeDnsRecordMutableChanges as i, filterPlanItemsForTarget as n, parseApplyTarget as r, assertApplyTargetDeclared as t };
-//# sourceMappingURL=applyTarget-q8lQlmL6.mjs.map
+//# sourceMappingURL=applyTarget-IwJLJY-2.mjs.map

package/dist/{applyTarget-q8lQlmL6.mjs.map → applyTarget-IwJLJY-2.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"applyTarget-q8lQlmL6.mjs","names":["items: PlanItem[]","changes: PlanFieldChange[]","APPLY_TARGET_KINDS: ReadonlySet<string>"],"sources":["../src/features/dns-records/dns-records.diff.ts","../src/core/apply/applyTarget.ts"],"sourcesContent":["/**\n * Plan-time field-level diff for declared DNS records. Pure: takes the\n * already-recorded {@link DnsRecordStateEntry} and the {@link\n * DnsRecordResourceConfig} the user wrote, and returns the\n * `update` / `replace` items `tamer plan` should emit.\n *\n * Mirrors the patch + delete-and-recreate decision tree in\n * {@link dnsRecordApply}:\n *   - `type` change → `replace` (Cloudflare's API rejects PATCH on type per\n *     https://developers.cloudflare.com/fundamentals/api/reference/deprecations/).\n *   - any of `content` / `ttl` / `proxied` / `priority` / `comment` differ →\n *     `update` (in-place PATCH).\n *\n * Records that don't yet have a state row are reported by `dnsRecordDrift`\n * as `undeployed` instead — those become `create` items. Records that\n * `apply` would skip (env-skipped, missing zone) are excluded here.\n */\n\nimport type {\n  DnsRecordResourceConfig,\n  DnsRecordStateEntry,\n  TenantMeta,\n} from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { PlanFieldChange, PlanItem } from \"../../core/plan/plan.types.js\";\nimport {\n  dnsRecordAppliesToEnv,\n  dnsRecordStateKey,\n  effectiveDnsRecordComment,\n  effectiveDnsRecordProxied,\n  effectiveDnsRecordTtl,\n} from \"./dns-records.resolve.js\";\n\nexport function dnsRecordDiffPlanItems(args: {\n  resources: DnsRecordResourceConfig[];\n  tenant: TenantMeta;\n  env: string;\n  state: StateManager;\n}): PlanItem[] {\n  const { resources, tenant, env, state } = args;\n  const items: PlanItem[] = [];\n\n  for (const config of resources) {\n    if (!dnsRecordAppliesToEnv(config, env)) continue;\n    const key = dnsRecordStateKey(config.zoneId, config.type, config.name);\n    const entry = state.get(key);\n    if (!entry || entry.type !== \"dns_record\") continue;\n\n    const stateEntry = entry as DnsRecordStateEntry;\n    if (stateEntry.recordType !== config.type) {\n      items.push({\n        kind: \"dns_record\",\n        action: \"replace\",\n        logicalName: config.logicalName,\n        derivedName: `${config.type} ${config.name}`,\n        detail: `type ${stateEntry.recordType} -> ${config.type} (delete + recreate)`,\n        changes: [\n          {\n            field: \"type\",\n            from: stateEntry.recordType,\n            to: config.type,\n            kind: \"immutable\",\n          },\n        ],\n      });\n      continue;\n    }\n\n    const changes = computeMutableChanges(stateEntry, config, tenant, env);\n    if (changes.length === 0) continue;\n    items.push({\n      kind: \"dns_record\",\n      action: \"update\",\n      logicalName: config.logicalName,\n      derivedName: `${config.type} ${config.name}`,\n      detail: changes\n        .map((c) => `${c.field}: ${formatVal(c.from)} -> ${formatVal(c.to)}`)\n        .join(\", \"),\n      changes,\n    });\n  }\n\n  return items;\n}\n\n/**\n * Pure comparison shared with `dnsRecordApply` so plan and apply agree\n * on what counts as drift on the mutable record fields. Excludes the\n * `type` change — that's an immutable replace handled separately.\n */\nexport function computeDnsRecordMutableChanges(\n  state: DnsRecordStateEntry,\n  config: DnsRecordResourceConfig,\n  tenant: TenantMeta,\n  env: string,\n): PlanFieldChange[] {\n  return computeMutableChanges(state, config, tenant, env);\n}\n\nfunction computeMutableChanges(\n  state: DnsRecordStateEntry,\n  config: DnsRecordResourceConfig,\n  tenant: TenantMeta,\n  env: string,\n): PlanFieldChange[] {\n  const expectedTtl = effectiveDnsRecordTtl(config);\n  const expectedProxied = effectiveDnsRecordProxied(config);\n  const expectedComment = effectiveDnsRecordComment(\n    config,\n    tenant,\n    env,\n  );\n\n  const changes: PlanFieldChange[] = [];\n  if (state.content !== config.content) {\n    changes.push({\n      field: \"content\",\n      from: state.content,\n      to: config.content,\n      kind: \"mutable\",\n    });\n  }\n  if (state.ttl !== expectedTtl) {\n    changes.push({\n      field: \"ttl\",\n      from: state.ttl,\n      to: expectedTtl,\n      kind: \"mutable\",\n    });\n  }\n  if (state.proxied !== expectedProxied) {\n    changes.push({\n      field: \"proxied\",\n      from: state.proxied,\n      to: expectedProxied,\n      kind: \"mutable\",\n    });\n  }\n  if (\n    config.priority !== undefined &&\n    state.priority !== config.priority\n  ) {\n    changes.push({\n      field: \"priority\",\n      from: state.priority,\n      to: config.priority,\n      kind: \"mutable\",\n    });\n  }\n  if (state.comment !== expectedComment) {\n    changes.push({\n      field: \"comment\",\n      from: state.comment,\n      to: expectedComment,\n      kind: \"mutable\",\n    });\n  }\n  return changes;\n}\n\nfunction formatVal(v: unknown): string {\n  if (v === undefined) return \"(unset)\";\n  if (typeof v === \"string\") return v.length > 32 ? `${v.slice(0, 29)}...` : v;\n  return String(v);\n}\n","import type { CfiConfig } from \"../../types.js\";\nimport {\n  getDispatchNamespaces,\n  getDnsRecords,\n  getLogpushJobs,\n} from \"../../types.js\";\nimport { logicalNamesForResourceKind } from \"../config/resourcesFromConfig.js\";\nimport type { ResourceKind } from \"../registry/registry.js\";\nimport { resourceModules } from \"../registry/registry.js\";\nimport type { PlanItem } from \"../plan/plan.types.js\";\n\nconst APPLY_TARGET_KINDS: ReadonlySet<string> = new Set([\n  ...resourceModules.map((m) => m.kind),\n  \"dispatch_namespace\",\n  \"dns_record\",\n  \"logpush_job\",\n]);\n\nexport type ApplyTargetKind =\n  | ResourceKind\n  | \"dispatch_namespace\"\n  | \"dns_record\"\n  | \"logpush_job\";\n\nexport interface ApplyTarget {\n  kind: ApplyTargetKind;\n  logical: string;\n}\n\n/**\n * Parse `tamer apply --target` / `tamer plan --target` (`d1:settings`,\n * `dispatch_namespace:workspace`, …). Not valid for `worker_route` /\n * `worker_script` (routes deploy with `tamer deploy`; scripts with wrangler).\n */\nexport function parseApplyTarget(raw: string): ApplyTarget {\n  const idx = raw.indexOf(\":\");\n  if (idx < 1 || idx === raw.length - 1) {\n    throw new Error(\n      `Invalid --target \"${raw}\": expected <kind>:<logicalName> (e.g. d1:settings, dns_record:apex_txt)`,\n    );\n  }\n  const kind = raw.slice(0, idx);\n  const logical = raw.slice(idx + 1);\n  if (!logical.trim()) {\n    throw new Error(\n      `Invalid --target \"${raw}\": missing logical name after \":\"`,\n    );\n  }\n  if (kind === \"worker_route\" || kind === \"worker_script\") {\n    throw new Error(\n      `--target ${kind}:… is not supported here (worker routes are applied on \\`tamer deploy\\`; scripts via wrangler). Omit --target or pass a resource kind.`,\n    );\n  }\n  if (!APPLY_TARGET_KINDS.has(kind)) {\n    const list = [...APPLY_TARGET_KINDS].sort().join(\", \");\n    throw new Error(\n      `Unknown resource kind in --target: \"${kind}\". Expected one of: ${list}`,\n    );\n  }\n  return { kind: kind as ApplyTargetKind, logical };\n}\n\nexport async function assertApplyTargetDeclared(\n  config: CfiConfig,\n  baseDir: string,\n  target: ApplyTarget,\n): Promise<void> {\n  if (target.kind === \"dispatch_namespace\") {\n    const names = getDispatchNamespaces(config).map((n) => n.logicalName);\n    if (!names.includes(target.logical)) {\n      throw new Error(\n        `No dispatch_namespace \"${target.logical}\" in the Tamer project config. Declared: ${names.length ? names.join(\", \") : \"(none)\"}`,\n      );\n    }\n    return;\n  }\n  if (target.kind === \"dns_record\") {\n    const names = getDnsRecords(config).map((d) => d.logicalName);\n    if (!names.includes(target.logical)) {\n      throw new Error(\n        `No dns_record \"${target.logical}\" in the Tamer project config. Declared: ${names.length ? names.join(\", \") : \"(none)\"}`,\n      );\n    }\n    return;\n  }\n  if (target.kind === \"logpush_job\") {\n    const names = getLogpushJobs(config).map((j) => j.logicalName);\n    if (!names.includes(target.logical)) {\n      throw new Error(\n        `No logpush_job \"${target.logical}\" in the Tamer project config. Declared: ${names.length ? names.join(\", \") : \"(none)\"}`,\n      );\n    }\n    return;\n  }\n  const set = await logicalNamesForResourceKind(config, baseDir, target.kind);\n  if (!set.has(target.logical)) {\n    const arr = [...set].sort();\n    throw new Error(\n      `No ${target.kind} resource \"${target.logical}\" in the Tamer project config for this stack. Declared ${target.kind}: ${arr.length ? arr.join(\", \") : \"(none)\"}`,\n    );\n  }\n}\n\nexport function filterPlanItemsForTarget(\n  items: PlanItem[],\n  target: ApplyTarget,\n): PlanItem[] {\n  return items.filter(\n    (it) => it.kind === target.kind && it.logicalName === target.logical,\n  );\n}\n"],"mappings":";;;;;AAiCA,SAAgB,uBAAuB,MAKxB;CACb,MAAM,EAAE,WAAW,QAAQ,KAAK,UAAU;CAC1C,MAAMA,QAAoB,EAAE;AAE5B,MAAK,MAAM,UAAU,WAAW;AAC9B,MAAI,CAAC,sBAAsB,QAAQ,IAAI,CAAE;EACzC,MAAM,MAAM,kBAAkB,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK;EACtE,MAAM,QAAQ,MAAM,IAAI,IAAI;AAC5B,MAAI,CAAC,SAAS,MAAM,SAAS,aAAc;EAE3C,MAAM,aAAa;AACnB,MAAI,WAAW,eAAe,OAAO,MAAM;AACzC,SAAM,KAAK;IACT,MAAM;IACN,QAAQ;IACR,aAAa,OAAO;IACpB,aAAa,GAAG,OAAO,KAAK,GAAG,OAAO;IACtC,QAAQ,QAAQ,WAAW,WAAW,MAAM,OAAO,KAAK;IACxD,SAAS,CACP;KACE,OAAO;KACP,MAAM,WAAW;KACjB,IAAI,OAAO;KACX,MAAM;KACP,CACF;IACF,CAAC;AACF;;EAGF,MAAM,UAAU,sBAAsB,YAAY,QAAQ,QAAQ,IAAI;AACtE,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,KAAK;GACT,MAAM;GACN,QAAQ;GACR,aAAa,OAAO;GACpB,aAAa,GAAG,OAAO,KAAK,GAAG,OAAO;GACtC,QAAQ,QACL,KAAK,MAAM,GAAG,EAAE,MAAM,IAAI,UAAU,EAAE,KAAK,CAAC,MAAM,UAAU,EAAE,GAAG,GAAG,CACpE,KAAK,KAAK;GACb;GACD,CAAC;;AAGJ,QAAO;;;;;;;AAQT,SAAgB,+BACd,OACA,QACA,QACA,KACmB;AACnB,QAAO,sBAAsB,OAAO,QAAQ,QAAQ,IAAI;;AAG1D,SAAS,sBACP,OACA,QACA,QACA,KACmB;CACnB,MAAM,cAAc,sBAAsB,OAAO;CACjD,MAAM,kBAAkB,0BAA0B,OAAO;CACzD,MAAM,kBAAkB,0BACtB,QACA,QACA,IACD;CAED,MAAMC,UAA6B,EAAE;AACrC,KAAI,MAAM,YAAY,OAAO,QAC3B,SAAQ,KAAK;EACX,OAAO;EACP,MAAM,MAAM;EACZ,IAAI,OAAO;EACX,MAAM;EACP,CAAC;AAEJ,KAAI,MAAM,QAAQ,YAChB,SAAQ,KAAK;EACX,OAAO;EACP,MAAM,MAAM;EACZ,IAAI;EACJ,MAAM;EACP,CAAC;AAEJ,KAAI,MAAM,YAAY,gBACpB,SAAQ,KAAK;EACX,OAAO;EACP,MAAM,MAAM;EACZ,IAAI;EACJ,MAAM;EACP,CAAC;AAEJ,KACE,OAAO,aAAa,UACpB,MAAM,aAAa,OAAO,SAE1B,SAAQ,KAAK;EACX,OAAO;EACP,MAAM,MAAM;EACZ,IAAI,OAAO;EACX,MAAM;EACP,CAAC;AAEJ,KAAI,MAAM,YAAY,gBACpB,SAAQ,KAAK;EACX,OAAO;EACP,MAAM,MAAM;EACZ,IAAI;EACJ,MAAM;EACP,CAAC;AAEJ,QAAO;;AAGT,SAAS,UAAU,GAAoB;AACrC,KAAI,MAAM,OAAW,QAAO;AAC5B,KAAI,OAAO,MAAM,SAAU,QAAO,EAAE,SAAS,KAAK,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,OAAO;AAC3E,QAAO,OAAO,EAAE;;;;;ACxJlB,MAAMC,qBAA0C,IAAI,IAAI;CACtD,GAAG,gBAAgB,KAAK,MAAM,EAAE,KAAK;CACrC;CACA;CACA;CACD,CAAC;;;;;;AAkBF,SAAgB,iBAAiB,KAA0B;CACzD,MAAM,MAAM,IAAI,QAAQ,IAAI;AAC5B,KAAI,MAAM,KAAK,QAAQ,IAAI,SAAS,EAClC,OAAM,IAAI,MACR,qBAAqB,IAAI,0EAC1B;CAEH,MAAM,OAAO,IAAI,MAAM,GAAG,IAAI;CAC9B,MAAM,UAAU,IAAI,MAAM,MAAM,EAAE;AAClC,KAAI,CAAC,QAAQ,MAAM,CACjB,OAAM,IAAI,MACR,qBAAqB,IAAI,mCAC1B;AAEH,KAAI,SAAS,kBAAkB,SAAS,gBACtC,OAAM,IAAI,MACR,YAAY,KAAK,wIAClB;AAEH,KAAI,CAAC,mBAAmB,IAAI,KAAK,EAAE;EACjC,MAAM,OAAO,CAAC,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,KAAK;AACtD,QAAM,IAAI,MACR,uCAAuC,KAAK,sBAAsB,OACnE;;AAEH,QAAO;EAAQ;EAAyB;EAAS;;AAGnD,eAAsB,0BACpB,QACA,SACA,QACe;AACf,KAAI,OAAO,SAAS,sBAAsB;EACxC,MAAM,QAAQ,sBAAsB,OAAO,CAAC,KAAK,MAAM,EAAE,YAAY;AACrE,MAAI,CAAC,MAAM,SAAS,OAAO,QAAQ,CACjC,OAAM,IAAI,MACR,0BAA0B,OAAO,QAAQ,2CAA2C,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG,WACvH;AAEH;;AAEF,KAAI,OAAO,SAAS,cAAc;EAChC,MAAM,QAAQ,cAAc,OAAO,CAAC,KAAK,MAAM,EAAE,YAAY;AAC7D,MAAI,CAAC,MAAM,SAAS,OAAO,QAAQ,CACjC,OAAM,IAAI,MACR,kBAAkB,OAAO,QAAQ,2CAA2C,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG,WAC/G;AAEH;;AAEF,KAAI,OAAO,SAAS,eAAe;EACjC,MAAM,QAAQ,eAAe,OAAO,CAAC,KAAK,MAAM,EAAE,YAAY;AAC9D,MAAI,CAAC,MAAM,SAAS,OAAO,QAAQ,CACjC,OAAM,IAAI,MACR,mBAAmB,OAAO,QAAQ,2CAA2C,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG,WAChH;AAEH;;CAEF,MAAM,MAAM,MAAM,4BAA4B,QAAQ,SAAS,OAAO,KAAK;AAC3E,KAAI,CAAC,IAAI,IAAI,OAAO,QAAQ,EAAE;EAC5B,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM;AAC3B,QAAM,IAAI,MACR,MAAM,OAAO,KAAK,aAAa,OAAO,QAAQ,yDAAyD,OAAO,KAAK,IAAI,IAAI,SAAS,IAAI,KAAK,KAAK,GAAG,WACtJ;;;AAIL,SAAgB,yBACd,OACA,QACY;AACZ,QAAO,MAAM,QACV,OAAO,GAAG,SAAS,OAAO,QAAQ,GAAG,gBAAgB,OAAO,QAC9D"}
+{"version":3,"file":"applyTarget-IwJLJY-2.mjs","names":["items: PlanItem[]","changes: PlanFieldChange[]","APPLY_TARGET_KINDS: ReadonlySet<string>"],"sources":["../src/features/dns-records/dns-records.diff.ts","../src/core/apply/applyTarget.ts"],"sourcesContent":["/**\n * Plan-time field-level diff for declared DNS records. Pure: takes the\n * already-recorded {@link DnsRecordStateEntry} and the {@link\n * DnsRecordResourceConfig} the user wrote, and returns the\n * `update` / `replace` items `tamer plan` should emit.\n *\n * Mirrors the patch + delete-and-recreate decision tree in\n * {@link dnsRecordApply}:\n *   - `type` change → `replace` (Cloudflare's API rejects PATCH on type per\n *     https://developers.cloudflare.com/fundamentals/api/reference/deprecations/).\n *   - any of `content` / `ttl` / `proxied` / `priority` / `comment` differ →\n *     `update` (in-place PATCH).\n *\n * Records that don't yet have a state row are reported by `dnsRecordDrift`\n * as `undeployed` instead — those become `create` items. Records that\n * `apply` would skip (env-skipped, missing zone) are excluded here.\n */\n\nimport type {\n  DnsRecordResourceConfig,\n  DnsRecordStateEntry,\n  TenantMeta,\n} from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { PlanFieldChange, PlanItem } from \"../../core/plan/plan.types.js\";\nimport {\n  dnsRecordAppliesToEnv,\n  dnsRecordStateKey,\n  effectiveDnsRecordComment,\n  effectiveDnsRecordProxied,\n  effectiveDnsRecordTtl,\n} from \"./dns-records.resolve.js\";\n\nexport function dnsRecordDiffPlanItems(args: {\n  resources: DnsRecordResourceConfig[];\n  tenant: TenantMeta;\n  env: string;\n  state: StateManager;\n}): PlanItem[] {\n  const { resources, tenant, env, state } = args;\n  const items: PlanItem[] = [];\n\n  for (const config of resources) {\n    if (!dnsRecordAppliesToEnv(config, env)) continue;\n    const key = dnsRecordStateKey(config.zoneId, config.type, config.name);\n    const entry = state.get(key);\n    if (!entry || entry.type !== \"dns_record\") continue;\n\n    const stateEntry = entry as DnsRecordStateEntry;\n    if (stateEntry.recordType !== config.type) {\n      items.push({\n        kind: \"dns_record\",\n        action: \"replace\",\n        logicalName: config.logicalName,\n        derivedName: `${config.type} ${config.name}`,\n        detail: `type ${stateEntry.recordType} -> ${config.type} (delete + recreate)`,\n        changes: [\n          {\n            field: \"type\",\n            from: stateEntry.recordType,\n            to: config.type,\n            kind: \"immutable\",\n          },\n        ],\n      });\n      continue;\n    }\n\n    const changes = computeMutableChanges(stateEntry, config, tenant, env);\n    if (changes.length === 0) continue;\n    items.push({\n      kind: \"dns_record\",\n      action: \"update\",\n      logicalName: config.logicalName,\n      derivedName: `${config.type} ${config.name}`,\n      detail: changes\n        .map((c) => `${c.field}: ${formatVal(c.from)} -> ${formatVal(c.to)}`)\n        .join(\", \"),\n      changes,\n    });\n  }\n\n  return items;\n}\n\n/**\n * Pure comparison shared with `dnsRecordApply` so plan and apply agree\n * on what counts as drift on the mutable record fields. Excludes the\n * `type` change — that's an immutable replace handled separately.\n */\nexport function computeDnsRecordMutableChanges(\n  state: DnsRecordStateEntry,\n  config: DnsRecordResourceConfig,\n  tenant: TenantMeta,\n  env: string,\n): PlanFieldChange[] {\n  return computeMutableChanges(state, config, tenant, env);\n}\n\nfunction computeMutableChanges(\n  state: DnsRecordStateEntry,\n  config: DnsRecordResourceConfig,\n  tenant: TenantMeta,\n  env: string,\n): PlanFieldChange[] {\n  const expectedTtl = effectiveDnsRecordTtl(config);\n  const expectedProxied = effectiveDnsRecordProxied(config);\n  const expectedComment = effectiveDnsRecordComment(\n    config,\n    tenant,\n    env,\n  );\n\n  const changes: PlanFieldChange[] = [];\n  if (state.content !== config.content) {\n    changes.push({\n      field: \"content\",\n      from: state.content,\n      to: config.content,\n      kind: \"mutable\",\n    });\n  }\n  if (state.ttl !== expectedTtl) {\n    changes.push({\n      field: \"ttl\",\n      from: state.ttl,\n      to: expectedTtl,\n      kind: \"mutable\",\n    });\n  }\n  if (state.proxied !== expectedProxied) {\n    changes.push({\n      field: \"proxied\",\n      from: state.proxied,\n      to: expectedProxied,\n      kind: \"mutable\",\n    });\n  }\n  if (\n    config.priority !== undefined &&\n    state.priority !== config.priority\n  ) {\n    changes.push({\n      field: \"priority\",\n      from: state.priority,\n      to: config.priority,\n      kind: \"mutable\",\n    });\n  }\n  if (state.comment !== expectedComment) {\n    changes.push({\n      field: \"comment\",\n      from: state.comment,\n      to: expectedComment,\n      kind: \"mutable\",\n    });\n  }\n  return changes;\n}\n\nfunction formatVal(v: unknown): string {\n  if (v === undefined) return \"(unset)\";\n  if (typeof v === \"string\") return v.length > 32 ? `${v.slice(0, 29)}...` : v;\n  return String(v);\n}\n","import type { CfiConfig } from \"../../types.js\";\nimport {\n  getDispatchNamespaces,\n  getDnsRecords,\n  getLogpushJobs,\n} from \"../../types.js\";\nimport { logicalNamesForResourceKind } from \"../config/resourcesFromConfig.js\";\nimport type { ResourceKind } from \"../registry/registry.js\";\nimport { resourceModules } from \"../registry/registry.js\";\nimport type { PlanItem } from \"../plan/plan.types.js\";\n\nconst APPLY_TARGET_KINDS: ReadonlySet<string> = new Set([\n  ...resourceModules.map((m) => m.kind),\n  \"dispatch_namespace\",\n  \"dns_record\",\n  \"logpush_job\",\n]);\n\nexport type ApplyTargetKind =\n  | ResourceKind\n  | \"dispatch_namespace\"\n  | \"dns_record\"\n  | \"logpush_job\";\n\nexport interface ApplyTarget {\n  kind: ApplyTargetKind;\n  logical: string;\n}\n\n/**\n * Parse `tamer apply --target` / `tamer plan --target` (`d1:settings`,\n * `dispatch_namespace:workspace`, …). Not valid for `worker_route` /\n * `worker_script` (routes deploy with `tamer deploy`; scripts with wrangler).\n */\nexport function parseApplyTarget(raw: string): ApplyTarget {\n  const idx = raw.indexOf(\":\");\n  if (idx < 1 || idx === raw.length - 1) {\n    throw new Error(\n      `Invalid --target \"${raw}\": expected <kind>:<logicalName> (e.g. d1:settings, dns_record:apex_txt)`,\n    );\n  }\n  const kind = raw.slice(0, idx);\n  const logical = raw.slice(idx + 1);\n  if (!logical.trim()) {\n    throw new Error(\n      `Invalid --target \"${raw}\": missing logical name after \":\"`,\n    );\n  }\n  if (kind === \"worker_route\" || kind === \"worker_script\") {\n    throw new Error(\n      `--target ${kind}:… is not supported here (worker routes are applied on \\`tamer deploy\\`; scripts via wrangler). Omit --target or pass a resource kind.`,\n    );\n  }\n  if (!APPLY_TARGET_KINDS.has(kind)) {\n    const list = [...APPLY_TARGET_KINDS].sort().join(\", \");\n    throw new Error(\n      `Unknown resource kind in --target: \"${kind}\". Expected one of: ${list}`,\n    );\n  }\n  return { kind: kind as ApplyTargetKind, logical };\n}\n\nexport async function assertApplyTargetDeclared(\n  config: CfiConfig,\n  baseDir: string,\n  target: ApplyTarget,\n): Promise<void> {\n  if (target.kind === \"dispatch_namespace\") {\n    const names = getDispatchNamespaces(config).map((n) => n.logicalName);\n    if (!names.includes(target.logical)) {\n      throw new Error(\n        `No dispatch_namespace \"${target.logical}\" in the Tamer project config. Declared: ${names.length ? names.join(\", \") : \"(none)\"}`,\n      );\n    }\n    return;\n  }\n  if (target.kind === \"dns_record\") {\n    const names = getDnsRecords(config).map((d) => d.logicalName);\n    if (!names.includes(target.logical)) {\n      throw new Error(\n        `No dns_record \"${target.logical}\" in the Tamer project config. Declared: ${names.length ? names.join(\", \") : \"(none)\"}`,\n      );\n    }\n    return;\n  }\n  if (target.kind === \"logpush_job\") {\n    const names = getLogpushJobs(config).map((j) => j.logicalName);\n    if (!names.includes(target.logical)) {\n      throw new Error(\n        `No logpush_job \"${target.logical}\" in the Tamer project config. Declared: ${names.length ? names.join(\", \") : \"(none)\"}`,\n      );\n    }\n    return;\n  }\n  const set = await logicalNamesForResourceKind(config, baseDir, target.kind);\n  if (!set.has(target.logical)) {\n    const arr = [...set].sort();\n    throw new Error(\n      `No ${target.kind} resource \"${target.logical}\" in the Tamer project config for this stack. Declared ${target.kind}: ${arr.length ? arr.join(\", \") : \"(none)\"}`,\n    );\n  }\n}\n\nexport function filterPlanItemsForTarget(\n  items: PlanItem[],\n  target: ApplyTarget,\n): PlanItem[] {\n  return items.filter(\n    (it) => it.kind === target.kind && it.logicalName === target.logical,\n  );\n}\n"],"mappings":";;;;;AAiCA,SAAgB,uBAAuB,MAKxB;CACb,MAAM,EAAE,WAAW,QAAQ,KAAK,UAAU;CAC1C,MAAMA,QAAoB,EAAE;AAE5B,MAAK,MAAM,UAAU,WAAW;AAC9B,MAAI,CAAC,sBAAsB,QAAQ,IAAI,CAAE;EACzC,MAAM,MAAM,kBAAkB,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK;EACtE,MAAM,QAAQ,MAAM,IAAI,IAAI;AAC5B,MAAI,CAAC,SAAS,MAAM,SAAS,aAAc;EAE3C,MAAM,aAAa;AACnB,MAAI,WAAW,eAAe,OAAO,MAAM;AACzC,SAAM,KAAK;IACT,MAAM;IACN,QAAQ;IACR,aAAa,OAAO;IACpB,aAAa,GAAG,OAAO,KAAK,GAAG,OAAO;IACtC,QAAQ,QAAQ,WAAW,WAAW,MAAM,OAAO,KAAK;IACxD,SAAS,CACP;KACE,OAAO;KACP,MAAM,WAAW;KACjB,IAAI,OAAO;KACX,MAAM;KACP,CACF;IACF,CAAC;AACF;;EAGF,MAAM,UAAU,sBAAsB,YAAY,QAAQ,QAAQ,IAAI;AACtE,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,KAAK;GACT,MAAM;GACN,QAAQ;GACR,aAAa,OAAO;GACpB,aAAa,GAAG,OAAO,KAAK,GAAG,OAAO;GACtC,QAAQ,QACL,KAAK,MAAM,GAAG,EAAE,MAAM,IAAI,UAAU,EAAE,KAAK,CAAC,MAAM,UAAU,EAAE,GAAG,GAAG,CACpE,KAAK,KAAK;GACb;GACD,CAAC;;AAGJ,QAAO;;;;;;;AAQT,SAAgB,+BACd,OACA,QACA,QACA,KACmB;AACnB,QAAO,sBAAsB,OAAO,QAAQ,QAAQ,IAAI;;AAG1D,SAAS,sBACP,OACA,QACA,QACA,KACmB;CACnB,MAAM,cAAc,sBAAsB,OAAO;CACjD,MAAM,kBAAkB,0BAA0B,OAAO;CACzD,MAAM,kBAAkB,0BACtB,QACA,QACA,IACD;CAED,MAAMC,UAA6B,EAAE;AACrC,KAAI,MAAM,YAAY,OAAO,QAC3B,SAAQ,KAAK;EACX,OAAO;EACP,MAAM,MAAM;EACZ,IAAI,OAAO;EACX,MAAM;EACP,CAAC;AAEJ,KAAI,MAAM,QAAQ,YAChB,SAAQ,KAAK;EACX,OAAO;EACP,MAAM,MAAM;EACZ,IAAI;EACJ,MAAM;EACP,CAAC;AAEJ,KAAI,MAAM,YAAY,gBACpB,SAAQ,KAAK;EACX,OAAO;EACP,MAAM,MAAM;EACZ,IAAI;EACJ,MAAM;EACP,CAAC;AAEJ,KACE,OAAO,aAAa,UACpB,MAAM,aAAa,OAAO,SAE1B,SAAQ,KAAK;EACX,OAAO;EACP,MAAM,MAAM;EACZ,IAAI,OAAO;EACX,MAAM;EACP,CAAC;AAEJ,KAAI,MAAM,YAAY,gBACpB,SAAQ,KAAK;EACX,OAAO;EACP,MAAM,MAAM;EACZ,IAAI;EACJ,MAAM;EACP,CAAC;AAEJ,QAAO;;AAGT,SAAS,UAAU,GAAoB;AACrC,KAAI,MAAM,OAAW,QAAO;AAC5B,KAAI,OAAO,MAAM,SAAU,QAAO,EAAE,SAAS,KAAK,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,OAAO;AAC3E,QAAO,OAAO,EAAE;;;;;ACxJlB,MAAMC,qBAA0C,IAAI,IAAI;CACtD,GAAG,gBAAgB,KAAK,MAAM,EAAE,KAAK;CACrC;CACA;CACA;CACD,CAAC;;;;;;AAkBF,SAAgB,iBAAiB,KAA0B;CACzD,MAAM,MAAM,IAAI,QAAQ,IAAI;AAC5B,KAAI,MAAM,KAAK,QAAQ,IAAI,SAAS,EAClC,OAAM,IAAI,MACR,qBAAqB,IAAI,0EAC1B;CAEH,MAAM,OAAO,IAAI,MAAM,GAAG,IAAI;CAC9B,MAAM,UAAU,IAAI,MAAM,MAAM,EAAE;AAClC,KAAI,CAAC,QAAQ,MAAM,CACjB,OAAM,IAAI,MACR,qBAAqB,IAAI,mCAC1B;AAEH,KAAI,SAAS,kBAAkB,SAAS,gBACtC,OAAM,IAAI,MACR,YAAY,KAAK,wIAClB;AAEH,KAAI,CAAC,mBAAmB,IAAI,KAAK,EAAE;EACjC,MAAM,OAAO,CAAC,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,KAAK;AACtD,QAAM,IAAI,MACR,uCAAuC,KAAK,sBAAsB,OACnE;;AAEH,QAAO;EAAQ;EAAyB;EAAS;;AAGnD,eAAsB,0BACpB,QACA,SACA,QACe;AACf,KAAI,OAAO,SAAS,sBAAsB;EACxC,MAAM,QAAQ,sBAAsB,OAAO,CAAC,KAAK,MAAM,EAAE,YAAY;AACrE,MAAI,CAAC,MAAM,SAAS,OAAO,QAAQ,CACjC,OAAM,IAAI,MACR,0BAA0B,OAAO,QAAQ,2CAA2C,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG,WACvH;AAEH;;AAEF,KAAI,OAAO,SAAS,cAAc;EAChC,MAAM,QAAQ,cAAc,OAAO,CAAC,KAAK,MAAM,EAAE,YAAY;AAC7D,MAAI,CAAC,MAAM,SAAS,OAAO,QAAQ,CACjC,OAAM,IAAI,MACR,kBAAkB,OAAO,QAAQ,2CAA2C,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG,WAC/G;AAEH;;AAEF,KAAI,OAAO,SAAS,eAAe;EACjC,MAAM,QAAQ,eAAe,OAAO,CAAC,KAAK,MAAM,EAAE,YAAY;AAC9D,MAAI,CAAC,MAAM,SAAS,OAAO,QAAQ,CACjC,OAAM,IAAI,MACR,mBAAmB,OAAO,QAAQ,2CAA2C,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG,WAChH;AAEH;;CAEF,MAAM,MAAM,MAAM,4BAA4B,QAAQ,SAAS,OAAO,KAAK;AAC3E,KAAI,CAAC,IAAI,IAAI,OAAO,QAAQ,EAAE;EAC5B,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM;AAC3B,QAAM,IAAI,MACR,MAAM,OAAO,KAAK,aAAa,OAAO,QAAQ,yDAAyD,OAAO,KAAK,IAAI,IAAI,SAAS,IAAI,KAAK,KAAK,GAAG,WACtJ;;;AAIL,SAAgB,yBACd,OACA,QACY;AACZ,QAAO,MAAM,QACV,OAAO,GAAG,SAAS,OAAO,QAAQ,GAAG,gBAAgB,OAAO,QAC9D"}

package/dist/{cloudflareSnapshot-D9LAgUVP.mjs → cloudflareSnapshot-DOphOBnH.mjs}

@@ -1,6 +1,6 @@
 import { f as getDispatchNamespaces, m as getLogpushJobs, p as getDnsRecords } from "./normalize-DVSTRZhO.mjs";
 import { B as getWorkers, C as stackNameForConfig, L as cloudflareAccountIdFromEnv, T as mergeWorkerConfigForResourcePick, f as fetchStackImports, h as StateManager, u as namingFromConfig } from "./tamer.mjs";
-import { n as resourceModules } from "./registry-Du91dVUE.mjs";
+import { n as resourceModules } from "./registry-BlTu3xMp.mjs";
 import { n as dispatchNamespaceSync, t as dnsRecordSync } from "./dns-records.sync-PoahWQjY.mjs";
 import { i as logpushJobSync } from "./logpush-job-GqVKG_HI.mjs";
 import { readFileSync, writeFileSync } from "fs";
@@ -158,4 +158,4 @@ function stripVolatile(entry) {
 
 //#endregion
 export { readPlanFile as a, hashCloudflareSnapshot as i, PLAN_FILE_FORMAT as n, writePlanFile as o, computeAttestation as r, buildCloudflareSnapshot as t };
-//# sourceMappingURL=cloudflareSnapshot-D9LAgUVP.mjs.map
+//# sourceMappingURL=cloudflareSnapshot-DOphOBnH.mjs.map

package/dist/{cloudflareSnapshot-D9LAgUVP.mjs.map → cloudflareSnapshot-DOphOBnH.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"cloudflareSnapshot-D9LAgUVP.mjs","names":["att: PlanAttestation","raw: string","parsed: unknown","stable: CloudflareSnapshot","out: Record<string, unknown>"],"sources":["../src/core/plan/planFile.ts","../src/core/plan/cloudflareSnapshot.ts"],"sourcesContent":["import { createHash } from \"crypto\";\nimport { readFileSync, writeFileSync } from \"fs\";\nimport type { CfiConfig, CfiState } from \"../../types.js\";\nimport type { PlanReport } from \"./plan.types.js\";\nimport type { CloudflareSnapshot } from \"./cloudflareSnapshot.js\";\n\n/** Stable on-disk format identifier for `tamer plan --out`. */\nexport const PLAN_FILE_FORMAT = \"tamer-plan/v1\" as const;\n\n/**\n * Serialized `tamer plan` output, suitable for `tamer apply --plan`.\n *\n * The {@link attestation} hashes pin the `(config, state)` pair the plan\n * was generated against. Apply recomputes the same hashes at run time and\n * refuses to proceed if either drifted, so a stale plan can never silently\n * apply against a different reality. Use `--allow-stale` only when you\n * understand the risk.\n */\nexport interface PlanFile {\n  format: typeof PLAN_FILE_FORMAT;\n  tenantId: string;\n  env: string;\n  generatedAt: string;\n  /** The plan as it would be printed by `tamer plan` (kept for review). */\n  report: PlanReport;\n  attestation: PlanAttestation;\n}\n\nexport interface PlanAttestation {\n  /** SHA-256 over the canonical JSON of the parsed `tamer.config.ts`. */\n  configHash: string;\n  /** SHA-256 over the canonical JSON of `state.load()` at plan time. */\n  stateHash: string;\n  /** Revision at plan time (informational; primary check is stateHash). */\n  stateRevision?: number;\n  /**\n   * Drift-aware refresh: SHA-256 over the normalized **Cloudflare-side**\n   * snapshot at plan time (per-kind `sync()` against a fresh in-memory\n   * state, with timestamps stripped). Apply re-fetches and recomputes; a\n   * mismatch means infrastructure drifted out-of-band between plan and\n   * apply, so the plan is no longer accurate. Omitted for `env: local`.\n   */\n  cloudflareHash?: string;\n}\n\n/**\n * Stable JSON stringify: object keys are sorted recursively. The hash must\n * be deterministic across machines, so insertion order can't matter.\n */\nexport function canonicalJson(value: unknown): string {\n  return stableStringify(value);\n}\n\nfunction stableStringify(value: unknown): string {\n  if (value === null || typeof value !== \"object\") {\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) {\n    return `[${value.map((v) => stableStringify(v)).join(\",\")}]`;\n  }\n  const obj = value as Record<string, unknown>;\n  const keys = Object.keys(obj).sort();\n  const body = keys\n    .map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`)\n    .join(\",\");\n  return `{${body}}`;\n}\n\nexport function sha256Hex(input: string): string {\n  return `sha256:${createHash(\"sha256\").update(input).digest(\"hex\")}`;\n}\n\n/**\n * Compute the attestation hashes for `(config, state)` exactly as the\n * apply-side will recompute them. Keep both sides in sync — the canonical\n * JSON algorithm above is the contract.\n */\nexport function computeAttestation(\n  config: CfiConfig,\n  state: CfiState,\n  cloudflareSnapshot?: CloudflareSnapshot,\n): PlanAttestation {\n  const att: PlanAttestation = {\n    configHash: sha256Hex(canonicalJson(config)),\n    stateHash: sha256Hex(canonicalJson(stateForHash(state))),\n    stateRevision: state.revision,\n  };\n  if (cloudflareSnapshot) {\n    att.cloudflareHash = sha256Hex(canonicalJson(cloudflareSnapshot));\n  }\n  return att;\n}\n\n/**\n * Stable hash of a Cloudflare snapshot; same algorithm as\n * `attestation.cloudflareHash` so apply can recompute and compare.\n */\nexport function hashCloudflareSnapshot(\n  snapshot: CloudflareSnapshot,\n): string {\n  return sha256Hex(canonicalJson(snapshot));\n}\n\n/**\n * State view used for hashing — strips fields that legitimately drift\n * between consecutive reads (timestamps, revision counter) so the hash\n * only changes when *resources* / *tenants* / *stack* change.\n */\nfunction stateForHash(state: CfiState): unknown {\n  const { resources, tenants, stack } = state;\n  return { resources: resources ?? {}, tenants: tenants ?? {}, stack };\n}\n\nexport function writePlanFile(path: string, file: PlanFile): void {\n  writeFileSync(path, JSON.stringify(file, null, 2), \"utf-8\");\n}\n\nexport function readPlanFile(path: string): PlanFile {\n  let raw: string;\n  try {\n    raw = readFileSync(path, \"utf-8\");\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`--plan: cannot read plan file \"${path}\": ${msg}`);\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`--plan: plan file \"${path}\" is not valid JSON: ${msg}`);\n  }\n  if (!isPlanFile(parsed)) {\n    throw new Error(\n      `--plan: plan file \"${path}\" is missing required fields or has wrong format ` +\n        `(expected ${PLAN_FILE_FORMAT})`,\n    );\n  }\n  if (parsed.format !== PLAN_FILE_FORMAT) {\n    throw new Error(\n      `--plan: plan file format \"${parsed.format}\" is not supported by this Tamer build (expected ${PLAN_FILE_FORMAT})`,\n    );\n  }\n  return parsed;\n}\n\nfunction isPlanFile(v: unknown): v is PlanFile {\n  if (!v || typeof v !== \"object\") return false;\n  const o = v as Record<string, unknown>;\n  return (\n    typeof o.format === \"string\" &&\n    typeof o.tenantId === \"string\" &&\n    typeof o.env === \"string\" &&\n    typeof o.generatedAt === \"string\" &&\n    !!o.report &&\n    typeof o.report === \"object\" &&\n    !!o.attestation &&\n    typeof o.attestation === \"object\"\n  );\n}\n","import type { CfiConfig, StateEntry } from \"../../types.js\";\nimport type { CFApiClient } from \"../api/CFApiClient.js\";\nimport { StateManager } from \"../state/StateManager.js\";\nimport { stackNameForConfig } from \"../state/stackName.js\";\nimport { resourceModules } from \"../registry/registry.js\";\nimport { namingFromConfig } from \"../config/namingFromConfig.js\";\nimport { getWorkers } from \"../config/loader.js\";\nimport { dispatchNamespaceSync } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordSync } from \"../../features/dns-records/index.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobSync } from \"../../features/logpush-job/index.js\";\nimport { fetchStackImports } from \"../imports/fetchStackImports.js\";\nimport { cloudflareAccountIdFromEnv } from \"../cloudflareEnv.js\";\nimport { mergeWorkerConfigForResourcePick } from \"../config/resolver.js\";\n\n/**\n * Drift-aware Cloudflare snapshot used by `tamer plan --out` and\n * `tamer apply --plan`.\n *\n * Drives the registry's `sync` hook for every kind against a **fresh\n * in-memory state** so the result reflects only what currently exists on\n * Cloudflare (no carryover from D1). The shape mirrors the post-sync\n * resource map but strips volatile fields (timestamps) so consecutive\n * snapshots of an unchanged account hash to the same value.\n *\n * Apply recomputes this against live Cloudflare and refuses to proceed if\n * `cloudflareHash` differs from the plan's pinned hash — that's how a\n * stale plan against drifted infra is detected.\n */\nexport async function buildCloudflareSnapshot(args: {\n  config: CfiConfig;\n  env: string;\n  api: CFApiClient;\n  baseDir: string;\n}): Promise<CloudflareSnapshot> {\n  const { config, env, api, baseDir } = args;\n  const naming = namingFromConfig(config);\n  // In-memory snapshot — never round-trips to D1, so stack name only\n  // matters for diagnostics; passing it keeps logs consistent with the\n  // owning stack.\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  state.hydrateInMemory();\n\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv() ?? \"\";\n  const imports =\n    env !== \"local\"\n      ? await fetchStackImports(api, config, env).catch(\n          () => ({} as Record<string, Record<string, string>>),\n        )\n      : ({} as Record<string, Record<string, string>>);\n\n  const workers = await getWorkers(config, baseDir);\n\n  for (const mod of resourceModules) {\n    const all = await mod.fetchAll(api);\n    for (const [workerKey, wc] of workers) {\n      const mergedWorker =\n        env !== \"local\" && accountId\n          ? mergeWorkerConfigForResourcePick(\n              config,\n              workerKey,\n              wc,\n              env,\n              accountId,\n              naming,\n              state,\n              { referencesMode: \"tolerant\", imports },\n            )\n          : wc;\n      const resources = mod.pickResources(mergedWorker);\n      if (resources.length === 0) continue;\n      mod.sync({\n        all,\n        resources,\n        tenant: config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n      });\n    }\n  }\n\n  if (getDispatchNamespaces(config).length > 0 && env !== \"local\") {\n    await dispatchNamespaceSync(\n      getDispatchNamespaces(config),\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n  }\n\n  if (getDnsRecords(config).length > 0 && env !== \"local\") {\n    await dnsRecordSync(\n      getDnsRecords(config),\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n  }\n\n  if (getLogpushJobs(config).length > 0 && env !== \"local\") {\n    await logpushJobSync(\n      getLogpushJobs(config),\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n  }\n\n  const entries = state.getAll();\n  const stable: CloudflareSnapshot = { entries: {} };\n  for (const key of Object.keys(entries).sort()) {\n    stable.entries[key] = stripVolatile(entries[key]!);\n  }\n  return stable;\n}\n\n/**\n * Per-entry projection used in {@link CloudflareSnapshot}. Drops fields\n * that legitimately move between two reads of the same Cloudflare resource\n * (timestamps); keeps anything that, if it changed, would mean the plan is\n * no longer accurate (cfId, derivedName, kind-specific identity bits).\n */\nfunction stripVolatile(entry: StateEntry): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(entry)) {\n    if (k === \"createdAt\" || k === \"updatedAt\") continue;\n    out[k] = v;\n  }\n  return out;\n}\n\nexport interface CloudflareSnapshot {\n  /** Sorted by key (== `derivedName`) for deterministic hashing. */\n  entries: Record<string, Record<string, unknown>>;\n}\n"],"mappings":";;;;;;;;;;AAOA,MAAa,mBAAmB;;;;;AA0ChC,SAAgB,cAAc,OAAwB;AACpD,QAAO,gBAAgB,MAAM;;AAG/B,SAAS,gBAAgB,OAAwB;AAC/C,KAAI,UAAU,QAAQ,OAAO,UAAU,SACrC,QAAO,KAAK,UAAU,MAAM;AAE9B,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,IAAI,MAAM,KAAK,MAAM,gBAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;CAE5D,MAAM,MAAM;AAKZ,QAAO,IAJM,OAAO,KAAK,IAAI,CAAC,MAAM,CAEjC,KAAK,MAAM,GAAG,KAAK,UAAU,EAAE,CAAC,GAAG,gBAAgB,IAAI,GAAG,GAAG,CAC7D,KAAK,IAAI,CACI;;AAGlB,SAAgB,UAAU,OAAuB;AAC/C,QAAO,UAAU,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;;;;;;AAQnE,SAAgB,mBACd,QACA,OACA,oBACiB;CACjB,MAAMA,MAAuB;EAC3B,YAAY,UAAU,cAAc,OAAO,CAAC;EAC5C,WAAW,UAAU,cAAc,aAAa,MAAM,CAAC,CAAC;EACxD,eAAe,MAAM;EACtB;AACD,KAAI,mBACF,KAAI,iBAAiB,UAAU,cAAc,mBAAmB,CAAC;AAEnE,QAAO;;;;;;AAOT,SAAgB,uBACd,UACQ;AACR,QAAO,UAAU,cAAc,SAAS,CAAC;;;;;;;AAQ3C,SAAS,aAAa,OAA0B;CAC9C,MAAM,EAAE,WAAW,SAAS,UAAU;AACtC,QAAO;EAAE,WAAW,aAAa,EAAE;EAAE,SAAS,WAAW,EAAE;EAAE;EAAO;;AAGtE,SAAgB,cAAc,MAAc,MAAsB;AAChE,eAAc,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,EAAE,QAAQ;;AAG7D,SAAgB,aAAa,MAAwB;CACnD,IAAIC;AACJ,KAAI;AACF,QAAM,aAAa,MAAM,QAAQ;UAC1B,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MAAM,kCAAkC,KAAK,KAAK,MAAM;;CAEpE,IAAIC;AACJ,KAAI;AACF,WAAS,KAAK,MAAM,IAAI;UACjB,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MAAM,sBAAsB,KAAK,uBAAuB,MAAM;;AAE1E,KAAI,CAAC,WAAW,OAAO,CACrB,OAAM,IAAI,MACR,sBAAsB,KAAK,6DACZ,iBAAiB,GACjC;AAEH,KAAI,OAAO,WAAW,iBACpB,OAAM,IAAI,MACR,6BAA6B,OAAO,OAAO,mDAAmD,iBAAiB,GAChH;AAEH,QAAO;;AAGT,SAAS,WAAW,GAA2B;AAC7C,KAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;CACxC,MAAM,IAAI;AACV,QACE,OAAO,EAAE,WAAW,YACpB,OAAO,EAAE,aAAa,YACtB,OAAO,EAAE,QAAQ,YACjB,OAAO,EAAE,gBAAgB,YACzB,CAAC,CAAC,EAAE,UACJ,OAAO,EAAE,WAAW,YACpB,CAAC,CAAC,EAAE,eACJ,OAAO,EAAE,gBAAgB;;;;;;;;;;;;;;;;;;;AChI7B,eAAsB,wBAAwB,MAKd;CAC9B,MAAM,EAAE,QAAQ,KAAK,KAAK,YAAY;CACtC,MAAM,SAAS,iBAAiB,OAAO;CAIvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,iBAAiB;CAEvB,MAAM,YAAY,OAAO,cAAc,4BAA4B,IAAI;CACvE,MAAM,UACJ,QAAQ,UACJ,MAAM,kBAAkB,KAAK,QAAQ,IAAI,CAAC,aACjC,EAAE,EACV,GACA,EAAE;CAET,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AAEjD,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,MAAM,MAAM,IAAI,SAAS,IAAI;AACnC,OAAK,MAAM,CAAC,WAAW,OAAO,SAAS;GACrC,MAAM,eACJ,QAAQ,WAAW,YACf,iCACE,QACA,WACA,IACA,KACA,WACA,QACA,OACA;IAAE,gBAAgB;IAAY;IAAS,CACxC,GACD;GACN,MAAM,YAAY,IAAI,cAAc,aAAa;AACjD,OAAI,UAAU,WAAW,EAAG;AAC5B,OAAI,KAAK;IACP;IACA;IACA,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;;;AAIN,KAAI,sBAAsB,OAAO,CAAC,SAAS,KAAK,QAAQ,QACtD,OAAM,sBACJ,sBAAsB,OAAO,EAC7B,OAAO,QACP,KACA,KACA,MACD;AAGH,KAAI,cAAc,OAAO,CAAC,SAAS,KAAK,QAAQ,QAC9C,OAAM,cACJ,cAAc,OAAO,EACrB,OAAO,QACP,KACA,KACA,MACD;AAGH,KAAI,eAAe,OAAO,CAAC,SAAS,KAAK,QAAQ,QAC/C,OAAM,eACJ,eAAe,OAAO,EACtB,OAAO,QACP,KACA,KACA,MACD;CAGH,MAAM,UAAU,MAAM,QAAQ;CAC9B,MAAMC,SAA6B,EAAE,SAAS,EAAE,EAAE;AAClD,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CAAC,MAAM,CAC3C,QAAO,QAAQ,OAAO,cAAc,QAAQ,KAAM;AAEpD,QAAO;;;;;;;;AAST,SAAS,cAAc,OAA4C;CACjE,MAAMC,MAA+B,EAAE;AACvC,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,EAAE;AAC1C,MAAI,MAAM,eAAe,MAAM,YAAa;AAC5C,MAAI,KAAK;;AAEX,QAAO"}
+{"version":3,"file":"cloudflareSnapshot-DOphOBnH.mjs","names":["att: PlanAttestation","raw: string","parsed: unknown","stable: CloudflareSnapshot","out: Record<string, unknown>"],"sources":["../src/core/plan/planFile.ts","../src/core/plan/cloudflareSnapshot.ts"],"sourcesContent":["import { createHash } from \"crypto\";\nimport { readFileSync, writeFileSync } from \"fs\";\nimport type { CfiConfig, CfiState } from \"../../types.js\";\nimport type { PlanReport } from \"./plan.types.js\";\nimport type { CloudflareSnapshot } from \"./cloudflareSnapshot.js\";\n\n/** Stable on-disk format identifier for `tamer plan --out`. */\nexport const PLAN_FILE_FORMAT = \"tamer-plan/v1\" as const;\n\n/**\n * Serialized `tamer plan` output, suitable for `tamer apply --plan`.\n *\n * The {@link attestation} hashes pin the `(config, state)` pair the plan\n * was generated against. Apply recomputes the same hashes at run time and\n * refuses to proceed if either drifted, so a stale plan can never silently\n * apply against a different reality. Use `--allow-stale` only when you\n * understand the risk.\n */\nexport interface PlanFile {\n  format: typeof PLAN_FILE_FORMAT;\n  tenantId: string;\n  env: string;\n  generatedAt: string;\n  /** The plan as it would be printed by `tamer plan` (kept for review). */\n  report: PlanReport;\n  attestation: PlanAttestation;\n}\n\nexport interface PlanAttestation {\n  /** SHA-256 over the canonical JSON of the parsed `tamer.config.ts`. */\n  configHash: string;\n  /** SHA-256 over the canonical JSON of `state.load()` at plan time. */\n  stateHash: string;\n  /** Revision at plan time (informational; primary check is stateHash). */\n  stateRevision?: number;\n  /**\n   * Drift-aware refresh: SHA-256 over the normalized **Cloudflare-side**\n   * snapshot at plan time (per-kind `sync()` against a fresh in-memory\n   * state, with timestamps stripped). Apply re-fetches and recomputes; a\n   * mismatch means infrastructure drifted out-of-band between plan and\n   * apply, so the plan is no longer accurate. Omitted for `env: local`.\n   */\n  cloudflareHash?: string;\n}\n\n/**\n * Stable JSON stringify: object keys are sorted recursively. The hash must\n * be deterministic across machines, so insertion order can't matter.\n */\nexport function canonicalJson(value: unknown): string {\n  return stableStringify(value);\n}\n\nfunction stableStringify(value: unknown): string {\n  if (value === null || typeof value !== \"object\") {\n    return JSON.stringify(value);\n  }\n  if (Array.isArray(value)) {\n    return `[${value.map((v) => stableStringify(v)).join(\",\")}]`;\n  }\n  const obj = value as Record<string, unknown>;\n  const keys = Object.keys(obj).sort();\n  const body = keys\n    .map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`)\n    .join(\",\");\n  return `{${body}}`;\n}\n\nexport function sha256Hex(input: string): string {\n  return `sha256:${createHash(\"sha256\").update(input).digest(\"hex\")}`;\n}\n\n/**\n * Compute the attestation hashes for `(config, state)` exactly as the\n * apply-side will recompute them. Keep both sides in sync — the canonical\n * JSON algorithm above is the contract.\n */\nexport function computeAttestation(\n  config: CfiConfig,\n  state: CfiState,\n  cloudflareSnapshot?: CloudflareSnapshot,\n): PlanAttestation {\n  const att: PlanAttestation = {\n    configHash: sha256Hex(canonicalJson(config)),\n    stateHash: sha256Hex(canonicalJson(stateForHash(state))),\n    stateRevision: state.revision,\n  };\n  if (cloudflareSnapshot) {\n    att.cloudflareHash = sha256Hex(canonicalJson(cloudflareSnapshot));\n  }\n  return att;\n}\n\n/**\n * Stable hash of a Cloudflare snapshot; same algorithm as\n * `attestation.cloudflareHash` so apply can recompute and compare.\n */\nexport function hashCloudflareSnapshot(\n  snapshot: CloudflareSnapshot,\n): string {\n  return sha256Hex(canonicalJson(snapshot));\n}\n\n/**\n * State view used for hashing — strips fields that legitimately drift\n * between consecutive reads (timestamps, revision counter) so the hash\n * only changes when *resources* / *tenants* / *stack* change.\n */\nfunction stateForHash(state: CfiState): unknown {\n  const { resources, tenants, stack } = state;\n  return { resources: resources ?? {}, tenants: tenants ?? {}, stack };\n}\n\nexport function writePlanFile(path: string, file: PlanFile): void {\n  writeFileSync(path, JSON.stringify(file, null, 2), \"utf-8\");\n}\n\nexport function readPlanFile(path: string): PlanFile {\n  let raw: string;\n  try {\n    raw = readFileSync(path, \"utf-8\");\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`--plan: cannot read plan file \"${path}\": ${msg}`);\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`--plan: plan file \"${path}\" is not valid JSON: ${msg}`);\n  }\n  if (!isPlanFile(parsed)) {\n    throw new Error(\n      `--plan: plan file \"${path}\" is missing required fields or has wrong format ` +\n        `(expected ${PLAN_FILE_FORMAT})`,\n    );\n  }\n  if (parsed.format !== PLAN_FILE_FORMAT) {\n    throw new Error(\n      `--plan: plan file format \"${parsed.format}\" is not supported by this Tamer build (expected ${PLAN_FILE_FORMAT})`,\n    );\n  }\n  return parsed;\n}\n\nfunction isPlanFile(v: unknown): v is PlanFile {\n  if (!v || typeof v !== \"object\") return false;\n  const o = v as Record<string, unknown>;\n  return (\n    typeof o.format === \"string\" &&\n    typeof o.tenantId === \"string\" &&\n    typeof o.env === \"string\" &&\n    typeof o.generatedAt === \"string\" &&\n    !!o.report &&\n    typeof o.report === \"object\" &&\n    !!o.attestation &&\n    typeof o.attestation === \"object\"\n  );\n}\n","import type { CfiConfig, StateEntry } from \"../../types.js\";\nimport type { CFApiClient } from \"../api/CFApiClient.js\";\nimport { StateManager } from \"../state/StateManager.js\";\nimport { stackNameForConfig } from \"../state/stackName.js\";\nimport { resourceModules } from \"../registry/registry.js\";\nimport { namingFromConfig } from \"../config/namingFromConfig.js\";\nimport { getWorkers } from \"../config/loader.js\";\nimport { dispatchNamespaceSync } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordSync } from \"../../features/dns-records/index.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobSync } from \"../../features/logpush-job/index.js\";\nimport { fetchStackImports } from \"../imports/fetchStackImports.js\";\nimport { cloudflareAccountIdFromEnv } from \"../cloudflareEnv.js\";\nimport { mergeWorkerConfigForResourcePick } from \"../config/resolver.js\";\n\n/**\n * Drift-aware Cloudflare snapshot used by `tamer plan --out` and\n * `tamer apply --plan`.\n *\n * Drives the registry's `sync` hook for every kind against a **fresh\n * in-memory state** so the result reflects only what currently exists on\n * Cloudflare (no carryover from D1). The shape mirrors the post-sync\n * resource map but strips volatile fields (timestamps) so consecutive\n * snapshots of an unchanged account hash to the same value.\n *\n * Apply recomputes this against live Cloudflare and refuses to proceed if\n * `cloudflareHash` differs from the plan's pinned hash — that's how a\n * stale plan against drifted infra is detected.\n */\nexport async function buildCloudflareSnapshot(args: {\n  config: CfiConfig;\n  env: string;\n  api: CFApiClient;\n  baseDir: string;\n}): Promise<CloudflareSnapshot> {\n  const { config, env, api, baseDir } = args;\n  const naming = namingFromConfig(config);\n  // In-memory snapshot — never round-trips to D1, so stack name only\n  // matters for diagnostics; passing it keeps logs consistent with the\n  // owning stack.\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  state.hydrateInMemory();\n\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv() ?? \"\";\n  const imports =\n    env !== \"local\"\n      ? await fetchStackImports(api, config, env).catch(\n          () => ({} as Record<string, Record<string, string>>),\n        )\n      : ({} as Record<string, Record<string, string>>);\n\n  const workers = await getWorkers(config, baseDir);\n\n  for (const mod of resourceModules) {\n    const all = await mod.fetchAll(api);\n    for (const [workerKey, wc] of workers) {\n      const mergedWorker =\n        env !== \"local\" && accountId\n          ? mergeWorkerConfigForResourcePick(\n              config,\n              workerKey,\n              wc,\n              env,\n              accountId,\n              naming,\n              state,\n              { referencesMode: \"tolerant\", imports },\n            )\n          : wc;\n      const resources = mod.pickResources(mergedWorker);\n      if (resources.length === 0) continue;\n      mod.sync({\n        all,\n        resources,\n        tenant: config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n      });\n    }\n  }\n\n  if (getDispatchNamespaces(config).length > 0 && env !== \"local\") {\n    await dispatchNamespaceSync(\n      getDispatchNamespaces(config),\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n  }\n\n  if (getDnsRecords(config).length > 0 && env !== \"local\") {\n    await dnsRecordSync(\n      getDnsRecords(config),\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n  }\n\n  if (getLogpushJobs(config).length > 0 && env !== \"local\") {\n    await logpushJobSync(\n      getLogpushJobs(config),\n      config.tenant,\n      env,\n      api,\n      state,\n    );\n  }\n\n  const entries = state.getAll();\n  const stable: CloudflareSnapshot = { entries: {} };\n  for (const key of Object.keys(entries).sort()) {\n    stable.entries[key] = stripVolatile(entries[key]!);\n  }\n  return stable;\n}\n\n/**\n * Per-entry projection used in {@link CloudflareSnapshot}. Drops fields\n * that legitimately move between two reads of the same Cloudflare resource\n * (timestamps); keeps anything that, if it changed, would mean the plan is\n * no longer accurate (cfId, derivedName, kind-specific identity bits).\n */\nfunction stripVolatile(entry: StateEntry): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(entry)) {\n    if (k === \"createdAt\" || k === \"updatedAt\") continue;\n    out[k] = v;\n  }\n  return out;\n}\n\nexport interface CloudflareSnapshot {\n  /** Sorted by key (== `derivedName`) for deterministic hashing. */\n  entries: Record<string, Record<string, unknown>>;\n}\n"],"mappings":";;;;;;;;;;AAOA,MAAa,mBAAmB;;;;;AA0ChC,SAAgB,cAAc,OAAwB;AACpD,QAAO,gBAAgB,MAAM;;AAG/B,SAAS,gBAAgB,OAAwB;AAC/C,KAAI,UAAU,QAAQ,OAAO,UAAU,SACrC,QAAO,KAAK,UAAU,MAAM;AAE9B,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,IAAI,MAAM,KAAK,MAAM,gBAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;CAE5D,MAAM,MAAM;AAKZ,QAAO,IAJM,OAAO,KAAK,IAAI,CAAC,MAAM,CAEjC,KAAK,MAAM,GAAG,KAAK,UAAU,EAAE,CAAC,GAAG,gBAAgB,IAAI,GAAG,GAAG,CAC7D,KAAK,IAAI,CACI;;AAGlB,SAAgB,UAAU,OAAuB;AAC/C,QAAO,UAAU,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;;;;;;AAQnE,SAAgB,mBACd,QACA,OACA,oBACiB;CACjB,MAAMA,MAAuB;EAC3B,YAAY,UAAU,cAAc,OAAO,CAAC;EAC5C,WAAW,UAAU,cAAc,aAAa,MAAM,CAAC,CAAC;EACxD,eAAe,MAAM;EACtB;AACD,KAAI,mBACF,KAAI,iBAAiB,UAAU,cAAc,mBAAmB,CAAC;AAEnE,QAAO;;;;;;AAOT,SAAgB,uBACd,UACQ;AACR,QAAO,UAAU,cAAc,SAAS,CAAC;;;;;;;AAQ3C,SAAS,aAAa,OAA0B;CAC9C,MAAM,EAAE,WAAW,SAAS,UAAU;AACtC,QAAO;EAAE,WAAW,aAAa,EAAE;EAAE,SAAS,WAAW,EAAE;EAAE;EAAO;;AAGtE,SAAgB,cAAc,MAAc,MAAsB;AAChE,eAAc,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,EAAE,QAAQ;;AAG7D,SAAgB,aAAa,MAAwB;CACnD,IAAIC;AACJ,KAAI;AACF,QAAM,aAAa,MAAM,QAAQ;UAC1B,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MAAM,kCAAkC,KAAK,KAAK,MAAM;;CAEpE,IAAIC;AACJ,KAAI;AACF,WAAS,KAAK,MAAM,IAAI;UACjB,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MAAM,sBAAsB,KAAK,uBAAuB,MAAM;;AAE1E,KAAI,CAAC,WAAW,OAAO,CACrB,OAAM,IAAI,MACR,sBAAsB,KAAK,6DACZ,iBAAiB,GACjC;AAEH,KAAI,OAAO,WAAW,iBACpB,OAAM,IAAI,MACR,6BAA6B,OAAO,OAAO,mDAAmD,iBAAiB,GAChH;AAEH,QAAO;;AAGT,SAAS,WAAW,GAA2B;AAC7C,KAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;CACxC,MAAM,IAAI;AACV,QACE,OAAO,EAAE,WAAW,YACpB,OAAO,EAAE,aAAa,YACtB,OAAO,EAAE,QAAQ,YACjB,OAAO,EAAE,gBAAgB,YACzB,CAAC,CAAC,EAAE,UACJ,OAAO,EAAE,WAAW,YACpB,CAAC,CAAC,EAAE,eACJ,OAAO,EAAE,gBAAgB;;;;;;;;;;;;;;;;;;;AChI7B,eAAsB,wBAAwB,MAKd;CAC9B,MAAM,EAAE,QAAQ,KAAK,KAAK,YAAY;CACtC,MAAM,SAAS,iBAAiB,OAAO;CAIvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,iBAAiB;CAEvB,MAAM,YAAY,OAAO,cAAc,4BAA4B,IAAI;CACvE,MAAM,UACJ,QAAQ,UACJ,MAAM,kBAAkB,KAAK,QAAQ,IAAI,CAAC,aACjC,EAAE,EACV,GACA,EAAE;CAET,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AAEjD,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,MAAM,MAAM,IAAI,SAAS,IAAI;AACnC,OAAK,MAAM,CAAC,WAAW,OAAO,SAAS;GACrC,MAAM,eACJ,QAAQ,WAAW,YACf,iCACE,QACA,WACA,IACA,KACA,WACA,QACA,OACA;IAAE,gBAAgB;IAAY;IAAS,CACxC,GACD;GACN,MAAM,YAAY,IAAI,cAAc,aAAa;AACjD,OAAI,UAAU,WAAW,EAAG;AAC5B,OAAI,KAAK;IACP;IACA;IACA,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;;;AAIN,KAAI,sBAAsB,OAAO,CAAC,SAAS,KAAK,QAAQ,QACtD,OAAM,sBACJ,sBAAsB,OAAO,EAC7B,OAAO,QACP,KACA,KACA,MACD;AAGH,KAAI,cAAc,OAAO,CAAC,SAAS,KAAK,QAAQ,QAC9C,OAAM,cACJ,cAAc,OAAO,EACrB,OAAO,QACP,KACA,KACA,MACD;AAGH,KAAI,eAAe,OAAO,CAAC,SAAS,KAAK,QAAQ,QAC/C,OAAM,eACJ,eAAe,OAAO,EACtB,OAAO,QACP,KACA,KACA,MACD;CAGH,MAAM,UAAU,MAAM,QAAQ;CAC9B,MAAMC,SAA6B,EAAE,SAAS,EAAE,EAAE;AAClD,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CAAC,MAAM,CAC3C,QAAO,QAAQ,OAAO,cAAc,QAAQ,KAAM;AAEpD,QAAO;;;;;;;;AAST,SAAS,cAAc,OAA4C;CACjE,MAAMC,MAA+B,EAAE;AACvC,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,EAAE;AAC1C,MAAI,MAAM,eAAe,MAAM,YAAa;AAC5C,MAAI,KAAK;;AAEX,QAAO"}

package/dist/{deploy-CNQ9lhnp.mjs → deploy-BvWkPRlh.mjs}

@@ -1,11 +1,11 @@
 import { B as getWorkers, C as stackNameForConfig, D as resolveDeployedWorkerName, E as mergedWorkerConfigForEnv, I as CFApiClient, L as cloudflareAccountIdFromEnv, O as resolveWorkerConfig, V as loadConfig, d as requiredSecretsForWorker, f as fetchStackImports, h as StateManager, i as pushSecretsForDeploy, j as wranglerConfigCliArgs, k as rewriteIntraStackServiceTargets, l as createDeploySecretsResources, u as namingFromConfig, w as buildIntraStackScriptNameMap, z as getConfigBaseDir } from "./tamer.mjs";
-import { i as workflowsApply } from "./registry-Du91dVUE.mjs";
+import { i as workflowsApply } from "./registry-BlTu3xMp.mjs";
 import "./r2S3EmptyBucket-B9_pHfvB.mjs";
-import { n as writeWranglerJson, t as generateWranglerConfig } from "./generator-vDl0esL-.mjs";
-import { t as assertShardRegistryPresentForDeploy } from "./emit-D0p7CKFk.mjs";
+import { n as writeWranglerJson, t as generateWranglerConfig } from "./generator-qyqB1_Yv.mjs";
+import { t as assertShardRegistryPresentForDeploy } from "./emit-BxHhy1ZC.mjs";
 import "./logpush-job-GqVKG_HI.mjs";
 import { r as workerRoutesApply } from "./worker-route-C7kgtUXH.mjs";
-import { runSync } from "./sync-nkUmYv5B.mjs";
+import { runSync } from "./sync-B6vBSAKa.mjs";
 import { n as spawnWranglerSync, t as spawnBuildSync } from "./wranglerSpawn-CqVNGkA9.mjs";
 
 //#region src/cli/commands/deploy.ts
@@ -158,4 +158,4 @@ async function runDeploy(options) {
 
 //#endregion
 export { runDeploy };
-//# sourceMappingURL=deploy-CNQ9lhnp.mjs.map
+//# sourceMappingURL=deploy-BvWkPRlh.mjs.map

package/dist/{deploy-CNQ9lhnp.mjs.map → deploy-BvWkPRlh.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"deploy-CNQ9lhnp.mjs","names":["out: WorkerEntry[]","deploySecrets: Awaited<\n    ReturnType<typeof createDeploySecretsResources>\n  > | null","buildEnv: Record<string, string>"],"sources":["../src/cli/commands/deploy.ts"],"sourcesContent":["import { loadConfig, getWorkers, getConfigBaseDir } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport { wranglerConfigCliArgs } from \"../../core/wrangler/wranglerOutFile.js\";\nimport { spawnWranglerSync, spawnBuildSync } from \"../../core/wrangler/wranglerSpawn.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport {\n  buildIntraStackScriptNameMap,\n  mergedWorkerConfigForEnv,\n  resolveDeployedWorkerName,\n  resolveWorkerConfig,\n  rewriteIntraStackServiceTargets,\n} from \"../../core/config/resolver.js\";\nimport { requiredSecretsForWorker } from \"../../core/secrets/declared.js\";\nimport { createDeploySecretsResources } from \"./secrets/context.js\";\nimport { pushSecretsForDeploy } from \"./secrets/push.js\";\nimport { workflowsApply } from \"../../features/workflows/workflows.apply.js\";\nimport {\n  generateWranglerConfig,\n  writeWranglerJson,\n} from \"../../core/wrangler/generator.js\";\nimport { runSync } from \"./sync.js\";\nimport { workerRoutesApply } from \"../../features/worker-route/index.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\nimport { assertShardRegistryPresentForDeploy } from \"../../core/codegen/shardRegistry/index.js\";\nimport type { CfiConfig, WorkerConfig } from \"../../types.js\";\n\ntype WorkerEntry = [string, WorkerConfig];\n\n/**\n * Topologically sort workers by `services[].service` so that dependencies\n * deploy before dependents. Cloudflare rejects deploys that reference\n * service bindings to workers that don't yet exist on the account.\n * Cross-config dependencies (services not in this monorepo) are ignored.\n */\nexport function topoSortWorkersByServiceBindings(\n  workers: WorkerEntry[],\n  config: CfiConfig,\n  naming: NamingEngine,\n  env: string,\n): WorkerEntry[] {\n  const intraMap = buildIntraStackScriptNameMap(config, env, naming);\n  const scriptNameToKey = new Map<string, string>();\n  for (const [key, cfg] of workers) {\n    const name = resolveDeployedWorkerName(config, key, cfg, env, naming);\n    scriptNameToKey.set(name, key);\n  }\n\n  const byKey = new Map(workers);\n  const visited = new Set<string>();\n  const visiting = new Set<string>();\n  const out: WorkerEntry[] = [];\n\n  function visit(key: string): void {\n    if (visited.has(key)) return;\n    if (visiting.has(key)) return;\n    visiting.add(key);\n    const cfg = byKey.get(key);\n    if (cfg) {\n      const merged = rewriteIntraStackServiceTargets(\n        mergedWorkerConfigForEnv(cfg, env, config.tenant),\n        intraMap,\n      );\n      const deps = merged.services?.map((s) => s.service) ?? [];\n      for (const dep of deps) {\n        const depKey = scriptNameToKey.get(dep);\n        if (depKey && depKey !== key) visit(depKey);\n      }\n      visiting.delete(key);\n      visited.add(key);\n      out.push([key, cfg]);\n    }\n  }\n\n  for (const [key] of workers) visit(key);\n  return out;\n}\n\nexport async function runDeploy(options: {\n  worker?: string;\n  env?: string;\n  configPath?: string;\n  /** Passed to `wrangler deploy --dispatch-namespace` when the worker has no `dispatchNamespace` in config. */\n  dispatchNamespace?: string;\n}): Promise<void> {\n  const workerFilter = options.worker;\n  // `--env` is intentionally required (no silent default to \"prod\") to\n  // match every other Tamer command and to avoid the classic \"ran\n  // `tamer deploy` from the wrong shell, shipped a half-tested branch\n  // to production\" footgun.\n  const env = options.env;\n  if (!env) {\n    throw new Error(\n      \"deploy: --env is required (e.g. --env staging). \" +\n        \"Tamer no longer defaults to prod — pass the env explicitly.\",\n    );\n  }\n  const configPath = options.configPath;\n\n  const config = await loadConfig(configPath, { env });\n  const baseDir = getConfigBaseDir();\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  console.log(`Syncing state for env: ${env}...`);\n  await runSync({ env, configPath });\n\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const imports = await fetchStackImports(api, config, env);\n  state.beginOperation(\"deploy\", workerFilter ? `worker:${workerFilter}` : undefined);\n\n  try {\n\n  const workers = await getWorkers(config, baseDir);\n  const toDeploy = workerFilter\n    ? workers.filter(([k]) => k === workerFilter)\n    : workers;\n\n  if (toDeploy.length === 0) {\n    throw new Error(\n      workerFilter\n        ? `Worker \"${workerFilter}\" not found`\n        : \"No workers configured\",\n    );\n  }\n\n  const ordered = topoSortWorkersByServiceBindings(\n    toDeploy,\n    config,\n    naming,\n    env,\n  );\n\n  await assertShardRegistryPresentForDeploy({\n    config,\n    env,\n    baseDir,\n    accountId,\n    naming,\n    state,\n    imports,\n    workers,\n  });\n\n  let deploySecrets: Awaited<\n    ReturnType<typeof createDeploySecretsResources>\n  > | null = null;\n\n  for (const [workerKey, workerConfig] of ordered) {\n    const mergedForSecrets = mergedWorkerConfigForEnv(\n      workerConfig,\n      env,\n      config.tenant,\n    );\n    const requiredSecrets = requiredSecretsForWorker(mergedForSecrets);\n\n    if (requiredSecrets.length > 0 && env !== \"local\") {\n      if (!deploySecrets) {\n        deploySecrets = await createDeploySecretsResources(api, env);\n      }\n      const deployedName = resolveDeployedWorkerName(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        naming,\n      );\n      await pushSecretsForDeploy({\n        workerKey,\n        deployedName,\n        required: requiredSecrets,\n        vault: deploySecrets.vault,\n        state,\n        api,\n        masterKey: deploySecrets.masterKey,\n      });\n    }\n\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { imports },\n    );\n    const wranglerConfig = generateWranglerConfig(resolved, state, naming);\n    writeWranglerJson(resolved.workerDir, wranglerConfig, resolved.wranglerOutFile);\n\n    const buildConfig = mergedForSecrets.build;\n    if (buildConfig) {\n      console.log(`Building ${workerKey} (${buildConfig.command})...`);\n      const buildEnv: Record<string, string> = {};\n      if (wranglerConfig.vars) {\n        for (const [k, v] of Object.entries(wranglerConfig.vars)) {\n          buildEnv[k] = typeof v === \"string\" ? v : String(v);\n        }\n      }\n      const buildResult = spawnBuildSync(buildConfig.command, {\n        cwd: resolved.workerDir,\n        stdio: \"inherit\",\n        env: buildEnv,\n      });\n      if (buildResult.status !== 0) {\n        throw new Error(\n          `build failed for ${workerKey} (exit ${buildResult.status})`,\n        );\n      }\n      console.log(`Built ${workerKey}`);\n    }\n\n    const typesArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n      \"types\",\n    ];\n    const typesResult = spawnWranglerSync(typesArgs, {\n      cwd: resolved.workerDir,\n      stdio: \"inherit\",\n    });\n    if (typesResult.status !== 0) {\n      throw new Error(`wrangler types failed for ${workerKey}`);\n    }\n\n    const dispatchNs =\n      resolved.dispatchNamespace ?? options.dispatchNamespace;\n    const deployArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n      \"deploy\",\n    ];\n    if (dispatchNs) {\n      deployArgs.push(\"--dispatch-namespace\", dispatchNs);\n    }\n\n    const deployResult = spawnWranglerSync(deployArgs, {\n      cwd: resolved.workerDir,\n      stdio: \"inherit\",\n    });\n    if (deployResult.status !== 0) {\n      throw new Error(`wrangler deploy failed for ${workerKey}`);\n    }\n    console.log(`Deployed ${workerKey}`);\n\n    // Register workflows after the script exists (chicken-and-egg: workflows\n    // need the deployed script). During `tamer apply`, workflow registration\n    // is deferred when the script doesn't exist yet. Here the script is live.\n    const workflowResources = resolved.resources?.workflows;\n    if (workflowResources && workflowResources.length > 0) {\n      await workflowsApply(\n        workflowResources,\n        config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        { workerKey, deployedName: resolved.workerName },\n      );\n    }\n  }\n\n  if (env !== \"local\") {\n    try {\n      await workerRoutesApply(\n        env,\n        config,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        api,\n        { imports },\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      throw new Error(`worker routes apply failed after deploy: ${msg}`);\n    }\n  }\n\n  state.finishOperation();\n  await state.persist(api);\n  console.log(`Deploy complete for env: ${env}`);\n  } catch (err) {\n    state.failOperation(err instanceof Error ? err.message : String(err));\n    try {\n      await state.persist(api);\n    } catch {\n      /* swallow secondary persist failure */\n    }\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,SAAgB,iCACd,SACA,QACA,QACA,KACe;CACf,MAAM,WAAW,6BAA6B,QAAQ,KAAK,OAAO;CAClE,MAAM,kCAAkB,IAAI,KAAqB;AACjD,MAAK,MAAM,CAAC,KAAK,QAAQ,SAAS;EAChC,MAAM,OAAO,0BAA0B,QAAQ,KAAK,KAAK,KAAK,OAAO;AACrE,kBAAgB,IAAI,MAAM,IAAI;;CAGhC,MAAM,QAAQ,IAAI,IAAI,QAAQ;CAC9B,MAAM,0BAAU,IAAI,KAAa;CACjC,MAAM,2BAAW,IAAI,KAAa;CAClC,MAAMA,MAAqB,EAAE;CAE7B,SAAS,MAAM,KAAmB;AAChC,MAAI,QAAQ,IAAI,IAAI,CAAE;AACtB,MAAI,SAAS,IAAI,IAAI,CAAE;AACvB,WAAS,IAAI,IAAI;EACjB,MAAM,MAAM,MAAM,IAAI,IAAI;AAC1B,MAAI,KAAK;GAKP,MAAM,OAJS,gCACb,yBAAyB,KAAK,KAAK,OAAO,OAAO,EACjD,SACD,CACmB,UAAU,KAAK,MAAM,EAAE,QAAQ,IAAI,EAAE;AACzD,QAAK,MAAM,OAAO,MAAM;IACtB,MAAM,SAAS,gBAAgB,IAAI,IAAI;AACvC,QAAI,UAAU,WAAW,IAAK,OAAM,OAAO;;AAE7C,YAAS,OAAO,IAAI;AACpB,WAAQ,IAAI,IAAI;AAChB,OAAI,KAAK,CAAC,KAAK,IAAI,CAAC;;;AAIxB,MAAK,MAAM,CAAC,QAAQ,QAAS,OAAM,IAAI;AACvC,QAAO;;AAGT,eAAsB,UAAU,SAMd;CAChB,MAAM,eAAe,QAAQ;CAK7B,MAAM,MAAM,QAAQ;AACpB,KAAI,CAAC,IACH,OAAM,IAAI,MACR,8GAED;CAEH,MAAM,aAAa,QAAQ;CAE3B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,UAAU,kBAAkB;CAClC,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;AAGH,SAAQ,IAAI,0BAA0B,IAAI,KAAK;AAC/C,OAAM,QAAQ;EAAE;EAAK;EAAY,CAAC;CAElC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;AACzD,OAAM,eAAe,UAAU,eAAe,UAAU,iBAAiB,OAAU;AAEnF,KAAI;EAEJ,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;EACjD,MAAM,WAAW,eACb,QAAQ,QAAQ,CAAC,OAAO,MAAM,aAAa,GAC3C;AAEJ,MAAI,SAAS,WAAW,EACtB,OAAM,IAAI,MACR,eACI,WAAW,aAAa,eACxB,wBACL;EAGH,MAAM,UAAU,iCACd,UACA,QACA,QACA,IACD;AAED,QAAM,oCAAoC;GACxC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACD,CAAC;EAEF,IAAIC,gBAEO;AAEX,OAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;GAC/C,MAAM,mBAAmB,yBACvB,cACA,KACA,OAAO,OACR;GACD,MAAM,kBAAkB,yBAAyB,iBAAiB;AAElE,OAAI,gBAAgB,SAAS,KAAK,QAAQ,SAAS;AACjD,QAAI,CAAC,cACH,iBAAgB,MAAM,6BAA6B,KAAK,IAAI;AAS9D,UAAM,qBAAqB;KACzB;KACA,cATmB,0BACnB,QACA,WACA,cACA,KACA,OACD;KAIC,UAAU;KACV,OAAO,cAAc;KACrB;KACA;KACA,WAAW,cAAc;KAC1B,CAAC;;GAGJ,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;GACD,MAAM,iBAAiB,uBAAuB,UAAU,OAAO,OAAO;AACtE,qBAAkB,SAAS,WAAW,gBAAgB,SAAS,gBAAgB;GAE/E,MAAM,cAAc,iBAAiB;AACrC,OAAI,aAAa;AACf,YAAQ,IAAI,YAAY,UAAU,IAAI,YAAY,QAAQ,MAAM;IAChE,MAAMC,WAAmC,EAAE;AAC3C,QAAI,eAAe,KACjB,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,eAAe,KAAK,CACtD,UAAS,KAAK,OAAO,MAAM,WAAW,IAAI,OAAO,EAAE;IAGvD,MAAM,cAAc,eAAe,YAAY,SAAS;KACtD,KAAK,SAAS;KACd,OAAO;KACP,KAAK;KACN,CAAC;AACF,QAAI,YAAY,WAAW,EACzB,OAAM,IAAI,MACR,oBAAoB,UAAU,SAAS,YAAY,OAAO,GAC3D;AAEH,YAAQ,IAAI,SAAS,YAAY;;AAYnC,OAJoB,kBALF;IAChB;IACA,GAAG,sBAAsB,SAAS,gBAAgB;IAClD;IACD,EACgD;IAC/C,KAAK,SAAS;IACd,OAAO;IACR,CAAC,CACc,WAAW,EACzB,OAAM,IAAI,MAAM,6BAA6B,YAAY;GAG3D,MAAM,aACJ,SAAS,qBAAqB,QAAQ;GACxC,MAAM,aAAa;IACjB;IACA,GAAG,sBAAsB,SAAS,gBAAgB;IAClD;IACD;AACD,OAAI,WACF,YAAW,KAAK,wBAAwB,WAAW;AAOrD,OAJqB,kBAAkB,YAAY;IACjD,KAAK,SAAS;IACd,OAAO;IACR,CAAC,CACe,WAAW,EAC1B,OAAM,IAAI,MAAM,8BAA8B,YAAY;AAE5D,WAAQ,IAAI,YAAY,YAAY;GAKpC,MAAM,oBAAoB,SAAS,WAAW;AAC9C,OAAI,qBAAqB,kBAAkB,SAAS,EAClD,OAAM,eACJ,mBACA,OAAO,QACP,KACA,KACA,OACA,QACA;IAAE;IAAW,cAAc,SAAS;IAAY,CACjD;;AAIL,MAAI,QAAQ,QACV,KAAI;AACF,SAAM,kBACJ,KACA,QACA,SACA,WACA,QACA,OACA,KACA,EAAE,SAAS,CACZ;WACM,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,SAAM,IAAI,MAAM,4CAA4C,MAAM;;AAItE,QAAM,iBAAiB;AACvB,QAAM,MAAM,QAAQ,IAAI;AACxB,UAAQ,IAAI,4BAA4B,MAAM;UACrC,KAAK;AACZ,QAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,MAAI;AACF,SAAM,MAAM,QAAQ,IAAI;UAClB;AAGR,QAAM"}
+{"version":3,"file":"deploy-BvWkPRlh.mjs","names":["out: WorkerEntry[]","deploySecrets: Awaited<\n    ReturnType<typeof createDeploySecretsResources>\n  > | null","buildEnv: Record<string, string>"],"sources":["../src/cli/commands/deploy.ts"],"sourcesContent":["import { loadConfig, getWorkers, getConfigBaseDir } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport { wranglerConfigCliArgs } from \"../../core/wrangler/wranglerOutFile.js\";\nimport { spawnWranglerSync, spawnBuildSync } from \"../../core/wrangler/wranglerSpawn.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport {\n  buildIntraStackScriptNameMap,\n  mergedWorkerConfigForEnv,\n  resolveDeployedWorkerName,\n  resolveWorkerConfig,\n  rewriteIntraStackServiceTargets,\n} from \"../../core/config/resolver.js\";\nimport { requiredSecretsForWorker } from \"../../core/secrets/declared.js\";\nimport { createDeploySecretsResources } from \"./secrets/context.js\";\nimport { pushSecretsForDeploy } from \"./secrets/push.js\";\nimport { workflowsApply } from \"../../features/workflows/workflows.apply.js\";\nimport {\n  generateWranglerConfig,\n  writeWranglerJson,\n} from \"../../core/wrangler/generator.js\";\nimport { runSync } from \"./sync.js\";\nimport { workerRoutesApply } from \"../../features/worker-route/index.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\nimport { assertShardRegistryPresentForDeploy } from \"../../core/codegen/shardRegistry/index.js\";\nimport type { CfiConfig, WorkerConfig } from \"../../types.js\";\n\ntype WorkerEntry = [string, WorkerConfig];\n\n/**\n * Topologically sort workers by `services[].service` so that dependencies\n * deploy before dependents. Cloudflare rejects deploys that reference\n * service bindings to workers that don't yet exist on the account.\n * Cross-config dependencies (services not in this monorepo) are ignored.\n */\nexport function topoSortWorkersByServiceBindings(\n  workers: WorkerEntry[],\n  config: CfiConfig,\n  naming: NamingEngine,\n  env: string,\n): WorkerEntry[] {\n  const intraMap = buildIntraStackScriptNameMap(config, env, naming);\n  const scriptNameToKey = new Map<string, string>();\n  for (const [key, cfg] of workers) {\n    const name = resolveDeployedWorkerName(config, key, cfg, env, naming);\n    scriptNameToKey.set(name, key);\n  }\n\n  const byKey = new Map(workers);\n  const visited = new Set<string>();\n  const visiting = new Set<string>();\n  const out: WorkerEntry[] = [];\n\n  function visit(key: string): void {\n    if (visited.has(key)) return;\n    if (visiting.has(key)) return;\n    visiting.add(key);\n    const cfg = byKey.get(key);\n    if (cfg) {\n      const merged = rewriteIntraStackServiceTargets(\n        mergedWorkerConfigForEnv(cfg, env, config.tenant),\n        intraMap,\n      );\n      const deps = merged.services?.map((s) => s.service) ?? [];\n      for (const dep of deps) {\n        const depKey = scriptNameToKey.get(dep);\n        if (depKey && depKey !== key) visit(depKey);\n      }\n      visiting.delete(key);\n      visited.add(key);\n      out.push([key, cfg]);\n    }\n  }\n\n  for (const [key] of workers) visit(key);\n  return out;\n}\n\nexport async function runDeploy(options: {\n  worker?: string;\n  env?: string;\n  configPath?: string;\n  /** Passed to `wrangler deploy --dispatch-namespace` when the worker has no `dispatchNamespace` in config. */\n  dispatchNamespace?: string;\n}): Promise<void> {\n  const workerFilter = options.worker;\n  // `--env` is intentionally required (no silent default to \"prod\") to\n  // match every other Tamer command and to avoid the classic \"ran\n  // `tamer deploy` from the wrong shell, shipped a half-tested branch\n  // to production\" footgun.\n  const env = options.env;\n  if (!env) {\n    throw new Error(\n      \"deploy: --env is required (e.g. --env staging). \" +\n        \"Tamer no longer defaults to prod — pass the env explicitly.\",\n    );\n  }\n  const configPath = options.configPath;\n\n  const config = await loadConfig(configPath, { env });\n  const baseDir = getConfigBaseDir();\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  console.log(`Syncing state for env: ${env}...`);\n  await runSync({ env, configPath });\n\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  const imports = await fetchStackImports(api, config, env);\n  state.beginOperation(\"deploy\", workerFilter ? `worker:${workerFilter}` : undefined);\n\n  try {\n\n  const workers = await getWorkers(config, baseDir);\n  const toDeploy = workerFilter\n    ? workers.filter(([k]) => k === workerFilter)\n    : workers;\n\n  if (toDeploy.length === 0) {\n    throw new Error(\n      workerFilter\n        ? `Worker \"${workerFilter}\" not found`\n        : \"No workers configured\",\n    );\n  }\n\n  const ordered = topoSortWorkersByServiceBindings(\n    toDeploy,\n    config,\n    naming,\n    env,\n  );\n\n  await assertShardRegistryPresentForDeploy({\n    config,\n    env,\n    baseDir,\n    accountId,\n    naming,\n    state,\n    imports,\n    workers,\n  });\n\n  let deploySecrets: Awaited<\n    ReturnType<typeof createDeploySecretsResources>\n  > | null = null;\n\n  for (const [workerKey, workerConfig] of ordered) {\n    const mergedForSecrets = mergedWorkerConfigForEnv(\n      workerConfig,\n      env,\n      config.tenant,\n    );\n    const requiredSecrets = requiredSecretsForWorker(mergedForSecrets);\n\n    if (requiredSecrets.length > 0 && env !== \"local\") {\n      if (!deploySecrets) {\n        deploySecrets = await createDeploySecretsResources(api, env);\n      }\n      const deployedName = resolveDeployedWorkerName(\n        config,\n        workerKey,\n        workerConfig,\n        env,\n        naming,\n      );\n      await pushSecretsForDeploy({\n        workerKey,\n        deployedName,\n        required: requiredSecrets,\n        vault: deploySecrets.vault,\n        state,\n        api,\n        masterKey: deploySecrets.masterKey,\n      });\n    }\n\n    const resolved = await resolveWorkerConfig(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      baseDir,\n      accountId,\n      naming,\n      state,\n      { imports },\n    );\n    const wranglerConfig = generateWranglerConfig(resolved, state, naming);\n    writeWranglerJson(resolved.workerDir, wranglerConfig, resolved.wranglerOutFile);\n\n    const buildConfig = mergedForSecrets.build;\n    if (buildConfig) {\n      console.log(`Building ${workerKey} (${buildConfig.command})...`);\n      const buildEnv: Record<string, string> = {};\n      if (wranglerConfig.vars) {\n        for (const [k, v] of Object.entries(wranglerConfig.vars)) {\n          buildEnv[k] = typeof v === \"string\" ? v : String(v);\n        }\n      }\n      const buildResult = spawnBuildSync(buildConfig.command, {\n        cwd: resolved.workerDir,\n        stdio: \"inherit\",\n        env: buildEnv,\n      });\n      if (buildResult.status !== 0) {\n        throw new Error(\n          `build failed for ${workerKey} (exit ${buildResult.status})`,\n        );\n      }\n      console.log(`Built ${workerKey}`);\n    }\n\n    const typesArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n      \"types\",\n    ];\n    const typesResult = spawnWranglerSync(typesArgs, {\n      cwd: resolved.workerDir,\n      stdio: \"inherit\",\n    });\n    if (typesResult.status !== 0) {\n      throw new Error(`wrangler types failed for ${workerKey}`);\n    }\n\n    const dispatchNs =\n      resolved.dispatchNamespace ?? options.dispatchNamespace;\n    const deployArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(resolved.wranglerOutFile),\n      \"deploy\",\n    ];\n    if (dispatchNs) {\n      deployArgs.push(\"--dispatch-namespace\", dispatchNs);\n    }\n\n    const deployResult = spawnWranglerSync(deployArgs, {\n      cwd: resolved.workerDir,\n      stdio: \"inherit\",\n    });\n    if (deployResult.status !== 0) {\n      throw new Error(`wrangler deploy failed for ${workerKey}`);\n    }\n    console.log(`Deployed ${workerKey}`);\n\n    // Register workflows after the script exists (chicken-and-egg: workflows\n    // need the deployed script). During `tamer apply`, workflow registration\n    // is deferred when the script doesn't exist yet. Here the script is live.\n    const workflowResources = resolved.resources?.workflows;\n    if (workflowResources && workflowResources.length > 0) {\n      await workflowsApply(\n        workflowResources,\n        config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        { workerKey, deployedName: resolved.workerName },\n      );\n    }\n  }\n\n  if (env !== \"local\") {\n    try {\n      await workerRoutesApply(\n        env,\n        config,\n        baseDir,\n        accountId,\n        naming,\n        state,\n        api,\n        { imports },\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      throw new Error(`worker routes apply failed after deploy: ${msg}`);\n    }\n  }\n\n  state.finishOperation();\n  await state.persist(api);\n  console.log(`Deploy complete for env: ${env}`);\n  } catch (err) {\n    state.failOperation(err instanceof Error ? err.message : String(err));\n    try {\n      await state.persist(api);\n    } catch {\n      /* swallow secondary persist failure */\n    }\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,SAAgB,iCACd,SACA,QACA,QACA,KACe;CACf,MAAM,WAAW,6BAA6B,QAAQ,KAAK,OAAO;CAClE,MAAM,kCAAkB,IAAI,KAAqB;AACjD,MAAK,MAAM,CAAC,KAAK,QAAQ,SAAS;EAChC,MAAM,OAAO,0BAA0B,QAAQ,KAAK,KAAK,KAAK,OAAO;AACrE,kBAAgB,IAAI,MAAM,IAAI;;CAGhC,MAAM,QAAQ,IAAI,IAAI,QAAQ;CAC9B,MAAM,0BAAU,IAAI,KAAa;CACjC,MAAM,2BAAW,IAAI,KAAa;CAClC,MAAMA,MAAqB,EAAE;CAE7B,SAAS,MAAM,KAAmB;AAChC,MAAI,QAAQ,IAAI,IAAI,CAAE;AACtB,MAAI,SAAS,IAAI,IAAI,CAAE;AACvB,WAAS,IAAI,IAAI;EACjB,MAAM,MAAM,MAAM,IAAI,IAAI;AAC1B,MAAI,KAAK;GAKP,MAAM,OAJS,gCACb,yBAAyB,KAAK,KAAK,OAAO,OAAO,EACjD,SACD,CACmB,UAAU,KAAK,MAAM,EAAE,QAAQ,IAAI,EAAE;AACzD,QAAK,MAAM,OAAO,MAAM;IACtB,MAAM,SAAS,gBAAgB,IAAI,IAAI;AACvC,QAAI,UAAU,WAAW,IAAK,OAAM,OAAO;;AAE7C,YAAS,OAAO,IAAI;AACpB,WAAQ,IAAI,IAAI;AAChB,OAAI,KAAK,CAAC,KAAK,IAAI,CAAC;;;AAIxB,MAAK,MAAM,CAAC,QAAQ,QAAS,OAAM,IAAI;AACvC,QAAO;;AAGT,eAAsB,UAAU,SAMd;CAChB,MAAM,eAAe,QAAQ;CAK7B,MAAM,MAAM,QAAQ;AACpB,KAAI,CAAC,IACH,OAAM,IAAI,MACR,8GAED;CAEH,MAAM,aAAa,QAAQ;CAE3B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,UAAU,kBAAkB;CAClC,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;AAGH,SAAQ,IAAI,0BAA0B,IAAI,KAAK;AAC/C,OAAM,QAAQ;EAAE;EAAK;EAAY,CAAC;CAElC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CACxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI;AACzD,OAAM,eAAe,UAAU,eAAe,UAAU,iBAAiB,OAAU;AAEnF,KAAI;EAEJ,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;EACjD,MAAM,WAAW,eACb,QAAQ,QAAQ,CAAC,OAAO,MAAM,aAAa,GAC3C;AAEJ,MAAI,SAAS,WAAW,EACtB,OAAM,IAAI,MACR,eACI,WAAW,aAAa,eACxB,wBACL;EAGH,MAAM,UAAU,iCACd,UACA,QACA,QACA,IACD;AAED,QAAM,oCAAoC;GACxC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACD,CAAC;EAEF,IAAIC,gBAEO;AAEX,OAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;GAC/C,MAAM,mBAAmB,yBACvB,cACA,KACA,OAAO,OACR;GACD,MAAM,kBAAkB,yBAAyB,iBAAiB;AAElE,OAAI,gBAAgB,SAAS,KAAK,QAAQ,SAAS;AACjD,QAAI,CAAC,cACH,iBAAgB,MAAM,6BAA6B,KAAK,IAAI;AAS9D,UAAM,qBAAqB;KACzB;KACA,cATmB,0BACnB,QACA,WACA,cACA,KACA,OACD;KAIC,UAAU;KACV,OAAO,cAAc;KACrB;KACA;KACA,WAAW,cAAc;KAC1B,CAAC;;GAGJ,MAAM,WAAW,MAAM,oBACrB,QACA,WACA,cACA,KACA,SACA,WACA,QACA,OACA,EAAE,SAAS,CACZ;GACD,MAAM,iBAAiB,uBAAuB,UAAU,OAAO,OAAO;AACtE,qBAAkB,SAAS,WAAW,gBAAgB,SAAS,gBAAgB;GAE/E,MAAM,cAAc,iBAAiB;AACrC,OAAI,aAAa;AACf,YAAQ,IAAI,YAAY,UAAU,IAAI,YAAY,QAAQ,MAAM;IAChE,MAAMC,WAAmC,EAAE;AAC3C,QAAI,eAAe,KACjB,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,eAAe,KAAK,CACtD,UAAS,KAAK,OAAO,MAAM,WAAW,IAAI,OAAO,EAAE;IAGvD,MAAM,cAAc,eAAe,YAAY,SAAS;KACtD,KAAK,SAAS;KACd,OAAO;KACP,KAAK;KACN,CAAC;AACF,QAAI,YAAY,WAAW,EACzB,OAAM,IAAI,MACR,oBAAoB,UAAU,SAAS,YAAY,OAAO,GAC3D;AAEH,YAAQ,IAAI,SAAS,YAAY;;AAYnC,OAJoB,kBALF;IAChB;IACA,GAAG,sBAAsB,SAAS,gBAAgB;IAClD;IACD,EACgD;IAC/C,KAAK,SAAS;IACd,OAAO;IACR,CAAC,CACc,WAAW,EACzB,OAAM,IAAI,MAAM,6BAA6B,YAAY;GAG3D,MAAM,aACJ,SAAS,qBAAqB,QAAQ;GACxC,MAAM,aAAa;IACjB;IACA,GAAG,sBAAsB,SAAS,gBAAgB;IAClD;IACD;AACD,OAAI,WACF,YAAW,KAAK,wBAAwB,WAAW;AAOrD,OAJqB,kBAAkB,YAAY;IACjD,KAAK,SAAS;IACd,OAAO;IACR,CAAC,CACe,WAAW,EAC1B,OAAM,IAAI,MAAM,8BAA8B,YAAY;AAE5D,WAAQ,IAAI,YAAY,YAAY;GAKpC,MAAM,oBAAoB,SAAS,WAAW;AAC9C,OAAI,qBAAqB,kBAAkB,SAAS,EAClD,OAAM,eACJ,mBACA,OAAO,QACP,KACA,KACA,OACA,QACA;IAAE;IAAW,cAAc,SAAS;IAAY,CACjD;;AAIL,MAAI,QAAQ,QACV,KAAI;AACF,SAAM,kBACJ,KACA,QACA,SACA,WACA,QACA,OACA,KACA,EAAE,SAAS,CACZ;WACM,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,SAAM,IAAI,MAAM,4CAA4C,MAAM;;AAItE,QAAM,iBAAiB;AACvB,QAAM,MAAM,QAAQ,IAAI;AACxB,UAAQ,IAAI,4BAA4B,MAAM;UACrC,KAAK;AACZ,QAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,MAAI;AACF,SAAM,MAAM,QAAQ,IAAI;UAClB;AAGR,QAAM"}

package/dist/{destroy-D18ZIufa.mjs → destroy-OozAEB7_.mjs}

@@ -1,12 +1,12 @@
 import { f as getDispatchNamespaces, p as getDnsRecords } from "./normalize-DVSTRZhO.mjs";
 import { B as getWorkers, C as stackNameForConfig, I as CFApiClient, L as cloudflareAccountIdFromEnv, N as isEphemeralEnv, P as deleteEnvSecretRows, V as loadConfig, h as StateManager, u as namingFromConfig, x as deleteEnvStateRows, z as getConfigBaseDir } from "./tamer.mjs";
-import { a as logicalNamesForResourceKind, n as resourceModules } from "./registry-Du91dVUE.mjs";
+import { a as logicalNamesForResourceKind, n as resourceModules } from "./registry-BlTu3xMp.mjs";
 import "./r2S3EmptyBucket-B9_pHfvB.mjs";
 import { n as logpushJobDestroy } from "./logpush-job-GqVKG_HI.mjs";
 import { n as workerRoutesDestroy } from "./worker-route-C7kgtUXH.mjs";
-import { runSync } from "./sync-nkUmYv5B.mjs";
-import { i as hashCloudflareSnapshot, t as buildCloudflareSnapshot } from "./cloudflareSnapshot-D9LAgUVP.mjs";
-import { t as verifyPlanFile } from "./verifyPlanFile-B6Wxl2m2.mjs";
+import { runSync } from "./sync-B6vBSAKa.mjs";
+import { i as hashCloudflareSnapshot, t as buildCloudflareSnapshot } from "./cloudflareSnapshot-DOphOBnH.mjs";
+import { t as verifyPlanFile } from "./verifyPlanFile-CuG9sooo.mjs";
 import { t as deleteEnvArtifacts } from "./tamerArtifactsR2-7qUbhOLD.mjs";
 import { n as workersDestroy } from "./workers-Bq1AY8aB.mjs";
 
@@ -216,4 +216,4 @@ async function runDestroy(options) {
 
 //#endregion
 export { runDestroy };
-//# sourceMappingURL=destroy-D18ZIufa.mjs.map
+//# sourceMappingURL=destroy-OozAEB7_.mjs.map

package/dist/{destroy-D18ZIufa.mjs.map → destroy-OozAEB7_.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"destroy-D18ZIufa.mjs","names":[],"sources":["../src/features/dispatch-namespace/dispatch-namespace.destroy.ts","../src/features/dns-records/dns-records.destroy.ts","../src/cli/destroyGuard.ts","../src/cli/commands/destroy.ts"],"sourcesContent":["import type { CfiConfig } from \"../../types.js\";\nimport { getDispatchNamespaces } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { DispatchNamespaceStateEntry } from \"../../types.js\";\nimport { isEphemeralEnv } from \"./dispatch-namespace.resolve.js\";\n\n/**\n * Tear down every dispatch namespace recorded in state.\n *\n * Cloudflare refuses to delete a namespace that still contains scripts, so we\n * enumerate `/dispatch/namespaces/{ns}/scripts` and delete each (with `force`\n * so dependents like service-bind targets don't block the removal). This\n * covers tenant scripts uploaded by `tamer wfp put` / `provision-workflow`\n * that aren't otherwise tracked in Tamer state.\n */\nexport async function dispatchNamespaceDestroy(\n  env: string,\n  state: StateManager,\n  api: CFApiClient,\n  config: CfiConfig,\n  _force?: boolean,\n): Promise<void> {\n  const allowedLogical = new Set(\n    getDispatchNamespaces(config).map((d) => d.logicalName),\n  );\n  if (allowedLogical.size === 0) return;\n\n  for (const [key, entry] of Object.entries(state.getAll())) {\n    if (entry.type !== \"dispatch_namespace\") continue;\n    const ns = entry as DispatchNamespaceStateEntry;\n    if (!allowedLogical.has(ns.logicalName)) continue;\n    const isSharedEphemeral = ns.derivedName.endsWith(\"-ephemeral\");\n    try {\n      const scripts = await api.dispatchNamespaceScriptList(ns.derivedName);\n      for (const s of scripts) {\n        if (isEphemeralEnv(env, config.tenant) && isSharedEphemeral) {\n          if (!s.id.endsWith(`-${env}`)) continue;\n        }\n        try {\n          await api.dispatchNamespaceScriptDelete(ns.derivedName, s.id, {\n            force: true,\n          });\n          console.log(\n            `Deleted tenant script \"${s.id}\" from namespace ${ns.derivedName}.`,\n          );\n        } catch (err) {\n          console.warn(\n            `Failed to delete tenant script ${s.id} in ${ns.derivedName}:`,\n            err instanceof Error ? err.message : err,\n          );\n        }\n      }\n      if (isEphemeralEnv(env, config.tenant) && isSharedEphemeral) {\n        console.log(\n          `Left shared dispatch namespace ${ns.derivedName} (removed only scripts suffixed -${env}).`,\n        );\n        continue;\n      }\n      await api.dispatchNamespaceDelete(ns.derivedName);\n      state.delete(key);\n    } catch (err) {\n      console.warn(\n        `Failed to delete dispatch namespace ${ns.derivedName}:`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n  }\n}\n","import type { CfiConfig, DnsRecordStateEntry } from \"../../types.js\";\nimport { getDnsRecords } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\n\n/**\n * Tear down every DNS record this stack owns. Restricted to records\n * whose `logicalName` is declared in the current `CfiConfig.dnsRecords`\n * (matches `runDestroy` semantics for shared state rows). Records flagged\n * `preserveOnDestroy: true` are left in place but still dropped from\n * state — the operator is responsible for re-importing them later.\n */\nexport async function dnsRecordDestroy(\n  env: string,\n  state: StateManager,\n  api: CFApiClient,\n  config: CfiConfig,\n  _force?: boolean,\n): Promise<void> {\n  if (env === \"local\") return;\n  const declared = getDnsRecords(config);\n  if (declared.length === 0) return;\n  const preserve = new Map<string, boolean>(\n    declared.map((c) => [c.logicalName, !!c.preserveOnDestroy]),\n  );\n  const allowedLogical = new Set(declared.map((c) => c.logicalName));\n\n  for (const [key, entry] of Object.entries(state.getAll())) {\n    if (entry.type !== \"dns_record\") continue;\n    const rec = entry as DnsRecordStateEntry;\n    if (!allowedLogical.has(rec.logicalName)) continue;\n    if (preserve.get(rec.logicalName)) {\n      console.log(\n        `Preserved DNS record ${rec.recordType} ${rec.name} (preserveOnDestroy).`,\n      );\n      state.delete(key);\n      continue;\n    }\n    try {\n      await api.zoneDnsRecordDelete(rec.zoneId, rec.recordId);\n      state.delete(key);\n    } catch (err) {\n      console.warn(\n        `Failed to delete DNS record ${rec.recordType} ${rec.name}:`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n  }\n}\n","/** Shared envs where destroy must be confirmed with `--confirm-env <same>`. */\nexport const SHARED_ENV_DESTROY = [\n  \"dev\",\n  \"staging\",\n  \"prod\",\n  \"production\",\n] as const;\n\n/**\n * @param force When true, skips the typed confirmation (break-glass).\n */\nexport function assertDestroyEnvAllowed(\n  env: string,\n  force: boolean,\n  confirmEnv?: string,\n): void {\n  if (force) return;\n  if (!SHARED_ENV_DESTROY.includes(env as (typeof SHARED_ENV_DESTROY)[number])) {\n    return;\n  }\n  if (confirmEnv !== env) {\n    throw new Error(\n      `Destroying shared environment \"${env}\" requires --confirm-env ${env}`,\n    );\n  }\n}\n","import { loadConfig, getWorkers, getConfigBaseDir } from \"../../core/config/loader.js\";\nimport { logicalNamesForResourceKind } from \"../../core/config/resourcesFromConfig.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { deleteEnvStateRows } from \"../../core/state/tamerStateDb.js\";\nimport { deleteEnvArtifacts } from \"../../core/state/tamerArtifactsR2.js\";\nimport { deleteEnvSecretRows } from \"../../core/secrets/secretsDb.js\";\nimport { getDispatchNamespaces, getDnsRecords } from \"../../types.js\";\nimport { logpushJobDestroy } from \"../../features/logpush-job/index.js\";\nimport { assertDestroyEnvAllowed } from \"../destroyGuard.js\";\nimport { dispatchNamespaceDestroy } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordDestroy } from \"../../features/dns-records/index.js\";\nimport { workersDestroy } from \"../../features/workers/index.js\";\nimport { workerRoutesDestroy } from \"../../features/worker-route/index.js\";\nimport { runSync } from \"./sync.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { verifyPlanFile } from \"../../core/plan/verifyPlanFile.js\";\nimport { hashCloudflareSnapshot } from \"../../core/plan/planFile.js\";\nimport { buildCloudflareSnapshot } from \"../../core/plan/cloudflareSnapshot.js\";\n\nexport async function runDestroy(options: {\n  env: string;\n  force?: boolean;\n  skipWorkers?: boolean;\n  confirmEnv?: string;\n  configPath?: string;\n  /** When true, delete the shared `tamer-state-{env}` D1 after other resources (use on last stack teardown). */\n  wipeMetadata?: boolean;\n  /**\n   * Path to a destroy plan file from `tamer plan --destroy --out`. Destroy\n   * recomputes the `(config, state, cloudflare)` attestation hashes and\n   * refuses to proceed if any drifted (override with `allowStale`). The\n   * pinned plan ensures the operator destroys exactly what they reviewed.\n   */\n  planFile?: string;\n  allowStale?: boolean;\n}): Promise<void> {\n  const {\n    env,\n    force = false,\n    skipWorkers = false,\n    confirmEnv,\n    configPath,\n    wipeMetadata = false,\n  } = options;\n  assertDestroyEnvAllowed(env, force, confirmEnv);\n\n  const config = await loadConfig(configPath, { env });\n  const baseDir = getConfigBaseDir();\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  if (options.planFile) {\n    const verifyApi = new CFApiClient(accountId);\n    const verifyState = new StateManager(\n      config.tenant.id,\n      env,\n      stackNameForConfig(config),\n    );\n    await verifyState.hydrate(verifyApi);\n    const liveSnapshot =\n      env === \"local\"\n        ? undefined\n        : await buildCloudflareSnapshot({\n            config,\n            env,\n            api: verifyApi,\n            baseDir,\n          });\n    verifyPlanFile({\n      planPath: options.planFile,\n      command: \"destroy\",\n      expectedMode: \"destroy\",\n      env,\n      tenantId: config.tenant.id,\n      config,\n      stateAtPlanCheck: verifyState.load(),\n      liveCloudflareHash: liveSnapshot\n        ? hashCloudflareSnapshot(liveSnapshot)\n        : undefined,\n      allowStale: !!options.allowStale,\n    });\n  }\n\n  if (env !== \"local\") {\n    console.log(`Syncing state from Cloudflare for env: ${env}...`);\n    await runSync({ env, configPath });\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  state.beginOperation(\"destroy\", wipeMetadata ? \"wipe-metadata\" : undefined);\n  try {\n    await state.persist(api);\n  } catch {\n    /* in-progress marker best-effort */\n  }\n\n  try {\n    if (!skipWorkers) {\n      await workerRoutesDestroy(env, config, baseDir, state, api);\n      await state.persist(api);\n      await workersDestroy(env, baseDir, accountId, config, state, api, force);\n    }\n\n    const ownedByKind = await Promise.all(\n      resourceModules.map((m) =>\n        logicalNamesForResourceKind(config, baseDir, m.kind).then((set) => ({\n          mod: m,\n          owned: set,\n        })),\n      ),\n    );\n    const workers = await getWorkers(config, baseDir);\n\n    // Always run Logpush + Pipelines teardown: state may still hold\n    // `logpush_pipelines` even if logpush was removed from tamer.config.ts,\n    // and destroy must still delete the Pipelines stream/sink in that case.\n    await logpushJobDestroy(env, state, api, config);\n    await state.persist(api);\n\n    for (const { mod, owned } of ownedByKind) {\n      if (owned.size === 0) continue;\n      // Aggregate this kind's resources across all workers in the config — the\n      // destroy hook only needs them for stack-scope filtering and may walk\n      // state directly. Empty array is acceptable when state holds entries\n      // owned by another stack we still want to filter against `owned`.\n      const resources = workers.flatMap(([, wc]) => mod.pickResources(wc));\n      await mod.destroy({\n        resources,\n        tenant: config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n        force,\n      });\n    }\n\n    if (getDispatchNamespaces(config).length > 0) {\n      await dispatchNamespaceDestroy(env, state, api, config, force);\n    }\n\n    if (getDnsRecords(config).length > 0) {\n      await dnsRecordDestroy(env, state, api, config, force);\n    }\n\n    // Clear `stackOutputs` after every successful destroy — the values\n    // pointed at resources we just deleted, so leaving them in state would\n    // mislead a future `tamer status` and (post-imports) leak dangling\n    // refs into sibling stacks. The state row itself is dropped further\n    // below when `wipeMetadata` is set.\n    state.replaceStackOutputs({});\n\n    if (env !== \"local\" && wipeMetadata) {\n      state.clearDirty();\n      const deletedState = await deleteEnvStateRows(api, env);\n      if (deletedState) {\n        console.log(`Cleared Tamer state rows for env ${env}.`);\n      }\n      try {\n        await deleteEnvArtifacts(api, env);\n      } catch (err) {\n        console.warn(\n          `Failed to clean Tamer artifacts for env ${env}:`,\n          err instanceof Error ? err.message : err,\n        );\n      }\n      try {\n        const deletedSecrets = await deleteEnvSecretRows(api, env);\n        if (deletedSecrets) {\n          console.log(`Cleared Tamer secret rows for env ${env}.`);\n        }\n      } catch (err) {\n        console.warn(\n          `Failed to clean Tamer secrets for env ${env}:`,\n          err instanceof Error ? err.message : err,\n        );\n      }\n    }\n\n    if (env !== \"local\" && !wipeMetadata) {\n      state.finishOperation();\n      try {\n        await state.persist(api);\n      } catch {\n        /* state row may have been wiped by sub-steps */\n      }\n    }\n    state.clearDirty();\n    console.log(`Destroyed all resources for env: ${env}`);\n  } catch (err) {\n    if (env !== \"local\") {\n      state.failOperation(err instanceof Error ? err.message : String(err));\n      try {\n        await state.persist(api);\n      } catch {\n        /* swallow secondary persist failure */\n      }\n    }\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgBA,eAAsB,yBACpB,KACA,OACA,KACA,QACA,QACe;CACf,MAAM,iBAAiB,IAAI,IACzB,sBAAsB,OAAO,CAAC,KAAK,MAAM,EAAE,YAAY,CACxD;AACD,KAAI,eAAe,SAAS,EAAG;AAE/B,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACzD,MAAI,MAAM,SAAS,qBAAsB;EACzC,MAAM,KAAK;AACX,MAAI,CAAC,eAAe,IAAI,GAAG,YAAY,CAAE;EACzC,MAAM,oBAAoB,GAAG,YAAY,SAAS,aAAa;AAC/D,MAAI;GACF,MAAM,UAAU,MAAM,IAAI,4BAA4B,GAAG,YAAY;AACrE,QAAK,MAAM,KAAK,SAAS;AACvB,QAAI,eAAe,KAAK,OAAO,OAAO,IAAI,mBACxC;SAAI,CAAC,EAAE,GAAG,SAAS,IAAI,MAAM,CAAE;;AAEjC,QAAI;AACF,WAAM,IAAI,8BAA8B,GAAG,aAAa,EAAE,IAAI,EAC5D,OAAO,MACR,CAAC;AACF,aAAQ,IACN,0BAA0B,EAAE,GAAG,mBAAmB,GAAG,YAAY,GAClE;aACM,KAAK;AACZ,aAAQ,KACN,kCAAkC,EAAE,GAAG,MAAM,GAAG,YAAY,IAC5D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;AAGL,OAAI,eAAe,KAAK,OAAO,OAAO,IAAI,mBAAmB;AAC3D,YAAQ,IACN,kCAAkC,GAAG,YAAY,mCAAmC,IAAI,IACzF;AACD;;AAEF,SAAM,IAAI,wBAAwB,GAAG,YAAY;AACjD,SAAM,OAAO,IAAI;WACV,KAAK;AACZ,WAAQ,KACN,uCAAuC,GAAG,YAAY,IACtD,eAAe,QAAQ,IAAI,UAAU,IACtC;;;;;;;;;;;;;;ACrDP,eAAsB,iBACpB,KACA,OACA,KACA,QACA,QACe;AACf,KAAI,QAAQ,QAAS;CACrB,MAAM,WAAW,cAAc,OAAO;AACtC,KAAI,SAAS,WAAW,EAAG;CAC3B,MAAM,WAAW,IAAI,IACnB,SAAS,KAAK,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAC5D;CACD,MAAM,iBAAiB,IAAI,IAAI,SAAS,KAAK,MAAM,EAAE,YAAY,CAAC;AAElE,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACzD,MAAI,MAAM,SAAS,aAAc;EACjC,MAAM,MAAM;AACZ,MAAI,CAAC,eAAe,IAAI,IAAI,YAAY,CAAE;AAC1C,MAAI,SAAS,IAAI,IAAI,YAAY,EAAE;AACjC,WAAQ,IACN,wBAAwB,IAAI,WAAW,GAAG,IAAI,KAAK,uBACpD;AACD,SAAM,OAAO,IAAI;AACjB;;AAEF,MAAI;AACF,SAAM,IAAI,oBAAoB,IAAI,QAAQ,IAAI,SAAS;AACvD,SAAM,OAAO,IAAI;WACV,KAAK;AACZ,WAAQ,KACN,+BAA+B,IAAI,WAAW,GAAG,IAAI,KAAK,IAC1D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;;;;;;AC5CP,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACD;;;;AAKD,SAAgB,wBACd,KACA,OACA,YACM;AACN,KAAI,MAAO;AACX,KAAI,CAAC,mBAAmB,SAAS,IAA2C,CAC1E;AAEF,KAAI,eAAe,IACjB,OAAM,IAAI,MACR,kCAAkC,IAAI,2BAA2B,MAClE;;;;;ACAL,eAAsB,WAAW,SAgBf;CAChB,MAAM,EACJ,KACA,QAAQ,OACR,cAAc,OACd,YACA,YACA,eAAe,UACb;AACJ,yBAAwB,KAAK,OAAO,WAAW;CAE/C,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,UAAU,kBAAkB;CAClC,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;AAGH,KAAI,QAAQ,UAAU;EACpB,MAAM,YAAY,IAAI,YAAY,UAAU;EAC5C,MAAM,cAAc,IAAI,aACtB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,QAAM,YAAY,QAAQ,UAAU;EACpC,MAAM,eACJ,QAAQ,UACJ,SACA,MAAM,wBAAwB;GAC5B;GACA;GACA,KAAK;GACL;GACD,CAAC;AACR,iBAAe;GACb,UAAU,QAAQ;GAClB,SAAS;GACT,cAAc;GACd;GACA,UAAU,OAAO,OAAO;GACxB;GACA,kBAAkB,YAAY,MAAM;GACpC,oBAAoB,eAChB,uBAAuB,aAAa,GACpC;GACJ,YAAY,CAAC,CAAC,QAAQ;GACvB,CAAC;;AAGJ,KAAI,QAAQ,SAAS;AACnB,UAAQ,IAAI,0CAA0C,IAAI,KAAK;AAC/D,QAAM,QAAQ;GAAE;GAAK;GAAY,CAAC;;CAGpC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;AACxB,OAAM,eAAe,WAAW,eAAe,kBAAkB,OAAU;AAC3E,KAAI;AACF,QAAM,MAAM,QAAQ,IAAI;SAClB;AAIR,KAAI;AACF,MAAI,CAAC,aAAa;AAChB,SAAM,oBAAoB,KAAK,QAAQ,SAAS,OAAO,IAAI;AAC3D,SAAM,MAAM,QAAQ,IAAI;AACxB,SAAM,eAAe,KAAK,SAAS,WAAW,QAAQ,OAAO,KAAK,MAAM;;EAG1E,MAAM,cAAc,MAAM,QAAQ,IAChC,gBAAgB,KAAK,MACnB,4BAA4B,QAAQ,SAAS,EAAE,KAAK,CAAC,MAAM,SAAS;GAClE,KAAK;GACL,OAAO;GACR,EAAE,CACJ,CACF;EACD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AAKjD,QAAM,kBAAkB,KAAK,OAAO,KAAK,OAAO;AAChD,QAAM,MAAM,QAAQ,IAAI;AAExB,OAAK,MAAM,EAAE,KAAK,WAAW,aAAa;AACxC,OAAI,MAAM,SAAS,EAAG;GAKtB,MAAM,YAAY,QAAQ,SAAS,GAAG,QAAQ,IAAI,cAAc,GAAG,CAAC;AACpE,SAAM,IAAI,QAAQ;IAChB;IACA,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;;AAGJ,MAAI,sBAAsB,OAAO,CAAC,SAAS,EACzC,OAAM,yBAAyB,KAAK,OAAO,KAAK,QAAQ,MAAM;AAGhE,MAAI,cAAc,OAAO,CAAC,SAAS,EACjC,OAAM,iBAAiB,KAAK,OAAO,KAAK,QAAQ,MAAM;AAQxD,QAAM,oBAAoB,EAAE,CAAC;AAE7B,MAAI,QAAQ,WAAW,cAAc;AACnC,SAAM,YAAY;AAElB,OADqB,MAAM,mBAAmB,KAAK,IAAI,CAErD,SAAQ,IAAI,oCAAoC,IAAI,GAAG;AAEzD,OAAI;AACF,UAAM,mBAAmB,KAAK,IAAI;YAC3B,KAAK;AACZ,YAAQ,KACN,2CAA2C,IAAI,IAC/C,eAAe,QAAQ,IAAI,UAAU,IACtC;;AAEH,OAAI;AAEF,QADuB,MAAM,oBAAoB,KAAK,IAAI,CAExD,SAAQ,IAAI,qCAAqC,IAAI,GAAG;YAEnD,KAAK;AACZ,YAAQ,KACN,yCAAyC,IAAI,IAC7C,eAAe,QAAQ,IAAI,UAAU,IACtC;;;AAIL,MAAI,QAAQ,WAAW,CAAC,cAAc;AACpC,SAAM,iBAAiB;AACvB,OAAI;AACF,UAAM,MAAM,QAAQ,IAAI;WAClB;;AAIV,QAAM,YAAY;AAClB,UAAQ,IAAI,oCAAoC,MAAM;UAC/C,KAAK;AACZ,MAAI,QAAQ,SAAS;AACnB,SAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,OAAI;AACF,UAAM,MAAM,QAAQ,IAAI;WAClB;;AAIV,QAAM"}
+{"version":3,"file":"destroy-OozAEB7_.mjs","names":[],"sources":["../src/features/dispatch-namespace/dispatch-namespace.destroy.ts","../src/features/dns-records/dns-records.destroy.ts","../src/cli/destroyGuard.ts","../src/cli/commands/destroy.ts"],"sourcesContent":["import type { CfiConfig } from \"../../types.js\";\nimport { getDispatchNamespaces } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { DispatchNamespaceStateEntry } from \"../../types.js\";\nimport { isEphemeralEnv } from \"./dispatch-namespace.resolve.js\";\n\n/**\n * Tear down every dispatch namespace recorded in state.\n *\n * Cloudflare refuses to delete a namespace that still contains scripts, so we\n * enumerate `/dispatch/namespaces/{ns}/scripts` and delete each (with `force`\n * so dependents like service-bind targets don't block the removal). This\n * covers tenant scripts uploaded by `tamer wfp put` / `provision-workflow`\n * that aren't otherwise tracked in Tamer state.\n */\nexport async function dispatchNamespaceDestroy(\n  env: string,\n  state: StateManager,\n  api: CFApiClient,\n  config: CfiConfig,\n  _force?: boolean,\n): Promise<void> {\n  const allowedLogical = new Set(\n    getDispatchNamespaces(config).map((d) => d.logicalName),\n  );\n  if (allowedLogical.size === 0) return;\n\n  for (const [key, entry] of Object.entries(state.getAll())) {\n    if (entry.type !== \"dispatch_namespace\") continue;\n    const ns = entry as DispatchNamespaceStateEntry;\n    if (!allowedLogical.has(ns.logicalName)) continue;\n    const isSharedEphemeral = ns.derivedName.endsWith(\"-ephemeral\");\n    try {\n      const scripts = await api.dispatchNamespaceScriptList(ns.derivedName);\n      for (const s of scripts) {\n        if (isEphemeralEnv(env, config.tenant) && isSharedEphemeral) {\n          if (!s.id.endsWith(`-${env}`)) continue;\n        }\n        try {\n          await api.dispatchNamespaceScriptDelete(ns.derivedName, s.id, {\n            force: true,\n          });\n          console.log(\n            `Deleted tenant script \"${s.id}\" from namespace ${ns.derivedName}.`,\n          );\n        } catch (err) {\n          console.warn(\n            `Failed to delete tenant script ${s.id} in ${ns.derivedName}:`,\n            err instanceof Error ? err.message : err,\n          );\n        }\n      }\n      if (isEphemeralEnv(env, config.tenant) && isSharedEphemeral) {\n        console.log(\n          `Left shared dispatch namespace ${ns.derivedName} (removed only scripts suffixed -${env}).`,\n        );\n        continue;\n      }\n      await api.dispatchNamespaceDelete(ns.derivedName);\n      state.delete(key);\n    } catch (err) {\n      console.warn(\n        `Failed to delete dispatch namespace ${ns.derivedName}:`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n  }\n}\n","import type { CfiConfig, DnsRecordStateEntry } from \"../../types.js\";\nimport { getDnsRecords } from \"../../types.js\";\nimport type { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\n\n/**\n * Tear down every DNS record this stack owns. Restricted to records\n * whose `logicalName` is declared in the current `CfiConfig.dnsRecords`\n * (matches `runDestroy` semantics for shared state rows). Records flagged\n * `preserveOnDestroy: true` are left in place but still dropped from\n * state — the operator is responsible for re-importing them later.\n */\nexport async function dnsRecordDestroy(\n  env: string,\n  state: StateManager,\n  api: CFApiClient,\n  config: CfiConfig,\n  _force?: boolean,\n): Promise<void> {\n  if (env === \"local\") return;\n  const declared = getDnsRecords(config);\n  if (declared.length === 0) return;\n  const preserve = new Map<string, boolean>(\n    declared.map((c) => [c.logicalName, !!c.preserveOnDestroy]),\n  );\n  const allowedLogical = new Set(declared.map((c) => c.logicalName));\n\n  for (const [key, entry] of Object.entries(state.getAll())) {\n    if (entry.type !== \"dns_record\") continue;\n    const rec = entry as DnsRecordStateEntry;\n    if (!allowedLogical.has(rec.logicalName)) continue;\n    if (preserve.get(rec.logicalName)) {\n      console.log(\n        `Preserved DNS record ${rec.recordType} ${rec.name} (preserveOnDestroy).`,\n      );\n      state.delete(key);\n      continue;\n    }\n    try {\n      await api.zoneDnsRecordDelete(rec.zoneId, rec.recordId);\n      state.delete(key);\n    } catch (err) {\n      console.warn(\n        `Failed to delete DNS record ${rec.recordType} ${rec.name}:`,\n        err instanceof Error ? err.message : err,\n      );\n    }\n  }\n}\n","/** Shared envs where destroy must be confirmed with `--confirm-env <same>`. */\nexport const SHARED_ENV_DESTROY = [\n  \"dev\",\n  \"staging\",\n  \"prod\",\n  \"production\",\n] as const;\n\n/**\n * @param force When true, skips the typed confirmation (break-glass).\n */\nexport function assertDestroyEnvAllowed(\n  env: string,\n  force: boolean,\n  confirmEnv?: string,\n): void {\n  if (force) return;\n  if (!SHARED_ENV_DESTROY.includes(env as (typeof SHARED_ENV_DESTROY)[number])) {\n    return;\n  }\n  if (confirmEnv !== env) {\n    throw new Error(\n      `Destroying shared environment \"${env}\" requires --confirm-env ${env}`,\n    );\n  }\n}\n","import { loadConfig, getWorkers, getConfigBaseDir } from \"../../core/config/loader.js\";\nimport { logicalNamesForResourceKind } from \"../../core/config/resourcesFromConfig.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { deleteEnvStateRows } from \"../../core/state/tamerStateDb.js\";\nimport { deleteEnvArtifacts } from \"../../core/state/tamerArtifactsR2.js\";\nimport { deleteEnvSecretRows } from \"../../core/secrets/secretsDb.js\";\nimport { getDispatchNamespaces, getDnsRecords } from \"../../types.js\";\nimport { logpushJobDestroy } from \"../../features/logpush-job/index.js\";\nimport { assertDestroyEnvAllowed } from \"../destroyGuard.js\";\nimport { dispatchNamespaceDestroy } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordDestroy } from \"../../features/dns-records/index.js\";\nimport { workersDestroy } from \"../../features/workers/index.js\";\nimport { workerRoutesDestroy } from \"../../features/worker-route/index.js\";\nimport { runSync } from \"./sync.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { verifyPlanFile } from \"../../core/plan/verifyPlanFile.js\";\nimport { hashCloudflareSnapshot } from \"../../core/plan/planFile.js\";\nimport { buildCloudflareSnapshot } from \"../../core/plan/cloudflareSnapshot.js\";\n\nexport async function runDestroy(options: {\n  env: string;\n  force?: boolean;\n  skipWorkers?: boolean;\n  confirmEnv?: string;\n  configPath?: string;\n  /** When true, delete the shared `tamer-state-{env}` D1 after other resources (use on last stack teardown). */\n  wipeMetadata?: boolean;\n  /**\n   * Path to a destroy plan file from `tamer plan --destroy --out`. Destroy\n   * recomputes the `(config, state, cloudflare)` attestation hashes and\n   * refuses to proceed if any drifted (override with `allowStale`). The\n   * pinned plan ensures the operator destroys exactly what they reviewed.\n   */\n  planFile?: string;\n  allowStale?: boolean;\n}): Promise<void> {\n  const {\n    env,\n    force = false,\n    skipWorkers = false,\n    confirmEnv,\n    configPath,\n    wipeMetadata = false,\n  } = options;\n  assertDestroyEnvAllowed(env, force, confirmEnv);\n\n  const config = await loadConfig(configPath, { env });\n  const baseDir = getConfigBaseDir();\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  if (options.planFile) {\n    const verifyApi = new CFApiClient(accountId);\n    const verifyState = new StateManager(\n      config.tenant.id,\n      env,\n      stackNameForConfig(config),\n    );\n    await verifyState.hydrate(verifyApi);\n    const liveSnapshot =\n      env === \"local\"\n        ? undefined\n        : await buildCloudflareSnapshot({\n            config,\n            env,\n            api: verifyApi,\n            baseDir,\n          });\n    verifyPlanFile({\n      planPath: options.planFile,\n      command: \"destroy\",\n      expectedMode: \"destroy\",\n      env,\n      tenantId: config.tenant.id,\n      config,\n      stateAtPlanCheck: verifyState.load(),\n      liveCloudflareHash: liveSnapshot\n        ? hashCloudflareSnapshot(liveSnapshot)\n        : undefined,\n      allowStale: !!options.allowStale,\n    });\n  }\n\n  if (env !== \"local\") {\n    console.log(`Syncing state from Cloudflare for env: ${env}...`);\n    await runSync({ env, configPath });\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  state.beginOperation(\"destroy\", wipeMetadata ? \"wipe-metadata\" : undefined);\n  try {\n    await state.persist(api);\n  } catch {\n    /* in-progress marker best-effort */\n  }\n\n  try {\n    if (!skipWorkers) {\n      await workerRoutesDestroy(env, config, baseDir, state, api);\n      await state.persist(api);\n      await workersDestroy(env, baseDir, accountId, config, state, api, force);\n    }\n\n    const ownedByKind = await Promise.all(\n      resourceModules.map((m) =>\n        logicalNamesForResourceKind(config, baseDir, m.kind).then((set) => ({\n          mod: m,\n          owned: set,\n        })),\n      ),\n    );\n    const workers = await getWorkers(config, baseDir);\n\n    // Always run Logpush + Pipelines teardown: state may still hold\n    // `logpush_pipelines` even if logpush was removed from tamer.config.ts,\n    // and destroy must still delete the Pipelines stream/sink in that case.\n    await logpushJobDestroy(env, state, api, config);\n    await state.persist(api);\n\n    for (const { mod, owned } of ownedByKind) {\n      if (owned.size === 0) continue;\n      // Aggregate this kind's resources across all workers in the config — the\n      // destroy hook only needs them for stack-scope filtering and may walk\n      // state directly. Empty array is acceptable when state holds entries\n      // owned by another stack we still want to filter against `owned`.\n      const resources = workers.flatMap(([, wc]) => mod.pickResources(wc));\n      await mod.destroy({\n        resources,\n        tenant: config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n        force,\n      });\n    }\n\n    if (getDispatchNamespaces(config).length > 0) {\n      await dispatchNamespaceDestroy(env, state, api, config, force);\n    }\n\n    if (getDnsRecords(config).length > 0) {\n      await dnsRecordDestroy(env, state, api, config, force);\n    }\n\n    // Clear `stackOutputs` after every successful destroy — the values\n    // pointed at resources we just deleted, so leaving them in state would\n    // mislead a future `tamer status` and (post-imports) leak dangling\n    // refs into sibling stacks. The state row itself is dropped further\n    // below when `wipeMetadata` is set.\n    state.replaceStackOutputs({});\n\n    if (env !== \"local\" && wipeMetadata) {\n      state.clearDirty();\n      const deletedState = await deleteEnvStateRows(api, env);\n      if (deletedState) {\n        console.log(`Cleared Tamer state rows for env ${env}.`);\n      }\n      try {\n        await deleteEnvArtifacts(api, env);\n      } catch (err) {\n        console.warn(\n          `Failed to clean Tamer artifacts for env ${env}:`,\n          err instanceof Error ? err.message : err,\n        );\n      }\n      try {\n        const deletedSecrets = await deleteEnvSecretRows(api, env);\n        if (deletedSecrets) {\n          console.log(`Cleared Tamer secret rows for env ${env}.`);\n        }\n      } catch (err) {\n        console.warn(\n          `Failed to clean Tamer secrets for env ${env}:`,\n          err instanceof Error ? err.message : err,\n        );\n      }\n    }\n\n    if (env !== \"local\" && !wipeMetadata) {\n      state.finishOperation();\n      try {\n        await state.persist(api);\n      } catch {\n        /* state row may have been wiped by sub-steps */\n      }\n    }\n    state.clearDirty();\n    console.log(`Destroyed all resources for env: ${env}`);\n  } catch (err) {\n    if (env !== \"local\") {\n      state.failOperation(err instanceof Error ? err.message : String(err));\n      try {\n        await state.persist(api);\n      } catch {\n        /* swallow secondary persist failure */\n      }\n    }\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgBA,eAAsB,yBACpB,KACA,OACA,KACA,QACA,QACe;CACf,MAAM,iBAAiB,IAAI,IACzB,sBAAsB,OAAO,CAAC,KAAK,MAAM,EAAE,YAAY,CACxD;AACD,KAAI,eAAe,SAAS,EAAG;AAE/B,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACzD,MAAI,MAAM,SAAS,qBAAsB;EACzC,MAAM,KAAK;AACX,MAAI,CAAC,eAAe,IAAI,GAAG,YAAY,CAAE;EACzC,MAAM,oBAAoB,GAAG,YAAY,SAAS,aAAa;AAC/D,MAAI;GACF,MAAM,UAAU,MAAM,IAAI,4BAA4B,GAAG,YAAY;AACrE,QAAK,MAAM,KAAK,SAAS;AACvB,QAAI,eAAe,KAAK,OAAO,OAAO,IAAI,mBACxC;SAAI,CAAC,EAAE,GAAG,SAAS,IAAI,MAAM,CAAE;;AAEjC,QAAI;AACF,WAAM,IAAI,8BAA8B,GAAG,aAAa,EAAE,IAAI,EAC5D,OAAO,MACR,CAAC;AACF,aAAQ,IACN,0BAA0B,EAAE,GAAG,mBAAmB,GAAG,YAAY,GAClE;aACM,KAAK;AACZ,aAAQ,KACN,kCAAkC,EAAE,GAAG,MAAM,GAAG,YAAY,IAC5D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;AAGL,OAAI,eAAe,KAAK,OAAO,OAAO,IAAI,mBAAmB;AAC3D,YAAQ,IACN,kCAAkC,GAAG,YAAY,mCAAmC,IAAI,IACzF;AACD;;AAEF,SAAM,IAAI,wBAAwB,GAAG,YAAY;AACjD,SAAM,OAAO,IAAI;WACV,KAAK;AACZ,WAAQ,KACN,uCAAuC,GAAG,YAAY,IACtD,eAAe,QAAQ,IAAI,UAAU,IACtC;;;;;;;;;;;;;;ACrDP,eAAsB,iBACpB,KACA,OACA,KACA,QACA,QACe;AACf,KAAI,QAAQ,QAAS;CACrB,MAAM,WAAW,cAAc,OAAO;AACtC,KAAI,SAAS,WAAW,EAAG;CAC3B,MAAM,WAAW,IAAI,IACnB,SAAS,KAAK,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAC5D;CACD,MAAM,iBAAiB,IAAI,IAAI,SAAS,KAAK,MAAM,EAAE,YAAY,CAAC;AAElE,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACzD,MAAI,MAAM,SAAS,aAAc;EACjC,MAAM,MAAM;AACZ,MAAI,CAAC,eAAe,IAAI,IAAI,YAAY,CAAE;AAC1C,MAAI,SAAS,IAAI,IAAI,YAAY,EAAE;AACjC,WAAQ,IACN,wBAAwB,IAAI,WAAW,GAAG,IAAI,KAAK,uBACpD;AACD,SAAM,OAAO,IAAI;AACjB;;AAEF,MAAI;AACF,SAAM,IAAI,oBAAoB,IAAI,QAAQ,IAAI,SAAS;AACvD,SAAM,OAAO,IAAI;WACV,KAAK;AACZ,WAAQ,KACN,+BAA+B,IAAI,WAAW,GAAG,IAAI,KAAK,IAC1D,eAAe,QAAQ,IAAI,UAAU,IACtC;;;;;;;;AC5CP,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACD;;;;AAKD,SAAgB,wBACd,KACA,OACA,YACM;AACN,KAAI,MAAO;AACX,KAAI,CAAC,mBAAmB,SAAS,IAA2C,CAC1E;AAEF,KAAI,eAAe,IACjB,OAAM,IAAI,MACR,kCAAkC,IAAI,2BAA2B,MAClE;;;;;ACAL,eAAsB,WAAW,SAgBf;CAChB,MAAM,EACJ,KACA,QAAQ,OACR,cAAc,OACd,YACA,YACA,eAAe,UACb;AACJ,yBAAwB,KAAK,OAAO,WAAW;CAE/C,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,UAAU,kBAAkB;CAClC,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;AAGH,KAAI,QAAQ,UAAU;EACpB,MAAM,YAAY,IAAI,YAAY,UAAU;EAC5C,MAAM,cAAc,IAAI,aACtB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,QAAM,YAAY,QAAQ,UAAU;EACpC,MAAM,eACJ,QAAQ,UACJ,SACA,MAAM,wBAAwB;GAC5B;GACA;GACA,KAAK;GACL;GACD,CAAC;AACR,iBAAe;GACb,UAAU,QAAQ;GAClB,SAAS;GACT,cAAc;GACd;GACA,UAAU,OAAO,OAAO;GACxB;GACA,kBAAkB,YAAY,MAAM;GACpC,oBAAoB,eAChB,uBAAuB,aAAa,GACpC;GACJ,YAAY,CAAC,CAAC,QAAQ;GACvB,CAAC;;AAGJ,KAAI,QAAQ,SAAS;AACnB,UAAQ,IAAI,0CAA0C,IAAI,KAAK;AAC/D,QAAM,QAAQ;GAAE;GAAK;GAAY,CAAC;;CAGpC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;AACxB,OAAM,eAAe,WAAW,eAAe,kBAAkB,OAAU;AAC3E,KAAI;AACF,QAAM,MAAM,QAAQ,IAAI;SAClB;AAIR,KAAI;AACF,MAAI,CAAC,aAAa;AAChB,SAAM,oBAAoB,KAAK,QAAQ,SAAS,OAAO,IAAI;AAC3D,SAAM,MAAM,QAAQ,IAAI;AACxB,SAAM,eAAe,KAAK,SAAS,WAAW,QAAQ,OAAO,KAAK,MAAM;;EAG1E,MAAM,cAAc,MAAM,QAAQ,IAChC,gBAAgB,KAAK,MACnB,4BAA4B,QAAQ,SAAS,EAAE,KAAK,CAAC,MAAM,SAAS;GAClE,KAAK;GACL,OAAO;GACR,EAAE,CACJ,CACF;EACD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AAKjD,QAAM,kBAAkB,KAAK,OAAO,KAAK,OAAO;AAChD,QAAM,MAAM,QAAQ,IAAI;AAExB,OAAK,MAAM,EAAE,KAAK,WAAW,aAAa;AACxC,OAAI,MAAM,SAAS,EAAG;GAKtB,MAAM,YAAY,QAAQ,SAAS,GAAG,QAAQ,IAAI,cAAc,GAAG,CAAC;AACpE,SAAM,IAAI,QAAQ;IAChB;IACA,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;;AAGJ,MAAI,sBAAsB,OAAO,CAAC,SAAS,EACzC,OAAM,yBAAyB,KAAK,OAAO,KAAK,QAAQ,MAAM;AAGhE,MAAI,cAAc,OAAO,CAAC,SAAS,EACjC,OAAM,iBAAiB,KAAK,OAAO,KAAK,QAAQ,MAAM;AAQxD,QAAM,oBAAoB,EAAE,CAAC;AAE7B,MAAI,QAAQ,WAAW,cAAc;AACnC,SAAM,YAAY;AAElB,OADqB,MAAM,mBAAmB,KAAK,IAAI,CAErD,SAAQ,IAAI,oCAAoC,IAAI,GAAG;AAEzD,OAAI;AACF,UAAM,mBAAmB,KAAK,IAAI;YAC3B,KAAK;AACZ,YAAQ,KACN,2CAA2C,IAAI,IAC/C,eAAe,QAAQ,IAAI,UAAU,IACtC;;AAEH,OAAI;AAEF,QADuB,MAAM,oBAAoB,KAAK,IAAI,CAExD,SAAQ,IAAI,qCAAqC,IAAI,GAAG;YAEnD,KAAK;AACZ,YAAQ,KACN,yCAAyC,IAAI,IAC7C,eAAe,QAAQ,IAAI,UAAU,IACtC;;;AAIL,MAAI,QAAQ,WAAW,CAAC,cAAc;AACpC,SAAM,iBAAiB;AACvB,OAAI;AACF,UAAM,MAAM,QAAQ,IAAI;WAClB;;AAIV,QAAM,YAAY;AAClB,UAAQ,IAAI,oCAAoC,MAAM;UAC/C,KAAK;AACZ,MAAI,QAAQ,SAAS;AACnB,SAAM,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AACrE,OAAI;AACF,UAAM,MAAM,QAAQ,IAAI;WAClB;;AAIV,QAAM"}