@dragonmastery/tamer 0.42.1 → 0.43.0

package/dist/{resolveTenantBindings-86AmRQcW.mjs → resolveTenantBindings-CXLwAG0F.mjs}

@@ -1,5 +1,5 @@
 import { n as materializeTamerResolvable } from "./normalize-DVSTRZhO.mjs";
-import { j as resolveReferencesInString } from "./tamer.mjs";
+import { I as resolveReferencesInString } from "./tamer.mjs";
 
 //#region src/core/tenant/resolveTenantBindings.ts
 /**
@@ -62,4 +62,4 @@ function resolveTenantBindings(config, shards, naming, state, env, accountId) {
 
 //#endregion
 export { resolveTenantBindings, resolveTenantD1Bindings };
-//# sourceMappingURL=resolveTenantBindings-86AmRQcW.mjs.map
+//# sourceMappingURL=resolveTenantBindings-CXLwAG0F.mjs.map

package/dist/{resolveTenantBindings-86AmRQcW.mjs.map → resolveTenantBindings-CXLwAG0F.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"resolveTenantBindings-86AmRQcW.mjs","names":["bindings: Array<\n    | { type: \"d1\"; name: string; id: string }\n    | { type: \"plain_text\"; name: string; text: string }\n    | { type: \"service\"; name: string; service: string; environment?: string }\n  >","refCtx: ReferenceContext"],"sources":["../src/core/tenant/resolveTenantBindings.ts"],"sourcesContent":["/**\n * Resolve dispatch script bindings for a provisioned tenant.\n *\n * D1 bindings derive from `tenant.shardBindings` matched to the tenant's\n * shard roles. Vars and services come from `tenant.dispatchVars` /\n * `tenant.dispatchServices` (resolved against state for `${tamer:...}`\n * references).\n */\nimport type { CfiConfig, TenantD1ShardRef } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport type { DispatchScriptBindings } from \"../../core/wfp/buildDispatchUploadForm.js\";\nimport { materializeTamerResolvable } from \"../../dx/normalize.js\";\nimport {\n  resolveReferencesInString,\n  type ReferenceContext,\n} from \"../../core/references/references.js\";\n\n/**\n * Resolve D1 bindings for the tenant dispatch script.\n * Matches shard roles to `tenant.shardBindings` and produces\n * unified `bindings[]` entries: `{ type: \"d1\", name: binding, id: cfId }`.\n */\nexport function resolveTenantD1Bindings(\n  config: CfiConfig,\n  shards: TenantD1ShardRef[],\n  naming: NamingEngine,\n): Array<{ type: \"d1\"; name: string; id: string }> {\n  const shardBindings = config.tenant.shardBindings ?? {};\n  return shards.map((shard) => {\n    const info = shardBindings[shard.role];\n    const binding = info?.binding ?? `DB_${shard.role.toUpperCase().replace(/-/g, \"_\")}`;\n    return { type: \"d1\", name: binding, id: shard.cfId };\n  });\n}\n\n/**\n * Resolve all dispatch script bindings (D1 + vars + services).\n * References in vars/services are resolved against state.\n * Uses the unified Cloudflare bindings format.\n */\nexport function resolveTenantBindings(\n  config: CfiConfig,\n  shards: TenantD1ShardRef[],\n  naming: NamingEngine,\n  state: StateManager,\n  env: string,\n  accountId: string,\n): DispatchScriptBindings {\n  const bindings: Array<\n    | { type: \"d1\"; name: string; id: string }\n    | { type: \"plain_text\"; name: string; text: string }\n    | { type: \"service\"; name: string; service: string; environment?: string }\n  > = [];\n\n  // D1 bindings from shard roles\n  bindings.push(...resolveTenantD1Bindings(config, shards, naming));\n\n  // Vars from config.tenant.dispatchVars\n  if (config.tenant.dispatchVars) {\n    const refCtx: ReferenceContext = {\n      config,\n      env,\n      state,\n      naming,\n      accountId,\n    };\n    for (const [key, value] of Object.entries(config.tenant.dispatchVars)) {\n      const text = resolveReferencesInString(\n        materializeTamerResolvable(value),\n        refCtx,\n        `tenant.dispatchVars.${key}`,\n      );\n      bindings.push({ type: \"plain_text\", name: key, text });\n    }\n  }\n\n  // Service bindings from config.tenant.dispatchServices\n  if (config.tenant.dispatchServices?.length) {\n    const refCtx: ReferenceContext = {\n      config,\n      env,\n      state,\n      naming,\n      accountId,\n    };\n    for (const s of config.tenant.dispatchServices) {\n      bindings.push({\n        type: \"service\",\n        name: s.name,\n        service: resolveReferencesInString(\n          materializeTamerResolvable(s.service),\n          refCtx,\n          `tenant.dispatchServices.${s.name}.service`,\n        ),\n        ...(s.environment ? { environment: s.environment } : {}),\n      });\n    }\n  }\n\n  return bindings.length > 0 ? { bindings } : {};\n}\n"],"mappings":";;;;;;;;;AAuBA,SAAgB,wBACd,QACA,QACA,QACiD;CACjD,MAAM,gBAAgB,OAAO,OAAO,iBAAiB,EAAE;AACvD,QAAO,OAAO,KAAK,UAAU;AAG3B,SAAO;GAAE,MAAM;GAAM,MAFR,cAAc,MAAM,OACX,WAAW,MAAM,MAAM,KAAK,aAAa,CAAC,QAAQ,MAAM,IAAI;GAC9C,IAAI,MAAM;GAAM;GACpD;;;;;;;AAQJ,SAAgB,sBACd,QACA,QACA,QACA,OACA,KACA,WACwB;CACxB,MAAMA,WAIF,EAAE;AAGN,UAAS,KAAK,GAAG,wBAAwB,QAAQ,QAAQ,OAAO,CAAC;AAGjE,KAAI,OAAO,OAAO,cAAc;EAC9B,MAAMC,SAA2B;GAC/B;GACA;GACA;GACA;GACA;GACD;AACD,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,OAAO,aAAa,EAAE;GACrE,MAAM,OAAO,0BACX,2BAA2B,MAAM,EACjC,QACA,uBAAuB,MACxB;AACD,YAAS,KAAK;IAAE,MAAM;IAAc,MAAM;IAAK;IAAM,CAAC;;;AAK1D,KAAI,OAAO,OAAO,kBAAkB,QAAQ;EAC1C,MAAMA,SAA2B;GAC/B;GACA;GACA;GACA;GACA;GACD;AACD,OAAK,MAAM,KAAK,OAAO,OAAO,iBAC5B,UAAS,KAAK;GACZ,MAAM;GACN,MAAM,EAAE;GACR,SAAS,0BACP,2BAA2B,EAAE,QAAQ,EACrC,QACA,2BAA2B,EAAE,KAAK,UACnC;GACD,GAAI,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,GAAG,EAAE;GACxD,CAAC;;AAIN,QAAO,SAAS,SAAS,IAAI,EAAE,UAAU,GAAG,EAAE"}
+{"version":3,"file":"resolveTenantBindings-CXLwAG0F.mjs","names":["bindings: Array<\n    | { type: \"d1\"; name: string; id: string }\n    | { type: \"plain_text\"; name: string; text: string }\n    | { type: \"service\"; name: string; service: string; environment?: string }\n  >","refCtx: ReferenceContext"],"sources":["../src/core/tenant/resolveTenantBindings.ts"],"sourcesContent":["/**\n * Resolve dispatch script bindings for a provisioned tenant.\n *\n * D1 bindings derive from `tenant.shardBindings` matched to the tenant's\n * shard roles. Vars and services come from `tenant.dispatchVars` /\n * `tenant.dispatchServices` (resolved against state for `${tamer:...}`\n * references).\n */\nimport type { CfiConfig, TenantD1ShardRef } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport type { DispatchScriptBindings } from \"../../core/wfp/buildDispatchUploadForm.js\";\nimport { materializeTamerResolvable } from \"../../dx/normalize.js\";\nimport {\n  resolveReferencesInString,\n  type ReferenceContext,\n} from \"../../core/references/references.js\";\n\n/**\n * Resolve D1 bindings for the tenant dispatch script.\n * Matches shard roles to `tenant.shardBindings` and produces\n * unified `bindings[]` entries: `{ type: \"d1\", name: binding, id: cfId }`.\n */\nexport function resolveTenantD1Bindings(\n  config: CfiConfig,\n  shards: TenantD1ShardRef[],\n  naming: NamingEngine,\n): Array<{ type: \"d1\"; name: string; id: string }> {\n  const shardBindings = config.tenant.shardBindings ?? {};\n  return shards.map((shard) => {\n    const info = shardBindings[shard.role];\n    const binding = info?.binding ?? `DB_${shard.role.toUpperCase().replace(/-/g, \"_\")}`;\n    return { type: \"d1\", name: binding, id: shard.cfId };\n  });\n}\n\n/**\n * Resolve all dispatch script bindings (D1 + vars + services).\n * References in vars/services are resolved against state.\n * Uses the unified Cloudflare bindings format.\n */\nexport function resolveTenantBindings(\n  config: CfiConfig,\n  shards: TenantD1ShardRef[],\n  naming: NamingEngine,\n  state: StateManager,\n  env: string,\n  accountId: string,\n): DispatchScriptBindings {\n  const bindings: Array<\n    | { type: \"d1\"; name: string; id: string }\n    | { type: \"plain_text\"; name: string; text: string }\n    | { type: \"service\"; name: string; service: string; environment?: string }\n  > = [];\n\n  // D1 bindings from shard roles\n  bindings.push(...resolveTenantD1Bindings(config, shards, naming));\n\n  // Vars from config.tenant.dispatchVars\n  if (config.tenant.dispatchVars) {\n    const refCtx: ReferenceContext = {\n      config,\n      env,\n      state,\n      naming,\n      accountId,\n    };\n    for (const [key, value] of Object.entries(config.tenant.dispatchVars)) {\n      const text = resolveReferencesInString(\n        materializeTamerResolvable(value),\n        refCtx,\n        `tenant.dispatchVars.${key}`,\n      );\n      bindings.push({ type: \"plain_text\", name: key, text });\n    }\n  }\n\n  // Service bindings from config.tenant.dispatchServices\n  if (config.tenant.dispatchServices?.length) {\n    const refCtx: ReferenceContext = {\n      config,\n      env,\n      state,\n      naming,\n      accountId,\n    };\n    for (const s of config.tenant.dispatchServices) {\n      bindings.push({\n        type: \"service\",\n        name: s.name,\n        service: resolveReferencesInString(\n          materializeTamerResolvable(s.service),\n          refCtx,\n          `tenant.dispatchServices.${s.name}.service`,\n        ),\n        ...(s.environment ? { environment: s.environment } : {}),\n      });\n    }\n  }\n\n  return bindings.length > 0 ? { bindings } : {};\n}\n"],"mappings":";;;;;;;;;AAuBA,SAAgB,wBACd,QACA,QACA,QACiD;CACjD,MAAM,gBAAgB,OAAO,OAAO,iBAAiB,EAAE;AACvD,QAAO,OAAO,KAAK,UAAU;AAG3B,SAAO;GAAE,MAAM;GAAM,MAFR,cAAc,MAAM,OACX,WAAW,MAAM,MAAM,KAAK,aAAa,CAAC,QAAQ,MAAM,IAAI;GAC9C,IAAI,MAAM;GAAM;GACpD;;;;;;;AAQJ,SAAgB,sBACd,QACA,QACA,QACA,OACA,KACA,WACwB;CACxB,MAAMA,WAIF,EAAE;AAGN,UAAS,KAAK,GAAG,wBAAwB,QAAQ,QAAQ,OAAO,CAAC;AAGjE,KAAI,OAAO,OAAO,cAAc;EAC9B,MAAMC,SAA2B;GAC/B;GACA;GACA;GACA;GACA;GACD;AACD,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,OAAO,aAAa,EAAE;GACrE,MAAM,OAAO,0BACX,2BAA2B,MAAM,EACjC,QACA,uBAAuB,MACxB;AACD,YAAS,KAAK;IAAE,MAAM;IAAc,MAAM;IAAK;IAAM,CAAC;;;AAK1D,KAAI,OAAO,OAAO,kBAAkB,QAAQ;EAC1C,MAAMA,SAA2B;GAC/B;GACA;GACA;GACA;GACA;GACD;AACD,OAAK,MAAM,KAAK,OAAO,OAAO,iBAC5B,UAAS,KAAK;GACZ,MAAM;GACN,MAAM,EAAE;GACR,SAAS,0BACP,2BAA2B,EAAE,QAAQ,EACrC,QACA,2BAA2B,EAAE,KAAK,UACnC;GACD,GAAI,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,GAAG,EAAE;GACxD,CAAC;;AAIN,QAAO,SAAS,SAAS,IAAI,EAAE,UAAU,GAAG,EAAE"}

package/dist/secretsDb-CMEcKvSi.mjs

@@ -0,0 +1,3 @@
+import { J as deleteEnvSecretRows, K as SECRET_HISTORY_CAP, Q as tamerSecretsDatabaseName, X as findTamerSecretsDatabaseUuid, Y as ensureTamerSecretsDatabase, Z as secretRowKey, q as copyEnvSecretRows } from "./tamer.mjs";
+
+export { ensureTamerSecretsDatabase };

package/dist/{stackOutputs-BLp-dyzl.mjs → stackOutputs-BMPahRAl.mjs}

@@ -1,5 +1,5 @@
 import { n as materializeTamerResolvable } from "./normalize-DVSTRZhO.mjs";
-import { j as resolveReferencesInString } from "./tamer.mjs";
+import { I as resolveReferencesInString } from "./tamer.mjs";
 
 //#region src/core/outputs/stackOutputs.ts
 /**
@@ -66,4 +66,4 @@ function buildOutputsView(config, state) {
 
 //#endregion
 export { resolveStackOutputs as n, buildOutputsView as t };
-//# sourceMappingURL=stackOutputs-BLp-dyzl.mjs.map
+//# sourceMappingURL=stackOutputs-BMPahRAl.mjs.map

package/dist/{stackOutputs-BLp-dyzl.mjs.map → stackOutputs-BMPahRAl.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"stackOutputs-BLp-dyzl.mjs","names":["out: Record<string, CfiStackOutputValue>","rows: StackOutputRow[]","status: StackOutputRow[\"status\"]"],"sources":["../src/core/outputs/stackOutputs.ts"],"sourcesContent":["/**\n * Tamer's CloudFormation `Outputs` analogue.\n *\n * `tamer.config.ts > outputs` declares named exports as Tamer reference\n * strings (e.g. `\"${tamer:d1:users.id}\"`). After a successful `apply` the\n * engine resolves every entry against the just-completed state and persists\n * the literal under {@link CfiState.stackOutputs}. Sibling stacks consume\n * them via `${tamer:import:<stackName>.<outputName>}` (added separately).\n *\n * Resolution is **strict**: any unresolved/unknown reference fails the\n * apply (and rolls back when `--rollback-on-failure` is set). Read-only\n * commands like `status` use {@link buildOutputsView} which is tolerant\n * and shows the placeholder verbatim alongside the persisted value.\n */\nimport type {\n  CfiConfig,\n  CfiStackOutputValue,\n} from \"../../types.js\";\nimport { materializeTamerResolvable } from \"../../dx/normalize.js\";\nimport type { NamingEngine } from \"../naming/NamingEngine.js\";\nimport type { StateManager } from \"../state/StateManager.js\";\nimport {\n  resolveReferencesInString,\n  TamerReferenceError,\n} from \"../references/references.js\";\n\n/**\n * Resolve every `outputs:` entry against the current state. Throws\n * {@link TamerReferenceError} on the first unresolved reference so a failed\n * apply can roll back instead of silently persisting half-resolved values.\n *\n * Pass an explicit `now` only from tests — production code should let it\n * default to wall-clock so `resolvedAt` reflects the real persist time.\n */\nexport function resolveStackOutputs(\n  config: CfiConfig,\n  ctx: {\n    env: string;\n    state: StateManager;\n    naming: NamingEngine;\n    /**\n     * Outputs from sibling stacks pre-fetched by `fetchStackImports`.\n     * An output may chain through an import (e.g.\n     * `outputs: { region: \"${tamer:import:net.region}\" }`) — strict\n     * resolution requires the sibling row to be hydrated already.\n     */\n    imports?: Record<string, Record<string, string>>;\n    /** Same as wrangler / apply `accountId` (for `${tamer:config:stack.account_id}` in outputs). */\n    accountId?: string;\n  },\n  now: () => string = () => new Date().toISOString(),\n): Record<string, CfiStackOutputValue> {\n  const outputs = config.outputs;\n  if (!outputs || Object.keys(outputs).length === 0) return {};\n  const refCtx = {\n    config,\n    env: ctx.env,\n    state: ctx.state,\n    naming: ctx.naming,\n    tolerant: false,\n    imports: ctx.imports,\n    accountId: ctx.accountId,\n  };\n  const resolvedAt = now();\n  const out: Record<string, CfiStackOutputValue> = {};\n  for (const [name, source] of Object.entries(outputs)) {\n    const sourceStr = materializeTamerResolvable(source);\n    const value = resolveReferencesInString(\n      sourceStr,\n      refCtx,\n      `outputs.${name}`,\n    );\n    out[name] = { value, source: sourceStr, resolvedAt };\n  }\n  return out;\n}\n\n/**\n * One row in the `tamer status` outputs panel. Combines the *declared*\n * source (from `tamer.config.ts`) with the *persisted* value (from state)\n * so operators can see drift between \"what the config says\" and \"what we\n * last resolved\". `value` is `null` when the output is declared but has\n * never been resolved (no `apply` yet), or when a stale persisted entry\n * exists for an output that has since been removed from config.\n */\nexport interface StackOutputRow {\n  name: string;\n  /** Live source from `tamer.config.ts > outputs[name]`, if still declared. */\n  declaredSource: string | undefined;\n  /** Persisted resolved literal, if `apply` has run for this output. */\n  value: string | null;\n  /** Source string at last persist (drifts vs. `declaredSource` after edits). */\n  persistedSource: string | undefined;\n  /** ISO timestamp of last persist (undefined when never resolved). */\n  resolvedAt: string | undefined;\n  /**\n   * `\"resolved\"` when persisted matches declared source, `\"stale\"` when\n   * source has drifted since persist (re-run apply), `\"orphan\"` when\n   * persisted but no longer declared, `\"pending\"` when declared but never\n   * resolved.\n   */\n  status: \"resolved\" | \"stale\" | \"orphan\" | \"pending\";\n}\n\n/**\n * Tolerant union of declared + persisted outputs for `tamer status` and the\n * machine-readable `--json` envelope. Never throws.\n */\nexport function buildOutputsView(\n  config: CfiConfig,\n  state: StateManager,\n): StackOutputRow[] {\n  const declared = config.outputs ?? {};\n  const persisted = state.getStackOutputs();\n  const names = new Set<string>([\n    ...Object.keys(declared),\n    ...Object.keys(persisted),\n  ]);\n  const rows: StackOutputRow[] = [];\n  for (const name of [...names].sort()) {\n    const rawDeclared = declared[name];\n    const declaredSource =\n      rawDeclared !== undefined ? materializeTamerResolvable(rawDeclared) : undefined;\n    const p = persisted[name];\n    let status: StackOutputRow[\"status\"];\n    if (declaredSource && !p) status = \"pending\";\n    else if (!declaredSource && p) status = \"orphan\";\n    else if (declaredSource && p && declaredSource !== p.source) status = \"stale\";\n    else status = \"resolved\";\n    rows.push({\n      name,\n      declaredSource,\n      value: p?.value ?? null,\n      persistedSource: p?.source,\n      resolvedAt: p?.resolvedAt,\n      status,\n    });\n  }\n  return rows;\n}\n\nexport { TamerReferenceError };\n"],"mappings":";;;;;;;;;;;;AAkCA,SAAgB,oBACd,QACA,KAcA,6BAA0B,IAAI,MAAM,EAAC,aAAa,EACb;CACrC,MAAM,UAAU,OAAO;AACvB,KAAI,CAAC,WAAW,OAAO,KAAK,QAAQ,CAAC,WAAW,EAAG,QAAO,EAAE;CAC5D,MAAM,SAAS;EACb;EACA,KAAK,IAAI;EACT,OAAO,IAAI;EACX,QAAQ,IAAI;EACZ,UAAU;EACV,SAAS,IAAI;EACb,WAAW,IAAI;EAChB;CACD,MAAM,aAAa,KAAK;CACxB,MAAMA,MAA2C,EAAE;AACnD,MAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,QAAQ,EAAE;EACpD,MAAM,YAAY,2BAA2B,OAAO;AAMpD,MAAI,QAAQ;GAAE,OALA,0BACZ,WACA,QACA,WAAW,OACZ;GACoB,QAAQ;GAAW;GAAY;;AAEtD,QAAO;;;;;;AAkCT,SAAgB,iBACd,QACA,OACkB;CAClB,MAAM,WAAW,OAAO,WAAW,EAAE;CACrC,MAAM,YAAY,MAAM,iBAAiB;CACzC,MAAM,QAAQ,IAAI,IAAY,CAC5B,GAAG,OAAO,KAAK,SAAS,EACxB,GAAG,OAAO,KAAK,UAAU,CAC1B,CAAC;CACF,MAAMC,OAAyB,EAAE;AACjC,MAAK,MAAM,QAAQ,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE;EACpC,MAAM,cAAc,SAAS;EAC7B,MAAM,iBACJ,gBAAgB,SAAY,2BAA2B,YAAY,GAAG;EACxE,MAAM,IAAI,UAAU;EACpB,IAAIC;AACJ,MAAI,kBAAkB,CAAC,EAAG,UAAS;WAC1B,CAAC,kBAAkB,EAAG,UAAS;WAC/B,kBAAkB,KAAK,mBAAmB,EAAE,OAAQ,UAAS;MACjE,UAAS;AACd,OAAK,KAAK;GACR;GACA;GACA,OAAO,GAAG,SAAS;GACnB,iBAAiB,GAAG;GACpB,YAAY,GAAG;GACf;GACD,CAAC;;AAEJ,QAAO"}
+{"version":3,"file":"stackOutputs-BMPahRAl.mjs","names":["out: Record<string, CfiStackOutputValue>","rows: StackOutputRow[]","status: StackOutputRow[\"status\"]"],"sources":["../src/core/outputs/stackOutputs.ts"],"sourcesContent":["/**\n * Tamer's CloudFormation `Outputs` analogue.\n *\n * `tamer.config.ts > outputs` declares named exports as Tamer reference\n * strings (e.g. `\"${tamer:d1:users.id}\"`). After a successful `apply` the\n * engine resolves every entry against the just-completed state and persists\n * the literal under {@link CfiState.stackOutputs}. Sibling stacks consume\n * them via `${tamer:import:<stackName>.<outputName>}` (added separately).\n *\n * Resolution is **strict**: any unresolved/unknown reference fails the\n * apply (and rolls back when `--rollback-on-failure` is set). Read-only\n * commands like `status` use {@link buildOutputsView} which is tolerant\n * and shows the placeholder verbatim alongside the persisted value.\n */\nimport type {\n  CfiConfig,\n  CfiStackOutputValue,\n} from \"../../types.js\";\nimport { materializeTamerResolvable } from \"../../dx/normalize.js\";\nimport type { NamingEngine } from \"../naming/NamingEngine.js\";\nimport type { StateManager } from \"../state/StateManager.js\";\nimport {\n  resolveReferencesInString,\n  TamerReferenceError,\n} from \"../references/references.js\";\n\n/**\n * Resolve every `outputs:` entry against the current state. Throws\n * {@link TamerReferenceError} on the first unresolved reference so a failed\n * apply can roll back instead of silently persisting half-resolved values.\n *\n * Pass an explicit `now` only from tests — production code should let it\n * default to wall-clock so `resolvedAt` reflects the real persist time.\n */\nexport function resolveStackOutputs(\n  config: CfiConfig,\n  ctx: {\n    env: string;\n    state: StateManager;\n    naming: NamingEngine;\n    /**\n     * Outputs from sibling stacks pre-fetched by `fetchStackImports`.\n     * An output may chain through an import (e.g.\n     * `outputs: { region: \"${tamer:import:net.region}\" }`) — strict\n     * resolution requires the sibling row to be hydrated already.\n     */\n    imports?: Record<string, Record<string, string>>;\n    /** Same as wrangler / apply `accountId` (for `${tamer:config:stack.account_id}` in outputs). */\n    accountId?: string;\n  },\n  now: () => string = () => new Date().toISOString(),\n): Record<string, CfiStackOutputValue> {\n  const outputs = config.outputs;\n  if (!outputs || Object.keys(outputs).length === 0) return {};\n  const refCtx = {\n    config,\n    env: ctx.env,\n    state: ctx.state,\n    naming: ctx.naming,\n    tolerant: false,\n    imports: ctx.imports,\n    accountId: ctx.accountId,\n  };\n  const resolvedAt = now();\n  const out: Record<string, CfiStackOutputValue> = {};\n  for (const [name, source] of Object.entries(outputs)) {\n    const sourceStr = materializeTamerResolvable(source);\n    const value = resolveReferencesInString(\n      sourceStr,\n      refCtx,\n      `outputs.${name}`,\n    );\n    out[name] = { value, source: sourceStr, resolvedAt };\n  }\n  return out;\n}\n\n/**\n * One row in the `tamer status` outputs panel. Combines the *declared*\n * source (from `tamer.config.ts`) with the *persisted* value (from state)\n * so operators can see drift between \"what the config says\" and \"what we\n * last resolved\". `value` is `null` when the output is declared but has\n * never been resolved (no `apply` yet), or when a stale persisted entry\n * exists for an output that has since been removed from config.\n */\nexport interface StackOutputRow {\n  name: string;\n  /** Live source from `tamer.config.ts > outputs[name]`, if still declared. */\n  declaredSource: string | undefined;\n  /** Persisted resolved literal, if `apply` has run for this output. */\n  value: string | null;\n  /** Source string at last persist (drifts vs. `declaredSource` after edits). */\n  persistedSource: string | undefined;\n  /** ISO timestamp of last persist (undefined when never resolved). */\n  resolvedAt: string | undefined;\n  /**\n   * `\"resolved\"` when persisted matches declared source, `\"stale\"` when\n   * source has drifted since persist (re-run apply), `\"orphan\"` when\n   * persisted but no longer declared, `\"pending\"` when declared but never\n   * resolved.\n   */\n  status: \"resolved\" | \"stale\" | \"orphan\" | \"pending\";\n}\n\n/**\n * Tolerant union of declared + persisted outputs for `tamer status` and the\n * machine-readable `--json` envelope. Never throws.\n */\nexport function buildOutputsView(\n  config: CfiConfig,\n  state: StateManager,\n): StackOutputRow[] {\n  const declared = config.outputs ?? {};\n  const persisted = state.getStackOutputs();\n  const names = new Set<string>([\n    ...Object.keys(declared),\n    ...Object.keys(persisted),\n  ]);\n  const rows: StackOutputRow[] = [];\n  for (const name of [...names].sort()) {\n    const rawDeclared = declared[name];\n    const declaredSource =\n      rawDeclared !== undefined ? materializeTamerResolvable(rawDeclared) : undefined;\n    const p = persisted[name];\n    let status: StackOutputRow[\"status\"];\n    if (declaredSource && !p) status = \"pending\";\n    else if (!declaredSource && p) status = \"orphan\";\n    else if (declaredSource && p && declaredSource !== p.source) status = \"stale\";\n    else status = \"resolved\";\n    rows.push({\n      name,\n      declaredSource,\n      value: p?.value ?? null,\n      persistedSource: p?.source,\n      resolvedAt: p?.resolvedAt,\n      status,\n    });\n  }\n  return rows;\n}\n\nexport { TamerReferenceError };\n"],"mappings":";;;;;;;;;;;;AAkCA,SAAgB,oBACd,QACA,KAcA,6BAA0B,IAAI,MAAM,EAAC,aAAa,EACb;CACrC,MAAM,UAAU,OAAO;AACvB,KAAI,CAAC,WAAW,OAAO,KAAK,QAAQ,CAAC,WAAW,EAAG,QAAO,EAAE;CAC5D,MAAM,SAAS;EACb;EACA,KAAK,IAAI;EACT,OAAO,IAAI;EACX,QAAQ,IAAI;EACZ,UAAU;EACV,SAAS,IAAI;EACb,WAAW,IAAI;EAChB;CACD,MAAM,aAAa,KAAK;CACxB,MAAMA,MAA2C,EAAE;AACnD,MAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,QAAQ,EAAE;EACpD,MAAM,YAAY,2BAA2B,OAAO;AAMpD,MAAI,QAAQ;GAAE,OALA,0BACZ,WACA,QACA,WAAW,OACZ;GACoB,QAAQ;GAAW;GAAY;;AAEtD,QAAO;;;;;;AAkCT,SAAgB,iBACd,QACA,OACkB;CAClB,MAAM,WAAW,OAAO,WAAW,EAAE;CACrC,MAAM,YAAY,MAAM,iBAAiB;CACzC,MAAM,QAAQ,IAAI,IAAY,CAC5B,GAAG,OAAO,KAAK,SAAS,EACxB,GAAG,OAAO,KAAK,UAAU,CAC1B,CAAC;CACF,MAAMC,OAAyB,EAAE;AACjC,MAAK,MAAM,QAAQ,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE;EACpC,MAAM,cAAc,SAAS;EAC7B,MAAM,iBACJ,gBAAgB,SAAY,2BAA2B,YAAY,GAAG;EACxE,MAAM,IAAI,UAAU;EACpB,IAAIC;AACJ,MAAI,kBAAkB,CAAC,EAAG,UAAS;WAC1B,CAAC,kBAAkB,EAAG,UAAS;WAC/B,kBAAkB,KAAK,mBAAmB,EAAE,OAAQ,UAAS;MACjE,UAAS;AACd,OAAK,KAAK;GACR;GACA;GACA,OAAO,GAAG,SAAS;GACnB,iBAAiB,GAAG;GACpB,YAAY,GAAG;GACf;GACD,CAAC;;AAEJ,QAAO"}

package/dist/{status-CL4MEGbn.mjs → status-CQpgTTeG.mjs}

@@ -1,10 +1,10 @@
 import { f as getDispatchNamespaces, m as getLogpushJobs, p as getDnsRecords } from "./normalize-DVSTRZhO.mjs";
-import { E as mergeWorkerConfigForResourcePick, H as getWorkers, O as resolveDeployedWorkerName, P as effectiveDispatchNamespaceName, R as CFApiClient, U as loadConfig, V as getConfigBaseDir, f as fetchStackImports, h as StateManager, m as scanConfigForImports, u as namingFromConfig, w as stackNameForConfig, y as tenantStateKey, z as cloudflareAccountIdFromEnv } from "./tamer.mjs";
-import { n as resourceModules } from "./registry-CTerXUza.mjs";
-import "./r2S3EmptyBucket-DD81ZWQ7.mjs";
-import { r as dnsRecordStateKey, t as dnsRecordAppliesToEnv } from "./dns-records.resolve-SPYGYNHa.mjs";
-import { t as logpushJobStatus } from "./logpush-job-Dqlt-wEw.mjs";
-import { t as buildOutputsView } from "./stackOutputs-BLp-dyzl.mjs";
+import { $ as CFApiClient, N as resolveDeployedWorkerName, _ as fetchStackImports, b as StateManager, et as cloudflareAccountIdFromEnv, h as namingFromConfig, it as loadConfig, j as mergeWorkerConfigForResourcePick, k as stackNameForConfig, nt as getConfigBaseDir, rt as getWorkers, w as tenantStateKey, y as scanConfigForImports, z as effectiveDispatchNamespaceName } from "./tamer.mjs";
+import { n as resourceModules } from "./registry-CRgobiU4.mjs";
+import "./r2S3EmptyBucket-CDE2lTM8.mjs";
+import { r as dnsRecordStateKey, t as dnsRecordAppliesToEnv } from "./dns-records.resolve-CUQz6Ivz.mjs";
+import { t as logpushJobStatus } from "./logpush-job-DZG-3nkJ.mjs";
+import { t as buildOutputsView } from "./stackOutputs-BMPahRAl.mjs";
 
 //#region src/features/dispatch-namespace/dispatch-namespace.status.ts
 function dispatchNamespaceStatus(resources, env, state, _naming, config) {
@@ -203,4 +203,4 @@ async function runStatus(options) {
 
 //#endregion
 export { runStatus };
-//# sourceMappingURL=status-CL4MEGbn.mjs.map
+//# sourceMappingURL=status-CQpgTTeG.mjs.map

package/dist/{status-CL4MEGbn.mjs.map → status-CQpgTTeG.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"status-CL4MEGbn.mjs","names":["results: Array<{\n    logicalName: string;\n    namespace: string;\n    status: ResourceStatus;\n  }>","rows: DnsRecordStatusRow[]","meta: string[]","siblingImports: Record<string, Record<string, string>>","logpushLive:\n    | Awaited<ReturnType<CFApiClient[\"logpushAccountJobsList\"]>>\n    | undefined","hints: string[]"],"sources":["../src/features/dispatch-namespace/dispatch-namespace.status.ts","../src/features/dns-records/dns-records.status.ts","../src/cli/commands/status.ts"],"sourcesContent":["import type { DispatchNamespaceResourceConfig, CfiConfig } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport type { ResourceStatus } from \"../../types.js\";\nimport { effectiveDispatchNamespaceName } from \"./dispatch-namespace.resolve.js\";\n\nexport function dispatchNamespaceStatus(\n  resources: DispatchNamespaceResourceConfig[],\n  env: string,\n  state: StateManager,\n  _naming: NamingEngine,\n  config: CfiConfig,\n): Array<{ logicalName: string; namespace: string; status: ResourceStatus }> {\n  const results: Array<{\n    logicalName: string;\n    namespace: string;\n    status: ResourceStatus;\n  }> = [];\n\n  for (const nsConfig of resources) {\n    const resolvedName = effectiveDispatchNamespaceName(nsConfig, env, config.tenant);\n    const key = `dispatch_ns:${resolvedName}`;\n    const entry = state.get(key);\n    results.push({\n      logicalName: nsConfig.logicalName,\n      namespace: resolvedName,\n      status:\n        entry?.type === \"dispatch_namespace\" ? \"ok\" : \"missing\",\n    });\n  }\n\n  return results;\n}\n","import type { DnsRecordResourceConfig, ResourceStatus } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport {\n  dnsRecordAppliesToEnv,\n  dnsRecordStateKey,\n} from \"./dns-records.resolve.js\";\n\nexport interface DnsRecordStatusRow {\n  logicalName: string;\n  type: string;\n  name: string;\n  recordId?: string;\n  status: ResourceStatus;\n}\n\nexport function dnsRecordStatus(\n  resources: DnsRecordResourceConfig[],\n  env: string,\n  state: StateManager,\n): DnsRecordStatusRow[] {\n  const rows: DnsRecordStatusRow[] = [];\n  for (const config of resources) {\n    if (!dnsRecordAppliesToEnv(config, env)) {\n      rows.push({\n        logicalName: config.logicalName,\n        type: config.type,\n        name: config.name,\n        status: \"ok\",\n      });\n      continue;\n    }\n    const entry = state.get(\n      dnsRecordStateKey(config.zoneId, config.type, config.name),\n    );\n    if (entry?.type === \"dns_record\") {\n      rows.push({\n        logicalName: config.logicalName,\n        type: entry.recordType,\n        name: entry.name,\n        recordId: entry.recordId,\n        status: \"ok\",\n      });\n    } else {\n      rows.push({\n        logicalName: config.logicalName,\n        type: config.type,\n        name: config.name,\n        status: \"missing\",\n      });\n    }\n  }\n  return rows;\n}\n","import { loadConfig, getWorkers, getConfigBaseDir } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { dispatchNamespaceStatus } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordStatus } from \"../../features/dns-records/index.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobStatus } from \"../../features/logpush-job/index.js\";\nimport { tenantStateKey } from \"../../core/tenant/tenantKeys.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport {\n  resolveDeployedWorkerName,\n  mergeWorkerConfigForResourcePick,\n} from \"../../core/config/resolver.js\";\nimport { buildOutputsView } from \"../../core/outputs/stackOutputs.js\";\nimport {\n  fetchStackImports,\n  scanConfigForImports,\n} from \"../../core/imports/fetchStackImports.js\";\n\nexport async function runStatus(options: {\n  env?: string;\n  configPath?: string;\n  /** `product:workspace` — show only this workspace tenant from state. */\n  tenant?: string;\n}): Promise<void> {\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n\n  const config = await loadConfig(configPath, { env });\n  const baseDir = getConfigBaseDir();\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n\n  const workers = await getWorkers(config, baseDir);\n  console.log(\n    `\\nStatus for ${config.tenant.name} (${config.tenant.slug}) — env: ${env}\\n`,\n  );\n\n  if (options.tenant?.trim()) {\n    const raw = options.tenant.trim();\n    const colon = raw.indexOf(\":\");\n    if (colon < 1) {\n      throw new Error(\n        'status --tenant expects \"product:workspace\" (e.g. todo:acme)',\n      );\n    }\n    const product = raw.slice(0, colon);\n    const workspace = raw.slice(colon + 1);\n    const t = state.getTenant(product, workspace);\n    console.log(`Workspace tenant ${tenantStateKey(product, workspace)}:`);\n    if (!t) {\n      console.log(\"  (no record in tamer state)\\n\");\n      return;\n    }\n    console.log(`  status: ${t.provisioningStatus}`);\n    console.log(`  dispatch namespace: ${t.dispatchNamespaceName}`);\n    console.log(`  script: ${t.scriptName}`);\n    if (t.d1Shards?.length) {\n      console.log(\"  D1 shards:\");\n      for (const s of t.d1Shards) {\n        console.log(`    ${s.role}: ${s.derivedName} [${s.cfId}]`);\n      }\n    }\n    console.log();\n    return;\n  }\n\n  const outputRows = buildOutputsView(config, state);\n  if (outputRows.length > 0) {\n    console.log(\"Stack outputs:\");\n    for (const r of outputRows) {\n      const valueText =\n        r.value === null\n          ? \"(unresolved — run apply)\"\n          : r.value;\n      const meta: string[] = [r.status];\n      if (r.status === \"stale\" && r.declaredSource) {\n        meta.push(`source drifted → ${r.declaredSource}`);\n      }\n      console.log(`  ${r.name}: ${valueText} [${meta.join(\", \")}]`);\n    }\n    console.log();\n  }\n\n  // Inbound imports — show every `${tamer:import:<stack>.<output>}`\n  // referenced by config, grouped by source stack. We tolerate fetch\n  // failures so `tamer status` still works in offline / partial-cred\n  // environments; a missing sibling row just displays \"(unresolved)\".\n  const importRefs = scanConfigForImports(config);\n  let siblingImports: Record<string, Record<string, string>> = {};\n  try {\n    siblingImports = await fetchStackImports(api, config, env);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    console.warn(`(could not pre-fetch imported stacks: ${msg})`);\n  }\n  if (importRefs.length > 0) {\n    console.log(\"Stack imports:\");\n    const byStack = new Map<string, Set<string>>();\n    for (const r of importRefs) {\n      if (!byStack.has(r.stack)) byStack.set(r.stack, new Set());\n      byStack.get(r.stack)!.add(r.output);\n    }\n    for (const [stack, outputs] of [...byStack].sort(([a], [b]) =>\n      a.localeCompare(b),\n    )) {\n      console.log(`  from stack \"${stack}\":`);\n      const stackOutputs = siblingImports[stack] ?? {};\n      for (const out of [...outputs].sort()) {\n        const v = stackOutputs[out];\n        const status = v === undefined ? \"unresolved\" : \"resolved\";\n        const value = v ?? \"(missing — run `tamer apply` on that stack)\";\n        console.log(`    ${out}: ${value} [${status}]`);\n      }\n    }\n    console.log();\n  }\n\n  const dns = dispatchNamespaceStatus(\n    getDispatchNamespaces(config),\n    env,\n    state,\n    naming,\n    config,\n  );\n  if (dns.length > 0) {\n    console.log(\"Dispatch namespaces:\");\n    for (const r of dns) {\n      console.log(`  ${r.logicalName} (${r.namespace}) [${r.status}]`);\n    }\n    console.log();\n  }\n\n  const tenants = state.listTenants();\n  if (tenants.length > 0) {\n    console.log(`Tenants (${tenants.length}):`);\n    for (const t of tenants.sort((a, b) =>\n      `${a.product}:${a.workspace}`.localeCompare(`${b.product}:${b.workspace}`),\n    )) {\n      const shards = t.d1Shards?.length ?? 0;\n      console.log(\n        `  ${t.product}:${t.workspace} [${t.provisioningStatus}] ${t.scriptName} (${shards} shard(s))`,\n      );\n    }\n    console.log();\n  }\n\n  const dnsRows = dnsRecordStatus(getDnsRecords(config), env, state);\n  if (dnsRows.length > 0) {\n    console.log(\"DNS records:\");\n    for (const r of dnsRows) {\n      const id = r.recordId ? ` [${r.recordId}]` : \"\";\n      console.log(`  ${r.logicalName}: ${r.type} ${r.name}${id} [${r.status}]`);\n    }\n    console.log();\n  }\n\n  let logpushLive:\n    | Awaited<ReturnType<CFApiClient[\"logpushAccountJobsList\"]>>\n    | undefined;\n  if (env !== \"local\") {\n    try {\n      logpushLive = await api.logpushAccountJobsList();\n    } catch {\n      // Token may lack Logpush list; state-only rows still print.\n    }\n  }\n  const logpushRows = logpushJobStatus(\n    getLogpushJobs(config),\n    config.tenant,\n    env,\n    state,\n    logpushLive,\n  );\n  if (logpushRows.length > 0) {\n    console.log(\"Logpush jobs:\");\n    for (const r of logpushRows) {\n      const id = r.cfJobId != null ? ` [id ${r.cfJobId}]` : \"\";\n      const hints: string[] = [];\n      if (r.cfEnabled === false) hints.push(\"disabled on Cloudflare\");\n      if (r.cfError) hints.push(`CF error: ${r.cfError}`);\n      const hint = hints.length > 0 ? ` — ${hints.join(\"; \")}` : \"\";\n      console.log(`  ${r.logicalName}: ${r.jobName}${id} [${r.status}]${hint}`);\n    }\n    console.log();\n  }\n\n  for (const [workerKey, workerConfig] of workers) {\n    console.log(`Worker: ${workerKey}`);\n    const deployedName = resolveDeployedWorkerName(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      naming,\n    );\n    const mergedWorker = mergeWorkerConfigForResourcePick(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports: siblingImports },\n    );\n    let printedAny = false;\n    for (const mod of resourceModules) {\n      const resources = mod.pickResources(mergedWorker);\n      if (resources.length === 0) continue;\n      const rows = mod.status({\n        resources,\n        env,\n        state,\n        naming,\n        worker: { workerKey, deployedName },\n      });\n      if (rows.length === 0) continue;\n      printedAny = true;\n      console.log(`  ${mod.label}:`);\n      for (const r of rows) {\n        console.log(`    ${r.binding}: ${r.name} [${r.status}]`);\n      }\n    }\n    if (!printedAny) console.log(\"  (no resources)\");\n    console.log();\n  }\n}\n"],"mappings":";;;;;;;;;AAMA,SAAgB,wBACd,WACA,KACA,OACA,SACA,QAC2E;CAC3E,MAAMA,UAID,EAAE;AAEP,MAAK,MAAM,YAAY,WAAW;EAChC,MAAM,eAAe,+BAA+B,UAAU,KAAK,OAAO,OAAO;EACjF,MAAM,MAAM,eAAe;EAC3B,MAAM,QAAQ,MAAM,IAAI,IAAI;AAC5B,UAAQ,KAAK;GACX,aAAa,SAAS;GACtB,WAAW;GACX,QACE,OAAO,SAAS,uBAAuB,OAAO;GACjD,CAAC;;AAGJ,QAAO;;;;;AChBT,SAAgB,gBACd,WACA,KACA,OACsB;CACtB,MAAMC,OAA6B,EAAE;AACrC,MAAK,MAAM,UAAU,WAAW;AAC9B,MAAI,CAAC,sBAAsB,QAAQ,IAAI,EAAE;AACvC,QAAK,KAAK;IACR,aAAa,OAAO;IACpB,MAAM,OAAO;IACb,MAAM,OAAO;IACb,QAAQ;IACT,CAAC;AACF;;EAEF,MAAM,QAAQ,MAAM,IAClB,kBAAkB,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK,CAC3D;AACD,MAAI,OAAO,SAAS,aAClB,MAAK,KAAK;GACR,aAAa,OAAO;GACpB,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,UAAU,MAAM;GAChB,QAAQ;GACT,CAAC;MAEF,MAAK,KAAK;GACR,aAAa,OAAO;GACpB,MAAM,OAAO;GACb,MAAM,OAAO;GACb,QAAQ;GACT,CAAC;;AAGN,QAAO;;;;;AC7BT,eAAsB,UAAU,SAKd;CAChB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAE3B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,UAAU,kBAAkB;CAClC,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAEH,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,SAAQ,IACN,gBAAgB,OAAO,OAAO,KAAK,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,IAC1E;AAED,KAAI,QAAQ,QAAQ,MAAM,EAAE;EAC1B,MAAM,MAAM,QAAQ,OAAO,MAAM;EACjC,MAAM,QAAQ,IAAI,QAAQ,IAAI;AAC9B,MAAI,QAAQ,EACV,OAAM,IAAI,MACR,iEACD;EAEH,MAAM,UAAU,IAAI,MAAM,GAAG,MAAM;EACnC,MAAM,YAAY,IAAI,MAAM,QAAQ,EAAE;EACtC,MAAM,IAAI,MAAM,UAAU,SAAS,UAAU;AAC7C,UAAQ,IAAI,oBAAoB,eAAe,SAAS,UAAU,CAAC,GAAG;AACtE,MAAI,CAAC,GAAG;AACN,WAAQ,IAAI,iCAAiC;AAC7C;;AAEF,UAAQ,IAAI,aAAa,EAAE,qBAAqB;AAChD,UAAQ,IAAI,yBAAyB,EAAE,wBAAwB;AAC/D,UAAQ,IAAI,aAAa,EAAE,aAAa;AACxC,MAAI,EAAE,UAAU,QAAQ;AACtB,WAAQ,IAAI,eAAe;AAC3B,QAAK,MAAM,KAAK,EAAE,SAChB,SAAQ,IAAI,OAAO,EAAE,KAAK,IAAI,EAAE,YAAY,IAAI,EAAE,KAAK,GAAG;;AAG9D,UAAQ,KAAK;AACb;;CAGF,MAAM,aAAa,iBAAiB,QAAQ,MAAM;AAClD,KAAI,WAAW,SAAS,GAAG;AACzB,UAAQ,IAAI,iBAAiB;AAC7B,OAAK,MAAM,KAAK,YAAY;GAC1B,MAAM,YACJ,EAAE,UAAU,OACR,6BACA,EAAE;GACR,MAAMC,OAAiB,CAAC,EAAE,OAAO;AACjC,OAAI,EAAE,WAAW,WAAW,EAAE,eAC5B,MAAK,KAAK,oBAAoB,EAAE,iBAAiB;AAEnD,WAAQ,IAAI,KAAK,EAAE,KAAK,IAAI,UAAU,IAAI,KAAK,KAAK,KAAK,CAAC,GAAG;;AAE/D,UAAQ,KAAK;;CAOf,MAAM,aAAa,qBAAqB,OAAO;CAC/C,IAAIC,iBAAyD,EAAE;AAC/D,KAAI;AACF,mBAAiB,MAAM,kBAAkB,KAAK,QAAQ,IAAI;UACnD,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,yCAAyC,IAAI,GAAG;;AAE/D,KAAI,WAAW,SAAS,GAAG;AACzB,UAAQ,IAAI,iBAAiB;EAC7B,MAAM,0BAAU,IAAI,KAA0B;AAC9C,OAAK,MAAM,KAAK,YAAY;AAC1B,OAAI,CAAC,QAAQ,IAAI,EAAE,MAAM,CAAE,SAAQ,IAAI,EAAE,uBAAO,IAAI,KAAK,CAAC;AAC1D,WAAQ,IAAI,EAAE,MAAM,CAAE,IAAI,EAAE,OAAO;;AAErC,OAAK,MAAM,CAAC,OAAO,YAAY,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OACtD,EAAE,cAAc,EAAE,CACnB,EAAE;AACD,WAAQ,IAAI,iBAAiB,MAAM,IAAI;GACvC,MAAM,eAAe,eAAe,UAAU,EAAE;AAChD,QAAK,MAAM,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE;IACrC,MAAM,IAAI,aAAa;IACvB,MAAM,SAAS,MAAM,SAAY,eAAe;IAChD,MAAM,QAAQ,KAAK;AACnB,YAAQ,IAAI,OAAO,IAAI,IAAI,MAAM,IAAI,OAAO,GAAG;;;AAGnD,UAAQ,KAAK;;CAGf,MAAM,MAAM,wBACV,sBAAsB,OAAO,EAC7B,KACA,OACA,QACA,OACD;AACD,KAAI,IAAI,SAAS,GAAG;AAClB,UAAQ,IAAI,uBAAuB;AACnC,OAAK,MAAM,KAAK,IACd,SAAQ,IAAI,KAAK,EAAE,YAAY,IAAI,EAAE,UAAU,KAAK,EAAE,OAAO,GAAG;AAElE,UAAQ,KAAK;;CAGf,MAAM,UAAU,MAAM,aAAa;AACnC,KAAI,QAAQ,SAAS,GAAG;AACtB,UAAQ,IAAI,YAAY,QAAQ,OAAO,IAAI;AAC3C,OAAK,MAAM,KAAK,QAAQ,MAAM,GAAG,MAC/B,GAAG,EAAE,QAAQ,GAAG,EAAE,YAAY,cAAc,GAAG,EAAE,QAAQ,GAAG,EAAE,YAAY,CAC3E,EAAE;GACD,MAAM,SAAS,EAAE,UAAU,UAAU;AACrC,WAAQ,IACN,KAAK,EAAE,QAAQ,GAAG,EAAE,UAAU,IAAI,EAAE,mBAAmB,IAAI,EAAE,WAAW,IAAI,OAAO,YACpF;;AAEH,UAAQ,KAAK;;CAGf,MAAM,UAAU,gBAAgB,cAAc,OAAO,EAAE,KAAK,MAAM;AAClE,KAAI,QAAQ,SAAS,GAAG;AACtB,UAAQ,IAAI,eAAe;AAC3B,OAAK,MAAM,KAAK,SAAS;GACvB,MAAM,KAAK,EAAE,WAAW,KAAK,EAAE,SAAS,KAAK;AAC7C,WAAQ,IAAI,KAAK,EAAE,YAAY,IAAI,EAAE,KAAK,GAAG,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,GAAG;;AAE3E,UAAQ,KAAK;;CAGf,IAAIC;AAGJ,KAAI,QAAQ,QACV,KAAI;AACF,gBAAc,MAAM,IAAI,wBAAwB;SAC1C;CAIV,MAAM,cAAc,iBAClB,eAAe,OAAO,EACtB,OAAO,QACP,KACA,OACA,YACD;AACD,KAAI,YAAY,SAAS,GAAG;AAC1B,UAAQ,IAAI,gBAAgB;AAC5B,OAAK,MAAM,KAAK,aAAa;GAC3B,MAAM,KAAK,EAAE,WAAW,OAAO,QAAQ,EAAE,QAAQ,KAAK;GACtD,MAAMC,QAAkB,EAAE;AAC1B,OAAI,EAAE,cAAc,MAAO,OAAM,KAAK,yBAAyB;AAC/D,OAAI,EAAE,QAAS,OAAM,KAAK,aAAa,EAAE,UAAU;GACnD,MAAM,OAAO,MAAM,SAAS,IAAI,MAAM,MAAM,KAAK,KAAK,KAAK;AAC3D,WAAQ,IAAI,KAAK,EAAE,YAAY,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,OAAO,GAAG,OAAO;;AAE3E,UAAQ,KAAK;;AAGf,MAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;AAC/C,UAAQ,IAAI,WAAW,YAAY;EACnC,MAAM,eAAe,0BACnB,QACA,WACA,cACA,KACA,OACD;EACD,MAAM,eAAe,iCACnB,QACA,WACA,cACA,KACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY,SAAS;GAAgB,CACxD;EACD,IAAI,aAAa;AACjB,OAAK,MAAM,OAAO,iBAAiB;GACjC,MAAM,YAAY,IAAI,cAAc,aAAa;AACjD,OAAI,UAAU,WAAW,EAAG;GAC5B,MAAM,OAAO,IAAI,OAAO;IACtB;IACA;IACA;IACA;IACA,QAAQ;KAAE;KAAW;KAAc;IACpC,CAAC;AACF,OAAI,KAAK,WAAW,EAAG;AACvB,gBAAa;AACb,WAAQ,IAAI,KAAK,IAAI,MAAM,GAAG;AAC9B,QAAK,MAAM,KAAK,KACd,SAAQ,IAAI,OAAO,EAAE,QAAQ,IAAI,EAAE,KAAK,IAAI,EAAE,OAAO,GAAG;;AAG5D,MAAI,CAAC,WAAY,SAAQ,IAAI,mBAAmB;AAChD,UAAQ,KAAK"}
+{"version":3,"file":"status-CQpgTTeG.mjs","names":["results: Array<{\n    logicalName: string;\n    namespace: string;\n    status: ResourceStatus;\n  }>","rows: DnsRecordStatusRow[]","meta: string[]","siblingImports: Record<string, Record<string, string>>","logpushLive:\n    | Awaited<ReturnType<CFApiClient[\"logpushAccountJobsList\"]>>\n    | undefined","hints: string[]"],"sources":["../src/features/dispatch-namespace/dispatch-namespace.status.ts","../src/features/dns-records/dns-records.status.ts","../src/cli/commands/status.ts"],"sourcesContent":["import type { DispatchNamespaceResourceConfig, CfiConfig } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport type { NamingEngine } from \"../../core/naming/NamingEngine.js\";\nimport type { ResourceStatus } from \"../../types.js\";\nimport { effectiveDispatchNamespaceName } from \"./dispatch-namespace.resolve.js\";\n\nexport function dispatchNamespaceStatus(\n  resources: DispatchNamespaceResourceConfig[],\n  env: string,\n  state: StateManager,\n  _naming: NamingEngine,\n  config: CfiConfig,\n): Array<{ logicalName: string; namespace: string; status: ResourceStatus }> {\n  const results: Array<{\n    logicalName: string;\n    namespace: string;\n    status: ResourceStatus;\n  }> = [];\n\n  for (const nsConfig of resources) {\n    const resolvedName = effectiveDispatchNamespaceName(nsConfig, env, config.tenant);\n    const key = `dispatch_ns:${resolvedName}`;\n    const entry = state.get(key);\n    results.push({\n      logicalName: nsConfig.logicalName,\n      namespace: resolvedName,\n      status:\n        entry?.type === \"dispatch_namespace\" ? \"ok\" : \"missing\",\n    });\n  }\n\n  return results;\n}\n","import type { DnsRecordResourceConfig, ResourceStatus } from \"../../types.js\";\nimport type { StateManager } from \"../../core/state/StateManager.js\";\nimport {\n  dnsRecordAppliesToEnv,\n  dnsRecordStateKey,\n} from \"./dns-records.resolve.js\";\n\nexport interface DnsRecordStatusRow {\n  logicalName: string;\n  type: string;\n  name: string;\n  recordId?: string;\n  status: ResourceStatus;\n}\n\nexport function dnsRecordStatus(\n  resources: DnsRecordResourceConfig[],\n  env: string,\n  state: StateManager,\n): DnsRecordStatusRow[] {\n  const rows: DnsRecordStatusRow[] = [];\n  for (const config of resources) {\n    if (!dnsRecordAppliesToEnv(config, env)) {\n      rows.push({\n        logicalName: config.logicalName,\n        type: config.type,\n        name: config.name,\n        status: \"ok\",\n      });\n      continue;\n    }\n    const entry = state.get(\n      dnsRecordStateKey(config.zoneId, config.type, config.name),\n    );\n    if (entry?.type === \"dns_record\") {\n      rows.push({\n        logicalName: config.logicalName,\n        type: entry.recordType,\n        name: entry.name,\n        recordId: entry.recordId,\n        status: \"ok\",\n      });\n    } else {\n      rows.push({\n        logicalName: config.logicalName,\n        type: config.type,\n        name: config.name,\n        status: \"missing\",\n      });\n    }\n  }\n  return rows;\n}\n","import { loadConfig, getWorkers, getConfigBaseDir } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { dispatchNamespaceStatus } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordStatus } from \"../../features/dns-records/index.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobStatus } from \"../../features/logpush-job/index.js\";\nimport { tenantStateKey } from \"../../core/tenant/tenantKeys.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport {\n  resolveDeployedWorkerName,\n  mergeWorkerConfigForResourcePick,\n} from \"../../core/config/resolver.js\";\nimport { buildOutputsView } from \"../../core/outputs/stackOutputs.js\";\nimport {\n  fetchStackImports,\n  scanConfigForImports,\n} from \"../../core/imports/fetchStackImports.js\";\n\nexport async function runStatus(options: {\n  env?: string;\n  configPath?: string;\n  /** `product:workspace` — show only this workspace tenant from state. */\n  tenant?: string;\n}): Promise<void> {\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n\n  const config = await loadConfig(configPath, { env });\n  const baseDir = getConfigBaseDir();\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n  const naming = namingFromConfig(config);\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n\n  const workers = await getWorkers(config, baseDir);\n  console.log(\n    `\\nStatus for ${config.tenant.name} (${config.tenant.slug}) — env: ${env}\\n`,\n  );\n\n  if (options.tenant?.trim()) {\n    const raw = options.tenant.trim();\n    const colon = raw.indexOf(\":\");\n    if (colon < 1) {\n      throw new Error(\n        'status --tenant expects \"product:workspace\" (e.g. todo:acme)',\n      );\n    }\n    const product = raw.slice(0, colon);\n    const workspace = raw.slice(colon + 1);\n    const t = state.getTenant(product, workspace);\n    console.log(`Workspace tenant ${tenantStateKey(product, workspace)}:`);\n    if (!t) {\n      console.log(\"  (no record in tamer state)\\n\");\n      return;\n    }\n    console.log(`  status: ${t.provisioningStatus}`);\n    console.log(`  dispatch namespace: ${t.dispatchNamespaceName}`);\n    console.log(`  script: ${t.scriptName}`);\n    if (t.d1Shards?.length) {\n      console.log(\"  D1 shards:\");\n      for (const s of t.d1Shards) {\n        console.log(`    ${s.role}: ${s.derivedName} [${s.cfId}]`);\n      }\n    }\n    console.log();\n    return;\n  }\n\n  const outputRows = buildOutputsView(config, state);\n  if (outputRows.length > 0) {\n    console.log(\"Stack outputs:\");\n    for (const r of outputRows) {\n      const valueText =\n        r.value === null\n          ? \"(unresolved — run apply)\"\n          : r.value;\n      const meta: string[] = [r.status];\n      if (r.status === \"stale\" && r.declaredSource) {\n        meta.push(`source drifted → ${r.declaredSource}`);\n      }\n      console.log(`  ${r.name}: ${valueText} [${meta.join(\", \")}]`);\n    }\n    console.log();\n  }\n\n  // Inbound imports — show every `${tamer:import:<stack>.<output>}`\n  // referenced by config, grouped by source stack. We tolerate fetch\n  // failures so `tamer status` still works in offline / partial-cred\n  // environments; a missing sibling row just displays \"(unresolved)\".\n  const importRefs = scanConfigForImports(config);\n  let siblingImports: Record<string, Record<string, string>> = {};\n  try {\n    siblingImports = await fetchStackImports(api, config, env);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    console.warn(`(could not pre-fetch imported stacks: ${msg})`);\n  }\n  if (importRefs.length > 0) {\n    console.log(\"Stack imports:\");\n    const byStack = new Map<string, Set<string>>();\n    for (const r of importRefs) {\n      if (!byStack.has(r.stack)) byStack.set(r.stack, new Set());\n      byStack.get(r.stack)!.add(r.output);\n    }\n    for (const [stack, outputs] of [...byStack].sort(([a], [b]) =>\n      a.localeCompare(b),\n    )) {\n      console.log(`  from stack \"${stack}\":`);\n      const stackOutputs = siblingImports[stack] ?? {};\n      for (const out of [...outputs].sort()) {\n        const v = stackOutputs[out];\n        const status = v === undefined ? \"unresolved\" : \"resolved\";\n        const value = v ?? \"(missing — run `tamer apply` on that stack)\";\n        console.log(`    ${out}: ${value} [${status}]`);\n      }\n    }\n    console.log();\n  }\n\n  const dns = dispatchNamespaceStatus(\n    getDispatchNamespaces(config),\n    env,\n    state,\n    naming,\n    config,\n  );\n  if (dns.length > 0) {\n    console.log(\"Dispatch namespaces:\");\n    for (const r of dns) {\n      console.log(`  ${r.logicalName} (${r.namespace}) [${r.status}]`);\n    }\n    console.log();\n  }\n\n  const tenants = state.listTenants();\n  if (tenants.length > 0) {\n    console.log(`Tenants (${tenants.length}):`);\n    for (const t of tenants.sort((a, b) =>\n      `${a.product}:${a.workspace}`.localeCompare(`${b.product}:${b.workspace}`),\n    )) {\n      const shards = t.d1Shards?.length ?? 0;\n      console.log(\n        `  ${t.product}:${t.workspace} [${t.provisioningStatus}] ${t.scriptName} (${shards} shard(s))`,\n      );\n    }\n    console.log();\n  }\n\n  const dnsRows = dnsRecordStatus(getDnsRecords(config), env, state);\n  if (dnsRows.length > 0) {\n    console.log(\"DNS records:\");\n    for (const r of dnsRows) {\n      const id = r.recordId ? ` [${r.recordId}]` : \"\";\n      console.log(`  ${r.logicalName}: ${r.type} ${r.name}${id} [${r.status}]`);\n    }\n    console.log();\n  }\n\n  let logpushLive:\n    | Awaited<ReturnType<CFApiClient[\"logpushAccountJobsList\"]>>\n    | undefined;\n  if (env !== \"local\") {\n    try {\n      logpushLive = await api.logpushAccountJobsList();\n    } catch {\n      // Token may lack Logpush list; state-only rows still print.\n    }\n  }\n  const logpushRows = logpushJobStatus(\n    getLogpushJobs(config),\n    config.tenant,\n    env,\n    state,\n    logpushLive,\n  );\n  if (logpushRows.length > 0) {\n    console.log(\"Logpush jobs:\");\n    for (const r of logpushRows) {\n      const id = r.cfJobId != null ? ` [id ${r.cfJobId}]` : \"\";\n      const hints: string[] = [];\n      if (r.cfEnabled === false) hints.push(\"disabled on Cloudflare\");\n      if (r.cfError) hints.push(`CF error: ${r.cfError}`);\n      const hint = hints.length > 0 ? ` — ${hints.join(\"; \")}` : \"\";\n      console.log(`  ${r.logicalName}: ${r.jobName}${id} [${r.status}]${hint}`);\n    }\n    console.log();\n  }\n\n  for (const [workerKey, workerConfig] of workers) {\n    console.log(`Worker: ${workerKey}`);\n    const deployedName = resolveDeployedWorkerName(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      naming,\n    );\n    const mergedWorker = mergeWorkerConfigForResourcePick(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports: siblingImports },\n    );\n    let printedAny = false;\n    for (const mod of resourceModules) {\n      const resources = mod.pickResources(mergedWorker);\n      if (resources.length === 0) continue;\n      const rows = mod.status({\n        resources,\n        env,\n        state,\n        naming,\n        worker: { workerKey, deployedName },\n      });\n      if (rows.length === 0) continue;\n      printedAny = true;\n      console.log(`  ${mod.label}:`);\n      for (const r of rows) {\n        console.log(`    ${r.binding}: ${r.name} [${r.status}]`);\n      }\n    }\n    if (!printedAny) console.log(\"  (no resources)\");\n    console.log();\n  }\n}\n"],"mappings":";;;;;;;;;AAMA,SAAgB,wBACd,WACA,KACA,OACA,SACA,QAC2E;CAC3E,MAAMA,UAID,EAAE;AAEP,MAAK,MAAM,YAAY,WAAW;EAChC,MAAM,eAAe,+BAA+B,UAAU,KAAK,OAAO,OAAO;EACjF,MAAM,MAAM,eAAe;EAC3B,MAAM,QAAQ,MAAM,IAAI,IAAI;AAC5B,UAAQ,KAAK;GACX,aAAa,SAAS;GACtB,WAAW;GACX,QACE,OAAO,SAAS,uBAAuB,OAAO;GACjD,CAAC;;AAGJ,QAAO;;;;;AChBT,SAAgB,gBACd,WACA,KACA,OACsB;CACtB,MAAMC,OAA6B,EAAE;AACrC,MAAK,MAAM,UAAU,WAAW;AAC9B,MAAI,CAAC,sBAAsB,QAAQ,IAAI,EAAE;AACvC,QAAK,KAAK;IACR,aAAa,OAAO;IACpB,MAAM,OAAO;IACb,MAAM,OAAO;IACb,QAAQ;IACT,CAAC;AACF;;EAEF,MAAM,QAAQ,MAAM,IAClB,kBAAkB,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK,CAC3D;AACD,MAAI,OAAO,SAAS,aAClB,MAAK,KAAK;GACR,aAAa,OAAO;GACpB,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,UAAU,MAAM;GAChB,QAAQ;GACT,CAAC;MAEF,MAAK,KAAK;GACR,aAAa,OAAO;GACpB,MAAM,OAAO;GACb,MAAM,OAAO;GACb,QAAQ;GACT,CAAC;;AAGN,QAAO;;;;;AC7BT,eAAsB,UAAU,SAKd;CAChB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAE3B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,UAAU,kBAAkB;CAClC,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAEH,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,SAAQ,IACN,gBAAgB,OAAO,OAAO,KAAK,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,IAC1E;AAED,KAAI,QAAQ,QAAQ,MAAM,EAAE;EAC1B,MAAM,MAAM,QAAQ,OAAO,MAAM;EACjC,MAAM,QAAQ,IAAI,QAAQ,IAAI;AAC9B,MAAI,QAAQ,EACV,OAAM,IAAI,MACR,iEACD;EAEH,MAAM,UAAU,IAAI,MAAM,GAAG,MAAM;EACnC,MAAM,YAAY,IAAI,MAAM,QAAQ,EAAE;EACtC,MAAM,IAAI,MAAM,UAAU,SAAS,UAAU;AAC7C,UAAQ,IAAI,oBAAoB,eAAe,SAAS,UAAU,CAAC,GAAG;AACtE,MAAI,CAAC,GAAG;AACN,WAAQ,IAAI,iCAAiC;AAC7C;;AAEF,UAAQ,IAAI,aAAa,EAAE,qBAAqB;AAChD,UAAQ,IAAI,yBAAyB,EAAE,wBAAwB;AAC/D,UAAQ,IAAI,aAAa,EAAE,aAAa;AACxC,MAAI,EAAE,UAAU,QAAQ;AACtB,WAAQ,IAAI,eAAe;AAC3B,QAAK,MAAM,KAAK,EAAE,SAChB,SAAQ,IAAI,OAAO,EAAE,KAAK,IAAI,EAAE,YAAY,IAAI,EAAE,KAAK,GAAG;;AAG9D,UAAQ,KAAK;AACb;;CAGF,MAAM,aAAa,iBAAiB,QAAQ,MAAM;AAClD,KAAI,WAAW,SAAS,GAAG;AACzB,UAAQ,IAAI,iBAAiB;AAC7B,OAAK,MAAM,KAAK,YAAY;GAC1B,MAAM,YACJ,EAAE,UAAU,OACR,6BACA,EAAE;GACR,MAAMC,OAAiB,CAAC,EAAE,OAAO;AACjC,OAAI,EAAE,WAAW,WAAW,EAAE,eAC5B,MAAK,KAAK,oBAAoB,EAAE,iBAAiB;AAEnD,WAAQ,IAAI,KAAK,EAAE,KAAK,IAAI,UAAU,IAAI,KAAK,KAAK,KAAK,CAAC,GAAG;;AAE/D,UAAQ,KAAK;;CAOf,MAAM,aAAa,qBAAqB,OAAO;CAC/C,IAAIC,iBAAyD,EAAE;AAC/D,KAAI;AACF,mBAAiB,MAAM,kBAAkB,KAAK,QAAQ,IAAI;UACnD,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,yCAAyC,IAAI,GAAG;;AAE/D,KAAI,WAAW,SAAS,GAAG;AACzB,UAAQ,IAAI,iBAAiB;EAC7B,MAAM,0BAAU,IAAI,KAA0B;AAC9C,OAAK,MAAM,KAAK,YAAY;AAC1B,OAAI,CAAC,QAAQ,IAAI,EAAE,MAAM,CAAE,SAAQ,IAAI,EAAE,uBAAO,IAAI,KAAK,CAAC;AAC1D,WAAQ,IAAI,EAAE,MAAM,CAAE,IAAI,EAAE,OAAO;;AAErC,OAAK,MAAM,CAAC,OAAO,YAAY,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OACtD,EAAE,cAAc,EAAE,CACnB,EAAE;AACD,WAAQ,IAAI,iBAAiB,MAAM,IAAI;GACvC,MAAM,eAAe,eAAe,UAAU,EAAE;AAChD,QAAK,MAAM,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE;IACrC,MAAM,IAAI,aAAa;IACvB,MAAM,SAAS,MAAM,SAAY,eAAe;IAChD,MAAM,QAAQ,KAAK;AACnB,YAAQ,IAAI,OAAO,IAAI,IAAI,MAAM,IAAI,OAAO,GAAG;;;AAGnD,UAAQ,KAAK;;CAGf,MAAM,MAAM,wBACV,sBAAsB,OAAO,EAC7B,KACA,OACA,QACA,OACD;AACD,KAAI,IAAI,SAAS,GAAG;AAClB,UAAQ,IAAI,uBAAuB;AACnC,OAAK,MAAM,KAAK,IACd,SAAQ,IAAI,KAAK,EAAE,YAAY,IAAI,EAAE,UAAU,KAAK,EAAE,OAAO,GAAG;AAElE,UAAQ,KAAK;;CAGf,MAAM,UAAU,MAAM,aAAa;AACnC,KAAI,QAAQ,SAAS,GAAG;AACtB,UAAQ,IAAI,YAAY,QAAQ,OAAO,IAAI;AAC3C,OAAK,MAAM,KAAK,QAAQ,MAAM,GAAG,MAC/B,GAAG,EAAE,QAAQ,GAAG,EAAE,YAAY,cAAc,GAAG,EAAE,QAAQ,GAAG,EAAE,YAAY,CAC3E,EAAE;GACD,MAAM,SAAS,EAAE,UAAU,UAAU;AACrC,WAAQ,IACN,KAAK,EAAE,QAAQ,GAAG,EAAE,UAAU,IAAI,EAAE,mBAAmB,IAAI,EAAE,WAAW,IAAI,OAAO,YACpF;;AAEH,UAAQ,KAAK;;CAGf,MAAM,UAAU,gBAAgB,cAAc,OAAO,EAAE,KAAK,MAAM;AAClE,KAAI,QAAQ,SAAS,GAAG;AACtB,UAAQ,IAAI,eAAe;AAC3B,OAAK,MAAM,KAAK,SAAS;GACvB,MAAM,KAAK,EAAE,WAAW,KAAK,EAAE,SAAS,KAAK;AAC7C,WAAQ,IAAI,KAAK,EAAE,YAAY,IAAI,EAAE,KAAK,GAAG,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,GAAG;;AAE3E,UAAQ,KAAK;;CAGf,IAAIC;AAGJ,KAAI,QAAQ,QACV,KAAI;AACF,gBAAc,MAAM,IAAI,wBAAwB;SAC1C;CAIV,MAAM,cAAc,iBAClB,eAAe,OAAO,EACtB,OAAO,QACP,KACA,OACA,YACD;AACD,KAAI,YAAY,SAAS,GAAG;AAC1B,UAAQ,IAAI,gBAAgB;AAC5B,OAAK,MAAM,KAAK,aAAa;GAC3B,MAAM,KAAK,EAAE,WAAW,OAAO,QAAQ,EAAE,QAAQ,KAAK;GACtD,MAAMC,QAAkB,EAAE;AAC1B,OAAI,EAAE,cAAc,MAAO,OAAM,KAAK,yBAAyB;AAC/D,OAAI,EAAE,QAAS,OAAM,KAAK,aAAa,EAAE,UAAU;GACnD,MAAM,OAAO,MAAM,SAAS,IAAI,MAAM,MAAM,KAAK,KAAK,KAAK;AAC3D,WAAQ,IAAI,KAAK,EAAE,YAAY,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,OAAO,GAAG,OAAO;;AAE3E,UAAQ,KAAK;;AAGf,MAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;AAC/C,UAAQ,IAAI,WAAW,YAAY;EACnC,MAAM,eAAe,0BACnB,QACA,WACA,cACA,KACA,OACD;EACD,MAAM,eAAe,iCACnB,QACA,WACA,cACA,KACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY,SAAS;GAAgB,CACxD;EACD,IAAI,aAAa;AACjB,OAAK,MAAM,OAAO,iBAAiB;GACjC,MAAM,YAAY,IAAI,cAAc,aAAa;AACjD,OAAI,UAAU,WAAW,EAAG;GAC5B,MAAM,OAAO,IAAI,OAAO;IACtB;IACA;IACA;IACA;IACA,QAAQ;KAAE;KAAW;KAAc;IACpC,CAAC;AACF,OAAI,KAAK,WAAW,EAAG;AACvB,gBAAa;AACb,WAAQ,IAAI,KAAK,IAAI,MAAM,GAAG;AAC9B,QAAK,MAAM,KAAK,KACd,SAAQ,IAAI,OAAO,EAAE,QAAQ,IAAI,EAAE,KAAK,IAAI,EAAE,OAAO,GAAG;;AAG5D,MAAI,CAAC,WAAY,SAAQ,IAAI,mBAAmB;AAChD,UAAQ,KAAK"}

package/dist/sync-Blz5emYO.mjs

@@ -0,0 +1,7 @@
+import "./registry-CRgobiU4.mjs";
+import "./r2S3EmptyBucket-CDE2lTM8.mjs";
+import "./logpush-job-DZG-3nkJ.mjs";
+import "./worker-route-BPDAwUL0.mjs";
+import { t as runSync } from "./sync-DqMMQ7mQ.mjs";
+
+export { runSync };

package/dist/{sync-Dii9n2nJ.mjs → sync-DqMMQ7mQ.mjs}

@@ -1,9 +1,9 @@
 import { f as getDispatchNamespaces, m as getLogpushJobs, p as getDnsRecords } from "./normalize-DVSTRZhO.mjs";
-import { E as mergeWorkerConfigForResourcePick, H as getWorkers, R as CFApiClient, U as loadConfig, V as getConfigBaseDir, f as fetchStackImports, h as StateManager, u as namingFromConfig, w as stackNameForConfig, z as cloudflareAccountIdFromEnv } from "./tamer.mjs";
-import { n as resourceModules } from "./registry-CTerXUza.mjs";
-import { n as dispatchNamespaceSync, t as dnsRecordSync } from "./dns-records.sync-BORRvLky.mjs";
-import { i as logpushJobSync } from "./logpush-job-Dqlt-wEw.mjs";
-import { i as workerRouteSync } from "./worker-route-BapxsQyX.mjs";
+import { $ as CFApiClient, _ as fetchStackImports, b as StateManager, et as cloudflareAccountIdFromEnv, h as namingFromConfig, it as loadConfig, j as mergeWorkerConfigForResourcePick, k as stackNameForConfig, nt as getConfigBaseDir, rt as getWorkers } from "./tamer.mjs";
+import { n as resourceModules } from "./registry-CRgobiU4.mjs";
+import { n as dispatchNamespaceSync, t as dnsRecordSync } from "./dns-records.sync-BnOga2LS.mjs";
+import { i as logpushJobSync } from "./logpush-job-DZG-3nkJ.mjs";
+import { i as workerRouteSync } from "./worker-route-BPDAwUL0.mjs";
 
 //#region src/cli/commands/sync.ts
 async function runSync(options) {
@@ -84,4 +84,4 @@ async function runSync(options) {
 
 //#endregion
 export { runSync as t };
-//# sourceMappingURL=sync-Dii9n2nJ.mjs.map
+//# sourceMappingURL=sync-DqMMQ7mQ.mjs.map

package/dist/{sync-Dii9n2nJ.mjs.map → sync-DqMMQ7mQ.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"sync-Dii9n2nJ.mjs","names":[],"sources":["../src/cli/commands/sync.ts"],"sourcesContent":["import { loadConfig, getWorkers, getConfigBaseDir } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { dispatchNamespaceSync } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordSync } from \"../../features/dns-records/index.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobSync } from \"../../features/logpush-job/index.js\";\nimport { workerRouteSync } from \"../../features/worker-route/index.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\nimport { mergeWorkerConfigForResourcePick } from \"../../core/config/resolver.js\";\n\nexport async function runSync(options: {\n  env?: string;\n  configPath?: string;\n}): Promise<void> {\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n\n  const config = await loadConfig(configPath, { env });\n  const baseDir = getConfigBaseDir();\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  // Tolerant pre-fetch: sync runs against existing cloud state, so we\n  // pass real import values into worker-route resolution to avoid\n  // matching against `${tamer:import:…}` placeholders.\n  const imports = await fetchStackImports(api, config, env).catch((err) => {\n    const msg = err instanceof Error ? err.message : String(err);\n    console.warn(`[sync] skipping cross-stack imports: ${msg}`);\n    return {} as Record<string, Record<string, string>>;\n  });\n\n  async function safeList<T>(\n    label: string,\n    fn: () => Promise<T[]>,\n  ): Promise<T[]> {\n    try {\n      return await fn();\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] skipping ${label}: ${msg}`);\n      return [];\n    }\n  }\n\n  const lists = await Promise.all(\n    resourceModules.map((m) =>\n      safeList(`${m.label} list`, () => m.fetchAll(api)),\n    ),\n  );\n\n  if (getDispatchNamespaces(config).length > 0) {\n    try {\n      await dispatchNamespaceSync(\n        getDispatchNamespaces(config),\n        config.tenant,\n        env,\n        api,\n        state,\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] skipping dispatch namespaces: ${msg}`);\n    }\n  }\n\n  if (getDnsRecords(config).length > 0) {\n    try {\n      await dnsRecordSync(\n        getDnsRecords(config),\n        config.tenant,\n        env,\n        api,\n        state,\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] skipping dns records: ${msg}`);\n    }\n  }\n\n  if (getLogpushJobs(config).length > 0 && env !== \"local\") {\n    try {\n      await logpushJobSync(\n        getLogpushJobs(config),\n        config.tenant,\n        env,\n        api,\n        state,\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] skipping logpush jobs: ${msg}`);\n    }\n  }\n\n  const workers = await getWorkers(config, baseDir);\n  for (const [workerKey, workerConfig] of workers) {\n    const mergedWorker = mergeWorkerConfigForResourcePick(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports },\n    );\n    resourceModules.forEach((mod, i) => {\n      const resources = mod.pickResources(mergedWorker);\n      if (resources.length === 0) return;\n      mod.sync({\n        resources,\n        all: lists[i],\n        tenant: config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n      });\n    });\n  }\n\n  try {\n    await workerRouteSync(env, config, baseDir, accountId, naming, state, api, {\n      imports,\n    });\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    console.warn(`[sync] skipping worker routes: ${msg}`);\n  }\n\n  await state.persist(api);\n  console.log(`Synced state for env: ${env}`);\n}\n"],"mappings":";;;;;;;;AAeA,eAAsB,QAAQ,SAGZ;CAChB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAE3B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,UAAU,kBAAkB;CAClC,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAIxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI,CAAC,OAAO,QAAQ;EACvE,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,wCAAwC,MAAM;AAC3D,SAAO,EAAE;GACT;CAEF,eAAe,SACb,OACA,IACc;AACd,MAAI;AACF,UAAO,MAAM,IAAI;WACV,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,mBAAmB,MAAM,IAAI,MAAM;AAChD,UAAO,EAAE;;;CAIb,MAAM,QAAQ,MAAM,QAAQ,IAC1B,gBAAgB,KAAK,MACnB,SAAS,GAAG,EAAE,MAAM,cAAc,EAAE,SAAS,IAAI,CAAC,CACnD,CACF;AAED,KAAI,sBAAsB,OAAO,CAAC,SAAS,EACzC,KAAI;AACF,QAAM,sBACJ,sBAAsB,OAAO,EAC7B,OAAO,QACP,KACA,KACA,MACD;UACM,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,wCAAwC,MAAM;;AAI/D,KAAI,cAAc,OAAO,CAAC,SAAS,EACjC,KAAI;AACF,QAAM,cACJ,cAAc,OAAO,EACrB,OAAO,QACP,KACA,KACA,MACD;UACM,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,gCAAgC,MAAM;;AAIvD,KAAI,eAAe,OAAO,CAAC,SAAS,KAAK,QAAQ,QAC/C,KAAI;AACF,QAAM,eACJ,eAAe,OAAO,EACtB,OAAO,QACP,KACA,KACA,MACD;UACM,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,iCAAiC,MAAM;;CAIxD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,MAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;EAC/C,MAAM,eAAe,iCACnB,QACA,WACA,cACA,KACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY;GAAS,CACxC;AACD,kBAAgB,SAAS,KAAK,MAAM;GAClC,MAAM,YAAY,IAAI,cAAc,aAAa;AACjD,OAAI,UAAU,WAAW,EAAG;AAC5B,OAAI,KAAK;IACP;IACA,KAAK,MAAM;IACX,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;IACF;;AAGJ,KAAI;AACF,QAAM,gBAAgB,KAAK,QAAQ,SAAS,WAAW,QAAQ,OAAO,KAAK,EACzE,SACD,CAAC;UACK,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,kCAAkC,MAAM;;AAGvD,OAAM,MAAM,QAAQ,IAAI;AACxB,SAAQ,IAAI,yBAAyB,MAAM"}
+{"version":3,"file":"sync-DqMMQ7mQ.mjs","names":[],"sources":["../src/cli/commands/sync.ts"],"sourcesContent":["import { loadConfig, getWorkers, getConfigBaseDir } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { dispatchNamespaceSync } from \"../../features/dispatch-namespace/index.js\";\nimport { dnsRecordSync } from \"../../features/dns-records/index.js\";\nimport { getDispatchNamespaces, getDnsRecords, getLogpushJobs } from \"../../types.js\";\nimport { logpushJobSync } from \"../../features/logpush-job/index.js\";\nimport { workerRouteSync } from \"../../features/worker-route/index.js\";\nimport { resourceModules } from \"../../core/registry/registry.js\";\nimport { fetchStackImports } from \"../../core/imports/fetchStackImports.js\";\nimport { mergeWorkerConfigForResourcePick } from \"../../core/config/resolver.js\";\n\nexport async function runSync(options: {\n  env?: string;\n  configPath?: string;\n}): Promise<void> {\n  const env = options.env ?? \"local\";\n  const configPath = options.configPath;\n\n  const config = await loadConfig(configPath, { env });\n  const baseDir = getConfigBaseDir();\n  const accountId =\n    config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const api = new CFApiClient(accountId);\n  const naming = namingFromConfig(config);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n  // Tolerant pre-fetch: sync runs against existing cloud state, so we\n  // pass real import values into worker-route resolution to avoid\n  // matching against `${tamer:import:…}` placeholders.\n  const imports = await fetchStackImports(api, config, env).catch((err) => {\n    const msg = err instanceof Error ? err.message : String(err);\n    console.warn(`[sync] skipping cross-stack imports: ${msg}`);\n    return {} as Record<string, Record<string, string>>;\n  });\n\n  async function safeList<T>(\n    label: string,\n    fn: () => Promise<T[]>,\n  ): Promise<T[]> {\n    try {\n      return await fn();\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] skipping ${label}: ${msg}`);\n      return [];\n    }\n  }\n\n  const lists = await Promise.all(\n    resourceModules.map((m) =>\n      safeList(`${m.label} list`, () => m.fetchAll(api)),\n    ),\n  );\n\n  if (getDispatchNamespaces(config).length > 0) {\n    try {\n      await dispatchNamespaceSync(\n        getDispatchNamespaces(config),\n        config.tenant,\n        env,\n        api,\n        state,\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] skipping dispatch namespaces: ${msg}`);\n    }\n  }\n\n  if (getDnsRecords(config).length > 0) {\n    try {\n      await dnsRecordSync(\n        getDnsRecords(config),\n        config.tenant,\n        env,\n        api,\n        state,\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] skipping dns records: ${msg}`);\n    }\n  }\n\n  if (getLogpushJobs(config).length > 0 && env !== \"local\") {\n    try {\n      await logpushJobSync(\n        getLogpushJobs(config),\n        config.tenant,\n        env,\n        api,\n        state,\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[sync] skipping logpush jobs: ${msg}`);\n    }\n  }\n\n  const workers = await getWorkers(config, baseDir);\n  for (const [workerKey, workerConfig] of workers) {\n    const mergedWorker = mergeWorkerConfigForResourcePick(\n      config,\n      workerKey,\n      workerConfig,\n      env,\n      accountId,\n      naming,\n      state,\n      { referencesMode: \"tolerant\", imports },\n    );\n    resourceModules.forEach((mod, i) => {\n      const resources = mod.pickResources(mergedWorker);\n      if (resources.length === 0) return;\n      mod.sync({\n        resources,\n        all: lists[i],\n        tenant: config.tenant,\n        env,\n        api,\n        state,\n        naming,\n        config,\n        baseDir,\n      });\n    });\n  }\n\n  try {\n    await workerRouteSync(env, config, baseDir, accountId, naming, state, api, {\n      imports,\n    });\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    console.warn(`[sync] skipping worker routes: ${msg}`);\n  }\n\n  await state.persist(api);\n  console.log(`Synced state for env: ${env}`);\n}\n"],"mappings":";;;;;;;;AAeA,eAAsB,QAAQ,SAGZ;CAChB,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,aAAa,QAAQ;CAE3B,MAAM,SAAS,MAAM,WAAW,YAAY,EAAE,KAAK,CAAC;CACpD,MAAM,UAAU,kBAAkB;CAClC,MAAM,YACJ,OAAO,cAAc,4BAA4B;AACnD,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAIxB,MAAM,UAAU,MAAM,kBAAkB,KAAK,QAAQ,IAAI,CAAC,OAAO,QAAQ;EACvE,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,wCAAwC,MAAM;AAC3D,SAAO,EAAE;GACT;CAEF,eAAe,SACb,OACA,IACc;AACd,MAAI;AACF,UAAO,MAAM,IAAI;WACV,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,mBAAmB,MAAM,IAAI,MAAM;AAChD,UAAO,EAAE;;;CAIb,MAAM,QAAQ,MAAM,QAAQ,IAC1B,gBAAgB,KAAK,MACnB,SAAS,GAAG,EAAE,MAAM,cAAc,EAAE,SAAS,IAAI,CAAC,CACnD,CACF;AAED,KAAI,sBAAsB,OAAO,CAAC,SAAS,EACzC,KAAI;AACF,QAAM,sBACJ,sBAAsB,OAAO,EAC7B,OAAO,QACP,KACA,KACA,MACD;UACM,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,wCAAwC,MAAM;;AAI/D,KAAI,cAAc,OAAO,CAAC,SAAS,EACjC,KAAI;AACF,QAAM,cACJ,cAAc,OAAO,EACrB,OAAO,QACP,KACA,KACA,MACD;UACM,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,gCAAgC,MAAM;;AAIvD,KAAI,eAAe,OAAO,CAAC,SAAS,KAAK,QAAQ,QAC/C,KAAI;AACF,QAAM,eACJ,eAAe,OAAO,EACtB,OAAO,QACP,KACA,KACA,MACD;UACM,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,iCAAiC,MAAM;;CAIxD,MAAM,UAAU,MAAM,WAAW,QAAQ,QAAQ;AACjD,MAAK,MAAM,CAAC,WAAW,iBAAiB,SAAS;EAC/C,MAAM,eAAe,iCACnB,QACA,WACA,cACA,KACA,WACA,QACA,OACA;GAAE,gBAAgB;GAAY;GAAS,CACxC;AACD,kBAAgB,SAAS,KAAK,MAAM;GAClC,MAAM,YAAY,IAAI,cAAc,aAAa;AACjD,OAAI,UAAU,WAAW,EAAG;AAC5B,OAAI,KAAK;IACP;IACA,KAAK,MAAM;IACX,QAAQ,OAAO;IACf;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;IACF;;AAGJ,KAAI;AACF,QAAM,gBAAgB,KAAK,QAAQ,SAAS,WAAW,QAAQ,OAAO,KAAK,EACzE,SACD,CAAC;UACK,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,kCAAkC,MAAM;;AAGvD,OAAM,MAAM,QAAQ,IAAI;AACxB,SAAQ,IAAI,yBAAyB,MAAM"}

package/dist/tamer.mjs

@@ -4310,7 +4310,8 @@ const TenantMetaSchema = object({
 		name: string().min(1),
 		service: union([string(), any()]),
 		environment: string().optional()
-	})).optional()
+	})).optional(),
+	dispatchSecrets: array(string().min(1)).optional()
 });
 const CloudflareNameFnSchema = custom((v) => v === void 0 || typeof v === "function").optional();
 const D1ResourceConfigSchema = object({
@@ -5381,7 +5382,31 @@ var CFApiClient = class {
 		}
 	}
 	/**
-	* @see https://developers.cloudflare.com/api/resources/workers/subresources/routes/methods/list/
+	* Push a secret to a dispatch namespace script.
+	* Same body shape as `workersSecretPut` but targets the dispatch path.
+	*/
+	async dispatchNamespaceScriptSecretPut(dispatchNamespace, scriptName, body) {
+		const url = `${CF_API_BASE}/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(dispatchNamespace)}/scripts/${encodeURIComponent(scriptName)}/secrets`;
+		const res = await fetch(url, {
+			method: "PUT",
+			headers: {
+				Authorization: `Bearer ${this.apiToken}`,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify({
+				...body,
+				type: body.type ?? "secret_text"
+			})
+		});
+		if (!res.ok) {
+			let errMsg = res.statusText;
+			try {
+				errMsg = (await res.json())?.errors?.map((e) => e.message).join("; ") ?? errMsg;
+			} catch {}
+			throw new Error(`CF API error: PUT \`/workers/dispatch/namespaces/${dispatchNamespace}/scripts/${scriptName}/secrets\` → HTTP ${res.status}. ${errMsg}`);
+		}
+	}
+	/**
 	*/
 	async zoneWorkerRoutesList(zoneId) {
 		return (await this.request(`/zones/${zoneId}/workers/routes`)).result ?? [];
@@ -8940,14 +8965,14 @@ async function main() {
 	try {
 		switch (command) {
 			case "bootstrap":
-				await import("./bootstrap-BCy6B-B6.mjs").then((m) => m.runBootstrap(parseBootstrapArgs(rest)));
+				await import("./bootstrap-D663FPHF.mjs").then((m) => m.runBootstrap(parseBootstrapArgs(rest)));
 				break;
 			case "sync":
-				await import("./sync-DSgJGQh1.mjs").then((m) => m.runSync(parseSyncArgs(rest)));
+				await import("./sync-Blz5emYO.mjs").then((m) => m.runSync(parseSyncArgs(rest)));
 				break;
 			case "apply": {
 				const a = parseApplyArgs(rest);
-				await import("./apply-Mk9usR-U.mjs").then((m) => m.runApply({
+				await import("./apply-J081Hfqc.mjs").then((m) => m.runApply({
 					env: a.env,
 					addShard: a.addShard,
 					configPath: a.configPath,
@@ -8959,11 +8984,11 @@ async function main() {
 				break;
 			}
 			case "dev":
-				await import("./dev-sk6JGKe4.mjs").then((m) => m.runDev(parseDevArgs(rest)));
+				await import("./dev-zQRvUhdd.mjs").then((m) => m.runDev(parseDevArgs(rest)));
 				break;
 			case "deploy": {
 				const d = parseDeployArgs(rest);
-				await import("./deploy-DbXBHpCG.mjs").then((m) => m.runDeploy({
+				await import("./deploy-N8cVT5M9.mjs").then((m) => m.runDeploy({
 					worker: d.worker,
 					env: d.env,
 					configPath: d.configPath,
@@ -8972,23 +8997,23 @@ async function main() {
 				break;
 			}
 			case "migrate":
-				await import("./migrate-DyrTw9ep.mjs").then((m) => m.runMigrate(parseMigrateArgs(rest)));
+				await import("./migrate-v1UQCzNi.mjs").then((m) => m.runMigrate(parseMigrateArgs(rest)));
 				break;
 			case "types":
-				await import("./types-DCL0mEjS.mjs").then((m) => m.runTypes(parseTypesArgs(rest)));
+				await import("./types-BCTgIotG.mjs").then((m) => m.runTypes(parseTypesArgs(rest)));
 				break;
 			case "status":
-				await import("./status-CL4MEGbn.mjs").then((m) => m.runStatus(parseStatusArgs(rest)));
+				await import("./status-CQpgTTeG.mjs").then((m) => m.runStatus(parseStatusArgs(rest)));
 				break;
 			case "events":
-				await import("./events-CqbN9sbT.mjs").then((m) => m.runEvents(parseEventsArgs(rest)));
+				await import("./events-C86vo1gV.mjs").then((m) => m.runEvents(parseEventsArgs(rest)));
 				break;
 			case "drift":
-				exitStatus = await import("./drift-oOUlh0u8.mjs").then((m) => m.runDrift(parseDriftArgs(rest)));
+				exitStatus = await import("./drift-RsT8UGQw.mjs").then((m) => m.runDrift(parseDriftArgs(rest)));
 				break;
 			case "plan": {
 				const p = parsePlanArgs(rest);
-				exitStatus = await import("./plan-D7UyLznb.mjs").then((m) => m.runPlan({
+				exitStatus = await import("./plan-Dp2aTzEU.mjs").then((m) => m.runPlan({
 					env: p.env,
 					configPath: p.configPath,
 					json: p.json,
@@ -9000,14 +9025,14 @@ async function main() {
 				break;
 			}
 			case "import":
-				await import("./import-leVD9Ryg.mjs").then((m) => m.runImport(parseImportArgs(rest)));
+				await import("./import-QJc0fI1h.mjs").then((m) => m.runImport(parseImportArgs(rest)));
 				break;
 			case "doctor":
-				exitStatus = await import("./doctor-BgqnscIE.mjs").then((m) => m.runDoctor(parseDoctorArgs(rest)));
+				exitStatus = await import("./doctor-yTe9cUO5.mjs").then((m) => m.runDoctor(parseDoctorArgs(rest)));
 				break;
 			case "destroy": {
 				const d = parseDestroyArgs(rest);
-				await import("./destroy-CesVkyxf.mjs").then((m) => m.runDestroy({
+				await import("./destroy-kkOR_ZBj.mjs").then((m) => m.runDestroy({
 					env: d.env,
 					force: d.force,
 					skipWorkers: d.skipWorkers,
@@ -9022,12 +9047,12 @@ async function main() {
 			case "wfp": {
 				const [sub, ...wfpRest] = rest;
 				if (sub === "put") {
-					const { parseWfpPutArgs, runWfpPut } = await import("./wfp-put-Bl5K3snx.mjs");
+					const { parseWfpPutArgs, runWfpPut } = await import("./wfp-put-oYvLiM_c.mjs");
 					await runWfpPut(parseWfpPutArgs(wfpRest));
 					break;
 				}
 				if (sub === "delete") {
-					const { parseWfpDeleteArgs, runWfpDelete } = await import("./wfp-delete-CwWQFxxj.mjs");
+					const { parseWfpDeleteArgs, runWfpDelete } = await import("./wfp-delete-BblKos51.mjs");
 					await runWfpDelete(parseWfpDeleteArgs(wfpRest));
 					break;
 				}
@@ -9035,7 +9060,7 @@ async function main() {
 					const tenantSub = wfpRest[0];
 					const tenantRest = wfpRest.slice(1);
 					if (tenantSub === "list") {
-						await import("./tenant-MWIs0esz.mjs").then((m) => m.runTenantList({
+						await import("./tenant-2XTWe9j0.mjs").then((m) => m.runTenantList({
 							env: parseStringFlag(wfpRest, "--env"),
 							configPath: parseStringFlag(wfpRest, "--config"),
 							json: wfpRest.includes("--json")
@@ -9043,7 +9068,7 @@ async function main() {
 						break;
 					}
 					if (tenantSub === "status") {
-						await import("./tenant-MWIs0esz.mjs").then((m) => m.runTenantStatus({
+						await import("./tenant-2XTWe9j0.mjs").then((m) => m.runTenantStatus({
 							env: parseStringFlag(wfpRest, "--env"),
 							product: parseStringFlag(wfpRest, "--product") ?? "",
 							workspace: parseStringFlag(wfpRest, "--workspace") ?? "",
@@ -9052,15 +9077,15 @@ async function main() {
 						break;
 					}
 					if (tenantSub === "provision") {
-						await import("./provision-tenant-DoGlAu6H.mjs").then((m) => m.runProvisionTenant(parseProvisionTenantArgs(tenantRest)));
+						await import("./provision-tenant-DEscl-jo.mjs").then((m) => m.runProvisionTenant(parseProvisionTenantArgs(tenantRest)));
 						break;
 					}
 					if (tenantSub === "destroy") {
-						await import("./destroy-tenant-DMynv_u-.mjs").then((m) => m.runDestroyTenant(parseDestroyTenantArgs(tenantRest)));
+						await import("./destroy-tenant-DdObj9pd.mjs").then((m) => m.runDestroyTenant(parseDestroyTenantArgs(tenantRest)));
 						break;
 					}
 					if (tenantSub === "migrate") {
-						await import("./tenant-migrate-CM6cb1zo.mjs").then((m) => m.runTenantMigrate({
+						await import("./tenant-migrate-B-n4ppSk.mjs").then((m) => m.runTenantMigrate({
 							env: parseStringFlag(wfpRest, "--env"),
 							product: parseStringFlag(wfpRest, "--product") ?? "",
 							workspace: parseStringFlag(wfpRest, "--workspace") ?? "",
@@ -9075,14 +9100,14 @@ async function main() {
 				process.exit(1);
 			}
 			case "secrets":
-				exitStatus = await import("./secrets-DJ1yUy01.mjs").then((m) => m.runSecrets(rest));
+				exitStatus = await import("./secrets-DVNZwGUS.mjs").then((m) => m.runSecrets(rest));
 				break;
 			case "env":
-				if (rest[0] === "list") await import("./env-list-DKseThiA.mjs").then((m) => m.runEnvList({
+				if (rest[0] === "list") await import("./env-list-D-wnLl8W.mjs").then((m) => m.runEnvList({
 					configPath: parseStringFlag(rest, "--config"),
 					json: rest.includes("--json")
 				}));
-				else if (rest[0] === "gc") await import("./env-gc-DE4EV7j7.mjs").then((m) => m.runEnvGc({
+				else if (rest[0] === "gc") await import("./env-gc-DrXu7DlG.mjs").then((m) => m.runEnvGc({
 					maxAge: parseStringFlag(rest, "--max-age") ?? "72h",
 					force: rest.includes("--force"),
 					dryRun: rest.includes("--dry-run"),
@@ -9185,5 +9210,5 @@ Environment variables (same as Wrangler):
 main();
 
 //#endregion
-export { rewriteIntraStackServiceTargets as A, cloudflareApiTokenFromEnv as B, listEnvRows as C, mergedWorkerConfigForEnv as D, mergeWorkerConfigForResourcePick as E, isEphemeralEnv as F, getWorkers as H, deleteEnvSecretRows as I, ensureTamerSecretsDatabase as L, assertSafeWranglerOutFile as M, wranglerConfigCliArgs as N, resolveDeployedWorkerName as O, effectiveDispatchNamespaceName as P, CFApiClient as R, ensureTamerStateDatabase as S, buildIntraStackScriptNameMap as T, loadConfig as U, getConfigBaseDir as V, tenantDispatchScriptName as _, reconcileSecrets as a, createEmptyCfiState as b, vaultReaderFromMap as c, requiredSecretsForWorker as d, fetchStackImports as f, parseTenantShardRoles as g, StateManager as h, pushSecretsForDeploy as i, resolveReferencesInString as j, resolveWorkerConfig as k, createDeploySecretsResources as l, scanConfigForImports as m, parseSecretsArgs as n, secretsDrift as o, importedStackNames as p, runSecrets as r, secretsPlanItems as s, SECRETS_USAGE as t, namingFromConfig as u, tenantShardDatabaseName as v, stackNameForConfig as w, deleteEnvStateRows as x, tenantStateKey as y, cloudflareAccountIdFromEnv as z };
+export { CFApiClient as $, buildIntraStackScriptNameMap as A, isEphemeralEnv as B, tenantShardDatabaseName as C, ensureTamerStateDatabase as D, deleteEnvStateRows as E, rewriteIntraStackServiceTargets as F, readMasterKeyFromEnv as G, generateMasterKey as H, resolveReferencesInString as I, deleteEnvSecretRows as J, SECRET_HISTORY_CAP as K, assertSafeWranglerOutFile as L, mergedWorkerConfigForEnv as M, resolveDeployedWorkerName as N, listEnvRows as O, resolveWorkerConfig as P, tamerSecretsDatabaseName as Q, wranglerConfigCliArgs as R, tenantDispatchScriptName as S, createEmptyCfiState as T, masterKeyEnvVarName as U, MASTER_KEY_BYTE_LENGTH as V, parseMasterKey as W, findTamerSecretsDatabaseUuid as X, ensureTamerSecretsDatabase as Y, secretRowKey as Z, fetchStackImports as _, reconcileSecrets as a, StateManager as b, vaultReaderFromMap as c, decryptSecretValue as d, cloudflareAccountIdFromEnv as et, encryptSecretValue as f, requiredSecretsForWorker as g, namingFromConfig as h, pushSecretsForDeploy as i, loadConfig as it, mergeWorkerConfigForResourcePick as j, stackNameForConfig as k, secretValueFingerprint as l, SecretsVault as m, parseSecretsArgs as n, getConfigBaseDir as nt, secretsDrift as o, createDeploySecretsResources as p, copyEnvSecretRows as q, runSecrets as r, getWorkers as rt, secretsPlanItems as s, SECRETS_USAGE as t, cloudflareApiTokenFromEnv as tt, SecretsCryptoError as u, importedStackNames as v, tenantStateKey as w, parseTenantShardRoles as x, scanConfigForImports as y, effectiveDispatchNamespaceName as z };
 //# sourceMappingURL=tamer.mjs.map