@dragonmastery/tamer 0.42.2 → 0.43.1

package/dist/{planFormat-CJw8Kq2s.mjs → planFormat-DHjPdYzr.mjs}

@@ -116,4 +116,4 @@ function printApplySummary() {
 
 //#endregion
 export { signFor as a, resetApplySummary as i, logApplyChange as n, printApplySummary as r, formatPlanFieldChanges as t };
-//# sourceMappingURL=planFormat-CJw8Kq2s.mjs.map
+//# sourceMappingURL=planFormat-DHjPdYzr.mjs.map

package/dist/{planFormat-CJw8Kq2s.mjs.map → planFormat-DHjPdYzr.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"planFormat-CJw8Kq2s.mjs","names":["applySummary: Record<PlanAction, number>"],"sources":["../src/core/plan/planFormat.ts"],"sourcesContent":["/**\n * Shared rendering for terraform-style plan output. Used by:\n *\n *   - `tamer plan` (human mode) — field-level diffs under each\n *     `update` / `replace` line so reviewers see exactly which fields\n *     would change before they sign off on a saved plan.\n *   - `tamer apply` — per-field log lines when each in-place patch fires,\n *     so the operator sees the same diffs at apply time that they\n *     reviewed at plan time. Without this they'd just see \"applied\" and\n *     have no feedback that the PATCH actually targeted the same fields.\n *   - `*Apply.ts` modules — register `logApplyChange()` at the PATCH /\n *     PUT call site so the console output is uniform across every\n *     resource kind.\n *\n * Pure functions only — no I/O, no mutation. Stays trivially testable\n * and reusable from the JSON serializer if we ever need a structured\n * audit log alongside the human stream.\n */\n\nimport type {\n  PlanAction,\n  PlanFieldChange,\n  PlanResourceKind,\n} from \"./plan.types.js\";\n\n/**\n * Format a single field value for human display. Truncates long strings\n * (Hyperdrive origins / DNS TXT content can be enormous) and uses a\n * sentinel for `undefined` so reviewers can tell a missing value apart\n * from an empty string.\n */\nexport function formatPlanValue(v: unknown): string {\n  if (v === undefined) return \"(unset)\";\n  if (v === null) return \"(null)\";\n  if (typeof v === \"string\") {\n    return v.length > 64 ? `${v.slice(0, 61)}...` : v;\n  }\n  if (typeof v === \"object\") {\n    try {\n      const json = JSON.stringify(v);\n      return json.length > 64 ? `${json.slice(0, 61)}...` : json;\n    } catch {\n      return String(v);\n    }\n  }\n  return String(v);\n}\n\n/**\n * One line of terraform-style attribute diff:\n *\n *   ~ origin.host: postgres-old.example.com -> postgres-new.example.com\n *\n * Mutable changes use `~`; immutable changes use `±` (matches the\n * action sign in `signFor` so the eye can follow what triggers a\n * `replace`).\n */\nexport function formatPlanFieldChange(c: PlanFieldChange): string {\n  const sign = c.kind === \"immutable\" ? \"±\" : \"~\";\n  return `${sign} ${c.field}: ${formatPlanValue(c.from)} -> ${formatPlanValue(\n    c.to,\n  )}`;\n}\n\n/**\n * Render a block of field changes with consistent indentation. Used by\n * both `tamer plan` (under each item) and `tamer apply` (after each\n * PATCH / PUT). Returns one line per change; the caller is responsible\n * for `console.log`ing them.\n */\nexport function formatPlanFieldChanges(\n  changes: readonly PlanFieldChange[] | undefined,\n  indent: string = \"      \",\n): string[] {\n  if (!changes || changes.length === 0) return [];\n  return changes.map((c) => `${indent}${formatPlanFieldChange(c)}`);\n}\n\n/**\n * Sign character for a plan action. Matches what the human plan\n * renderer prints next to each item (and what apply echoes back so the\n * eye can correlate plan rows to apply rows).\n */\nexport function signFor(action: PlanAction): string {\n  switch (action) {\n    case \"create\":\n      return \"+\";\n    case \"update\":\n      return \"~\";\n    case \"replace\":\n      return \"±\";\n    case \"delete\":\n      return \"-\";\n    case \"no_change\":\n      return \" \";\n  }\n}\n\n/**\n * Apply-time log emitter. Modules call this at the PATCH / PUT / POST\n * call site so the console output is uniform across every kind:\n *\n *   ~ hyperdrive db -> hd-db-t-acme-prod\n *       ~ origin.host: pg-old.example.com -> pg-new.example.com\n *       ~ origin.database: appdb -> appdb_v2\n *\n * `logical` is the user's `tamer.config.ts` logical name; `derived` is\n * the Cloudflare-side name/id Tamer chose. `changes` is optional —\n * `create` rows print just the header line.\n *\n * Side effect: increments the module-scoped {@link applySummary} so\n * `runApply` can print a terraform-style \"Applied: N created, N updated,\n * N replaced.\" summary at the end. The counter is process-global; call\n * {@link resetApplySummary} at the start of each apply run.\n */\nexport function logApplyChange(args: {\n  kind: PlanResourceKind;\n  action: PlanAction;\n  logical: string;\n  derived: string;\n  changes?: readonly PlanFieldChange[];\n}): void {\n  const { kind, action, logical, derived, changes } = args;\n  const sign = signFor(action);\n  console.log(`  ${sign} ${kind} ${logical} -> ${derived}`);\n  for (const line of formatPlanFieldChanges(changes)) {\n    console.log(line);\n  }\n  recordApplyAction(action);\n}\n\n/**\n * Counter for what `tamer apply` actually did this run, mirroring\n * `planSummary` so the final summary line at apply end matches the\n * `Summary: …` line `tamer plan` prints. `delete` is included so the\n * same counter survives the future `apply --plan <destroy.json>` path\n * (currently `runDestroy` owns deletes; the slot is reserved for the\n * unified-apply future).\n */\nconst applySummary: Record<PlanAction, number> = {\n  create: 0,\n  update: 0,\n  replace: 0,\n  delete: 0,\n  no_change: 0,\n};\n\nfunction recordApplyAction(action: PlanAction): void {\n  applySummary[action]++;\n}\n\n/** Reset before each `runApply` so summaries don't leak between invocations. */\nexport function resetApplySummary(): void {\n  applySummary.create = 0;\n  applySummary.update = 0;\n  applySummary.replace = 0;\n  applySummary.delete = 0;\n  applySummary.no_change = 0;\n}\n\n/** Snapshot the counter for printing / testing. */\nexport function getApplySummary(): Readonly<Record<PlanAction, number>> {\n  return { ...applySummary };\n}\n\n/**\n * Print the final summary line at the bottom of `tamer apply` output —\n * matches the \"Summary: N to create, N to update, N to replace.\" line\n * `tamer plan` prints, but in past tense and with whatever apply\n * actually did.\n */\nexport function printApplySummary(): void {\n  const s = applySummary;\n  console.log(\n    `Summary: ${s.create} created, ${s.update} updated, ${s.replace} replaced.`,\n  );\n}\n"],"mappings":";;;;;;;AA+BA,SAAgB,gBAAgB,GAAoB;AAClD,KAAI,MAAM,OAAW,QAAO;AAC5B,KAAI,MAAM,KAAM,QAAO;AACvB,KAAI,OAAO,MAAM,SACf,QAAO,EAAE,SAAS,KAAK,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,OAAO;AAElD,KAAI,OAAO,MAAM,SACf,KAAI;EACF,MAAM,OAAO,KAAK,UAAU,EAAE;AAC9B,SAAO,KAAK,SAAS,KAAK,GAAG,KAAK,MAAM,GAAG,GAAG,CAAC,OAAO;SAChD;AACN,SAAO,OAAO,EAAE;;AAGpB,QAAO,OAAO,EAAE;;;;;;;;;;;AAYlB,SAAgB,sBAAsB,GAA4B;AAEhE,QAAO,GADM,EAAE,SAAS,cAAc,MAAM,IAC7B,GAAG,EAAE,MAAM,IAAI,gBAAgB,EAAE,KAAK,CAAC,MAAM,gBAC1D,EAAE,GACH;;;;;;;;AASH,SAAgB,uBACd,SACA,SAAiB,UACP;AACV,KAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO,EAAE;AAC/C,QAAO,QAAQ,KAAK,MAAM,GAAG,SAAS,sBAAsB,EAAE,GAAG;;;;;;;AAQnE,SAAgB,QAAQ,QAA4B;AAClD,SAAQ,QAAR;EACE,KAAK,SACH,QAAO;EACT,KAAK,SACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,SACH,QAAO;EACT,KAAK,YACH,QAAO;;;;;;;;;;;;;;;;;;;;AAqBb,SAAgB,eAAe,MAMtB;CACP,MAAM,EAAE,MAAM,QAAQ,SAAS,SAAS,YAAY;CACpD,MAAM,OAAO,QAAQ,OAAO;AAC5B,SAAQ,IAAI,KAAK,KAAK,GAAG,KAAK,GAAG,QAAQ,MAAM,UAAU;AACzD,MAAK,MAAM,QAAQ,uBAAuB,QAAQ,CAChD,SAAQ,IAAI,KAAK;AAEnB,mBAAkB,OAAO;;;;;;;;;;AAW3B,MAAMA,eAA2C;CAC/C,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,WAAW;CACZ;AAED,SAAS,kBAAkB,QAA0B;AACnD,cAAa;;;AAIf,SAAgB,oBAA0B;AACxC,cAAa,SAAS;AACtB,cAAa,SAAS;AACtB,cAAa,UAAU;AACvB,cAAa,SAAS;AACtB,cAAa,YAAY;;;;;;;;AAc3B,SAAgB,oBAA0B;CACxC,MAAM,IAAI;AACV,SAAQ,IACN,YAAY,EAAE,OAAO,YAAY,EAAE,OAAO,YAAY,EAAE,QAAQ,YACjE"}
+{"version":3,"file":"planFormat-DHjPdYzr.mjs","names":["applySummary: Record<PlanAction, number>"],"sources":["../src/core/plan/planFormat.ts"],"sourcesContent":["/**\n * Shared rendering for terraform-style plan output. Used by:\n *\n *   - `tamer plan` (human mode) — field-level diffs under each\n *     `update` / `replace` line so reviewers see exactly which fields\n *     would change before they sign off on a saved plan.\n *   - `tamer apply` — per-field log lines when each in-place patch fires,\n *     so the operator sees the same diffs at apply time that they\n *     reviewed at plan time. Without this they'd just see \"applied\" and\n *     have no feedback that the PATCH actually targeted the same fields.\n *   - `*Apply.ts` modules — register `logApplyChange()` at the PATCH /\n *     PUT call site so the console output is uniform across every\n *     resource kind.\n *\n * Pure functions only — no I/O, no mutation. Stays trivially testable\n * and reusable from the JSON serializer if we ever need a structured\n * audit log alongside the human stream.\n */\n\nimport type {\n  PlanAction,\n  PlanFieldChange,\n  PlanResourceKind,\n} from \"./plan.types.js\";\n\n/**\n * Format a single field value for human display. Truncates long strings\n * (Hyperdrive origins / DNS TXT content can be enormous) and uses a\n * sentinel for `undefined` so reviewers can tell a missing value apart\n * from an empty string.\n */\nexport function formatPlanValue(v: unknown): string {\n  if (v === undefined) return \"(unset)\";\n  if (v === null) return \"(null)\";\n  if (typeof v === \"string\") {\n    return v.length > 64 ? `${v.slice(0, 61)}...` : v;\n  }\n  if (typeof v === \"object\") {\n    try {\n      const json = JSON.stringify(v);\n      return json.length > 64 ? `${json.slice(0, 61)}...` : json;\n    } catch {\n      return String(v);\n    }\n  }\n  return String(v);\n}\n\n/**\n * One line of terraform-style attribute diff:\n *\n *   ~ origin.host: postgres-old.example.com -> postgres-new.example.com\n *\n * Mutable changes use `~`; immutable changes use `±` (matches the\n * action sign in `signFor` so the eye can follow what triggers a\n * `replace`).\n */\nexport function formatPlanFieldChange(c: PlanFieldChange): string {\n  const sign = c.kind === \"immutable\" ? \"±\" : \"~\";\n  return `${sign} ${c.field}: ${formatPlanValue(c.from)} -> ${formatPlanValue(\n    c.to,\n  )}`;\n}\n\n/**\n * Render a block of field changes with consistent indentation. Used by\n * both `tamer plan` (under each item) and `tamer apply` (after each\n * PATCH / PUT). Returns one line per change; the caller is responsible\n * for `console.log`ing them.\n */\nexport function formatPlanFieldChanges(\n  changes: readonly PlanFieldChange[] | undefined,\n  indent: string = \"      \",\n): string[] {\n  if (!changes || changes.length === 0) return [];\n  return changes.map((c) => `${indent}${formatPlanFieldChange(c)}`);\n}\n\n/**\n * Sign character for a plan action. Matches what the human plan\n * renderer prints next to each item (and what apply echoes back so the\n * eye can correlate plan rows to apply rows).\n */\nexport function signFor(action: PlanAction): string {\n  switch (action) {\n    case \"create\":\n      return \"+\";\n    case \"update\":\n      return \"~\";\n    case \"replace\":\n      return \"±\";\n    case \"delete\":\n      return \"-\";\n    case \"no_change\":\n      return \" \";\n  }\n}\n\n/**\n * Apply-time log emitter. Modules call this at the PATCH / PUT / POST\n * call site so the console output is uniform across every kind:\n *\n *   ~ hyperdrive db -> hd-db-t-acme-prod\n *       ~ origin.host: pg-old.example.com -> pg-new.example.com\n *       ~ origin.database: appdb -> appdb_v2\n *\n * `logical` is the user's `tamer.config.ts` logical name; `derived` is\n * the Cloudflare-side name/id Tamer chose. `changes` is optional —\n * `create` rows print just the header line.\n *\n * Side effect: increments the module-scoped {@link applySummary} so\n * `runApply` can print a terraform-style \"Applied: N created, N updated,\n * N replaced.\" summary at the end. The counter is process-global; call\n * {@link resetApplySummary} at the start of each apply run.\n */\nexport function logApplyChange(args: {\n  kind: PlanResourceKind;\n  action: PlanAction;\n  logical: string;\n  derived: string;\n  changes?: readonly PlanFieldChange[];\n}): void {\n  const { kind, action, logical, derived, changes } = args;\n  const sign = signFor(action);\n  console.log(`  ${sign} ${kind} ${logical} -> ${derived}`);\n  for (const line of formatPlanFieldChanges(changes)) {\n    console.log(line);\n  }\n  recordApplyAction(action);\n}\n\n/**\n * Counter for what `tamer apply` actually did this run, mirroring\n * `planSummary` so the final summary line at apply end matches the\n * `Summary: …` line `tamer plan` prints. `delete` is included so the\n * same counter survives the future `apply --plan <destroy.json>` path\n * (currently `runDestroy` owns deletes; the slot is reserved for the\n * unified-apply future).\n */\nconst applySummary: Record<PlanAction, number> = {\n  create: 0,\n  update: 0,\n  replace: 0,\n  delete: 0,\n  no_change: 0,\n};\n\nfunction recordApplyAction(action: PlanAction): void {\n  applySummary[action]++;\n}\n\n/** Reset before each `runApply` so summaries don't leak between invocations. */\nexport function resetApplySummary(): void {\n  applySummary.create = 0;\n  applySummary.update = 0;\n  applySummary.replace = 0;\n  applySummary.delete = 0;\n  applySummary.no_change = 0;\n}\n\n/** Snapshot the counter for printing / testing. */\nexport function getApplySummary(): Readonly<Record<PlanAction, number>> {\n  return { ...applySummary };\n}\n\n/**\n * Print the final summary line at the bottom of `tamer apply` output —\n * matches the \"Summary: N to create, N to update, N to replace.\" line\n * `tamer plan` prints, but in past tense and with whatever apply\n * actually did.\n */\nexport function printApplySummary(): void {\n  const s = applySummary;\n  console.log(\n    `Summary: ${s.create} created, ${s.update} updated, ${s.replace} replaced.`,\n  );\n}\n"],"mappings":";;;;;;;AA+BA,SAAgB,gBAAgB,GAAoB;AAClD,KAAI,MAAM,OAAW,QAAO;AAC5B,KAAI,MAAM,KAAM,QAAO;AACvB,KAAI,OAAO,MAAM,SACf,QAAO,EAAE,SAAS,KAAK,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,OAAO;AAElD,KAAI,OAAO,MAAM,SACf,KAAI;EACF,MAAM,OAAO,KAAK,UAAU,EAAE;AAC9B,SAAO,KAAK,SAAS,KAAK,GAAG,KAAK,MAAM,GAAG,GAAG,CAAC,OAAO;SAChD;AACN,SAAO,OAAO,EAAE;;AAGpB,QAAO,OAAO,EAAE;;;;;;;;;;;AAYlB,SAAgB,sBAAsB,GAA4B;AAEhE,QAAO,GADM,EAAE,SAAS,cAAc,MAAM,IAC7B,GAAG,EAAE,MAAM,IAAI,gBAAgB,EAAE,KAAK,CAAC,MAAM,gBAC1D,EAAE,GACH;;;;;;;;AASH,SAAgB,uBACd,SACA,SAAiB,UACP;AACV,KAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO,EAAE;AAC/C,QAAO,QAAQ,KAAK,MAAM,GAAG,SAAS,sBAAsB,EAAE,GAAG;;;;;;;AAQnE,SAAgB,QAAQ,QAA4B;AAClD,SAAQ,QAAR;EACE,KAAK,SACH,QAAO;EACT,KAAK,SACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,SACH,QAAO;EACT,KAAK,YACH,QAAO;;;;;;;;;;;;;;;;;;;;AAqBb,SAAgB,eAAe,MAMtB;CACP,MAAM,EAAE,MAAM,QAAQ,SAAS,SAAS,YAAY;CACpD,MAAM,OAAO,QAAQ,OAAO;AAC5B,SAAQ,IAAI,KAAK,KAAK,GAAG,KAAK,GAAG,QAAQ,MAAM,UAAU;AACzD,MAAK,MAAM,QAAQ,uBAAuB,QAAQ,CAChD,SAAQ,IAAI,KAAK;AAEnB,mBAAkB,OAAO;;;;;;;;;;AAW3B,MAAMA,eAA2C;CAC/C,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,WAAW;CACZ;AAED,SAAS,kBAAkB,QAA0B;AACnD,cAAa;;;AAIf,SAAgB,oBAA0B;AACxC,cAAa,SAAS;AACtB,cAAa,SAAS;AACtB,cAAa,UAAU;AACvB,cAAa,SAAS;AACtB,cAAa,YAAY;;;;;;;;AAc3B,SAAgB,oBAA0B;CACxC,MAAM,IAAI;AACV,SAAQ,IACN,YAAY,EAAE,OAAO,YAAY,EAAE,OAAO,YAAY,EAAE,QAAQ,YACjE"}

package/dist/{provision-tenant-DoWNQJvY.mjs → provision-tenant-wGPK8MRJ.mjs}

@@ -1,9 +1,9 @@
 import { f as getDispatchNamespaces } from "./normalize-DVSTRZhO.mjs";
-import { P as effectiveDispatchNamespaceName, R as CFApiClient, U as loadConfig, _ as tenantDispatchScriptName, g as parseTenantShardRoles, h as StateManager, u as namingFromConfig, v as tenantShardDatabaseName, w as stackNameForConfig, y as tenantStateKey, z as cloudflareAccountIdFromEnv } from "./tamer.mjs";
-import "./r2S3EmptyBucket-DD81ZWQ7.mjs";
-import { n as logApplyChange } from "./planFormat-CJw8Kq2s.mjs";
-import { i as tamerArtifactsKeyPrefix, r as tamerArtifactsBucketName } from "./tamerArtifactsR2-B3X21TGV.mjs";
-import { resolveTenantBindings } from "./resolveTenantBindings-86AmRQcW.mjs";
+import { $ as cloudflareAccountIdFromEnv, C as tenantStateKey, O as stackNameForConfig, Q as CFApiClient, R as effectiveDispatchNamespaceName, S as tenantShardDatabaseName, b as parseTenantShardRoles, m as namingFromConfig, rt as loadConfig, x as tenantDispatchScriptName, y as StateManager } from "./tamer.mjs";
+import "./r2S3EmptyBucket-OKIQdlms.mjs";
+import { n as logApplyChange } from "./planFormat-DHjPdYzr.mjs";
+import { i as tamerArtifactsKeyPrefix, r as tamerArtifactsBucketName } from "./tamerArtifactsR2--lL7OBaD.mjs";
+import { resolveTenantBindings } from "./resolveTenantBindings-C-3w6e22.mjs";
 import { basename, resolve } from "path";
 
 //#region src/cli/commands/provision-tenant.ts
@@ -133,8 +133,8 @@ async function provisionTenantInner(options) {
 	if (options.migrate !== false && shards.length > 0) await migrateTenantShards(config, shards, env, naming);
 	const { writeFileSync, unlinkSync, mkdirSync } = await import("fs");
 	const { join: joinPath, dirname: dirnamePath } = await import("path");
-	const { spawnWranglerSync } = await import("./wranglerSpawn-CfPkFLP3.mjs");
-	const { wranglerConfigCliArgs } = await import("./wranglerOutFile-DDFKeKwO.mjs");
+	const { spawnWranglerSync } = await import("./wranglerSpawn-PEDw4vkF.mjs");
+	const { wranglerConfigCliArgs } = await import("./wranglerOutFile-BwTiiBhi.mjs");
 	let workerDir;
 	let tempWranglerPath;
 	const tempWranglerFile = "wrangler.tenant.json";
@@ -195,6 +195,27 @@ async function provisionTenantInner(options) {
 		unlinkSync(tempWranglerPath);
 	} catch {}
 	if (deployResult.status !== 0) throw new Error(`wrangler deploy failed for tenant ${scriptName} (exit ${deployResult.status})`);
+	const dispatchSecretNames = config.tenant.dispatchSecrets ?? [];
+	if (dispatchSecretNames.length > 0) {
+		const { ensureTamerSecretsDatabase } = await import("./secretsDb-B_xO1fwY.mjs");
+		const { SecretsVault } = await import("./SecretsVault-DfizRmnN.mjs");
+		const { readMasterKeyFromEnv } = await import("./masterKey-DjpTmsn9.mjs");
+		const { decryptSecretValue } = await import("./crypto-Dsq43xcZ.mjs");
+		const vault = new SecretsVault(api, env, await ensureTamerSecretsDatabase(api));
+		const masterKey = readMasterKeyFromEnv(env);
+		if (!masterKey) throw new Error(`dispatchSecrets: master key not found. Set TAMER_SECRETS_KEY_${env} in the environment.`);
+		console.log(`Pushing ${dispatchSecretNames.length} dispatch secret(s) to ${scriptName}…`);
+		for (const secretName of dispatchSecretNames) {
+			const record = await vault.get(secretName);
+			if (!record) throw new Error(`dispatchSecrets: secret "${secretName}" not found in vault for env ${env}. Run: tamer secrets set ${secretName} --env ${env}`);
+			const plaintext = await decryptSecretValue(record, masterKey);
+			await api.dispatchNamespaceScriptSecretPut(dispatchNamespaceName, scriptName, {
+				name: secretName,
+				text: plaintext
+			});
+			console.log(`  ✓ ${secretName} → ${scriptName}`);
+		}
+	}
 	state.setTenant(buildTenantEntry(entryOpts, "ready", existing, { d1Shards: shards }));
 	await state.persist(api);
 	const shardsSummary = shards.length > 0 ? `shards: ${shards.map((s) => s.role).join(", ")}` : "no shards declared";
@@ -225,12 +246,12 @@ async function migrateTenantShards(config, shards, env, naming) {
 	const { writeFileSync, unlinkSync, mkdirSync } = await import("fs");
 	const { join: join$1 } = await import("path");
 	const { tmpdir } = await import("os");
-	const { spawnWranglerSync } = await import("./wranglerSpawn-CfPkFLP3.mjs");
-	const { wranglerConfigCliArgs } = await import("./wranglerOutFile-DDFKeKwO.mjs");
-	const { resolveTenantD1Bindings } = await import("./resolveTenantBindings-86AmRQcW.mjs");
+	const { spawnWranglerSync } = await import("./wranglerSpawn-PEDw4vkF.mjs");
+	const { wranglerConfigCliArgs } = await import("./wranglerOutFile-BwTiiBhi.mjs");
+	const { resolveTenantD1Bindings } = await import("./resolveTenantBindings-C-3w6e22.mjs");
 	const shardBindings = config.tenant.shardBindings ?? {};
 	const d1Bindings = resolveTenantD1Bindings(config, shards, naming);
-	const { getConfigBaseDir } = await import("./loader-B5iVsP6t.mjs");
+	const { getConfigBaseDir } = await import("./loader-O14iKXe5.mjs");
 	const baseDir = getConfigBaseDir();
 	for (let i = 0; i < shards.length; i++) {
 		const shard = shards[i];
@@ -277,4 +298,4 @@ async function migrateTenantShards(config, shards, env, naming) {
 
 //#endregion
 export { runProvisionTenant };
-//# sourceMappingURL=provision-tenant-DoWNQJvY.mjs.map
+//# sourceMappingURL=provision-tenant-wGPK8MRJ.mjs.map

package/dist/{provision-tenant-DoWNQJvY.mjs.map → provision-tenant-wGPK8MRJ.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"provision-tenant-DoWNQJvY.mjs","names":["result: ProvisionTenantResult","allD1: Awaited<ReturnType<typeof api.d1ListAll>> | null","shards: TenantD1ShardRef[]","workerDir: string","tempWranglerPath: string","wranglerConfig: Record<string, unknown>","d1Databases: Array<Record<string, string>>","vars: Record<string, string>","services: Array<Record<string, string>>","join"],"sources":["../src/cli/commands/provision-tenant.ts"],"sourcesContent":["import { basename, resolve } from \"path\";\nimport { loadConfig } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { getDispatchNamespaces } from \"../../types.js\";\nimport { effectiveDispatchNamespaceName } from \"../../features/dispatch-namespace/dispatch-namespace.resolve.js\";\nimport {\n  parseTenantShardRoles,\n  tenantDispatchScriptName,\n  tenantShardDatabaseName,\n  tenantStateKey,\n} from \"../../core/tenant/tenantKeys.js\";\nimport {\n  buildSingleModuleDispatchForm,\n  buildSingleModuleDispatchFormFromBuffer,\n} from \"../../core/wfp/buildDispatchUploadForm.js\";\nimport { resolveTenantBindings } from \"../../core/tenant/resolveTenantBindings.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { tamerArtifactsBucketName, tamerArtifactsKeyPrefix } from \"../../core/state/tamerArtifactsR2.js\";\nimport { logApplyChange } from \"../../core/plan/planFormat.js\";\nimport type { TenantD1ShardRef, TenantStateEntry } from \"../../types.js\";\n\nconst now = (): string => new Date().toISOString();\n\nfunction buildTenantEntry(\n  options: {\n    product: string;\n    workspace: string;\n    dispatchNamespaceName: string;\n    scriptName: string;\n  },\n  status: TenantStateEntry[\"provisioningStatus\"],\n  existing: TenantStateEntry | undefined,\n  patch?: Partial<Pick<TenantStateEntry, \"d1Shards\">>,\n): TenantStateEntry {\n  return {\n    product: options.product,\n    workspace: options.workspace,\n    provisioningStatus: status,\n    dispatchNamespaceName: options.dispatchNamespaceName,\n    scriptName: options.scriptName,\n    d1Shards: patch?.d1Shards ?? existing?.d1Shards,\n    createdAt: existing?.createdAt ?? now(),\n    updatedAt: now(),\n  };\n}\n\n/**\n * Resolve the effective shard set for this provision call.\n *\n *   1. The configured layout (`tenant.d1Shards` in `tamer.config.ts`)\n *      is the source of truth — any role used by `--shards` must\n *      appear here, and `apply` / `drift` / other operators read the\n *      same shape.\n *   2. When `--shards a,b` is passed, trim to that subset (preserving\n *      configured order so plan/provision logs stay deterministic).\n *      Extending the layout is an edit to `tamer.config.ts`, not a\n *      CLI flag — that's why `parseTenantShardRoles` rejects roles\n *      outside the configured set.\n *   3. When the config has no `tenant.d1Shards`, the resolved set is\n *      empty: `provision-tenant` only uploads the dispatch script\n *      (truly generic single-Worker tenant case).\n */\nfunction resolveShardRoles(\n  configured: readonly string[],\n  shardsRaw: string | undefined,\n): string[] {\n  if (shardsRaw == null || shardsRaw.trim() === \"\") return [...configured];\n  return parseTenantShardRoles(shardsRaw, configured);\n}\n\n/**\n * Idempotent tenant provisioning. Each call:\n *\n *   1. Marks the tenant `pending` if there's no record yet.\n *   2. For every shard role declared in `tenant.d1Shards` in\n *      `tamer.config.ts` (or a `--shards` subset): looks up an\n *      existing D1 by derived name (`tenantShardDatabaseName(role,\n *      …)`), creating it via `d1Create` only when missing. Persists\n *      the `(role, derivedName, cfId)` triple to\n *      `state.tenants[…].d1Shards[]`.\n *   3. Marks the tenant `d1_created` once *all* requested shards\n *      exist in state.\n *   4. Uploads the dispatch script (from `--main` or `--artifact-key`)\n *      via the WFP dispatch namespace.\n *   5. Marks the tenant `ready`.\n *\n * When `tenant.d1Shards` is omitted, step 2/3 collapse to a no-op\n * (truly generic single-Worker tenant — only the dispatch script is\n * provisioned). Re-running with the same shard set is a no-op (state\n * already has those rows). Editing `tamer.config.ts` to **extend**\n * the layout (e.g. adding a new role) and re-running picks up the\n * missing shards without disturbing existing ones, so a tenant\n * created with `[\"app\"]` can be migrated to `[\"system\",\"app\",\n * \"history\"]` (or `[\"primary\",\"audit\"]`, or any other set) with one\n * config edit + one `provision-tenant` invocation. Re-running after\n * a config that **shrinks** the layout never deletes shards (use\n * `destroy-tenant` for that).\n */\n/**\n * Machine-readable result envelope emitted on the final stdout line\n * when `--json` is passed. Designed for the Cloudflare Container caller\n * (`provision-workflow`, see `docs/handoff.md` §7) so the Worker can\n * parse the result without scraping human logs. On success the Workflow\n * sees `status: \"ready\"` plus the materialized tenant shape; on\n * failure it sees `status: \"failed\"` with `error` + best-effort\n * `partial` state, and the process exits non-zero.\n */\nexport interface ProvisionTenantResult {\n  status: \"ready\" | \"failed\" | \"noop\";\n  tenantKey: string;\n  product: string;\n  workspace: string;\n  env: string;\n  scriptName: string;\n  dispatchNamespaceName: string;\n  shards: { role: string; derivedName: string; cfId: string }[];\n  error?: string;\n}\n\nexport async function runProvisionTenant(options: {\n  env: string;\n  product: string;\n  workspace: string;\n  main?: string;\n  artifactKey?: string;\n  moduleName?: string;\n  configPath?: string;\n  compatibilityDate?: string;\n  compatibilityFlags?: string[];\n  /**\n   * Raw `--shards` value (`\"system,app\"` etc.) — validated against\n   * `tenant.d1Shards` from the loaded config. Omit to provision every\n   * configured shard.\n   */\n  shardsRaw?: string;\n  json?: boolean;\n  migrate?: boolean;\n}): Promise<void> {\n  const env = options.env;\n  if (env === \"local\") {\n    throw new Error(\n      \"provision-tenant requires a non-local --env (Cloudflare-backed state).\",\n    );\n  }\n\n  try {\n    await provisionTenantInner(options);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    if (options.json) {\n      // Failure envelope: we may have died before loadConfig, so we\n      // can't ask `tenant.ephemeralEnvPattern` whether `env` would\n      // get the `-{env}` suffix. Emit the non-ephemeral form as a\n      // best-effort hint — `error` carries the real signal.\n      const result: ProvisionTenantResult = {\n        status: \"failed\",\n        tenantKey: tenantStateKey(options.product, options.workspace),\n        product: options.product,\n        workspace: options.workspace,\n        env,\n        scriptName: `${options.product}-${options.workspace}`,\n        dispatchNamespaceName: \"\",\n        shards: [],\n        error: msg,\n      };\n      process.stdout.write(JSON.stringify(result) + \"\\n\");\n    }\n    // Container caller (provision-workflow) reads exit code as\n    // primary success/failure signal; JSON envelope on stdout is\n    // secondary detail. Re-throw so the CLI surfaces the original\n    // error in human mode.\n    throw err;\n  }\n}\n\nasync function provisionTenantInner(options: {\n  env: string;\n  product: string;\n  workspace: string;\n  main?: string;\n  artifactKey?: string;\n  moduleName?: string;\n  configPath?: string;\n  compatibilityDate?: string;\n  compatibilityFlags?: string[];\n  shardsRaw?: string;\n  json?: boolean;\n  migrate?: boolean;\n}): Promise<void> {\n  const env = options.env;\n  const config = await loadConfig(options.configPath, { env });\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const dns = getDispatchNamespaces(config);\n  if (dns.length === 0) {\n    throw new Error(\n      \"provision-tenant requires at least one dispatch namespace in the Tamer project config (dispatchNamespaces).\",\n    );\n  }\n  const nsConfig = dns[0]!;\n  const dispatchNamespaceName = effectiveDispatchNamespaceName(\n    nsConfig,\n    env,\n    config.tenant,\n  );\n  const scriptName = tenantDispatchScriptName(\n    options.product,\n    options.workspace,\n    env,\n    config.tenant,\n  );\n  const desiredRoles = resolveShardRoles(\n    config.tenant.d1Shards ?? [],\n    options.shardsRaw,\n  );\n\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n\n  let existing = state.getTenant(options.product, options.workspace);\n  // \"ready\" is a no-op only when the existing layout already covers\n  // every requested shard role. Adding a new role re-opens the tenant\n  // for incremental provisioning without forcing a full re-deploy.\n  if (existing?.provisioningStatus === \"ready\") {\n    const have = new Set((existing.d1Shards ?? []).map((s) => s.role));\n    const missing = desiredRoles.filter((r) => !have.has(r));\n    if (missing.length === 0) {\n      console.log(\n        `Tenant ${tenantStateKey(options.product, options.workspace)} already ready — shards up to date, redeploying script…`,\n      );\n      // Don't return — fall through to always redeploy the script.\n      // Code may have changed since the last provision.\n      // The shard creation loop below will skip existing shards.\n    } else {\n      console.log(\n        `Tenant ${tenantStateKey(options.product, options.workspace)} ready but missing shards: ${missing.join(\", \")}; extending layout.`,\n      );\n    }\n  }\n\n  const compatDate =\n    options.compatibilityDate ??\n    config.compatibility_date ??\n    new Date().toISOString().slice(0, 10);\n\n  const entryOpts = {\n    product: options.product,\n    workspace: options.workspace,\n    dispatchNamespaceName,\n    scriptName,\n  };\n\n  if (!existing) {\n    state.setTenant(buildTenantEntry(entryOpts, \"pending\", undefined));\n    await state.persist(api);\n    existing = state.getTenant(options.product, options.workspace)!;\n  }\n\n  // Reconcile each requested shard role. We list D1 once per call when\n  // we need to (some role is missing from state) and reuse the result\n  // for every subsequent role.\n  let allD1: Awaited<ReturnType<typeof api.d1ListAll>> | null = null;\n  const shards: TenantD1ShardRef[] = [...(existing.d1Shards ?? [])];\n\n  for (const role of desiredRoles) {\n    if (shards.find((s) => s.role === role)) continue;\n    const derivedName = tenantShardDatabaseName(\n      role,\n      options.workspace,\n      options.product,\n      config.tenant.id,\n      env,\n    );\n    if (allD1 === null) {\n      allD1 = await api.d1ListAll();\n    }\n    let cfId = allD1.find((d) => d.name === derivedName)?.uuid;\n    if (cfId) {\n      // Adopt an existing D1 (e.g. partial-failure resume, or\n      // operator created it out-of-band) without re-issuing POST.\n      logApplyChange({\n        kind: \"d1\",\n        action: \"no_change\",\n        logical: `${role}-shard`,\n        derived: derivedName,\n      });\n    } else {\n      logApplyChange({\n        kind: \"d1\",\n        action: \"create\",\n        logical: `${role}-shard`,\n        derived: derivedName,\n      });\n      const created = await api.d1Create(derivedName);\n      cfId = created.uuid;\n    }\n    shards.push({ role, derivedName, cfId });\n    // Persist after each shard so a network failure mid-loop leaves\n    // the already-created shards recorded — `provision-tenant` is\n    // resumable role-by-role.\n    state.setTenant(\n      buildTenantEntry(entryOpts, \"d1_created\", existing, { d1Shards: shards }),\n    );\n    await state.persist(api);\n    existing = state.getTenant(options.product, options.workspace)!;\n  }\n\n  // Resolve dispatch script bindings from shards + config.\n  const naming = namingFromConfig(config);\n  const bindings = resolveTenantBindings(\n    config,\n    shards,\n    naming,\n    state,\n    env,\n    accountId,\n  );\n\n  // Optionally run migrations on each shard before uploading the script.\n  if (options.migrate !== false && shards.length > 0) {\n    await migrateTenantShards(config, shards, env, naming);\n  }\n\n  // Deploy the tenant worker via wrangler — handles TS compilation, WASM\n  // packaging, node: polyfills, and binding resolution. We write a temporary\n  // wrangler.json with the resolved tenant bindings, then run\n  // `wrangler deploy --dispatch-namespace`.\n  const { writeFileSync, unlinkSync, mkdirSync } = await import(\"fs\");\n  const { join: joinPath, dirname: dirnamePath } = await import(\"path\");\n  const { spawnWranglerSync } = await import(\"../../core/wrangler/wranglerSpawn.js\");\n  const { wranglerConfigCliArgs } = await import(\"../../core/wrangler/wranglerOutFile.js\");\n\n  let workerDir: string;\n  let tempWranglerPath: string;\n  const tempWranglerFile = \"wrangler.tenant.json\";\n\n  // Build the temporary wrangler config for the tenant dispatch script\n  const wranglerConfig: Record<string, unknown> = {\n    name: scriptName,\n    main: options.main ? basename(resolve(process.cwd(), options.main)) : (options.moduleName ?? \"worker.js\"),\n    compatibility_date: compatDate,\n    compatibility_flags: options.compatibilityFlags ?? [],\n  };\n\n  // Add resolved bindings to wrangler config\n  if (bindings.bindings?.length) {\n    // Convert unified bindings format to wrangler config format\n    const d1Databases: Array<Record<string, string>> = [];\n    const vars: Record<string, string> = {};\n    const services: Array<Record<string, string>> = [];\n    for (const b of bindings.bindings) {\n      if (b.type === \"d1\") {\n        d1Databases.push({ binding: b.name, database_id: b.id });\n      } else if (b.type === \"plain_text\") {\n        vars[b.name] = b.text;\n      } else if (b.type === \"service\") {\n        services.push({ name: b.name, service: b.service, ...(b.environment ? { environment: b.environment } : {}) });\n      }\n    }\n    if (d1Databases.length) wranglerConfig.d1_databases = d1Databases;\n    if (Object.keys(vars).length) wranglerConfig.vars = vars;\n    if (services.length) wranglerConfig.services = services;\n  }\n\n  if (options.main) {\n    const mainPath = resolve(process.cwd(), options.main);\n    workerDir = dirnamePath(mainPath);\n    wranglerConfig.main = basename(mainPath);\n    tempWranglerPath = joinPath(workerDir, tempWranglerFile);\n  } else if (options.artifactKey) {\n    // Download pre-built bundle from R2 to a temp directory\n    const { tmpdir } = await import(\"os\");\n    const bucket = tamerArtifactsBucketName();\n    const fullKey = `${tamerArtifactsKeyPrefix(env)}${options.artifactKey}`;\n    const body = await api.r2GetObject(bucket, fullKey);\n    const mod =\n      options.moduleName?.trim() ||\n      basename(options.artifactKey).replace(/\\.(zip|tar|gz)$/i, \"\") ||\n      \"worker.js\";\n    workerDir = joinPath(tmpdir(), `tamer-tenant-${Date.now()}`);\n    mkdirSync(workerDir, { recursive: true });\n    writeFileSync(joinPath(workerDir, mod), new Uint8Array(body));\n    wranglerConfig.main = mod;\n    tempWranglerPath = joinPath(workerDir, tempWranglerFile);\n  } else {\n    throw new Error(\"provision-tenant: provide --main or --artifact-key\");\n  }\n\n  writeFileSync(tempWranglerPath, JSON.stringify(wranglerConfig, null, 2));\n\n  console.log(`Deploying tenant script ${scriptName} to ${dispatchNamespaceName} via wrangler…`);\n  const deployResult = spawnWranglerSync(\n    [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(tempWranglerFile),\n      \"deploy\",\n      \"--dispatch-namespace\",\n      dispatchNamespaceName,\n    ],\n    {\n      cwd: workerDir,\n      stdio: \"inherit\",\n    },\n  );\n\n  // Clean up temp config\n  try {\n    unlinkSync(tempWranglerPath);\n  } catch {\n    /* best-effort */\n  }\n\n  if (deployResult.status !== 0) {\n    throw new Error(\n      `wrangler deploy failed for tenant ${scriptName} (exit ${deployResult.status})`,\n    );\n  }\n\n  state.setTenant(\n    buildTenantEntry(entryOpts, \"ready\", existing, { d1Shards: shards }),\n  );\n  await state.persist(api);\n\n  const shardsSummary =\n    shards.length > 0\n      ? `shards: ${shards.map((s) => s.role).join(\", \")}`\n      : \"no shards declared\";\n  console.log(\n    `Provisioned tenant ${tenantStateKey(options.product, options.workspace)} → script ${scriptName} in ${dispatchNamespaceName} (${shardsSummary})`,\n  );\n\n  if (options.json) {\n    const result: ProvisionTenantResult = {\n      status: \"ready\",\n      tenantKey: tenantStateKey(options.product, options.workspace),\n      product: options.product,\n      workspace: options.workspace,\n      env,\n      scriptName,\n      dispatchNamespaceName,\n      shards: shards.map((s) => ({\n        role: s.role,\n        derivedName: s.derivedName,\n        cfId: s.cfId,\n      })),\n    };\n    process.stdout.write(JSON.stringify(result) + \"\\n\");\n  }\n}\n\n/**\n * Run D1 migrations on each tenant shard by writing a temporary wrangler.json\n * with the shard binding and invoking `wrangler d1 migrations apply`.\n */\nasync function migrateTenantShards(\n  config: import(\"../../types.js\").CfiConfig,\n  shards: TenantD1ShardRef[],\n  env: string,\n  naming: import(\"../../core/naming/NamingEngine.js\").NamingEngine,\n): Promise<void> {\n  const { writeFileSync, unlinkSync, mkdirSync } = await import(\"fs\");\n  const { join } = await import(\"path\");\n  const { tmpdir } = await import(\"os\");\n  const { spawnWranglerSync } = await import(\n    \"../../core/wrangler/wranglerSpawn.js\"\n  );\n  const { wranglerConfigCliArgs } = await import(\n    \"../../core/wrangler/wranglerOutFile.js\"\n  );\n  const { resolveTenantD1Bindings } = await import(\n    \"../../core/tenant/resolveTenantBindings.js\"\n  );\n\n  const shardBindings = config.tenant.shardBindings ?? {};\n  const d1Bindings = resolveTenantD1Bindings(config, shards, naming);\n\n  // Resolve base dir for relative migrationsDir paths\n  const { getConfigBaseDir } = await import(\"../../core/config/loader.js\");\n  const baseDir = getConfigBaseDir();\n\n  for (let i = 0; i < shards.length; i++) {\n    const shard = shards[i]!;\n    const binding = d1Bindings[i]!;\n    const info = shardBindings[shard.role];\n    if (!info?.migrationsDir) {\n      console.log(`  migrate: skipping ${shard.role} (no migrationsDir in shardBindings)`);\n      continue;\n    }\n\n    const migDir = resolve(baseDir, info.migrationsDir);\n    const tempWranglerPath = join(migDir, `wrangler.${shard.role}.json`);\n    const tempConfig = {\n      name: `tenant-migrate-${shard.role}`,\n      d1_databases: [{ binding: binding.name, database_id: shard.cfId, database_name: shard.derivedName, migrations_dir: \".\" }],\n      compatibility_date: config.compatibility_date ?? \"2024-01-01\",\n    };\n    writeFileSync(tempWranglerPath, JSON.stringify(tempConfig, null, 2));\n\n    const migrateArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(`wrangler.${shard.role}.json`),\n      \"d1\",\n      \"migrations\",\n      \"apply\",\n      binding.name,\n      \"--remote\",\n    ];\n    if (info.migrationsTable) {\n      migrateArgs.push(\"--migrations-table\", info.migrationsTable);\n    }\n\n    console.log(`  migrate: applying migrations for ${shard.role} (${shard.derivedName})...`);\n    const result = spawnWranglerSync(migrateArgs, {\n      cwd: migDir,\n      stdio: \"inherit\",\n    });\n    if (result.status !== 0) {\n      console.warn(`  migrate: failed for ${shard.role} (exit ${result.status})`);\n    }\n    try {\n      unlinkSync(tempWranglerPath);\n    } catch {\n      /* best-effort cleanup */\n    }\n  }\n}\n"],"mappings":";;;;;;;;;AAwBA,MAAM,6BAAoB,IAAI,MAAM,EAAC,aAAa;AAElD,SAAS,iBACP,SAMA,QACA,UACA,OACkB;AAClB,QAAO;EACL,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB,oBAAoB;EACpB,uBAAuB,QAAQ;EAC/B,YAAY,QAAQ;EACpB,UAAU,OAAO,YAAY,UAAU;EACvC,WAAW,UAAU,aAAa,KAAK;EACvC,WAAW,KAAK;EACjB;;;;;;;;;;;;;;;;;;AAmBH,SAAS,kBACP,YACA,WACU;AACV,KAAI,aAAa,QAAQ,UAAU,MAAM,KAAK,GAAI,QAAO,CAAC,GAAG,WAAW;AACxE,QAAO,sBAAsB,WAAW,WAAW;;AAoDrD,eAAsB,mBAAmB,SAkBvB;CAChB,MAAM,MAAM,QAAQ;AACpB,KAAI,QAAQ,QACV,OAAM,IAAI,MACR,yEACD;AAGH,KAAI;AACF,QAAM,qBAAqB,QAAQ;UAC5B,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,MAAI,QAAQ,MAAM;GAKhB,MAAMA,SAAgC;IACpC,QAAQ;IACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;IAC7D,SAAS,QAAQ;IACjB,WAAW,QAAQ;IACnB;IACA,YAAY,GAAG,QAAQ,QAAQ,GAAG,QAAQ;IAC1C,uBAAuB;IACvB,QAAQ,EAAE;IACV,OAAO;IACR;AACD,WAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK;;AAMrD,QAAM;;;AAIV,eAAe,qBAAqB,SAalB;CAChB,MAAM,MAAM,QAAQ;CACpB,MAAM,SAAS,MAAM,WAAW,QAAQ,YAAY,EAAE,KAAK,CAAC;CAC5D,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,MAAM,sBAAsB,OAAO;AACzC,KAAI,IAAI,WAAW,EACjB,OAAM,IAAI,MACR,8GACD;CAEH,MAAM,WAAW,IAAI;CACrB,MAAM,wBAAwB,+BAC5B,UACA,KACA,OAAO,OACR;CACD,MAAM,aAAa,yBACjB,QAAQ,SACR,QAAQ,WACR,KACA,OAAO,OACR;CACD,MAAM,eAAe,kBACnB,OAAO,OAAO,YAAY,EAAE,EAC5B,QAAQ,UACT;CAED,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,IAAI,WAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;AAIlE,KAAI,UAAU,uBAAuB,SAAS;EAC5C,MAAM,OAAO,IAAI,KAAK,SAAS,YAAY,EAAE,EAAE,KAAK,MAAM,EAAE,KAAK,CAAC;EAClE,MAAM,UAAU,aAAa,QAAQ,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;AACxD,MAAI,QAAQ,WAAW,EACrB,SAAQ,IACN,UAAU,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,yDAC9D;MAKD,SAAQ,IACN,UAAU,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,6BAA6B,QAAQ,KAAK,KAAK,CAAC,qBAC9G;;CAIL,MAAM,aACJ,QAAQ,qBACR,OAAO,uCACP,IAAI,MAAM,EAAC,aAAa,CAAC,MAAM,GAAG,GAAG;CAEvC,MAAM,YAAY;EAChB,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB;EACA;EACD;AAED,KAAI,CAAC,UAAU;AACb,QAAM,UAAU,iBAAiB,WAAW,WAAW,OAAU,CAAC;AAClE,QAAM,MAAM,QAAQ,IAAI;AACxB,aAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;;CAMhE,IAAIC,QAA0D;CAC9D,MAAMC,SAA6B,CAAC,GAAI,SAAS,YAAY,EAAE,CAAE;AAEjE,MAAK,MAAM,QAAQ,cAAc;AAC/B,MAAI,OAAO,MAAM,MAAM,EAAE,SAAS,KAAK,CAAE;EACzC,MAAM,cAAc,wBAClB,MACA,QAAQ,WACR,QAAQ,SACR,OAAO,OAAO,IACd,IACD;AACD,MAAI,UAAU,KACZ,SAAQ,MAAM,IAAI,WAAW;EAE/B,IAAI,OAAO,MAAM,MAAM,MAAM,EAAE,SAAS,YAAY,EAAE;AACtD,MAAI,KAGF,gBAAe;GACb,MAAM;GACN,QAAQ;GACR,SAAS,GAAG,KAAK;GACjB,SAAS;GACV,CAAC;OACG;AACL,kBAAe;IACb,MAAM;IACN,QAAQ;IACR,SAAS,GAAG,KAAK;IACjB,SAAS;IACV,CAAC;AAEF,WADgB,MAAM,IAAI,SAAS,YAAY,EAChC;;AAEjB,SAAO,KAAK;GAAE;GAAM;GAAa;GAAM,CAAC;AAIxC,QAAM,UACJ,iBAAiB,WAAW,cAAc,UAAU,EAAE,UAAU,QAAQ,CAAC,CAC1E;AACD,QAAM,MAAM,QAAQ,IAAI;AACxB,aAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;;CAIhE,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,WAAW,sBACf,QACA,QACA,QACA,OACA,KACA,UACD;AAGD,KAAI,QAAQ,YAAY,SAAS,OAAO,SAAS,EAC/C,OAAM,oBAAoB,QAAQ,QAAQ,KAAK,OAAO;CAOxD,MAAM,EAAE,eAAe,YAAY,cAAc,MAAM,OAAO;CAC9D,MAAM,EAAE,MAAM,UAAU,SAAS,gBAAgB,MAAM,OAAO;CAC9D,MAAM,EAAE,sBAAsB,MAAM,OAAO;CAC3C,MAAM,EAAE,0BAA0B,MAAM,OAAO;CAE/C,IAAIC;CACJ,IAAIC;CACJ,MAAM,mBAAmB;CAGzB,MAAMC,iBAA0C;EAC9C,MAAM;EACN,MAAM,QAAQ,OAAO,SAAS,QAAQ,QAAQ,KAAK,EAAE,QAAQ,KAAK,CAAC,GAAI,QAAQ,cAAc;EAC7F,oBAAoB;EACpB,qBAAqB,QAAQ,sBAAsB,EAAE;EACtD;AAGD,KAAI,SAAS,UAAU,QAAQ;EAE7B,MAAMC,cAA6C,EAAE;EACrD,MAAMC,OAA+B,EAAE;EACvC,MAAMC,WAA0C,EAAE;AAClD,OAAK,MAAM,KAAK,SAAS,SACvB,KAAI,EAAE,SAAS,KACb,aAAY,KAAK;GAAE,SAAS,EAAE;GAAM,aAAa,EAAE;GAAI,CAAC;WAC/C,EAAE,SAAS,aACpB,MAAK,EAAE,QAAQ,EAAE;WACR,EAAE,SAAS,UACpB,UAAS,KAAK;GAAE,MAAM,EAAE;GAAM,SAAS,EAAE;GAAS,GAAI,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,GAAG,EAAE;GAAG,CAAC;AAGjH,MAAI,YAAY,OAAQ,gBAAe,eAAe;AACtD,MAAI,OAAO,KAAK,KAAK,CAAC,OAAQ,gBAAe,OAAO;AACpD,MAAI,SAAS,OAAQ,gBAAe,WAAW;;AAGjD,KAAI,QAAQ,MAAM;EAChB,MAAM,WAAW,QAAQ,QAAQ,KAAK,EAAE,QAAQ,KAAK;AACrD,cAAY,YAAY,SAAS;AACjC,iBAAe,OAAO,SAAS,SAAS;AACxC,qBAAmB,SAAS,WAAW,iBAAiB;YAC/C,QAAQ,aAAa;EAE9B,MAAM,EAAE,WAAW,MAAM,OAAO;EAChC,MAAM,SAAS,0BAA0B;EACzC,MAAM,UAAU,GAAG,wBAAwB,IAAI,GAAG,QAAQ;EAC1D,MAAM,OAAO,MAAM,IAAI,YAAY,QAAQ,QAAQ;EACnD,MAAM,MACJ,QAAQ,YAAY,MAAM,IAC1B,SAAS,QAAQ,YAAY,CAAC,QAAQ,oBAAoB,GAAG,IAC7D;AACF,cAAY,SAAS,QAAQ,EAAE,gBAAgB,KAAK,KAAK,GAAG;AAC5D,YAAU,WAAW,EAAE,WAAW,MAAM,CAAC;AACzC,gBAAc,SAAS,WAAW,IAAI,EAAE,IAAI,WAAW,KAAK,CAAC;AAC7D,iBAAe,OAAO;AACtB,qBAAmB,SAAS,WAAW,iBAAiB;OAExD,OAAM,IAAI,MAAM,qDAAqD;AAGvE,eAAc,kBAAkB,KAAK,UAAU,gBAAgB,MAAM,EAAE,CAAC;AAExE,SAAQ,IAAI,2BAA2B,WAAW,MAAM,sBAAsB,gBAAgB;CAC9F,MAAM,eAAe,kBACnB;EACE;EACA,GAAG,sBAAsB,iBAAiB;EAC1C;EACA;EACA;EACD,EACD;EACE,KAAK;EACL,OAAO;EACR,CACF;AAGD,KAAI;AACF,aAAW,iBAAiB;SACtB;AAIR,KAAI,aAAa,WAAW,EAC1B,OAAM,IAAI,MACR,qCAAqC,WAAW,SAAS,aAAa,OAAO,GAC9E;AAGH,OAAM,UACJ,iBAAiB,WAAW,SAAS,UAAU,EAAE,UAAU,QAAQ,CAAC,CACrE;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,MAAM,gBACJ,OAAO,SAAS,IACZ,WAAW,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK,KAC/C;AACN,SAAQ,IACN,sBAAsB,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,YAAY,WAAW,MAAM,sBAAsB,IAAI,cAAc,GAC/I;AAED,KAAI,QAAQ,MAAM;EAChB,MAAMR,SAAgC;GACpC,QAAQ;GACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;GAC7D,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB;GACA;GACA;GACA,QAAQ,OAAO,KAAK,OAAO;IACzB,MAAM,EAAE;IACR,aAAa,EAAE;IACf,MAAM,EAAE;IACT,EAAE;GACJ;AACD,UAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK;;;;;;;AAQvD,eAAe,oBACb,QACA,QACA,KACA,QACe;CACf,MAAM,EAAE,eAAe,YAAY,cAAc,MAAM,OAAO;CAC9D,MAAM,EAAE,iBAAS,MAAM,OAAO;CAC9B,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,EAAE,sBAAsB,MAAM,OAClC;CAEF,MAAM,EAAE,0BAA0B,MAAM,OACtC;CAEF,MAAM,EAAE,4BAA4B,MAAM,OACxC;CAGF,MAAM,gBAAgB,OAAO,OAAO,iBAAiB,EAAE;CACvD,MAAM,aAAa,wBAAwB,QAAQ,QAAQ,OAAO;CAGlE,MAAM,EAAE,qBAAqB,MAAM,OAAO;CAC1C,MAAM,UAAU,kBAAkB;AAElC,MAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;EACtC,MAAM,QAAQ,OAAO;EACrB,MAAM,UAAU,WAAW;EAC3B,MAAM,OAAO,cAAc,MAAM;AACjC,MAAI,CAAC,MAAM,eAAe;AACxB,WAAQ,IAAI,uBAAuB,MAAM,KAAK,sCAAsC;AACpF;;EAGF,MAAM,SAAS,QAAQ,SAAS,KAAK,cAAc;EACnD,MAAM,mBAAmBS,OAAK,QAAQ,YAAY,MAAM,KAAK,OAAO;EACpE,MAAM,aAAa;GACjB,MAAM,kBAAkB,MAAM;GAC9B,cAAc,CAAC;IAAE,SAAS,QAAQ;IAAM,aAAa,MAAM;IAAM,eAAe,MAAM;IAAa,gBAAgB;IAAK,CAAC;GACzH,oBAAoB,OAAO,sBAAsB;GAClD;AACD,gBAAc,kBAAkB,KAAK,UAAU,YAAY,MAAM,EAAE,CAAC;EAEpE,MAAM,cAAc;GAClB;GACA,GAAG,sBAAsB,YAAY,MAAM,KAAK,OAAO;GACvD;GACA;GACA;GACA,QAAQ;GACR;GACD;AACD,MAAI,KAAK,gBACP,aAAY,KAAK,sBAAsB,KAAK,gBAAgB;AAG9D,UAAQ,IAAI,sCAAsC,MAAM,KAAK,IAAI,MAAM,YAAY,MAAM;EACzF,MAAM,SAAS,kBAAkB,aAAa;GAC5C,KAAK;GACL,OAAO;GACR,CAAC;AACF,MAAI,OAAO,WAAW,EACpB,SAAQ,KAAK,yBAAyB,MAAM,KAAK,SAAS,OAAO,OAAO,GAAG;AAE7E,MAAI;AACF,cAAW,iBAAiB;UACtB"}
+{"version":3,"file":"provision-tenant-wGPK8MRJ.mjs","names":["result: ProvisionTenantResult","allD1: Awaited<ReturnType<typeof api.d1ListAll>> | null","shards: TenantD1ShardRef[]","workerDir: string","tempWranglerPath: string","wranglerConfig: Record<string, unknown>","d1Databases: Array<Record<string, string>>","vars: Record<string, string>","services: Array<Record<string, string>>","join"],"sources":["../src/cli/commands/provision-tenant.ts"],"sourcesContent":["import { basename, resolve } from \"path\";\nimport { loadConfig } from \"../../core/config/loader.js\";\nimport { cloudflareAccountIdFromEnv } from \"../../core/cloudflareEnv.js\";\nimport { CFApiClient } from \"../../core/api/CFApiClient.js\";\nimport { StateManager } from \"../../core/state/StateManager.js\";\nimport { stackNameForConfig } from \"../../core/state/stackName.js\";\nimport { getDispatchNamespaces } from \"../../types.js\";\nimport { effectiveDispatchNamespaceName } from \"../../features/dispatch-namespace/dispatch-namespace.resolve.js\";\nimport {\n  parseTenantShardRoles,\n  tenantDispatchScriptName,\n  tenantShardDatabaseName,\n  tenantStateKey,\n} from \"../../core/tenant/tenantKeys.js\";\nimport {\n  buildSingleModuleDispatchForm,\n  buildSingleModuleDispatchFormFromBuffer,\n} from \"../../core/wfp/buildDispatchUploadForm.js\";\nimport { resolveTenantBindings } from \"../../core/tenant/resolveTenantBindings.js\";\nimport { namingFromConfig } from \"../../core/config/namingFromConfig.js\";\nimport { tamerArtifactsBucketName, tamerArtifactsKeyPrefix } from \"../../core/state/tamerArtifactsR2.js\";\nimport { logApplyChange } from \"../../core/plan/planFormat.js\";\nimport type { TenantD1ShardRef, TenantStateEntry } from \"../../types.js\";\n\nconst now = (): string => new Date().toISOString();\n\nfunction buildTenantEntry(\n  options: {\n    product: string;\n    workspace: string;\n    dispatchNamespaceName: string;\n    scriptName: string;\n  },\n  status: TenantStateEntry[\"provisioningStatus\"],\n  existing: TenantStateEntry | undefined,\n  patch?: Partial<Pick<TenantStateEntry, \"d1Shards\">>,\n): TenantStateEntry {\n  return {\n    product: options.product,\n    workspace: options.workspace,\n    provisioningStatus: status,\n    dispatchNamespaceName: options.dispatchNamespaceName,\n    scriptName: options.scriptName,\n    d1Shards: patch?.d1Shards ?? existing?.d1Shards,\n    createdAt: existing?.createdAt ?? now(),\n    updatedAt: now(),\n  };\n}\n\n/**\n * Resolve the effective shard set for this provision call.\n *\n *   1. The configured layout (`tenant.d1Shards` in `tamer.config.ts`)\n *      is the source of truth — any role used by `--shards` must\n *      appear here, and `apply` / `drift` / other operators read the\n *      same shape.\n *   2. When `--shards a,b` is passed, trim to that subset (preserving\n *      configured order so plan/provision logs stay deterministic).\n *      Extending the layout is an edit to `tamer.config.ts`, not a\n *      CLI flag — that's why `parseTenantShardRoles` rejects roles\n *      outside the configured set.\n *   3. When the config has no `tenant.d1Shards`, the resolved set is\n *      empty: `provision-tenant` only uploads the dispatch script\n *      (truly generic single-Worker tenant case).\n */\nfunction resolveShardRoles(\n  configured: readonly string[],\n  shardsRaw: string | undefined,\n): string[] {\n  if (shardsRaw == null || shardsRaw.trim() === \"\") return [...configured];\n  return parseTenantShardRoles(shardsRaw, configured);\n}\n\n/**\n * Idempotent tenant provisioning. Each call:\n *\n *   1. Marks the tenant `pending` if there's no record yet.\n *   2. For every shard role declared in `tenant.d1Shards` in\n *      `tamer.config.ts` (or a `--shards` subset): looks up an\n *      existing D1 by derived name (`tenantShardDatabaseName(role,\n *      …)`), creating it via `d1Create` only when missing. Persists\n *      the `(role, derivedName, cfId)` triple to\n *      `state.tenants[…].d1Shards[]`.\n *   3. Marks the tenant `d1_created` once *all* requested shards\n *      exist in state.\n *   4. Uploads the dispatch script (from `--main` or `--artifact-key`)\n *      via the WFP dispatch namespace.\n *   5. Marks the tenant `ready`.\n *\n * When `tenant.d1Shards` is omitted, step 2/3 collapse to a no-op\n * (truly generic single-Worker tenant — only the dispatch script is\n * provisioned). Re-running with the same shard set is a no-op (state\n * already has those rows). Editing `tamer.config.ts` to **extend**\n * the layout (e.g. adding a new role) and re-running picks up the\n * missing shards without disturbing existing ones, so a tenant\n * created with `[\"app\"]` can be migrated to `[\"system\",\"app\",\n * \"history\"]` (or `[\"primary\",\"audit\"]`, or any other set) with one\n * config edit + one `provision-tenant` invocation. Re-running after\n * a config that **shrinks** the layout never deletes shards (use\n * `destroy-tenant` for that).\n */\n/**\n * Machine-readable result envelope emitted on the final stdout line\n * when `--json` is passed. Designed for the Cloudflare Container caller\n * (`provision-workflow`, see `docs/handoff.md` §7) so the Worker can\n * parse the result without scraping human logs. On success the Workflow\n * sees `status: \"ready\"` plus the materialized tenant shape; on\n * failure it sees `status: \"failed\"` with `error` + best-effort\n * `partial` state, and the process exits non-zero.\n */\nexport interface ProvisionTenantResult {\n  status: \"ready\" | \"failed\" | \"noop\";\n  tenantKey: string;\n  product: string;\n  workspace: string;\n  env: string;\n  scriptName: string;\n  dispatchNamespaceName: string;\n  shards: { role: string; derivedName: string; cfId: string }[];\n  error?: string;\n}\n\nexport async function runProvisionTenant(options: {\n  env: string;\n  product: string;\n  workspace: string;\n  main?: string;\n  artifactKey?: string;\n  moduleName?: string;\n  configPath?: string;\n  compatibilityDate?: string;\n  compatibilityFlags?: string[];\n  /**\n   * Raw `--shards` value (`\"system,app\"` etc.) — validated against\n   * `tenant.d1Shards` from the loaded config. Omit to provision every\n   * configured shard.\n   */\n  shardsRaw?: string;\n  json?: boolean;\n  migrate?: boolean;\n}): Promise<void> {\n  const env = options.env;\n  if (env === \"local\") {\n    throw new Error(\n      \"provision-tenant requires a non-local --env (Cloudflare-backed state).\",\n    );\n  }\n\n  try {\n    await provisionTenantInner(options);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    if (options.json) {\n      // Failure envelope: we may have died before loadConfig, so we\n      // can't ask `tenant.ephemeralEnvPattern` whether `env` would\n      // get the `-{env}` suffix. Emit the non-ephemeral form as a\n      // best-effort hint — `error` carries the real signal.\n      const result: ProvisionTenantResult = {\n        status: \"failed\",\n        tenantKey: tenantStateKey(options.product, options.workspace),\n        product: options.product,\n        workspace: options.workspace,\n        env,\n        scriptName: `${options.product}-${options.workspace}`,\n        dispatchNamespaceName: \"\",\n        shards: [],\n        error: msg,\n      };\n      process.stdout.write(JSON.stringify(result) + \"\\n\");\n    }\n    // Container caller (provision-workflow) reads exit code as\n    // primary success/failure signal; JSON envelope on stdout is\n    // secondary detail. Re-throw so the CLI surfaces the original\n    // error in human mode.\n    throw err;\n  }\n}\n\nasync function provisionTenantInner(options: {\n  env: string;\n  product: string;\n  workspace: string;\n  main?: string;\n  artifactKey?: string;\n  moduleName?: string;\n  configPath?: string;\n  compatibilityDate?: string;\n  compatibilityFlags?: string[];\n  shardsRaw?: string;\n  json?: boolean;\n  migrate?: boolean;\n}): Promise<void> {\n  const env = options.env;\n  const config = await loadConfig(options.configPath, { env });\n  const accountId = config.account_id ?? cloudflareAccountIdFromEnv();\n  if (!accountId) {\n    throw new Error(\n      \"account_id required in config or CLOUDFLARE_ACCOUNT_ID env var\",\n    );\n  }\n\n  const dns = getDispatchNamespaces(config);\n  if (dns.length === 0) {\n    throw new Error(\n      \"provision-tenant requires at least one dispatch namespace in the Tamer project config (dispatchNamespaces).\",\n    );\n  }\n  const nsConfig = dns[0]!;\n  const dispatchNamespaceName = effectiveDispatchNamespaceName(\n    nsConfig,\n    env,\n    config.tenant,\n  );\n  const scriptName = tenantDispatchScriptName(\n    options.product,\n    options.workspace,\n    env,\n    config.tenant,\n  );\n  const desiredRoles = resolveShardRoles(\n    config.tenant.d1Shards ?? [],\n    options.shardsRaw,\n  );\n\n  const api = new CFApiClient(accountId);\n  const state = new StateManager(\n    config.tenant.id,\n    env,\n    stackNameForConfig(config),\n  );\n  await state.hydrate(api);\n\n  let existing = state.getTenant(options.product, options.workspace);\n  // \"ready\" is a no-op only when the existing layout already covers\n  // every requested shard role. Adding a new role re-opens the tenant\n  // for incremental provisioning without forcing a full re-deploy.\n  if (existing?.provisioningStatus === \"ready\") {\n    const have = new Set((existing.d1Shards ?? []).map((s) => s.role));\n    const missing = desiredRoles.filter((r) => !have.has(r));\n    if (missing.length === 0) {\n      console.log(\n        `Tenant ${tenantStateKey(options.product, options.workspace)} already ready — shards up to date, redeploying script…`,\n      );\n      // Don't return — fall through to always redeploy the script.\n      // Code may have changed since the last provision.\n      // The shard creation loop below will skip existing shards.\n    } else {\n      console.log(\n        `Tenant ${tenantStateKey(options.product, options.workspace)} ready but missing shards: ${missing.join(\", \")}; extending layout.`,\n      );\n    }\n  }\n\n  const compatDate =\n    options.compatibilityDate ??\n    config.compatibility_date ??\n    new Date().toISOString().slice(0, 10);\n\n  const entryOpts = {\n    product: options.product,\n    workspace: options.workspace,\n    dispatchNamespaceName,\n    scriptName,\n  };\n\n  if (!existing) {\n    state.setTenant(buildTenantEntry(entryOpts, \"pending\", undefined));\n    await state.persist(api);\n    existing = state.getTenant(options.product, options.workspace)!;\n  }\n\n  // Reconcile each requested shard role. We list D1 once per call when\n  // we need to (some role is missing from state) and reuse the result\n  // for every subsequent role.\n  let allD1: Awaited<ReturnType<typeof api.d1ListAll>> | null = null;\n  const shards: TenantD1ShardRef[] = [...(existing.d1Shards ?? [])];\n\n  for (const role of desiredRoles) {\n    if (shards.find((s) => s.role === role)) continue;\n    const derivedName = tenantShardDatabaseName(\n      role,\n      options.workspace,\n      options.product,\n      config.tenant.id,\n      env,\n    );\n    if (allD1 === null) {\n      allD1 = await api.d1ListAll();\n    }\n    let cfId = allD1.find((d) => d.name === derivedName)?.uuid;\n    if (cfId) {\n      // Adopt an existing D1 (e.g. partial-failure resume, or\n      // operator created it out-of-band) without re-issuing POST.\n      logApplyChange({\n        kind: \"d1\",\n        action: \"no_change\",\n        logical: `${role}-shard`,\n        derived: derivedName,\n      });\n    } else {\n      logApplyChange({\n        kind: \"d1\",\n        action: \"create\",\n        logical: `${role}-shard`,\n        derived: derivedName,\n      });\n      const created = await api.d1Create(derivedName);\n      cfId = created.uuid;\n    }\n    shards.push({ role, derivedName, cfId });\n    // Persist after each shard so a network failure mid-loop leaves\n    // the already-created shards recorded — `provision-tenant` is\n    // resumable role-by-role.\n    state.setTenant(\n      buildTenantEntry(entryOpts, \"d1_created\", existing, { d1Shards: shards }),\n    );\n    await state.persist(api);\n    existing = state.getTenant(options.product, options.workspace)!;\n  }\n\n  // Resolve dispatch script bindings from shards + config.\n  const naming = namingFromConfig(config);\n  const bindings = resolveTenantBindings(\n    config,\n    shards,\n    naming,\n    state,\n    env,\n    accountId,\n  );\n\n  // Optionally run migrations on each shard before uploading the script.\n  if (options.migrate !== false && shards.length > 0) {\n    await migrateTenantShards(config, shards, env, naming);\n  }\n\n  // Deploy the tenant worker via wrangler — handles TS compilation, WASM\n  // packaging, node: polyfills, and binding resolution. We write a temporary\n  // wrangler.json with the resolved tenant bindings, then run\n  // `wrangler deploy --dispatch-namespace`.\n  const { writeFileSync, unlinkSync, mkdirSync } = await import(\"fs\");\n  const { join: joinPath, dirname: dirnamePath } = await import(\"path\");\n  const { spawnWranglerSync } = await import(\"../../core/wrangler/wranglerSpawn.js\");\n  const { wranglerConfigCliArgs } = await import(\"../../core/wrangler/wranglerOutFile.js\");\n\n  let workerDir: string;\n  let tempWranglerPath: string;\n  const tempWranglerFile = \"wrangler.tenant.json\";\n\n  // Build the temporary wrangler config for the tenant dispatch script\n  const wranglerConfig: Record<string, unknown> = {\n    name: scriptName,\n    main: options.main ? basename(resolve(process.cwd(), options.main)) : (options.moduleName ?? \"worker.js\"),\n    compatibility_date: compatDate,\n    compatibility_flags: options.compatibilityFlags ?? [],\n  };\n\n  // Add resolved bindings to wrangler config\n  if (bindings.bindings?.length) {\n    // Convert unified bindings format to wrangler config format\n    const d1Databases: Array<Record<string, string>> = [];\n    const vars: Record<string, string> = {};\n    const services: Array<Record<string, string>> = [];\n    for (const b of bindings.bindings) {\n      if (b.type === \"d1\") {\n        d1Databases.push({ binding: b.name, database_id: b.id });\n      } else if (b.type === \"plain_text\") {\n        vars[b.name] = b.text;\n      } else if (b.type === \"service\") {\n        services.push({ name: b.name, service: b.service, ...(b.environment ? { environment: b.environment } : {}) });\n      }\n    }\n    if (d1Databases.length) wranglerConfig.d1_databases = d1Databases;\n    if (Object.keys(vars).length) wranglerConfig.vars = vars;\n    if (services.length) wranglerConfig.services = services;\n  }\n\n  if (options.main) {\n    const mainPath = resolve(process.cwd(), options.main);\n    workerDir = dirnamePath(mainPath);\n    wranglerConfig.main = basename(mainPath);\n    tempWranglerPath = joinPath(workerDir, tempWranglerFile);\n  } else if (options.artifactKey) {\n    // Download pre-built bundle from R2 to a temp directory\n    const { tmpdir } = await import(\"os\");\n    const bucket = tamerArtifactsBucketName();\n    const fullKey = `${tamerArtifactsKeyPrefix(env)}${options.artifactKey}`;\n    const body = await api.r2GetObject(bucket, fullKey);\n    const mod =\n      options.moduleName?.trim() ||\n      basename(options.artifactKey).replace(/\\.(zip|tar|gz)$/i, \"\") ||\n      \"worker.js\";\n    workerDir = joinPath(tmpdir(), `tamer-tenant-${Date.now()}`);\n    mkdirSync(workerDir, { recursive: true });\n    writeFileSync(joinPath(workerDir, mod), new Uint8Array(body));\n    wranglerConfig.main = mod;\n    tempWranglerPath = joinPath(workerDir, tempWranglerFile);\n  } else {\n    throw new Error(\"provision-tenant: provide --main or --artifact-key\");\n  }\n\n  writeFileSync(tempWranglerPath, JSON.stringify(wranglerConfig, null, 2));\n\n  console.log(`Deploying tenant script ${scriptName} to ${dispatchNamespaceName} via wrangler…`);\n  const deployResult = spawnWranglerSync(\n    [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(tempWranglerFile),\n      \"deploy\",\n      \"--dispatch-namespace\",\n      dispatchNamespaceName,\n    ],\n    {\n      cwd: workerDir,\n      stdio: \"inherit\",\n    },\n  );\n\n  // Clean up temp config\n  try {\n    unlinkSync(tempWranglerPath);\n  } catch {\n    /* best-effort */\n  }\n\n  if (deployResult.status !== 0) {\n    throw new Error(\n      `wrangler deploy failed for tenant ${scriptName} (exit ${deployResult.status})`,\n    );\n  }\n\n  // Push dispatch secrets from the vault (dispatchSecrets on TenantMeta).\n  const dispatchSecretNames = config.tenant.dispatchSecrets ?? [];\n  if (dispatchSecretNames.length > 0) {\n    const { ensureTamerSecretsDatabase } = await import(\"../../core/secrets/secretsDb.js\");\n    const { SecretsVault } = await import(\"../../core/secrets/SecretsVault.js\");\n    const { readMasterKeyFromEnv } = await import(\"../../core/secrets/masterKey.js\");\n    const { decryptSecretValue } = await import(\"../../core/secrets/crypto.js\");\n\n    const secretsUuid = await ensureTamerSecretsDatabase(api);\n    const vault = new SecretsVault(api, env, secretsUuid);\n    const masterKey = readMasterKeyFromEnv(env);\n    if (!masterKey) {\n      throw new Error(\n        `dispatchSecrets: master key not found. Set TAMER_SECRETS_KEY_${env} in the environment.`,\n      );\n    }\n\n    console.log(`Pushing ${dispatchSecretNames.length} dispatch secret(s) to ${scriptName}…`);\n    for (const secretName of dispatchSecretNames) {\n      const record = await vault.get(secretName);\n      if (!record) {\n        throw new Error(\n          `dispatchSecrets: secret \"${secretName}\" not found in vault for env ${env}. ` +\n            `Run: tamer secrets set ${secretName} --env ${env}`,\n        );\n      }\n      const plaintext = await decryptSecretValue(record, masterKey);\n      await api.dispatchNamespaceScriptSecretPut(\n        dispatchNamespaceName,\n        scriptName,\n        { name: secretName, text: plaintext },\n      );\n      console.log(`  ✓ ${secretName} → ${scriptName}`);\n    }\n  }\n\n  state.setTenant(\n    buildTenantEntry(entryOpts, \"ready\", existing, { d1Shards: shards }),\n  );\n  await state.persist(api);\n\n  const shardsSummary =\n    shards.length > 0\n      ? `shards: ${shards.map((s) => s.role).join(\", \")}`\n      : \"no shards declared\";\n  console.log(\n    `Provisioned tenant ${tenantStateKey(options.product, options.workspace)} → script ${scriptName} in ${dispatchNamespaceName} (${shardsSummary})`,\n  );\n\n  if (options.json) {\n    const result: ProvisionTenantResult = {\n      status: \"ready\",\n      tenantKey: tenantStateKey(options.product, options.workspace),\n      product: options.product,\n      workspace: options.workspace,\n      env,\n      scriptName,\n      dispatchNamespaceName,\n      shards: shards.map((s) => ({\n        role: s.role,\n        derivedName: s.derivedName,\n        cfId: s.cfId,\n      })),\n    };\n    process.stdout.write(JSON.stringify(result) + \"\\n\");\n  }\n}\n\n/**\n * Run D1 migrations on each tenant shard by writing a temporary wrangler.json\n * with the shard binding and invoking `wrangler d1 migrations apply`.\n */\nasync function migrateTenantShards(\n  config: import(\"../../types.js\").CfiConfig,\n  shards: TenantD1ShardRef[],\n  env: string,\n  naming: import(\"../../core/naming/NamingEngine.js\").NamingEngine,\n): Promise<void> {\n  const { writeFileSync, unlinkSync, mkdirSync } = await import(\"fs\");\n  const { join } = await import(\"path\");\n  const { tmpdir } = await import(\"os\");\n  const { spawnWranglerSync } = await import(\n    \"../../core/wrangler/wranglerSpawn.js\"\n  );\n  const { wranglerConfigCliArgs } = await import(\n    \"../../core/wrangler/wranglerOutFile.js\"\n  );\n  const { resolveTenantD1Bindings } = await import(\n    \"../../core/tenant/resolveTenantBindings.js\"\n  );\n\n  const shardBindings = config.tenant.shardBindings ?? {};\n  const d1Bindings = resolveTenantD1Bindings(config, shards, naming);\n\n  // Resolve base dir for relative migrationsDir paths\n  const { getConfigBaseDir } = await import(\"../../core/config/loader.js\");\n  const baseDir = getConfigBaseDir();\n\n  for (let i = 0; i < shards.length; i++) {\n    const shard = shards[i]!;\n    const binding = d1Bindings[i]!;\n    const info = shardBindings[shard.role];\n    if (!info?.migrationsDir) {\n      console.log(`  migrate: skipping ${shard.role} (no migrationsDir in shardBindings)`);\n      continue;\n    }\n\n    const migDir = resolve(baseDir, info.migrationsDir);\n    const tempWranglerPath = join(migDir, `wrangler.${shard.role}.json`);\n    const tempConfig = {\n      name: `tenant-migrate-${shard.role}`,\n      d1_databases: [{ binding: binding.name, database_id: shard.cfId, database_name: shard.derivedName, migrations_dir: \".\" }],\n      compatibility_date: config.compatibility_date ?? \"2024-01-01\",\n    };\n    writeFileSync(tempWranglerPath, JSON.stringify(tempConfig, null, 2));\n\n    const migrateArgs = [\n      \"wrangler\",\n      ...wranglerConfigCliArgs(`wrangler.${shard.role}.json`),\n      \"d1\",\n      \"migrations\",\n      \"apply\",\n      binding.name,\n      \"--remote\",\n    ];\n    if (info.migrationsTable) {\n      migrateArgs.push(\"--migrations-table\", info.migrationsTable);\n    }\n\n    console.log(`  migrate: applying migrations for ${shard.role} (${shard.derivedName})...`);\n    const result = spawnWranglerSync(migrateArgs, {\n      cwd: migDir,\n      stdio: \"inherit\",\n    });\n    if (result.status !== 0) {\n      console.warn(`  migrate: failed for ${shard.role} (exit ${result.status})`);\n    }\n    try {\n      unlinkSync(tempWranglerPath);\n    } catch {\n      /* best-effort cleanup */\n    }\n  }\n}\n"],"mappings":";;;;;;;;;AAwBA,MAAM,6BAAoB,IAAI,MAAM,EAAC,aAAa;AAElD,SAAS,iBACP,SAMA,QACA,UACA,OACkB;AAClB,QAAO;EACL,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB,oBAAoB;EACpB,uBAAuB,QAAQ;EAC/B,YAAY,QAAQ;EACpB,UAAU,OAAO,YAAY,UAAU;EACvC,WAAW,UAAU,aAAa,KAAK;EACvC,WAAW,KAAK;EACjB;;;;;;;;;;;;;;;;;;AAmBH,SAAS,kBACP,YACA,WACU;AACV,KAAI,aAAa,QAAQ,UAAU,MAAM,KAAK,GAAI,QAAO,CAAC,GAAG,WAAW;AACxE,QAAO,sBAAsB,WAAW,WAAW;;AAoDrD,eAAsB,mBAAmB,SAkBvB;CAChB,MAAM,MAAM,QAAQ;AACpB,KAAI,QAAQ,QACV,OAAM,IAAI,MACR,yEACD;AAGH,KAAI;AACF,QAAM,qBAAqB,QAAQ;UAC5B,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,MAAI,QAAQ,MAAM;GAKhB,MAAMA,SAAgC;IACpC,QAAQ;IACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;IAC7D,SAAS,QAAQ;IACjB,WAAW,QAAQ;IACnB;IACA,YAAY,GAAG,QAAQ,QAAQ,GAAG,QAAQ;IAC1C,uBAAuB;IACvB,QAAQ,EAAE;IACV,OAAO;IACR;AACD,WAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK;;AAMrD,QAAM;;;AAIV,eAAe,qBAAqB,SAalB;CAChB,MAAM,MAAM,QAAQ;CACpB,MAAM,SAAS,MAAM,WAAW,QAAQ,YAAY,EAAE,KAAK,CAAC;CAC5D,MAAM,YAAY,OAAO,cAAc,4BAA4B;AACnE,KAAI,CAAC,UACH,OAAM,IAAI,MACR,iEACD;CAGH,MAAM,MAAM,sBAAsB,OAAO;AACzC,KAAI,IAAI,WAAW,EACjB,OAAM,IAAI,MACR,8GACD;CAEH,MAAM,WAAW,IAAI;CACrB,MAAM,wBAAwB,+BAC5B,UACA,KACA,OAAO,OACR;CACD,MAAM,aAAa,yBACjB,QAAQ,SACR,QAAQ,WACR,KACA,OAAO,OACR;CACD,MAAM,eAAe,kBACnB,OAAO,OAAO,YAAY,EAAE,EAC5B,QAAQ,UACT;CAED,MAAM,MAAM,IAAI,YAAY,UAAU;CACtC,MAAM,QAAQ,IAAI,aAChB,OAAO,OAAO,IACd,KACA,mBAAmB,OAAO,CAC3B;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,IAAI,WAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;AAIlE,KAAI,UAAU,uBAAuB,SAAS;EAC5C,MAAM,OAAO,IAAI,KAAK,SAAS,YAAY,EAAE,EAAE,KAAK,MAAM,EAAE,KAAK,CAAC;EAClE,MAAM,UAAU,aAAa,QAAQ,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;AACxD,MAAI,QAAQ,WAAW,EACrB,SAAQ,IACN,UAAU,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,yDAC9D;MAKD,SAAQ,IACN,UAAU,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,6BAA6B,QAAQ,KAAK,KAAK,CAAC,qBAC9G;;CAIL,MAAM,aACJ,QAAQ,qBACR,OAAO,uCACP,IAAI,MAAM,EAAC,aAAa,CAAC,MAAM,GAAG,GAAG;CAEvC,MAAM,YAAY;EAChB,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB;EACA;EACD;AAED,KAAI,CAAC,UAAU;AACb,QAAM,UAAU,iBAAiB,WAAW,WAAW,OAAU,CAAC;AAClE,QAAM,MAAM,QAAQ,IAAI;AACxB,aAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;;CAMhE,IAAIC,QAA0D;CAC9D,MAAMC,SAA6B,CAAC,GAAI,SAAS,YAAY,EAAE,CAAE;AAEjE,MAAK,MAAM,QAAQ,cAAc;AAC/B,MAAI,OAAO,MAAM,MAAM,EAAE,SAAS,KAAK,CAAE;EACzC,MAAM,cAAc,wBAClB,MACA,QAAQ,WACR,QAAQ,SACR,OAAO,OAAO,IACd,IACD;AACD,MAAI,UAAU,KACZ,SAAQ,MAAM,IAAI,WAAW;EAE/B,IAAI,OAAO,MAAM,MAAM,MAAM,EAAE,SAAS,YAAY,EAAE;AACtD,MAAI,KAGF,gBAAe;GACb,MAAM;GACN,QAAQ;GACR,SAAS,GAAG,KAAK;GACjB,SAAS;GACV,CAAC;OACG;AACL,kBAAe;IACb,MAAM;IACN,QAAQ;IACR,SAAS,GAAG,KAAK;IACjB,SAAS;IACV,CAAC;AAEF,WADgB,MAAM,IAAI,SAAS,YAAY,EAChC;;AAEjB,SAAO,KAAK;GAAE;GAAM;GAAa;GAAM,CAAC;AAIxC,QAAM,UACJ,iBAAiB,WAAW,cAAc,UAAU,EAAE,UAAU,QAAQ,CAAC,CAC1E;AACD,QAAM,MAAM,QAAQ,IAAI;AACxB,aAAW,MAAM,UAAU,QAAQ,SAAS,QAAQ,UAAU;;CAIhE,MAAM,SAAS,iBAAiB,OAAO;CACvC,MAAM,WAAW,sBACf,QACA,QACA,QACA,OACA,KACA,UACD;AAGD,KAAI,QAAQ,YAAY,SAAS,OAAO,SAAS,EAC/C,OAAM,oBAAoB,QAAQ,QAAQ,KAAK,OAAO;CAOxD,MAAM,EAAE,eAAe,YAAY,cAAc,MAAM,OAAO;CAC9D,MAAM,EAAE,MAAM,UAAU,SAAS,gBAAgB,MAAM,OAAO;CAC9D,MAAM,EAAE,sBAAsB,MAAM,OAAO;CAC3C,MAAM,EAAE,0BAA0B,MAAM,OAAO;CAE/C,IAAIC;CACJ,IAAIC;CACJ,MAAM,mBAAmB;CAGzB,MAAMC,iBAA0C;EAC9C,MAAM;EACN,MAAM,QAAQ,OAAO,SAAS,QAAQ,QAAQ,KAAK,EAAE,QAAQ,KAAK,CAAC,GAAI,QAAQ,cAAc;EAC7F,oBAAoB;EACpB,qBAAqB,QAAQ,sBAAsB,EAAE;EACtD;AAGD,KAAI,SAAS,UAAU,QAAQ;EAE7B,MAAMC,cAA6C,EAAE;EACrD,MAAMC,OAA+B,EAAE;EACvC,MAAMC,WAA0C,EAAE;AAClD,OAAK,MAAM,KAAK,SAAS,SACvB,KAAI,EAAE,SAAS,KACb,aAAY,KAAK;GAAE,SAAS,EAAE;GAAM,aAAa,EAAE;GAAI,CAAC;WAC/C,EAAE,SAAS,aACpB,MAAK,EAAE,QAAQ,EAAE;WACR,EAAE,SAAS,UACpB,UAAS,KAAK;GAAE,MAAM,EAAE;GAAM,SAAS,EAAE;GAAS,GAAI,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,GAAG,EAAE;GAAG,CAAC;AAGjH,MAAI,YAAY,OAAQ,gBAAe,eAAe;AACtD,MAAI,OAAO,KAAK,KAAK,CAAC,OAAQ,gBAAe,OAAO;AACpD,MAAI,SAAS,OAAQ,gBAAe,WAAW;;AAGjD,KAAI,QAAQ,MAAM;EAChB,MAAM,WAAW,QAAQ,QAAQ,KAAK,EAAE,QAAQ,KAAK;AACrD,cAAY,YAAY,SAAS;AACjC,iBAAe,OAAO,SAAS,SAAS;AACxC,qBAAmB,SAAS,WAAW,iBAAiB;YAC/C,QAAQ,aAAa;EAE9B,MAAM,EAAE,WAAW,MAAM,OAAO;EAChC,MAAM,SAAS,0BAA0B;EACzC,MAAM,UAAU,GAAG,wBAAwB,IAAI,GAAG,QAAQ;EAC1D,MAAM,OAAO,MAAM,IAAI,YAAY,QAAQ,QAAQ;EACnD,MAAM,MACJ,QAAQ,YAAY,MAAM,IAC1B,SAAS,QAAQ,YAAY,CAAC,QAAQ,oBAAoB,GAAG,IAC7D;AACF,cAAY,SAAS,QAAQ,EAAE,gBAAgB,KAAK,KAAK,GAAG;AAC5D,YAAU,WAAW,EAAE,WAAW,MAAM,CAAC;AACzC,gBAAc,SAAS,WAAW,IAAI,EAAE,IAAI,WAAW,KAAK,CAAC;AAC7D,iBAAe,OAAO;AACtB,qBAAmB,SAAS,WAAW,iBAAiB;OAExD,OAAM,IAAI,MAAM,qDAAqD;AAGvE,eAAc,kBAAkB,KAAK,UAAU,gBAAgB,MAAM,EAAE,CAAC;AAExE,SAAQ,IAAI,2BAA2B,WAAW,MAAM,sBAAsB,gBAAgB;CAC9F,MAAM,eAAe,kBACnB;EACE;EACA,GAAG,sBAAsB,iBAAiB;EAC1C;EACA;EACA;EACD,EACD;EACE,KAAK;EACL,OAAO;EACR,CACF;AAGD,KAAI;AACF,aAAW,iBAAiB;SACtB;AAIR,KAAI,aAAa,WAAW,EAC1B,OAAM,IAAI,MACR,qCAAqC,WAAW,SAAS,aAAa,OAAO,GAC9E;CAIH,MAAM,sBAAsB,OAAO,OAAO,mBAAmB,EAAE;AAC/D,KAAI,oBAAoB,SAAS,GAAG;EAClC,MAAM,EAAE,+BAA+B,MAAM,OAAO;EACpD,MAAM,EAAE,iBAAiB,MAAM,OAAO;EACtC,MAAM,EAAE,yBAAyB,MAAM,OAAO;EAC9C,MAAM,EAAE,uBAAuB,MAAM,OAAO;EAG5C,MAAM,QAAQ,IAAI,aAAa,KAAK,KADhB,MAAM,2BAA2B,IAAI,CACJ;EACrD,MAAM,YAAY,qBAAqB,IAAI;AAC3C,MAAI,CAAC,UACH,OAAM,IAAI,MACR,gEAAgE,IAAI,sBACrE;AAGH,UAAQ,IAAI,WAAW,oBAAoB,OAAO,yBAAyB,WAAW,GAAG;AACzF,OAAK,MAAM,cAAc,qBAAqB;GAC5C,MAAM,SAAS,MAAM,MAAM,IAAI,WAAW;AAC1C,OAAI,CAAC,OACH,OAAM,IAAI,MACR,4BAA4B,WAAW,+BAA+B,IAAI,2BAC9C,WAAW,SAAS,MACjD;GAEH,MAAM,YAAY,MAAM,mBAAmB,QAAQ,UAAU;AAC7D,SAAM,IAAI,iCACR,uBACA,YACA;IAAE,MAAM;IAAY,MAAM;IAAW,CACtC;AACD,WAAQ,IAAI,OAAO,WAAW,KAAK,aAAa;;;AAIpD,OAAM,UACJ,iBAAiB,WAAW,SAAS,UAAU,EAAE,UAAU,QAAQ,CAAC,CACrE;AACD,OAAM,MAAM,QAAQ,IAAI;CAExB,MAAM,gBACJ,OAAO,SAAS,IACZ,WAAW,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK,KAC/C;AACN,SAAQ,IACN,sBAAsB,eAAe,QAAQ,SAAS,QAAQ,UAAU,CAAC,YAAY,WAAW,MAAM,sBAAsB,IAAI,cAAc,GAC/I;AAED,KAAI,QAAQ,MAAM;EAChB,MAAMR,SAAgC;GACpC,QAAQ;GACR,WAAW,eAAe,QAAQ,SAAS,QAAQ,UAAU;GAC7D,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB;GACA;GACA;GACA,QAAQ,OAAO,KAAK,OAAO;IACzB,MAAM,EAAE;IACR,aAAa,EAAE;IACf,MAAM,EAAE;IACT,EAAE;GACJ;AACD,UAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,GAAG,KAAK;;;;;;;AAQvD,eAAe,oBACb,QACA,QACA,KACA,QACe;CACf,MAAM,EAAE,eAAe,YAAY,cAAc,MAAM,OAAO;CAC9D,MAAM,EAAE,iBAAS,MAAM,OAAO;CAC9B,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,EAAE,sBAAsB,MAAM,OAClC;CAEF,MAAM,EAAE,0BAA0B,MAAM,OACtC;CAEF,MAAM,EAAE,4BAA4B,MAAM,OACxC;CAGF,MAAM,gBAAgB,OAAO,OAAO,iBAAiB,EAAE;CACvD,MAAM,aAAa,wBAAwB,QAAQ,QAAQ,OAAO;CAGlE,MAAM,EAAE,qBAAqB,MAAM,OAAO;CAC1C,MAAM,UAAU,kBAAkB;AAElC,MAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;EACtC,MAAM,QAAQ,OAAO;EACrB,MAAM,UAAU,WAAW;EAC3B,MAAM,OAAO,cAAc,MAAM;AACjC,MAAI,CAAC,MAAM,eAAe;AACxB,WAAQ,IAAI,uBAAuB,MAAM,KAAK,sCAAsC;AACpF;;EAGF,MAAM,SAAS,QAAQ,SAAS,KAAK,cAAc;EACnD,MAAM,mBAAmBS,OAAK,QAAQ,YAAY,MAAM,KAAK,OAAO;EACpE,MAAM,aAAa;GACjB,MAAM,kBAAkB,MAAM;GAC9B,cAAc,CAAC;IAAE,SAAS,QAAQ;IAAM,aAAa,MAAM;IAAM,eAAe,MAAM;IAAa,gBAAgB;IAAK,CAAC;GACzH,oBAAoB,OAAO,sBAAsB;GAClD;AACD,gBAAc,kBAAkB,KAAK,UAAU,YAAY,MAAM,EAAE,CAAC;EAEpE,MAAM,cAAc;GAClB;GACA,GAAG,sBAAsB,YAAY,MAAM,KAAK,OAAO;GACvD;GACA;GACA;GACA,QAAQ;GACR;GACD;AACD,MAAI,KAAK,gBACP,aAAY,KAAK,sBAAsB,KAAK,gBAAgB;AAG9D,UAAQ,IAAI,sCAAsC,MAAM,KAAK,IAAI,MAAM,YAAY,MAAM;EACzF,MAAM,SAAS,kBAAkB,aAAa;GAC5C,KAAK;GACL,OAAO;GACR,CAAC;AACF,MAAI,OAAO,WAAW,EACpB,SAAQ,KAAK,yBAAyB,MAAM,KAAK,SAAS,OAAO,OAAO,GAAG;AAE7E,MAAI;AACF,cAAW,iBAAiB;UACtB"}

package/dist/{r2S3EmptyBucket-DD81ZWQ7.mjs → r2S3EmptyBucket-OKIQdlms.mjs}

@@ -89,4 +89,4 @@ async function emptyR2BucketViaS3(accountId, bucketName, creds) {
 
 //#endregion
 export { r2S3CredentialsFromEnv as n, emptyR2BucketViaS3 as t };
-//# sourceMappingURL=r2S3EmptyBucket-DD81ZWQ7.mjs.map
+//# sourceMappingURL=r2S3EmptyBucket-OKIQdlms.mjs.map

package/dist/{r2S3EmptyBucket-DD81ZWQ7.mjs.map → r2S3EmptyBucket-OKIQdlms.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"r2S3EmptyBucket-DD81ZWQ7.mjs","names":["keyMarker: string | undefined","uploadIdMarker: string | undefined","continuationToken: string | undefined"],"sources":["../src/features/r2/r2S3EmptyBucket.ts"],"sourcesContent":["/**\n * Empty an R2 bucket using the S3-compatible API (list/delete objects, abort\n * incomplete multipart uploads). The Cloudflare v4 \"delete bucket\" call fails\n * while any objects or in-flight MPU remain.\n *\n * Uses {@link https://developers.cloudflare.com/r2/api/s3/tokens/ | R2 S3 API tokens}:\n * set **R2_ACCESS_KEY_ID** and **R2_SECRET_ACCESS_KEY** (not CLOUDFLARE_API_TOKEN).\n */\nimport {\n  S3Client,\n  ListObjectsV2Command,\n  DeleteObjectsCommand,\n  ListMultipartUploadsCommand,\n  AbortMultipartUploadCommand,\n} from \"@aws-sdk/client-s3\";\n\nconst DELETE_BATCH = 1000;\n\nexport function r2S3CredentialsFromEnv():\n  | { accessKeyId: string; secretAccessKey: string }\n  | undefined {\n  const accessKeyId = process.env.R2_ACCESS_KEY_ID?.trim();\n  const secretAccessKey = process.env.R2_SECRET_ACCESS_KEY?.trim();\n  if (!accessKeyId || !secretAccessKey) return undefined;\n  return { accessKeyId, secretAccessKey };\n}\n\nfunction s3ForR2(\n  accountId: string,\n  creds: { accessKeyId: string; secretAccessKey: string },\n): S3Client {\n  return new S3Client({\n    region: \"auto\",\n    endpoint: `https://${accountId}.r2.cloudflarestorage.com`,\n    credentials: creds,\n  });\n}\n\n/**\n * Aborts all incomplete multipart uploads, then deletes all object keys\n * (batched). Idempotent for an already-empty bucket.\n */\nexport async function emptyR2BucketViaS3(\n  accountId: string,\n  bucketName: string,\n  creds: { accessKeyId: string; secretAccessKey: string },\n): Promise<{ uploadsAborted: number; objectsDeleted: number }> {\n  const s3 = s3ForR2(accountId, creds);\n  let uploadsAborted = 0;\n  let keyMarker: string | undefined;\n  let uploadIdMarker: string | undefined;\n\n  for (;;) {\n    const mpu = await s3.send(\n      new ListMultipartUploadsCommand({\n        Bucket: bucketName,\n        KeyMarker: keyMarker,\n        UploadIdMarker: uploadIdMarker,\n      }),\n    );\n    for (const u of mpu.Uploads ?? []) {\n      if (u.Key == null || u.UploadId == null) continue;\n      await s3.send(\n        new AbortMultipartUploadCommand({\n          Bucket: bucketName,\n          Key: u.Key,\n          UploadId: u.UploadId,\n        }),\n      );\n      uploadsAborted += 1;\n    }\n    if (!mpu.IsTruncated) break;\n    keyMarker = mpu.NextKeyMarker;\n    uploadIdMarker = mpu.NextUploadIdMarker;\n  }\n\n  let objectsDeleted = 0;\n  let continuationToken: string | undefined;\n\n  for (;;) {\n    const listed = await s3.send(\n      new ListObjectsV2Command({\n        Bucket: bucketName,\n        ContinuationToken: continuationToken,\n        MaxKeys: DELETE_BATCH,\n      }),\n    );\n    const keys = (listed.Contents ?? [])\n      .map((o) => o.Key)\n      .filter((k): k is string => Boolean(k));\n    if (keys.length > 0) {\n      const del = await s3.send(\n        new DeleteObjectsCommand({\n          Bucket: bucketName,\n          Delete: { Objects: keys.map((Key) => ({ Key })), Quiet: true },\n        }),\n      );\n      const errs = del.Errors ?? [];\n      if (errs.length > 0) {\n        const first = errs[0];\n        throw new Error(\n          `S3 DeleteObjects: ${first.Key ?? \"?\"} — ${first.Code ?? \"\"} ${first.Message ?? \"\"}`.trim(),\n        );\n      }\n      objectsDeleted += del.Deleted?.length ?? keys.length;\n    }\n    if (!listed.IsTruncated) break;\n    continuationToken = listed.NextContinuationToken;\n  }\n\n  return { uploadsAborted, objectsDeleted };\n}\n"],"mappings":";;;;;;;;;;;AAgBA,MAAM,eAAe;AAErB,SAAgB,yBAEF;CACZ,MAAM,cAAc,QAAQ,IAAI,kBAAkB,MAAM;CACxD,MAAM,kBAAkB,QAAQ,IAAI,sBAAsB,MAAM;AAChE,KAAI,CAAC,eAAe,CAAC,gBAAiB,QAAO;AAC7C,QAAO;EAAE;EAAa;EAAiB;;AAGzC,SAAS,QACP,WACA,OACU;AACV,QAAO,IAAI,SAAS;EAClB,QAAQ;EACR,UAAU,WAAW,UAAU;EAC/B,aAAa;EACd,CAAC;;;;;;AAOJ,eAAsB,mBACpB,WACA,YACA,OAC6D;CAC7D,MAAM,KAAK,QAAQ,WAAW,MAAM;CACpC,IAAI,iBAAiB;CACrB,IAAIA;CACJ,IAAIC;AAEJ,UAAS;EACP,MAAM,MAAM,MAAM,GAAG,KACnB,IAAI,4BAA4B;GAC9B,QAAQ;GACR,WAAW;GACX,gBAAgB;GACjB,CAAC,CACH;AACD,OAAK,MAAM,KAAK,IAAI,WAAW,EAAE,EAAE;AACjC,OAAI,EAAE,OAAO,QAAQ,EAAE,YAAY,KAAM;AACzC,SAAM,GAAG,KACP,IAAI,4BAA4B;IAC9B,QAAQ;IACR,KAAK,EAAE;IACP,UAAU,EAAE;IACb,CAAC,CACH;AACD,qBAAkB;;AAEpB,MAAI,CAAC,IAAI,YAAa;AACtB,cAAY,IAAI;AAChB,mBAAiB,IAAI;;CAGvB,IAAI,iBAAiB;CACrB,IAAIC;AAEJ,UAAS;EACP,MAAM,SAAS,MAAM,GAAG,KACtB,IAAI,qBAAqB;GACvB,QAAQ;GACR,mBAAmB;GACnB,SAAS;GACV,CAAC,CACH;EACD,MAAM,QAAQ,OAAO,YAAY,EAAE,EAChC,KAAK,MAAM,EAAE,IAAI,CACjB,QAAQ,MAAmB,QAAQ,EAAE,CAAC;AACzC,MAAI,KAAK,SAAS,GAAG;GACnB,MAAM,MAAM,MAAM,GAAG,KACnB,IAAI,qBAAqB;IACvB,QAAQ;IACR,QAAQ;KAAE,SAAS,KAAK,KAAK,SAAS,EAAE,KAAK,EAAE;KAAE,OAAO;KAAM;IAC/D,CAAC,CACH;GACD,MAAM,OAAO,IAAI,UAAU,EAAE;AAC7B,OAAI,KAAK,SAAS,GAAG;IACnB,MAAM,QAAQ,KAAK;AACnB,UAAM,IAAI,MACR,qBAAqB,MAAM,OAAO,IAAI,KAAK,MAAM,QAAQ,GAAG,GAAG,MAAM,WAAW,KAAK,MAAM,CAC5F;;AAEH,qBAAkB,IAAI,SAAS,UAAU,KAAK;;AAEhD,MAAI,CAAC,OAAO,YAAa;AACzB,sBAAoB,OAAO;;AAG7B,QAAO;EAAE;EAAgB;EAAgB"}
+{"version":3,"file":"r2S3EmptyBucket-OKIQdlms.mjs","names":["keyMarker: string | undefined","uploadIdMarker: string | undefined","continuationToken: string | undefined"],"sources":["../src/features/r2/r2S3EmptyBucket.ts"],"sourcesContent":["/**\n * Empty an R2 bucket using the S3-compatible API (list/delete objects, abort\n * incomplete multipart uploads). The Cloudflare v4 \"delete bucket\" call fails\n * while any objects or in-flight MPU remain.\n *\n * Uses {@link https://developers.cloudflare.com/r2/api/s3/tokens/ | R2 S3 API tokens}:\n * set **R2_ACCESS_KEY_ID** and **R2_SECRET_ACCESS_KEY** (not CLOUDFLARE_API_TOKEN).\n */\nimport {\n  S3Client,\n  ListObjectsV2Command,\n  DeleteObjectsCommand,\n  ListMultipartUploadsCommand,\n  AbortMultipartUploadCommand,\n} from \"@aws-sdk/client-s3\";\n\nconst DELETE_BATCH = 1000;\n\nexport function r2S3CredentialsFromEnv():\n  | { accessKeyId: string; secretAccessKey: string }\n  | undefined {\n  const accessKeyId = process.env.R2_ACCESS_KEY_ID?.trim();\n  const secretAccessKey = process.env.R2_SECRET_ACCESS_KEY?.trim();\n  if (!accessKeyId || !secretAccessKey) return undefined;\n  return { accessKeyId, secretAccessKey };\n}\n\nfunction s3ForR2(\n  accountId: string,\n  creds: { accessKeyId: string; secretAccessKey: string },\n): S3Client {\n  return new S3Client({\n    region: \"auto\",\n    endpoint: `https://${accountId}.r2.cloudflarestorage.com`,\n    credentials: creds,\n  });\n}\n\n/**\n * Aborts all incomplete multipart uploads, then deletes all object keys\n * (batched). Idempotent for an already-empty bucket.\n */\nexport async function emptyR2BucketViaS3(\n  accountId: string,\n  bucketName: string,\n  creds: { accessKeyId: string; secretAccessKey: string },\n): Promise<{ uploadsAborted: number; objectsDeleted: number }> {\n  const s3 = s3ForR2(accountId, creds);\n  let uploadsAborted = 0;\n  let keyMarker: string | undefined;\n  let uploadIdMarker: string | undefined;\n\n  for (;;) {\n    const mpu = await s3.send(\n      new ListMultipartUploadsCommand({\n        Bucket: bucketName,\n        KeyMarker: keyMarker,\n        UploadIdMarker: uploadIdMarker,\n      }),\n    );\n    for (const u of mpu.Uploads ?? []) {\n      if (u.Key == null || u.UploadId == null) continue;\n      await s3.send(\n        new AbortMultipartUploadCommand({\n          Bucket: bucketName,\n          Key: u.Key,\n          UploadId: u.UploadId,\n        }),\n      );\n      uploadsAborted += 1;\n    }\n    if (!mpu.IsTruncated) break;\n    keyMarker = mpu.NextKeyMarker;\n    uploadIdMarker = mpu.NextUploadIdMarker;\n  }\n\n  let objectsDeleted = 0;\n  let continuationToken: string | undefined;\n\n  for (;;) {\n    const listed = await s3.send(\n      new ListObjectsV2Command({\n        Bucket: bucketName,\n        ContinuationToken: continuationToken,\n        MaxKeys: DELETE_BATCH,\n      }),\n    );\n    const keys = (listed.Contents ?? [])\n      .map((o) => o.Key)\n      .filter((k): k is string => Boolean(k));\n    if (keys.length > 0) {\n      const del = await s3.send(\n        new DeleteObjectsCommand({\n          Bucket: bucketName,\n          Delete: { Objects: keys.map((Key) => ({ Key })), Quiet: true },\n        }),\n      );\n      const errs = del.Errors ?? [];\n      if (errs.length > 0) {\n        const first = errs[0];\n        throw new Error(\n          `S3 DeleteObjects: ${first.Key ?? \"?\"} — ${first.Code ?? \"\"} ${first.Message ?? \"\"}`.trim(),\n        );\n      }\n      objectsDeleted += del.Deleted?.length ?? keys.length;\n    }\n    if (!listed.IsTruncated) break;\n    continuationToken = listed.NextContinuationToken;\n  }\n\n  return { uploadsAborted, objectsDeleted };\n}\n"],"mappings":";;;;;;;;;;;AAgBA,MAAM,eAAe;AAErB,SAAgB,yBAEF;CACZ,MAAM,cAAc,QAAQ,IAAI,kBAAkB,MAAM;CACxD,MAAM,kBAAkB,QAAQ,IAAI,sBAAsB,MAAM;AAChE,KAAI,CAAC,eAAe,CAAC,gBAAiB,QAAO;AAC7C,QAAO;EAAE;EAAa;EAAiB;;AAGzC,SAAS,QACP,WACA,OACU;AACV,QAAO,IAAI,SAAS;EAClB,QAAQ;EACR,UAAU,WAAW,UAAU;EAC/B,aAAa;EACd,CAAC;;;;;;AAOJ,eAAsB,mBACpB,WACA,YACA,OAC6D;CAC7D,MAAM,KAAK,QAAQ,WAAW,MAAM;CACpC,IAAI,iBAAiB;CACrB,IAAIA;CACJ,IAAIC;AAEJ,UAAS;EACP,MAAM,MAAM,MAAM,GAAG,KACnB,IAAI,4BAA4B;GAC9B,QAAQ;GACR,WAAW;GACX,gBAAgB;GACjB,CAAC,CACH;AACD,OAAK,MAAM,KAAK,IAAI,WAAW,EAAE,EAAE;AACjC,OAAI,EAAE,OAAO,QAAQ,EAAE,YAAY,KAAM;AACzC,SAAM,GAAG,KACP,IAAI,4BAA4B;IAC9B,QAAQ;IACR,KAAK,EAAE;IACP,UAAU,EAAE;IACb,CAAC,CACH;AACD,qBAAkB;;AAEpB,MAAI,CAAC,IAAI,YAAa;AACtB,cAAY,IAAI;AAChB,mBAAiB,IAAI;;CAGvB,IAAI,iBAAiB;CACrB,IAAIC;AAEJ,UAAS;EACP,MAAM,SAAS,MAAM,GAAG,KACtB,IAAI,qBAAqB;GACvB,QAAQ;GACR,mBAAmB;GACnB,SAAS;GACV,CAAC,CACH;EACD,MAAM,QAAQ,OAAO,YAAY,EAAE,EAChC,KAAK,MAAM,EAAE,IAAI,CACjB,QAAQ,MAAmB,QAAQ,EAAE,CAAC;AACzC,MAAI,KAAK,SAAS,GAAG;GACnB,MAAM,MAAM,MAAM,GAAG,KACnB,IAAI,qBAAqB;IACvB,QAAQ;IACR,QAAQ;KAAE,SAAS,KAAK,KAAK,SAAS,EAAE,KAAK,EAAE;KAAE,OAAO;KAAM;IAC/D,CAAC,CACH;GACD,MAAM,OAAO,IAAI,UAAU,EAAE;AAC7B,OAAI,KAAK,SAAS,GAAG;IACnB,MAAM,QAAQ,KAAK;AACnB,UAAM,IAAI,MACR,qBAAqB,MAAM,OAAO,IAAI,KAAK,MAAM,QAAQ,GAAG,GAAG,MAAM,WAAW,KAAK,MAAM,CAC5F;;AAEH,qBAAkB,IAAI,SAAS,UAAU,KAAK;;AAEhD,MAAI,CAAC,OAAO,YAAa;AACzB,sBAAoB,OAAO;;AAG7B,QAAO;EAAE;EAAgB;EAAgB"}

package/dist/{registry-CTerXUza.mjs → registry-D3heJge_.mjs}

@@ -1,6 +1,6 @@
-import { H as getWorkers } from "./tamer.mjs";
-import { t as emptyR2BucketViaS3 } from "./r2S3EmptyBucket-DD81ZWQ7.mjs";
-import { n as logApplyChange } from "./planFormat-CJw8Kq2s.mjs";
+import { nt as getWorkers } from "./tamer.mjs";
+import { t as emptyR2BucketViaS3 } from "./r2S3EmptyBucket-OKIQdlms.mjs";
+import { n as logApplyChange } from "./planFormat-DHjPdYzr.mjs";
 import { createHash } from "crypto";
 
 //#region src/core/naming/resolveCloudflareName.ts
@@ -3157,4 +3157,4 @@ function getResourceModule(kind) {
 
 //#endregion
 export { logicalNamesForResourceKind as a, workflowsApply as i, resourceModules as n, d1CloudflareDatabaseName as o, secretsStoreDeriveName as r, d1SkipsProvisionAndMigrate as s, getResourceModule as t };
-//# sourceMappingURL=registry-CTerXUza.mjs.map
+//# sourceMappingURL=registry-D3heJge_.mjs.map