Installation

Prerequisites

• Bun 1.3.10+ and Node.js 22+ (engines.node). The tamer bin has a bun shebang, so Bun is required to run it (CI, laptops).
• A Cloudflare account with CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN
• Wrangler 4.0.0+ (peer dependency)

The tamer bin runs under Bun

The published tamer executable has a #!/usr/bin/env bun shebang (not node) because it dynamically imports your .ts config file, which needs Bun's module resolution. Install Bun alongside Node in any environment that runs tamer (CI, laptops). Node alone is not enough.

Consumer installation (downstream repos)

npm install -D @dragonmastery/tamer wrangler

Then follow the Quickstart.

Contributor installation (this repo)

bun install

Verify credentials

Contributors (this repo):

bun run tamer -- doctor --env dev

Consumers (downstream repos): npx tamer doctor --env dev (or add a "tamer:doctor": "tamer doctor --env dev" script — see Quickstart).

Checks that CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN are set and valid against the Cloudflare API. Add --json for machine-readable output.

Environment variables

Variable	Required	Purpose
CLOUDFLARE_ACCOUNT_ID	Yes (non-local)	Cloudflare account ID
CLOUDFLARE_API_TOKEN	Yes (non-local)	Cloudflare API token
R2_ACCESS_KEY_ID	Optional	R2 S3 API — for tamer destroy bucket-emptying
R2_SECRET_ACCESS_KEY	Optional	R2 S3 API — for tamer destroy bucket-emptying

Bun auto-loads .env from the current working directory. Keep credentials in a per-project .env (gitignored).

API token scopes

Custom token, scoped to the account you target. Names match Cloudflare's API token permissions reference:

Permission	Scope	Used by
Workers Scripts: Edit	Account	deploy, destroy, wfp put, dispatch-namespace ops
Workers KV Storage: Edit	Account	KV apply / destroy / sync
Workers R2 Storage: Edit	Account	R2 apply / destroy / sync
D1: Edit	Account	D1 apply / destroy / migrate / sync
Queues: Edit	Account	Queues apply / destroy / sync / drift / import
Hyperdrive: Edit	Account	Hyperdrive apply / destroy / sync / drift / import
Vectorize: Edit	Account	Vectorize apply / destroy / sync / drift / import
AI Gateway: Edit	Account	AI Gateway apply / destroy / sync / drift / import
Pipelines: Edit	Account	Pipelines apply / destroy / sync / drift / import
Workflows: Edit	Account	Workflows apply / destroy / sync / drift / import
Secrets Store: Edit	Account	Secrets Store apply / destroy / sync / drift / import
DNS: Edit	Zone	DNS records (zones declared in dnsRecords[])
Logs: Edit (or Logpush: Edit)	Account	logpushJobs Workers trace Logpush jobs
Account Settings: Read	Account	Account-scoped reads (required by Wrangler subprocesses)
Workers Routes: Edit	Zone	Zone-name tamerRoutes (deploy, sync, destroy, drift). Skip if you only use custom-domain routes.
Zone: Read	Zone	Resolving zone_name → zone id for zone-name routes

Quick start

The dashboard template "Edit Cloudflare Workers" covers most of these. Add D1: Edit manually — it's not in the template.

Pipelines + R2 Data Catalog

If you use pipelinesAuto, your token also needs:

• Workers R2 Data Catalog: Edit (Account) — Tamer calls /r2-catalog/{bucket}/enable on your CLOUDFLARE_API_TOKEN
• API Tokens: Edit (Account) — Tamer mints two sub-tokens (catalog + sink)
• Workers R2 Storage: Edit on the catalog bucket

For read-only flows (status, plan, drift), use the Read variants instead.