@volter/twin-cloudflare 0.1.0

package/dist/src/cloudflare-provisioning.js

@@ -0,0 +1,2097 @@
+// Cloudflare Workers / R2 / Hyperdrive / Queues PROVISIONING control plane — the surface a
+// wrangler-shaped or raw-API deploy script drives when standing up a Workers launch plane:
+// Worker script upload (metadata + bindings recorded, content fingerprinted, NEVER executed),
+// cron triggers, workers.dev subdomains, zone routes and custom domains, R2 bucket control
+// plane (no object data plane), Hyperdrive configuration records (origins recorded, never
+// dialed), Queues and queue consumers, and Durable Object namespace records materialized from
+// script migrations.
+//
+// Grounding (re-read 2026-08-23 from the SAME pinned sources as the core slice): Cloudflare's
+// first-party api-schemas OpenAPI 4.0.0 (commit 2ac8369e9b63dccacee1a2284e95bb819f05b307 —
+// paths, envelopes, request schemas, script-name/bucket-name patterns, the delete?force
+// contract) and the official cloudflare-typescript SDK (npm cloudflare@7.1.0 — response
+// shapes, binding-kind union, consumer union, multipart upload encoding). The pinned OpenAPI
+// declares only a GENERIC 4XX error envelope for these operations, so specific numeric error
+// codes are not pinned by it: this file uses Cloudflare's widely observed codes where they are
+// well known (10007 script not found, 10006 R2 bucket missing, 10004 R2 bucket exists) and the
+// pack's generic conventions (1004 validation, 1001 not found) everywhere else — see README
+// "Official grounding". No live probe was possible (no Cloudflare account); the OpenAPI + SDK
+// are the honest grounding ceiling for this slice.
+import { createHash } from 'node:crypto';
+import { deterministicHex, failure, headers as lowerHeaders, isResponse, mint, noRoute, paginate, parseBody, readOnly, row, rows, callerEmail, audit, scopeMissing, success, uuidFrom, write, } from "./cloudflare-common.js";
+import { catchUpR2CustomDomains, connectR2CustomDomain, createR2TempCredential, r2BearerToken, r2Credential, r2ParentCovers, removeR2CustomDomain, r2CustomDomains, TEMP_PERMISSIONS, updateR2CustomDomain } from "./cloudflare-r2.js";
+import { createAssetsUploadSession, redeemAssetsCompletion, uploadAssets } from "./cloudflare-worker-assets.js";
+const SCRIPT_NAME_PATTERN = /^[a-z0-9_][a-z0-9-_]*$/; // OpenAPI workers_script_name
+const BUCKET_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/; // OpenAPI r2 create schema (3-64 chars)
+const R2_LOCATIONS = new Set(['apac', 'eeur', 'enam', 'weur', 'wnam', 'oc']);
+const R2_STORAGE_CLASSES = new Set(['Standard', 'InfrequentAccess']);
+const R2_JURISDICTIONS = new Set(['default', 'eu', 'fedramp']);
+const USAGE_MODELS = new Set(['standard', 'bundled', 'unbound']);
+const HYPERDRIVE_SCHEMES = new Set(['postgres', 'postgresql', 'mysql']);
+// The closed binding-kind union from the official SDK (cloudflare@7.1.0 WorkersBindingKind*).
+// An unknown `type` fails 400 — the union is closed in both the OpenAPI and the SDK.
+const BINDING_KINDS = new Set([
+    'ai', 'ai_search', 'ai_search_namespace', 'messaging', 'analytics_engine', 'assets', 'browser',
+    'd1', 'data_blob', 'dispatch_namespace', 'durable_object_namespace', 'hyperdrive', 'inherit',
+    'images', 'json', 'kv_namespace', 'media', 'mtls_certificate', 'plain_text', 'pipelines',
+    'queue', 'ratelimit', 'r2_bucket', 'secret_text', 'send_email', 'service', 'text_blob',
+    'vectorize', 'version_metadata', 'secrets_store_secret', 'flagship', 'secret_key', 'workflow',
+    'wasm_module', 'vpc_service', 'vpc_network',
+    // Dynamic Worker Loaders: wrangler's `worker_loaders` config uploads `{type: "worker_loader",
+    // name}` — newer than the pinned SDK union; recorded as configuration like every kind below
+    // the deploy-critical ones.
+    'worker_loader',
+]);
+function str(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+const CRON_FIELDS = [
+    { min: 0, max: 59 },
+    { min: 0, max: 23 },
+    { min: 1, max: 31, special: /^(l|lw|[0-9]{1,2}w)$/ }, // day-of-month: last / last-weekday / nth-weekday
+    { min: 1, max: 12, names: /^(jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)$/ },
+    { min: 0, max: 7, names: /^(sun|mon|tue|wed|thu|fri|sat)$/, special: /^([0-7]#[1-5]|[0-7]?l)$/ }, // day-of-week: nth / last
+];
+function cronToken(token, f) {
+    const lower = token.toLowerCase();
+    if (f.names?.test(lower))
+        return true;
+    if (f.special?.test(lower))
+        return true;
+    return /^[0-9]+$/.test(token) && Number(token) >= f.min && Number(token) <= f.max;
+}
+function validCronField(field, f) {
+    if (field === '?' || field === '*')
+        return true;
+    return field.split(',').every((part) => {
+        if (part === '')
+            return false;
+        const slash = part.split('/');
+        if (slash.length > 2)
+            return false; // reject */5/5 and the like
+        const [base, step] = slash;
+        if (step !== undefined && !/^[1-9][0-9]*$/.test(step))
+            return false;
+        if (base === '*')
+            return true;
+        const dash = base.split('-');
+        if (dash.length > 2)
+            return false;
+        if (dash.length === 2) {
+            // A numeric range must be low<=high; special/named endpoints are accepted as-is.
+            if (!cronToken(dash[0], f) || !cronToken(dash[1], f))
+                return false;
+            if (/^[0-9]+$/.test(dash[0]) && /^[0-9]+$/.test(dash[1]) && Number(dash[0]) > Number(dash[1]))
+                return false;
+            return true;
+        }
+        return cronToken(base, f);
+    });
+}
+function validCron(cron) {
+    const fields = cron.trim().split(/\s+/);
+    return fields.length === 5 && fields.every((field, index) => validCronField(field, CRON_FIELDS[index]));
+}
+function scriptID(accountID, name) {
+    return `${accountID}:${name}`;
+}
+function scriptRows(accountID, root) {
+    return rows('worker_script', root).filter((item) => item.account_id === accountID);
+}
+function scriptRow(accountID, name, root) {
+    return row('worker_script', scriptID(accountID, name), root);
+}
+function scriptNotFound(name) {
+    return failure(404, 10007, `workers.api.error.script_not_found: script "${name}" not found`);
+}
+/** Kernel writes here fold a per-subject `rev` ordinal into every action so a write returning
+ *  a subject to a previously held value in the same millisecond can never collide with the
+ *  earlier action's content hash and be dropped as a replay (the kernel's content+timestamp
+ *  dedupe — see ADDING_A_TWIN.md section 5; upstash-store.ts `rev` is the precedent). */
+async function pwrite(type, id, operation, fields, req) {
+    const rev = Number(row(type, id, req.root, true)?.rev ?? 0) + 1;
+    await write(type, id, operation, { ...fields, rev }, req);
+}
+function namespaceRows(accountID, root) {
+    return rows('durable_object_namespace', root).filter((item) => item.account_id === accountID);
+}
+// ── views (response shapes per the official SDK) ────────────────────────────────────────────
+function scriptView(value) {
+    return {
+        id: value.name,
+        etag: value.etag,
+        created_on: value.created_on,
+        modified_on: value.modified_on,
+        usage_model: value.usage_model ?? 'standard',
+        logpush: value.logpush ?? false,
+        has_assets: value.assets !== null && value.assets !== undefined,
+        has_modules: value.has_modules === true,
+        tags: value.tags ?? [],
+        tail_consumers: value.tail_consumers ?? null,
+        ...(str(value.compatibility_date) ? { compatibility_date: value.compatibility_date } : {}),
+        ...(Array.isArray(value.compatibility_flags) ? { compatibility_flags: value.compatibility_flags } : {}),
+        ...(str(value.migration_tag) ? { migration_tag: value.migration_tag } : {}),
+    };
+}
+/** A script's tag: the vendor's opaque 32-hex identity for one Worker, stable across uploads and
+ *  new after a delete/recreate. Minted against every tag already in state (tombstones included). */
+function mintScriptTag(accountID, scriptName, root) {
+    const taken = new Set(rows('worker_script', root, true).map((item) => String(item.tag ?? '')));
+    for (let salt = 0;; salt++) {
+        const tag = deterministicHex(`${accountID}:${scriptName}:tag:${salt}`, 32);
+        if (!taken.has(tag))
+            return tag;
+    }
+}
+/** The client a script was last uploaded from, as the vendor reports it (`last_deployed_from`):
+ *  wrangler identifies itself in its User-Agent (`wrangler/<version>`); anything else is the API. */
+function deploySource(req) {
+    return /^wrangler(\/|$)/i.test(lowerHeaders(req.headers)['user-agent'] ?? '') ? 'wrangler' : 'api';
+}
+/** `GET /accounts/{account_id}/workers/services/{service_name}` — the Worker-as-service view
+ *  wrangler reads before every deploy (tag, tags, migration tag, last deploy source). This path
+ *  is not in the pinned OpenAPI; its shape is what Cloudflare's own client (wrangler, the
+ *  cloudflare/workers-sdk deploy helpers) reads from it: `default_environment.environment` and
+ *  `default_environment.script.{tag,tags,migration_tag,last_deployed_from}`. A Worker that does
+ *  not exist answers 10007, the not-found code wrangler treats as "first deploy". */
+function serviceView(value) {
+    const script = {
+        ...scriptView(value),
+        tag: value.tag,
+        last_deployed_from: value.last_deployed_from ?? 'api',
+    };
+    return {
+        id: value.name,
+        default_environment: {
+            environment: 'production',
+            created_on: value.created_on,
+            modified_on: value.modified_on,
+            script,
+        },
+        environments: [{ environment: 'production', created_on: value.created_on, modified_on: value.modified_on }],
+        created_on: value.created_on,
+        modified_on: value.modified_on,
+    };
+}
+function routeView(value) {
+    return { id: value.id, pattern: value.pattern, ...(str(value.script) ? { script: value.script } : {}) };
+}
+function domainView(value) {
+    return {
+        id: value.id,
+        cert_id: value.cert_id,
+        hostname: value.hostname,
+        service: value.service,
+        zone_id: value.zone_id,
+        zone_name: value.zone_name,
+        environment: 'production',
+    };
+}
+function bucketView(value) {
+    return {
+        name: value.name,
+        creation_date: value.creation_date,
+        ...(str(value.location) ? { location: value.location } : {}),
+        storage_class: value.storage_class ?? 'Standard',
+        jurisdiction: value.jurisdiction ?? 'default',
+    };
+}
+function hyperdriveView(value) {
+    return {
+        id: value.id,
+        name: value.name,
+        origin: value.origin,
+        ...(value.caching !== undefined && value.caching !== null ? { caching: value.caching } : {}),
+        ...(value.mtls !== undefined && value.mtls !== null ? { mtls: value.mtls } : {}),
+        ...(typeof value.origin_connection_limit === 'number' ? { origin_connection_limit: value.origin_connection_limit } : {}),
+        created_on: value.created_on,
+        modified_on: value.modified_on,
+    };
+}
+function consumerView(value, root) {
+    const queue = row('queue', String(value.queue_id), root);
+    return {
+        consumer_id: value.id,
+        queue_name: queue?.queue_name ?? null,
+        created_on: value.created_on,
+        type: value.consumer_type,
+        ...(value.consumer_type === 'worker' && str(value.script_name) ? { script_name: value.script_name } : {}),
+        ...(str(value.dead_letter_queue) ? { dead_letter_queue: value.dead_letter_queue } : {}),
+        settings: value.settings ?? {},
+    };
+}
+function queueProducers(accountID, queueName, root) {
+    return scriptRows(accountID, root)
+        .filter((script) => (Array.isArray(script.bindings) ? script.bindings : [])
+        .some((binding) => binding?.type === 'queue' && binding?.queue_name === queueName))
+        .map((script) => ({ script: script.name, type: 'worker' }));
+}
+function queueView(value, root) {
+    const consumers = rows('queue_consumer', root)
+        .filter((item) => item.queue_id === value.id)
+        .map((item) => consumerView(item, root));
+    const producers = queueProducers(String(value.account_id), String(value.queue_name), root);
+    return {
+        queue_id: value.id,
+        queue_name: value.queue_name,
+        created_on: value.created_on,
+        modified_on: value.modified_on,
+        producers,
+        producers_total_count: producers.length,
+        consumers,
+        consumers_total_count: consumers.length,
+        ...(value.settings !== undefined && value.settings !== null ? { settings: value.settings } : {}),
+    };
+}
+function namespaceView(value) {
+    return { id: value.id, class: value.class_name, script: value.script, use_sqlite: value.use_sqlite === true };
+}
+/** Parse a multipart/form-data body already decoded as UTF-8 text. Text module parts survive
+ *  intact; a binary part (e.g. wasm) survives only as its lossy UTF-8 decoding — the content is
+ *  still recorded and fingerprinted deterministically, but byte-exact wasm round-tripping is a
+ *  documented non-goal of this control-plane twin. */
+function parseMultipart(body, boundary) {
+    const delimiter = `--${boundary}`;
+    const segments = body.split(delimiter);
+    if (segments.length < 3)
+        return null;
+    const parts = [];
+    for (const segment of segments.slice(1, -1)) {
+        const cleaned = segment.replace(/^\r?\n/, '');
+        const headerEnd = cleaned.indexOf('\r\n\r\n') >= 0 ? cleaned.indexOf('\r\n\r\n') : cleaned.indexOf('\n\n');
+        if (headerEnd < 0)
+            return null;
+        const rawHeaders = cleaned.slice(0, headerEnd);
+        const data = cleaned.slice(headerEnd).replace(/^(\r\n\r\n|\n\n)/, '').replace(/\r?\n$/, '');
+        const disposition = rawHeaders.split(/\r?\n/).find((line) => /^content-disposition:/i.test(line)) ?? '';
+        const nameMatch = /name="([^"]*)"/i.exec(disposition);
+        const filenameMatch = /filename="([^"]*)"/i.exec(disposition);
+        const typeLine = rawHeaders.split(/\r?\n/).find((line) => /^content-type:/i.test(line));
+        if (!nameMatch)
+            return null;
+        parts.push({
+            name: nameMatch[1],
+            ...(filenameMatch ? { filename: filenameMatch[1] } : {}),
+            ...(typeLine ? { contentType: typeLine.split(':')[1].trim() } : {}),
+            data,
+        });
+    }
+    return parts;
+}
+// ── Worker script upload ────────────────────────────────────────────────────────────────────
+function validateBindings(accountID, scriptName, bindings, req, projectedClasses) {
+    if (bindings === undefined)
+        return null;
+    if (!Array.isArray(bindings))
+        return failure(400, 1004, 'metadata.bindings must be an array');
+    for (const value of bindings) {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            return failure(400, 1004, 'Each binding must be an object');
+        const binding = value;
+        if (!str(binding.type) || !BINDING_KINDS.has(binding.type)) {
+            return failure(400, 1004, `Binding type "${String(binding.type)}" is not a valid Workers binding kind`);
+        }
+        if (!str(binding.name))
+            return failure(400, 1004, 'Each binding requires a nonempty name');
+        if ((binding.type === 'plain_text' || binding.type === 'secret_text') && !str(binding.text)) {
+            return failure(400, 1004, `${binding.type} binding "${binding.name}" requires text`);
+        }
+        if (binding.type === 'json' && binding.json === undefined) {
+            return failure(400, 1004, `json binding "${binding.name}" requires json`);
+        }
+        if (binding.type === 'kv_namespace' && !str(binding.namespace_id)) {
+            return failure(400, 1004, `kv_namespace binding "${binding.name}" requires namespace_id`);
+        }
+        if (binding.type === 'service') {
+            if (!str(binding.service))
+                return failure(400, 1004, `service binding "${binding.name}" requires service`);
+            // A service binding must target an existing Worker (or this script itself) — the delete
+            // path treats service bindings as real dependents, so a dangling one must not be recordable
+            // (round-two N4, same cross-resource-ghost class as the route→script check).
+            if (binding.service !== scriptName && !scriptRow(accountID, binding.service, req.root)) {
+                return failure(400, 1004, `service binding "${binding.name}" references unknown Worker "${binding.service}"`);
+            }
+        }
+        if (binding.type === 'r2_bucket') {
+            if (!str(binding.bucket_name))
+                return failure(400, 1004, `r2_bucket binding "${binding.name}" requires bucket_name`);
+            if (!row('r2_bucket', `${accountID}:${binding.bucket_name}`, req.root)) {
+                return failure(400, 1004, `r2_bucket binding "${binding.name}" references unknown bucket "${binding.bucket_name}"`);
+            }
+        }
+        if (binding.type === 'queue') {
+            if (!str(binding.queue_name))
+                return failure(400, 1004, `queue binding "${binding.name}" requires queue_name`);
+            if (!rows('queue', req.root).some((item) => item.account_id === accountID && item.queue_name === binding.queue_name)) {
+                return failure(400, 1004, `queue binding "${binding.name}" references unknown queue "${binding.queue_name}"`);
+            }
+        }
+        if (binding.type === 'hyperdrive') {
+            if (!str(binding.id))
+                return failure(400, 1004, `hyperdrive binding "${binding.name}" requires id`);
+            const config = row('hyperdrive_config', binding.id, req.root);
+            if (!config || config.account_id !== accountID) {
+                return failure(400, 1004, `hyperdrive binding "${binding.name}" references unknown Hyperdrive configuration "${binding.id}"`);
+            }
+        }
+        if (binding.type === 'durable_object_namespace') {
+            const owner = str(binding.script_name) ? binding.script_name : scriptName;
+            if (!str(binding.class_name) && !str(binding.namespace_id)) {
+                return failure(400, 1004, `durable_object_namespace binding "${binding.name}" requires class_name or namespace_id`);
+            }
+            if (str(binding.namespace_id) && !namespaceRows(accountID, req.root).some((item) => item.id === binding.namespace_id)) {
+                return failure(400, 1004, `durable_object_namespace binding "${binding.name}" references unknown namespace "${binding.namespace_id}"`);
+            }
+            if (str(binding.class_name)) {
+                // Same-script class refs are validated against the PROJECTED post-migration class set
+                // (this upload's own migrations may create the class); cross-script refs against the
+                // other script's already-live classes.
+                const known = owner === scriptName
+                    ? projectedClasses.has(binding.class_name)
+                    : namespaceRows(accountID, req.root).some((item) => item.script === owner && item.class_name === binding.class_name);
+                if (!known)
+                    return failure(400, 1004, `durable_object_namespace binding "${binding.name}" references unknown class "${binding.class_name}" on script "${owner}"`);
+            }
+        }
+    }
+    return null;
+}
+function classList(value, label) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.some((item) => !str(item)))
+        return failure(400, 1004, `migrations.${label} must be an array of class names`);
+    return value;
+}
+/** Validate migrations and compute the ordered write-plan + the resulting live-class set —
+ *  WITHOUT writing anything. Splitting plan from apply is what makes a Worker upload atomic:
+ *  nothing is written until ALL validation (metadata, bindings against the projected classes,
+ *  and migrations) has passed, so a rejected upload can never leave orphan Durable Object
+ *  namespaces behind (round-two N5). */
+function planMigrations(accountID, scriptName, migrations, currentTag, root) {
+    if (str(migrations.old_tag) && migrations.old_tag !== currentTag) {
+        return failure(400, 1004, `migrations.old_tag "${migrations.old_tag}" does not match the script's current migration tag`);
+    }
+    const steps = Array.isArray(migrations.steps) ? migrations.steps : [migrations];
+    const ops = [];
+    // Simulate the evolving live-class map (className -> existing id, or null for a planned create).
+    const live = new Map();
+    for (const item of namespaceRows(accountID, root).filter((row) => row.script === scriptName)) {
+        live.set(String(item.class_name), item.id);
+    }
+    for (const step of steps) {
+        if (!step || typeof step !== 'object')
+            return failure(400, 1004, 'Each migration step must be an object');
+        if (step.transferred_classes !== undefined) {
+            return failure(400, 1004, 'migrations.transferred_classes is not modeled by this twin');
+        }
+        const created = classList(step.new_classes, 'new_classes');
+        if (isResponse(created))
+            return created;
+        const createdSqlite = classList(step.new_sqlite_classes, 'new_sqlite_classes');
+        if (isResponse(createdSqlite))
+            return createdSqlite;
+        const deleted = classList(step.deleted_classes, 'deleted_classes');
+        if (isResponse(deleted))
+            return deleted;
+        const renames = step.renamed_classes === undefined ? [] : step.renamed_classes;
+        if (!Array.isArray(renames))
+            return failure(400, 1004, 'migrations.renamed_classes must be an array');
+        for (const [list, useSqlite] of [[created, false], [createdSqlite, true]]) {
+            for (const className of list) {
+                if (live.has(className))
+                    return failure(400, 1004, `migrations: class "${className}" already has a Durable Object namespace on this script`);
+                live.set(className, null);
+                ops.push({ kind: 'create', className, useSqlite });
+            }
+        }
+        for (const className of deleted) {
+            const id = live.get(className);
+            if (id === undefined)
+                return failure(400, 1004, `migrations: cannot delete unknown class "${className}"`);
+            live.delete(className);
+            if (id !== null)
+                ops.push({ kind: 'delete', id });
+            // A class created by an EARLIER step of this same upload never materializes: drop its
+            // planned create (e.g. steps v1 new WorldDO → v2 delete WorldDO on a first deploy).
+            else {
+                const planned = ops.findIndex((op) => op.kind === 'create' && op.className === className);
+                if (planned >= 0)
+                    ops.splice(planned, 1);
+            }
+        }
+        for (const rename of renames) {
+            const pair = rename;
+            if (!pair || typeof pair !== 'object' || !str(pair.from) || !str(pair.to)) {
+                return failure(400, 1004, 'migrations.renamed_classes entries require from and to');
+            }
+            const id = live.get(pair.from);
+            if (id === undefined)
+                return failure(400, 1004, `migrations: cannot rename unknown class "${pair.from}"`);
+            if (live.has(pair.to))
+                return failure(400, 1004, `migrations: rename target class "${pair.to}" already exists`);
+            live.delete(pair.from);
+            live.set(pair.to, id);
+            if (id !== null)
+                ops.push({ kind: 'rename', id, to: pair.to });
+            // Renaming a class this upload creates: the planned create takes the new name.
+            else {
+                const planned = ops.find((op) => op.kind === 'create' && op.className === pair.from);
+                if (planned && planned.kind === 'create')
+                    planned.className = pair.to;
+            }
+        }
+    }
+    return { ...(str(migrations.new_tag) ? { migrationTag: migrations.new_tag } : {}), ops, classes: new Set(live.keys()) };
+}
+async function applyMigrationPlan(accountID, scriptName, ops, req) {
+    for (const op of ops) {
+        if (op.kind === 'create') {
+            const id = mint('durable_object_namespace', `${accountID}:${scriptName}:${op.className}`, req.root);
+            await pwrite('durable_object_namespace', id, 'durable_object_namespace.create', {
+                account_id: accountID, script: scriptName, class_name: op.className, use_sqlite: op.useSqlite, deleted: false,
+            }, req);
+        }
+        else if (op.kind === 'delete') {
+            await pwrite('durable_object_namespace', op.id, 'durable_object_namespace.delete', { account_id: accountID, script: scriptName, deleted: true }, req);
+        }
+        else {
+            await pwrite('durable_object_namespace', op.id, 'durable_object_namespace.rename', { account_id: accountID, script: scriptName, class_name: op.to }, req);
+        }
+    }
+}
+/** Fold Rails-style bracket keys (the encoding the official SDK's FormData serializer emits:
+ *  `metadata[main_module]`, `metadata[bindings][][type]`, …) into a metadata object. An empty
+ *  `[]` segment appends to an array; a repeated direct key inside the trailing array element
+ *  starts a new element, matching the serializer's sequential emission order. Values arrive as
+ *  strings; the boolean fields this twin validates are coerced afterwards. */
+const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+function foldBracketMetadata(entries) {
+    const root = Object.create(null);
+    for (const { path, value } of entries) {
+        const tokens = [...path.matchAll(/\[([^\]]*)\]/g)].map((match) => match[1]);
+        if (tokens.length === 0)
+            return null;
+        // Refuse prototype-pollution keys outright — a bracket path like metadata[__proto__][x]
+        // must never reach into Object.prototype (Object.create(null) already denies the write, but
+        // rejecting loudly is clearer and covers constructor/prototype too).
+        if (tokens.some((token) => FORBIDDEN_KEYS.has(token)))
+            return null;
+        let node = root;
+        for (let i = 0; i < tokens.length; i++) {
+            const token = tokens[i];
+            const last = i === tokens.length - 1;
+            if (token === '') {
+                if (!Array.isArray(node))
+                    return null;
+                if (last) {
+                    node.push(value);
+                    break;
+                }
+                const nextToken = tokens[i + 1];
+                let element = node[node.length - 1];
+                const needNew = element === undefined || typeof element !== 'object' || element === null
+                    || (nextToken !== '' && !Array.isArray(element) && Object.hasOwn(element, nextToken));
+                if (needNew) {
+                    element = nextToken === '' ? [] : {};
+                    node.push(element);
+                }
+                node = element;
+            }
+            else {
+                if (typeof node !== 'object' || node === null || Array.isArray(node))
+                    return null;
+                const object = node;
+                if (last) {
+                    object[token] = value;
+                    break;
+                }
+                const nextToken = tokens[i + 1];
+                if (object[token] === undefined)
+                    object[token] = nextToken === '' ? [] : {};
+                node = object[token];
+            }
+        }
+    }
+    for (const key of ['logpush', 'keep_assets']) {
+        if (root[key] === 'true')
+            root[key] = true;
+        if (root[key] === 'false')
+            root[key] = false;
+    }
+    return root;
+}
+function parseUpload(req) {
+    const contentType = lowerHeaders(req.headers)['content-type'] ?? '';
+    const body = req.body ?? '';
+    // The wire can be multipart under EITHER content type: wrangler/raw API deploys send
+    // multipart/form-data with a boundary parameter, while the official SDK's runtime keeps the
+    // operation's application/javascript content type on a FormData-serialized body (measured
+    // against cloudflare@7.1.0 under Bun). Accept the header boundary when present, otherwise
+    // sniff the body's own delimiter line.
+    const headerBoundary = /boundary\s*=\s*(?:"([^"]+)"|([^\s;]+))/i.exec(contentType);
+    const sniffedBoundary = /^--([^\r\n]+)\r?\n/.exec(body);
+    const boundary = headerBoundary?.[1] ?? headerBoundary?.[2]
+        ?? (/content-disposition:\s*form-data/i.test(body) ? sniffedBoundary?.[1] : undefined);
+    if (/^multipart\/form-data/i.test(contentType) || boundary !== undefined) {
+        if (!boundary)
+            return failure(400, 1004, 'Invalid multipart/form-data body');
+        const parts = parseMultipart(body, boundary);
+        if (!parts)
+            return failure(400, 1004, 'Invalid multipart/form-data body');
+        const modules = parts.filter((part) => part.filename !== undefined).map((part) => ({
+            name: part.filename,
+            ...(part.contentType ? { content_type: part.contentType } : {}),
+            content: part.data,
+        }));
+        const fields = parts.filter((part) => part.filename === undefined);
+        const jsonPart = fields.find((part) => part.name === 'metadata');
+        const bracketParts = fields.filter((part) => part.name.startsWith('metadata['));
+        const unexpected = fields.find((part) => part !== jsonPart && !bracketParts.includes(part));
+        if (unexpected)
+            return failure(400, 1004, `Unexpected multipart part "${unexpected.name}"`);
+        if (jsonPart && bracketParts.length > 0)
+            return failure(400, 1004, 'metadata must be a single JSON part or bracket-encoded fields, not both');
+        let metadata;
+        if (jsonPart) {
+            try {
+                metadata = JSON.parse(jsonPart.data);
+            }
+            catch {
+                return failure(400, 1004, 'metadata part must be valid JSON');
+            }
+            if (!metadata || typeof metadata !== 'object' || Array.isArray(metadata))
+                return failure(400, 1004, 'metadata part must be a JSON object');
+        }
+        else if (bracketParts.length > 0) {
+            metadata = foldBracketMetadata(bracketParts.map((part) => ({ path: part.name.slice('metadata'.length), value: part.data })));
+            if (!metadata)
+                return failure(400, 1004, 'Invalid bracket-encoded metadata fields');
+        }
+        else {
+            return failure(400, 1004, 'multipart upload requires a metadata part');
+        }
+        return { metadata: metadata, modules };
+    }
+    // The official SDK serializes a no-files update as JSON {"metadata": {...}} under the
+    // operation's application/javascript content type; a raw non-JSON body is the classic
+    // service-worker-syntax script upload (OpenAPI application/javascript | text/javascript).
+    try {
+        const parsed = JSON.parse(body);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed) && 'metadata' in parsed) {
+            const metadata = parsed.metadata;
+            if (!metadata || typeof metadata !== 'object' || Array.isArray(metadata))
+                return failure(400, 1004, 'metadata must be a JSON object');
+            return { metadata: metadata, modules: [] };
+        }
+    }
+    catch { /* not JSON — treat as raw service-worker script */ }
+    if (!body)
+        return failure(400, 1004, 'Script upload requires content');
+    return { metadata: {}, modules: [], serviceWorkerBody: body };
+}
+const VERSIONED_FIELDS = ['etag', 'entry_module', 'has_modules', 'bindings', 'compatibility_date', 'compatibility_flags', 'usage_model', 'assets'];
+function versionRows(script, root) {
+    return rows('worker_version', root)
+        .filter((item) => item.account_id === script.account_id && item.script_name === script.name && item.script_tag === script.tag)
+        .sort((a, b) => Number(b.number) - Number(a.number));
+}
+/** The deployed modules: the live version's, or — for a record written before versions were
+ *  modeled — the script row's own copy. */
+function liveModules(script, root) {
+    if (Array.isArray(script.modules) && script.modules.length > 0)
+        return script.modules;
+    const version = str(script.version_id) ? row('worker_version', script.version_id, root) : undefined;
+    return Array.isArray(version?.modules) ? version.modules : [];
+}
+/** Validate one multipart Worker upload and compute the version it makes — WITHOUT writing.
+ *  `mode: 'deploy'` is the script PUT (creates the Worker, may migrate Durable Objects);
+ *  `mode: 'version'` is the versions upload (the Worker must exist; migrations are refused —
+ *  Cloudflare applies Durable Object migrations only through a deploy). */
+function buildUpload(req, url, accountID, scriptName, mode) {
+    const upload = parseUpload(req);
+    if (isResponse(upload))
+        return upload;
+    const { metadata, modules, serviceWorkerBody } = upload;
+    if (str(metadata.main_module) && str(metadata.body_part)) {
+        return failure(400, 1004, 'metadata cannot declare both main_module and body_part');
+    }
+    const entry = str(metadata.main_module) ? metadata.main_module : str(metadata.body_part) ? metadata.body_part : undefined;
+    if (modules.length > 0) {
+        if (!entry)
+            return failure(400, 1004, 'metadata requires main_module or body_part naming an uploaded file');
+        if (!modules.some((module) => module.name === entry)) {
+            return failure(400, 1004, `metadata references "${entry}" but no uploaded file has that name`);
+        }
+    }
+    else if (entry) {
+        return failure(400, 1004, `metadata references "${entry}" but the upload contains no files`);
+    }
+    if (metadata.compatibility_date !== undefined && (!str(metadata.compatibility_date) || !/^\d{4}-\d{2}-\d{2}$/.test(metadata.compatibility_date))) {
+        return failure(400, 1004, 'metadata.compatibility_date must be a YYYY-MM-DD date');
+    }
+    if (metadata.compatibility_flags !== undefined && (!Array.isArray(metadata.compatibility_flags) || metadata.compatibility_flags.some((flag) => !str(flag)))) {
+        return failure(400, 1004, 'metadata.compatibility_flags must be an array of strings');
+    }
+    if (metadata.usage_model !== undefined && (!str(metadata.usage_model) || !USAGE_MODELS.has(metadata.usage_model))) {
+        return failure(400, 1004, 'metadata.usage_model must be standard, bundled, or unbound');
+    }
+    if (metadata.logpush !== undefined && typeof metadata.logpush !== 'boolean') {
+        return failure(400, 1004, 'metadata.logpush must be a boolean');
+    }
+    if (metadata.tags !== undefined && (!Array.isArray(metadata.tags) || metadata.tags.some((tag) => !str(tag)))) {
+        return failure(400, 1004, 'metadata.tags must be an array of strings');
+    }
+    if (metadata.annotations !== undefined && (!metadata.annotations || typeof metadata.annotations !== 'object' || Array.isArray(metadata.annotations))) {
+        return failure(400, 1004, 'metadata.annotations must be an object');
+    }
+    const existing = scriptRow(accountID, scriptName, req.root);
+    if (mode === 'version' && !existing)
+        return scriptNotFound(scriptName);
+    const hasContent = modules.length > 0 || serviceWorkerBody !== undefined;
+    if (!existing && !hasContent)
+        return failure(400, 1004, 'Script upload requires content');
+    // Plan migrations FIRST (pure — no writes) to learn the projected post-migration class set,
+    // then validate every binding against it. All validation completes before any write, so a
+    // rejected upload leaves no orphan Durable Object namespaces (round-two N5).
+    let migrationTag = str(existing?.migration_tag) ? String(existing?.migration_tag) : undefined;
+    let migrationOps = [];
+    let projectedClasses = new Set(namespaceRows(accountID, req.root).filter((item) => item.script === scriptName).map((item) => String(item.class_name)));
+    if (metadata.migrations !== undefined) {
+        if (mode === 'version')
+            return failure(400, 1004, 'Durable Object migrations cannot be applied by a version upload; deploy the Worker to migrate');
+        if (!metadata.migrations || typeof metadata.migrations !== 'object' || Array.isArray(metadata.migrations)) {
+            return failure(400, 1004, 'metadata.migrations must be an object');
+        }
+        const plan = planMigrations(accountID, scriptName, metadata.migrations, migrationTag, req.root);
+        if (isResponse(plan))
+            return plan;
+        migrationOps = plan.ops;
+        projectedClasses = plan.classes;
+        if (plan.migrationTag)
+            migrationTag = plan.migrationTag;
+    }
+    const invalidBinding = validateBindings(accountID, scriptName, metadata.bindings, req, projectedClasses);
+    if (invalidBinding)
+        return invalidBinding;
+    // `inherit` bindings take the deployed version's binding of the same name (or `old_name`);
+    // under `bindings_inherit=strict` a binding with nothing to inherit is refused.
+    let bindings = metadata.bindings ?? existing?.bindings ?? [];
+    if (Array.isArray(metadata.bindings)) {
+        const previous = Array.isArray(existing?.bindings) ? existing.bindings : [];
+        const strict = url.searchParams.get('bindings_inherit') === 'strict';
+        const resolved = [];
+        for (const binding of metadata.bindings) {
+            if (binding.type !== 'inherit') {
+                resolved.push(binding);
+                continue;
+            }
+            const from = str(binding.old_name) ? binding.old_name : binding.name;
+            const found = previous.find((item) => item.name === from);
+            if (found)
+                resolved.push({ ...found, name: binding.name });
+            else if (strict)
+                return failure(400, 1004, `inherit binding "${String(binding.name)}" has no binding named "${String(from)}" on the deployed version to inherit`);
+        }
+        bindings = resolved;
+    }
+    // Static assets: metadata.assets redeems an asset-upload completion token (the manifest the
+    // session recorded plus the router/asset config the upload carries); keep_assets carries the
+    // previous upload's assets forward; otherwise the Worker has none. An `assets` binding needs
+    // assets to bind.
+    let assets = null;
+    if (metadata.assets !== undefined) {
+        if (!metadata.assets || typeof metadata.assets !== 'object' || Array.isArray(metadata.assets)) {
+            return failure(400, 1004, 'metadata.assets must be an object');
+        }
+        const declared = metadata.assets;
+        if (declared.config !== undefined && (!declared.config || typeof declared.config !== 'object' || Array.isArray(declared.config))) {
+            return failure(400, 1004, 'metadata.assets.config must be an object');
+        }
+        const redeemed = redeemAssetsCompletion(req, accountID, scriptName, declared.jwt);
+        if (isResponse(redeemed))
+            return redeemed;
+        assets = { session_id: redeemed.session_id, manifest: redeemed.manifest, config: declared.config ?? {} };
+    }
+    else if (metadata.keep_assets === true && existing?.assets) {
+        assets = existing.assets;
+    }
+    const assetsBinding = (Array.isArray(bindings) ? bindings : []).find((binding) => binding.type === 'assets');
+    if (assetsBinding && !assets) {
+        return failure(400, 1004, `assets binding "${String(assetsBinding.name)}" requires the upload to carry assets (metadata.assets or keep_assets)`);
+    }
+    const storedModules = hasContent
+        ? (serviceWorkerBody !== undefined ? [{ name: 'script', content_type: 'application/javascript', content: serviceWorkerBody }] : modules)
+        : liveModules(existing, req.root);
+    const entryModule = hasContent ? (serviceWorkerBody !== undefined ? 'script' : entry) : existing?.entry_module ?? null;
+    const hasModules = serviceWorkerBody !== undefined ? false : (hasContent ? modules.length > 0 : existing?.has_modules === true);
+    // Compute the COMPLETE effective record (metadata wins, else prior live value, else the
+    // vendor default). Writing every field explicitly — never a conditional spread — is what
+    // stops a tombstone's stale value from surviving the kernel's field merge on delete→recreate
+    // (finding-3), and the etag hashing the SAME effective values is what keeps the etag honest
+    // about what is stored (finding-10). `existing` is a LIVE row only (rows() filters tombstones),
+    // so on recreate every field falls through to metadata-or-default and overwrites the tombstone.
+    const compatibilityDate = metadata.compatibility_date ?? existing?.compatibility_date ?? null;
+    const compatibilityFlags = metadata.compatibility_flags ?? existing?.compatibility_flags ?? null;
+    const usageModel = metadata.usage_model ?? existing?.usage_model ?? 'standard';
+    const logpush = metadata.logpush ?? existing?.logpush ?? false;
+    const tags = metadata.tags ?? existing?.tags ?? [];
+    const etag = createHash('sha256')
+        .update(JSON.stringify({
+        modules: storedModules.map((module) => ({ name: module.name, content: module.content })),
+        entry: entryModule,
+        bindings,
+        compatibility_date: compatibilityDate,
+        compatibility_flags: compatibilityFlags,
+        usage_model: usageModel,
+        logpush,
+        tags,
+        // what the assets ARE (manifest + config), not which upload session delivered them
+        assets: assets ? { manifest: assets.manifest, config: assets.config } : null,
+    }))
+        .digest('hex');
+    const annotations = Object.fromEntries(Object.entries(metadata.annotations ?? {}).filter(([, value]) => typeof value === 'string'));
+    return {
+        existing,
+        content: {
+            etag, modules: storedModules, entry_module: entryModule, has_modules: hasModules, bindings,
+            compatibility_date: compatibilityDate, compatibility_flags: compatibilityFlags, usage_model: usageModel, assets,
+        },
+        migrationOps,
+        migrationTag,
+        logpush,
+        tags,
+        annotations,
+    };
+}
+/** Write one version row: its content, number, source and annotations. The version's id is a
+ *  UUID (the shape wrangler prints as "Current Version ID"). */
+async function writeVersion(req, accountID, scriptName, scriptTag, number, content, annotations) {
+    const id = mint('worker_version', `${accountID}:${scriptName}:${scriptTag}:${number}`, req.root);
+    const at = req.occurredAt ?? new Date().toISOString();
+    await pwrite('worker_version', id, 'worker_version.upload', {
+        account_id: accountID, script_name: scriptName, script_tag: scriptTag, number, ...content,
+        source: deploySource(req), annotations, author_email: callerEmail(req) || null, created_on: at, modified_on: at, deleted: false,
+    }, req);
+    return row('worker_version', id, req.root);
+}
+function deploymentRecord(req, script, versions, annotations) {
+    const count = Array.isArray(script.deployments) ? script.deployments.length : 0;
+    return {
+        id: uuidFrom(`${String(script.tag)}:deployment:${count}`),
+        created_on: req.occurredAt ?? new Date().toISOString(),
+        source: deploySource(req),
+        strategy: 'percentage',
+        versions,
+        annotations,
+        // Cloudflare names the user whose token made the deployment.
+        author_email: callerEmail(req) || null,
+    };
+}
+/** `PUT /accounts/{account_id}/workers/scripts/{script_name}` — upload AND deploy: every upload
+ *  is a new version deployed at 100% (the vendor's `deployment_id` in the answer is that version's
+ *  id, the value wrangler prints as "Current Version ID"). */
+async function uploadScript(req, url, accountID, scriptName) {
+    const blocked = readOnly(req);
+    if (blocked)
+        return blocked;
+    if (!SCRIPT_NAME_PATTERN.test(scriptName))
+        return failure(400, 1004, 'script_name must match ^[a-z0-9_][a-z0-9-_]*$');
+    const built = buildUpload(req, url, accountID, scriptName, 'deploy');
+    if (isResponse(built))
+        return built;
+    const { existing, content } = built;
+    const tag = String(existing?.tag ?? mintScriptTag(accountID, scriptName, req.root));
+    const number = Number(existing?.version_count ?? 0) + 1;
+    const at = req.occurredAt ?? new Date().toISOString();
+    // All validation passed — now perform the writes (migrations, the version, then the script).
+    await applyMigrationPlan(accountID, scriptName, built.migrationOps, req);
+    const version = await writeVersion(req, accountID, scriptName, tag, number, content, built.annotations);
+    const deployments = Array.isArray(existing?.deployments) ? existing.deployments : [];
+    const deployment = deploymentRecord(req, { tag, deployments }, [{ version_id: version.id, percentage: 100 }], { ...built.annotations, 'workers/triggered_by': 'upload' });
+    const { modules: _modules, ...live } = content;
+    await audit(req, accountID, { type: existing ? 'update' : 'create', resource: { type: 'script', id: scriptName }, newValue: { version_id: version.id, deployment_id: deployment.id }, metadata: { script: scriptName, deployment_id: deployment.id, version_id: version.id, annotations: built.annotations } });
+    await pwrite('worker_script', scriptID(accountID, scriptName), existing ? 'worker_script.update' : 'worker_script.upload', {
+        account_id: accountID,
+        name: scriptName,
+        ...live,
+        modules: null,
+        version_id: version.id,
+        version_count: number,
+        deployments: [...deployments, deployment],
+        logpush: built.logpush,
+        tags: built.tags,
+        migration_tag: built.migrationTag ?? null,
+        tag,
+        last_deployed_from: deploySource(req),
+        created_on: existing?.created_on ?? at,
+        modified_on: at,
+        schedules: existing?.schedules ?? [],
+        subdomain_enabled: existing?.subdomain_enabled ?? false,
+        subdomain_previews_enabled: existing?.subdomain_previews_enabled ?? false,
+        tail_consumers: existing?.tail_consumers ?? null,
+        observability: existing?.observability ?? null,
+        deleted: false,
+    }, req);
+    const script = scriptRow(accountID, scriptName, req.root);
+    return success({ ...scriptView(script), deployment_id: version.id, startup_time_ms: 5 });
+}
+function downloadScript(script, root) {
+    const modules = liveModules(script, root);
+    // A module-syntax Worker downloads as multipart/form-data regardless of module count (the
+    // pinned spec lists both content types for the download); a service-worker script downloads
+    // as raw application/javascript.
+    if (script.has_modules === true && modules.length > 0) {
+        const boundary = `twin-${deterministicHex(String(script.etag ?? script.id), 16)}`;
+        const body = modules
+            .map((module) => `--${boundary}\r\nContent-Disposition: form-data; name="${module.name}"; filename="${module.name}"\r\nContent-Type: ${module.content_type ?? 'application/javascript+module'}\r\n\r\n${module.content}\r\n`)
+            .join('') + `--${boundary}--\r\n`;
+        return { status: 200, body, raw: true, headers: { 'content-type': `multipart/form-data; boundary=${boundary}` } };
+    }
+    return {
+        status: 200,
+        body: modules[0]?.content ?? '',
+        raw: true,
+        headers: { 'content-type': 'application/javascript' },
+    };
+}
+// ── versions, deployments, script settings ──────────────────────────────────────────────────
+/** Version shape per the official SDK (VersionGetResponse): id, number, metadata, annotations,
+ *  and the resources it carries. The modules themselves are served by the script download. */
+function versionView(version) {
+    return {
+        id: version.id,
+        number: version.number,
+        metadata: {
+            author_email: version.author_email ?? null,
+            author_id: null,
+            created_on: version.created_on,
+            modified_on: version.modified_on,
+            source: version.source ?? 'api',
+            hasPreview: false,
+        },
+        annotations: version.annotations ?? {},
+        resources: {
+            bindings: bindingsView(version.bindings),
+            script: {
+                etag: version.etag,
+                handlers: [],
+                last_deployed_from: version.source ?? 'api',
+            },
+            script_runtime: {
+                compatibility_date: version.compatibility_date ?? null,
+                compatibility_flags: version.compatibility_flags ?? [],
+                usage_model: version.usage_model ?? 'standard',
+            },
+        },
+    };
+}
+/** The script's secrets as the vendor lists them (SDK SecretListResponse): name and type of each
+ *  secret_text / secret_key binding — never the value. */
+function scriptSecrets(script) {
+    return (Array.isArray(script.bindings) ? script.bindings : [])
+        .filter((binding) => binding.type === 'secret_text' || binding.type === 'secret_key')
+        .map((binding) => binding.type === 'secret_key'
+        ? { name: binding.name, type: 'secret_key', ...(binding.format !== undefined ? { format: binding.format } : {}), ...(binding.usages !== undefined ? { usages: binding.usages } : {}) }
+        : { name: binding.name, type: 'secret_text' });
+}
+/** Bindings as the vendor reads them back: a secret's value is write-only, so secret_text
+ *  bindings come back without `text` (and secret_key without its key material). */
+function bindingsView(bindings) {
+    return (Array.isArray(bindings) ? bindings : []).map((binding) => {
+        if (binding.type === 'secret_text') {
+            const { text: _text, ...rest } = binding;
+            return rest;
+        }
+        if (binding.type === 'secret_key') {
+            const { key_base64: _key, key_jwk: _jwk, ...rest } = binding;
+            return rest;
+        }
+        return binding;
+    });
+}
+/** `GET …/scripts/{script_name}/settings` (SDK ScriptSettings): the deployed version's bindings
+ *  and runtime, plus the non-versioned settings. */
+function scriptSettingsView(script) {
+    return {
+        bindings: bindingsView(script.bindings),
+        compatibility_date: script.compatibility_date ?? null,
+        compatibility_flags: script.compatibility_flags ?? [],
+        logpush: script.logpush ?? false,
+        observability: script.observability ?? null,
+        placement: {},
+        tags: script.tags ?? [],
+        tail_consumers: script.tail_consumers ?? null,
+        usage_model: script.usage_model ?? 'standard',
+    };
+}
+function settingsView(script) {
+    return {
+        logpush: script.logpush ?? false,
+        tail_consumers: script.tail_consumers ?? null,
+        observability: script.observability ?? null,
+        tags: script.tags ?? [],
+    };
+}
+/** POST /accounts/{account_id}/workers/scripts/{script_name}/versions — upload a version without deploying it. */
+async function uploadVersion(req, url, accountID, scriptName) {
+    const blocked = readOnly(req);
+    if (blocked)
+        return blocked;
+    const built = buildUpload(req, url, accountID, scriptName, 'version');
+    if (isResponse(built))
+        return built;
+    const script = built.existing;
+    const number = Number(script.version_count ?? 0) + 1;
+    const version = await writeVersion(req, accountID, scriptName, String(script.tag), number, built.content, built.annotations);
+    await pwrite('worker_script', scriptID(accountID, scriptName), 'worker_script.version', { account_id: accountID, version_count: number }, req);
+    return success({ ...versionView(version), startup_time_ms: 5 });
+}
+/** POST /accounts/{account_id}/workers/scripts/{script_name}/deployments — route traffic to
+ *  versions. The version at the larger share becomes the Worker's live content; the twin records
+ *  the split, it never routes a request. */
+async function createDeployment(req, accountID, script) {
+    const blocked = readOnly(req);
+    if (blocked)
+        return blocked;
+    const body = parseBody(req);
+    if (isResponse(body))
+        return body;
+    if (body.strategy !== 'percentage')
+        return failure(400, 1004, 'strategy must be "percentage"');
+    if (!Array.isArray(body.versions) || body.versions.length === 0 || body.versions.length > 2) {
+        return failure(400, 1004, 'versions must list one or two {version_id, percentage} entries');
+    }
+    const known = new Map(versionRows(script, req.root).map((version) => [version.id, version]));
+    const split = [];
+    for (const value of body.versions) {
+        if (!value || !str(value.version_id) || typeof value.percentage !== 'number' || value.percentage < 0 || value.percentage > 100) {
+            return failure(400, 1004, 'each deployment version requires version_id and a percentage between 0 and 100');
+        }
+        if (!known.has(value.version_id))
+            return failure(400, 1004, `version "${value.version_id}" is not a version of Worker "${String(script.name)}"`);
+        if (split.some((item) => item.version_id === value.version_id))
+            return failure(400, 1004, `version "${value.version_id}" is listed twice`);
+        split.push({ version_id: value.version_id, percentage: value.percentage });
+    }
+    if (Math.abs(split.reduce((sum, item) => sum + item.percentage, 0) - 100) > 1e-9)
+        return failure(400, 1004, 'version percentages must sum to 100');
+    if (body.annotations !== undefined && (!body.annotations || typeof body.annotations !== 'object' || Array.isArray(body.annotations))) {
+        return failure(400, 1004, 'annotations must be an object');
+    }
+    const annotations = Object.fromEntries(Object.entries(body.annotations ?? {}).filter(([, value]) => typeof value === 'string'));
+    const deployments = Array.isArray(script.deployments) ? script.deployments : [];
+    const deployment = deploymentRecord(req, { tag: script.tag, deployments }, split, annotations);
+    const live = known.get([...split].sort((a, b) => b.percentage - a.percentage)[0].version_id);
+    await pwrite('worker_script', script.id, 'worker_script.deploy', {
+        account_id: accountID,
+        ...Object.fromEntries(VERSIONED_FIELDS.map((field) => [field, live[field] ?? null])),
+        modules: null,
+        version_id: live.id,
+        deployments: [...deployments, deployment],
+        modified_on: req.occurredAt ?? new Date().toISOString(),
+    }, req);
+    return success(deployment);
+}
+async function patchScriptSettings(req, accountID, script) {
+    const blocked = readOnly(req);
+    if (blocked)
+        return blocked;
+    const body = parseBody(req);
+    if (isResponse(body))
+        return body;
+    if (body.logpush !== undefined && typeof body.logpush !== 'boolean')
+        return failure(400, 1004, 'logpush must be a boolean');
+    if (body.tags !== undefined && body.tags !== null && (!Array.isArray(body.tags) || body.tags.some((tag) => !str(tag)))) {
+        return failure(400, 1004, 'tags must be an array of strings');
+    }
+    if (body.tail_consumers !== undefined && body.tail_consumers !== null
+        && (!Array.isArray(body.tail_consumers) || body.tail_consumers.some((item) => !item || typeof item !== 'object' || !str(item.service)))) {
+        return failure(400, 1004, 'tail_consumers must be an array of {service} objects');
+    }
+    if (body.observability !== undefined && body.observability !== null) {
+        const observability = body.observability;
+        if (typeof observability !== 'object' || Array.isArray(observability) || typeof observability.enabled !== 'boolean') {
+            return failure(400, 1004, 'observability requires enabled (boolean)');
+        }
+        if (observability.head_sampling_rate !== undefined && observability.head_sampling_rate !== null
+            && (typeof observability.head_sampling_rate !== 'number' || observability.head_sampling_rate < 0 || observability.head_sampling_rate > 1)) {
+            return failure(400, 1004, 'observability.head_sampling_rate must be between 0 and 1');
+        }
+    }
+    await pwrite('worker_script', script.id, 'worker_script.settings', {
+        account_id: accountID,
+        ...(body.logpush !== undefined ? { logpush: body.logpush } : {}),
+        ...(body.tags !== undefined ? { tags: body.tags ?? [] } : {}),
+        ...(body.tail_consumers !== undefined ? { tail_consumers: body.tail_consumers } : {}),
+        ...(body.observability !== undefined ? { observability: body.observability } : {}),
+        modified_on: req.occurredAt ?? new Date().toISOString(),
+    }, req);
+    return success(settingsView(scriptRow(accountID, String(script.name), req.root)));
+}
+// ── the route table ─────────────────────────────────────────────────────────────────────────
+export const CLOUDFLARE_PROVISIONING_SURFACE = [
+    'GET /accounts/{account_id}/workers/scripts',
+    'PUT /accounts/{account_id}/workers/scripts/{script_name}',
+    'GET /accounts/{account_id}/workers/scripts/{script_name}',
+    'DELETE /accounts/{account_id}/workers/scripts/{script_name}',
+    'GET /accounts/{account_id}/workers/scripts/{script_name}/schedules',
+    'PUT /accounts/{account_id}/workers/scripts/{script_name}/schedules',
+    'GET /accounts/{account_id}/workers/scripts/{script_name}/subdomain',
+    'POST /accounts/{account_id}/workers/scripts/{script_name}/subdomain',
+    'DELETE /accounts/{account_id}/workers/scripts/{script_name}/subdomain',
+    'POST /accounts/{account_id}/workers/scripts/{script_name}/assets-upload-session',
+    'POST /accounts/{account_id}/workers/assets/upload',
+    'GET /accounts/{account_id}/workers/scripts/{script_name}/versions',
+    'POST /accounts/{account_id}/workers/scripts/{script_name}/versions',
+    'GET /accounts/{account_id}/workers/scripts/{script_name}/versions/{version_id}',
+    'GET /accounts/{account_id}/workers/scripts/{script_name}/deployments',
+    'POST /accounts/{account_id}/workers/scripts/{script_name}/deployments',
+    'GET /accounts/{account_id}/workers/scripts/{script_name}/script-settings',
+    'PATCH /accounts/{account_id}/workers/scripts/{script_name}/script-settings',
+    'GET /accounts/{account_id}/workers/scripts/{script_name}/settings',
+    'GET /accounts/{account_id}/workers/scripts/{script_name}/secrets',
+    'GET /accounts/{account_id}/workers/scripts/{script_name}/secrets/{secret_name}',
+    'GET /accounts/{account_id}/workers/subdomain',
+    'PUT /accounts/{account_id}/workers/subdomain',
+    'DELETE /accounts/{account_id}/workers/subdomain',
+    'GET /accounts/{account_id}/workers/domains',
+    'PUT /accounts/{account_id}/workers/domains',
+    'GET /accounts/{account_id}/workers/domains/{domain_id}',
+    'DELETE /accounts/{account_id}/workers/domains/{domain_id}',
+    'GET /accounts/{account_id}/workers/durable_objects/namespaces',
+    'GET /accounts/{account_id}/workers/services/{service_name}',
+    'GET /zones/{zone_id}/workers/routes',
+    'POST /zones/{zone_id}/workers/routes',
+    'GET /zones/{zone_id}/workers/routes/{route_id}',
+    'PUT /zones/{zone_id}/workers/routes/{route_id}',
+    'DELETE /zones/{zone_id}/workers/routes/{route_id}',
+    'GET /accounts/{account_id}/r2/buckets',
+    'POST /accounts/{account_id}/r2/buckets',
+    'GET /accounts/{account_id}/r2/buckets/{bucket_name}',
+    'DELETE /accounts/{account_id}/r2/buckets/{bucket_name}',
+    'GET /accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom',
+    'POST /accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom',
+    'GET /accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom/{domain}',
+    'PUT /accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom/{domain}',
+    'DELETE /accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom/{domain}',
+    'POST /accounts/{account_id}/r2/temp-access-credentials',
+    'GET /accounts/{account_id}/hyperdrive/configs',
+    'POST /accounts/{account_id}/hyperdrive/configs',
+    'GET /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}',
+    'PUT /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}',
+    'PATCH /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}',
+    'DELETE /accounts/{account_id}/hyperdrive/configs/{hyperdrive_id}',
+    'GET /accounts/{account_id}/queues',
+    'POST /accounts/{account_id}/queues',
+    'GET /accounts/{account_id}/queues/{queue_id}',
+    'DELETE /accounts/{account_id}/queues/{queue_id}',
+    'GET /accounts/{account_id}/queues/{queue_id}/consumers',
+    'POST /accounts/{account_id}/queues/{queue_id}/consumers',
+    'GET /accounts/{account_id}/queues/{queue_id}/consumers/{consumer_id}',
+    'PUT /accounts/{account_id}/queues/{queue_id}/consumers/{consumer_id}',
+    'DELETE /accounts/{account_id}/queues/{queue_id}/consumers/{consumer_id}',
+];
+/** Route the provisioning slice. Returns null when the path belongs to another slice; once a
+ *  provisioning-owned prefix matches, an unmodeled method/subresource fails loudly (noRoute). */
+export async function handleProvisioningRoute(req, method, url, parts) {
+    if (parts[0] === 'zones' && parts[2] === 'workers') {
+        if (parts[3] !== 'routes')
+            return noRoute();
+        const zoneID = parts[1];
+        const zone = row('zone', zoneID, req.root);
+        if (!zone)
+            return scopeMissing('zone', zoneID);
+        return routesRoute(req, method, parts, zoneID, String(zone.account_id));
+    }
+    if (parts[0] !== 'accounts')
+        return null;
+    const area = parts[2];
+    if (area !== 'workers' && area !== 'r2' && area !== 'hyperdrive' && area !== 'queues')
+        return null;
+    const accountID = parts[1];
+    if (!row('account', accountID, req.root))
+        return scopeMissing('account', accountID);
+    if (area === 'workers')
+        return workersRoute(req, method, url, parts, accountID);
+    if (area === 'r2')
+        return r2Route(req, method, url, parts, accountID);
+    if (area === 'hyperdrive')
+        return hyperdriveRoute(req, method, url, parts, accountID);
+    return queuesRoute(req, method, parts, accountID);
+}
+async function workersRoute(req, method, url, parts, accountID) {
+    if (parts[3] === 'scripts') {
+        if (parts.length === 4 && method === 'GET') {
+            const page = paginate(scriptRows(accountID, req.root).map(scriptView), url, 100, 1000);
+            return success(page.result, page.info);
+        }
+        const scriptName = parts[4];
+        if (!scriptName || parts.length > 7)
+            return noRoute();
+        if (parts.length === 7) {
+            if ((parts[5] !== 'versions' && parts[5] !== 'secrets') || method !== 'GET')
+                return noRoute();
+            const owner = scriptRow(accountID, scriptName, req.root);
+            if (!owner)
+                return scriptNotFound(scriptName);
+            if (parts[5] === 'secrets') {
+                const secret = scriptSecrets(owner).find((item) => item.name === parts[6]);
+                return secret ? success(secret) : failure(404, 1001, `secret "${parts[6]}" not found on Worker "${scriptName}"`);
+            }
+            const version = versionRows(owner, req.root).find((item) => item.id === parts[6]);
+            return version ? success(versionView(version)) : failure(404, 1001, `version "${parts[6]}" not found on Worker "${scriptName}"`);
+        }
+        if (parts.length === 5 && method === 'PUT')
+            return uploadScript(req, url, accountID, scriptName);
+        // The asset upload session precedes the script's first upload, so it is not gated on the
+        // script existing.
+        if (parts.length === 6 && parts[5] === 'assets-upload-session' && method === 'POST') {
+            const blocked = readOnly(req);
+            if (blocked)
+                return blocked;
+            if (!SCRIPT_NAME_PATTERN.test(scriptName))
+                return failure(400, 1004, 'script_name must match ^[a-z0-9_][a-z0-9-_]*$');
+            const body = parseBody(req);
+            if (isResponse(body))
+                return body;
+            return createAssetsUploadSession(req, accountID, scriptName, body);
+        }
+        const script = scriptRow(accountID, scriptName, req.root);
+        if (parts.length === 5) {
+            if (method === 'GET')
+                return script ? downloadScript(script, req.root) : scriptNotFound(scriptName);
+            if (method === 'DELETE') {
+                if (!script)
+                    return scriptNotFound(scriptName);
+                const blocked = readOnly(req);
+                if (blocked)
+                    return blocked;
+                const force = url.searchParams.get('force') === 'true';
+                const ownNamespaces = namespaceRows(accountID, req.root).filter((item) => item.script === scriptName);
+                const dependents = scriptRows(accountID, req.root).filter((other) => other.name !== scriptName
+                    && (Array.isArray(other.bindings) ? other.bindings : []).some((binding) => binding?.type === 'service' && binding?.service === scriptName));
+                if (!force && (ownNamespaces.length > 0 || dependents.length > 0)) {
+                    // Grounded in the pinned OpenAPI's own `force` description: without force=true, delete
+                    // IS stopped by an associated service binding or durable object.
+                    return failure(400, 1004, `Could not delete script "${scriptName}": it has associated Durable Object namespaces or service bindings; retry with ?force=true`);
+                }
+                for (const namespace of ownNamespaces) {
+                    await pwrite('durable_object_namespace', namespace.id, 'durable_object_namespace.delete', {
+                        account_id: accountID, script: scriptName, deleted: true,
+                    }, req);
+                }
+                await pwrite('worker_script', scriptID(accountID, scriptName), 'worker_script.delete', { account_id: accountID, deleted: true }, req);
+                return success(null);
+            }
+            return noRoute();
+        }
+        // parts.length === 6 — script subresources
+        if (!script)
+            return scriptNotFound(scriptName);
+        if (parts[5] === 'versions') {
+            if (method === 'POST')
+                return uploadVersion(req, url, accountID, scriptName);
+            if (method === 'GET') {
+                const page = paginate(versionRows(script, req.root).map(versionView), url, 10, 100);
+                return success({ items: page.result }, page.info);
+            }
+            return noRoute();
+        }
+        if (parts[5] === 'deployments') {
+            if (method === 'GET') {
+                const deployments = Array.isArray(script.deployments) ? [...script.deployments].reverse() : [];
+                return success({ deployments });
+            }
+            if (method === 'POST')
+                return createDeployment(req, accountID, script);
+            return noRoute();
+        }
+        if (parts[5] === 'secrets' && method === 'GET') {
+            // Secrets are the script's secret bindings; their values are write-only and never listed.
+            return success(scriptSecrets(script));
+        }
+        if (parts[5] === 'settings' && method === 'GET')
+            return success(scriptSettingsView(script));
+        if (parts[5] === 'script-settings') {
+            if (method === 'GET')
+                return success(settingsView(script));
+            if (method === 'PATCH')
+                return patchScriptSettings(req, accountID, script);
+            return noRoute();
+        }
+        if (parts[5] === 'schedules') {
+            if (method === 'GET') {
+                return success({ schedules: Array.isArray(script.schedules) ? script.schedules : [] });
+            }
+            if (method === 'PUT') {
+                const blocked = readOnly(req);
+                if (blocked)
+                    return blocked;
+                let body;
+                try {
+                    body = req.body ? JSON.parse(req.body) : undefined;
+                }
+                catch {
+                    return failure(400, 1004, 'Invalid request body');
+                }
+                if (!Array.isArray(body))
+                    return failure(400, 1004, 'Cron trigger update requires an array of {cron} objects');
+                const at = req.occurredAt ?? new Date().toISOString();
+                const schedules = [];
+                for (const value of body) {
+                    const item = value;
+                    if (!item || typeof item !== 'object' || !str(item.cron))
+                        return failure(400, 1004, 'Each cron trigger requires a nonempty cron expression');
+                    if (!validCron(item.cron))
+                        return failure(400, 1004, `Invalid cron expression "${item.cron}"`);
+                    const previous = (Array.isArray(script.schedules) ? script.schedules : []).find((existing) => existing.cron === item.cron);
+                    schedules.push({ cron: item.cron, created_on: previous?.created_on ?? at, modified_on: at });
+                }
+                await pwrite('worker_script', scriptID(accountID, scriptName), 'worker_script.schedules', { account_id: accountID, schedules }, req);
+                return success({ schedules });
+            }
+            return noRoute();
+        }
+        if (parts[5] === 'subdomain') {
+            const view = () => ({
+                enabled: scriptRow(accountID, scriptName, req.root)?.subdomain_enabled === true,
+                previews_enabled: scriptRow(accountID, scriptName, req.root)?.subdomain_previews_enabled === true,
+            });
+            if (method === 'GET')
+                return success(view());
+            if (method === 'POST') {
+                const blocked = readOnly(req);
+                if (blocked)
+                    return blocked;
+                const body = parseBody(req);
+                if (isResponse(body))
+                    return body;
+                if (typeof body.enabled !== 'boolean')
+                    return failure(400, 1004, 'enabled is required and must be a boolean');
+                if (body.previews_enabled !== undefined && typeof body.previews_enabled !== 'boolean') {
+                    return failure(400, 1004, 'previews_enabled must be a boolean');
+                }
+                await pwrite('worker_script', scriptID(accountID, scriptName), 'worker_script.subdomain', {
+                    account_id: accountID,
+                    subdomain_enabled: body.enabled,
+                    subdomain_previews_enabled: body.previews_enabled ?? (body.enabled ? script.subdomain_previews_enabled === true : false),
+                }, req);
+                return success(view());
+            }
+            if (method === 'DELETE') {
+                const blocked = readOnly(req);
+                if (blocked)
+                    return blocked;
+                await pwrite('worker_script', scriptID(accountID, scriptName), 'worker_script.subdomain', {
+                    account_id: accountID, subdomain_enabled: false, subdomain_previews_enabled: false,
+                }, req);
+                return success(view());
+            }
+            return noRoute();
+        }
+        return noRoute();
+    }
+    if (parts[3] === 'assets' && parts[4] === 'upload' && parts.length === 5 && method === 'POST') {
+        const blocked = readOnly(req);
+        if (blocked)
+            return blocked;
+        return uploadAssets(req, accountID, url, parseMultipart);
+    }
+    if (parts[3] === 'services') {
+        const serviceName = parts[4];
+        if (!serviceName || parts.length !== 5 || method !== 'GET')
+            return noRoute();
+        const script = scriptRow(accountID, serviceName, req.root);
+        return script ? success(serviceView(script)) : scriptNotFound(serviceName);
+    }
+    if (parts[3] === 'subdomain' && parts.length === 4) {
+        const existing = row('workers_subdomain', accountID, req.root);
+        if (method === 'GET') {
+            // An account that never registered a workers.dev subdomain answers 10007 — the code
+            // wrangler's getWorkersDevSubdomain keys its "register one now?" branch on.
+            return existing ? success({ subdomain: existing.subdomain }) : failure(404, 10007, 'workers.api.error.subdomain_not_found: This account does not have a workers.dev subdomain');
+        }
+        if (method === 'PUT') {
+            const blocked = readOnly(req);
+            if (blocked)
+                return blocked;
+            const body = parseBody(req);
+            if (isResponse(body))
+                return body;
+            if (!str(body.subdomain))
+                return failure(400, 1004, 'subdomain is required');
+            const subdomain = body.subdomain.toLowerCase();
+            // workers.dev subdomains are a single DNS label (RFC-1035-shaped).
+            if (!/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/.test(subdomain)) {
+                return failure(400, 1004, 'subdomain must be a valid DNS label (letters, digits, hyphens; 1-63 chars)');
+            }
+            await pwrite('workers_subdomain', accountID, 'workers_subdomain.update', { account_id: accountID, subdomain, deleted: false }, req);
+            return success({ subdomain });
+        }
+        if (method === 'DELETE') {
+            const blocked = readOnly(req);
+            if (blocked)
+                return blocked;
+            if (existing)
+                await pwrite('workers_subdomain', accountID, 'workers_subdomain.delete', { account_id: accountID, deleted: true }, req);
+            return { status: 204, body: null, raw: true };
+        }
+        return noRoute();
+    }
+    if (parts[3] === 'domains') {
+        if (parts.length === 4 && method === 'GET') {
+            let values = rows('worker_domain', req.root).filter((item) => item.account_id === accountID);
+            for (const [param, field] of [['hostname', 'hostname'], ['service', 'service'], ['zone_id', 'zone_id'], ['zone_name', 'zone_name']]) {
+                const filter = url.searchParams.get(param);
+                if (filter)
+                    values = values.filter((item) => item[field] === filter);
+            }
+            // All modeled domains are production; honor the documented `environment` filter.
+            const environment = url.searchParams.get('environment');
+            if (environment)
+                values = environment === 'production' ? values : [];
+            return success(values.map(domainView));
+        }
+        if (parts.length === 4 && method === 'PUT') {
+            const blocked = readOnly(req);
+            if (blocked)
+                return blocked;
+            const body = parseBody(req);
+            if (isResponse(body))
+                return body;
+            if (!str(body.hostname) || !str(body.service))
+                return failure(400, 1004, 'hostname and service are required');
+            const hostname = body.hostname.toLowerCase();
+            const zone = rows('zone', req.root)
+                .filter((item) => item.account_id === accountID && (hostname === item.name || hostname.endsWith(`.${item.name}`)))
+                .sort((a, b) => String(b.name).length - String(a.name).length)[0];
+            if (!zone)
+                return failure(400, 1004, `hostname "${hostname}" is not within a zone on this account`);
+            if (str(body.zone_id) && body.zone_id !== zone.id)
+                return failure(400, 1004, 'zone_id does not match the zone containing hostname');
+            if (str(body.zone_name) && body.zone_name.toLowerCase() !== zone.name)
+                return failure(400, 1004, 'zone_name does not match the zone containing hostname');
+            if (!scriptRow(accountID, body.service, req.root))
+                return failure(400, 1004, `service "${body.service}" is not a Worker on this account`);
+            const existing = rows('worker_domain', req.root).find((item) => item.account_id === accountID && item.hostname === hostname);
+            const id = existing?.id ?? mint('worker_domain', `${accountID}:${hostname}`, req.root);
+            await pwrite('worker_domain', id, existing ? 'worker_domain.update' : 'worker_domain.attach', {
+                account_id: accountID,
+                hostname,
+                service: body.service,
+                zone_id: zone.id,
+                zone_name: zone.name,
+                cert_id: existing?.cert_id ?? uuidFrom(`${accountID}:${hostname}:cert`),
+                deleted: false,
+            }, req);
+            return success(domainView(row('worker_domain', id, req.root)));
+        }
+        const domainID = parts[3] === 'domains' && parts.length === 5 ? parts[4] : undefined;
+        if (!domainID)
+            return noRoute();
+        const domain = row('worker_domain', domainID, req.root);
+        if (!domain || domain.account_id !== accountID)
+            return failure(404, 1001, 'Worker domain not found');
+        if (method === 'GET')
+            return success(domainView(domain));
+        if (method === 'DELETE') {
+            const blocked = readOnly(req);
+            if (blocked)
+                return blocked;
+            await pwrite('worker_domain', domainID, 'worker_domain.detach', { account_id: accountID, deleted: true }, req);
+            // OpenAPI: 200 with the bare success envelope and no result member.
+            return { status: 200, body: { success: true, errors: [], messages: [] } };
+        }
+        return noRoute();
+    }
+    if (parts[3] === 'durable_objects' && parts[4] === 'namespaces' && parts.length === 5 && method === 'GET') {
+        const page = paginate(namespaceRows(accountID, req.root).map(namespaceView), url, 20, 1000);
+        return success(page.result, page.info);
+    }
+    return noRoute();
+}
+async function routesRoute(req, method, parts, zoneID, accountID) {
+    const zoneRoutes = () => rows('worker_route', req.root).filter((item) => item.zone_id === zoneID);
+    const scriptMissing = (script) => str(script) && !scriptRow(accountID, script, req.root)
+        ? failure(400, 10007, `script "${String(script)}" is not a Worker on this account`) : null;
+    if (parts.length === 4 && method === 'GET')
+        return success(zoneRoutes().map(routeView));
+    if (parts.length === 4 && method === 'POST') {
+        const blocked = readOnly(req);
+        if (blocked)
+            return blocked;
+        const body = parseBody(req);
+        if (isResponse(body))
+            return body;
+        if (!str(body.pattern))
+            return failure(400, 1004, 'pattern is required');
+        if (body.script !== undefined && !str(body.script))
+            return failure(400, 1004, 'script must be a nonempty string');
+        const missing = scriptMissing(body.script);
+        if (missing)
+            return missing;
+        if (zoneRoutes().some((item) => item.pattern === body.pattern))
+            return failure(409, 1003, 'A route with this pattern already exists');
+        const id = mint('worker_route', `${zoneID}:${body.pattern}`, req.root);
+        await pwrite('worker_route', id, 'worker_route.create', {
+            zone_id: zoneID, pattern: body.pattern, ...(str(body.script) ? { script: body.script } : {}), deleted: false,
+        }, req);
+        return success(routeView(row('worker_route', id, req.root)));
+    }
+    const routeID = parts[4];
+    if (!routeID || parts.length !== 5)
+        return noRoute();
+    const route = row('worker_route', routeID, req.root);
+    if (!route || route.zone_id !== zoneID)
+        return failure(404, 1001, 'Route not found');
+    if (method === 'GET')
+        return success(routeView(route));
+    if (method === 'PUT') {
+        const blocked = readOnly(req);
+        if (blocked)
+            return blocked;
+        const body = parseBody(req);
+        if (isResponse(body))
+            return body;
+        if (!str(body.pattern))
+            return failure(400, 1004, 'pattern is required');
+        if (body.script !== undefined && !str(body.script))
+            return failure(400, 1004, 'script must be a nonempty string');
+        const missing = scriptMissing(body.script);
+        if (missing)
+            return missing;
+        if (zoneRoutes().some((item) => item.id !== routeID && item.pattern === body.pattern)) {
+            return failure(409, 1003, 'A route with this pattern already exists');
+        }
+        await pwrite('worker_route', routeID, 'worker_route.update', {
+            zone_id: zoneID, pattern: body.pattern, script: str(body.script) ? body.script : null,
+        }, req);
+        return success(routeView(row('worker_route', routeID, req.root)));
+    }
+    if (method === 'DELETE') {
+        const blocked = readOnly(req);
+        if (blocked)
+            return blocked;
+        await pwrite('worker_route', routeID, 'worker_route.delete', { zone_id: zoneID, deleted: true }, req);
+        return success({ id: routeID });
+    }
+    return noRoute();
+}
+// Who may call R2's REST routes the lane relies on (temporary credentials, custom domains). R2's troubleshooting page
+// (https://developers.cloudflare.com/r2/platform/troubleshooting/): an R2 API token with Object Read & Write or Object
+// Read only "against the Cloudflare REST API ... return one of the following: When the token applies to all buckets:
+// {"code":10002,"message":"Unauthorized"} (HTTP 401). When the token is scoped to specific buckets:
+// {"code":10000,"message":"Authentication error"} (HTTP 403)", and "To use the REST API, authenticate with an Admin Read &
+// Write or Admin Read only token". A user API token of an Administrator or Super Administrator member serves too ("User API
+// tokens ... inherit your personal permissions", R2 API tokens). Where Cloudflare's pages are silent, the twin's choice:
+// any other bearer, and an Admin Read only token on a write, answer 10000 Authentication error (HTTP 403). The rest of the
+// pack's routes keep accepting any bearer: a cloudflare-pack defect, fixed when that pack migrates.
+const R2_API_ROLES = new Set([deterministicHex('cf-role:Super Administrator - All Privileges', 32), deterministicHex('cf-role:Administrator', 32)]);
+function r2ApiRefusal(req, accountID, write) {
+    const bearer = /^Bearer\s+(\S+)$/i.exec(lowerHeaders(req.headers).authorization ?? '')?.[1] ?? '';
+    const denied = failure(403, 10000, 'Authentication error');
+    const token = bearer ? r2BearerToken(accountID, bearer, req.root) : undefined;
+    if (token) {
+        if (token.permission === 'object-rw' || token.permission === 'object-ro')
+            return token.buckets === '*' ? failure(401, 10002, 'Unauthorized') : denied;
+        return write && token.permission === 'admin-ro' ? denied : null;
+    }
+    const user = rows('user_token', req.root).find((u) => u.token === bearer);
+    const member = user ? rows('account_member', req.root).find((m) => m.account_id === accountID && m.email === user.email && m.status !== 'pending') : undefined;
+    return member && (member.role_ids ?? []).some((r) => R2_API_ROLES.has(r)) ? null : denied;
+}
+async function r2Route(req, method, url, parts, accountID) {
+    if (parts[3] === 'temp-access-credentials' && parts.length === 4 && method === 'POST')
+        return r2ApiRefusal(req, accountID, true) ?? r2TempCredentialsRoute(req, accountID);
+    if (parts[3] !== 'buckets')
+        return noRoute();
+    const jurisdictionHeader = lowerHeaders(req.headers)['cf-r2-jurisdiction'];
+    if (jurisdictionHeader !== undefined && !R2_JURISDICTIONS.has(jurisdictionHeader)) {
+        return failure(400, 1004, 'cf-r2-jurisdiction must be default, eu, or fedramp');
+    }
+    const accountBuckets = () => rows('r2_bucket', req.root).filter((item) => item.account_id === accountID);
+    if (parts.length === 4 && method === 'GET') {
+        let values = accountBuckets();
+        const nameContains = url.searchParams.get('name_contains');
+        if (nameContains)
+            values = values.filter((item) => String(item.name).includes(nameContains));
+        values = values.sort((a, b) => String(a.name).localeCompare(String(b.name)));
+        if (url.searchParams.get('direction') === 'desc')
+            values = values.reverse();
+        const startAfter = url.searchParams.get('start_after');
+        if (startAfter) {
+            const index = values.findIndex((item) => item.name === startAfter);
+            values = index >= 0 ? values.slice(index + 1) : values;
+        }
+        const perPage = Math.min(1000, Math.max(1, Number(url.searchParams.get('per_page') ?? 20) || 20));
+        return success({ buckets: values.slice(0, perPage).map(bucketView) });
+    }
+    if (parts.length === 4 && method === 'POST') {
+        const blocked = readOnly(req);
+        if (blocked)
+            return blocked;
+        const body = parseBody(req);
+        if (isResponse(body))
+            return body;
+        if (!str(body.name) || body.name.length < 3 || body.name.length > 64 || !BUCKET_NAME_PATTERN.test(body.name)) {
+            return failure(400, 1004, 'name must be 3-64 characters of lowercase letters, numbers, and hyphens');
+        }
+        if (body.locationHint !== undefined && (!str(body.locationHint) || !R2_LOCATIONS.has(body.locationHint))) {
+            return failure(400, 1004, 'locationHint must be one of apac, eeur, enam, weur, wnam, oc');
+        }
+        if (body.storageClass !== undefined && (!str(body.storageClass) || !R2_STORAGE_CLASSES.has(body.storageClass))) {
+            return failure(400, 1004, 'storageClass must be Standard or InfrequentAccess');
+        }
+        if (accountBuckets().some((item) => item.name === body.name)) {
+            return failure(409, 10004, 'The bucket you tried to create already exists, and you own it.');
+        }
+        const at = req.occurredAt ?? new Date().toISOString();
+        await pwrite('r2_bucket', `${accountID}:${body.name}`, 'r2_bucket.create', {
+            account_id: accountID,
+            name: body.name,
+            creation_date: at,
+            ...(str(body.locationHint) ? { location: body.locationHint } : { location: null }),
+            storage_class: body.storageClass ?? 'Standard',
+            jurisdiction: jurisdictionHeader ?? 'default',
+            deleted: false,
+        }, req);
+        return success(bucketView(row('r2_bucket', `${accountID}:${body.name}`, req.root)));
+    }
+    const bucketName = parts[4];
+    if (!bucketName)
+        return noRoute();
+    const bucket = row('r2_bucket', `${accountID}:${bucketName}`, req.root);
+    if (!bucket)
+        return failure(404, 10006, 'The specified bucket does not exist.');
+    if (parts[5] === 'domains' && parts[6] === 'custom')
+        return r2ApiRefusal(req, accountID, method !== 'GET') ?? r2CustomDomainRoute(req, method, parts, accountID, bucketName);
+    if (parts.length !== 5)
+        return noRoute();
+    if (method === 'GET')
+        return success(bucketView(bucket));
+    if (method === 'DELETE') {
+        const blocked = readOnly(req);
+        if (blocked)
+            return blocked;
+        // one bucket, whether the S3 API or this API made it (cloudflare-r2.ts): a bucket that holds objects is not deleted
+        // (https://developers.cloudflare.com/r2/api/error-codes/: "10008 BucketNotEmpty 409 Cannot delete bucket that
+        // contains objects.")
+        if (rows('r2_object', req.root).some((o) => o.bucket_id === `${accountID}:${bucketName}`))
+            return failure(409, 10008, 'Cannot delete bucket that contains objects.');
+        await pwrite('r2_bucket', `${accountID}:${bucketName}`, 'r2_bucket.delete', { account_id: accountID, deleted: true }, req);
+        // "The specified domain will also remain connected to R2 until you remove it or delete the bucket." (public buckets)
+        for (const d of r2CustomDomains(req.root).filter((x) => x.account_id === accountID && x.bucket === bucketName))
+            await removeR2CustomDomain(d.id, req.root, req.occurredAt ?? new Date().toISOString());
+        return success({});
+    }
+    return noRoute();
+}
+// R2's Temporary Credentials API (https://developers.cloudflare.com/api/resources/r2/subresources/temporary_credentials/methods/create/):
+// POST /accounts/{account_id}/r2/temp-access-credentials {bucket, parentAccessKeyId, permission, ttlSeconds (up to
+// 604800), prefixes?, objects?}, answering {accessKeyId, secretAccessKey, sessionToken}. The reference declares a generic
+// error envelope only, so a refusal takes the pack's 1004 validation convention.
+async function r2TempCredentialsRoute(req, accountID) {
+    const blocked = readOnly(req);
+    if (blocked)
+        return blocked;
+    const body = parseBody(req);
+    if (isResponse(body))
+        return body;
+    if (!str(body.bucket) || !row('r2_bucket', `${accountID}:${body.bucket}`, req.root))
+        return failure(404, 10006, 'The specified bucket does not exist.');
+    const permission = TEMP_PERMISSIONS[String(body.permission)];
+    if (!permission)
+        return failure(400, 1004, 'permission must be one of admin-read-write, admin-read-only, object-read-write, object-read-only');
+    const ttl = Number(body.ttlSeconds);
+    if (!Number.isInteger(ttl) || ttl < 1 || ttl > 604800)
+        return failure(400, 1004, 'ttlSeconds must be a whole number of seconds up to 604800');
+    const parent = str(body.parentAccessKeyId) ? r2Credential(accountID, body.parentAccessKeyId, req.root) : undefined;
+    if (!parent)
+        return failure(400, 1004, 'parentAccessKeyId must name a live R2 API token of the account');
+    // "A temporary credential cannot exceed the permissions of its parent token"
+    if (!r2ParentCovers(parent, permission, body.bucket))
+        return failure(400, 1004, 'The temporary credentials cannot exceed the parent token\'s permissions');
+    const list = (v) => (v === undefined ? [] : Array.isArray(v) && v.every((x) => typeof x === 'string') ? v : undefined);
+    const prefixes = list(body.prefixes);
+    const objects = list(body.objects);
+    if (!prefixes || !objects)
+        return failure(400, 1004, 'prefixes and objects must be lists of strings');
+    const c = await createR2TempCredential({ accountId: accountID, bucket: body.bucket, parent, permission, ttlSeconds: ttl, prefixes, objects }, req.root, req.occurredAt ?? new Date().toISOString());
+    return success({ accessKeyId: c.access_key_id, secretAccessKey: c.secret_access_key, sessionToken: c.session_token });
+}
+// R2 custom domains (https://developers.cloudflare.com/api/resources/r2/subresources/buckets/subresources/domains/subresources/custom/):
+// attach (POST {domain, enabled, zoneId, minTLS?, ciphers?}), list, get, configure (PUT) and remove, each answered in the
+// shapes the reference gives. A domain belongs to a zone of the bucket's account (public buckets: "The domain being used
+// must have been added as a zone in the same account as the R2 bucket"); its status turns Active by Cloudflare's own move
+// (cloudflare-r2.ts). The reference declares only a generic error envelope, so a refusal takes the pack's 1004 validation
+// and 1001 not-found conventions.
+const TLS_VERSIONS = new Set(['1.0', '1.1', '1.2', '1.3']);
+async function r2CustomDomainRoute(req, method, parts, accountID, bucketName) {
+    const at = req.occurredAt ?? new Date().toISOString();
+    await catchUpR2CustomDomains(req.root, at);
+    const mine = () => r2CustomDomains(req.root).filter((d) => d.account_id === accountID && d.bucket === bucketName);
+    const full = (d) => ({ domain: d.domain, enabled: d.enabled, status: { ownership: d.ownership, ssl: d.ssl }, minTLS: d.min_tls, ...(d.ciphers ? { ciphers: d.ciphers } : {}), zoneId: d.zone_id, zoneName: d.zone_name });
+    if (parts.length === 7 && method === 'GET')
+        return success({ domains: mine().map(full) });
+    if (parts.length === 7 && method === 'POST') {
+        const blocked = readOnly(req);
+        if (blocked)
+            return blocked;
+        const body = parseBody(req);
+        if (isResponse(body))
+            return body;
+        if (!str(body.domain) || !str(body.zoneId))
+            return failure(400, 1004, 'domain and zoneId are required');
+        const domain = body.domain.toLowerCase();
+        const zone = row('zone', body.zoneId, req.root);
+        if (!zone || zone.account_id !== accountID)
+            return failure(400, 1004, 'zoneId must name a zone in the same account as the bucket');
+        const zoneName = String(zone.name);
+        if (domain !== zoneName && !domain.endsWith(`.${zoneName}`))
+            return failure(400, 1004, `domain must be ${zoneName} or a subdomain of it`);
+        if (body.minTLS !== undefined && !TLS_VERSIONS.has(String(body.minTLS)))
+            return failure(400, 1004, 'minTLS must be one of 1.0, 1.1, 1.2, 1.3');
+        if (r2CustomDomains(req.root).some((d) => d.domain === domain))
+            return failure(409, 1004, `${domain} is already connected to a bucket`);
+        const d = await connectR2CustomDomain({ accountId: accountID, bucket: bucketName, domain, enabled: body.enabled !== false, zoneId: body.zoneId, zoneName, ...(body.minTLS !== undefined ? { minTLS: String(body.minTLS) } : {}), ...(Array.isArray(body.ciphers) ? { ciphers: body.ciphers.map(String) } : {}) }, req.root, at);
+        return success({ domain: d.domain, enabled: d.enabled, zoneId: d.zone_id, minTLS: d.min_tls, ...(d.ciphers ? { ciphers: d.ciphers } : {}) });
+    }
+    if (parts.length !== 8)
+        return noRoute();
+    const d = mine().find((x) => x.domain === parts[7].toLowerCase());
+    if (!d)
+        return failure(404, 1001, `The custom domain ${parts[7]} is not connected to this bucket`);
+    if (method === 'GET')
+        return success(full(d));
+    const blocked = readOnly(req);
+    if (blocked)
+        return blocked;
+    if (method === 'PUT') {
+        const body = parseBody(req);
+        if (isResponse(body))
+            return body;
+        if (body.minTLS !== undefined && !TLS_VERSIONS.has(String(body.minTLS)))
+            return failure(400, 1004, 'minTLS must be one of 1.0, 1.1, 1.2, 1.3');
+        await updateR2CustomDomain(d.id, { ...(typeof body.enabled === 'boolean' ? { enabled: body.enabled } : {}), ...(body.minTLS !== undefined ? { minTLS: String(body.minTLS) } : {}), ...(Array.isArray(body.ciphers) ? { ciphers: body.ciphers.map(String) } : {}) }, req.root, at);
+        const now = mine().find((x) => x.id === d.id);
+        return success({ domain: now.domain, enabled: now.enabled, minTLS: now.min_tls, ...(now.ciphers ? { ciphers: now.ciphers } : {}) });
+    }
+    if (method === 'DELETE') {
+        await removeR2CustomDomain(d.id, req.root, at);
+        return success({ domain: d.domain });
+    }
+    return noRoute();
+}
+function validHyperdriveOrigin(origin) {
+    if (!origin || typeof origin !== 'object' || Array.isArray(origin))
+        return failure(400, 1004, 'origin is required and must be an object');
+    const value = origin;
+    if (!str(value.scheme) || !HYPERDRIVE_SCHEMES.has(value.scheme))
+        return failure(400, 1004, 'origin.scheme must be postgres, postgresql, or mysql');
+    if (!str(value.database) || !str(value.user) || !str(value.password)) {
+        return failure(400, 1004, 'origin requires database, user, and password');
+    }
+    const isAccess = str(value.access_client_id) || str(value.access_client_secret);
+    const isVpc = str(value.service_id);
+    if (isAccess && isVpc)
+        return failure(400, 1004, 'origin cannot mix Access and VPC fields');
+    if (isVpc) {
+        // Database reachable through a Workers VPC — recorded, never dialed.
+        return { origin: { database: value.database, scheme: value.scheme, service_id: value.service_id, user: value.user } };
+    }
+    if (isAccess) {
+        if (!str(value.access_client_id) || !str(value.access_client_secret)) {
+            return failure(400, 1004, 'Access-protected origin requires access_client_id and access_client_secret');
+        }
+        if (!str(value.host))
+            return failure(400, 1004, 'origin.host is required');
+        // access_client_secret is writeOnly in the vendor schema: recorded config, never echoed.
+        return { origin: { access_client_id: value.access_client_id, database: value.database, host: value.host, scheme: value.scheme, user: value.user } };
+    }
+    if (!str(value.host))
+        return failure(400, 1004, 'origin.host is required');
+    if (!Number.isInteger(value.port) || Number(value.port) < 1 || Number(value.port) > 65535) {
+        return failure(400, 1004, 'origin.port must be an integer between 1 and 65535');
+    }
+    return { origin: { database: value.database, host: value.host, port: value.port, scheme: value.scheme, user: value.user } };
+}
+// PATCH accepts the vendor's TYPED PARTIAL edit-origin (SDK ConfigEditParams): any subset of the
+// non-secret origin fields, each validated if present. Secrets (password/access_client_secret)
+// are writeOnly — accepted-if-string but never stored/echoed. The caller merges the returned
+// partial over the existing origin.
+function validPartialHyperdriveOrigin(origin) {
+    if (!origin || typeof origin !== 'object' || Array.isArray(origin))
+        return failure(400, 1004, 'origin must be an object');
+    const value = origin;
+    if (value.scheme !== undefined && (!str(value.scheme) || !HYPERDRIVE_SCHEMES.has(value.scheme))) {
+        return failure(400, 1004, 'origin.scheme must be postgres, postgresql, or mysql');
+    }
+    if (value.port !== undefined && (!Number.isInteger(value.port) || Number(value.port) < 1 || Number(value.port) > 65535)) {
+        return failure(400, 1004, 'origin.port must be an integer between 1 and 65535');
+    }
+    for (const key of ['database', 'user', 'host', 'access_client_id', 'service_id']) {
+        if (value[key] !== undefined && !str(value[key]))
+            return failure(400, 1004, `origin.${key} must be a nonempty string`);
+    }
+    for (const secret of ['password', 'access_client_secret']) {
+        if (value[secret] !== undefined && !str(value[secret]))
+            return failure(400, 1004, `origin.${secret} must be a nonempty string`);
+    }
+    const partial = {};
+    for (const key of ['scheme', 'database', 'user', 'host', 'port', 'access_client_id', 'service_id']) {
+        if (value[key] !== undefined)
+            partial[key] = value[key];
+    }
+    return { origin: partial };
+}
+// After a PATCH merges a typed partial over the stored origin, the RESULT must still be exactly
+// one of the vendor's origin variants — a partial edit must not produce a hybrid the create path
+// could never make (e.g. an Access origin that grew a `port`, or a VPC origin with a host)
+// (round-two N1). Secrets are absent from a stored origin by design, so this is password-exempt.
+function validMergedOrigin(origin) {
+    if (!str(origin.scheme) || !HYPERDRIVE_SCHEMES.has(String(origin.scheme)))
+        return failure(400, 1004, 'origin.scheme must be postgres, postgresql, or mysql');
+    if (!str(origin.database) || !str(origin.user))
+        return failure(400, 1004, 'origin requires database and user');
+    const hasService = str(origin.service_id);
+    const hasAccess = str(origin.access_client_id);
+    const hasHost = str(origin.host);
+    const hasPort = origin.port !== undefined;
+    if (hasService) {
+        if (hasHost || hasPort || hasAccess)
+            return failure(400, 1004, 'a VPC origin cannot also carry host, port, or Access fields');
+        return null;
+    }
+    if (hasAccess) {
+        if (!hasHost)
+            return failure(400, 1004, 'an Access-protected origin requires host');
+        if (hasPort)
+            return failure(400, 1004, 'an Access-protected origin cannot carry a port');
+        return null;
+    }
+    if (!hasHost || !hasPort)
+        return failure(400, 1004, 'a public origin requires host and port');
+    if (!Number.isInteger(origin.port) || Number(origin.port) < 1 || Number(origin.port) > 65535)
+        return failure(400, 1004, 'origin.port must be an integer between 1 and 65535');
+    return null;
+}
+// caching/mtls are closed vendor sub-schemas — validate known keys' types and REJECT unknown
+// keys so the twin never records-and-echoes a shape the SDK's own types cannot hold (finding-9).
+function validCaching(caching) {
+    if (caching === undefined)
+        return null;
+    if (!caching || typeof caching !== 'object' || Array.isArray(caching))
+        return failure(400, 1004, 'caching must be an object');
+    for (const [key, value] of Object.entries(caching)) {
+        if (key === 'disabled') {
+            if (typeof value !== 'boolean')
+                return failure(400, 1004, 'caching.disabled must be a boolean');
+        }
+        else if (key === 'max_age' || key === 'stale_while_revalidate') {
+            if (typeof value !== 'number')
+                return failure(400, 1004, `caching.${key} must be a number`);
+        }
+        else
+            return failure(400, 1004, `caching.${key} is not a valid caching option`);
+    }
+    return null;
+}
+function validMtls(mtls) {
+    if (mtls === undefined)
+        return null;
+    if (!mtls || typeof mtls !== 'object' || Array.isArray(mtls))
+        return failure(400, 1004, 'mtls must be an object');
+    for (const [key, value] of Object.entries(mtls)) {
+        if (key === 'ca_certificate_id' || key === 'mtls_certificate_id' || key === 'sslmode') {
+            if (typeof value !== 'string')
+                return failure(400, 1004, `mtls.${key} must be a string`);
+        }
+        else
+            return failure(400, 1004, `mtls.${key} is not a valid mtls option`);
+    }
+    return null;
+}
+async function hyperdriveRoute(req, method, url, parts, accountID) {
+    if (parts[3] !== 'configs')
+        return noRoute();
+    const accountConfigs = () => rows('hyperdrive_config', req.root).filter((item) => item.account_id === accountID);
+    const validateWrite = (body) => {
+        if (!str(body.name))
+            return failure(400, 1004, 'name is required');
+        const caching = validCaching(body.caching);
+        if (caching)
+            return caching;
+        const mtls = validMtls(body.mtls);
+        if (mtls)
+            return mtls;
+        if (body.origin_connection_limit !== undefined && (!Number.isInteger(body.origin_connection_limit) || Number(body.origin_connection_limit) < 5)) {
+            return failure(400, 1004, 'origin_connection_limit must be an integer >= 5');
+        }
+        return validHyperdriveOrigin(body.origin);
+    };
+    if (parts.length === 4 && method === 'GET') {
+        const page = paginate(accountConfigs().map(hyperdriveView), url, 20, 100);
+        return success(page.result, page.info);
+    }
+    if (parts.length === 4 && method === 'POST') {
+        const blocked = readOnly(req);
+        if (blocked)
+            return blocked;
+        const body = parseBody(req);
+        if (isResponse(body))
+            return body;
+        const checked = validateWrite(body);
+        if (isResponse(checked))
+            return checked;
+        const at = req.occurredAt ?? new Date().toISOString();
+        const id = mint('hyperdrive_config', `${accountID}:${body.name}`, req.root);
+        await pwrite('hyperdrive_config', id, 'hyperdrive_config.create', {
+            account_id: accountID,
+            name: body.name,
+            origin: checked.origin,
+            ...(body.caching !== undefined ? { caching: body.caching } : {}),
+            ...(body.mtls !== undefined ? { mtls: body.mtls } : {}),
+            ...(body.origin_connection_limit !== undefined ? { origin_connection_limit: body.origin_connection_limit } : {}),
+            created_on: at,
+            modified_on: at,
+            deleted: false,
+        }, req);
+        return success(hyperdriveView(row('hyperdrive_config', id, req.root)));
+    }
+    const hyperdriveID = parts[4];
+    if (!hyperdriveID || parts.length !== 5)
+        return noRoute();
+    const config = row('hyperdrive_config', hyperdriveID, req.root);
+    if (!config || config.account_id !== accountID)
+        return failure(404, 1001, 'Hyperdrive configuration not found');
+    if (method === 'GET')
+        return success(hyperdriveView(config));
+    if (method === 'PUT') {
+        const blocked = readOnly(req);
+        if (blocked)
+            return blocked;
+        const body = parseBody(req);
+        if (isResponse(body))
+            return body;
+        const checked = validateWrite(body);
+        if (isResponse(checked))
+            return checked;
+        await pwrite('hyperdrive_config', hyperdriveID, 'hyperdrive_config.replace', {
+            account_id: accountID,
+            name: body.name,
+            origin: checked.origin,
+            caching: body.caching ?? null,
+            mtls: body.mtls ?? null,
+            origin_connection_limit: typeof body.origin_connection_limit === 'number' ? body.origin_connection_limit : null,
+            modified_on: req.occurredAt ?? new Date().toISOString(),
+        }, req);
+        return success(hyperdriveView(row('hyperdrive_config', hyperdriveID, req.root)));
+    }
+    if (method === 'PATCH') {
+        const blocked = readOnly(req);
+        if (blocked)
+            return blocked;
+        const body = parseBody(req);
+        if (isResponse(body))
+            return body;
+        if (body.name !== undefined && !str(body.name))
+            return failure(400, 1004, 'name must be a nonempty string');
+        const caching = validCaching(body.caching);
+        if (caching)
+            return caching;
+        const mtls = validMtls(body.mtls);
+        if (mtls)
+            return mtls;
+        if (body.origin_connection_limit !== undefined && (!Number.isInteger(body.origin_connection_limit) || Number(body.origin_connection_limit) < 5)) {
+            return failure(400, 1004, 'origin_connection_limit must be an integer >= 5');
+        }
+        let origin;
+        if (body.origin !== undefined) {
+            // PATCH merges the typed partial edit-origin over the existing origin (the vendor's edit
+            // union is partial; requiring the full create-shape here spuriously 400s the SDK's own
+            // typed partial — finding-4).
+            const checked = validPartialHyperdriveOrigin(body.origin);
+            if (isResponse(checked))
+                return checked;
+            origin = { ...config.origin, ...checked.origin };
+            const coherent = validMergedOrigin(origin);
+            if (coherent)
+                return coherent;
+        }
+        await pwrite('hyperdrive_config', hyperdriveID, 'hyperdrive_config.update', {
+            account_id: accountID,
+            ...(body.name !== undefined ? { name: body.name } : {}),
+            ...(origin !== undefined ? { origin } : {}),
+            ...(body.caching !== undefined ? { caching: body.caching } : {}),
+            ...(body.mtls !== undefined ? { mtls: body.mtls } : {}),
+            ...(body.origin_connection_limit !== undefined ? { origin_connection_limit: body.origin_connection_limit } : {}),
+            modified_on: req.occurredAt ?? new Date().toISOString(),
+        }, req);
+        return success(hyperdriveView(row('hyperdrive_config', hyperdriveID, req.root)));
+    }
+    if (method === 'DELETE') {
+        const blocked = readOnly(req);
+        if (blocked)
+            return blocked;
+        await pwrite('hyperdrive_config', hyperdriveID, 'hyperdrive_config.delete', { account_id: accountID, deleted: true }, req);
+        return success(null);
+    }
+    return noRoute();
+}
+function validConsumerBody(body) {
+    if (body.type !== 'worker' && body.type !== 'http_pull')
+        return failure(400, 1004, 'type must be worker or http_pull');
+    if (body.type === 'worker' && !str(body.script_name))
+        return failure(400, 1004, 'worker consumers require script_name');
+    if (body.dead_letter_queue !== undefined && !str(body.dead_letter_queue))
+        return failure(400, 1004, 'dead_letter_queue must be a nonempty string');
+    if (body.settings !== undefined && (body.settings === null || typeof body.settings !== 'object' || Array.isArray(body.settings))) {
+        return failure(400, 1004, 'settings must be an object');
+    }
+    const allowed = body.type === 'worker'
+        ? new Set(['batch_size', 'max_concurrency', 'max_retries', 'max_wait_time_ms', 'retry_delay'])
+        : new Set(['batch_size', 'max_retries', 'retry_delay', 'visibility_timeout_ms']);
+    // ONLY max_concurrency is documented nullable ("set to null to opt into the platform maximum");
+    // every other setting is a plain number — accepting null for them would record-and-echo a shape
+    // the SDK's own types cannot hold (round-two N2).
+    for (const [key, value] of Object.entries(body.settings ?? {})) {
+        if (!allowed.has(key))
+            return failure(400, 1004, `settings.${key} is not a valid ${String(body.type)} consumer setting`);
+        if (key === 'max_concurrency') {
+            if (value !== null && typeof value !== 'number')
+                return failure(400, 1004, 'settings.max_concurrency must be a number or null');
+        }
+        else if (typeof value !== 'number') {
+            return failure(400, 1004, `settings.${key} must be a number`);
+        }
+    }
+    return null;
+}
+async function queuesRoute(req, method, parts, accountID) {
+    const accountQueues = () => rows('queue', req.root).filter((item) => item.account_id === accountID);
+    if (parts.length === 3 && method === 'GET')
+        return success(accountQueues().map((item) => queueView(item, req.root)));
+    if (parts.length === 3 && method === 'POST') {
+        const blocked = readOnly(req);
+        if (blocked)
+            return blocked;
+        const body = parseBody(req);
+        if (isResponse(body))
+            return body;
+        if (!str(body.queue_name))
+            return failure(400, 1004, 'queue_name is required');
+        if (accountQueues().some((item) => item.queue_name === body.queue_name)) {
+            return failure(400, 1004, `A queue named "${body.queue_name}" already exists on this account`);
+        }
+        const at = req.occurredAt ?? new Date().toISOString();
+        const id = mint('queue', `${accountID}:${body.queue_name}`, req.root);
+        await pwrite('queue', id, 'queue.create', {
+            account_id: accountID, queue_name: body.queue_name, created_on: at, modified_on: at, deleted: false,
+        }, req);
+        return success(queueView(row('queue', id, req.root), req.root));
+    }
+    const queueID = parts[3];
+    if (!queueID)
+        return noRoute();
+    const queue = row('queue', queueID, req.root);
+    if (!queue || queue.account_id !== accountID)
+        return failure(404, 1001, 'Queue not found');
+    if (parts.length === 4) {
+        if (method === 'GET')
+            return success(queueView(queue, req.root));
+        if (method === 'DELETE') {
+            const blocked = readOnly(req);
+            if (blocked)
+                return blocked;
+            for (const consumer of rows('queue_consumer', req.root).filter((item) => item.queue_id === queueID)) {
+                await pwrite('queue_consumer', consumer.id, 'queue_consumer.delete', { queue_id: queueID, deleted: true }, req);
+            }
+            await pwrite('queue', queueID, 'queue.delete', { account_id: accountID, deleted: true }, req);
+            // Pinned OpenAPI QueueDeleteResponse: bare {success,errors,messages}, no result member.
+            return { status: 200, body: { success: true, errors: [], messages: [] } };
+        }
+        return noRoute();
+    }
+    if (parts[4] !== 'consumers')
+        return noRoute();
+    const queueConsumers = () => rows('queue_consumer', req.root).filter((item) => item.queue_id === queueID);
+    if (parts.length === 5 && method === 'GET')
+        return success(queueConsumers().map((item) => consumerView(item, req.root)));
+    if (parts.length === 5 && method === 'POST') {
+        const blocked = readOnly(req);
+        if (blocked)
+            return blocked;
+        const body = parseBody(req);
+        if (isResponse(body))
+            return body;
+        const invalid = validConsumerBody(body);
+        if (invalid)
+            return invalid;
+        if (body.type === 'worker' && !scriptRow(accountID, String(body.script_name), req.root)) {
+            return failure(400, 1004, `script_name "${body.script_name}" is not a Worker on this account`);
+        }
+        if (str(body.dead_letter_queue) && !rows('queue', req.root).some((item) => item.account_id === accountID && item.queue_name === body.dead_letter_queue)) {
+            return failure(400, 1004, `dead_letter_queue "${body.dead_letter_queue}" is not a queue on this account`);
+        }
+        // A Cloudflare queue has at most one consumer (worker and http_pull are mutually exclusive).
+        if (queueConsumers().length > 0)
+            return failure(400, 1004, 'This queue already has a consumer; delete it before adding another');
+        const at = req.occurredAt ?? new Date().toISOString();
+        const id = mint('queue_consumer', `${queueID}:${String(body.script_name ?? 'http_pull')}`, req.root);
+        await pwrite('queue_consumer', id, 'queue_consumer.create', {
+            account_id: accountID,
+            queue_id: queueID,
+            consumer_type: body.type,
+            ...(body.type === 'worker' ? { script_name: body.script_name } : {}),
+            ...(str(body.dead_letter_queue) ? { dead_letter_queue: body.dead_letter_queue } : {}),
+            settings: body.settings ?? {},
+            created_on: at,
+            deleted: false,
+        }, req);
+        return success(consumerView(row('queue_consumer', id, req.root), req.root));
+    }
+    const consumerID = parts[5];
+    if (!consumerID || parts.length !== 6)
+        return noRoute();
+    const consumer = row('queue_consumer', consumerID, req.root);
+    if (!consumer || consumer.queue_id !== queueID)
+        return failure(404, 1001, 'Consumer not found');
+    if (method === 'GET')
+        return success(consumerView(consumer, req.root));
+    if (method === 'PUT') {
+        const blocked = readOnly(req);
+        if (blocked)
+            return blocked;
+        const body = parseBody(req);
+        if (isResponse(body))
+            return body;
+        const invalid = validConsumerBody(body);
+        if (invalid)
+            return invalid;
+        if (body.type === 'worker' && !scriptRow(accountID, String(body.script_name), req.root)) {
+            return failure(400, 1004, `script_name "${body.script_name}" is not a Worker on this account`);
+        }
+        if (str(body.dead_letter_queue) && !rows('queue', req.root).some((item) => item.account_id === accountID && item.queue_name === body.dead_letter_queue)) {
+            return failure(400, 1004, `dead_letter_queue "${body.dead_letter_queue}" is not a queue on this account`);
+        }
+        await pwrite('queue_consumer', consumerID, 'queue_consumer.update', {
+            account_id: accountID,
+            queue_id: queueID,
+            consumer_type: body.type,
+            script_name: body.type === 'worker' ? body.script_name : null,
+            dead_letter_queue: str(body.dead_letter_queue) ? body.dead_letter_queue : null,
+            settings: body.settings ?? {},
+        }, req);
+        return success(consumerView(row('queue_consumer', consumerID, req.root), req.root));
+    }
+    if (method === 'DELETE') {
+        const blocked = readOnly(req);
+        if (blocked)
+            return blocked;
+        await pwrite('queue_consumer', consumerID, 'queue_consumer.delete', { queue_id: queueID, deleted: true }, req);
+        // Pinned OpenAPI ConsumerDeleteResponse: bare {success,errors,messages}, no result member.
+        return { status: 200, body: { success: true, errors: [], messages: [] } };
+    }
+    return noRoute();
+}