void 0.10.10 → 0.10.11

package/dist/provision-BLrCEBbI.mjs

@@ -0,0 +1,2557 @@
+import { a as join, c as resolve, n as dirname, o as normalize, t as basename } from "./dist-DaKKDf8D.mjs";
+import { b as readProvisionedBindingEntry, f as assertNoDuplicateMembers, w as writeProvisionedWranglerConfig } from "./deploy-DT8wsPZd.mjs";
+import { i as voidWarn, r as voidLog } from "./log-ChfPKsVd.mjs";
+import { o as resolveWranglerArgv, u as scanWranglerDotenvKeys } from "./preset-BGrvB4Bl.mjs";
+import { createRequire } from "node:module";
+import { closeSync, existsSync, fsyncSync, lstatSync, openSync, readFileSync, readlinkSync, realpathSync, renameSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
+import { types } from "node:util";
+import { parse } from "jsonc-parser";
+import lockfile from "proper-lockfile";
+//#region src/cli/provision.ts
+/**
+* Diff the DESIRED id-bearing resources against the ACTUAL bindings in the root
+* wrangler config, WITHOUT any remote/wrangler call. A resource counts as
+* provisioned ONLY when its binding entry exists with a REAL (non-placeholder)
+* identifier — the SAME predicate the provisioner's read-first uses:
+*   - D1 `database_id` is a real UUID ({@link isRealD1Id}, not `'local'`);
+*   - KV `id` is a real 32-hex ({@link isRealKvId}, not `'local'`);
+*   - R2 `bucket_name` names a real bucket ({@link isRealStoredR2BucketName}, not `'default'`);
+*   - Hyperdrive `id` is a real 32-hex ({@link isRealHyperdriveId}).
+*
+* Queues are NAME-bearing (no id in the config), so they are NOT part of this
+* id-drift check. A missing config file yields every desired resource as missing.
+*
+* Used by the deploy orchestrator (Task 6) for BOTH the no-`--provision` DRIFT
+* CHECK (any `missing` → guidance error) and the CI `--provision` no-op gate
+* (`missing.length === 0` ⇒ a provable no-op the committed config already covers).
+* A malformed/duplicate-binding config makes {@link readProvisionedBindingEntry}
+* throw — fail closed, exactly as the provisioner would.
+*/
+function checkCloudflareProvisionDrift(configPath, desired) {
+	const config = readRootConfig(configPath);
+	const missing = [];
+	const isProvisioned = (field, binding, hasRealId) => {
+		const entry = readProvisionedBindingEntry(config, field, binding, configPath);
+		return entry !== void 0 && hasRealId(entry);
+	};
+	if (desired.d1) {
+		if (!isProvisioned("d1_databases", desired.d1.binding, (e) => isRealD1Id(e.database_id))) missing.push({
+			binding: desired.d1.binding,
+			kind: "d1",
+			name: desired.d1.name
+		});
+	}
+	for (const kv of desired.kvNamespaces) if (!isProvisioned("kv_namespaces", kv.binding, (e) => isRealKvId(e.id))) missing.push({
+		binding: kv.binding,
+		kind: "kv",
+		name: kv.title
+	});
+	if (desired.r2) {
+		if (!isProvisioned("r2_buckets", desired.r2.binding, (e) => isRealStoredR2BucketName(e.bucket_name))) missing.push({
+			binding: desired.r2.binding,
+			kind: "r2",
+			name: desired.r2.bucketName
+		});
+	}
+	if (desired.hyperdrive) {
+		if (!isProvisioned("hyperdrive", desired.hyperdrive.binding, (e) => isRealHyperdriveId(e.id))) missing.push({
+			binding: desired.hyperdrive.binding,
+			kind: "hyperdrive",
+			name: desired.hyperdrive.name
+		});
+	}
+	return { missing };
+}
+/** Where Void keeps D1 migrations — written as `migrations_dir` on the D1 entry. */
+const D1_MIGRATIONS_DIR = "./db/migrations";
+/** UTF-8 byte-order mark. Node's utf-8 read preserves a leading one. */
+const UTF8_BOM = "";
+const D1_ID_PLACEHOLDER = "local";
+const KV_ID_PLACEHOLDER = "local";
+const R2_BUCKET_NAME_PLACEHOLDER = "default";
+const D1_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const HEX32_ID_RE = /^[0-9a-f]{32}$/i;
+/** R2 bucket names ARE the identity: wrangler 4.107's `isValidR2BucketName`. */
+const R2_BUCKET_NAME_RE = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
+/**
+* A D1 `database_id` that is a real (non-placeholder) hyphenated UUID. Exported so
+* the deploy orchestrator applies the SAME placeholder rule when deciding whether a
+* stored `database_name` names a real DB (a synced `database_id: "local"` must not
+* let its paired name become the production database identity).
+*/
+function isRealD1Id(value) {
+	return typeof value === "string" && value !== D1_ID_PLACEHOLDER && D1_ID_RE.test(value);
+}
+/**
+* A KV namespace `id` that is a real (non-placeholder) 32-hex string. Exported so the
+* deploy orchestrator applies the SAME placeholder rule when checking whether two KV
+* bindings already share one provisioned namespace.
+*/
+function isRealKvId(value) {
+	return typeof value === "string" && value !== KV_ID_PLACEHOLDER && HEX32_ID_RE.test(value);
+}
+/** A Hyperdrive config `id` that is a real 32-hex string (no placeholder exists). */
+function isRealHyperdriveId(value) {
+	return typeof value === "string" && HEX32_ID_RE.test(value);
+}
+/** An R2 `bucket_name` satisfying wrangler's bucket-name GRAMMAR (format only). */
+function isValidR2BucketNameFormat(value) {
+	return typeof value === "string" && R2_BUCKET_NAME_RE.test(value);
+}
+/**
+* A STORED R2 `bucket_name` that names a REAL bucket, i.e. any non-empty string
+* that is not R2's own placeholder (`default`). `local` IS a real name here. Grammar is
+* deliberately not required: a grammar-invalid stored name that contradicts the desired
+* bucket must still fail closed as a contradiction, never be silently rewritten.
+*/
+function isRealStoredR2BucketName(value) {
+	return typeof value === "string" && value.length > 0 && value !== R2_BUCKET_NAME_PLACEHOLDER;
+}
+const defaultLogger = {
+	info: (msg) => voidLog(msg),
+	warn: (msg) => voidWarn(msg)
+};
+/**
+* The transport-redirecting env vars wrangler 4.107 honors. Each can point
+* wrangler's authenticated API transport at a DIFFERENT endpoint (or select a
+* different env-block/account) than the ONE this provision pinned:
+*   - `CLOUDFLARE_API_BASE_URL` / `CF_API_BASE_URL` — override the API base URL directly
+*     (`getCloudflareApiBaseUrlFromEnv`).
+*   - `WRANGLER_API_ENVIRONMENT=staging` — routes to `api.staging.cloudflare.com`.
+*   - `CLOUDFLARE_COMPLIANCE_REGION=fedramp_high` — routes to `api.fed.cloudflare.com`.
+*   - `CLOUDFLARE_ENV` — selects a named `env.*` config block (different account/bindings).
+* We pin ONE resolved base explicitly (see {@link provisionEnv}) and fail closed when a
+* project dotenv would reselect one (see {@link assertNoTransportRedirectInProjectDotenv}).
+*/
+const TRANSPORT_REDIRECT_ENV_VARS = [
+	"CLOUDFLARE_API_BASE_URL",
+	"CF_API_BASE_URL",
+	"WRANGLER_API_ENVIRONMENT",
+	"CLOUDFLARE_COMPLIANCE_REGION",
+	"CLOUDFLARE_ENV"
+];
+/**
+* Wrangler 4.107's diagnostic-output sinks that would PERSIST the raw provisioning
+* argv (including a Hyperdrive connection string, password and all) to disk:
+*   - `WRANGLER_OUTPUT_FILE_PATH` / `WRANGLER_OUTPUT_FILE_DIRECTORY` — when either is set
+*     (`getOutputFilePathFromEnv`/`getOutputFileDirectoryFromEnv`), wrangler's startup
+*     middleware appends a `wrangler-session` entry with the VERBATIM
+*     `command_line_args: argv` to that file (`writeOutput` in wrangler-dist/cli.js) — so
+*     `hyperdrive create --connection-string=postgres://user:PASSWORD@…` lands on disk.
+* They are scrubbed from every provisioner child env ({@link provisionEnv}) and fenced in
+* the project dotenv ({@link assertNoTransportRedirectInProjectDotenv}) — wrangler reloads
+* dotenv into `process.env` BEFORE writing the session entry, so a dotenv-declared sink
+* would resurrect the leak. `WRANGLER_LOG_SANITIZE` (`getSanitizeLogs`, default true) is
+* PINNED to `true` instead: a truthy ambient value survives wrangler's dotenv reload
+* (dotenv-expand keeps an already-set truthy `process.env` value), so the pin cannot be
+* overridden into unsanitized logging of the secret-bearing API request.
+*/
+const OUTPUT_FILE_ENV_VARS = ["WRANGLER_OUTPUT_FILE_PATH", "WRANGLER_OUTPUT_FILE_DIRECTORY"];
+/**
+* Resolve the ONE Cloudflare API base URL this provision is pinned to, mirroring
+* wrangler 4.107's `getCloudflareApiBaseUrl` EXACTLY (wrangler-dist/cli.js) so the
+* Hyperdrive REST lister and the spawned wrangler agree on the endpoint:
+*
+*   getCloudflareApiBaseUrl = (complianceConfig) =>
+*     getCloudflareApiBaseUrlFromEnv() ??
+*     `https://api${getComplianceRegionSubdomain(complianceConfig)}${getStagingSubdomain()}.cloudflare.com/client/v4`
+*
+* Order + semantics mirrored exactly:
+*   1. The DIRECT base override is evaluated FIRST, by PRESENCE (wrangler's env factory
+*      checks `variableName in process.env`), with `CLOUDFLARE_API_BASE_URL` taking
+*      precedence over the deprecated `CF_API_BASE_URL`. A present-but-EMPTY override is
+*      returned AS-IS: `"" ?? derived` keeps the empty string (NULLISH, not falsy,
+*      coalescing), so wrangler pins the empty base (its API calls then fail on the
+*      unparsable URL) — we mirror that instead of silently substituting an endpoint.
+*   2. Only on the DERIVED branch are the staging/compliance selectors read — wrangler's
+*      `??` short-circuits past `getComplianceRegionSubdomain`/`getStagingSubdomain` when a
+*      direct base is present, so a direct base + conflicting compliance settings resolves
+*      to the direct base in wrangler (NO conflict error) and must not be rejected here.
+*   3. On the derived branch both env selectors are choice-VALIDATED (wrangler's
+*      `getProcessEnv` → `assertOneOf` throws on any present value outside the choices,
+*      e.g. `WRANGLER_API_ENVIRONMENT=stagng` or an empty string), so an invalid selector
+*      FAILS CLOSED instead of silently pinning public production.
+*   4. The config's own `compliance_region` VALUE is validated UNCONDITIONALLY — wrangler's
+*      config validation (`isOneOf("public", "fedramp_high")` on the `compliance_region`
+*      field) rejects an invalid config value for every command regardless of which branch
+*      resolves the base.
+* Read ONCE from the REAL ambient `process.env` (which does NOT include the project `.env`
+* — Node never auto-loads it), so an ambient/CI pin is honored while a project dotenv
+* redirect is rejected up front by {@link assertNoTransportRedirectInProjectDotenv}.
+*/
+function resolvePinnedApiBaseUrl(env = process.env, configComplianceRegion) {
+	const configRegion = configComplianceRegion !== void 0 ? assertComplianceChoice(configComplianceRegion, "the wrangler config \"compliance_region\"") : void 0;
+	const direct = env.CLOUDFLARE_API_BASE_URL !== void 0 ? env.CLOUDFLARE_API_BASE_URL : env.CF_API_BASE_URL;
+	if (direct !== void 0) return direct;
+	return `https://api${resolveComplianceRegion(env, configRegion) === "fedramp_high" ? ".fed" : ""}${resolveApiEnvironment(env) === "staging" ? ".staging" : ""}.cloudflare.com/client/v4`;
+}
+/**
+* Mirror wrangler 4.107's `getCloudflareApiEnvironmentFromEnv` (env factory with
+* `choices: ["production", "staging"]`, default `"production"`): an ABSENT variable
+* defaults to production; a PRESENT value outside the choices — `"stagng"`, an empty
+* string — makes wrangler's `assertOneOf` throw, so we fail closed identically instead of
+* silently pinning public production where wrangler stops.
+*/
+function resolveApiEnvironment(env) {
+	const raw = env.WRANGLER_API_ENVIRONMENT;
+	if (raw === void 0) return "production";
+	if (raw !== "production" && raw !== "staging") throw new Error(`provision: the WRANGLER_API_ENVIRONMENT environment variable must be one of "production" or "staging", got ${JSON.stringify(raw)}. wrangler rejects this value, so provisioning refuses to guess an endpoint; fix or unset it and retry.`);
+	return raw;
+}
+/** The compliance-region choices wrangler 4.107 accepts (`getCloudflareComplianceRegionFromEnv`). */
+const COMPLIANCE_REGIONS = ["public", "fedramp_high"];
+function assertComplianceChoice(value, source) {
+	if (value !== "public" && value !== "fedramp_high") throw new Error(`provision: ${source} must be one of ${COMPLIANCE_REGIONS.map((c) => JSON.stringify(c)).join(" or ")}, got ${JSON.stringify(value)}.`);
+	return value;
+}
+/**
+* Reconcile the effective Cloudflare compliance region, mirroring wrangler 4.107's
+* `getCloudflareComplianceRegion(complianceConfig)` EXACTLY (evaluated only on the
+* DERIVED-base branch — with a direct base override wrangler never calls it):
+*   - reads `CLOUDFLARE_COMPLIANCE_REGION` by PRESENCE and validates it against the
+*     `public`/`fedramp_high` choices (wrangler's `getProcessEnv` → `assertOneOf`, which
+*     throws on ANY present out-of-choices value — an empty string included);
+*   - when BOTH the env var AND the (already-validated) config region are set to
+*     DIFFERENT values, THROWS (fail closed) — wrangler raises a `UserError` for exactly
+*     this conflict, so we must not paper over it by pinning one endpoint while the config
+*     declares the other region;
+*   - otherwise returns `env || config || "public"` (both values are validated choices by
+*     now, so wrangler's falsy-coalescing is equivalent to nullish here).
+*/
+function resolveComplianceRegion(env, configRegion) {
+	const rawEnv = env.CLOUDFLARE_COMPLIANCE_REGION;
+	const envRegion = rawEnv !== void 0 ? assertComplianceChoice(rawEnv, "the CLOUDFLARE_COMPLIANCE_REGION environment variable") : void 0;
+	if (envRegion !== void 0 && configRegion !== void 0 && envRegion !== configRegion) throw new Error(`provision: the Cloudflare compliance region is set to conflicting values — the CLOUDFLARE_COMPLIANCE_REGION environment variable is ${JSON.stringify(envRegion)} but the wrangler config "compliance_region" is ${JSON.stringify(configRegion)}. wrangler refuses to run with a mismatched compliance region; reconcile them (remove one, or set them equal) and retry.`);
+	return envRegion ?? configRegion ?? "public";
+}
+/**
+* Mirror wrangler 4.107's `getDefaultEnvFiles(env)`: base `.env`/`.env.local`, then —
+* when the environment argument is DEFINED (we always pass `--env=`, so wrangler sees
+* `args.env === ""`, which is `!== undefined`) — the per-env pair `.env.${env}`/`.env.${env}.local`.
+* With the empty environment those are the empty-env filenames `.env.` and `.env..local`.
+*/
+function defaultWranglerEnvFiles(env) {
+	return [
+		".env",
+		".env.local",
+		`.env.${env}`,
+		`.env.${env}.local`
+	];
+}
+/**
+* FAIL CLOSED when the project's dotenv files declare a transport-redirecting
+* variable. wrangler 4.107 reloads `.env`/`.env.local` (and the dev-vars files) from the
+* project root into `process.env` on EVERY command with `override: true`, so a repo `.env`
+* setting `CLOUDFLARE_API_BASE_URL` / `WRANGLER_API_ENVIRONMENT` /
+* `CLOUDFLARE_COMPLIANCE_REGION` / `CLOUDFLARE_ENV` would redirect wrangler's authenticated
+* transport (and credentials) to a staging / FedRAMP / arbitrary endpoint AFTER we resolved
+* the pinned base — while the Hyperdrive existence check runs against the pinned base.
+* Single-account/single-endpoint provisioning cannot reason about a transport redirected
+* out from under it, so we refuse. The fix is to export the variable in the shell/CI
+* environment (which we DO honor, pinning both wrangler and the lister to it) instead of
+* the project dotenv.
+*
+* Exported for direct unit testing of the file-set and the Windows case rule; production
+* always calls it with the real `process.platform`.
+*/
+function assertNoTransportRedirectInProjectDotenv(root, platform = process.platform) {
+	const dotenvCaseInsensitive = platform === "win32";
+	const devVarsFile = existsSync(join(root, ".dev.vars.")) ? ".dev.vars." : ".dev.vars";
+	const files = [...defaultWranglerEnvFiles("").map((file) => ({
+		file,
+		caseInsensitive: dotenvCaseInsensitive
+	})), {
+		file: devVarsFile,
+		caseInsensitive: false
+	}];
+	for (const { file, caseInsensitive } of files) {
+		const keys = scanWranglerDotenvKeys(join(root, file));
+		const lowerKeys = caseInsensitive ? new Set([...keys].map((key) => key.toLowerCase())) : void 0;
+		const declares = (name) => lowerKeys !== void 0 ? lowerKeys.has(name.toLowerCase()) : keys.has(name);
+		const offenders = TRANSPORT_REDIRECT_ENV_VARS.filter(declares);
+		if (offenders.length > 0) throw new Error(`provision: refusing to provision — the project file "${file}" sets ${offenders.join(", ")}, which wrangler reloads on every command and would redirect its authenticated Cloudflare API transport (and credentials) to a different endpoint/account than this provision is pinned to (the Hyperdrive existence check would then run against a DIFFERENT endpoint, risking cross-environment writes or duplicate resources). Remove ${offenders.join(", ")} from "${file}" and, if you truly need a non-default endpoint, export it in your shell/CI environment instead — that pin IS honored for both wrangler and the existence check.`);
+		const outputOffenders = OUTPUT_FILE_ENV_VARS.filter(declares);
+		if (outputOffenders.length > 0) throw new Error(`provision: refusing to provision — the project file "${file}" sets ${outputOffenders.join(", ")}, which wrangler reloads on every command and which makes wrangler persist its session diagnostics — including the verbatim command line, where a Hyperdrive connection string's password would appear — to that output file. Remove ${outputOffenders.join(", ")} from "${file}" (set it in your shell only for non-provisioning wrangler commands if you need session output).`);
+	}
+}
+/**
+* Child-process env with the CF Access service-token PAIR scrubbed. Mirrors
+* `buildEnv` in `deploy.ts`: a shared, long-lived Access token is needed only by
+* this CLI's own API client and must never leak into the spawned wrangler
+* process (which may in turn run user hooks). The cloudflared `CF_ACCESS_TOKEN`
+* JWT (dev path) is left untouched.
+*
+* Pins ONE transport context: scrubs every {@link TRANSPORT_REDIRECT_ENV_VARS}
+* from the child env, then re-sets `CLOUDFLARE_API_BASE_URL` to the SINGLE resolved
+* `apiBaseUrl` so the spawned wrangler and the Hyperdrive REST lister hit the exact same
+* endpoint. Scrubbing the compliance/staging/env selectors makes the explicit base
+* authoritative (they can no longer re-derive a different base). Combined with
+* {@link assertNoTransportRedirectInProjectDotenv} (which blocks a project dotenv from
+* repopulating any of them via wrangler's per-command reload), the pin cannot be moved.
+*/
+/**
+* Delete `name` from `env` IN PLACE, honoring the platform's env-key case rule.
+* Windows environment keys are CASE-INSENSITIVE: a spawned child's `process.env`
+* resolves `WRANGLER_OUTPUT_FILE_PATH` from an ambient `Wrangler_Output_File_Path`
+* too, so an exact-case `delete` leaves a mixed-case spelling live. On win32 every
+* case-insensitive spelling is removed; elsewhere POSIX env vars are case-sensitive,
+* so only the exact key is a match. Exported so the deploy orchestrator scrubs its
+* OWN extra deploy-time keys (worker-name override, build-config-path) through the
+* SAME rule the provisioner uses, instead of re-deriving it.
+*/
+function deleteEnvVarCaseAware(env, name, platform = process.platform) {
+	if (platform !== "win32") {
+		delete env[name];
+		return;
+	}
+	const lower = name.toLowerCase();
+	for (const key of Object.keys(env)) if (key.toLowerCase() === lower) delete env[key];
+}
+function provisionEnv(ctx) {
+	const env = { ...process.env };
+	const platform = ctx?.platform ?? process.platform;
+	const scrub = (name) => deleteEnvVarCaseAware(env, name, platform);
+	scrub("CF_ACCESS_CLIENT_ID");
+	scrub("CF_ACCESS_CLIENT_SECRET");
+	for (const name of TRANSPORT_REDIRECT_ENV_VARS) scrub(name);
+	for (const name of OUTPUT_FILE_ENV_VARS) scrub(name);
+	scrub("WRANGLER_LOG_SANITIZE");
+	env.WRANGLER_LOG_SANITIZE = "true";
+	if (ctx?.apiBaseUrl !== void 0) env.CLOUDFLARE_API_BASE_URL = ctx.apiBaseUrl;
+	if (ctx?.accountId) {
+		scrub("CLOUDFLARE_ACCOUNT_ID");
+		env.CLOUDFLARE_ACCOUNT_ID = ctx.accountId;
+	}
+	return env;
+}
+/**
+* Hard per-command timeout for a single wrangler invocation. A hung wrangler must
+* NEVER hang the whole provision, so the default runner SIGKILLs a child that runs
+* past this and reports a HARD failure (a non-null signal — see
+* {@link normalizeRunWranglerResult}). With the ASYNC runner this bound is
+* INDEPENDENT of {@link LOCK_STALE_MS}: awaiting the child keeps the event loop free,
+* so `proper-lockfile`'s heartbeat refreshes the mutex throughout — the timeout only
+* bounds a hang, it is not load-bearing for lock safety.
+*/
+const COMMAND_TIMEOUT_MS = 12e4;
+/**
+* After a timeout SIGKILL, how long to keep confirming the child is ACTUALLY gone —
+* BOTH its `close` event AND whole-group disappearance (`kill(-pid, 0)` → ESRCH) — before
+* giving up. SIGKILL is uncatchable, so a healthy kernel reaps the group within
+* milliseconds; this generous bound only guards a pathological uninterruptible-sleep child.
+* The runner NEVER settles a timeout as "done" until both facts are confirmed; an expiry
+* (or a failed kill) REJECTS with a {@link WranglerQuarantineError} instead, so the
+* whole-provision lock — released only after a CONFIRMED settle — is intentionally
+* retained while the real wrangler CLI may still be creating resources.
+*/
+const CONFIRM_KILL_GRACE_MS = 5e3;
+/** The pid-poll interval while confirming post-SIGKILL termination. */
+const CONFIRM_KILL_POLL_MS = 20;
+/**
+* The margin the coordinator-WIDE teardown deadline adds on top of a
+* runner's own confirmation grace window: a signal teardown is bounded at
+* `confirmGraceMs + this` even if the runner's bounded confirmation never calls back.
+*/
+const SIGNAL_TEARDOWN_DEADLINE_MARGIN_MS = 5e3;
+/**
+* Classify a process-group kill error. `ESRCH` means the group ALREADY exited (there was
+* nothing left to kill) → success. ANY other code (`EPERM`, …) is a REAL kill failure: the
+* child may still be running, so it must be surfaced, never swallowed. Exported for direct
+* unit testing of the classification the timeout/cancel paths rely on.
+*/
+function isAlreadyGoneKillError(error) {
+	return error?.code === "ESRCH";
+}
+/**
+* A QUARANTINE failure: the runner could NOT confirm that a spawned
+* wrangler child (and its whole process group) is dead — the group kill failed for a
+* non-ESRCH reason (EPERM, …), or the post-SIGKILL confirmation window expired with the
+* group still (possibly) alive. The child may STILL be creating resources / writing
+* config, so the whole-provision mutex must be INTENTIONALLY RETAINED — never released —
+* and this error surfaces with manual-recovery guidance naming the surviving pid.
+* {@link provisionCloudflareResources} detects it via {@link isQuarantineError} and calls
+* `lock.quarantine()` instead of `lock.release()`.
+*/
+var WranglerQuarantineError = class extends Error {
+	quarantine = true;
+	pid;
+	constructor(pid, detail) {
+		const pidLabel = pid !== void 0 ? ` (pid ${pid})` : "";
+		super(`provision: the spawned wrangler could not be confirmed terminated${pidLabel} — ${detail}. It may still be running and creating resources, so the cross-process provision lock is intentionally RETAINED (not released) and its owner is recorded in a quarantine sidecar ("<wrangler config>.void-provision.lock.quarantine.json") that blocks concurrent provisions. Recovery: verify the process${pidLabel} is dead (e.g. \`kill -0 <pid>\`; terminate it if not) — the NEXT provision then confirms the recorded group is gone and clears the quarantine automatically. To clear it manually instead, remove the sidecar and the "<wrangler config>.void-provision.lock.lock" directory, then re-run.`);
+		this.name = "WranglerQuarantineError";
+		this.pid = pid;
+	}
+};
+let activeProvisionSlot;
+function acquireProcessProvisionSlot() {
+	if (activeProvisionSlot !== void 0) throw new Error("provision: a provision is already active in this process — run provisions sequentially. provisionCloudflareResources supports at most one concurrent provision per process; concurrent provisions across PROCESSES are serialized by the on-disk provision lock instead.");
+	if (retentionWatchdog !== void 0) throw new Error(`provision: a previous provision in this process is still retaining its lock — an unconfirmed wrangler child${retentionWatchdog.info.pid !== void 0 ? ` (pid ${retentionWatchdog.info.pid})` : ""} could not be quarantined durably yet. No new provision may start until that retention resolves (the child is confirmed dead, or the quarantine metadata persists durably).`);
+	const token = Symbol("void-provision-slot");
+	activeProvisionSlot = token;
+	return () => {
+		if (activeProvisionSlot === token) activeProvisionSlot = void 0;
+	};
+}
+/**
+* The ONE active provision's lock-quarantine hook, 1:1 with the
+* provision slot above. When the parent process is about to DIE re-raising a forwarded
+* SIGINT/SIGTERM while a spawned wrangler child's teardown could NOT be confirmed,
+* proper-lockfile's signal-exit sweep would remove the still-TRACKED provision mutex —
+* releasing the lock under a possibly-live child. {@link provisionCloudflareResources}
+* sets this for the duration of the provision; a registering wrangler child CAPTURES it
+* at registration (see {@link registerRunner}) so an unresolved teardown quarantines
+* exactly ITS OWNING provision lock with ITS OWN pid metadata — never a broadcast
+* through every lock (the previous Set this replaces stamped the FIRST unresolved
+* registrant's pid into every lock's sidecar, so a foreign group's death could clear a
+* quarantine whose real child was alive).
+*/
+let activeProvisionQuarantineHook;
+/** True when `error` is a quarantine failure whose provision lock must stay retained. */
+function isQuarantineError(error) {
+	return error instanceof WranglerQuarantineError || error?.quarantine === true;
+}
+/** The (at most one) currently-registered {runner, owning-lock} pair. */
+let activeRegistration;
+let coordinatorListenersInstalled = false;
+let activeTeardown;
+let reRaisedOnce = false;
+const onCoordinatorSigint = () => coordinatorHandleSignal("SIGINT");
+const onCoordinatorSigterm = () => coordinatorHandleSignal("SIGTERM");
+function installCoordinatorListeners() {
+	if (coordinatorListenersInstalled) return;
+	coordinatorListenersInstalled = true;
+	process.on("SIGINT", onCoordinatorSigint);
+	process.on("SIGTERM", onCoordinatorSigterm);
+}
+function removeCoordinatorListeners() {
+	if (!coordinatorListenersInstalled) return;
+	coordinatorListenersInstalled = false;
+	process.removeListener("SIGINT", onCoordinatorSigint);
+	process.removeListener("SIGTERM", onCoordinatorSigterm);
+}
+function registerRunner(registrant) {
+	if (activeRegistration !== void 0) throw new Error("provision: internal invariant violated — a second wrangler child tried to register while one is already active in this process");
+	activeRegistration = {
+		registrant,
+		lockQuarantine: activeProvisionQuarantineHook
+	};
+	installCoordinatorListeners();
+}
+function deregisterRunner(registrant) {
+	if (activeRegistration?.registrant === registrant) activeRegistration = void 0;
+	if (activeRegistration === void 0 && activeTeardown === void 0 && retentionWatchdog === void 0) removeCoordinatorListeners();
+}
+function coordinatorHandleSignal(signal) {
+	if (activeTeardown !== void 0) return;
+	if (retentionWatchdog !== void 0 && activeRegistration === void 0) {
+		process.stderr.write(`provision: ignoring ${signal} — a provision lock is retained while an unconfirmed wrangler child may live and its quarantine metadata is not yet durable. The process exits once the child is confirmed dead or the metadata persists.\n`);
+		return;
+	}
+	const teardown = {
+		signal,
+		pending: 0,
+		dispatching: true,
+		persistFailed: false,
+		finished: false,
+		deadlineTimer: void 0,
+		expirePendingPair: void 0
+	};
+	activeTeardown = teardown;
+	const snapshot = activeRegistration !== void 0 ? [activeRegistration] : [];
+	teardown.pending = snapshot.length;
+	if (snapshot.length > 0) {
+		const deadlineMs = Math.max(...snapshot.map((r) => r.registrant.teardownDeadlineMs));
+		teardown.deadlineTimer = setTimeout(() => {
+			teardown.expirePendingPair?.(`the coordinator-wide ${deadlineMs}ms teardown deadline expired before the process group's termination was confirmed`);
+		}, deadlineMs);
+	}
+	for (const registration of snapshot) coordinatorTearDownRegistrant(teardown, registration);
+	teardown.dispatching = false;
+	maybeFinishCoordinatorTeardown(teardown);
+}
+/** Finish only after the initial dispatch fully completed AND every
+* snapshot registrant resolved (confirmed or quarantined). */
+function maybeFinishCoordinatorTeardown(teardown) {
+	if (!teardown.dispatching && teardown.pending === 0) finishCoordinatorTeardown(teardown);
+}
+function coordinatorTearDownRegistrant(teardown, registration) {
+	const { registrant, lockQuarantine } = registration;
+	let done = false;
+	const complete = () => {
+		if (done) return;
+		done = true;
+		teardown.pending -= 1;
+		maybeFinishCoordinatorTeardown(teardown);
+	};
+	const quarantinePair = (detail) => {
+		if (done) return;
+		if (lockQuarantine !== void 0) try {
+			lockQuarantine({
+				pid: registrant.pid(),
+				reason: `the spawned wrangler could not be confirmed terminated after a forwarded ${teardown.signal} — ${detail}`
+			});
+		} catch (failure) {
+			teardown.persistFailed = true;
+			process.stderr.write(`provision: ${failure.message}\n`);
+		}
+		const pid = registrant.pid();
+		process.stderr.write(`provision: warning — the wrangler child process group${typeof pid === "number" ? ` (pid ${pid})` : ""} could not be confirmed terminated after ${teardown.signal} (${detail}). It may still be running; the provision lock is retained (quarantined) — verify the process is dead before re-running provision.\n`);
+		registrant.quarantine(detail);
+		complete();
+	};
+	teardown.expirePendingPair = quarantinePair;
+	const outcome = registrant.signalGroup(teardown.signal);
+	if (typeof outcome === "object") {
+		quarantinePair(`the process group could not be signalled: ${outcome.error.message}`);
+		return;
+	}
+	if (outcome === "gone") registrant.markGroupGone();
+	registrant.awaitConfirmedDead((result) => {
+		if (result.confirmed) complete();
+		else quarantinePair(result.detail);
+	});
+}
+function finishCoordinatorTeardown(teardown) {
+	if (teardown.finished) return;
+	teardown.finished = true;
+	if (teardown.deadlineTimer !== void 0) clearTimeout(teardown.deadlineTimer);
+	removeCoordinatorListeners();
+	if (teardown.persistFailed || retentionWatchdog !== void 0) {
+		activeTeardown = void 0;
+		installCoordinatorListeners();
+		process.stderr.write(`provision: NOT re-raising ${teardown.signal} — a provision lock's quarantine metadata could not be persisted, so the lock is intentionally still held by this process to keep it from being stolen while the unconfirmed wrangler child may live.\n`);
+		return;
+	}
+	if (reRaisedOnce) return;
+	reRaisedOnce = true;
+	process.kill(process.pid, teardown.signal);
+	setTimeout(() => {}, 2e3);
+}
+const RETENTION_RETRY_MIN_MS = 250;
+const RETENTION_RETRY_MAX_MS = 5e3;
+let retentionWatchdog;
+/**
+* Quarantine `lock`, and on a PERSISTENCE failure arm the retention
+* watchdog BEFORE rethrowing. THE single quarantine entry point for provision-level
+* code (the body-error path and the signal coordinator's hook both route through it),
+* so no persistence failure can leave the process free to drain unprotected.
+*/
+function retainQuarantinedLock(lock, info) {
+	try {
+		lock.quarantine(info);
+	} catch (error) {
+		armRetentionWatchdog(lock, info);
+		throw error;
+	}
+}
+function armRetentionWatchdog(lock, info) {
+	if (retentionWatchdog !== void 0) return;
+	process.stderr.write(`provision: warning — quarantine metadata for the unconfirmed wrangler child${info.pid !== void 0 ? ` (pid ${info.pid})` : ""} could not be persisted, so the provision lock "${lock.lockTargetPath}.lock" is RETAINED by this process, which stays alive until the child is confirmed dead or the metadata persists durably.\n`);
+	installCoordinatorListeners();
+	let attempt = 0;
+	const resolveWatchdog = () => {
+		if (retentionWatchdog !== void 0) clearTimeout(retentionWatchdog.timer);
+		retentionWatchdog = void 0;
+		if (activeRegistration === void 0 && activeTeardown === void 0) removeCoordinatorListeners();
+	};
+	const tick = () => {
+		if (info.pid !== void 0) {
+			let dead = false;
+			try {
+				process.kill(process.platform === "win32" ? info.pid : -info.pid, 0);
+			} catch (error) {
+				dead = error.code === "ESRCH";
+			}
+			if (dead) {
+				lock.release().then(() => resolveWatchdog(), (error) => {
+					process.stderr.write(`provision: the retained provision lock could not be released after the child's death was confirmed (${error.message}); the mutex self-heals once stale.\n`);
+					resolveWatchdog();
+				});
+				return;
+			}
+		}
+		try {
+			lock.quarantine(info);
+			resolveWatchdog();
+			return;
+		} catch {}
+		attempt += 1;
+		const delay = Math.min(RETENTION_RETRY_MIN_MS * 2 ** attempt, RETENTION_RETRY_MAX_MS);
+		if (retentionWatchdog !== void 0) retentionWatchdog.timer = setTimeout(tick, delay);
+	};
+	retentionWatchdog = {
+		lock,
+		info,
+		timer: setTimeout(tick, RETENTION_RETRY_MIN_MS)
+	};
+}
+/**
+* Default `runWrangler`: resolves the project-local wrangler as an ARGV launcher
+* via Task 2's {@link resolveWranglerArgv} and runs it with `spawn` and
+* `shell: false`, so every argument is passed literally (no shell parsing → no
+* injection). Captures stdout (for `--json` parsing) and stderr (for
+* error/collision detection). Never called in unit tests — those inject a stub.
+*
+* ASYNC (returns a Promise). `spawn` + `await` (vs. the old blocking
+* `spawnSync`) keeps the Node event loop free while wrangler runs, so
+* `proper-lockfile`'s update timer keeps refreshing the mutex mtime for the WHOLE
+* provision — no wrangler call, however slow, can freeze the loop long enough for
+* another process to see the lock stale and steal it while we still hold it. A
+* {@link COMMAND_TIMEOUT_MS} SIGKILL guards against a hung child.
+*/
+function createDefaultRunWrangler(root, options) {
+	const launcher = options?.launcher ?? resolveWranglerArgv(root);
+	const timeoutMs = options?.timeoutMs ?? COMMAND_TIMEOUT_MS;
+	const confirmGraceMs = options?.confirmKillGraceMs ?? CONFIRM_KILL_GRACE_MS;
+	const killProcessGroup = options?.killProcessGroup ?? ((target, signal) => process.kill(target, signal));
+	const [command, ...prefix] = launcher;
+	const isWindows = process.platform === "win32";
+	const teardownDeadlineMs = options?.signalTeardownDeadlineMs ?? confirmGraceMs + SIGNAL_TEARDOWN_DEADLINE_MARGIN_MS;
+	return (args, opts) => new Promise((resolvePromise, rejectPromise) => {
+		if (activeTeardown !== void 0) {
+			rejectPromise(/* @__PURE__ */ new Error(`provision: refusing to spawn wrangler — a fatal ${activeTeardown.signal} is being handled and this process is terminating; no new wrangler work may start.`));
+			return;
+		}
+		if (activeRegistration !== void 0) {
+			rejectPromise(/* @__PURE__ */ new Error("provision: refusing to spawn wrangler — another wrangler child is already active in this process (wrangler calls must run sequentially; provisions run at most one per process)."));
+			return;
+		}
+		const child = spawn(command, [...prefix, ...args], {
+			cwd: opts.cwd ?? root,
+			shell: false,
+			env: provisionEnv({
+				accountId: opts.accountId,
+				apiBaseUrl: opts.apiBaseUrl
+			}),
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true,
+			detached: !isWindows
+		});
+		let stdout = "";
+		let stderr = "";
+		let timedOut = false;
+		let settled = false;
+		let spawned = false;
+		let postSpawnError;
+		let closed = false;
+		let groupGone = false;
+		child.once("spawn", () => {
+			spawned = true;
+		});
+		child.stdout?.setEncoding("utf-8");
+		child.stderr?.setEncoding("utf-8");
+		child.stdout?.on("data", (chunk) => {
+			stdout += chunk;
+		});
+		child.stderr?.on("data", (chunk) => {
+			stderr += chunk;
+		});
+		const signalGroup = (signal) => {
+			try {
+				if (!isWindows && typeof child.pid === "number") {
+					killProcessGroup(-child.pid, signal);
+					return "signaled";
+				}
+				if (isWindows && typeof child.pid === "number") {
+					if (child.exitCode !== null || child.signalCode !== null) return "gone";
+					killProcessGroup(child.pid, signal);
+					return "signaled";
+				}
+				if (child.kill(signal)) return "signaled";
+				if (child.exitCode !== null || child.signalCode !== null) return "gone";
+				return { error: /* @__PURE__ */ new Error(`child.kill(${signal}) returned false (signal not delivered)`) };
+			} catch (error) {
+				return isAlreadyGoneKillError(error) ? "gone" : { error };
+			}
+		};
+		/** True when the whole process group no longer exists (`kill(-pid, 0)` → ESRCH). */
+		const probeGroupGone = () => {
+			if (groupGone) return true;
+			if (typeof child.pid !== "number") {
+				groupGone = true;
+				return true;
+			}
+			if (isWindows) {
+				if (child.exitCode !== null || child.signalCode !== null) {
+					groupGone = true;
+					return true;
+				}
+				try {
+					process.kill(child.pid, 0);
+				} catch (error) {
+					if (error.code === "ESRCH") groupGone = true;
+				}
+				return groupGone;
+			}
+			try {
+				process.kill(-child.pid, 0);
+			} catch (error) {
+				if (error.code === "ESRCH") groupGone = true;
+			}
+			return groupGone;
+		};
+		const timeoutStderr = (extra) => [
+			stderr,
+			`provision: wrangler exceeded the ${timeoutMs}ms command timeout`,
+			extra
+		].filter(Boolean).join("\n");
+		const deregisterSelf = () => deregisterRunner(registrant);
+		const finish = (result) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(commandTimer);
+			deregisterSelf();
+			resolvePromise(result);
+		};
+		const quarantine = (detail) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(commandTimer);
+			deregisterSelf();
+			rejectPromise(new WranglerQuarantineError(child.pid, detail));
+		};
+		const confirmPollNudges = [];
+		const nudgeConfirmPolls = () => {
+			for (const poll of confirmPollNudges) poll();
+		};
+		const awaitConfirmedDead = (handlers) => {
+			const deadline = Date.now() + confirmGraceMs;
+			let pollTimer;
+			const poll = () => {
+				clearTimeout(pollTimer);
+				if (handlers.stopWhenSettled && settled) return;
+				if (closed && probeGroupGone()) {
+					handlers.onConfirmed();
+					return;
+				}
+				if (Date.now() >= deadline) {
+					handlers.onExpiry();
+					return;
+				}
+				pollTimer = setTimeout(poll, CONFIRM_KILL_POLL_MS);
+			};
+			confirmPollNudges.push(poll);
+			poll();
+		};
+		const confirmThenSettle = (makeResult, what) => {
+			awaitConfirmedDead({
+				stopWhenSettled: true,
+				onConfirmed: () => finish(makeResult()),
+				onExpiry: () => quarantine(`the process group could not be confirmed terminated within ${confirmGraceMs}ms of ${what}`)
+			});
+		};
+		const registrant = {
+			pid: () => child.pid,
+			signalGroup,
+			teardownDeadlineMs,
+			markGroupGone: () => {
+				groupGone = true;
+			},
+			awaitConfirmedDead: (onDone) => {
+				awaitConfirmedDead({
+					stopWhenSettled: false,
+					onConfirmed: () => onDone({ confirmed: true }),
+					onExpiry: () => onDone({
+						confirmed: false,
+						detail: `the process group did not terminate within ${confirmGraceMs}ms of the forwarded signal`
+					})
+				});
+			},
+			quarantine
+		};
+		const commandTimer = setTimeout(() => {
+			timedOut = true;
+			const outcome = signalGroup("SIGKILL");
+			if (typeof outcome === "object") {
+				quarantine(`the process group could not be killed: ${outcome.error.message}`);
+				return;
+			}
+			if (outcome === "gone") groupGone = true;
+			confirmThenSettle(() => normalizeRunWranglerResult({
+				stdout,
+				stderr: timeoutStderr(),
+				status: null,
+				signal: "SIGKILL"
+			}), `the timeout SIGKILL (${timeoutStderr()})`);
+		}, timeoutMs);
+		child.on("error", (error) => {
+			if (!spawned && typeof child.pid !== "number") {
+				finish(normalizeRunWranglerResult({
+					stdout,
+					stderr,
+					status: null,
+					signal: null,
+					error
+				}));
+				return;
+			}
+			if (settled || timedOut || postSpawnError !== void 0) return;
+			postSpawnError = error;
+			clearTimeout(commandTimer);
+			const outcome = signalGroup("SIGKILL");
+			if (typeof outcome === "object") {
+				quarantine(`a post-spawn child error (${error.message}) was followed by a failed process-group kill: ${outcome.error.message}`);
+				return;
+			}
+			if (outcome === "gone") groupGone = true;
+			confirmThenSettle(() => normalizeRunWranglerResult({
+				stdout,
+				stderr: [stderr, `provision: the spawned wrangler child emitted an error after spawn: ${error.message}`].filter(Boolean).join("\n"),
+				status: null,
+				signal: "SIGKILL"
+			}), `a post-spawn child error (${error.message}; the group was SIGKILLed)`);
+		});
+		child.on("close", (code, signal) => {
+			closed = true;
+			if (timedOut || postSpawnError !== void 0) {
+				nudgeConfirmPolls();
+				return;
+			}
+			clearTimeout(commandTimer);
+			const makeResult = () => normalizeRunWranglerResult({
+				stdout,
+				stderr,
+				status: code,
+				signal
+			});
+			if (probeGroupGone()) {
+				finish(makeResult());
+				return;
+			}
+			const outcome = signalGroup("SIGKILL");
+			if (typeof outcome === "object") {
+				quarantine(`the child exited (status ${String(code)}) but its process group is still alive and could not be killed: ${outcome.error.message}`);
+				return;
+			}
+			if (outcome === "gone") groupGone = true;
+			confirmThenSettle(makeResult, `the child's exit (status ${String(code)}; surviving process-group members were SIGKILLed)`);
+			nudgeConfirmPolls();
+		});
+		registerRunner(registrant);
+		options?.onSpawnedChild?.(child);
+	});
+}
+/**
+* Normalize a `spawnSync` result into a {@link RunWranglerResult}, treating a
+* signal-killed child or a spawn error as a FAILURE — never success.
+*
+* The naive `status ?? (error ? 1 : 0)` collapses a SIGTERM'd child (which
+* returns `status: null`, a non-null `signal`, and NO `error`) to `0`, so a
+* killed `create` would be recorded as `created` though nothing happened. So we
+* fail on ANY non-numeric `status`, a non-null `signal`, or a present `error`,
+* and surface the signal/spawn-error text in `stderr` for diagnostics.
+*/
+function normalizeRunWranglerResult(result) {
+	const stdout = result.stdout ?? "";
+	const notes = [];
+	if (result.signal != null) notes.push(`provision: wrangler was terminated by signal ${result.signal}`);
+	if (result.error != null) notes.push(`provision: wrangler could not be spawned: ${result.error.message}`);
+	const status = typeof result.status !== "number" || result.signal != null || result.error != null ? typeof result.status === "number" && result.status !== 0 ? result.status : 1 : result.status;
+	const baseStderr = result.stderr ?? "";
+	return {
+		stdout,
+		stderr: notes.length > 0 ? [baseStderr, ...notes].filter(Boolean).join("\n") : baseStderr,
+		status,
+		signal: result.signal ?? null,
+		error: result.error != null ? result.error.message : null
+	};
+}
+/**
+* THE single provenance rule. A result is a HARD failure when the child was
+* signal-killed or could not be spawned: it did not run to completion, so its
+* buffered status/stdout/stderr is unreliable and must NEVER be read as "absent"
+* or "success". Every success/absence/adopt classifier below defers to this.
+*/
+function isHardFailure(result) {
+	return result.signal != null || result.error != null;
+}
+/** The child ran to completion and reported SUCCESS (a clean numeric exit 0). */
+function isCleanSuccess(result) {
+	return !isHardFailure(result) && result.status === 0;
+}
+/**
+* The child ran to completion and reported a FAILURE status (a numeric non-zero
+* exit, no signal, no spawn error) — the ONLY case whose stdout/stderr may be
+* classified for a resource-specific not-found signal.
+*/
+function isCleanFailure(result) {
+	return !isHardFailure(result) && typeof result.status === "number" && result.status !== 0;
+}
+/**
+* The OVERALL deadline for the Hyperdrive existence lister (across ALL its paginated
+* requests). A stalled body or a never-settling injected seam must never hold the
+* whole-provision lock (whose heartbeat keeps refreshing while the loop is free) forever, so
+* the caller fails closed at this bound.
+*/
+const HYPERDRIVE_LIST_TIMEOUT_MS = 6e4;
+/**
+* Run a lister call under an OVERALL deadline. Builds one `AbortController`, hands its
+* signal to `start` (threaded into every paginated `fetch`), and races the returned promise
+* against a timer that ABORTS the signal AND rejects — so even a seam that ignores the signal
+* (never settling) can NOT hold the caller (and thus the provision lock) past `ms`.
+*/
+function withListerDeadline(start, ms) {
+	return new Promise((resolve, reject) => {
+		const controller = new AbortController();
+		const timer = setTimeout(() => {
+			controller.abort();
+			reject(/* @__PURE__ */ new Error(`the existence check exceeded the ${ms}ms deadline`));
+		}, ms);
+		Promise.resolve().then(() => start(controller.signal)).then((value) => {
+			clearTimeout(timer);
+			resolve(value);
+		}, (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+	});
+}
+/**
+* The Cloudflare API token the default Hyperdrive existence check authenticates with:
+* the caller-supplied one, else the ambient `CLOUDFLARE_API_TOKEN`. An empty value is
+* treated as absent. This is the ONE resolver — the up-front Hyperdrive fence and the
+* default lister below both use it, so the fence can never promise a check the lister
+* then declines to make.
+*/
+function resolveHyperdriveApiToken(apiToken) {
+	const token = apiToken ?? process.env.CLOUDFLARE_API_TOKEN;
+	return typeof token === "string" && token.length > 0 ? token : void 0;
+}
+/**
+* Default Hyperdrive existence check: `GET /accounts/{id}/hyperdrive/configs`
+* with the CF API token, matched by name in the caller. Returns `undefined` when
+* it cannot be built (no account id / no token) — the caller then fails closed
+* before any blind create. Never called in unit tests — those inject a stub.
+*/
+function createDefaultListHyperdriveConfigs(apiToken) {
+	const token = resolveHyperdriveApiToken(apiToken);
+	if (!token) return;
+	return async ({ accountId, apiBaseUrl, signal }) => {
+		const perPage = 100;
+		const listUrl = (page) => `${apiBaseUrl}/accounts/${accountId}/hyperdrive/configs?page=${page}&per_page=${perPage}`;
+		const byId = /* @__PURE__ */ new Map();
+		let expectedTotal;
+		for (let page = 1;; page++) {
+			const res = await fetch(listUrl(page), {
+				headers: { Authorization: `Bearer ${token}` },
+				signal
+			});
+			if (!res.ok) throw new Error(`Cloudflare API returned HTTP ${res.status} listing Hyperdrive configs`);
+			const body = await res.json();
+			if (!isRecord(body) || body.success !== true || !Array.isArray(body.result)) throw new Error("Cloudflare API returned an unsuccessful or malformed Hyperdrive configs payload");
+			const info = body.result_info;
+			const totalCount = isRecord(info) && typeof info.total_count === "number" && Number.isInteger(info.total_count) ? info.total_count : void 0;
+			if (totalCount === void 0 || totalCount < 0) throw new Error("Cloudflare API returned Hyperdrive configs without valid pagination metadata (result_info.total_count); cannot prove the list is complete");
+			if (expectedTotal === void 0) expectedTotal = totalCount;
+			else if (totalCount !== expectedTotal) throw new Error("Cloudflare API returned inconsistent Hyperdrive pagination totals across pages; cannot prove the list is complete");
+			if (body.result.length === 0 && byId.size < expectedTotal) throw new Error("Cloudflare API returned an empty Hyperdrive page before all configs were listed; cannot prove the list is complete");
+			for (const entry of body.result) {
+				if (!isRecord(entry) || typeof entry.id !== "string" || entry.id.length === 0 || typeof entry.name !== "string" || entry.name.length === 0) throw new Error("Cloudflare API returned a malformed Hyperdrive config entry (missing id/name)");
+				if (byId.has(entry.id)) throw new Error("Cloudflare API returned a duplicate Hyperdrive config id across pages; cannot prove the list is complete");
+				byId.set(entry.id, {
+					id: entry.id,
+					name: entry.name
+				});
+			}
+			if (byId.size > expectedTotal) throw new Error("Cloudflare API returned more Hyperdrive configs than result_info.total_count; cannot prove the list is complete");
+			if (byId.size === expectedTotal) break;
+		}
+		return [...byId.values()];
+	};
+}
+/**
+* The ONE strict Hyperdrive-list validator, applied at the CALLER after EITHER
+* lister returns (the default fetch OR an injected seam), so validation can never live
+* only inside the default fetch. Validates EVERY member up front — BEFORE any name
+* filtering: rejects any non-object member, empty/non-string `name`, and duplicate `id`,
+* AND requires every member's `id` to be a REAL 32-hex Hyperdrive id (not merely
+* non-empty). A malformed id on ANY member means the list is untrustworthy, so we fail
+* closed rather than skip that member and mistake the target for absent. Then requires
+* EXACTLY 0 or 1 exact-name match (>1 is ambiguous — Hyperdrive names are NOT
+* account-unique — and fails closed) BEFORE any match/write. Returns the single
+* exact-name match, or `undefined` when none matches.
+*/
+function selectHyperdriveMatch(configs, name, configPath) {
+	const seenIds = /* @__PURE__ */ new Set();
+	const validated = [];
+	for (const config of configs) {
+		if (!isRecord(config) || typeof config.id !== "string" || config.id.length === 0 || typeof config.name !== "string" || config.name.length === 0) throw new Error(`provision: the Hyperdrive existence check returned a malformed config entry (each must be an object with a non-empty string id and name). Cannot verify whether ${JSON.stringify(name)} already exists; refusing to create a possible duplicate.`);
+		if (!isRealHyperdriveId(config.id)) throw new Error(`provision: the Hyperdrive existence check returned a config ${JSON.stringify(config.name)} with a malformed id ${JSON.stringify(config.id)} (expected a 32-character hex Hyperdrive id). Cannot verify whether ${JSON.stringify(name)} already exists; refusing to create a possible duplicate.`);
+		if (seenIds.has(config.id)) throw new Error(`provision: the Hyperdrive existence check returned a duplicate config id ${JSON.stringify(config.id)}. Cannot verify existing configs; refusing to create a possible duplicate.`);
+		seenIds.add(config.id);
+		validated.push({
+			id: config.id,
+			name: config.name
+		});
+	}
+	const named = validated.filter((c) => c.name === name);
+	if (named.length > 1) throw new Error(`provision: cannot adopt Hyperdrive config ${JSON.stringify(name)} — ${named.length} configs in this account share that name (ids: ${named.map((c) => c.id).join(", ")}). Hyperdrive names are not account-unique; remove the duplicates or pin the id in "${configPath}", then retry.`);
+	return named[0];
+}
+/** The quarantine sidecar path for a lock target. */
+function quarantineSidecarPath(lockTarget) {
+	return `${lockTarget}.quarantine.json`;
+}
+/**
+* Atomically persist the quarantine owner metadata: write a temp file,
+* then `rename` over the final path, so a concurrent acquisition gate can never read
+* partial JSON. On POSIX the spawned wrangler child is `detached` (its own process-group
+* leader), so the recorded `pgid` IS its pid; Windows has no process groups (the gate
+* probes the pid directly there).
+*
+* DURABLE: the temp file is fsync'd before the rename, the directory is
+* fsync'd after it (see the classification below), and the final sidecar is READ
+* BACK and verified. Any failure THROWS — callers treat persistence as a PRECONDITION
+* for detaching the lock from proper-lockfile's tracking (see
+* {@link ProvisionLock.quarantine}); a sidecar that merely "probably" landed is not a
+* durable marker the acquisition gate can rely on.
+*/
+function writeQuarantineSidecar(sidecarPath, info, dirDurability) {
+	const payload = JSON.stringify({
+		pid: info.pid ?? null,
+		pgid: process.platform === "win32" ? null : info.pid ?? null,
+		reason: info.reason,
+		quarantinedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		quarantinedBy: process.pid,
+		generation: `${randomUUID()}.${process.hrtime.bigint().toString()}`
+	}, null, 2);
+	const tmpPath = `${sidecarPath}.tmp-${process.pid}`;
+	try {
+		const fd = openSync(tmpPath, "w");
+		try {
+			writeSync(fd, payload);
+			fsyncSync(fd);
+		} finally {
+			closeSync(fd);
+		}
+		renameSync(tmpPath, sidecarPath);
+	} catch (error) {
+		try {
+			unlinkSync(tmpPath);
+		} catch {}
+		throw error;
+	}
+	const dirOpen = dirDurability?.openSync ?? openSync;
+	const dirFsync = dirDurability?.fsyncSync ?? fsyncSync;
+	const dirClose = dirDurability?.closeSync ?? closeSync;
+	try {
+		const dirFd = dirOpen(dirname(sidecarPath), "r");
+		try {
+			dirFsync(dirFd);
+		} finally {
+			dirClose(dirFd);
+		}
+	} catch (error) {
+		const code = error.code ?? "";
+		if (![
+			"EISDIR",
+			"EPERM",
+			"EINVAL",
+			"ENOTSUP",
+			"ENOSYS"
+		].includes(code)) {
+			try {
+				unlinkSync(sidecarPath);
+			} catch {}
+			throw error;
+		}
+	}
+	const readBack = JSON.parse(readFileSync(sidecarPath, "utf-8"));
+	if (!isRecord(readBack) || readBack.pid !== (info.pid ?? null) || readBack.reason !== info.reason) throw new Error(`the quarantine sidecar "${sidecarPath}" did not verify after writing`);
+}
+function readPositiveInt(value) {
+	return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : void 0;
+}
+/**
+* The quarantine acquisition GATE. Every provision acquires its mutex
+* through {@link acquireProvisionLock} (the single choke point — grep-proven: no other
+* code calls `lockfile.lock`), and this gate runs BEFORE proper-lockfile is even
+* consulted, so a QUARANTINED mutex can never be stolen by the mtime-stale path while
+* the recorded wrangler process group may still be alive:
+*   - no sidecar → nothing quarantined → proceed to normal acquisition;
+*   - sidecar present → probe the recorded group (`kill(-pgid, 0)`; the plain pid where
+*     no group exists): ESRCH (confirmed dead) → clear the sidecar and proceed; still
+*     alive OR the probe fails (EPERM, no recorded pid, unreadable sidecar) → FAIL
+*     CLOSED with the recorded metadata + manual-recovery guidance. PID reuse can make
+*     a dead group probe "alive" — that keeps failing closed (the safe direction; the
+*     guidance covers manual clearance).
+* Clearing touches ONLY the sidecar (unlink, ENOENT-tolerant — concurrent clearers are
+* fine). The retained mutex DIRECTORY is deliberately NOT removed by hand: its
+* heartbeat stopped at quarantine, so proper-lockfile's own stale lifecycle reclaims it
+* during the acquisition below — a manual rmdir here could race a concurrent acquirer's
+* fresh mutex (remove-then-acquire is not atomic across processes) and let two
+* provisions hold the lock at once.
+*
+* This gate now ALWAYS runs under the RECOVERY mutex (see
+* {@link acquireProvisionLock}), so its read IS the re-read-under-the-mutex every
+* recoverer must base its decision on, and a clear may only remove the exact sidecar
+* GENERATION it just inspected: the sidecar is re-read immediately before the unlink
+* and the decision fails closed if the generation changed (a newer quarantine was
+* persisted by the current main-mutex holder — whose quarantine writes are the one
+* interleaving the recovery mutex cannot serialize — while this decision was pending).
+* `onBeforeClear` is a test seam injecting exactly that interleaving deterministically.
+*/
+function assertQuarantineClearedOrClear(lockTarget, onBeforeClear) {
+	const sidecarPath = quarantineSidecarPath(lockTarget);
+	if (!existsSync(sidecarPath)) return;
+	let recorded;
+	try {
+		const parsed = JSON.parse(readFileSync(sidecarPath, "utf-8"));
+		recorded = isRecord(parsed) ? parsed : void 0;
+	} catch {
+		recorded = void 0;
+	}
+	const pid = readPositiveInt(recorded?.pid);
+	const pgid = readPositiveInt(recorded?.pgid);
+	const reason = typeof recorded?.reason === "string" ? recorded.reason : void 0;
+	const quarantinedAt = typeof recorded?.quarantinedAt === "string" ? recorded.quarantinedAt : void 0;
+	const probeTarget = pgid !== void 0 && process.platform !== "win32" ? -pgid : pid ?? pgid;
+	let confirmedDead = false;
+	if (probeTarget !== void 0) try {
+		process.kill(probeTarget, 0);
+	} catch (error) {
+		if (error.code === "ESRCH") confirmedDead = true;
+	}
+	if (!confirmedDead) {
+		const who = pid !== void 0 || pgid !== void 0 ? `process group ${String(pgid ?? pid)}` : "an unrecorded process";
+		throw new Error(`provision: refusing to provision — a previous provision QUARANTINED this config's lock because a spawned wrangler child could not be confirmed terminated (${who}${quarantinedAt ? `, quarantined at ${quarantinedAt}` : ""}${reason ? `; reason: ${reason}` : ""}). It may still be creating resources. Verify the process is dead (e.g. \`kill -0 ${String(pid ?? "<pid>")}\`; terminate it if not) and re-run — the quarantine then clears automatically. If you are CERTAIN the recorded process is unrelated (pid reuse) or gone, remove "${sidecarPath}" and the "${lockTarget}.lock" directory manually, then retry.`);
+	}
+	const inspectedGeneration = typeof recorded?.generation === "string" ? recorded.generation : void 0;
+	onBeforeClear?.();
+	let current;
+	try {
+		const reread = JSON.parse(readFileSync(sidecarPath, "utf-8"));
+		current = isRecord(reread) ? reread : void 0;
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		current = void 0;
+	}
+	const currentGeneration = typeof current?.generation === "string" ? current.generation : void 0;
+	if (current === void 0 || currentGeneration !== inspectedGeneration) throw new Error(`provision: refusing to clear the quarantine sidecar "${sidecarPath}" — it changed while this recovery decision was being made (a newer quarantine generation was persisted). Re-run to re-evaluate the current quarantine.`);
+	try {
+		unlinkSync(sidecarPath);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+}
+function loadProperLockfileInternals() {
+	try {
+		return createRequire(import.meta.url)("proper-lockfile/lib/lockfile.js");
+	} catch {
+		return;
+	}
+}
+/**
+* `realpathSync` is `node:fs`, so it returns a NATIVE path — backslashes on Windows —
+* while every other path in this module comes from `pathslash` and is POSIX-normalized,
+* including the not-yet-created branch below (whose `join()` already normalizes). Without
+* this, `canonicalizeConfigPath` hands back TWO different spellings of the same file
+* depending only on whether it happens to exist yet, defeating the "ONE identity" contract
+* the function exists to provide — and splitting the lock identity, the wrangler `-c` argv,
+* and the paths printed in error messages. No-op off Windows, where `\` is a legal filename
+* character that must survive byte-for-byte.
+*/
+function toPosixConfigPath(nativePath) {
+	return process.platform === "win32" ? normalize(nativePath) : nativePath;
+}
+/**
+* Canonicalize an already-absolute config path via `realpath` so the lock identity
+* and every read/write/`-c` key on the REAL file, not a lexical symlink alias. When the
+* config file EXISTS, its own realpath is returned (a symlink resolves to its target).
+* When it does NOT yet exist, `realpath` would throw (ENOENT), so we canonicalize the
+* PARENT directory (which normally exists — the project root) and rejoin the basename, so
+* two aliases to the same not-yet-created config still resolve to one identity. If neither
+* the file nor its parent can be canonicalized, the lexical path is returned unchanged (no
+* worse than before, and the common case — an existing project dir — is always canonical).
+*/
+function canonicalizeConfigPath(absoluteConfigPath, depth = 0) {
+	try {
+		return toPosixConfigPath(realpathSync(absoluteConfigPath));
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	let linkStat;
+	try {
+		linkStat = lstatSync(absoluteConfigPath);
+	} catch {
+		linkStat = void 0;
+	}
+	if (linkStat?.isSymbolicLink()) {
+		if (depth >= 40) throw Object.assign(/* @__PURE__ */ new Error(`ELOOP: too many symbolic links while resolving "${absoluteConfigPath}"`), { code: "ELOOP" });
+		const target = readlinkSync(absoluteConfigPath);
+		return canonicalizeConfigPath(resolve(dirname(absoluteConfigPath), target), depth + 1);
+	}
+	const dir = dirname(absoluteConfigPath);
+	try {
+		return join(realpathSync(dir), basename(absoluteConfigPath));
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		return absoluteConfigPath;
+	}
+}
+/**
+* A lock whose owner has not refreshed it within this window is treated as abandoned
+* (crashed) and may be compromised/stolen, so a crashed provision cannot wedge every
+* future one. A LIVE owner refreshes the mutex mtime every {@link LOCK_UPDATE_MS}
+* (strictly less than this), so it never expires by age. Generous vs. a real
+* provision's duration.
+*
+* CORRECTNESS — this heartbeat is a `setTimeout` on the Node event loop, so it only
+* fires while the loop is FREE. The default runner is ASYNC (`spawn`, awaited), so no
+* wrangler call blocks the loop; between/`during` every `await` the pending update timer
+* runs and refreshes the mtime. Fast synchronous bookkeeping (JSON parse, small config
+* reads) is « `LOCK_UPDATE_MS`, so the mtime is continuously refreshed and NO other
+* process ever sees this lock stale → it can never be stolen while we hold it. (The old
+* blocking `spawnSync` could freeze the loop past `LOCK_STALE_MS`, starving the
+* heartbeat AND `onCompromised`, which is exactly the race this closes.)
+*/
+const LOCK_STALE_MS = 12e4;
+/** Refresh interval keeping a live owner's lock fresh (must be < {@link LOCK_STALE_MS}). */
+const LOCK_UPDATE_MS = 2e4;
+/**
+* Backoff budget while waiting for a held (non-stale) lock. Polls with jittered backoff
+* for roughly a minute before giving up, so a concurrent provision blocks (not spins)
+* until the holder releases, then proceeds.
+*/
+const LOCK_RETRIES = {
+	retries: 100,
+	factor: 1.5,
+	minTimeout: 200,
+	maxTimeout: 2e3
+};
+/**
+* The stale window of the RECOVERY mutex (the small proper-lockfile
+* lock serializing every gate→probe→clear→acquire→revalidate decision — see
+* {@link acquireProvisionLock}). Deliberately SHORT: its critical section is a few
+* synchronous fs reads plus one mkdir, so a crashed recoverer frees it within seconds
+* (proper-lockfile's own heartbeat keeps a live recoverer's window fresh).
+*/
+const RECOVERY_LOCK_STALE_MS = 6e3;
+/**
+* Normalize the `retries` knob into the ONE backoff schedule OUR
+* acquisition loop runs (proper-lockfile's internal retrying is disabled with
+* `retries: 0` so the quarantine gate runs on EVERY attempt — see
+* {@link acquireProvisionLock}). A bare number keeps {@link LOCK_RETRIES}' backoff shape.
+*/
+function normalizeLockRetries(retries) {
+	if (typeof retries === "number") return {
+		...LOCK_RETRIES,
+		retries
+	};
+	return {
+		retries: retries?.retries ?? LOCK_RETRIES.retries,
+		factor: retries?.factor ?? LOCK_RETRIES.factor,
+		minTimeout: retries?.minTimeout ?? LOCK_RETRIES.minTimeout,
+		maxTimeout: retries?.maxTimeout ?? LOCK_RETRIES.maxTimeout
+	};
+}
+/**
+* Acquire the cross-process provision lock over the resolved config path via
+* `proper-lockfile` (an atomic `mkdir`-based mutex at `<configPath>.void-provision.lock.lock`).
+* `proper-lockfile` requires the locked pathname to EXIST, so we lock a DEDICATED
+* adjacent marker file (`<configPath>.void-provision.lock`), creating it if absent —
+* never the real config, so the writer's missing-vs-empty config semantics stay
+* untouched. Returns a handle whose `release()` drops the mutex; ALWAYS call it in a
+* `finally` so an interruption never leaks the lock.
+*
+* `onCompromised` FAILS CLOSED (re-throws): if the lock is ever detected stolen (its
+* mtime changed, or the mutex vanished under a live owner), provisioning must NEVER
+* continue — a compromised lock means another process may be racing the same config.
+*
+* Acquisition is ONE atomic recovery protocol, applied on EVERY
+* attempt: quarantine GATE → single non-retrying proper-lockfile acquisition →
+* REVALIDATE the gate under ownership → clear-or-abort. Retrying is owned by THIS
+* function (proper-lockfile runs with `retries: 0`), so a waiter that entered while the
+* holder was healthy re-runs the gate on every backoff attempt and can never stale-take
+* a mutex whose holder QUARANTINED mid-wait; the post-acquire revalidation catches a
+* sidecar that appeared between the last gate and the acquisition itself (the fresh
+* lock is released and the acquisition fails closed).
+*
+* The ENTIRE per-attempt protocol runs under a second small
+* proper-lockfile RECOVERY mutex (`<lockTarget>.recovery`, `retries: 0`, short stale):
+* without it, two recoverers could interleave ACROSS processes — B reads a dead sidecar
+* S0, gets descheduled; A clears S0, acquires the main mutex, quarantines again writing
+* a LIVE sidecar S1; B resumes and unlinks the PATHNAME (now S1) on its stale decision,
+* then stale-reclaims A's retained mutex (the revalidation sees no sidecar). Under the
+* recovery mutex every decision re-reads the sidecar after acquiring it, and the clear
+* is additionally GENERATION-verified (see {@link assertQuarantineClearedOrClear}) for
+* the one interleaving the recovery mutex cannot serialize (the current MAIN-mutex
+* holder quarantining mid-decision). The recovery mutex deliberately does NOT take the
+* caller's `fs` seam — that seam simulates main-mutex failures.
+*/
+async function acquireProvisionLock(configPath, lockOptions) {
+	const lockTarget = `${configPath}.void-provision.lock`;
+	const recoveryTarget = `${lockTarget}.recovery`;
+	if (!existsSync(lockTarget)) writeFileSync(lockTarget, "");
+	if (!existsSync(recoveryTarget)) writeFileSync(recoveryTarget, "");
+	const staleMs = lockOptions?.stale ?? LOCK_STALE_MS;
+	const retryCfg = normalizeLockRetries(lockOptions?.retries);
+	const isElocked = (error) => error?.code === "ELOCKED";
+	const backoffDelay = (attempt) => new Promise((resolveSleep) => setTimeout(resolveSleep, Math.min(retryCfg.minTimeout * retryCfg.factor ** attempt, retryCfg.maxTimeout)));
+	const acquireOnce = () => lockfile.lock(lockTarget, {
+		stale: staleMs,
+		update: lockOptions?.update ?? LOCK_UPDATE_MS,
+		retries: 0,
+		...lockOptions?.fs !== void 0 ? { fs: lockOptions.fs } : {},
+		onCompromised: (error) => {
+			throw error;
+		}
+	});
+	const acquireRecoveryOnce = () => lockfile.lock(recoveryTarget, {
+		stale: RECOVERY_LOCK_STALE_MS,
+		retries: 0,
+		onCompromised: (error) => {
+			throw error;
+		}
+	});
+	let release;
+	for (let attempt = 0;; attempt++) {
+		let releaseRecovery;
+		try {
+			releaseRecovery = await acquireRecoveryOnce();
+		} catch (error) {
+			if (isElocked(error) && attempt < retryCfg.retries) {
+				await backoffDelay(attempt);
+				continue;
+			}
+			throw error;
+		}
+		let mainHeldByOther = false;
+		try {
+			assertQuarantineClearedOrClear(lockTarget, lockOptions?.onBeforeQuarantineClear);
+			try {
+				release = await acquireOnce();
+			} catch (error) {
+				if (isElocked(error) && attempt < retryCfg.retries) mainHeldByOther = true;
+				else throw error;
+			}
+			if (!mainHeldByOther) try {
+				assertQuarantineClearedOrClear(lockTarget, lockOptions?.onBeforeQuarantineClear);
+			} catch (gateError) {
+				let revalidateReleaseError;
+				try {
+					await release();
+				} catch (error) {
+					revalidateReleaseError = error;
+				}
+				release = void 0;
+				if (revalidateReleaseError !== void 0) throw new AggregateError([gateError, revalidateReleaseError], `provision: a quarantine was found right after acquiring the provision lock AND the fresh lock could not be released afterward. Quarantine: ${gateError.message}; release error: ${revalidateReleaseError.message}`, { cause: gateError });
+				throw gateError;
+			}
+		} finally {
+			try {
+				await releaseRecovery();
+			} catch {}
+		}
+		if (!mainHeldByOther) break;
+		await backoffDelay(attempt);
+	}
+	const acquiredRelease = release;
+	let releasePromise;
+	const doRelease = async () => {
+		try {
+			await acquiredRelease();
+		} catch (error) {
+			if (error?.code === "ERELEASED") return;
+			throw new Error(`provision: failed to release the cross-process provision lock "${lockTarget}.lock" (${error.message}). The mutex directory may still exist and will block future provisions until it goes stale (~${Math.round(staleMs / 1e3)}s). Remove it manually if it persists, then retry.`);
+		}
+	};
+	return {
+		lockTargetPath: lockTarget,
+		release: () => releasePromise ??= doRelease(),
+		quarantine: (info) => {
+			if (releasePromise !== void 0) return;
+			try {
+				writeQuarantineSidecar(quarantineSidecarPath(lockTarget), info, lockOptions?.dirDurability);
+			} catch (error) {
+				throw new Error(`provision: could not persist quarantine metadata to "${quarantineSidecarPath(lockTarget)}" (${error.message}). The cross-process provision lock "${lockTarget}.lock" is intentionally STILL HELD by this process (tracked, heartbeat running) so it cannot go stale and be stolen while the unconfirmed wrangler child${info.pid !== void 0 ? ` (pid ${info.pid})` : ""} may still be running. Manual recovery: verify the process is dead${info.pid !== void 0 ? ` (e.g. \`kill -0 ${info.pid}\`)` : ""} and terminate it if not; the lock is freed when this process exits — remove the "${lockTarget}.lock" directory if it persists, then re-run.`);
+			}
+			releasePromise = Promise.resolve();
+			const locks = loadProperLockfileInternals()?.getLocks?.();
+			if (!locks) return;
+			let key;
+			try {
+				key = realpathSync(lockTarget);
+			} catch {
+				key = resolve(lockTarget);
+			}
+			const tracked = locks[key];
+			if (tracked) {
+				tracked.released = true;
+				if (tracked.updateTimeout !== void 0) clearTimeout(tracked.updateTimeout);
+				delete locks[key];
+			}
+		}
+	};
+}
+/**
+* Parse a wrangler `--json` stdout into an array, distinguishing a VALID JSON
+* array (returns it, possibly empty) from unparseable/non-array output (returns
+* `undefined`). Members are returned UNFILTERED — a malformed member (e.g. a
+* `null`) is preserved, NOT silently dropped, so {@link validateResourceList}
+* can fail closed on it (a dropped malformed member could BE the target and look
+* like "absent", minting a duplicate). Used everywhere an empty list must mean
+* "authoritatively absent" and garbage must NOT be coerced to "absent".
+*/
+function parseJsonArrayStrict(stdout) {
+	const value = parseJsonLoose(stdout);
+	return Array.isArray(value) ? value : void 0;
+}
+/** Parse a wrangler `--json` stdout into an object, tolerating noise/failure. */
+function parseJsonObject(stdout) {
+	const value = parseJsonLoose(stdout);
+	return isRecord(value) ? value : void 0;
+}
+/**
+* wrangler may print human banners before the JSON payload; slice from the
+* first `{`/`[` so a leading banner does not break `JSON.parse`.
+*/
+function parseJsonLoose(stdout) {
+	const trimmed = stdout.trim();
+	const start = trimmed.search(/[[{]/);
+	if (start === -1) return;
+	try {
+		return JSON.parse(trimmed.slice(start));
+	} catch {
+		return;
+	}
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Read the single provisioned binding entry for `field`/`binding` from the resolved
+* config, delegating to the STRICT canonical reader in `wrangler.ts`
+* ({@link readProvisionedBindingEntry}). Unlike the old loose first-match `.find()`, this
+* validates the target field's outer shape, fails closed on a DUPLICATE binding, and runs
+* the worker-wide CROSS-TYPE collision check (reusing the Task-3 collector) — so a
+* duplicate/collision config can never be reported `reused` or pass a create postcondition.
+*/
+function readBindingEntry(configPath, field, binding) {
+	return readProvisionedBindingEntry(readRootConfig(configPath), field, binding, configPath);
+}
+/**
+* Read + parse the root wrangler config (fresh each call — wrangler mutates it).
+* BOM-aware (wrangler + the Task 3 writer strip a leading BOM before parsing, so
+* we must too, else a BOM-prefixed config would look unparseable). FAILS CLOSED
+* on a genuine parse error or a non-object root: never silently treat a real
+* config as `{}`, which would miss existing ids (re-provision/orphan) and mask a
+* corrupt file. A missing file is fine (nothing to read-first → `{}`).
+*/
+function readRootConfig(configPath) {
+	if (!existsSync(configPath)) return {};
+	const raw = readFileSync(configPath, "utf-8");
+	const content = raw.startsWith(UTF8_BOM) ? raw.slice(1) : raw;
+	const errors = [];
+	const parsed = parse(content, errors, { allowTrailingComma: true });
+	if (errors.length > 0) throw new Error(`provision: cannot read "${configPath}" — it is not valid JSON/JSONC. Fix the file and retry.`);
+	if (!isRecord(parsed)) throw new Error(`provision: "${configPath}" must be a JSON object.`);
+	return parsed;
+}
+/** Escape a string for literal embedding in a `RegExp`. */
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* FAIL-CLOSED gate over a discovery/list/info result. Throws (no create) unless
+* the child exited cleanly — a NUMERIC `status === 0`. Because
+* {@link normalizeRunWranglerResult} already folds a signal-killed child or a
+* spawn error into a non-zero status, a single numeric check here rejects ALL of
+* nonzero-exit / SIGTERM / spawn-error / non-numeric status. MUST be called
+* BEFORE parsing stdout, so a failed result can never be parsed as "absent".
+*/
+function assertDiscoverySucceeded(result, label) {
+	if (!isCleanSuccess(result)) throw new Error(`provision: "${label}" failed (exit ${String(result.status)}): ${result.stderr || result.stdout || "no output"}. Cannot verify existing resources; refusing to create a possible duplicate.`);
+}
+/**
+* STRICT list validator shared by KV + D1. Rejects the ENTIRE list (throws) if ANY
+* member is not a well-formed object carrying a non-empty name AND a
+* FORMAT-VALID id (per {@link ResourceListSpec.idValidator}). A member is NEVER
+* silently filtered, and a member with a malformed id is NEVER accepted, because
+* either could BE the requested target (or signal a corrupt list) and treating it as
+* "absent" would mint a duplicate. Validates EVERY member up front — BEFORE any
+* name-filtering by the caller — so a nonmatching member with a bogus id can no longer
+* pass the gate as authoritative absence. Returns the validated members (every one
+* guaranteed to have a real id + name) on success.
+*/
+function validateResourceList(list, spec) {
+	const validated = [];
+	for (const member of list) {
+		if (!isRecord(member)) throw new Error(`provision: "${spec.command}" returned a malformed ${spec.resource} entry (not an object). Cannot verify existing resources; refusing to create a possible duplicate.`);
+		const rawName = member[spec.nameField];
+		const nameValid = typeof rawName === "string" && rawName.length > 0;
+		const idValid = spec.hasValidId(member);
+		if (nameValid && !idValid) throw new Error(`provision: "${spec.command}" returned a ${spec.resource} ${spec.nameLabel} ${JSON.stringify(rawName)} with no valid id (${spec.idRule}). Cannot verify existing resources; refusing to create a possible duplicate.`);
+		if (!nameValid) throw new Error(`provision: "${spec.command}" returned a malformed ${spec.resource} entry with no valid ${spec.nameField}. Cannot verify existing resources; refusing to create a possible duplicate.`);
+		validated.push(member);
+	}
+	return validated;
+}
+function reconcileD1IdAliases(entry) {
+	const present = [entry.database_id, entry.uuid].filter((value) => value !== void 0 && value !== "");
+	if (present.length === 0) return { kind: "absent" };
+	const ids = /* @__PURE__ */ new Set();
+	for (const value of present) {
+		if (!isRealD1Id(value)) return { kind: "invalid" };
+		ids.add(value);
+	}
+	if (ids.size !== 1) return { kind: "invalid" };
+	return {
+		kind: "id",
+		id: [...ids][0]
+	};
+}
+/**
+* THE single strict D1 identity normalizer, shared by `d1 list --json` and
+* `d1 info <name> --json`. It reconciles the TWO name aliases (`name`,
+* `database_name`) and TWO id aliases (`database_id`, `uuid`) — an EMPTY STRING is
+* treated as ABSENT for each — and returns a usable id ONLY when the entry
+* unambiguously IS the requested database:
+*   - `{ kind: 'other' }` — no non-empty name alias equals `requestedName`, so this
+*     entry is a different database (the caller skips it, never mistakes it for the
+*     target, and never adopts it under a normalization of a DIFFERENT name);
+*   - `{ kind: 'claimed-but-invalid' }` — a name alias DOES equal `requestedName`
+*     but the entry is ambiguous: CONFLICTING non-empty name aliases (e.g.
+*     `name:"wanted"` + `database_name:"other"`), OR not EXACTLY ONE distinct
+*     non-empty id (0 → no id; >1 → conflicting/blank uuid vs database_id). The
+*     caller fails closed (never adopt, never create a duplicate);
+*   - `{ kind: 'match', id }` — exactly one requested-name alias and exactly one
+*     unambiguous non-empty id.
+* The old two-helper split (`normalizeD1Identity` preferring `database_name`,
+* `d1EntryName` preferring `name`) let a `{name,database_name}` mismatch be
+* SELECTED under one alias yet KEYED under the other. This collapses both into one
+* exact-match rule so no sibling gap remains.
+*/
+function normalizeD1(entry, requestedName) {
+	if (!isRecord(entry)) return { kind: "other" };
+	const names = [entry.name, entry.database_name].filter((value) => typeof value === "string" && value.length > 0);
+	if (!names.includes(requestedName)) return { kind: "other" };
+	if (new Set(names).size > 1) return { kind: "claimed-but-invalid" };
+	const reconciled = reconcileD1IdAliases(entry);
+	if (reconciled.kind !== "id") return { kind: "claimed-but-invalid" };
+	return {
+		kind: "match",
+		id: reconciled.id
+	};
+}
+/**
+* `wrangler kv namespace list` → the `{ id }` of every namespace whose title
+* matches. The list has ALREADY been through {@link validateResourceList} (every
+* member has a non-empty string `id` + `title`), so this only filters + collects.
+*
+* A title-matching namespace whose `id` is NOT a real KV id (32-hex) is ambiguous:
+* we can neither adopt it nor treat it as absent (which would mint a duplicate title), so
+* we FAIL CLOSED. Real wrangler always returns 32-hex ids; this guards a malformed seam.
+*/
+function extractKvMatches(list, title) {
+	const matches = [];
+	for (const ns of list) {
+		if (ns.title !== title) continue;
+		if (!isRealKvId(ns.id)) throw new Error(`provision: "wrangler kv namespace list" returned a namespace titled ${JSON.stringify(title)} with a malformed id ${JSON.stringify(ns.id)} (expected a 32-character hex namespace id). Cannot verify whether it already exists; refusing to create a possible duplicate.`);
+		matches.push({ id: ns.id });
+	}
+	return matches;
+}
+/** True when a `d1 create` failure means the name is already taken (code 7502). */
+function isAlreadyExistsError(result) {
+	const text = `${result.stdout}\n${result.stderr}`;
+	return text.includes("7502") || /already exists/i.test(text);
+}
+/**
+* EXACT, name-aware not-found classifier shared by R2 + queues. Given a
+* already-NON-zero `<res> info`-by-name probe, returns `true` (confirmed absent →
+* safe to create) ONLY on wrangler's exact, resource-specific not-found signal
+* for THIS name (regex-escaped). Everything else returns `false` so the caller
+* fails closed — a signal/spawn failure, an auth/network/metrics error, or a
+* GENERIC "not found" (e.g. `Account not found`) is NEVER treated as absence,
+* which would mint a duplicate resource.
+*/
+function isConfirmedAbsent(result, kind, name) {
+	if (!isCleanFailure(result)) return false;
+	const text = `${result.stdout}\n${result.stderr}`;
+	switch (kind) {
+		case "r2": return /\[code:\s*10006\]/.test(text);
+		case "queue": return new RegExp(`Queue\\s+"${escapeRegExp(name)}"\\s+does not exist`, "i").test(text);
+	}
+}
+/**
+* A `wrangler queues info <name>` result POSITIVELY confirms THIS queue does NOT
+* exist in the account. Narrow, queue-only view of {@link isConfirmedAbsent}, shared
+* with the deploy orchestrator's pre-build queue probe (`cli/deploy.ts`) so both call
+* sites classify the SAME wrangler output the SAME way. Only the exact, name-aware
+* `Queue "<name>" does not exist` on a clean non-zero exit returns `true`; every other
+* outcome (success, signal/spawn failure, auth or network error, generic "not found")
+* returns `false` and is left for the caller to treat as inconclusive.
+*/
+function isQueueConfirmedAbsent(result, name) {
+	return isConfirmedAbsent(result, "queue", name);
+}
+/**
+* A `wrangler queues info <name>` result POSITIVELY confirms THIS queue
+* exists. Queues write NO config, so a create cannot be verified by re-reading the
+* config (the D1/KV/R2/Hyperdrive backstop). And wrangler's `bin.wrangler` wrapper
+* maps a signal-killed inner CLI to `process.exit(0)` (`bin/wrangler.js`:
+* `code === null → exit(0)`), so a KILLED probe/create can surface a clean exit 0
+* with empty/partial output. A bare clean 0 is therefore NOT proof the queue exists.
+* We require BOTH a clean success (numeric exit 0, no signal/spawn error — the
+* provenance rule) AND the output to name THIS exact queue: wrangler 4.107's
+* `queues info` prints `Queue Name: <queue_name>` for the queue it fetched by name
+* (account-unique), so an exact `Queue Name: <name>` line is the positive signal.
+* Used for BOTH the reuse probe and the post-create verify probe.
+*/
+function queueInfoConfirmsExists(result, name) {
+	if (!isCleanSuccess(result)) return false;
+	const text = `${result.stdout}\n${result.stderr}`;
+	return new RegExp(`^Queue Name:\\s+${escapeRegExp(name)}\\s*$`, "m").test(text);
+}
+/**
+* Throw when the writer could not attach `migrations_dir` because no matching
+* `d1_databases[]` entry exists. The provisioner only writes `migrations_dir`
+* AFTER establishing the D1 entry (create/adopt/reuse), so a skip here means the
+* D1 resource is unexpectedly absent from the config — never silently succeed
+* with the gap unfilled.
+*/
+function assertD1MigrationsDirApplied(result, binding, configPath) {
+	if (result.d1MigrationsDirSkipped) throw new Error(`provision: could not set migrations_dir for D1 binding ${JSON.stringify(binding)} — no matching d1_databases entry exists in "${configPath}" after provisioning it. The D1 resource was not written to the config as expected; inspect the file and retry.`);
+}
+/**
+* Backstop — verify a create's POSTCONDITION, RESOURCE-SPECIFICALLY + identity
+* checked. wrangler 4.107's `bin.wrangler` is a WRAPPER that spawns
+* `wrangler-dist/cli.js` and maps a signal-killed child (`code === null`) to
+* `process.exit(0)`, so `spawnSync` can see a `create` report "success" though the
+* real CLI was killed and `--update-config` wrote NO id. After every config-writing
+* create (d1/kv/r2/hyperdrive) reports success we RE-READ the resolved config and
+* CONFIRM the target binding now holds a REAL id AND — where the resource's name is
+* its identity (R2 `bucket_name`, D1 `database_name`) — that the recorded name EXACTLY
+* matches the requested one; otherwise we FAIL CLOSED. A bare "some non-placeholder
+* value" check is NOT enough: for R2, `bucket_name` IS the identity, so
+* `{ bucket_name: 'other' }` would otherwise pass and bind the WRONG bucket. This also
+* catches any partial/silent create failure, not only kills. (Queue creates write NO
+* config, so they cannot be verified this way — a killed queue-create self-heals on
+* the next read-first/probe run, which re-detects absence and re-creates.)
+*/
+function assertCreateWroteRealId(configPath, spec, binding, name) {
+	const entry = readBindingEntry(configPath, spec.field, binding);
+	const idOk = !!entry && spec.idValidator(entry[spec.idField]);
+	const nameOk = spec.nameField === void 0 || !!entry && entry[spec.nameField] === name;
+	if (!idOk || !nameOk) throw new Error(`provision: "${spec.command} ${name}" reported success but "${configPath}" does not hold the expected ${spec.resource} for binding ${JSON.stringify(binding)} afterward (need a real ${spec.idField}${spec.nameField ? ` and ${spec.nameField} === ${JSON.stringify(name)}` : ""}). The create may have been interrupted or written a different resource — wrangler's launcher can mask a signal-killed child as exit 0. Refusing to record a wrong/unprovisioned resource; inspect the account/config and retry.`);
+}
+/** True when `value` contains an ASCII control character (0x00–0x1F or 0x7F). */
+function hasControlChar(value) {
+	for (let i = 0; i < value.length; i++) {
+		const code = value.charCodeAt(i);
+		if (code < 32 || code === 127) return true;
+	}
+	return false;
+}
+/** The universal option-injection guard for ANY wrangler ARGV positional. */
+function assertNoOptionInjection(kind, name) {
+	if (typeof name !== "string" || name.length === 0 || name.startsWith("-") || hasControlChar(name)) throw new Error(`provision: refusing to pass an unsafe ${kind} name ${JSON.stringify(name)} to wrangler. A name may not be empty, begin with "-" (it would be parsed as a CLI flag), or contain control characters. Rename the resource and retry.`);
+}
+/**
+* Per-resource Cloudflare naming GRAMMAR, verified 2026-07 against wrangler 4.107
+* and live account resources:
+*   - `r2`      — wrangler's own `isValidR2BucketName`: 3–63 chars, lowercase letters /
+*                 digits / `-`, begin+end alphanumeric (DNS-like). This IS the identity.
+*   - `kvTitle` — the KV namespace positional is forwarded verbatim as the account TITLE;
+*                 Cloudflare allows a broad charset INCLUDING SPACES (≤512 chars). We only
+*                 forbid control chars (already covered by the injection guard) — spaces
+*                 and mixed case are legal, so "My Own Namespace" is accepted.
+*   - `d1` / `hyperdrive` / `queue` — 1–63 chars, begin with a letter/digit, then
+*                 letters / digits / `-` / `_` (matches every live D1 `name`, Hyperdrive
+*                 config `name`, and Void's `QUEUE_<NAME>`-derived queue names).
+*/
+const RESOURCE_NAME_GRAMMARS = {
+	r2: {
+		re: R2_BUCKET_NAME_RE,
+		label: "R2 bucket",
+		rule: "be 3–63 characters, contain only lowercase letters, digits and \"-\", and begin and end with a letter or digit"
+	},
+	kvTitle: {
+		re: /^[\s\S]{1,512}$/,
+		label: "KV namespace",
+		rule: "be 1–512 characters and contain no control characters (spaces are allowed)"
+	},
+	d1: {
+		re: /^[A-Za-z0-9][A-Za-z0-9_-]{0,62}$/,
+		label: "D1 database",
+		rule: "be 1–63 characters, start with a letter or digit, and contain only letters, digits, \"-\" or \"_\""
+	},
+	hyperdrive: {
+		re: /^[A-Za-z0-9][A-Za-z0-9_-]{0,62}$/,
+		label: "Hyperdrive config",
+		rule: "be 1–63 characters, start with a letter or digit, and contain only letters, digits, \"-\" or \"_\""
+	},
+	queue: {
+		re: /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/,
+		label: "queue",
+		rule: "be 1–63 characters, contain only letters, digits and \"-\", and begin and end with a letter or digit"
+	}
+};
+/**
+* Validate a name destined for a wrangler ARGV positional: FIRST the universal
+* option-injection guard, THEN the resource's own Cloudflare grammar. Fail closed on any
+* violation, before the account gate or any wrangler/REST call.
+*
+* Exported — like {@link isQueueConfirmedAbsent} — so the deploy orchestrator's
+* no-`--provision` queue probe (`cli/deploy.ts`) gates names on the SAME rules this
+* provisioner enforces, instead of only the `--provision` path being protected. Queue names
+* are taken verbatim from filenames with no sanitization, so without this gate a name
+* beginning with `-` reaches wrangler as a FLAG rather than a positional.
+*/
+function assertValidResourceName(kind, name) {
+	assertNoOptionInjection(RESOURCE_NAME_GRAMMARS[kind].label, name);
+	const grammar = RESOURCE_NAME_GRAMMARS[kind];
+	if (!grammar.re.test(name)) throw new Error(`provision: refusing to pass an invalid ${grammar.label} name ${JSON.stringify(name)} to wrangler. A ${grammar.label} name must ${grammar.rule}. Rename the resource and retry.`);
+}
+/**
+* The trailing flags EVERY provisioner wrangler invocation MUST carry, built
+* ONCE so no call site can forget them:
+*   - `-c <configPath>` pins the ONE resolved config (no split-brain reads/writes);
+*   - `--env=` (an explicit EMPTY environment) FORCES wrangler onto the top-level
+*     config environment. wrangler 4.107 selects its config env as
+*     `args.env ?? getCloudflareEnv()`; passing an explicit empty `args.env`
+*     short-circuits the `??` so a project `.env`/`.env.local` that sets
+*     `CLOUDFLARE_ENV` (reloaded into `process.env` on every wrangler command)
+*     can NEVER reselect a named `env.*` block — whose `account_id`/bindings could
+*     differ from the single account this provision resolved, patched, and pinned.
+*     `--env=` is wrangler's own documented sentinel for "use the top-level
+*     environment" (it prints exactly this guidance when multiple env blocks exist).
+* Discovery/create AND `--update-config` therefore all operate on the SAME
+* top-level config/account.
+*/
+function wranglerConfigArgs(configPath) {
+	return [
+		"-c",
+		configPath,
+		"--env="
+	];
+}
+/**
+* Build a redactor that strips connection-string secrets from every string the
+* provisioner PROPAGATES (buffered wrangler stdout/stderr, error strings, logged
+* warnings). Two layers:
+*   1. the EXACT desired connection string (when this provision carries one) is replaced
+*      whole, so no derived message can echo it verbatim;
+*   2. any URL userinfo password (`scheme://user:secret@…`) is masked generically, so a
+*      wrangler error that re-renders a connection string in ANY spelling still never
+*      leaks the password (the scheme + user survive for diagnostics).
+* Applied at the single runWrangler choke point (every call site reads pre-redacted
+* results) and to the Hyperdrive lister's propagated failure message.
+*/
+function createSecretRedactor(connectionString) {
+	return (text) => {
+		let out = text;
+		if (typeof connectionString === "string" && connectionString.length > 0) out = out.split(connectionString).join("[REDACTED]");
+		out = out.replace(/(\w[\w+.-]*:\/\/[^\s/@:]+:)[^\s@/]+(@)/g, "$1[REDACTED]$2");
+		return out;
+	};
+}
+/**
+* The engine's own lazy `Error#stack` accessor pair, captured ONCE at
+* module init. V8 defines `stack` as an own get/set accessor on every Error instance,
+* sharing ONE getter/setter function across all of them — so FUNCTION IDENTITY proves
+* "this is the engine's deterministic lazy-stack slot" (user code cannot forge these
+* function identities). It is the ONLY accessor the in-place sanitizer may handle;
+* every other accessor forces the inert fallback carrier.
+*/
+const engineStackDescriptor = Object.getOwnPropertyDescriptor(/* @__PURE__ */ new Error(), "stack");
+const ENGINE_STACK_GET = engineStackDescriptor?.get;
+const ENGINE_STACK_SET = engineStackDescriptor?.set;
+/**
+* The ONLY prototypes a rebuilt carrier may have restored. Restoring an
+* ARBITRARY prototype would reintroduce hostile behavior on the otherwise-inert carrier
+* (a prototype getter or `toString` the carrier's readers would still hit), so an
+* unknown prototype degrades to the base Error/Object/Array prototype the fresh carrier
+* was built with. `WranglerQuarantineError` is included so a rebuilt quarantine carrier
+* keeps its `instanceof` classification.
+*/
+const KNOWN_SAFE_PROTOTYPES = /* @__PURE__ */ new Set([
+	Error.prototype,
+	TypeError.prototype,
+	RangeError.prototype,
+	ReferenceError.prototype,
+	SyntaxError.prototype,
+	EvalError.prototype,
+	URIError.prototype,
+	AggregateError.prototype,
+	WranglerQuarantineError.prototype,
+	Object.prototype,
+	Array.prototype
+]);
+function tryRedactValue(value, redactText) {
+	try {
+		if (typeof value === "string") return {
+			ok: true,
+			value: redactText(value)
+		};
+		if (typeof value !== "object" || value === null) return {
+			ok: true,
+			value
+		};
+		if (!types.isProxy(value) && sanitizeInPlace(value, redactText)) return {
+			ok: true,
+			value
+		};
+		return {
+			ok: true,
+			value: deepSanitizedCopy(value, redactText)
+		};
+	} catch {
+		return { ok: false };
+	}
+}
+/**
+* Attempt to redact `root` fully IN PLACE. Returns `true` only when EVERY string
+* that needed redaction was verifiably rewritten (assignment read back); any immutable
+* or unverifiable slot holding a secret returns `false` so the caller switches to the
+* fallback-carrier copy. Partial rewrites applied before a `false` are harmless — they
+* only ever REMOVE secret text, and the caller then discards the original anyway.
+*/
+function sanitizeInPlace(root, redactText) {
+	const seen = /* @__PURE__ */ new WeakSet();
+	let ok = true;
+	const visitChild = (child) => {
+		if (typeof child === "object" && child !== null) visit(child);
+	};
+	const visit = (v) => {
+		if (!ok || seen.has(v)) return;
+		seen.add(v);
+		if (types.isProxy(v)) {
+			ok = false;
+			return;
+		}
+		if (v instanceof Map) {
+			for (const [key, val] of Array.from(v.entries())) {
+				const newKey = typeof key === "string" ? redactText(key) : key;
+				const newVal = typeof val === "string" ? redactText(val) : val;
+				visitChild(key);
+				visitChild(val);
+				if (newKey !== key) v.delete(key);
+				if (newKey !== key || newVal !== val) v.set(newKey, newVal);
+				if (!ok) return;
+			}
+			return;
+		}
+		if (v instanceof Set) {
+			for (const member of Array.from(v.values())) {
+				if (typeof member === "string") {
+					const red = redactText(member);
+					if (red !== member) {
+						v.delete(member);
+						v.add(red);
+					}
+				} else visitChild(member);
+				if (!ok) return;
+			}
+			return;
+		}
+		for (const key of Reflect.ownKeys(v)) {
+			const desc = Object.getOwnPropertyDescriptor(v, key);
+			if (!desc) continue;
+			if (desc.get !== void 0 || desc.set !== void 0) {
+				if (!(key === "stack" && ENGINE_STACK_GET !== void 0 && desc.get === ENGINE_STACK_GET && desc.set === ENGINE_STACK_SET)) {
+					ok = false;
+					return;
+				}
+				let current;
+				try {
+					current = desc.get !== void 0 ? desc.get.call(v) : void 0;
+				} catch {
+					ok = false;
+					return;
+				}
+				if (typeof current === "string") {
+					const red = redactText(current);
+					if (red !== current) {
+						if (desc.set === void 0) {
+							ok = false;
+							return;
+						}
+						try {
+							desc.set.call(v, red);
+						} catch {
+							ok = false;
+							return;
+						}
+						let after;
+						try {
+							const afterDesc = Object.getOwnPropertyDescriptor(v, key);
+							after = afterDesc?.get !== void 0 ? afterDesc.get.call(v) : afterDesc?.value;
+						} catch {
+							ok = false;
+							return;
+						}
+						if (after !== red) {
+							ok = false;
+							return;
+						}
+					}
+				} else visitChild(current);
+				if (!ok) return;
+				continue;
+			}
+			const val = desc.value;
+			if (typeof val === "string") {
+				const red = redactText(val);
+				if (red === val) continue;
+				if (desc.writable !== true) {
+					ok = false;
+					return;
+				}
+				try {
+					v[key] = red;
+				} catch {
+					ok = false;
+					return;
+				}
+				if (Object.getOwnPropertyDescriptor(v, key)?.value !== red) {
+					ok = false;
+					return;
+				}
+			} else {
+				visitChild(val);
+				if (!ok) return;
+			}
+		}
+	};
+	visit(root);
+	return ok;
+}
+/**
+* The fallback CARRIER: a fully sanitized deep copy of `root`, built when in-place
+* redaction is impossible. Fresh objects/arrays/Errors/Maps/Sets (all mutable), every
+* string redacted, every own property — enumerable or not, string or symbol key —
+* carried over as a plain data property, accessors snapshotted (an unreadable getter
+* becomes `'[unredactable]'`), the original PROTOTYPE restored so `instanceof`
+* classification (e.g. {@link WranglerQuarantineError}) survives the rebuild. Cycle-safe
+* (a cycle in the original maps to the same cycle among the copies).
+*/
+function deepSanitizedCopy(root, redactText) {
+	const copies = /* @__PURE__ */ new WeakMap();
+	const copy = (v) => {
+		if (typeof v === "string") return redactText(v);
+		if (typeof v !== "object" || v === null) return v;
+		if (copies.has(v)) return copies.get(v);
+		if (v instanceof Map) {
+			const out = /* @__PURE__ */ new Map();
+			copies.set(v, out);
+			for (const [key, val] of v.entries()) out.set(copy(key), copy(val));
+			return out;
+		}
+		if (v instanceof Set) {
+			const out = /* @__PURE__ */ new Set();
+			copies.set(v, out);
+			for (const member of v.values()) out.add(copy(member));
+			return out;
+		}
+		const out = Array.isArray(v) ? [] : v instanceof Error ? /* @__PURE__ */ new Error() : {};
+		const proto = Object.getPrototypeOf(v);
+		if (typeof proto === "object" && proto !== null && KNOWN_SAFE_PROTOTYPES.has(proto)) try {
+			Object.setPrototypeOf(out, proto);
+		} catch {}
+		copies.set(v, out);
+		for (const key of Reflect.ownKeys(v)) {
+			const desc = Object.getOwnPropertyDescriptor(v, key);
+			if (!desc) continue;
+			let val;
+			if (desc.get !== void 0 || desc.set !== void 0) try {
+				val = desc.get !== void 0 ? desc.get.call(v) : void 0;
+			} catch {
+				val = "[unredactable]";
+			}
+			else val = desc.value;
+			try {
+				Object.defineProperty(out, key, {
+					value: copy(val),
+					writable: true,
+					enumerable: desc.enumerable === true,
+					configurable: true
+				});
+			} catch {}
+		}
+		return out;
+	};
+	return copy(root);
+}
+/**
+* Extract a SAFELY-READ, redacted one-line message from an unknown
+* value, for logging. Never coerces an object (`String()`/template literals invoke an
+* arbitrary — possibly hostile — `toString`): only primitives are stringified, and for
+* objects only a plain string `message` field is read (inside the no-throw boundary; a
+* throwing trap/getter degrades to the generic placeholder). THE one helper every
+* logging path uses for unknown rejection values (grep-proven: the Hyperdrive lister
+* warning and the rebuilt-carrier message below).
+*/
+function safeRedactedErrorMessage(value, redactText) {
+	try {
+		if (typeof value === "string") return redactText(value);
+		if (value === null || value === void 0 || typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return String(value);
+		const message = value.message;
+		if (typeof message === "string") return redactText(message);
+	} catch {}
+	return "the rejection could not be rendered safely; its content was withheld";
+}
+/** The conservative carrier for a rejection that resists inspection. */
+function unsafeInspectionQuarantineCarrier() {
+	const carrier = /* @__PURE__ */ new Error("provision: a propagated rejection could not be safely inspected (a property or prototype trap threw during redaction); its content was withheld. Treating it conservatively as an unconfirmed-wrangler-child (quarantine) failure: the whole-provision lock is retained, not released.");
+	Object.assign(carrier, {
+		quarantine: true,
+		pid: void 0
+	});
+	return carrier;
+}
+/**
+* Redact a seam REJECTION with EVERYTHING — the quarantine
+* classification included — inside the ONE no-throw boundary, GUARANTEEING:
+*   1. this function NEVER throws (pre-fix, `isQuarantineError`'s `instanceof` ran on
+*      the ORIGINAL value before any boundary — a Proxy with throwing
+*      `getPrototypeOf`/property traps made the redactor itself throw a
+*      secret-bearing, classification-free replacement error, and the outer path then
+*      RELEASED the mutex under a possibly-live child);
+*   2. if inspection is unsafe ANYWHERE (classification, redaction, message reads), it
+*      FAILS CLOSED AS QUARANTINE: a fresh INERT sanitized carrier marked
+*      `{ quarantine: true }` propagates, so the mutex is retained (conservative — the
+*      hostile value could have been hiding a real quarantine) and no trap error or
+*      secret ever escapes;
+*   3. a quarantined rejection can never degrade into an ordinary failure: the
+*      classification + pid are captured inside the boundary and restored structurally
+*      on the carrier when a rebuild lost them.
+*/
+function redactRejection(error, redactText) {
+	try {
+		const wasQuarantine = isQuarantineError(error);
+		const quarantinePid = wasQuarantine && typeof error.pid === "number" ? error.pid : void 0;
+		const attempt = tryRedactValue(error, redactText);
+		if (!attempt.ok) return unsafeInspectionQuarantineCarrier();
+		const redacted = attempt.value;
+		if (!wasQuarantine || isQuarantineError(redacted)) return redacted;
+		const carrier = redacted instanceof Error ? redacted : new Error(safeRedactedErrorMessage(redacted, redactText));
+		Object.assign(carrier, {
+			quarantine: true,
+			pid: quarantinePid
+		});
+		return carrier;
+	} catch {
+		return unsafeInspectionQuarantineCarrier();
+	}
+}
+/**
+* Ensure every resource in `desired` exists in the user's own Cloudflare account,
+* creating the missing ones by shelling out to `wrangler` and letting
+* `wrangler <res> create --update-config` write real ids into the root config.
+* For resources that already exist (adopt path) — where `create` cannot run —
+* the real id is captured from `wrangler <res> list/info` (or, for Hyperdrive,
+* the account-list existence seam) and written through the Task 3 writer's adopt
+* fields. Pure provisioning: NO build, deploy, or drift-check. Idempotent +
+* read-first: a binding already pointing at a real id is left untouched.
+*/
+async function provisionCloudflareResources(root, rootWranglerPath, desired, opts) {
+	const releaseProvisionSlot = acquireProcessProvisionSlot();
+	try {
+		return await provisionWithProcessSlot(root, rootWranglerPath, desired, opts);
+	} finally {
+		releaseProvisionSlot();
+	}
+}
+/** The provision body, run while holding this process's single provision slot. */
+async function provisionWithProcessSlot(root, rootWranglerPath, desired, opts) {
+	await Promise.resolve();
+	const configPath = canonicalizeConfigPath(resolve(root, rootWranglerPath));
+	const lock = await acquireProvisionLock(configPath, opts?.lockOptions);
+	const quarantineHook = (info) => retainQuarantinedLock(lock, info);
+	activeProvisionQuarantineHook = quarantineHook;
+	let result;
+	let threw = false;
+	let bodyError;
+	try {
+		result = await provisionCloudflareResourcesLocked(root, configPath, desired, opts);
+	} catch (error) {
+		threw = true;
+		bodyError = error;
+	}
+	if (activeProvisionQuarantineHook === quarantineHook) activeProvisionQuarantineHook = void 0;
+	if (threw) {
+		if (isQuarantineError(bodyError)) {
+			try {
+				retainQuarantinedLock(lock, {
+					pid: typeof bodyError.pid === "number" ? bodyError.pid : void 0,
+					reason: typeof bodyError.message === "string" ? bodyError.message : String(bodyError)
+				});
+			} catch (quarantineError) {
+				throw new AggregateError([bodyError, quarantineError], `provision failed with an unconfirmed wrangler child AND its quarantine metadata could not be persisted — the cross-process provision lock is intentionally still held by this process (not released, not stealable) while the child may live. Primary error: ${bodyError instanceof Error ? bodyError.message : String(bodyError)}; quarantine error: ${quarantineError instanceof Error ? quarantineError.message : String(quarantineError)}.`, { cause: bodyError });
+			}
+			throw bodyError;
+		}
+		let releaseError;
+		try {
+			await lock.release();
+		} catch (error) {
+			releaseError = error;
+		}
+		if (releaseError !== void 0) throw new AggregateError([bodyError, releaseError], `provision failed AND the cross-process provision lock could not be released afterward — a leaked mutex may block future provisions. Primary error: ${bodyError instanceof Error ? bodyError.message : String(bodyError)}; release error: ${releaseError instanceof Error ? releaseError.message : String(releaseError)}.`, { cause: bodyError });
+		throw bodyError;
+	}
+	await lock.release();
+	return result;
+}
+/**
+* The provision body, run entirely UNDER the whole-provision lock (see
+* {@link provisionCloudflareResources}). `configPath` is the ONE resolved absolute
+* config path the lock is keyed on — threaded through read-first, wrangler `-c`, and
+* the writer so reads/writes can never hit different files.
+*/
+async function provisionCloudflareResourcesLocked(root, configPath, desired, opts) {
+	if (existsSync(configPath)) {
+		const raw = readFileSync(configPath, "utf-8");
+		assertNoDuplicateMembers(raw.startsWith(UTF8_BOM) ? raw.slice(1) : raw, configPath);
+	}
+	if (desired.d1) assertValidResourceName("d1", desired.d1.name);
+	for (const { title } of desired.kvNamespaces) assertValidResourceName("kvTitle", title);
+	if (desired.r2) assertValidResourceName("r2", desired.r2.bucketName);
+	if (desired.hyperdrive) assertValidResourceName("hyperdrive", desired.hyperdrive.name);
+	for (const queueName of desired.queues) assertValidResourceName("queue", queueName);
+	const rootConfig = readRootConfig(configPath);
+	const rawConfigAccountId = rootConfig.account_id;
+	const configAccountId = typeof rawConfigAccountId === "string" && rawConfigAccountId.length > 0 ? rawConfigAccountId : void 0;
+	const rawComplianceRegion = rootConfig.compliance_region;
+	if (rawComplianceRegion !== void 0 && typeof rawComplianceRegion !== "string") throw new Error(`provision: "${configPath}" has a non-string "compliance_region"; it must be "public" or "fedramp_high". Fix the config and retry.`);
+	const configComplianceRegion = typeof rawComplianceRegion === "string" ? rawComplianceRegion : void 0;
+	if (configAccountId && opts?.accountId && configAccountId !== opts.accountId) throw new Error(`provision: Cloudflare account mismatch — "${configPath}" pins account_id ${JSON.stringify(configAccountId)} but deploy requested ${JSON.stringify(opts.accountId)}. Reconcile them (correct or remove the config's account_id, or deploy to the pinned account) and retry.`);
+	const ambientAccountId = typeof process.env.CLOUDFLARE_ACCOUNT_ID === "string" && process.env.CLOUDFLARE_ACCOUNT_ID.length > 0 ? process.env.CLOUDFLARE_ACCOUNT_ID : void 0;
+	const effectiveAccountId = configAccountId ?? opts?.accountId ?? ambientAccountId;
+	const log = opts?.log ?? defaultLogger;
+	const resources = [];
+	const write = (patch) => writeProvisionedWranglerConfig(root, patch, { configPath });
+	const hasRemoteWork = !!desired.d1 || desired.kvNamespaces.length > 0 || !!desired.r2 || !!desired.hyperdrive || desired.queues.length > 0;
+	if (hasRemoteWork && !effectiveAccountId) throw new Error("provision: no Cloudflare account is resolvable — set \"account_id\" in your root wrangler config or export CLOUDFLARE_ACCOUNT_ID before deploying. Refusing to provision resources without a pinned account (wrangler would otherwise fall back to an ambient/interactive account that is never persisted, so a later retry could rebind them elsewhere).");
+	if (hasRemoteWork) assertNoTransportRedirectInProjectDotenv(root);
+	if (desired.hyperdrive && !opts?.listHyperdriveConfigs) {
+		const { binding, name, connectionString } = desired.hyperdrive;
+		const entry = readBindingEntry(configPath, "hyperdrive", binding);
+		if (!(entry !== void 0 && isRealHyperdriveId(entry.id)) && !resolveHyperdriveApiToken(opts?.apiToken)) {
+			if (connectionString) throw new Error(`provision: Hyperdrive config ${JSON.stringify(name)} is not in "${configPath}" yet, and creating it needs a Cloudflare API token. wrangler exposes no machine-readable Hyperdrive list, so Void checks the account over the Cloudflare REST API, which a "wrangler login" (OAuth) session cannot authenticate. Without that check a create would silently duplicate an existing same-named config, so nothing was provisioned. Either (a) export CLOUDFLARE_API_TOKEN with Hyperdrive edit permission and rerun, or (b) create the Hyperdrive config yourself (dashboard / "wrangler hyperdrive create") and add its id to the ${JSON.stringify(binding)} hyperdrive binding in "${configPath}" — deploying an already-provisioned Hyperdrive needs no token.`);
+			throw new Error(`provision: Hyperdrive config ${JSON.stringify(name)} is not in "${configPath}" yet, and there is no DATABASE_URL to create it from. Nothing was provisioned. Either (a) export DATABASE_URL with your PostgreSQL connection string and rerun (Void reads it from the shell — a value in .env/.env.local is NOT used here, so it never ships as a plaintext worker var), or (b) create the Hyperdrive config yourself (dashboard / "wrangler hyperdrive create") and add its id to the ${JSON.stringify(binding)} hyperdrive binding in "${configPath}" — deploying an already-provisioned Hyperdrive needs neither DATABASE_URL nor an API token.`);
+		}
+	}
+	let accountIdWritten = false;
+	if (effectiveAccountId && configAccountId !== effectiveAccountId) {
+		write({ accountId: effectiveAccountId });
+		accountIdWritten = true;
+	}
+	const transportAccountId = effectiveAccountId;
+	const transportApiBaseUrl = resolvePinnedApiBaseUrl(process.env, configComplianceRegion);
+	const selectedRunWrangler = opts?.runWrangler ?? createDefaultRunWrangler(root);
+	const redactSecrets = createSecretRedactor(desired.hyperdrive?.connectionString);
+	const redactResult = (result) => ({
+		...result,
+		stdout: redactSecrets(result.stdout),
+		stderr: redactSecrets(result.stderr),
+		error: result.error != null ? redactSecrets(result.error) : result.error
+	});
+	const runWrangler = (args, callOpts) => Promise.resolve(selectedRunWrangler(args, {
+		...callOpts,
+		accountId: transportAccountId,
+		apiBaseUrl: transportApiBaseUrl
+	})).then(redactResult, (error) => {
+		throw redactRejection(error, redactSecrets);
+	});
+	if (desired.d1) {
+		const { binding, name } = desired.d1;
+		const migrationsDir = desired.d1.migrationsDir ?? D1_MIGRATIONS_DIR;
+		const entry = readBindingEntry(configPath, "d1_databases", binding);
+		if (entry && isRealD1Id(entry.database_id)) {
+			const storedName = entry.database_name;
+			if (storedName !== void 0 && storedName !== name) throw new Error(`provision: D1 binding ${JSON.stringify(binding)} in "${configPath}" stores database_name ${JSON.stringify(storedName)} (with a real database_id), but this deploy wants database ${JSON.stringify(name)}. Refusing to reuse a database that contradicts the desired name. Fix "${configPath}" — correct the entry's database_name/database_id (or remove the entry to re-provision) — or rename the desired database, then retry.`);
+			assertD1MigrationsDirApplied(write({ d1MigrationsDir: {
+				binding,
+				dir: migrationsDir
+			} }), binding, configPath);
+			resources.push({
+				kind: "d1",
+				binding,
+				name,
+				action: "reused",
+				id: entry.database_id
+			});
+		} else {
+			const listResult = await runWrangler([
+				"d1",
+				"list",
+				"--json",
+				...wranglerConfigArgs(configPath)
+			], { captureJson: true });
+			assertDiscoverySucceeded(listResult, "wrangler d1 list");
+			const rawList = parseJsonArrayStrict(listResult.stdout);
+			if (!rawList) throw new Error(`provision: "wrangler d1 list --json" did not return a JSON array; cannot verify whether D1 database ${JSON.stringify(name)} exists. Refusing to create a possible duplicate.`);
+			const claimants = validateResourceList(rawList, {
+				resource: "D1 database",
+				command: "wrangler d1 list",
+				hasValidId: (member) => reconcileD1IdAliases(member).kind === "id",
+				idRule: "its uuid/database_id aliases must be present, well-formed D1 UUIDs agreeing on one id",
+				nameField: "name",
+				nameLabel: "named"
+			}).map((db) => normalizeD1(db, name)).filter((m) => m.kind !== "other");
+			if (claimants.length > 1) throw new Error(`provision: "wrangler d1 list" returned ${claimants.length} D1 databases named ${JSON.stringify(name)}. D1 database names are account-unique, so this is ambiguous; cannot pick one to adopt and refusing to create a possible duplicate. Inspect the account and retry.`);
+			if (claimants.length === 1 && claimants[0].kind === "claimed-but-invalid") throw new Error(`provision: "wrangler d1 list" returned a D1 database named ${JSON.stringify(name)} with an ambiguous or empty id (conflicting/blank uuid/database_id, or conflicting name aliases). Cannot adopt it, and refusing to create a possible duplicate; inspect the account and retry.`);
+			const existing = claimants.length === 1 && claimants[0].kind === "match" ? claimants[0] : void 0;
+			if (existing) {
+				log.info(`adopted existing D1 database ${name} (${existing.id})`);
+				assertD1MigrationsDirApplied(write({
+					d1: {
+						binding,
+						databaseName: name,
+						databaseId: existing.id
+					},
+					d1MigrationsDir: {
+						binding,
+						dir: migrationsDir
+					}
+				}), binding, configPath);
+				resources.push({
+					kind: "d1",
+					binding,
+					name,
+					action: "adopted",
+					id: existing.id
+				});
+			} else {
+				const created = await runWrangler([
+					"d1",
+					"create",
+					name,
+					"--binding",
+					binding,
+					"--update-config",
+					...wranglerConfigArgs(configPath)
+				]);
+				if (isCleanSuccess(created)) {
+					assertCreateWroteRealId(configPath, {
+						field: "d1_databases",
+						idField: "database_id",
+						idValidator: isRealD1Id,
+						nameField: "database_name",
+						resource: "D1 database",
+						command: "wrangler d1 create"
+					}, binding, name);
+					assertD1MigrationsDirApplied(write({ d1MigrationsDir: {
+						binding,
+						dir: migrationsDir
+					} }), binding, configPath);
+					resources.push({
+						kind: "d1",
+						binding,
+						name,
+						action: "created"
+					});
+				} else if (isCleanFailure(created) && isAlreadyExistsError(created)) {
+					const infoResult = await runWrangler([
+						"d1",
+						"info",
+						name,
+						"--json",
+						...wranglerConfigArgs(configPath)
+					], { captureJson: true });
+					assertDiscoverySucceeded(infoResult, `wrangler d1 info ${name}`);
+					const info = normalizeD1(parseJsonObject(infoResult.stdout), name);
+					if (info.kind !== "match") throw new Error(`provision: "wrangler d1 create ${name}" reported the database already exists, but "wrangler d1 info ${name} --json" did not return a database with a matching name and an unambiguous id. Refusing to adopt an unverified database.`);
+					log.info(`adopted existing D1 database ${name} (${info.id})`);
+					assertD1MigrationsDirApplied(write({
+						d1: {
+							binding,
+							databaseName: name,
+							databaseId: info.id
+						},
+						d1MigrationsDir: {
+							binding,
+							dir: migrationsDir
+						}
+					}), binding, configPath);
+					resources.push({
+						kind: "d1",
+						binding,
+						name,
+						action: "adopted",
+						id: info.id
+					});
+				} else throw new Error(`provision: "wrangler d1 create ${name}" failed: ${created.stderr || created.stdout}`);
+			}
+		}
+	}
+	for (const { binding, title } of desired.kvNamespaces) {
+		const entry = readBindingEntry(configPath, "kv_namespaces", binding);
+		if (entry && isRealKvId(entry.id)) {
+			resources.push({
+				kind: "kv",
+				binding,
+				name: title,
+				action: "reused",
+				id: entry.id
+			});
+			continue;
+		}
+		const listResult = await runWrangler([
+			"kv",
+			"namespace",
+			"list",
+			...wranglerConfigArgs(configPath)
+		], { captureJson: true });
+		assertDiscoverySucceeded(listResult, "wrangler kv namespace list");
+		const rawList = parseJsonArrayStrict(listResult.stdout);
+		if (!rawList) throw new Error(`provision: "wrangler kv namespace list" did not return a JSON array; cannot verify whether KV namespace ${JSON.stringify(title)} exists. Refusing to create a possible duplicate.`);
+		const matches = extractKvMatches(validateResourceList(rawList, {
+			resource: "KV namespace",
+			command: "wrangler kv namespace list",
+			hasValidId: (member) => isRealKvId(member.id),
+			idRule: "its id is missing or not a well-formed 32-hex namespace id",
+			nameField: "title",
+			nameLabel: "titled"
+		}), title);
+		if (matches.length > 0) {
+			const chosen = matches.reduce((min, ns) => ns.id < min.id ? ns : min);
+			if (matches.length > 1) log.warn(`multiple KV namespaces titled "${title}" (${matches.map((m) => m.id).join(", ")}); adopting the lexicographically-smallest id ${chosen.id}`);
+			log.info(`adopted existing KV namespace ${title} (${chosen.id})`);
+			write({ kv: {
+				binding,
+				id: chosen.id
+			} });
+			resources.push({
+				kind: "kv",
+				binding,
+				name: title,
+				action: "adopted",
+				id: chosen.id
+			});
+		} else {
+			const created = await runWrangler([
+				"kv",
+				"namespace",
+				"create",
+				title,
+				"--binding",
+				binding,
+				"--update-config",
+				...wranglerConfigArgs(configPath)
+			]);
+			if (!isCleanSuccess(created)) throw new Error(`provision: "wrangler kv namespace create ${title}" failed: ${created.stderr || created.stdout}`);
+			assertCreateWroteRealId(configPath, {
+				field: "kv_namespaces",
+				idField: "id",
+				idValidator: isRealKvId,
+				resource: "KV namespace",
+				command: "wrangler kv namespace create"
+			}, binding, title);
+			resources.push({
+				kind: "kv",
+				binding,
+				name: title,
+				action: "created"
+			});
+		}
+	}
+	if (desired.r2) {
+		const { binding, bucketName } = desired.r2;
+		const entry = readBindingEntry(configPath, "r2_buckets", binding);
+		const storedBucketName = entry?.bucket_name;
+		if (entry && isRealStoredR2BucketName(storedBucketName)) {
+			if (storedBucketName !== bucketName) throw new Error(`provision: R2 binding ${JSON.stringify(binding)} in "${configPath}" stores bucket_name ${JSON.stringify(storedBucketName)}, but this deploy wants bucket ${JSON.stringify(bucketName)}. bucket_name IS the R2 identity, so this entry contradicts the desired bucket. Fix "${configPath}" — correct the entry's bucket_name (or remove the entry to re-provision) — or rename the desired bucket, then retry.`);
+			resources.push({
+				kind: "r2",
+				binding,
+				name: bucketName,
+				action: "reused"
+			});
+		} else {
+			const info = await runWrangler([
+				"r2",
+				"bucket",
+				"info",
+				bucketName,
+				"--json",
+				...wranglerConfigArgs(configPath)
+			], { captureJson: true });
+			if (isCleanSuccess(info)) {
+				const payload = parseJsonObject(info.stdout);
+				if (!payload || payload.name !== bucketName) throw new Error(`provision: "wrangler r2 bucket info ${bucketName} --json" exited 0 but did not identify the requested bucket (expected name ${JSON.stringify(bucketName)}). Refusing to adopt an unverified bucket. Output: ${info.stdout || info.stderr}`);
+				log.info(`adopted existing R2 bucket ${bucketName}`);
+				write({ r2: {
+					binding,
+					bucketName
+				} });
+				resources.push({
+					kind: "r2",
+					binding,
+					name: bucketName,
+					action: "adopted"
+				});
+			} else if (isConfirmedAbsent(info, "r2", bucketName)) {
+				const created = await runWrangler([
+					"r2",
+					"bucket",
+					"create",
+					bucketName,
+					"--binding",
+					binding,
+					"--update-config",
+					...wranglerConfigArgs(configPath)
+				]);
+				if (!isCleanSuccess(created)) throw new Error(`provision: "wrangler r2 bucket create ${bucketName}" failed: ${created.stderr || created.stdout}`);
+				assertCreateWroteRealId(configPath, {
+					field: "r2_buckets",
+					idField: "bucket_name",
+					idValidator: isValidR2BucketNameFormat,
+					nameField: "bucket_name",
+					resource: "R2 bucket",
+					command: "wrangler r2 bucket create"
+				}, binding, bucketName);
+				if (bucketName === R2_BUCKET_NAME_PLACEHOLDER) {
+					const verify = await runWrangler([
+						"r2",
+						"bucket",
+						"info",
+						bucketName,
+						"--json",
+						...wranglerConfigArgs(configPath)
+					], { captureJson: true });
+					const payload = isCleanSuccess(verify) ? parseJsonObject(verify.stdout) : void 0;
+					if (!payload || payload.name !== bucketName) throw new Error(`provision: "wrangler r2 bucket create ${bucketName}" reported success but a follow-up "wrangler r2 bucket info ${bucketName}" did not confirm the bucket exists. The create may have been interrupted — wrangler's launcher can mask a signal-killed child as exit 0, and the config entry is indistinguishable from the local-dev placeholder for this name. Refusing to record an unprovisioned bucket; inspect the account and retry.`);
+				}
+				resources.push({
+					kind: "r2",
+					binding,
+					name: bucketName,
+					action: "created"
+				});
+			} else throw new Error(`provision: "wrangler r2 bucket info ${bucketName}" failed: ${info.stderr || info.stdout}. Cannot determine whether the bucket exists; refusing to create a possible duplicate.`);
+		}
+	}
+	if (desired.hyperdrive) {
+		const { binding, name, connectionString } = desired.hyperdrive;
+		const entry = readBindingEntry(configPath, "hyperdrive", binding);
+		if (entry && isRealHyperdriveId(entry.id)) resources.push({
+			kind: "hyperdrive",
+			binding,
+			name,
+			action: "reused",
+			id: entry.id
+		});
+		else {
+			const lister = opts?.listHyperdriveConfigs ?? createDefaultListHyperdriveConfigs(opts?.apiToken);
+			let validatedConfigs;
+			let existenceUnknown = true;
+			if (lister) try {
+				const result = await withListerDeadline((signal) => lister({
+					accountId: transportAccountId,
+					apiBaseUrl: transportApiBaseUrl,
+					signal
+				}), opts?.listTimeoutMs ?? HYPERDRIVE_LIST_TIMEOUT_MS);
+				if (!Array.isArray(result)) throw new Error(`the existence check returned a ${result === null ? "null" : typeof result} result instead of an array`);
+				validatedConfigs = result;
+				existenceUnknown = false;
+			} catch (error) {
+				log.warn(`Hyperdrive existence check for ${name} failed: ` + safeRedactedErrorMessage(error, redactSecrets));
+				existenceUnknown = true;
+				validatedConfigs = void 0;
+			}
+			const existing = validatedConfigs !== void 0 ? selectHyperdriveMatch(validatedConfigs, name, configPath) : void 0;
+			if (existing) {
+				log.info(`adopted existing Hyperdrive config ${name} (${existing.id})`);
+				write({ hyperdrive: {
+					binding,
+					id: existing.id
+				} });
+				resources.push({
+					kind: "hyperdrive",
+					binding,
+					name,
+					action: "adopted",
+					id: existing.id
+				});
+			} else if (!connectionString) {
+				const reason = "no connection string provided";
+				log.warn(`skipping Hyperdrive config ${name}: ${reason}`);
+				resources.push({
+					kind: "hyperdrive",
+					binding,
+					name,
+					action: "skipped",
+					reason
+				});
+			} else if (existenceUnknown) throw new Error(`provision: cannot verify whether Hyperdrive config ${JSON.stringify(name)} already exists (no existence check available — provide an accountId + API token, or inject a listHyperdriveConfigs seam). "wrangler hyperdrive create" silently duplicates a same-named config, so provisioning refuses to create it blindly.`);
+			else {
+				const created = await runWrangler([
+					"hyperdrive",
+					"create",
+					name,
+					`--connection-string=${connectionString}`,
+					"--binding",
+					binding,
+					"--update-config",
+					...wranglerConfigArgs(configPath)
+				]);
+				if (!isCleanSuccess(created)) throw new Error(`provision: "wrangler hyperdrive create ${name}" failed: ${created.stderr || created.stdout}`);
+				assertCreateWroteRealId(configPath, {
+					field: "hyperdrive",
+					idField: "id",
+					idValidator: isRealHyperdriveId,
+					resource: "Hyperdrive config",
+					command: "wrangler hyperdrive create"
+				}, binding, name);
+				resources.push({
+					kind: "hyperdrive",
+					binding,
+					name,
+					action: "created"
+				});
+			}
+		}
+	}
+	for (const name of desired.queues) {
+		const info = await runWrangler([
+			"queues",
+			"info",
+			name,
+			...wranglerConfigArgs(configPath)
+		]);
+		if (queueInfoConfirmsExists(info, name)) {
+			resources.push({
+				kind: "queue",
+				name,
+				action: "reused"
+			});
+			continue;
+		}
+		if (!isConfirmedAbsent(info, "queue", name)) throw new Error(`provision: "wrangler queues info ${name}" failed or did not confirm the queue exists: ${info.stderr || info.stdout || "no output"}`);
+		const created = await runWrangler([
+			"queues",
+			"create",
+			name,
+			...wranglerConfigArgs(configPath)
+		]);
+		if (!isCleanSuccess(created)) throw new Error(`provision: "wrangler queues create ${name}" failed: ${created.stderr || created.stdout}`);
+		if (!queueInfoConfirmsExists(await runWrangler([
+			"queues",
+			"info",
+			name,
+			...wranglerConfigArgs(configPath)
+		]), name)) throw new Error(`provision: "wrangler queues create ${name}" reported success but "wrangler queues info ${name}" did not confirm the queue exists afterward. The create may have been interrupted — wrangler's launcher can mask a signal-killed child as exit 0. Refusing to record an unprovisioned queue; inspect the account and retry.`);
+		resources.push({
+			kind: "queue",
+			name,
+			action: "created"
+		});
+	}
+	return {
+		resources,
+		configPath,
+		accountIdWritten
+	};
+}
+//#endregion
+export { WranglerQuarantineError, acquireProvisionLock, assertNoTransportRedirectInProjectDotenv, assertValidResourceName, checkCloudflareProvisionDrift, createDefaultRunWrangler, deleteEnvVarCaseAware, isAlreadyGoneKillError, isQuarantineError, isQueueConfirmedAbsent, isRealD1Id, isRealKvId, normalizeRunWranglerResult, provisionCloudflareResources, provisionEnv, resolvePinnedApiBaseUrl, scanWranglerDotenvKeys };