void 0.21.9 → 0.23.0

package/dist/{provision-BhreDAOS.mjs → provision-CJFgTZY8.mjs}

@@ -1,8 +1,9 @@
 import { a as join, n as dirname, o as normalize, t as basename, u as resolve$2 } from "./dist-BVqXeR_h.mjs";
-import { R as persistCloudflareConfig, _ as readProvisionedBindingEntry, k as writeProvisionedWranglerConfig, s as assertNoDuplicateMembers } from "./wrangler-BymcxrRa.mjs";
+import { i as persistCloudflareConfig } from "./cloudflare-config-Bktvwtpf.mjs";
+import { A as writeProvisionedWranglerConfig, s as assertNoDuplicateMembers, v as readProvisionedBindingEntry } from "./wrangler-7K-bW_DL.mjs";
 import { i as voidWarn, r as voidLog } from "./log-ChfPKsVd.mjs";
 import { r as scanWranglerDotenvKeys } from "./dotenv-VQxupEUv.mjs";
-import { o as resolveWranglerArgv } from "./preset-UHj9ARyP.mjs";
+import { c as resolveCloudflareOperationArgv, n as decodeCloudflareOperationResult, r as encodeCloudflareOperation } from "./cloudflare-process-B-wekeR6.mjs";
 import { createRequire } from "node:module";
 import { closeSync, existsSync, fsyncSync, lstatSync, openSync, readFileSync, readlinkSync, realpathSync, renameSync, unlinkSync, writeSync } from "node:fs";
 import { randomUUID } from "node:crypto";
@@ -418,8 +419,8 @@ let activeProvisionQuarantineHook;
 function isQuarantineError(error) {
 	return error instanceof WranglerQuarantineError || error?.quarantine === true;
 }
-/** The (at most one) currently-registered {runner, owning-lock} pair. */
-let activeRegistration;
+/** Concurrent registrations are allowed only for two immutable Worker uploads. */
+const activeRegistrations = /* @__PURE__ */ new Map();
 let coordinatorListenersInstalled = false;
 let activeTeardown;
 let reRaisedOnce = false;
@@ -437,21 +438,25 @@ function removeCoordinatorListeners() {
 	process.removeListener("SIGINT", onCoordinatorSigint);
 	process.removeListener("SIGTERM", onCoordinatorSigterm);
 }
-function registerRunner(registrant) {
-	if (activeRegistration !== void 0) throw new Error("provision: internal invariant violated — a second wrangler child tried to register while one is already active in this process");
-	activeRegistration = {
+function canRegisterRunner(parallelWorkerUpload) {
+	return activeRegistrations.size === 0 || parallelWorkerUpload && activeProvisionQuarantineHook === void 0 && activeRegistrations.size < 2 && [...activeRegistrations.values()].every((entry) => entry.parallelWorkerUpload);
+}
+function registerRunner(registrant, parallelWorkerUpload) {
+	if (!canRegisterRunner(parallelWorkerUpload)) throw new Error("provision: internal invariant violated — a Cloudflare child tried to register outside its concurrency limit");
+	activeRegistrations.set(registrant, {
 		registrant,
-		lockQuarantine: activeProvisionQuarantineHook
-	};
+		lockQuarantine: activeProvisionQuarantineHook,
+		parallelWorkerUpload
+	});
 	installCoordinatorListeners();
 }
 function deregisterRunner(registrant) {
-	if (activeRegistration?.registrant === registrant) activeRegistration = void 0;
-	if (activeRegistration === void 0 && activeTeardown === void 0 && retentionWatchdog === void 0) removeCoordinatorListeners();
+	activeRegistrations.delete(registrant);
+	if (activeRegistrations.size === 0 && activeTeardown === void 0 && retentionWatchdog === void 0) removeCoordinatorListeners();
 }
 function coordinatorHandleSignal(signal) {
 	if (activeTeardown !== void 0) return;
-	if (retentionWatchdog !== void 0 && activeRegistration === void 0) {
+	if (retentionWatchdog !== void 0 && activeRegistrations.size === 0) {
 		process.stderr.write(`provision: ignoring ${signal} — a provision lock is retained while an unconfirmed wrangler child may live and its quarantine metadata is not yet durable. The process exits once the child is confirmed dead or the metadata persists.\n`);
 		return;
 	}
@@ -462,15 +467,15 @@ function coordinatorHandleSignal(signal) {
 		persistFailed: false,
 		finished: false,
 		deadlineTimer: void 0,
-		expirePendingPair: void 0
+		expirePendingPairs: []
 	};
 	activeTeardown = teardown;
-	const snapshot = activeRegistration !== void 0 ? [activeRegistration] : [];
+	const snapshot = [...activeRegistrations.values()];
 	teardown.pending = snapshot.length;
 	if (snapshot.length > 0) {
 		const deadlineMs = Math.max(...snapshot.map((r) => r.registrant.teardownDeadlineMs));
 		teardown.deadlineTimer = setTimeout(() => {
-			teardown.expirePendingPair?.(`the coordinator-wide ${deadlineMs}ms teardown deadline expired before the process group's termination was confirmed`);
+			for (const expire of teardown.expirePendingPairs) expire(`the coordinator-wide ${deadlineMs}ms teardown deadline expired before the process group's termination was confirmed`);
 		}, deadlineMs);
 	}
 	for (const registration of snapshot) coordinatorTearDownRegistrant(teardown, registration);
@@ -507,7 +512,7 @@ function coordinatorTearDownRegistrant(teardown, registration) {
 		registrant.quarantine(detail);
 		complete();
 	};
-	teardown.expirePendingPair = quarantinePair;
+	teardown.expirePendingPairs.push(quarantinePair);
 	const outcome = registrant.signalGroup(teardown.signal);
 	if (typeof outcome === "object") {
 		quarantinePair(`the process group could not be signalled: ${outcome.error.message}`);
@@ -560,7 +565,7 @@ function armRetentionWatchdog(lock, info) {
 	const resolveWatchdog = () => {
 		if (retentionWatchdog !== void 0) clearTimeout(retentionWatchdog.timer);
 		retentionWatchdog = void 0;
-		if (activeRegistration === void 0 && activeTeardown === void 0) removeCoordinatorListeners();
+		if (activeRegistrations.size === 0 && activeTeardown === void 0) removeCoordinatorListeners();
 	};
 	const tick = () => {
 		if (info.pid !== void 0) {
@@ -594,11 +599,10 @@ function armRetentionWatchdog(lock, info) {
 	};
 }
 /**
-* Default `runWrangler`: resolves the project-local wrangler as an ARGV launcher
-* via Task 2's {@link resolveWranglerArgv} and runs it with `spawn` and
-* `shell: false`, so every argument is passed literally (no shell parsing → no
-* injection). Captures stdout (for `--json` parsing) and stderr (for
-* error/collision detection). Never called in unit tests — those inject a stub.
+* Default provider runner: launches the isolated typed operation entry through
+* {@link resolveCloudflareOperationArgv} with `shell: false`. Public request fields
+* travel as literal JSON argv; secrets travel through stdin. Captured stdout carries
+* the structured result envelope, while stderr carries provider diagnostics.
 *
 * ASYNC (returns a Promise). `spawn` + `await` (vs. the old blocking
 * `spawnSync`) keeps the Node event loop free while wrangler runs, so
@@ -608,7 +612,7 @@ function armRetentionWatchdog(lock, info) {
 * {@link COMMAND_TIMEOUT_MS} SIGKILL guards against a hung child.
 */
 function createDefaultRunWrangler(root, options) {
-	const launcher = options?.launcher ?? resolveWranglerArgv(root);
+	const launcher = options?.launcher ?? resolveCloudflareOperationArgv(root);
 	const timeoutMs = options?.timeoutMs ?? COMMAND_TIMEOUT_MS;
 	const confirmGraceMs = options?.confirmKillGraceMs ?? CONFIRM_KILL_GRACE_MS;
 	const killProcessGroup = options?.killProcessGroup ?? ((target, signal) => process.kill(target, signal));
@@ -616,15 +620,16 @@ function createDefaultRunWrangler(root, options) {
 	const isWindows = process.platform === "win32";
 	const teardownDeadlineMs = options?.signalTeardownDeadlineMs ?? confirmGraceMs + SIGNAL_TEARDOWN_DEADLINE_MARGIN_MS;
 	return (args, opts) => new Promise((resolvePromise, rejectPromise) => {
+		const parallelWorkerUpload = options?.parallelWorkerUpload === true && args.type === "versions.upload";
 		if (activeTeardown !== void 0) {
 			rejectPromise(/* @__PURE__ */ new Error(`provision: refusing to spawn wrangler — a fatal ${activeTeardown.signal} is being handled and this process is terminating; no new wrangler work may start.`));
 			return;
 		}
-		if (activeRegistration !== void 0) {
-			rejectPromise(/* @__PURE__ */ new Error("provision: refusing to spawn wrangler — another wrangler child is already active in this process (wrangler calls must run sequentially; provisions run at most one per process)."));
+		if (!canRegisterRunner(parallelWorkerUpload)) {
+			rejectPromise(/* @__PURE__ */ new Error("provision: refusing to spawn wrangler — another wrangler child is already active in this process (only two immutable Worker uploads may overlap; all other Cloudflare commands and provisions remain sequential)."));
 			return;
 		}
-		const child = spawn(command, [...prefix, ...args], {
+		const child = spawn(command, [...prefix, ...encodeCloudflareOperation(args)], {
 			cwd: opts.cwd ?? root,
 			shell: false,
 			env: {
@@ -635,7 +640,7 @@ function createDefaultRunWrangler(root, options) {
 				...opts.suppressLogs ? { WRANGLER_WRITE_LOGS: "false" } : {}
 			},
 			stdio: [
-				"ignore",
+				opts.input === void 0 ? "ignore" : "pipe",
 				"pipe",
 				"pipe"
 			],
@@ -716,7 +721,7 @@ function createDefaultRunWrangler(root, options) {
 			settled = true;
 			clearTimeout(commandTimer);
 			deregisterSelf();
-			resolvePromise(result);
+			resolvePromise(decodeCloudflareOperationResult(result));
 		};
 		const quarantine = (detail) => {
 			if (settled) return;
@@ -789,7 +794,7 @@ function createDefaultRunWrangler(root, options) {
 				signal: "SIGKILL"
 			}), `the timeout SIGKILL (${timeoutStderr()})`);
 		}, timeoutMs);
-		child.on("error", (error) => {
+		const handleProcessError = (error) => {
 			if (!spawned && typeof child.pid !== "number") {
 				finish(normalizeRunWranglerResult({
 					stdout,
@@ -815,7 +820,9 @@ function createDefaultRunWrangler(root, options) {
 				status: null,
 				signal: "SIGKILL"
 			}), `a post-spawn child error (${error.message}; the group was SIGKILLed)`);
-		});
+		};
+		child.on("error", handleProcessError);
+		child.stdin?.on("error", handleProcessError);
 		child.on("close", (code, signal) => {
 			closed = true;
 			if (timedOut || postSpawnError !== void 0) {
@@ -842,8 +849,9 @@ function createDefaultRunWrangler(root, options) {
 			confirmThenSettle(makeResult, `the child's exit (status ${String(code)}; surviving process-group members were SIGKILLed)`);
 			nudgeConfirmPolls();
 		});
-		registerRunner(registrant);
+		registerRunner(registrant, parallelWorkerUpload);
 		options?.onSpawnedChild?.(child);
+		if (opts.input !== void 0) child.stdin?.end(opts.input);
 	});
 }
 /**
@@ -890,7 +898,7 @@ function isCleanSuccess(result) {
 * classified for a resource-specific not-found signal.
 */
 function isCleanFailure(result) {
-	return !isHardFailure(result) && typeof result.status === "number" && result.status !== 0;
+	return !isHardFailure(result) && Number.isSafeInteger(result.status) && result.status > 0;
 }
 /**
 * The OVERALL deadline for the Hyperdrive existence lister (across ALL its paginated
@@ -1416,29 +1424,12 @@ async function acquireProvisionLock(configPath, lockOptions) {
 * like "absent", minting a duplicate). Used everywhere an empty list must mean
 * "authoritatively absent" and garbage must NOT be coerced to "absent".
 */
-function parseJsonArrayStrict(stdout) {
-	const value = parseJsonLoose(stdout);
+function parseJsonArrayStrict(value) {
 	return Array.isArray(value) ? value : void 0;
 }
-/** Parse a wrangler `--json` stdout into an object, tolerating noise/failure. */
-function parseJsonObject(stdout) {
-	const value = parseJsonLoose(stdout);
+function parseJsonObject(value) {
 	return isRecord(value) ? value : void 0;
 }
-/**
-* wrangler may print human banners before the JSON payload; slice from the
-* first `{`/`[` so a leading banner does not break `JSON.parse`.
-*/
-function parseJsonLoose(stdout) {
-	const trimmed = stdout.trim();
-	const start = trimmed.search(/[[{]/);
-	if (start === -1) return;
-	try {
-		return JSON.parse(trimmed.slice(start));
-	} catch {
-		return;
-	}
-}
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -1471,17 +1462,13 @@ function readRootConfig(configPath) {
 	if (!isRecord(parsed)) throw new Error(`provision: "${configPath}" must be a JSON object.`);
 	return parsed;
 }
-/** Escape a string for literal embedding in a `RegExp`. */
-function escapeRegExp(value) {
-	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 /**
 * FAIL-CLOSED gate over a discovery/list/info result. Throws (no create) unless
 * the child exited cleanly — a NUMERIC `status === 0`. Because
 * {@link normalizeRunWranglerResult} already folds a signal-killed child or a
 * spawn error into a non-zero status, a single numeric check here rejects ALL of
 * nonzero-exit / SIGTERM / spawn-error / non-numeric status. MUST be called
-* BEFORE parsing stdout, so a failed result can never be parsed as "absent".
+* BEFORE reading provider data, so failed discovery never implies absence.
 */
 function assertDiscoverySucceeded(result, label) {
 	if (!isCleanSuccess(result)) throw new Error(`provision: "${label}" failed (exit ${String(result.status)}): ${result.stderr || result.stdout || "no output"}. Cannot verify existing resources; refusing to create a possible duplicate.`);
@@ -1577,8 +1564,7 @@ function extractKvMatches(list, title) {
 }
 /** True when a `d1 create` failure means the name is already taken (code 7502). */
 function isAlreadyExistsError(result) {
-	const text = `${result.stdout}\n${result.stderr}`;
-	return text.includes("7502") || /already exists/i.test(text);
+	return result.errorCode === 7502;
 }
 /**
 * EXACT, name-aware not-found classifier shared by R2 + queues. Given a
@@ -1589,43 +1575,16 @@ function isAlreadyExistsError(result) {
 * GENERIC "not found" (e.g. `Account not found`) is NEVER treated as absence,
 * which would mint a duplicate resource.
 */
-function isConfirmedAbsent(result, kind, name) {
-	if (!isCleanFailure(result)) return false;
-	const text = `${result.stdout}\n${result.stderr}`;
-	switch (kind) {
-		case "r2": return /\[code:\s*10006\]/.test(text);
-		case "queue": return new RegExp(`Queue\\s+"${escapeRegExp(name)}"\\s+does not exist`, "i").test(text);
-	}
+function isConfirmedAbsent(result, kind, _name) {
+	return isCleanFailure(result) && (kind === "r2" ? result.errorCode === 10006 : result.failure === "not-found");
 }
-/**
-* A `wrangler queues info <name>` result POSITIVELY confirms THIS queue does NOT
-* exist in the account. Narrow, queue-only view of {@link isConfirmedAbsent}, shared
-* with the deploy orchestrator's pre-build queue probe (`cli/deploy.ts`) so both call
-* sites classify the SAME wrangler output the SAME way. Only the exact, name-aware
-* `Queue "<name>" does not exist` on a clean non-zero exit returns `true`; every other
-* outcome (success, signal/spawn failure, auth or network error, generic "not found")
-* returns `false` and is left for the caller to treat as inconclusive.
-*/
+/** Only a completed, typed not-found response confirms queue absence. */
 function isQueueConfirmedAbsent(result, name) {
 	return isConfirmedAbsent(result, "queue", name);
 }
-/**
-* A `wrangler queues info <name>` result POSITIVELY confirms THIS queue
-* exists. Queues write NO config, so a create cannot be verified by re-reading the
-* config (the D1/KV/R2/Hyperdrive backstop). And wrangler's `bin.wrangler` wrapper
-* maps a signal-killed inner CLI to `process.exit(0)` (`bin/wrangler.js`:
-* `code === null → exit(0)`), so a KILLED probe/create can surface a clean exit 0
-* with empty/partial output. A bare clean 0 is therefore NOT proof the queue exists.
-* We require BOTH a clean success (numeric exit 0, no signal/spawn error — the
-* provenance rule) AND the output to name THIS exact queue: wrangler 4.131's
-* `queues info` prints `Queue Name: <queue_name>` for the queue it fetched by name
-* (account-unique), so an exact `Queue Name: <name>` line is the positive signal.
-* Used for BOTH the reuse probe and the post-create verify probe.
-*/
+/** Reuse and post-create verification require clean success and the exact returned name. */
 function queueInfoConfirmsExists(result, name) {
-	if (!isCleanSuccess(result)) return false;
-	const text = `${result.stdout}\n${result.stderr}`;
-	return new RegExp(`^Queue Name:\\s+${escapeRegExp(name)}\\s*$`, "m").test(text);
+	return isCleanSuccess(result) && isRecord(result.data) && result.data.name === name;
 }
 /**
 * Throw when the writer could not attach `migrations_dir` because no matching
@@ -1728,29 +1687,6 @@ function assertValidResourceName(kind, name) {
 	if (!grammar.re.test(name)) throw new Error(`provision: refusing to pass an invalid ${grammar.label} name ${JSON.stringify(name)} to wrangler. A ${grammar.label} name must ${grammar.rule}. Rename the resource and retry.`);
 }
 /**
-* The trailing flags EVERY provisioner wrangler invocation MUST carry, built
-* ONCE so no call site can forget them:
-*   - `-c <configPath>` pins the ONE resolved config (no split-brain reads/writes);
-*   - `--env=` (an explicit EMPTY environment) FORCES wrangler onto the top-level
-*     config environment. wrangler 4.131 selects its config env as
-*     `args.env ?? getCloudflareEnv()`; passing an explicit empty `args.env`
-*     short-circuits the `??` so a project `.env`/`.env.local` that sets
-*     `CLOUDFLARE_ENV` (reloaded into `process.env` on every wrangler command)
-*     can NEVER reselect a named `env.*` block — whose `account_id`/bindings could
-*     differ from the single account this provision resolved, patched, and pinned.
-*     `--env=` is wrangler's own documented sentinel for "use the top-level
-*     environment" (it prints exactly this guidance when multiple env blocks exist).
-* Discovery/create AND `--update-config` therefore all operate on the SAME
-* top-level config/account.
-*/
-function wranglerConfigArgs(configPath) {
-	return [
-		"-c",
-		configPath,
-		"--env="
-	];
-}
-/**
 * Build a redactor that strips connection-string secrets from every string the
 * provisioner PROPAGATES (buffered wrangler stdout/stderr, error strings, logged
 * warnings). Two layers:
@@ -2151,14 +2087,12 @@ async function reconcileD1(desired, configPath, runWrangler, write, persistCreat
 				id: entry.database_id
 			});
 		} else {
-			const listResult = await runWrangler([
-				"d1",
-				"list",
-				"--json",
-				...wranglerConfigArgs(configPath)
-			], { captureJson: true });
+			const listResult = await runWrangler({
+				type: "d1.list",
+				configPath
+			}, {});
 			assertDiscoverySucceeded(listResult, "wrangler d1 list");
-			const rawList = parseJsonArrayStrict(listResult.stdout);
+			const rawList = parseJsonArrayStrict(listResult.data);
 			if (!rawList) throw new Error(`provision: "wrangler d1 list --json" did not return a JSON array; cannot verify whether D1 database ${JSON.stringify(name)} exists. Refusing to create a possible duplicate.`);
 			const claimants = validateResourceList(rawList, {
 				resource: "D1 database",
@@ -2192,15 +2126,12 @@ async function reconcileD1(desired, configPath, runWrangler, write, persistCreat
 					id: existing.id
 				});
 			} else {
-				const created = await runWrangler([
-					"d1",
-					"create",
+				const created = await runWrangler({
+					type: "d1.create",
 					name,
-					"--binding",
 					binding,
-					"--update-config",
-					...wranglerConfigArgs(configPath)
-				]);
+					configPath
+				});
 				if (isCleanSuccess(created)) {
 					assertCreateWroteRealId(configPath, {
 						field: "d1_databases",
@@ -2222,15 +2153,13 @@ async function reconcileD1(desired, configPath, runWrangler, write, persistCreat
 						action: "created"
 					});
 				} else if (isCleanFailure(created) && isAlreadyExistsError(created)) {
-					const infoResult = await runWrangler([
-						"d1",
-						"info",
+					const infoResult = await runWrangler({
+						type: "d1.info",
 						name,
-						"--json",
-						...wranglerConfigArgs(configPath)
-					], { captureJson: true });
+						configPath
+					}, {});
 					assertDiscoverySucceeded(infoResult, `wrangler d1 info ${name}`);
-					const info = normalizeD1(parseJsonObject(infoResult.stdout), name);
+					const info = normalizeD1(parseJsonObject(infoResult.data), name);
 					if (info.kind !== "match") throw new Error(`provision: "wrangler d1 create ${name}" reported the database already exists, but "wrangler d1 info ${name} --json" did not return a database with a matching name and an unambiguous id. Refusing to adopt an unverified database.`);
 					log.info(`adopted existing D1 database ${name} (${info.id})`);
 					assertD1MigrationsDirApplied(write({
@@ -2265,21 +2194,11 @@ async function reconcileD1(desired, configPath, runWrangler, write, persistCreat
 		else {
 			let token = opts?.apiToken ?? process.env.CLOUDFLARE_API_TOKEN;
 			if (!token) {
-				const auth = await runWrangler([
-					"auth",
-					"token",
-					"--json",
-					...wranglerConfigArgs(configPath)
-				], {
-					captureJson: true,
-					suppressLogs: true
-				});
-				const start = auth.stdout.indexOf("{");
-				const end = auth.stdout.lastIndexOf("}");
-				let parsed;
-				if (isCleanSuccess(auth) && start >= 0 && end > start) try {
-					parsed = JSON.parse(auth.stdout.slice(start, end + 1));
-				} catch {}
+				const auth = await runWrangler({
+					type: "auth.token",
+					configPath
+				}, { suppressLogs: true });
+				const parsed = isCleanSuccess(auth) && isRecord(auth.data) ? auth.data : void 0;
 				if ((parsed?.type === "oauth" || parsed?.type === "api_token") && typeof parsed.token === "string") token = parsed.token;
 			}
 			if (!token) throw new Error("provision: D1 read replication requires a Cloudflare API bearer with D1 Edit permission. Log in with `wrangler login` or set CLOUDFLARE_API_TOKEN, then retry.");
@@ -2300,14 +2219,12 @@ async function reconcileKv(desired, configPath, runWrangler, write, persistCreat
 			});
 			continue;
 		}
-		const listResult = await runWrangler([
-			"kv",
-			"namespace",
-			"list",
-			...wranglerConfigArgs(configPath)
-		], { captureJson: true });
+		const listResult = await runWrangler({
+			type: "kv.namespace.list",
+			configPath
+		}, {});
 		assertDiscoverySucceeded(listResult, "wrangler kv namespace list");
-		const rawList = parseJsonArrayStrict(listResult.stdout);
+		const rawList = parseJsonArrayStrict(listResult.data);
 		if (!rawList) throw new Error(`provision: "wrangler kv namespace list" did not return a JSON array; cannot verify whether KV namespace ${JSON.stringify(title)} exists. Refusing to create a possible duplicate.`);
 		const matches = extractKvMatches(validateResourceList(rawList, {
 			resource: "KV namespace",
@@ -2333,16 +2250,12 @@ async function reconcileKv(desired, configPath, runWrangler, write, persistCreat
 				id: chosen.id
 			});
 		} else {
-			const created = await runWrangler([
-				"kv",
-				"namespace",
-				"create",
-				title,
-				"--binding",
+			const created = await runWrangler({
+				type: "kv.namespace.create",
+				name: title,
 				binding,
-				"--update-config",
-				...wranglerConfigArgs(configPath)
-			]);
+				configPath
+			});
 			if (!isCleanSuccess(created)) throw new Error(`provision: "wrangler kv namespace create ${title}" failed: ${created.stderr || created.stdout}`);
 			assertCreateWroteRealId(configPath, {
 				field: "kv_namespaces",
@@ -2375,16 +2288,13 @@ async function reconcileR2(desired, configPath, runWrangler, write, persistCreat
 				action: "reused"
 			});
 		} else {
-			const info = await runWrangler([
-				"r2",
-				"bucket",
-				"info",
-				bucketName,
-				"--json",
-				...wranglerConfigArgs(configPath)
-			], { captureJson: true });
+			const info = await runWrangler({
+				type: "r2.bucket.info",
+				name: bucketName,
+				configPath
+			}, {});
 			if (isCleanSuccess(info)) {
-				const payload = parseJsonObject(info.stdout);
+				const payload = parseJsonObject(info.data);
 				if (!payload || payload.name !== bucketName) throw new Error(`provision: "wrangler r2 bucket info ${bucketName} --json" exited 0 but did not identify the requested bucket (expected name ${JSON.stringify(bucketName)}). Refusing to adopt an unverified bucket. Output: ${info.stdout || info.stderr}`);
 				log.info(`adopted existing R2 bucket ${bucketName}`);
 				write({ r2: {
@@ -2398,16 +2308,12 @@ async function reconcileR2(desired, configPath, runWrangler, write, persistCreat
 					action: "adopted"
 				});
 			} else if (isConfirmedAbsent(info, "r2", bucketName)) {
-				const created = await runWrangler([
-					"r2",
-					"bucket",
-					"create",
-					bucketName,
-					"--binding",
+				const created = await runWrangler({
+					type: "r2.bucket.create",
+					name: bucketName,
 					binding,
-					"--update-config",
-					...wranglerConfigArgs(configPath)
-				]);
+					configPath
+				});
 				if (!isCleanSuccess(created)) throw new Error(`provision: "wrangler r2 bucket create ${bucketName}" failed: ${created.stderr || created.stdout}`);
 				assertCreateWroteRealId(configPath, {
 					field: "r2_buckets",
@@ -2418,15 +2324,12 @@ async function reconcileR2(desired, configPath, runWrangler, write, persistCreat
 					command: "wrangler r2 bucket create"
 				}, binding, bucketName);
 				if (bucketName === R2_BUCKET_NAME_PLACEHOLDER) {
-					const verify = await runWrangler([
-						"r2",
-						"bucket",
-						"info",
-						bucketName,
-						"--json",
-						...wranglerConfigArgs(configPath)
-					], { captureJson: true });
-					const payload = isCleanSuccess(verify) ? parseJsonObject(verify.stdout) : void 0;
+					const verify = await runWrangler({
+						type: "r2.bucket.info",
+						name: bucketName,
+						configPath
+					}, {});
+					const payload = isCleanSuccess(verify) ? parseJsonObject(verify.data) : void 0;
 					if (!payload || payload.name !== bucketName) throw new Error(`provision: "wrangler r2 bucket create ${bucketName}" reported success but a follow-up "wrangler r2 bucket info ${bucketName}" did not confirm the bucket exists. The create may have been interrupted — wrangler's launcher can mask a signal-killed child as exit 0, and the config entry is indistinguishable from the local-dev placeholder for this name. Refusing to record an unprovisioned bucket; inspect the account and retry.`);
 				}
 				persistCreatedConfig();
@@ -2495,16 +2398,12 @@ async function reconcileHyperdrive(desired, configPath, runWrangler, write, pers
 				});
 			} else if (existenceUnknown) throw new Error(`provision: cannot verify whether Hyperdrive config ${JSON.stringify(name)} already exists (no existence check available — provide an accountId + API token, or inject a listHyperdriveConfigs seam). "wrangler hyperdrive create" silently duplicates a same-named config, so provisioning refuses to create it blindly.`);
 			else {
-				const created = await runWrangler([
-					"hyperdrive",
-					"create",
+				const created = await runWrangler({
+					type: "hyperdrive.create",
 					name,
-					`--connection-string=${connectionString}`,
-					"--binding",
 					binding,
-					"--update-config",
-					...wranglerConfigArgs(configPath)
-				]);
+					configPath
+				}, { input: connectionString });
 				if (!isCleanSuccess(created)) throw new Error(`provision: "wrangler hyperdrive create ${name}" failed: ${created.stderr || created.stdout}`);
 				assertCreateWroteRealId(configPath, {
 					field: "hyperdrive",
@@ -2526,12 +2425,11 @@ async function reconcileHyperdrive(desired, configPath, runWrangler, write, pers
 }
 async function reconcileQueues(desired, configPath, runWrangler, resources) {
 	for (const name of desired.queues) {
-		const info = await runWrangler([
-			"queues",
-			"info",
+		const info = await runWrangler({
+			type: "queues.info",
 			name,
-			...wranglerConfigArgs(configPath)
-		]);
+			configPath
+		});
 		if (queueInfoConfirmsExists(info, name)) {
 			resources.push({
 				kind: "queue",
@@ -2541,19 +2439,17 @@ async function reconcileQueues(desired, configPath, runWrangler, resources) {
 			continue;
 		}
 		if (!isConfirmedAbsent(info, "queue", name)) throw new Error(`provision: "wrangler queues info ${name}" failed or did not confirm the queue exists: ${info.stderr || info.stdout || "no output"}`);
-		const created = await runWrangler([
-			"queues",
-			"create",
+		const created = await runWrangler({
+			type: "queues.create",
 			name,
-			...wranglerConfigArgs(configPath)
-		]);
+			configPath
+		});
 		if (!isCleanSuccess(created)) throw new Error(`provision: "wrangler queues create ${name}" failed: ${created.stderr || created.stdout}`);
-		if (!queueInfoConfirmsExists(await runWrangler([
-			"queues",
-			"info",
+		if (!queueInfoConfirmsExists(await runWrangler({
+			type: "queues.info",
 			name,
-			...wranglerConfigArgs(configPath)
-		]), name)) throw new Error(`provision: "wrangler queues create ${name}" reported success but "wrangler queues info ${name}" did not confirm the queue exists afterward. The create may have been interrupted — wrangler's launcher can mask a signal-killed child as exit 0. Refusing to record an unprovisioned queue; inspect the account and retry.`);
+			configPath
+		}), name)) throw new Error(`provision: "wrangler queues create ${name}" reported success but "wrangler queues info ${name}" did not confirm the queue exists afterward. The create may have been interrupted — wrangler's launcher can mask a signal-killed child as exit 0. Refusing to record an unprovisioned queue; inspect the account and retry.`);
 		resources.push({
 			kind: "queue",
 			name,

package/dist/{requests-DFyhBMaf.mjs → requests-MhxYnau8.mjs}

@@ -1,8 +1,8 @@
-import { a as dim, c as import_picocolors, r as cliTitle } from "./output-CCH48AMM.mjs";
-import { c as getToken } from "./auth-DLNN0D3Z.mjs";
+import { c as getToken } from "./auth-CSkdO2Bb.mjs";
 import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { O as intro, P as outro, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
+import { O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
+import { a as dim, c as import_picocolors, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 //#region src/cli/requests.ts
 async function runRequestsCommand(root, range, status) {
 	console.log();

package/dist/resource-name-C7LVpcRm.mjs

@@ -0,0 +1,11 @@
+//#region src/shared/resource-name.ts
+function resourceNameWords(value) {
+	return value.split(/[^a-zA-Z0-9]+/).filter(Boolean);
+}
+function isResourceName(value) {
+	if (typeof value !== "string") return false;
+	const words = resourceNameWords(value);
+	return words.length > 0 && /^[a-zA-Z]/.test(words[0]);
+}
+//#endregion
+export { resourceNameWords as n, isResourceName as t };

package/dist/{rollback-DHHxXZiS.mjs → rollback-CJ6iSDoU.mjs}

@@ -1,8 +1,8 @@
-import { a as dim, c as import_picocolors, i as createSpinner, o as ensureUtc, r as cliTitle } from "./output-CCH48AMM.mjs";
-import { c as getToken } from "./auth-DLNN0D3Z.mjs";
+import { c as getToken } from "./auth-CSkdO2Bb.mjs";
 import { i as readDeploymentPlatform, o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { E as confirm, I as select, O as intro, P as outro, T as cancel, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
+import { E as confirm, I as select, O as intro, P as outro, T as cancel, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
+import { a as dim, c as import_picocolors, i as createSpinner, o as ensureUtc, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 //#region src/cli/rollback.ts
 async function runRollbackCommand(root, deployId) {
 	console.log();
@@ -83,7 +83,7 @@ async function runRollbackCommand(root, deployId) {
 	outro(dim("Traffic is now serving the rolled-back deployment."));
 }
 async function runCloudflareRollback(root, deployId) {
-	const { activateCloudflareExistingVersion, readCloudflareWorkerStatus, resolveCloudflareOperationContext } = await import("./cloudflare-operations-BipGMJ5O.mjs");
+	const { activateCloudflareExistingVersion, readCloudflareWorkerStatus, resolveCloudflareOperationContext } = await import("./cloudflare-operations-AiWashgg.mjs");
 	const context = resolveCloudflareOperationContext(root);
 	const status = await readCloudflareWorkerStatus(context);
 	const deployedVersionIds = new Set(status.deployedVersionIds);