void 0.27.0 → 0.28.0

package/dist/{provision-BfaLiWbj.mjs → provision-DDh7ITVS.mjs}

@@ -1,36 +1,21 @@
-import { a as join, n as dirname, o as normalize, t as basename, u as resolve$2 } from "./dist-BVqXeR_h.mjs";
+import { a as join, c as resolve$2, n as dirname, o as normalize, t as basename } from "./dist-ipQi0Q8y.mjs";
 import { i as voidWarn, r as voidLog } from "./log-vqY3pqwI.mjs";
-import { _ as persistMaterializedWranglerConfig, j as writeProvisionedWranglerConfig, s as assertNoDuplicateMembers, y as readProvisionedBindingEntry } from "./wrangler-D9KTuqnv.mjs";
-import { n as scanWranglerDotenvKeys } from "./dotenv-BfU6eqFt.mjs";
-import { l as resolveCloudflareOperationArgv, n as decodeCloudflareOperationResult, r as encodeCloudflareOperation } from "./cloudflare-process-2-TfIEzB.mjs";
+import { _ as persistMaterializedWranglerConfig, j as writeProvisionedWranglerConfig, s as assertNoDuplicateMembers, y as readProvisionedBindingEntry } from "./wrangler-BYs07Rxy.mjs";
+import { n as scanWranglerDotenvKeys } from "./dotenv-CNazY3-w.mjs";
+import { l as resolveCloudflareOperationArgv, n as decodeCloudflareOperationResult, r as encodeCloudflareOperation } from "./cloudflare-process-CeDWJRhj.mjs";
 import { createRequire } from "node:module";
 import { closeSync, existsSync, fsyncSync, lstatSync, openSync, readFileSync, readlinkSync, realpathSync, renameSync, unlinkSync, writeSync } from "node:fs";
 import { isRecord } from "@void/deploy-core";
 import { randomUUID } from "node:crypto";
 import { parse } from "jsonc-parser";
-import { types } from "node:util";
 import { spawn } from "node:child_process";
 import { resolve } from "node:path/posix";
 import { resolve as resolve$1 } from "node:path/win32";
 import lockfile from "proper-lockfile";
 //#region src/cli/provision.ts
 /**
-* Diff the DESIRED id-bearing resources against the ACTUAL bindings in the root
-* wrangler config, WITHOUT any remote/wrangler call. A resource counts as
-* provisioned ONLY when its binding entry exists with a REAL (non-placeholder)
-* identifier — the SAME predicate the provisioner's read-first uses:
-*   - D1 `database_id` is a real UUID ({@link isRealD1Id}, not `'local'`);
-*   - KV `id` is a real 32-hex ({@link isRealKvId}, not `'local'`);
-*   - R2 `bucket_name` names a real bucket ({@link isRealStoredR2BucketName});
-*   - Hyperdrive `id` is a real 32-hex ({@link isRealHyperdriveId}).
-*
-* Queues are NAME-bearing (no id in the config), so they are NOT part of this
-* id-drift check. A missing config file yields every desired resource as missing.
-*
-* Used by the deploy orchestrator to decide whether automatic provisioning is needed
-* and to verify that every id-bearing resource was satisfied afterward.
-* A malformed/duplicate-binding config makes {@link readProvisionedBindingEntry}
-* throw — fail closed, exactly as the provisioner would.
+* Desired id-bearing resources whose binding has no real id in the root config, using the
+* same rule as read-first. Reads only the local config; queues have no id and are skipped.
 */
 function checkCloudflareProvisionDrift(configPath, desired) {
 	const config = readRootConfig(configPath);
@@ -76,22 +61,13 @@ const KV_ID_PLACEHOLDER = "local";
 const R2_BUCKET_NAME_PLACEHOLDER = "default";
 const D1_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const HEX32_ID_RE = /^[0-9a-f]{32}$/i;
-/** R2 bucket names ARE the identity: wrangler 4.131's `isValidR2BucketName`. */
+/** R2 bucket-name grammar (wrangler's `isValidR2BucketName`). */
 const R2_BUCKET_NAME_RE = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
-/**
-* A D1 `database_id` that is a real (non-placeholder) hyphenated UUID. Exported so
-* the deploy orchestrator applies the SAME placeholder rule when deciding whether a
-* stored `database_name` names a real DB (a synced `database_id: "local"` must not
-* let its paired name become the production database identity).
-*/
+/** A real (non-placeholder) D1 `database_id`. */
 function isRealD1Id(value) {
 	return typeof value === "string" && value !== D1_ID_PLACEHOLDER && D1_ID_RE.test(value);
 }
-/**
-* A KV namespace `id` that is a real (non-placeholder) 32-hex string. Exported so the
-* deploy orchestrator applies the SAME placeholder rule when checking whether two KV
-* bindings already share one provisioned namespace.
-*/
+/** A real (non-placeholder) KV namespace `id`. */
 function isRealKvId(value) {
 	return typeof value === "string" && value !== KV_ID_PLACEHOLDER && HEX32_ID_RE.test(value);
 }
@@ -104,11 +80,8 @@ function isValidR2BucketNameFormat(value) {
 	return typeof value === "string" && R2_BUCKET_NAME_RE.test(value);
 }
 /**
-* A STORED R2 `bucket_name` that names a REAL bucket, i.e. any non-empty string
-* other than the placeholder (`default`), unless `default` itself is desired.
-* `local` IS a real name here. Grammar is
-* deliberately not required: a grammar-invalid stored name that contradicts the desired
-* bucket must still fail closed as a contradiction, never be silently rewritten.
+* A stored R2 `bucket_name` naming a real bucket: any non-empty string except the `default`
+* placeholder (unless desired). Grammar is not checked, so a contradicting name still fails.
 */
 function isRealStoredR2BucketName(value, desiredName) {
 	return typeof value === "string" && value.length > 0 && (value !== R2_BUCKET_NAME_PLACEHOLDER || value === desiredName);
@@ -118,16 +91,8 @@ const defaultLogger = {
 	warn: (msg) => voidWarn(msg)
 };
 /**
-* The transport-redirecting env vars wrangler 4.131 honors. Each can point
-* wrangler's authenticated API transport at a DIFFERENT endpoint (or select a
-* different env-block/account) than the ONE this provision pinned:
-*   - `CLOUDFLARE_API_BASE_URL` / `CF_API_BASE_URL` — override the API base URL directly
-*     (`getCloudflareApiBaseUrlFromEnv`).
-*   - `WRANGLER_API_ENVIRONMENT=staging` — routes to `api.staging.cloudflare.com`.
-*   - `CLOUDFLARE_COMPLIANCE_REGION=fedramp_high` — routes to `api.fed.cloudflare.com`.
-*   - `CLOUDFLARE_ENV` — selects a named `env.*` config block (different account/bindings).
-* We pin ONE resolved base explicitly (see {@link provisionEnv}) and fail closed when a
-* project dotenv would reselect one (see {@link assertNoTransportRedirectInProjectDotenv}).
+* Env vars that move wrangler's API transport to another endpoint or select another config
+* env. Provisioning pins one base ({@link provisionEnv}) and rejects them in project dotenv.
 */
 const TRANSPORT_REDIRECT_ENV_VARS = [
 	"CLOUDFLARE_API_BASE_URL",
@@ -137,53 +102,17 @@ const TRANSPORT_REDIRECT_ENV_VARS = [
 	"CLOUDFLARE_ENV"
 ];
 /**
-* Wrangler 4.131's diagnostic-output sinks that would PERSIST the raw provisioning
-* argv (including a Hyperdrive connection string, password and all) to disk:
-*   - `WRANGLER_OUTPUT_FILE_PATH` / `WRANGLER_OUTPUT_FILE_DIRECTORY` — when either is set
-*     (`getOutputFilePathFromEnv`/`getOutputFileDirectoryFromEnv`), wrangler's startup
-*     middleware appends a `wrangler-session` entry with the VERBATIM
-*     `command_line_args: argv` to that file (`writeOutput` in wrangler-dist/cli.js) — so
-*     `hyperdrive create --connection-string=postgres://user:PASSWORD@…` lands on disk.
-* They are scrubbed from every provisioner child env ({@link provisionEnv}) and fenced in
-* the project dotenv ({@link assertNoTransportRedirectInProjectDotenv}) — wrangler reloads
-* dotenv into `process.env` BEFORE writing the session entry, so a dotenv-declared sink
-* would resurrect the leak. `WRANGLER_LOG_SANITIZE` (`getSanitizeLogs`, default true) is
-* PINNED to `true` instead: a truthy ambient value survives wrangler's dotenv reload
-* (dotenv-expand keeps an already-set truthy `process.env` value), so the pin cannot be
-* overridden into unsanitized logging of the secret-bearing API request.
+* Wrangler session-output sinks. When set, wrangler writes the raw argv to disk, which can
+* include a Hyperdrive password. They are scrubbed from the child env and rejected in project
+* dotenv, which wrangler reloads before writing.
 */
 const OUTPUT_FILE_ENV_VARS = ["WRANGLER_OUTPUT_FILE_PATH", "WRANGLER_OUTPUT_FILE_DIRECTORY"];
 /**
-* Resolve the ONE Cloudflare API base URL this provision is pinned to, mirroring
-* wrangler 4.131's `getCloudflareApiBaseUrl` EXACTLY (wrangler-dist/cli.js) so the
-* Hyperdrive REST lister and the spawned wrangler agree on the endpoint:
-*
-*   getCloudflareApiBaseUrl = (complianceConfig) =>
-*     getCloudflareApiBaseUrlFromEnv() ??
-*     `https://api${getComplianceRegionSubdomain(complianceConfig)}${getStagingSubdomain()}.cloudflare.com/client/v4`
-*
-* Order + semantics mirrored exactly:
-*   1. The DIRECT base override is evaluated FIRST, by PRESENCE (wrangler's env factory
-*      checks `variableName in process.env`), with `CLOUDFLARE_API_BASE_URL` taking
-*      precedence over the deprecated `CF_API_BASE_URL`. A present-but-EMPTY override is
-*      returned AS-IS: `"" ?? derived` keeps the empty string (NULLISH, not falsy,
-*      coalescing), so wrangler pins the empty base (its API calls then fail on the
-*      unparsable URL) — we mirror that instead of silently substituting an endpoint.
-*   2. Only on the DERIVED branch are the staging/compliance selectors read — wrangler's
-*      `??` short-circuits past `getComplianceRegionSubdomain`/`getStagingSubdomain` when a
-*      direct base is present, so a direct base + conflicting compliance settings resolves
-*      to the direct base in wrangler (NO conflict error) and must not be rejected here.
-*   3. On the derived branch both env selectors are choice-VALIDATED (wrangler's
-*      `getProcessEnv` → `assertOneOf` throws on any present value outside the choices,
-*      e.g. `WRANGLER_API_ENVIRONMENT=stagng` or an empty string), so an invalid selector
-*      FAILS CLOSED instead of silently pinning public production.
-*   4. The config's own `compliance_region` VALUE is validated UNCONDITIONALLY — wrangler's
-*      config validation (`isOneOf("public", "fedramp_high")` on the `compliance_region`
-*      field) rejects an invalid config value for every command regardless of which branch
-*      resolves the base.
-* Read ONCE from the REAL ambient `process.env` (which does NOT include the project `.env`
-* — Node never auto-loads it), so an ambient/CI pin is honored while a project dotenv
-* redirect is rejected up front by {@link assertNoTransportRedirectInProjectDotenv}.
+* The one API base URL this provision uses, resolved like wrangler's `getCloudflareApiBaseUrl`
+* so the Hyperdrive REST lister and wrangler agree:
+*   1. a present `CLOUDFLARE_API_BASE_URL` (then `CF_API_BASE_URL`) is used as-is, even empty;
+*   2. otherwise the staging and compliance selectors derive it, and invalid values fail;
+*   3. the config's `compliance_region` is always validated.
 */
 function resolvePinnedApiBaseUrl(env = process.env, configComplianceRegion) {
 	const configRegion = configComplianceRegion !== void 0 ? assertComplianceChoice(configComplianceRegion, "the wrangler config \"compliance_region\"") : void 0;
@@ -191,51 +120,27 @@ function resolvePinnedApiBaseUrl(env = process.env, configComplianceRegion) {
 	if (direct !== void 0) return direct;
 	return `https://api${resolveComplianceRegion(env, configRegion) === "fedramp_high" ? ".fed" : ""}${resolveApiEnvironment(env) === "staging" ? ".staging" : ""}.cloudflare.com/client/v4`;
 }
-/**
-* Mirror wrangler 4.131's `getCloudflareApiEnvironmentFromEnv` (env factory with
-* `choices: ["production", "staging"]`, default `"production"`): an ABSENT variable
-* defaults to production; a PRESENT value outside the choices — `"stagng"`, an empty
-* string — makes wrangler's `assertOneOf` throw, so we fail closed identically instead of
-* silently pinning public production where wrangler stops.
-*/
+/** `WRANGLER_API_ENVIRONMENT` like wrangler: absent means production; other values fail. */
 function resolveApiEnvironment(env) {
 	const raw = env.WRANGLER_API_ENVIRONMENT;
 	if (raw === void 0) return "production";
 	if (raw !== "production" && raw !== "staging") throw new Error(`provision: the WRANGLER_API_ENVIRONMENT environment variable must be one of "production" or "staging", got ${JSON.stringify(raw)}. wrangler rejects this value, so provisioning refuses to guess an endpoint; fix or unset it and retry.`);
 	return raw;
 }
-/** The compliance-region choices wrangler 4.131 accepts (`getCloudflareComplianceRegionFromEnv`). */
+/** Compliance-region values wrangler accepts. */
 const COMPLIANCE_REGIONS = ["public", "fedramp_high"];
 function assertComplianceChoice(value, source) {
 	if (value !== "public" && value !== "fedramp_high") throw new Error(`provision: ${source} must be one of ${COMPLIANCE_REGIONS.map((c) => JSON.stringify(c)).join(" or ")}, got ${JSON.stringify(value)}.`);
 	return value;
 }
-/**
-* Reconcile the effective Cloudflare compliance region, mirroring wrangler 4.131's
-* `getCloudflareComplianceRegion(complianceConfig)` EXACTLY (evaluated only on the
-* DERIVED-base branch — with a direct base override wrangler never calls it):
-*   - reads `CLOUDFLARE_COMPLIANCE_REGION` by PRESENCE and validates it against the
-*     `public`/`fedramp_high` choices (wrangler's `getProcessEnv` → `assertOneOf`, which
-*     throws on ANY present out-of-choices value — an empty string included);
-*   - when BOTH the env var AND the (already-validated) config region are set to
-*     DIFFERENT values, THROWS (fail closed) — wrangler raises a `UserError` for exactly
-*     this conflict, so we must not paper over it by pinning one endpoint while the config
-*     declares the other region;
-*   - otherwise returns `env || config || "public"` (both values are validated choices by
-*     now, so wrangler's falsy-coalescing is equivalent to nullish here).
-*/
+/** Effective compliance region like wrangler: values are validated and a conflict fails. */
 function resolveComplianceRegion(env, configRegion) {
 	const rawEnv = env.CLOUDFLARE_COMPLIANCE_REGION;
 	const envRegion = rawEnv !== void 0 ? assertComplianceChoice(rawEnv, "the CLOUDFLARE_COMPLIANCE_REGION environment variable") : void 0;
 	if (envRegion !== void 0 && configRegion !== void 0 && envRegion !== configRegion) throw new Error(`provision: the Cloudflare compliance region is set to conflicting values — the CLOUDFLARE_COMPLIANCE_REGION environment variable is ${JSON.stringify(envRegion)} but the wrangler config "compliance_region" is ${JSON.stringify(configRegion)}. wrangler refuses to run with a mismatched compliance region; reconcile them (remove one, or set them equal) and retry.`);
 	return envRegion ?? configRegion ?? "public";
 }
-/**
-* Mirror wrangler 4.131's `getDefaultEnvFiles(env)`: base `.env`/`.env.local`, then —
-* when the environment argument is DEFINED (we always pass `--env=`, so wrangler sees
-* `args.env === ""`, which is `!== undefined`) — the per-env pair `.env.${env}`/`.env.${env}.local`.
-* With the empty environment those are the empty-env filenames `.env.` and `.env..local`.
-*/
+/** Dotenv files wrangler loads for `--env=<env>`; provisioning always passes an empty env. */
 function defaultWranglerEnvFiles(env) {
 	return [
 		".env",
@@ -245,20 +150,9 @@ function defaultWranglerEnvFiles(env) {
 	];
 }
 /**
-* FAIL CLOSED when the project's dotenv files declare a transport-redirecting
-* variable. wrangler 4.131 reloads `.env`/`.env.local` (and the dev-vars files) from the
-* project root into `process.env` on EVERY command with `override: true`, so a repo `.env`
-* setting `CLOUDFLARE_API_BASE_URL` / `WRANGLER_API_ENVIRONMENT` /
-* `CLOUDFLARE_COMPLIANCE_REGION` / `CLOUDFLARE_ENV` would redirect wrangler's authenticated
-* transport (and credentials) to a staging / FedRAMP / arbitrary endpoint AFTER we resolved
-* the pinned base — while the Hyperdrive existence check runs against the pinned base.
-* Single-account/single-endpoint provisioning cannot reason about a transport redirected
-* out from under it, so we refuse. The fix is to export the variable in the shell/CI
-* environment (which we DO honor, pinning both wrangler and the lister to it) instead of
-* the project dotenv.
-*
-* Exported for direct unit testing of the file-set and the Windows case rule; production
-* always calls it with the real `process.platform`.
+* Fail when a project dotenv file sets a transport-redirect or session-output variable.
+* Wrangler reloads these files on every command, which would move its authenticated transport
+* away from the pinned base. Values exported in the shell are honored instead.
 */
 function assertNoTransportRedirectInProjectDotenv(root, platform = process.platform) {
 	const dotenvCaseInsensitive = platform === "win32";
@@ -281,14 +175,8 @@ function assertNoTransportRedirectInProjectDotenv(root, platform = process.platf
 	}
 }
 /**
-* Delete `name` from `env` IN PLACE, honoring the platform's env-key case rule.
-* Windows environment keys are CASE-INSENSITIVE: a spawned child's `process.env`
-* resolves `WRANGLER_OUTPUT_FILE_PATH` from an ambient `Wrangler_Output_File_Path`
-* too, so an exact-case `delete` leaves a mixed-case spelling live. On win32 every
-* case-insensitive spelling is removed; elsewhere POSIX env vars are case-sensitive,
-* so only the exact key is a match. Exported so the deploy orchestrator scrubs its
-* OWN extra deploy-time keys (worker-name override, build-config-path) through the
-* SAME rule the provisioner uses, instead of re-deriving it.
+* Delete `name` from `env` in place. Windows env keys are case-insensitive, so every spelling
+* is removed there; elsewhere only the exact key.
 */
 function deleteEnvVarCaseAware(env, name, platform = process.platform) {
 	if (platform !== "win32") {
@@ -299,19 +187,8 @@ function deleteEnvVarCaseAware(env, name, platform = process.platform) {
 	for (const key of Object.keys(env)) if (key.toLowerCase() === lower) delete env[key];
 }
 /**
-* Child-process env with every CF Access credential scrubbed. Mirrors `buildEnv`
-* in `deploy.ts`: Access credentials are needed only by this CLI's own guarded
-* HTTP requests and must never leak into the spawned wrangler process (which may
-* in turn run user hooks). This includes the short-lived cloudflared
-* `CF_ACCESS_TOKEN` JWT used by local readiness probes.
-*
-* Pins ONE transport context: scrubs every {@link TRANSPORT_REDIRECT_ENV_VARS}
-* from the child env, then re-sets `CLOUDFLARE_API_BASE_URL` to the SINGLE resolved
-* `apiBaseUrl` so the spawned wrangler and the Hyperdrive REST lister hit the exact same
-* endpoint. Scrubbing the compliance/staging/env selectors makes the explicit base
-* authoritative (they can no longer re-derive a different base). Combined with
-* {@link assertNoTransportRedirectInProjectDotenv} (which blocks a project dotenv from
-* repopulating any of them via wrangler's per-command reload), the pin cannot be moved.
+* Child env for a Cloudflare operation. CF Access credentials, transport selectors and output
+* sinks are scrubbed; the account, API base and sanitized logging are pinned.
 */
 function provisionEnv(ctx) {
 	const env = { ...process.env };
@@ -344,53 +221,24 @@ function provisionEnv(ctx) {
 	}
 	return env;
 }
-/**
-* Hard per-command timeout for a single wrangler invocation. A hung wrangler must
-* NEVER hang the whole provision, so the default runner SIGKILLs a child that runs
-* past this and reports a HARD failure (a non-null signal — see
-* {@link normalizeRunWranglerResult}). With the ASYNC runner this bound is
-* INDEPENDENT of {@link LOCK_STALE_MS}: awaiting the child keeps the event loop free,
-* so `proper-lockfile`'s heartbeat refreshes the mutex throughout — the timeout only
-* bounds a hang, it is not load-bearing for lock safety.
-*/
+/** Per-command timeout; the default runner SIGKILLs a child that runs longer. */
 const COMMAND_TIMEOUT_MS = 12e4;
 /**
-* After a timeout SIGKILL, how long to keep confirming the child is ACTUALLY gone —
-* BOTH its `close` event AND whole-group disappearance (`kill(-pid, 0)` → ESRCH) — before
-* giving up. SIGKILL is uncatchable, so a healthy kernel reaps the group within
-* milliseconds; this generous bound only guards a pathological uninterruptible-sleep child.
-* The runner NEVER settles a timeout as "done" until both facts are confirmed; an expiry
-* (or a failed kill) REJECTS with a {@link WranglerQuarantineError} instead, so the
-* whole-provision lock — released only after a CONFIRMED settle — is intentionally
-* retained while the real wrangler CLI may still be creating resources.
+* After a SIGKILL, how long to wait for both `close` and the whole process group to be gone.
+* If that cannot be confirmed, the runner rejects with {@link WranglerQuarantineError}.
 */
 const CONFIRM_KILL_GRACE_MS = 5e3;
 /** The pid-poll interval while confirming post-SIGKILL termination. */
 const CONFIRM_KILL_POLL_MS = 20;
-/**
-* The margin the coordinator-WIDE teardown deadline adds on top of a
-* runner's own confirmation grace window: a signal teardown is bounded at
-* `confirmGraceMs + this` even if the runner's bounded confirmation never calls back.
-*/
+/** Extra time a signal teardown allows beyond a runner's confirmation window. */
 const SIGNAL_TEARDOWN_DEADLINE_MARGIN_MS = 5e3;
-/**
-* Classify a process-group kill error. `ESRCH` means the group ALREADY exited (there was
-* nothing left to kill) → success. ANY other code (`EPERM`, …) is a REAL kill failure: the
-* child may still be running, so it must be surfaced, never swallowed. Exported for direct
-* unit testing of the classification the timeout/cancel paths rely on.
-*/
+/** ESRCH means the group already exited; any other kill error is a real failure. */
 function isAlreadyGoneKillError(error) {
 	return error?.code === "ESRCH";
 }
 /**
-* A QUARANTINE failure: the runner could NOT confirm that a spawned
-* wrangler child (and its whole process group) is dead — the group kill failed for a
-* non-ESRCH reason (EPERM, …), or the post-SIGKILL confirmation window expired with the
-* group still (possibly) alive. The child may STILL be creating resources / writing
-* config, so the whole-provision mutex must be INTENTIONALLY RETAINED — never released —
-* and this error surfaces with manual-recovery guidance naming the surviving pid.
-* {@link provisionCloudflareResources} detects it via {@link isQuarantineError} and calls
-* `lock.quarantine()` instead of `lock.release()`.
+* The runner could not confirm that a spawned child and its process group are dead. The child
+* may still be creating resources, so the provision lock is kept instead of released.
 */
 var WranglerQuarantineError = class extends Error {
 	quarantine = true;
@@ -413,17 +261,8 @@ function acquireProcessProvisionSlot() {
 	};
 }
 /**
-* The ONE active provision's lock-quarantine hook, 1:1 with the
-* provision slot above. When the parent process is about to DIE re-raising a forwarded
-* SIGINT/SIGTERM while a spawned wrangler child's teardown could NOT be confirmed,
-* proper-lockfile's signal-exit sweep would remove the still-TRACKED provision mutex —
-* releasing the lock under a possibly-live child. {@link provisionCloudflareResources}
-* sets this for the duration of the provision; a registering wrangler child CAPTURES it
-* at registration (see {@link registerRunner}) so an unresolved teardown quarantines
-* exactly ITS OWNING provision lock with ITS OWN pid metadata — never a broadcast
-* through every lock (the previous Set this replaces stamped the FIRST unresolved
-* registrant's pid into every lock's sidecar, so a foreign group's death could clear a
-* quarantine whose real child was alive).
+* The active provision's lock-quarantine hook. A child captures it at registration, so a
+* failed teardown quarantines only its own provision lock with its own pid.
 */
 let activeProvisionQuarantineHook;
 /** True when `error` is a quarantine failure whose provision lock must stay retained. */
@@ -493,8 +332,7 @@ function coordinatorHandleSignal(signal) {
 	teardown.dispatching = false;
 	maybeFinishCoordinatorTeardown(teardown);
 }
-/** Finish only after the initial dispatch fully completed AND every
-* snapshot registrant resolved (confirmed or quarantined). */
+/** Finish after dispatch completes and every registrant is resolved. */
 function maybeFinishCoordinatorTeardown(teardown) {
 	if (!teardown.dispatching && teardown.pending === 0) finishCoordinatorTeardown(teardown);
 }
@@ -554,12 +392,7 @@ function finishCoordinatorTeardown(teardown) {
 const RETENTION_RETRY_MIN_MS = 250;
 const RETENTION_RETRY_MAX_MS = 5e3;
 let retentionWatchdog;
-/**
-* Quarantine `lock`, and on a PERSISTENCE failure arm the retention
-* watchdog BEFORE rethrowing. THE single quarantine entry point for provision-level
-* code (the body-error path and the signal coordinator's hook both route through it),
-* so no persistence failure can leave the process free to drain unprotected.
-*/
+/** Quarantine `lock`; if persisting fails, arm the retention watchdog before rethrowing. */
 function retainQuarantinedLock(lock, info) {
 	try {
 		lock.quarantine(info);
@@ -610,20 +443,11 @@ function armRetentionWatchdog(lock, info) {
 	};
 }
 /**
-* Default provider runner: launches the isolated typed operation entry through
-* {@link resolveCloudflareOperationArgv} with `shell: false`. Public request fields
-* travel as literal JSON argv; secrets travel through stdin. Captured stdout carries
-* the structured result envelope, while stderr carries provider diagnostics.
-*
-* ASYNC (returns a Promise). `spawn` + `await` (vs. the old blocking
-* `spawnSync`) keeps the Node event loop free while wrangler runs, so
-* `proper-lockfile`'s update timer keeps refreshing the mutex mtime for the WHOLE
-* provision — no wrangler call, however slow, can freeze the loop long enough for
-* another process to see the lock stale and steal it while we still hold it. A
-* {@link COMMAND_TIMEOUT_MS} SIGKILL guards against a hung child.
+* Default runner: spawns the typed operation entry ({@link resolveCloudflareOperationArgv})
+* without a shell; secrets go through stdin. It is async so the lock heartbeat keeps running.
 */
 function createDefaultRunWrangler(root, options) {
-	const launcher = options?.launcher ?? resolveCloudflareOperationArgv(root);
+	const launcher = options?.launcher ?? resolveCloudflareOperationArgv();
 	const timeoutMs = options?.timeoutMs ?? COMMAND_TIMEOUT_MS;
 	const confirmGraceMs = options?.confirmKillGraceMs ?? CONFIRM_KILL_GRACE_MS;
 	const killProcessGroup = options?.killProcessGroup ?? ((target, signal) => process.kill(target, signal));
@@ -867,14 +691,8 @@ function createDefaultRunWrangler(root, options) {
 	});
 }
 /**
-* Normalize a `spawnSync` result into a {@link RunWranglerResult}, treating a
-* signal-killed child or a spawn error as a FAILURE — never success.
-*
-* The naive `status ?? (error ? 1 : 0)` collapses a SIGTERM'd child (which
-* returns `status: null`, a non-null `signal`, and NO `error`) to `0`, so a
-* killed `create` would be recorded as `created` though nothing happened. So we
-* fail on ANY non-numeric `status`, a non-null `signal`, or a present `error`,
-* and surface the signal/spawn-error text in `stderr` for diagnostics.
+* Normalize a finished child into a {@link RunWranglerResult}. A signal, a spawn error or a
+* non-numeric status is a non-zero failure, never success.
 */
 function normalizeRunWranglerResult(result) {
 	const stdout = result.stdout ?? "";
@@ -891,12 +709,7 @@ function normalizeRunWranglerResult(result) {
 		error: result.error != null ? result.error.message : null
 	};
 }
-/**
-* THE single provenance rule. A result is a HARD failure when the child was
-* signal-killed or could not be spawned: it did not run to completion, so its
-* buffered status/stdout/stderr is unreliable and must NEVER be read as "absent"
-* or "success". Every success/absence/adopt classifier below defers to this.
-*/
+/** A signal-killed or unspawned child: its output is never read as success or absence. */
 function isHardFailure(result) {
 	return result.signal != null || result.error != null;
 }
@@ -904,27 +717,13 @@ function isHardFailure(result) {
 function isCleanSuccess(result) {
 	return !isHardFailure(result) && result.status === 0;
 }
-/**
-* The child ran to completion and reported a FAILURE status (a numeric non-zero
-* exit, no signal, no spawn error) — the ONLY case whose stdout/stderr may be
-* classified for a resource-specific not-found signal.
-*/
+/** A completed child with a non-zero exit: the only result that may mean "not found". */
 function isCleanFailure(result) {
 	return !isHardFailure(result) && Number.isSafeInteger(result.status) && result.status > 0;
 }
-/**
-* The OVERALL deadline for the Hyperdrive existence lister (across ALL its paginated
-* requests). A stalled body or a never-settling injected seam must never hold the
-* whole-provision lock (whose heartbeat keeps refreshing while the loop is free) forever, so
-* the caller fails closed at this bound.
-*/
+/** Overall deadline for the Hyperdrive lister, so a stalled list cannot hold the lock forever. */
 const HYPERDRIVE_LIST_TIMEOUT_MS = 6e4;
-/**
-* Run a lister call under an OVERALL deadline. Builds one `AbortController`, hands its
-* signal to `start` (threaded into every paginated `fetch`), and races the returned promise
-* against a timer that ABORTS the signal AND rejects — so even a seam that ignores the signal
-* (never settling) can NOT hold the caller (and thus the provision lock) past `ms`.
-*/
+/** Run `start` under an overall deadline: abort and reject at `ms`, even if it ignores the signal. */
 function withListerDeadline(start, ms) {
 	return new Promise((resolve, reject) => {
 		const controller = new AbortController();
@@ -942,21 +741,16 @@ function withListerDeadline(start, ms) {
 	});
 }
 /**
-* The Cloudflare API token the default Hyperdrive existence check authenticates with:
-* the caller-supplied one, else the ambient `CLOUDFLARE_API_TOKEN`. An empty value is
-* treated as absent. This is the ONE resolver — the up-front Hyperdrive fence and the
-* default lister below both use it, so the fence can never promise a check the lister
-* then declines to make.
+* API token for the Hyperdrive REST check: the caller's, else `CLOUDFLARE_API_TOKEN`. Shared by
+* the up-front fence and the default lister so they always agree.
 */
 function resolveHyperdriveApiToken(apiToken) {
 	const token = apiToken ?? process.env.CLOUDFLARE_API_TOKEN;
 	return typeof token === "string" && token.length > 0 ? token : void 0;
 }
 /**
-* Default Hyperdrive existence check: `GET /accounts/{id}/hyperdrive/configs`
-* with the CF API token, matched by name in the caller. Returns `undefined` when
-* it cannot be built (no account id / no token) — the caller then fails closed
-* before any blind create. Never called in unit tests — those inject a stub.
+* Default Hyperdrive lister over the REST API. Returns `undefined` without a token, so the
+* caller fails closed before a blind create.
 */
 function createDefaultListHyperdriveConfigs(apiToken) {
 	const token = resolveHyperdriveApiToken(apiToken);
@@ -995,16 +789,8 @@ function createDefaultListHyperdriveConfigs(apiToken) {
 	};
 }
 /**
-* The ONE strict Hyperdrive-list validator, applied at the CALLER after EITHER
-* lister returns (the default fetch OR an injected seam), so validation can never live
-* only inside the default fetch. Validates EVERY member up front — BEFORE any name
-* filtering: rejects any non-object member, empty/non-string `name`, and duplicate `id`,
-* AND requires every member's `id` to be a REAL 32-hex Hyperdrive id (not merely
-* non-empty). A malformed id on ANY member means the list is untrustworthy, so we fail
-* closed rather than skip that member and mistake the target for absent. Then requires
-* EXACTLY 0 or 1 exact-name match (>1 is ambiguous — Hyperdrive names are NOT
-* account-unique — and fails closed) BEFORE any match/write. Returns the single
-* exact-name match, or `undefined` when none matches.
+* Validate a Hyperdrive list from any lister and return the config named `name`, if any. A
+* malformed member, a bad or duplicate id, or more than one match fails closed.
 */
 function selectHyperdriveMatch(configs, name, configPath) {
 	const seenIds = /* @__PURE__ */ new Set();
@@ -1028,18 +814,8 @@ function quarantineSidecarPath(lockTarget) {
 	return `${lockTarget}.quarantine.json`;
 }
 /**
-* Atomically persist the quarantine owner metadata: write a temp file,
-* then `rename` over the final path, so a concurrent acquisition gate can never read
-* partial JSON. On POSIX the spawned wrangler child is `detached` (its own process-group
-* leader), so the recorded `pgid` IS its pid; Windows has no process groups (the gate
-* probes the pid directly there).
-*
-* DURABLE: the temp file is fsync'd before the rename, the directory is
-* fsync'd after it (see the classification below), and the final sidecar is READ
-* BACK and verified. Any failure THROWS — callers treat persistence as a PRECONDITION
-* for detaching the lock from proper-lockfile's tracking (see
-* {@link ProvisionLock.quarantine}); a sidecar that merely "probably" landed is not a
-* durable marker the acquisition gate can rely on.
+* Persist quarantine metadata durably (temp file, fsync, rename, directory fsync), then read it
+* back. Throws on any failure.
 */
 function writeQuarantineSidecar(sidecarPath, info, dirDurability) {
 	const payload = JSON.stringify({
@@ -1098,33 +874,11 @@ function readPositiveInt(value) {
 	return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : void 0;
 }
 /**
-* The quarantine acquisition GATE. Every provision acquires its mutex
-* through {@link acquireProvisionLock} (the single choke point — grep-proven: no other
-* code calls `lockfile.lock`), and this gate runs BEFORE proper-lockfile is even
-* consulted, so a QUARANTINED mutex can never be stolen by the mtime-stale path while
-* the recorded wrangler process group may still be alive:
-*   - no sidecar → nothing quarantined → proceed to normal acquisition;
-*   - sidecar present → probe the recorded group (`kill(-pgid, 0)`; the plain pid where
-*     no group exists): ESRCH (confirmed dead) → clear the sidecar and proceed; still
-*     alive OR the probe fails (EPERM, no recorded pid, unreadable sidecar) → FAIL
-*     CLOSED with the recorded metadata + manual-recovery guidance. PID reuse can make
-*     a dead group probe "alive" — that keeps failing closed (the safe direction; the
-*     guidance covers manual clearance).
-* Clearing touches ONLY the sidecar (unlink, ENOENT-tolerant — concurrent clearers are
-* fine). The retained mutex DIRECTORY is deliberately NOT removed by hand: its
-* heartbeat stopped at quarantine, so proper-lockfile's own stale lifecycle reclaims it
-* during the acquisition below — a manual rmdir here could race a concurrent acquirer's
-* fresh mutex (remove-then-acquire is not atomic across processes) and let two
-* provisions hold the lock at once.
-*
-* This gate now ALWAYS runs under the RECOVERY mutex (see
-* {@link acquireProvisionLock}), so its read IS the re-read-under-the-mutex every
-* recoverer must base its decision on, and a clear may only remove the exact sidecar
-* GENERATION it just inspected: the sidecar is re-read immediately before the unlink
-* and the decision fails closed if the generation changed (a newer quarantine was
-* persisted by the current main-mutex holder — whose quarantine writes are the one
-* interleaving the recovery mutex cannot serialize — while this decision was pending).
-* `onBeforeClear` is a test seam injecting exactly that interleaving deterministically.
+* Quarantine gate, run under the recovery mutex before each lock attempt. With a sidecar
+* present, the recorded group is probed: confirmed dead clears the sidecar, alive or unknown
+* fails closed. Only the sidecar generation that was inspected is cleared; the mutex directory
+* is left for proper-lockfile's stale handling, since removing it by hand could race another
+* acquirer.
 */
 function assertQuarantineClearedOrClear(lockTarget, onBeforeClear) {
 	const sidecarPath = quarantineSidecarPath(lockTarget);
@@ -1176,28 +930,13 @@ function loadProperLockfileInternals() {
 		return;
 	}
 }
-/**
-* `realpathSync` is `node:fs`, so it returns a NATIVE path — backslashes on Windows —
-* while every other path in this module comes from `pathslash` and is POSIX-normalized,
-* including the not-yet-created branch below (whose `join()` already normalizes). Without
-* this, `canonicalizeConfigPath` hands back TWO different spellings of the same file
-* depending only on whether it happens to exist yet, defeating the "ONE identity" contract
-* the function exists to provide — and splitting the lock identity, the wrangler `-c` argv,
-* and the paths printed in error messages. No-op off Windows, where `\` is a legal filename
-* character that must survive byte-for-byte.
-*/
+/** `realpathSync` returns backslashes on Windows; normalize so one file has one spelling. */
 function toPosixConfigPath(nativePath) {
 	return process.platform === "win32" ? normalize(nativePath) : nativePath;
 }
 /**
-* Canonicalize an already-absolute config path via `realpath` so the lock identity
-* and every read/write/`-c` key on the REAL file, not a lexical symlink alias. When the
-* config file EXISTS, its own realpath is returned (a symlink resolves to its target).
-* When it does NOT yet exist, `realpath` would throw (ENOENT), so we canonicalize the
-* PARENT directory (which normally exists — the project root) and rejoin the basename, so
-* two aliases to the same not-yet-created config still resolve to one identity. If neither
-* the file nor its parent can be canonicalized, the lexical path is returned unchanged (no
-* worse than before, and the common case — an existing project dir — is always canonical).
+* Canonical config path, so symlink aliases share one lock identity. A dangling symlink is
+* followed; a missing file canonicalizes its parent directory instead.
 */
 function canonicalizeConfigPath(absoluteConfigPath, depth = 0) {
 	try {
@@ -1225,49 +964,22 @@ function canonicalizeConfigPath(absoluteConfigPath, depth = 0) {
 	}
 }
 /**
-* A lock whose owner has not refreshed it within this window is treated as abandoned
-* (crashed) and may be compromised/stolen, so a crashed provision cannot wedge every
-* future one. A LIVE owner refreshes the mutex mtime every {@link LOCK_UPDATE_MS}
-* (strictly less than this), so it never expires by age. Generous vs. a real
-* provision's duration.
-*
-* CORRECTNESS — this heartbeat is a `setTimeout` on the Node event loop, so it only
-* fires while the loop is FREE. The default runner is ASYNC (`spawn`, awaited), so no
-* wrangler call blocks the loop; between/`during` every `await` the pending update timer
-* runs and refreshes the mtime. Fast synchronous bookkeeping (JSON parse, small config
-* reads) is « `LOCK_UPDATE_MS`, so the mtime is continuously refreshed and NO other
-* process ever sees this lock stale → it can never be stolen while we hold it. (The old
-* blocking `spawnSync` could freeze the loop past `LOCK_STALE_MS`, starving the
-* heartbeat AND `onCompromised`, which is exactly the race this closes.)
+* A lock not refreshed for this long counts as abandoned. A live owner refreshes it every
+* {@link LOCK_UPDATE_MS}; this needs a free event loop, which is why the runner is async.
 */
 const LOCK_STALE_MS = 12e4;
 /** Refresh interval keeping a live owner's lock fresh (must be < {@link LOCK_STALE_MS}). */
 const LOCK_UPDATE_MS = 2e4;
-/**
-* Backoff budget while waiting for a held (non-stale) lock. Polls with jittered backoff
-* for roughly a minute before giving up, so a concurrent provision blocks (not spins)
-* until the holder releases, then proceeds.
-*/
+/** Backoff while waiting for a held lock (about a minute). */
 const LOCK_RETRIES = {
 	retries: 100,
 	factor: 1.5,
 	minTimeout: 200,
 	maxTimeout: 2e3
 };
-/**
-* The stale window of the RECOVERY mutex (the small proper-lockfile
-* lock serializing every gate→probe→clear→acquire→revalidate decision — see
-* {@link acquireProvisionLock}). Deliberately SHORT: its critical section is a few
-* synchronous fs reads plus one mkdir, so a crashed recoverer frees it within seconds
-* (proper-lockfile's own heartbeat keeps a live recoverer's window fresh).
-*/
+/** Stale window of the short-lived recovery mutex. */
 const RECOVERY_LOCK_STALE_MS = 6e3;
-/**
-* Normalize the `retries` knob into the ONE backoff schedule OUR
-* acquisition loop runs (proper-lockfile's internal retrying is disabled with
-* `retries: 0` so the quarantine gate runs on EVERY attempt — see
-* {@link acquireProvisionLock}). A bare number keeps {@link LOCK_RETRIES}' backoff shape.
-*/
+/** Backoff schedule for our own retry loop (proper-lockfile runs with `retries: 0`). */
 function normalizeLockRetries(retries) {
 	if (typeof retries === "number") return {
 		...LOCK_RETRIES,
@@ -1280,52 +992,18 @@ function normalizeLockRetries(retries) {
 		maxTimeout: retries?.maxTimeout ?? LOCK_RETRIES.maxTimeout
 	};
 }
-/**
-* Match the key spelling `proper-lockfile` stores when `realpath: false`.
-*
-* The library uses the host's native `node:path.resolve`, including backslashes on
-* Windows. Most Void paths intentionally use `pathslash`, but its forward-slash output
-* cannot address `proper-lockfile`'s internal registry on Windows.
-*/
+/** The registry key proper-lockfile uses with `realpath: false` (native separators). */
 function resolveProperLockfileKey(file, platform = process.platform) {
 	return platform === "win32" ? resolve$1(file) : resolve(file);
 }
 /**
-* Acquire the cross-process provision lock over the resolved config path via
-* `proper-lockfile` (an atomic `mkdir`-based mutex at `<configPath>.void-provision.lock.lock`).
-* The library normally realpaths the pathname being locked, which requires it to exist.
-* Both lock identities here are deliberately SYNTHETIC adjacent paths, so acquisition
-* passes `realpath: false`: proper-lockfile resolves the identity lexically and creates
-* only its temporary mutex directory — never an empty marker file in the user's project.
-* This is safe because the config path was already canonicalized (including missing-file
-* and symlink cases) before reaching this function. It also preserves the writer's
-* missing-vs-empty config semantics. Returns a handle whose `release()` drops the mutex;
-* ALWAYS call it in a `finally` so an interruption never leaks the lock.
-*
-* `onCompromised` FAILS CLOSED (re-throws): if the lock is ever detected stolen (its
-* mtime changed, or the mutex vanished under a live owner), provisioning must NEVER
-* continue — a compromised lock means another process may be racing the same config.
+* Acquire the provision lock (`<configPath>.void-provision.lock.lock`). The lock targets are
+* synthetic paths, so `realpath: false` avoids creating marker files; the config path is
+* already canonical. A compromised lock throws.
 *
-* Acquisition is ONE atomic recovery protocol, applied on EVERY
-* attempt: quarantine GATE → single non-retrying proper-lockfile acquisition →
-* REVALIDATE the gate under ownership → clear-or-abort. Retrying is owned by THIS
-* function (proper-lockfile runs with `retries: 0`), so a waiter that entered while the
-* holder was healthy re-runs the gate on every backoff attempt and can never stale-take
-* a mutex whose holder QUARANTINED mid-wait; the post-acquire revalidation catches a
-* sidecar that appeared between the last gate and the acquisition itself (the fresh
-* lock is released and the acquisition fails closed).
-*
-* The ENTIRE per-attempt protocol runs under a second small
-* proper-lockfile RECOVERY mutex (`<lockTarget>.recovery`, `retries: 0`, short stale):
-* without it, two recoverers could interleave ACROSS processes — B reads a dead sidecar
-* S0, gets descheduled; A clears S0, acquires the main mutex, quarantines again writing
-* a LIVE sidecar S1; B resumes and unlinks the PATHNAME (now S1) on its stale decision,
-* then stale-reclaims A's retained mutex (the revalidation sees no sidecar). Under the
-* recovery mutex every decision re-reads the sidecar after acquiring it, and the clear
-* is additionally GENERATION-verified (see {@link assertQuarantineClearedOrClear}) for
-* the one interleaving the recovery mutex cannot serialize (the current MAIN-mutex
-* holder quarantining mid-decision). The recovery mutex deliberately does NOT take the
-* caller's `fs` seam — that seam simulates main-mutex failures.
+* Each attempt runs under a short recovery mutex: quarantine gate, one non-retrying
+* acquisition, then the gate again under ownership. This loop owns retries, so the gate runs
+* on every attempt and a quarantined lock is never taken over by age.
 */
 async function acquireProvisionLock(configPath, lockOptions) {
 	const lockTarget = `${configPath}.void-provision.lock`;
@@ -1427,39 +1105,13 @@ async function acquireProvisionLock(configPath, lockOptions) {
 		}
 	};
 }
-/**
-* Parse a wrangler `--json` stdout into an array, distinguishing a VALID JSON
-* array (returns it, possibly empty) from unparseable/non-array output (returns
-* `undefined`). Members are returned UNFILTERED — a malformed member (e.g. a
-* `null`) is preserved, NOT silently dropped, so {@link validateResourceList}
-* can fail closed on it (a dropped malformed member could BE the target and look
-* like "absent", minting a duplicate). Used everywhere an empty list must mean
-* "authoritatively absent" and garbage must NOT be coerced to "absent".
-*/
-function parseJsonArrayStrict(value) {
-	return Array.isArray(value) ? value : void 0;
-}
-function parseJsonObject(value) {
-	return isRecord(value) ? value : void 0;
-}
-/**
-* Read the single provisioned binding entry for `field`/`binding` from the resolved
-* config, delegating to the STRICT canonical reader in `wrangler.ts`
-* ({@link readProvisionedBindingEntry}). Unlike the old loose first-match `.find()`, this
-* validates the target field's outer shape, fails closed on a DUPLICATE binding, and runs
-* the worker-wide CROSS-TYPE collision check — so a
-* duplicate/collision config can never be reported `reused` or pass a create postcondition.
-*/
+/** One binding entry, via the strict reader that fails on duplicate or colliding bindings. */
 function readBindingEntry(configPath, field, binding) {
 	return readProvisionedBindingEntry(readRootConfig(configPath), field, binding, configPath);
 }
 /**
-* Read + parse the root wrangler config (fresh each call — wrangler mutates it).
-* BOM-aware (wrangler + `writeProvisionedWranglerConfig` strip a leading BOM before
-* parsing, so we must too, else a BOM-prefixed config would look unparseable). FAILS CLOSED
-* on a genuine parse error or a non-object root: never silently treat a real
-* config as `{}`, which would miss existing ids (re-provision/orphan) and mask a
-* corrupt file. A missing file is fine (nothing to read-first → `{}`).
+* Read the root config fresh (wrangler edits it), without a BOM. A parse error or a non-object
+* fails; a missing file reads as `{}`.
 */
 function readRootConfig(configPath) {
 	if (!existsSync(configPath)) return {};
@@ -1471,27 +1123,13 @@ function readRootConfig(configPath) {
 	if (!isRecord(parsed)) throw new Error(`provision: "${configPath}" must be a JSON object.`);
 	return parsed;
 }
-/**
-* FAIL-CLOSED gate over a discovery/list/info result. Throws (no create) unless
-* the child exited cleanly — a NUMERIC `status === 0`. Because
-* {@link normalizeRunWranglerResult} already folds a signal-killed child or a
-* spawn error into a non-zero status, a single numeric check here rejects ALL of
-* nonzero-exit / SIGTERM / spawn-error / non-numeric status. MUST be called
-* BEFORE reading provider data, so failed discovery never implies absence.
-*/
+/** Throw unless a discovery call exited cleanly, so a failed list never means "absent". */
 function assertDiscoverySucceeded(result, label) {
 	if (!isCleanSuccess(result)) throw new Error(`provision: "${label}" failed (exit ${String(result.status)}): ${result.stderr || result.stdout || "no output"}. Cannot verify existing resources; refusing to create a possible duplicate.`);
 }
 /**
-* STRICT list validator shared by KV + D1. Rejects the ENTIRE list (throws) if ANY
-* member is not a well-formed object carrying a non-empty name AND a
-* FORMAT-VALID id (per {@link ResourceListSpec.hasValidId}). A member is NEVER
-* silently filtered, and a member with a malformed id is NEVER accepted, because
-* either could BE the requested target (or signal a corrupt list) and treating it as
-* "absent" would mint a duplicate. Validates EVERY member up front — BEFORE any
-* name-filtering by the caller — so a nonmatching member with a bogus id can no longer
-* pass the gate as authoritative absence. Returns the validated members (every one
-* guaranteed to have a real id + name) on success.
+* Reject the whole list if any member lacks a non-empty name or a valid id. A malformed member
+* could be the target, so it is never filtered out as "absent".
 */
 function validateResourceList(list, spec) {
 	const validated = [];
@@ -1521,25 +1159,9 @@ function reconcileD1IdAliases(entry) {
 	};
 }
 /**
-* THE single strict D1 identity normalizer, shared by `d1 list --json` and
-* `d1 info <name> --json`. It reconciles the TWO name aliases (`name`,
-* `database_name`) and TWO id aliases (`database_id`, `uuid`) — an EMPTY STRING is
-* treated as ABSENT for each — and returns a usable id ONLY when the entry
-* unambiguously IS the requested database:
-*   - `{ kind: 'other' }` — no non-empty name alias equals `requestedName`, so this
-*     entry is a different database (the caller skips it, never mistakes it for the
-*     target, and never adopts it under a normalization of a DIFFERENT name);
-*   - `{ kind: 'claimed-but-invalid' }` — a name alias DOES equal `requestedName`
-*     but the entry is ambiguous: CONFLICTING non-empty name aliases (e.g.
-*     `name:"wanted"` + `database_name:"other"`), OR not EXACTLY ONE distinct
-*     non-empty id (0 → no id; >1 → conflicting/blank uuid vs database_id). The
-*     caller fails closed (never adopt, never create a duplicate);
-*   - `{ kind: 'match', id }` — exactly one requested-name alias and exactly one
-*     unambiguous non-empty id.
-* The old two-helper split (`normalizeD1Identity` preferring `database_name`,
-* `d1EntryName` preferring `name`) let a `{name,database_name}` mismatch be
-* SELECTED under one alias yet KEYED under the other. This collapses both into one
-* exact-match rule so no sibling gap remains.
+* Strict D1 identity check shared by `d1 list` and `d1 info`. `other` when no name alias
+* (`name`, `database_name`) equals `requestedName`; `claimed-but-invalid` when one does but the
+* name or id aliases conflict; otherwise `match`.
 */
 function normalizeD1(entry, requestedName) {
 	if (entry === void 0) return { kind: "other" };
@@ -1553,73 +1175,32 @@ function normalizeD1(entry, requestedName) {
 		id: reconciled.id
 	};
 }
-/**
-* `wrangler kv namespace list` → the `{ id }` of every namespace whose title
-* matches. The list has ALREADY been through {@link validateResourceList} (every
-* member has a non-empty string `id` + `title`), so this only filters + collects.
-*
-* A title-matching namespace whose `id` is NOT a real KV id (32-hex) is ambiguous:
-* we can neither adopt it nor treat it as absent (which would mint a duplicate title), so
-* we FAIL CLOSED. Real wrangler always returns 32-hex ids; this guards a malformed seam.
-*/
-function extractKvMatches(list, title) {
-	const matches = [];
-	for (const ns of list) {
-		if (ns.title !== title) continue;
-		if (!isRealKvId(ns.id)) throw new Error(`provision: "wrangler kv namespace list" returned a namespace titled ${JSON.stringify(title)} with a malformed id ${JSON.stringify(ns.id)} (expected a 32-character hex namespace id). Cannot verify whether it already exists; refusing to create a possible duplicate.`);
-		matches.push({ id: ns.id });
-	}
-	return matches;
-}
 /** True when a `d1 create` failure means the name is already taken (code 7502). */
 function isAlreadyExistsError(result) {
 	return result.errorCode === 7502;
 }
 /**
-* Not-found classifier shared by R2 + queues. Given an `<res> info`-by-name probe,
-* returns `true` (confirmed absent → safe to create) ONLY on a clean non-zero exit
-* with the provider's typed not-found result (R2 error code 10006; the queue
-* operation's `not-found` failure). Everything else returns `false` so the caller
-* fails closed — a signal/spawn failure, an auth/network/metrics error, or a
-* GENERIC "not found" (e.g. `Account not found`) is NEVER treated as absence,
-* which would mint a duplicate resource.
+* True only for a completed non-zero probe with the provider's typed not-found result (R2
+* code 10006, or the queue operation's `not-found`). Nothing else counts as absence.
 */
 function isConfirmedAbsent(result, kind) {
 	return isCleanFailure(result) && (kind === "r2" ? result.errorCode === 10006 : result.failure === "not-found");
 }
 /** Only a completed, typed not-found response confirms queue absence. */
-function isQueueConfirmedAbsent(result, _name) {
+function isQueueConfirmedAbsent(result) {
 	return isConfirmedAbsent(result, "queue");
 }
 /** Reuse and post-create verification require clean success and the exact returned name. */
 function queueInfoConfirmsExists(result, name) {
 	return isCleanSuccess(result) && isRecord(result.data) && result.data.name === name;
 }
-/**
-* Throw when the writer could not attach `migrations_dir` because no matching
-* `d1_databases[]` entry exists. The provisioner only writes `migrations_dir`
-* AFTER establishing the D1 entry (create/adopt/reuse), so a skip here means the
-* D1 resource is unexpectedly absent from the config — never silently succeed
-* with the gap unfilled.
-*/
+/** Throw when the writer found no D1 entry to attach `migrations_dir` to. */
 function assertD1MigrationsDirApplied(result, binding, configPath) {
 	if (result.d1MigrationsDirSkipped) throw new Error(`provision: could not set migrations_dir for D1 binding ${JSON.stringify(binding)} — no matching d1_databases entry exists in "${configPath}" after provisioning it. The D1 resource was not written to the config as expected; inspect the file and retry.`);
 }
 /**
-* Backstop — verify a create's POSTCONDITION, RESOURCE-SPECIFICALLY + identity
-* checked. wrangler 4.131's `bin.wrangler` is a WRAPPER that spawns
-* `wrangler-dist/cli.js` and maps a signal-killed child (`code === null`) to
-* `process.exit(0)`, so `spawnSync` can see a `create` report "success" though the
-* real CLI was killed and `--update-config` wrote NO id. After every config-writing
-* create (d1/kv/r2/hyperdrive) reports success we RE-READ the resolved config and
-* CONFIRM the target binding now holds a REAL id AND — where the resource's name is
-* its identity (R2 `bucket_name`, D1 `database_name`) — that the recorded name EXACTLY
-* matches the requested one; otherwise we FAIL CLOSED. A bare "some non-placeholder
-* value" check is NOT enough: for R2, `bucket_name` IS the identity, so
-* `{ bucket_name: 'other' }` would otherwise pass and bind the WRONG bucket. This also
-* catches any partial/silent create failure, not only kills. (Queue creates write NO
-* config, so they cannot be verified this way — a killed queue-create self-heals on
-* the next read-first/probe run, which re-detects absence and re-creates.)
+* After a create reports success, re-read the config and require a real id, plus the exact
+* name where the name is the identity. A killed child can still report exit 0.
 */
 function assertCreateWroteRealId(configPath, spec, binding, name) {
 	const entry = readBindingEntry(configPath, spec.field, binding);
@@ -1639,19 +1220,7 @@ function hasControlChar(value) {
 function assertNoOptionInjection(kind, name) {
 	if (typeof name !== "string" || name.length === 0 || name.startsWith("-") || hasControlChar(name)) throw new Error(`provision: refusing to pass an unsafe ${kind} name ${JSON.stringify(name)} to wrangler. A name may not be empty, begin with "-" (it would be parsed as a CLI flag), or contain control characters. Rename the resource and retry.`);
 }
-/**
-* Per-resource Cloudflare naming GRAMMAR, verified 2026-07 against wrangler 4.107
-* and live account resources:
-*   - `r2`      — wrangler's own `isValidR2BucketName`: 3–63 chars, lowercase letters /
-*                 digits / `-`, begin+end alphanumeric (DNS-like). This IS the identity.
-*   - `kvTitle` — the KV namespace positional is forwarded verbatim as the account TITLE;
-*                 Cloudflare allows a broad charset INCLUDING SPACES (≤512 chars). We only
-*                 forbid control chars (already covered by the injection guard) — spaces
-*                 and mixed case are legal, so "My Own Namespace" is accepted.
-*   - `d1` / `hyperdrive` / `queue` — 1–63 chars, begin with a letter/digit, then
-*                 letters / digits / `-` / `_` (matches every live D1 `name`, Hyperdrive
-*                 config `name`, and Void's `QUEUE_<NAME>`-derived queue names).
-*/
+/** Per-resource Cloudflare naming grammar. KV titles may contain spaces and mixed case. */
 const RESOURCE_NAME_GRAMMARS = {
 	r2: {
 		re: R2_BUCKET_NAME_RE,
@@ -1679,34 +1248,13 @@ const RESOURCE_NAME_GRAMMARS = {
 		rule: "be 1–63 characters, contain only letters, digits and \"-\", and begin and end with a letter or digit"
 	}
 };
-/**
-* Validate a name destined for a wrangler ARGV positional: FIRST the universal
-* option-injection guard, THEN the resource's own Cloudflare grammar. Fail closed on any
-* violation, before the account gate or any wrangler/REST call.
-*
-* Exported — like {@link isQueueConfirmedAbsent} — so the deploy orchestrator's
-* pre-provision queue probe (`cli/deploy.ts`) gates names on the SAME rules this
-* provisioner enforces. Queue names
-* are taken verbatim from filenames with no sanitization, so without this gate a name
-* beginning with `-` reaches wrangler as a FLAG rather than a positional.
-*/
+/** Validate an argv positional: the option-injection guard, then the resource grammar. */
 function assertValidResourceName(kind, name) {
 	assertNoOptionInjection(RESOURCE_NAME_GRAMMARS[kind].label, name);
 	const grammar = RESOURCE_NAME_GRAMMARS[kind];
 	if (!grammar.re.test(name)) throw new Error(`provision: refusing to pass an invalid ${grammar.label} name ${JSON.stringify(name)} to wrangler. A ${grammar.label} name must ${grammar.rule}. Rename the resource and retry.`);
 }
-/**
-* Build a redactor that strips connection-string secrets from every string the
-* provisioner PROPAGATES (buffered wrangler stdout/stderr, error strings, logged
-* warnings). Two layers:
-*   1. the EXACT desired connection string (when this provision carries one) is replaced
-*      whole, so no derived message can echo it verbatim;
-*   2. any URL userinfo password (`scheme://user:secret@…`) is masked generically, so a
-*      wrangler error that re-renders a connection string in ANY spelling still never
-*      leaks the password (the scheme + user survive for diagnostics).
-* Applied at the single runWrangler choke point (every call site reads pre-redacted
-* results) and to the Hyperdrive lister's propagated failure message.
-*/
+/** Redactor that replaces the exact connection string and masks any URL userinfo password. */
 function createSecretRedactor(connectionString) {
 	return (text) => {
 		let out = text;
@@ -1715,304 +1263,16 @@ function createSecretRedactor(connectionString) {
 		return out;
 	};
 }
-/**
-* The engine's own lazy `Error#stack` accessor pair, captured ONCE at
-* module init. V8 defines `stack` as an own get/set accessor on every Error instance,
-* sharing ONE getter/setter function across all of them — so FUNCTION IDENTITY proves
-* "this is the engine's deterministic lazy-stack slot" (user code cannot forge these
-* function identities). It is the ONLY accessor the in-place sanitizer may handle;
-* every other accessor forces the inert fallback carrier.
-*/
-const engineStackDescriptor = Object.getOwnPropertyDescriptor(/* @__PURE__ */ new Error(), "stack");
-const ENGINE_STACK_GET = engineStackDescriptor?.get;
-const ENGINE_STACK_SET = engineStackDescriptor?.set;
-/**
-* The ONLY prototypes a rebuilt carrier may have restored. Restoring an
-* ARBITRARY prototype would reintroduce hostile behavior on the otherwise-inert carrier
-* (a prototype getter or `toString` the carrier's readers would still hit), so an
-* unknown prototype degrades to the base Error/Object/Array prototype the fresh carrier
-* was built with. `WranglerQuarantineError` is included so a rebuilt quarantine carrier
-* keeps its `instanceof` classification.
-*/
-const KNOWN_SAFE_PROTOTYPES = /* @__PURE__ */ new Set([
-	Error.prototype,
-	TypeError.prototype,
-	RangeError.prototype,
-	ReferenceError.prototype,
-	SyntaxError.prototype,
-	EvalError.prototype,
-	URIError.prototype,
-	AggregateError.prototype,
-	WranglerQuarantineError.prototype,
-	Object.prototype,
-	Array.prototype
-]);
-function tryRedactValue(value, redactText) {
-	try {
-		if (typeof value === "string") return {
-			ok: true,
-			value: redactText(value)
-		};
-		if (typeof value !== "object" || value === null) return {
-			ok: true,
-			value
-		};
-		if (!types.isProxy(value) && sanitizeInPlace(value, redactText)) return {
-			ok: true,
-			value
-		};
-		return {
-			ok: true,
-			value: deepSanitizedCopy(value, redactText)
-		};
-	} catch {
-		return { ok: false };
-	}
-}
-/**
-* Attempt to redact `root` fully IN PLACE. Returns `true` only when EVERY string
-* that needed redaction was verifiably rewritten (assignment read back); any immutable
-* or unverifiable slot holding a secret returns `false` so the caller switches to the
-* fallback-carrier copy. Partial rewrites applied before a `false` are harmless — they
-* only ever REMOVE secret text, and the caller then discards the original anyway.
-*/
-function sanitizeInPlace(root, redactText) {
-	const seen = /* @__PURE__ */ new WeakSet();
-	let ok = true;
-	const visitChild = (child) => {
-		if (typeof child === "object" && child !== null) visit(child);
-	};
-	const visit = (v) => {
-		if (!ok || seen.has(v)) return;
-		seen.add(v);
-		if (types.isProxy(v)) {
-			ok = false;
-			return;
-		}
-		if (v instanceof Map) {
-			for (const [key, val] of Array.from(v.entries())) {
-				const newKey = typeof key === "string" ? redactText(key) : key;
-				const newVal = typeof val === "string" ? redactText(val) : val;
-				visitChild(key);
-				visitChild(val);
-				if (newKey !== key) v.delete(key);
-				if (newKey !== key || newVal !== val) v.set(newKey, newVal);
-				if (!ok) return;
-			}
-			return;
-		}
-		if (v instanceof Set) {
-			for (const member of Array.from(v.values())) {
-				if (typeof member === "string") {
-					const red = redactText(member);
-					if (red !== member) {
-						v.delete(member);
-						v.add(red);
-					}
-				} else visitChild(member);
-				if (!ok) return;
-			}
-			return;
-		}
-		for (const key of Reflect.ownKeys(v)) {
-			const desc = Object.getOwnPropertyDescriptor(v, key);
-			if (!desc) continue;
-			if (desc.get !== void 0 || desc.set !== void 0) {
-				if (!(key === "stack" && ENGINE_STACK_GET !== void 0 && desc.get === ENGINE_STACK_GET && desc.set === ENGINE_STACK_SET)) {
-					ok = false;
-					return;
-				}
-				let current;
-				try {
-					current = desc.get !== void 0 ? desc.get.call(v) : void 0;
-				} catch {
-					ok = false;
-					return;
-				}
-				if (typeof current === "string") {
-					const red = redactText(current);
-					if (red !== current) {
-						if (desc.set === void 0) {
-							ok = false;
-							return;
-						}
-						try {
-							desc.set.call(v, red);
-						} catch {
-							ok = false;
-							return;
-						}
-						let after;
-						try {
-							const afterDesc = Object.getOwnPropertyDescriptor(v, key);
-							after = afterDesc?.get !== void 0 ? afterDesc.get.call(v) : afterDesc?.value;
-						} catch {
-							ok = false;
-							return;
-						}
-						if (after !== red) {
-							ok = false;
-							return;
-						}
-					}
-				} else visitChild(current);
-				if (!ok) return;
-				continue;
-			}
-			const val = desc.value;
-			if (typeof val === "string") {
-				const red = redactText(val);
-				if (red === val) continue;
-				if (desc.writable !== true) {
-					ok = false;
-					return;
-				}
-				try {
-					v[key] = red;
-				} catch {
-					ok = false;
-					return;
-				}
-				if (Object.getOwnPropertyDescriptor(v, key)?.value !== red) {
-					ok = false;
-					return;
-				}
-			} else {
-				visitChild(val);
-				if (!ok) return;
-			}
-		}
-	};
-	visit(root);
-	return ok;
-}
-/**
-* The fallback CARRIER: a fully sanitized deep copy of `root`, built when in-place
-* redaction is impossible. Fresh objects/arrays/Errors/Maps/Sets (all mutable), every
-* string redacted, every own property — enumerable or not, string or symbol key —
-* carried over as a plain data property, accessors snapshotted (an unreadable getter
-* becomes `'[unredactable]'`), the original PROTOTYPE restored so `instanceof`
-* classification (e.g. {@link WranglerQuarantineError}) survives the rebuild. Cycle-safe
-* (a cycle in the original maps to the same cycle among the copies).
-*/
-function deepSanitizedCopy(root, redactText) {
-	const copies = /* @__PURE__ */ new WeakMap();
-	const copy = (v) => {
-		if (typeof v === "string") return redactText(v);
-		if (typeof v !== "object" || v === null) return v;
-		if (copies.has(v)) return copies.get(v);
-		if (v instanceof Map) {
-			const out = /* @__PURE__ */ new Map();
-			copies.set(v, out);
-			for (const [key, val] of v.entries()) out.set(copy(key), copy(val));
-			return out;
-		}
-		if (v instanceof Set) {
-			const out = /* @__PURE__ */ new Set();
-			copies.set(v, out);
-			for (const member of v.values()) out.add(copy(member));
-			return out;
-		}
-		const out = Array.isArray(v) ? [] : v instanceof Error ? /* @__PURE__ */ new Error() : {};
-		const proto = Object.getPrototypeOf(v);
-		if (typeof proto === "object" && proto !== null && KNOWN_SAFE_PROTOTYPES.has(proto)) try {
-			Object.setPrototypeOf(out, proto);
-		} catch {}
-		copies.set(v, out);
-		for (const key of Reflect.ownKeys(v)) {
-			const desc = Object.getOwnPropertyDescriptor(v, key);
-			if (!desc) continue;
-			let val;
-			if (desc.get !== void 0 || desc.set !== void 0) try {
-				val = desc.get !== void 0 ? desc.get.call(v) : void 0;
-			} catch {
-				val = "[unredactable]";
-			}
-			else val = desc.value;
-			try {
-				Object.defineProperty(out, key, {
-					value: copy(val),
-					writable: true,
-					enumerable: desc.enumerable === true,
-					configurable: true
-				});
-			} catch {}
-		}
-		return out;
-	};
-	return copy(root);
-}
-/**
-* Extract a SAFELY-READ, redacted one-line message from an unknown
-* value, for logging. Never coerces an object (`String()`/template literals invoke an
-* arbitrary — possibly hostile — `toString`): only primitives are stringified, and for
-* objects only a plain string `message` field is read (inside the no-throw boundary; a
-* throwing trap/getter degrades to the generic placeholder). THE one helper every
-* logging path uses for unknown rejection values (grep-proven: the Hyperdrive lister
-* warning and the rebuilt-carrier message below).
-*/
-function safeRedactedErrorMessage(value, redactText) {
-	try {
-		if (typeof value === "string") return redactText(value);
-		if (value === null || value === void 0 || typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return String(value);
-		const message = value.message;
-		if (typeof message === "string") return redactText(message);
-	} catch {}
-	return "the rejection could not be rendered safely; its content was withheld";
-}
-/** The conservative carrier for a rejection that resists inspection. */
-function unsafeInspectionQuarantineCarrier() {
-	const carrier = /* @__PURE__ */ new Error("provision: a propagated rejection could not be safely inspected (a property or prototype trap threw during redaction); its content was withheld. Treating it conservatively as an unconfirmed-wrangler-child (quarantine) failure: the whole-provision lock is retained, not released.");
-	Object.assign(carrier, {
-		quarantine: true,
-		pid: void 0
-	});
-	return carrier;
-}
-/**
-* Redact a seam REJECTION with EVERYTHING — the quarantine
-* classification included — inside the ONE no-throw boundary, GUARANTEEING:
-*   1. this function NEVER throws (pre-fix, `isQuarantineError`'s `instanceof` ran on
-*      the ORIGINAL value before any boundary — a Proxy with throwing
-*      `getPrototypeOf`/property traps made the redactor itself throw a
-*      secret-bearing, classification-free replacement error, and the outer path then
-*      RELEASED the mutex under a possibly-live child);
-*   2. if inspection is unsafe ANYWHERE (classification, redaction, message reads), it
-*      FAILS CLOSED AS QUARANTINE: a fresh INERT sanitized carrier marked
-*      `{ quarantine: true }` propagates, so the mutex is retained (conservative — the
-*      hostile value could have been hiding a real quarantine) and no trap error or
-*      secret ever escapes;
-*   3. a quarantined rejection can never degrade into an ordinary failure: the
-*      classification + pid are captured inside the boundary and restored structurally
-*      on the carrier when a rebuild lost them.
-*/
+/** Redact a runner rejection, keeping the same Error object so quarantine fields survive. */
 function redactRejection(error, redactText) {
-	try {
-		const wasQuarantine = isQuarantineError(error);
-		const quarantinePid = wasQuarantine && typeof error.pid === "number" ? error.pid : void 0;
-		const attempt = tryRedactValue(error, redactText);
-		if (!attempt.ok) return unsafeInspectionQuarantineCarrier();
-		const redacted = attempt.value;
-		if (!wasQuarantine || isQuarantineError(redacted)) return redacted;
-		const carrier = redacted instanceof Error ? redacted : new Error(safeRedactedErrorMessage(redacted, redactText));
-		Object.assign(carrier, {
-			quarantine: true,
-			pid: quarantinePid
-		});
-		return carrier;
-	} catch {
-		return unsafeInspectionQuarantineCarrier();
-	}
+	if (!(error instanceof Error)) return new Error(redactText(String(error)));
+	error.message = redactText(error.message);
+	if (typeof error.stack === "string") error.stack = redactText(error.stack);
+	return error;
 }
 /**
-* Ensure every resource in `desired` exists in the user's own Cloudflare account,
-* creating the missing ones by shelling out to `wrangler` and letting
-* `wrangler <res> create --update-config` write real ids into the root config.
-* For resources that already exist (adopt path) — where `create` cannot run —
-* the real id is captured from `wrangler <res> list/info` (or, for Hyperdrive,
-* the account-list existence seam) and written through `writeProvisionedWranglerConfig`'s
-* adopt fields. Pure provisioning: NO build, deploy, or drift-check. Idempotent +
-* read-first: a binding already pointing at a real id is left untouched.
+* Ensure every desired resource exists in the user's Cloudflare account and record its id in
+* the root config, creating or adopting as needed. A binding with a real id is left as is.
 */
 async function provisionCloudflareResources(root, rootWranglerPath, desired, opts) {
 	const releaseProvisionSlot = acquireProcessProvisionSlot();
@@ -2024,7 +1284,6 @@ async function provisionCloudflareResources(root, rootWranglerPath, desired, opt
 }
 /** The provision body, run while holding this process's single provision slot. */
 async function provisionWithProcessSlot(root, rootWranglerPath, desired, opts) {
-	await Promise.resolve();
 	const configPath = canonicalizeConfigPath(resolve$2(root, rootWranglerPath));
 	const lock = await acquireProvisionLock(configPath, opts?.lockOptions);
 	const quarantineHook = (info) => retainQuarantinedLock(lock, info);
@@ -2101,8 +1360,8 @@ async function reconcileD1(desired, configPath, runWrangler, write, persistCreat
 				configPath
 			}, {});
 			assertDiscoverySucceeded(listResult, "wrangler d1 list");
-			const rawList = parseJsonArrayStrict(listResult.data);
-			if (!rawList) throw new Error(`provision: "wrangler d1 list --json" did not return a JSON array; cannot verify whether D1 database ${JSON.stringify(name)} exists. Refusing to create a possible duplicate.`);
+			const rawList = listResult.data;
+			if (!Array.isArray(rawList)) throw new Error(`provision: "wrangler d1 list --json" did not return a JSON array; cannot verify whether D1 database ${JSON.stringify(name)} exists. Refusing to create a possible duplicate.`);
 			const claimants = validateResourceList(rawList, {
 				resource: "D1 database",
 				command: "wrangler d1 list",
@@ -2168,7 +1427,7 @@ async function reconcileD1(desired, configPath, runWrangler, write, persistCreat
 						configPath
 					}, {});
 					assertDiscoverySucceeded(infoResult, `wrangler d1 info ${name}`);
-					const info = normalizeD1(parseJsonObject(infoResult.data), name);
+					const info = normalizeD1(isRecord(infoResult.data) ? infoResult.data : void 0, name);
 					if (info.kind !== "match") throw new Error(`provision: "wrangler d1 create ${name}" reported the database already exists, but "wrangler d1 info ${name} --json" did not return a database with a matching name and an unambiguous id. Refusing to adopt an unverified database.`);
 					log.info(`adopted existing D1 database ${name} (${info.id})`);
 					assertD1MigrationsDirApplied(write({
@@ -2233,16 +1492,16 @@ async function reconcileKv(desired, configPath, runWrangler, write, persistCreat
 			configPath
 		}, {});
 		assertDiscoverySucceeded(listResult, "wrangler kv namespace list");
-		const rawList = parseJsonArrayStrict(listResult.data);
-		if (!rawList) throw new Error(`provision: "wrangler kv namespace list" did not return a JSON array; cannot verify whether KV namespace ${JSON.stringify(title)} exists. Refusing to create a possible duplicate.`);
-		const matches = extractKvMatches(validateResourceList(rawList, {
+		const rawList = listResult.data;
+		if (!Array.isArray(rawList)) throw new Error(`provision: "wrangler kv namespace list" did not return a JSON array; cannot verify whether KV namespace ${JSON.stringify(title)} exists. Refusing to create a possible duplicate.`);
+		const matches = validateResourceList(rawList, {
 			resource: "KV namespace",
 			command: "wrangler kv namespace list",
 			hasValidId: (member) => isRealKvId(member.id),
 			idRule: "its id is missing or not a well-formed 32-hex namespace id",
 			nameField: "title",
 			nameLabel: "titled"
-		}), title);
+		}).filter((ns) => ns.title === title).map((ns) => ({ id: ns.id }));
 		if (matches.length > 0) {
 			const chosen = matches.reduce((min, ns) => ns.id < min.id ? ns : min);
 			if (matches.length > 1) log.warn(`multiple KV namespaces titled "${title}" (${matches.map((m) => m.id).join(", ")}); adopting the lexicographically-smallest id ${chosen.id}`);
@@ -2303,8 +1562,8 @@ async function reconcileR2(desired, configPath, runWrangler, write, persistCreat
 				configPath
 			}, {});
 			if (isCleanSuccess(info)) {
-				const payload = parseJsonObject(info.data);
-				if (!payload || payload.name !== bucketName) throw new Error(`provision: "wrangler r2 bucket info ${bucketName} --json" exited 0 but did not identify the requested bucket (expected name ${JSON.stringify(bucketName)}). Refusing to adopt an unverified bucket. Output: ${info.stdout || info.stderr}`);
+				const payload = info.data;
+				if (!isRecord(payload) || payload.name !== bucketName) throw new Error(`provision: "wrangler r2 bucket info ${bucketName} --json" exited 0 but did not identify the requested bucket (expected name ${JSON.stringify(bucketName)}). Refusing to adopt an unverified bucket. Output: ${info.stdout || info.stderr}`);
 				log.info(`adopted existing R2 bucket ${bucketName}`);
 				write({ r2: {
 					binding,
@@ -2338,8 +1597,7 @@ async function reconcileR2(desired, configPath, runWrangler, write, persistCreat
 						name: bucketName,
 						configPath
 					}, {});
-					const payload = isCleanSuccess(verify) ? parseJsonObject(verify.data) : void 0;
-					if (!payload || payload.name !== bucketName) throw new Error(`provision: "wrangler r2 bucket create ${bucketName}" reported success but a follow-up "wrangler r2 bucket info ${bucketName}" did not confirm the bucket exists. The create may have been interrupted — wrangler's launcher can mask a signal-killed child as exit 0, and the config entry is indistinguishable from the local-dev placeholder for this name. Refusing to record an unprovisioned bucket; inspect the account and retry.`);
+					if (!isCleanSuccess(verify) || !isRecord(verify.data) || verify.data.name !== bucketName) throw new Error(`provision: "wrangler r2 bucket create ${bucketName}" reported success but a follow-up "wrangler r2 bucket info ${bucketName}" did not confirm the bucket exists. The create may have been interrupted — wrangler's launcher can mask a signal-killed child as exit 0, and the config entry is indistinguishable from the local-dev placeholder for this name. Refusing to record an unprovisioned bucket; inspect the account and retry.`);
 				}
 				persistCreatedConfig();
 				resources.push({
@@ -2377,7 +1635,7 @@ async function reconcileHyperdrive(desired, configPath, runWrangler, write, pers
 				validatedConfigs = result;
 				existenceUnknown = false;
 			} catch (error) {
-				log.warn(`Hyperdrive existence check for ${name} failed: ` + safeRedactedErrorMessage(error, redactSecrets));
+				log.warn(`Hyperdrive existence check for ${name} failed: ` + redactSecrets(error instanceof Error ? error.message : String(error)));
 				existenceUnknown = true;
 				validatedConfigs = void 0;
 			}
@@ -2466,12 +1724,7 @@ async function reconcileQueues(desired, configPath, runWrangler, resources) {
 		});
 	}
 }
-/**
-* The provision body, run entirely UNDER the whole-provision lock (see
-* {@link provisionCloudflareResources}). `configPath` is the ONE resolved absolute
-* config path the lock is keyed on — threaded through read-first, wrangler `-c`, and
-* the writer so reads/writes can never hit different files.
-*/
+/** The provision body, run under the lock with the canonical config path. */
 async function provisionCloudflareResourcesLocked(root, configPath, desired, opts) {
 	if (existsSync(configPath)) {
 		const raw = readFileSync(configPath, "utf-8");
@@ -2541,4 +1794,4 @@ async function provisionCloudflareResourcesLocked(root, configPath, desired, opt
 	};
 }
 //#endregion
-export { resolvePinnedApiBaseUrl as _, checkCloudflareProvisionDrift as a, enableD1ReadReplicationViaApi as c, isQueueConfirmedAbsent as d, isRealD1Id as f, provisionEnv as g, provisionCloudflareResources as h, assertValidResourceName as i, isAlreadyGoneKillError as l, normalizeRunWranglerResult as m, acquireProvisionLock as n, createDefaultRunWrangler as o, isRealKvId as p, assertNoTransportRedirectInProjectDotenv as r, deleteEnvVarCaseAware as s, WranglerQuarantineError as t, isQuarantineError as u, resolveProperLockfileKey as v };
+export { deleteEnvVarCaseAware as a, isRealKvId as c, resolvePinnedApiBaseUrl as d, createDefaultRunWrangler as i, provisionCloudflareResources as l, assertValidResourceName as n, isQueueConfirmedAbsent as o, checkCloudflareProvisionDrift as r, isRealD1Id as s, assertNoTransportRedirectInProjectDotenv as t, provisionEnv as u };