@cloudflare/vite-plugin 1.54.8 → 1.54.10

package/dist/index.mjs

@@ -137,7 +137,7 @@ function createFatalError$1(message, isJson, options) {
 __name$6(createFatalError$1, "createFatalError");
 
 //#endregion
-//#region ../workers-utils/dist/chunk-R5MIV2EH.mjs
+//#region ../workers-utils/dist/chunk-JGKSDUFK.mjs
 function hasKnownExportType(entry) {
 	const type = entry?.type;
 	return type === "durable-object" || type === "worker";
@@ -173,6 +173,17 @@ function getDurableObjectContainerApps(containers) {
 	return Array.isArray(containers) ? containers.filter(isDurableObjectContainerApp) : [];
 }
 __name$6(getDurableObjectContainerApps, "getDurableObjectContainerApps");
+function getResolvedDurableObjectContainerApps(containers, exports$1) {
+	return getDurableObjectContainerApps(containers).map((container) => {
+		const className = resolveContainerClassName(container, exports$1);
+		if (typeof className !== "string" || className.length === 0) throw new UserError(`The container "${container.name}" is not linked to a Durable Object. Either set "containers.class_name", or reference this container from a Durable Object's \`exports\` entry via its "container" field.`, { telemetryMessage: "durable object container class unresolved" });
+		return {
+			...container,
+			class_name: className
+		};
+	});
+}
+__name$6(getResolvedDurableObjectContainerApps, "getResolvedDurableObjectContainerApps");
 function getContainerNameToClassNameMap(exports$1) {
 	const containerNameToClassName = /* @__PURE__ */ new Map();
 	for (const [className, entry] of Object.entries(getDurableObjectExports(exports$1))) if ("container" in entry && typeof entry.container === "string" && !containerNameToClassName.has(entry.container)) containerNameToClassName.set(entry.container, className);
@@ -225,9 +236,9 @@ function getDurableObjectClassNameToUseSQLiteMap(migrations, exports$1) {
 	return durableObjectClassNameToUseSQLiteMap;
 }
 __name$6(getDurableObjectClassNameToUseSQLiteMap, "getDurableObjectClassNameToUseSQLiteMap");
-function validateDurableObjectContainerApplications(config$2) {
+function validateDurableObjectContainerApplications(config$2, containers = getDurableObjectContainerApps(config$2.containers)) {
 	const allDOs = getDurableObjectClassNameToUseSQLiteMap(config$2.migrations, config$2.exports);
-	for (const container of getDurableObjectContainerApps(config$2.containers)) {
+	for (const container of getResolvedDurableObjectContainerApps(containers, config$2.exports)) {
 		const maybeBoundDO = config$2.durable_objects.bindings.find((durableObject) => durableObject.class_name === container.class_name);
 		const useSQLite = allDOs.get(container.class_name);
 		if (useSQLite === void 0 && maybeBoundDO === void 0) throw new UserError(`The container class_name ${container.class_name} does not match any durable object class_name defined in your Wrangler config file. Note that the durable object must be defined in the same script as the container.`, { telemetryMessage: "no DO defined that matches container class_name" });
@@ -2195,7 +2206,12 @@ var APIError = class extends ParseError {
 		return this.#status;
 	}
 	isGatewayError() {
-		if (this.#status !== void 0) return [524].includes(this.#status);
+		if (this.#status !== void 0) return [
+			502,
+			503,
+			504,
+			524
+		].includes(this.#status);
 		return false;
 	}
 	isRetryable() {
@@ -2599,8 +2615,8 @@ function formatConfigSnippet(snippet, configPath, formatted = true) {
 __name$6(formatConfigSnippet, "formatConfigSnippet");
 
 //#endregion
-//#region ../workers-utils/dist/chunk-KBTXSRPS.mjs
-var DEFAULT_COMPAT_DATE = "2026-09-11";
+//#region ../workers-utils/dist/chunk-5H6GBNUC.mjs
+var DEFAULT_COMPAT_DATE = "2026-09-15";
 function assertNever(_value) {}
 __name$6(assertNever, "assertNever");
 function mapWorkerMetadataBindings(bindings) {
@@ -2772,9 +2788,6 @@ function mapWorkerMetadataBindings(bindings) {
 					instance_name: binding.instance_name
 				}];
 				break;
-			case "websearch":
-				configObj.websearch = { binding: binding.name };
-				break;
 			case "agent_memory":
 				configObj.agent_memory = [...configObj.agent_memory ?? [], {
 					binding: binding.name,
@@ -27263,7 +27276,6 @@ var defaultWranglerConfig = {
 	vectorize: [],
 	ai_search_namespaces: [],
 	ai_search: [],
-	websearch: void 0,
 	agent_memory: [],
 	hyperdrive: [],
 	workflows: [],
@@ -41341,7 +41353,6 @@ var friendlyBindingNames = {
 	vectorize: "Vectorize Index",
 	ai_search_namespaces: "AI Search Namespace",
 	ai_search: "AI Search Instance",
-	websearch: "Web Search",
 	agent_memory: "Agent Memory",
 	hyperdrive: "Hyperdrive Config",
 	r2_buckets: "R2 Bucket",
@@ -41394,7 +41405,6 @@ var bindingTypeFriendlyNames = {
 	vectorize: "Vectorize Index",
 	ai_search_namespace: "AI Search Namespace",
 	ai_search: "AI Search Instance",
-	websearch: "Web Search",
 	agent_memory: "Agent Memory",
 	hyperdrive: "Hyperdrive Config",
 	service: "Worker",
@@ -41897,7 +41907,6 @@ function normalizeAndValidateEnvironment(diagnostics, configPath, rawEnv, isDisp
 		vectorize: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "vectorize", validateBindingArray(envName, validateVectorizeBinding), []),
 		ai_search_namespaces: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "ai_search_namespaces", validateBindingArray(envName, validateAISearchNamespaceBinding), []),
 		ai_search: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "ai_search", validateBindingArray(envName, validateAISearchBinding), []),
-		websearch: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "websearch", validateNamedSimpleBinding(envName), void 0),
 		agent_memory: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "agent_memory", validateBindingArray(envName, validateAgentMemoryBinding), []),
 		hyperdrive: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "hyperdrive", validateBindingArray(envName, validateHyperdriveBinding), []),
 		services: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "services", validateBindingArray(envName, validateServiceBinding), []),
@@ -41939,7 +41948,7 @@ function normalizeAndValidateEnvironment(diagnostics, configPath, rawEnv, isDisp
 	warnIfDurableObjectsHaveNoLifecycleConfig(diagnostics, environment.durable_objects, environment.migrations, environment.exports, configPath);
 	errorIfMigrationsAndExportsBothSet(diagnostics, environment.migrations, environment.exports);
 	const containersDeclaredElsewhere = rawConfig !== void 0 ? rawConfig.containers !== void 0 : Object.values("env" in rawEnv ? rawEnv.env ?? {} : {}).some((rawNamedEnv) => rawNamedEnv?.containers !== void 0);
-	validateContainerExportLinks(diagnostics, environment.containers, environment.exports, containersDeclaredElsewhere);
+	validateContainerExportLinks$1(diagnostics, environment.containers, environment.exports, containersDeclaredElsewhere);
 	if (envName !== "top level") validateAdditionalProperties(diagnostics, "env." + envName, Object.keys(rawEnv), Object.keys(environment));
 	return environment;
 }
@@ -42437,7 +42446,6 @@ var validateUnsafeBinding = /* @__PURE__ */ __name$6((diagnostics, field, value)
 			"ai",
 			"ai_search_namespace",
 			"ai_search",
-			"websearch",
 			"agent_memory",
 			"kv_namespace",
 			"durable_object_namespace",
@@ -42583,7 +42591,18 @@ function validateDurableObjectContainerImages(diagnostics, field, images, compli
 				valid$2 = false;
 			}
 		}
-		const unsupportedFields = Object.keys(image).filter((property) => property !== "dockerfile" && property !== "image");
+		const isDockerfileBuild = hasDockerfile && !hasImage;
+		if (isDockerfileBuild) {
+			if (image.build_context !== void 0 && (typeof image.build_context !== "string" || image.build_context.length === 0)) {
+				diagnostics.errors.push(`"${imageField}.build_context" must be a non-empty string.`);
+				valid$2 = false;
+			}
+			if (image.build_vars !== void 0 && (typeof image.build_vars !== "object" || image.build_vars === null || Array.isArray(image.build_vars) || Object.values(image.build_vars).some((value) => typeof value !== "string"))) {
+				diagnostics.errors.push(`"${imageField}.build_vars" must be an object with string values.`);
+				valid$2 = false;
+			}
+		}
+		const unsupportedFields = Object.keys(image).filter((property) => property !== "dockerfile" && property !== "image" && !(isDockerfileBuild && (property === "build_context" || property === "build_vars")));
 		if (unsupportedFields.length > 0) {
 			diagnostics.errors.push(`Unexpected fields found in ${imageField} field: ${unsupportedFields.map((property) => `"${property}"`).join(", ")}`);
 			valid$2 = false;
@@ -42592,6 +42611,24 @@ function validateDurableObjectContainerImages(diagnostics, field, images, compli
 	return valid$2;
 }
 __name$6(validateDurableObjectContainerImages, "validateDurableObjectContainerImages");
+function validateDurableObjectContainerUnsafe(diagnostics, field, value) {
+	if (value === void 0) return;
+	if (typeof value !== "object" || value === null || Array.isArray(value)) {
+		diagnostics.errors.push(`"${field}" should be an object.`);
+		return;
+	}
+	const unsafe = value;
+	const configuration = unsafe.configuration;
+	if (Object.keys(unsafe).some((key) => key !== "configuration") || configuration !== void 0 && (typeof configuration !== "object" || configuration === null || Array.isArray(configuration) || Object.keys(configuration).some((key) => key !== "experimental_flags"))) {
+		diagnostics.errors.push(`Only "${field}.configuration.experimental_flags" is supported for Durable Object-managed Containers.`);
+		return;
+	}
+	if (configuration !== void 0) {
+		const flags = configuration.experimental_flags;
+		if (flags !== void 0 && (!Array.isArray(flags) || flags.some((flag) => typeof flag !== "string"))) diagnostics.errors.push(`"${field}.configuration.experimental_flags" should be an array of strings.`);
+	}
+}
+__name$6(validateDurableObjectContainerUnsafe, "validateDurableObjectContainerUnsafe");
 function validateContainerApp(envName, topLevelName, configPath, options = {}) {
 	const { generateDefaultName = true } = options;
 	return (diagnostics, field, value, config2) => {
@@ -42603,11 +42640,10 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
 		for (const containerAppOptional of value) {
 			const isDurableObjectManaged = containerAppOptional.scheduling_policy === "durable_object";
 			const hasValidDurableObjectClassName = typeof containerAppOptional.class_name === "string" && containerAppOptional.class_name.length > 0;
-			if (isDurableObjectManaged) {
-				if (!hasValidDurableObjectClassName) diagnostics.errors.push(`"containers.class_name" must be a non-empty string when "containers.scheduling_policy" is "durable_object".`);
-			} else validateOptionalProperty(diagnostics, field, "class_name", containerAppOptional.class_name, "string");
+			validateOptionalProperty(diagnostics, field, "class_name", containerAppOptional.class_name, "string");
+			if (isDurableObjectManaged && containerAppOptional.class_name === "") diagnostics.errors.push(`"containers.class_name" must be a non-empty string when specified for a Durable Object-managed Container.`);
 			validateOptionalProperty(diagnostics, field, "name", containerAppOptional.name, "string");
-			if (generateDefaultName && !containerAppOptional.name && (!isDurableObjectManaged || hasValidDurableObjectClassName)) if (containerAppOptional.class_name === void 0) diagnostics.errors.push(`"containers.name" is required when "containers.class_name" is not defined, because there is no class name to derive a default name from. Either name this container and reference it from a Durable Object's \`exports\` entry, or set "containers.class_name".`);
+			if (generateDefaultName && !containerAppOptional.name && (!isDurableObjectManaged || containerAppOptional.class_name === void 0 || hasValidDurableObjectClassName)) if (containerAppOptional.class_name === void 0) diagnostics.errors.push(`"containers.name" is required when "containers.class_name" is not defined, because there is no class name to derive a default name from. Either name this container and reference it from a Durable Object's \`exports\` entry, or set "containers.class_name".`);
 			else if (!topLevelName) diagnostics.errors.push(`Must have either a top level "name" and "containers.class_name" field defined, or have field "containers.name" defined.`);
 			else {
 				let name = `${topLevelName}-${containerAppOptional.class_name}`;
@@ -42616,13 +42652,18 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
 			}
 			if (isDurableObjectManaged) {
 				validateDurableObjectContainerImages(diagnostics, `${field}.images`, containerAppOptional.images, options.complianceConfig);
+				validateContainerObservability(diagnostics, `${field}.observability`, containerAppOptional.observability, config2);
+				if (containerAppOptional.observability?.target_instance_count !== void 0 || containerAppOptional.observability?.target_instance_percentage !== void 0) diagnostics.errors.push(`"${field}.observability" only supports enabling or disabling logs for Durable Object-managed Containers; instance targeting is not supported.`);
+				validateDurableObjectContainerUnsafe(diagnostics, `${field}.unsafe`, containerAppOptional.unsafe);
 				const unsupportedFields = Object.keys(containerAppOptional).filter((key) => ![
 					"name",
 					"class_name",
 					"scheduling_policy",
-					"images"
+					"images",
+					"observability",
+					"unsafe"
 				].includes(key));
-				if (unsupportedFields.length > 0) diagnostics.errors.push(`Unsupported fields for Durable Object-managed Containers in ${field}: ${unsupportedFields.map((key) => `"${key}"`).join(",")}. Only "name", "class_name", "scheduling_policy", and "images" are supported.`);
+				if (unsupportedFields.length > 0) diagnostics.errors.push(`Unsupported fields for Durable Object-managed Containers in ${field}: ${unsupportedFields.map((key) => `"${key}"`).join(",")}. Only "name", "class_name", "scheduling_policy", "images", "observability", and restricted "unsafe" settings are supported.`);
 				continue;
 			}
 			if (!containerAppOptional.configuration?.image && !containerAppOptional.image) diagnostics.errors.push(`"containers.image" field must be defined for each container app. This should be the path to your Dockerfile or an image URI pointing to the Cloudflare registry.`);
@@ -43693,6 +43734,8 @@ var validatePreviewsConfig = /* @__PURE__ */ __name$6((envName, configPath) => (
 		"d1_databases",
 		"r2_buckets",
 		"vectorize",
+		"ai_search_namespaces",
+		"ai_search",
 		"hyperdrive",
 		"services",
 		"analytics_engine_datasets",
@@ -43731,6 +43774,8 @@ var validatePreviewsConfig = /* @__PURE__ */ __name$6((envName, configPath) => (
 	isValid = validateBindingArray(envName, validateD1Binding)(diagnostics, `${field}.d1_databases`, previews.d1_databases, void 0) && isValid;
 	isValid = validateBindingArray(envName, validateR2Binding)(diagnostics, `${field}.r2_buckets`, previews.r2_buckets, void 0) && isValid;
 	isValid = validateBindingArray(envName, validateVectorizeBinding)(diagnostics, `${field}.vectorize`, previews.vectorize, void 0) && isValid;
+	isValid = validateBindingArray(envName, validateAISearchNamespaceBinding)(diagnostics, `${field}.ai_search_namespaces`, previews.ai_search_namespaces, void 0) && isValid;
+	isValid = validateBindingArray(envName, validateAISearchBinding)(diagnostics, `${field}.ai_search`, previews.ai_search, void 0) && isValid;
 	isValid = validateBindingArray(envName, validateHyperdriveBinding)(diagnostics, `${field}.hyperdrive`, previews.hyperdrive, void 0) && isValid;
 	isValid = validateBindingArray(envName, validateServiceBinding)(diagnostics, `${field}.services`, previews.services, void 0) && isValid;
 	isValid = validateBindingArray(envName, validateAnalyticsEngineBinding)(diagnostics, `${field}.analytics_engine_datasets`, previews.analytics_engine_datasets, void 0) && isValid;
@@ -44149,7 +44194,7 @@ function errorIfMigrationsAndExportsBothSet(diagnostics, migrations, exports$1)
 	if (migrations.length > 0 && exports$1 !== void 0 && Object.values(exports$1).some((entry) => entry.type === "durable-object")) diagnostics.errors.push(`\`migrations\` and \`exports\` are mutually exclusive. Choose one or the other to declare your Durable Object lifecycle, but not both.`);
 }
 __name$6(errorIfMigrationsAndExportsBothSet, "errorIfMigrationsAndExportsBothSet");
-function validateContainerExportLinks(diagnostics, containers, exports$1, containersDeclaredElsewhere) {
+function validateContainerExportLinks$1(diagnostics, containers, exports$1, containersDeclaredElsewhere) {
 	if (containers !== void 0 && !Array.isArray(containers)) return;
 	if (containers === void 0 && containersDeclaredElsewhere) return;
 	const containersByName = /* @__PURE__ */ new Map();
@@ -44209,7 +44254,7 @@ function validateContainerExportLinks(diagnostics, containers, exports$1, contai
 		if (referencedContainerName === void 0 && exportEntry !== void 0 && "storage" in exportEntry && exportEntry.storage === "legacy-kv") diagnostics.errors.push(`The container "${container.name}" sets "class_name" to "${container.class_name}", but "exports.${container.class_name}.storage" is "legacy-kv". Containers are not supported on Durable Objects using the "legacy-kv" storage backend.`);
 	}
 }
-__name$6(validateContainerExportLinks, "validateContainerExportLinks");
+__name$6(validateContainerExportLinks$1, "validateContainerExportLinks");
 var validatePythonModules = /* @__PURE__ */ __name$6((diagnostics, field, value, topLevelEnv) => {
 	if (value === void 0) return true;
 	if (typeof value !== "object" || value === null || Array.isArray(value)) {
@@ -44291,7 +44336,6 @@ var BINDING_LOCAL_SUPPORT = {
 	flagship: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
 	vpc_service: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
 	vpc_network: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
-	websearch: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
 	agent_memory: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator"
 };
 function getBindingLocalSupport(type) {
@@ -44649,14 +44693,6 @@ function convertConfigToBindings(config2, options) {
 					...x
 				};
 				break;
-			case "websearch": {
-				const { binding,...x } = info$1;
-				output[binding] = {
-					type: "websearch",
-					...x
-				};
-				break;
-			}
 			case "agent_memory":
 				for (const { binding,...x } of info$1) output[binding] = {
 					type: "agent_memory",
@@ -44802,7 +44838,6 @@ function printBindings(bindings, options) {
 	const vectorize = extractBindingsOfType("vectorize", bindings);
 	const ai_search_namespaces = extractBindingsOfType("ai_search_namespace", bindings);
 	const ai_search = extractBindingsOfType("ai_search", bindings);
-	const websearch = extractBindingsOfType("websearch", bindings);
 	const agent_memory = extractBindingsOfType("agent_memory", bindings);
 	const hyperdrive = extractBindingsOfType("hyperdrive", bindings);
 	const r2_buckets = extractBindingsOfType("r2_bucket", bindings);
@@ -44942,12 +44977,6 @@ function printBindings(bindings, options) {
 		value: instance_name ? String(instance_name) : void 0,
 		mode: getMode({ isSimulatedLocally: false })
 	})));
-	if (websearch.length > 0) output.push(...websearch.map(({ binding }) => ({
-		name: binding,
-		type: getBindingTypeFriendlyName("websearch"),
-		value: void 0,
-		mode: getMode({ isSimulatedLocally: false })
-	})));
 	if (agent_memory.length > 0) output.push(...agent_memory.map(({ binding, namespace }) => ({
 		name: binding,
 		type: getBindingTypeFriendlyName("agent_memory"),
@@ -45236,7 +45265,7 @@ ${allTailConsumers.map(({ service, streaming }) => {
 		let containersTitle = "The following containers are available:";
 		if (context.name && isMultiWorker) containersTitle = `The following containers are available from ${source_default.blue(context.name)}:`;
 		log$2(`${containersTitle}
-${containers.map((container) => container.scheduling_policy === "durable_object" ? `- ${container.class_name} (durable_object)` : `- ${container.name} (${container.image})`).join("\n")}`);
+${containers.map((container) => container.scheduling_policy === "durable_object" ? `- ${container.class_name ?? container.name} (durable_object)` : `- ${container.name} (${container.image})`).join("\n")}`);
 		log$2("");
 	}
 	if (context.unsafeMetadata) {
@@ -55442,10 +55471,6 @@ const KnownBindingSchema = discriminatedUnion("type", [
 		const value = input;
 		return value.tunnelId !== void 0 && value.networkId !== void 0 ? `"vpc-network" bindings must specify exactly one of "tunnelId" or "networkId", not both` : `"vpc-network" bindings must specify either "tunnelId" or "networkId"`;
 	} }),
-	strictObject({
-		type: literal$1("web-search"),
-		dev: RemoteBindingDevSchema.optional()
-	}),
 	WorkerBindingSchema,
 	strictObject({ type: literal$1("worker-loader") })
 ]);
@@ -55484,8 +55509,7 @@ const SINGLETON_BINDING_TYPES = new Set([
 	"images",
 	"media",
 	"stream",
-	"version-metadata",
-	"web-search"
+	"version-metadata"
 ]);
 const listFormatter = new Intl.ListFormat("en-US");
 function validateSingletonBindings(env$3, ctx) {
@@ -55504,6 +55528,136 @@ function validateSingletonBindings(env$3, ctx) {
 	});
 }
 const EnvSchema = record(string(), BindingSchema).superRefine(validateSingletonBindings).optional();
+const ContainerImageDockerfileSchema = strictObject({
+	dockerfile: string().min(1),
+	buildContext: string().optional(),
+	buildVars: record(string(), string()).optional()
+});
+const ContainerImageReferenceSchema = strictObject({ reference: string().min(1) });
+const ContainerImageLocalReferenceSchema = strictObject({ localReference: string().min(1) });
+const InputContainerImageSchema = union([ContainerImageDockerfileSchema, ContainerImageReferenceSchema]);
+const OutputContainerImageSchema = union([ContainerImageReferenceSchema, ContainerImageLocalReferenceSchema]);
+const VALID_ROLLOUT_STEP_PERCENTAGES = new Set([
+	5,
+	10,
+	20,
+	25,
+	50,
+	100
+]);
+const ContainerRolloutStepPercentageSchema = union([number(), array(number())]).superRefine((stepPercentage, ctx) => {
+	if (typeof stepPercentage === "number") {
+		if (!VALID_ROLLOUT_STEP_PERCENTAGES.has(stepPercentage)) ctx.addIssue({
+			code: "custom",
+			message: "A rollout step percentage must be one of 5, 10, 20, 25, 50, or 100"
+		});
+		return;
+	}
+	if (stepPercentage.length === 0) {
+		ctx.addIssue({
+			code: "custom",
+			message: "A rollout must contain at least one step percentage"
+		});
+		return;
+	}
+	for (const [index, step] of stepPercentage.entries()) {
+		if (step < 10 || step > 100) ctx.addIssue({
+			code: "custom",
+			path: [index],
+			message: "Rollout step percentages must be between 10 and 100"
+		});
+		const previousStep = stepPercentage[index - 1];
+		if (previousStep !== void 0 && step < previousStep) ctx.addIssue({
+			code: "custom",
+			path: [index],
+			message: "Rollout step percentages must be in ascending order"
+		});
+	}
+	const lastIndex = stepPercentage.length - 1;
+	if (stepPercentage[lastIndex] !== 100) ctx.addIssue({
+		code: "custom",
+		path: [lastIndex],
+		message: "The final rollout step percentage must be 100"
+	});
+});
+function validateContainerRelationships(container, ctx) {
+	const stepPercentage = container.rollout?.stepPercentage;
+	if (Array.isArray(stepPercentage) && container.maxInstances !== void 0 && stepPercentage.length > container.maxInstances) ctx.addIssue({
+		code: "custom",
+		path: ["rollout", "stepPercentage"],
+		message: "A rollout cannot contain more steps than the maximum number of instances"
+	});
+}
+const ContainerObservabilityBaseSchema = strictObject({
+	enabled: boolean().optional(),
+	logs: strictObject({ enabled: boolean().optional() }).optional()
+});
+const ContainerObservabilitySchema = union([ContainerObservabilityBaseSchema.extend({ targetInstancePercentage: number().min(0).max(100).optional() }), ContainerObservabilityBaseSchema.extend({ targetInstanceCount: number().int().nonnegative().optional() })]);
+const BaseContainerSchema = strictObject({
+	type: literal$1("container"),
+	name: string().min(1),
+	observability: ContainerObservabilitySchema.optional(),
+	unsafe: record(string(), unknown()).optional()
+});
+const StandardContainerBaseSchema = BaseContainerSchema.extend({
+	maxInstances: number().int().nonnegative().default(20),
+	instanceType: union([_enum([
+		"basic",
+		"lite",
+		"standard-1",
+		"standard-2",
+		"standard-3",
+		"standard-4"
+	]), strictObject({
+		vcpu: number().min(.0625).optional(),
+		memoryMib: number().nonnegative().optional(),
+		diskMb: number().nonnegative().optional()
+	})]).optional(),
+	schedulingPolicy: _enum(["default", "regional"]).optional(),
+	ssh: strictObject({
+		enabled: boolean(),
+		port: number().int().min(1).max(65535).optional()
+	}).optional(),
+	authorizedKeys: array(strictObject({
+		name: string(),
+		publicKey: string()
+	})).optional(),
+	constraints: strictObject({
+		regions: array(_enum([
+			"ENAM",
+			"WNAM",
+			"EEUR",
+			"WEUR",
+			"APAC",
+			"SAM",
+			"ME",
+			"OC",
+			"AFR"
+		])).optional(),
+		jurisdiction: _enum(["eu", "fedramp"]).optional()
+	}).optional(),
+	rollout: strictObject({
+		kind: _enum([
+			"full-auto",
+			"none",
+			"full-manual"
+		]).optional(),
+		stepPercentage: ContainerRolloutStepPercentageSchema.optional(),
+		activeGracePeriod: number().nonnegative().optional()
+	}).optional()
+});
+const DurableObjectContainerBaseSchema = BaseContainerSchema.extend({ schedulingPolicy: literal$1("durable-object") });
+/**
+* Input Container schema — validates user-authored `cloudflare.config.ts`
+* Container exports. Dockerfiles are built by the consuming build tool.
+*/
+const InputContainerSchema = union([StandardContainerBaseSchema.extend({ image: InputContainerImageSchema }).superRefine(validateContainerRelationships), DurableObjectContainerBaseSchema.extend({ images: record(string(), InputContainerImageSchema).optional() })]);
+/**
+* Output Container schema — validates Container configs in the Build Output
+* Specification, after any Dockerfile has been built into a local or remote
+* image reference.
+*/
+const OutputContainerSchema = union([StandardContainerBaseSchema.extend({ image: OutputContainerImageSchema }).superRefine(validateContainerRelationships), DurableObjectContainerBaseSchema.extend({ images: record(string(), OutputContainerImageSchema).optional() })]);
 const DurableObjectCreatedExportSchema = strictObject({
 	type: literal$1("durable-object"),
 	state: literal$1("created").optional(),
@@ -55682,8 +55836,13 @@ const InputSettingsSchema = strictObject({
 * Build Output Specification. Adds the `mode` the build was produced in.
 */
 const OutputSettingsSchema = InputSettingsSchema.extend({ mode: string().optional() });
+const DEFAULT_EXPORT_NAME = "default";
 const SETTINGS_EXPORT_NAME = "settings";
-const SUPPORTED_EXPORT_TYPES = new Set(["worker", "settings"]);
+const SUPPORTED_EXPORT_TYPES = new Set([
+	"container",
+	"worker",
+	"settings"
+]);
 function invalidConfigExportMessage(exportName) {
 	return `The \`${exportName}\` export is not a supported export type. Move constants, helper functions, and other unsupported exports to a separate module.`;
 }
@@ -55700,6 +55859,15 @@ const ConfigExportsTypeSchema = record(string(), unknown()).check((ctx) => {
 			});
 			continue;
 		}
+		if (key === DEFAULT_EXPORT_NAME && type !== "worker") {
+			ctx.issues.push({
+				code: "custom",
+				input: value,
+				path: [key],
+				message: `The \`${DEFAULT_EXPORT_NAME}\` export is reserved for a \`worker\` config; found a \`${type}\` config.`
+			});
+			continue;
+		}
 		const isSettingsName = key === SETTINGS_EXPORT_NAME;
 		const isSettingsType = type === "settings";
 		if (isSettingsType && !isSettingsName) ctx.issues.push({
@@ -55881,18 +56049,26 @@ function createFatalError(message, isJson, options) {
 	return new FatalError$1(`${message}`, options);
 }
 __name$5(createFatalError, "createFatalError");
+const ROLLOUT_KIND_MAP = {
+	"full-auto": "full_auto",
+	"full-manual": "full_manual",
+	none: "none"
+};
 /**
 * Convert a parsed `@cloudflare/config` config into a Wrangler `RawConfig`.
 *
-* The caller is responsible for unwrapping any function/promise wrapper around
-* the config and validating it against `InputWorkerSchema` before passing it in.
+* The caller is responsible for unwrapping any function/promise wrappers and
+* validating the configs against their corresponding input schemas before
+* passing them in.
 *
 * @param workerConfig The parsed (post-validation) Worker config.
 * @param settingsConfig The optional parsed settings config, whose fields
 * are merged onto the result.
+* @param containerExports The parsed Container exports to include in the
+* result.
 * @returns The corresponding Wrangler `RawConfig`.
 */
-function convertToWranglerConfig(workerConfig, settingsConfig) {
+function convertToWranglerConfig(workerConfig, settingsConfig, containerExports = []) {
 	const result = {};
 	convertTopLevel(workerConfig, result);
 	convertBindingsAndAssets(workerConfig, result);
@@ -55901,8 +56077,50 @@ function convertToWranglerConfig(workerConfig, settingsConfig) {
 	convertTriggers(workerConfig, result);
 	convertTailConsumers(workerConfig, result);
 	if (settingsConfig !== void 0) convertSettings(settingsConfig, result);
+	if (containerExports.length > 0) result.containers = containerExports.map((container) => convertContainer(container));
 	return result;
 }
+function convertContainer(container) {
+	if (container.schedulingPolicy === "durable-object") throw new UserError$1("Durable Object-managed Containers are not currently supported by `convertToWranglerConfig()`.", { telemetryMessage: false });
+	const converted = { name: container.name };
+	if (container.observability !== void 0) converted.observability = convertContainerObservability(container.observability);
+	if (container.unsafe !== void 0) converted.unsafe = container.unsafe;
+	converted.image = "dockerfile" in container.image ? container.image.dockerfile : container.image.reference;
+	converted.max_instances = container.maxInstances;
+	if ("dockerfile" in container.image) {
+		if (container.image.buildContext !== void 0) converted.image_build_context = container.image.buildContext;
+		if (container.image.buildVars !== void 0) converted.image_vars = container.image.buildVars;
+	}
+	if (container.instanceType !== void 0) if (typeof container.instanceType === "string") converted.instance_type = container.instanceType;
+	else {
+		const instanceType = {};
+		if (container.instanceType.vcpu !== void 0) instanceType.vcpu = container.instanceType.vcpu;
+		if (container.instanceType.memoryMib !== void 0) instanceType.memory_mib = container.instanceType.memoryMib;
+		if (container.instanceType.diskMb !== void 0) instanceType.disk_mb = container.instanceType.diskMb;
+		converted.instance_type = instanceType;
+	}
+	if (container.schedulingPolicy !== void 0) converted.scheduling_policy = container.schedulingPolicy;
+	if (container.ssh !== void 0) converted.ssh = container.ssh;
+	if (container.authorizedKeys !== void 0) converted.authorized_keys = container.authorizedKeys.map(({ name, publicKey }) => ({
+		name,
+		public_key: publicKey
+	}));
+	if (container.constraints !== void 0) converted.constraints = container.constraints;
+	if (container.rollout !== void 0) {
+		if (container.rollout.kind !== void 0) converted.rollout_kind = ROLLOUT_KIND_MAP[container.rollout.kind];
+		if (container.rollout.stepPercentage !== void 0) converted.rollout_step_percentage = container.rollout.stepPercentage;
+		if (container.rollout.activeGracePeriod !== void 0) converted.rollout_active_grace_period = container.rollout.activeGracePeriod;
+	}
+	return converted;
+}
+function convertContainerObservability(observability) {
+	const converted = {};
+	if (observability.enabled !== void 0) converted.enabled = observability.enabled;
+	if (observability.logs !== void 0) converted.logs = observability.logs;
+	if ("targetInstancePercentage" in observability && observability.targetInstancePercentage !== void 0) converted.target_instance_percentage = observability.targetInstancePercentage;
+	if ("targetInstanceCount" in observability && observability.targetInstanceCount !== void 0) converted.target_instance_count = observability.targetInstanceCount;
+	return converted;
+}
 /**
 * Merge a parsed settings config's fields (`account_id`, `compliance_region`)
 * onto an existing Wrangler `RawConfig`.
@@ -56230,12 +56448,6 @@ function convertBindingsAndAssets(config$2, result) {
 					remote: binding.dev?.remote
 				}));
 				break;
-			case "web-search":
-				result.websearch = omitUndefined({
-					binding: name,
-					remote: binding.dev?.remote
-				});
-				break;
 			case "worker":
 				services.push(omitUndefined({
 					binding: name,
@@ -56570,6 +56782,9 @@ function isRecord(value) {
 function isConfigReference(value) {
 	return typeof value === "function" || isRecord(value);
 }
+function normalizeConfigReference(reference, resolved, expectedType) {
+	return isRecord(resolved) && resolved.type === expectedType && typeof resolved.name === "string" ? resolved.name : reference;
+}
 function createDefinitionResolver(ctx) {
 	const resolvedDefinitions = /* @__PURE__ */ new Map();
 	return (input) => {
@@ -56590,7 +56805,7 @@ async function normalizeWorkerReferences(resolved, resolveDefinition) {
 		const target$1 = await resolveDefinition(binding.worker);
 		env$3[bindingName] = {
 			...binding,
-			worker: isRecord(target$1) ? target$1.name : void 0
+			worker: normalizeConfigReference(binding.worker, target$1, "worker")
 		};
 	}
 	return {
@@ -56598,22 +56813,151 @@ async function normalizeWorkerReferences(resolved, resolveDefinition) {
 		env: env$3
 	};
 }
+async function normalizeContainerReferences(resolved, resolveDefinition, resolvedExports) {
+	const issues = [];
+	if (!isRecord(resolved) || !isRecord(resolved.exports)) return {
+		value: resolved,
+		issues
+	};
+	const workerExports = { ...resolved.exports };
+	for (const [exportName, workerExport] of Object.entries(workerExports)) {
+		if (!isRecord(workerExport) || workerExport.type !== "durable-object" || workerExport.container === void 0) continue;
+		const reference = workerExport.container;
+		if (typeof reference === "string") {
+			issues.push({
+				code: "custom",
+				input: reference,
+				path: [
+					"exports",
+					exportName,
+					"container"
+				],
+				message: "Container provided as a string. Reference an exported Container definition instead."
+			});
+			workerExports[exportName] = {
+				...workerExport,
+				container: void 0
+			};
+			continue;
+		}
+		const target$1 = await resolveDefinition(reference);
+		if (isRecord(target$1) && target$1.type === "container" && typeof target$1.name === "string" && !Object.values(resolvedExports).includes(target$1)) {
+			issues.push({
+				code: "custom",
+				input: reference,
+				path: [
+					"exports",
+					exportName,
+					"container"
+				],
+				message: `The referenced Container "${target$1.name}" is not exported.`
+			});
+			workerExports[exportName] = {
+				...workerExport,
+				container: void 0
+			};
+			continue;
+		}
+		workerExports[exportName] = {
+			...workerExport,
+			container: normalizeConfigReference(reference, target$1, "container")
+		};
+	}
+	return {
+		value: {
+			...resolved,
+			exports: workerExports
+		},
+		issues
+	};
+}
+async function normalizeConfigReferences(resolved, resolveDefinition, resolvedExports) {
+	return normalizeContainerReferences(await normalizeWorkerReferences(resolved, resolveDefinition), resolveDefinition, resolvedExports);
+}
 function prefixIssues(issues, prefix) {
 	return issues.map((issue$2) => ({
 		...issue$2,
 		path: [prefix, ...issue$2.path]
 	}));
 }
+function validateUniqueResourceNames(configExports) {
+	const issues = [];
+	const exportNameByResourceName = {
+		container: /* @__PURE__ */ new Map(),
+		worker: /* @__PURE__ */ new Map()
+	};
+	for (const [exportName, config$2] of Object.entries(configExports)) {
+		if (config$2.type !== "container" && config$2.type !== "worker") continue;
+		const resourceType = config$2.type === "container" ? "Container" : "Worker";
+		const exportNames = exportNameByResourceName[config$2.type];
+		const previousExportName = exportNames.get(config$2.name);
+		if (previousExportName !== void 0) {
+			issues.push({
+				code: "custom",
+				input: config$2.name,
+				path: [exportName, "name"],
+				message: `The ${resourceType} name "${config$2.name}" is also used by the "${previousExportName}" export. ${resourceType} names must be unique.`
+			});
+			continue;
+		}
+		exportNames.set(config$2.name, exportName);
+	}
+	return issues;
+}
+function validateContainerExportLinks(configExports) {
+	const issues = [];
+	const containerNames = /* @__PURE__ */ new Set();
+	for (const config$2 of Object.values(configExports)) if (config$2.type === "container") containerNames.add(config$2.name);
+	const firstReferenceByContainerName = /* @__PURE__ */ new Map();
+	for (const [workerExportName, config$2] of Object.entries(configExports)) {
+		if (config$2.type !== "worker") continue;
+		for (const [durableObjectExportName, workerExport] of Object.entries(config$2.exports ?? {})) {
+			if (workerExport.type !== "durable-object" || !("container" in workerExport) || workerExport.container === void 0) continue;
+			const containerName = workerExport.container;
+			const path$2 = [
+				workerExportName,
+				"exports",
+				durableObjectExportName,
+				"container"
+			];
+			if (!containerNames.has(containerName)) {
+				issues.push({
+					code: "custom",
+					input: containerName,
+					path: path$2,
+					message: `The Container "${containerName}" is not exported from this configuration.`
+				});
+				continue;
+			}
+			const firstReference = firstReferenceByContainerName.get(containerName);
+			if (firstReference !== void 0) {
+				issues.push({
+					code: "custom",
+					input: containerName,
+					path: path$2,
+					message: `The Container "${containerName}" is already referenced by "${firstReference.workerExportName}.exports.${firstReference.durableObjectExportName}". A Container can only be linked to one Durable Object.`
+				});
+				continue;
+			}
+			firstReferenceByContainerName.set(containerName, {
+				workerExportName,
+				durableObjectExportName
+			});
+		}
+	}
+	return issues;
+}
 /**
 * Resolve and validate loaded `cloudflare.config.ts` exports.
 *
-* Config inputs are resolved once by identity. Top-level Worker exports are
-* also parsed once by identity; unexported references are resolved only far
-* enough to replace the reference with the Worker's name.
+* Config inputs are resolved once by identity. Top-level Worker and Container
+* exports are also parsed once by identity. References are resolved only far
+* enough to replace them with resource names, then Container links are
+* validated across the exported resources.
 */
 async function resolveAndValidateConfigExports(exports$2, ctx) {
 	const resolveDefinition = createDefinitionResolver(ctx);
-	const parsedWorkers = /* @__PURE__ */ new Map();
+	const parsedResources = /* @__PURE__ */ new Map();
 	const resolvedExports = {};
 	for (const [name, input] of Object.entries(exports$2)) resolvedExports[name] = await resolveDefinition(input);
 	const typeResult = ConfigExportsTypeSchema.safeParse(resolvedExports);
@@ -56627,17 +56971,20 @@ async function resolveAndValidateConfigExports(exports$2, ctx) {
 	for (const [name, input] of Object.entries(exports$2)) {
 		const resolved = resolvedExports[name];
 		if (!isRecord(resolved)) continue;
-		if (resolved.type === "worker") {
-			let result = parsedWorkers.get(input);
-			if (!result) {
-				result = InputWorkerSchema.safeParse(await normalizeWorkerReferences(resolved, resolveDefinition));
-				parsedWorkers.set(input, result);
-				if (!result.success) issues.push(...prefixIssues(result.error.issues, name));
-			}
-			if (result.success) data$1[name] = result.data;
-			continue;
-		}
-	}
+		if (resolved.type !== "worker" && resolved.type !== "container") continue;
+		let result = parsedResources.get(input);
+		if (!result) {
+			if (resolved.type === "worker") {
+				const normalized = await normalizeConfigReferences(resolved, resolveDefinition, resolvedExports);
+				issues.push(...prefixIssues(normalized.issues, name));
+				result = InputWorkerSchema.safeParse(normalized.value);
+			} else result = InputContainerSchema.safeParse(resolved);
+			parsedResources.set(input, result);
+			if (!result.success) issues.push(...prefixIssues(result.error.issues, name));
+		}
+		if (result.success) data$1[name] = result.data;
+	}
+	issues.push(...validateUniqueResourceNames(data$1), ...validateContainerExportLinks(data$1));
 	return issues.length > 0 ? {
 		success: false,
 		error: new ZodError(issues)
@@ -56815,9 +57162,25 @@ const MAX_ROUTES_RULE_LENGTH = 100;
 
 //#endregion
 //#region ../workers-shared/utils/configuration/parseStaticRouting.ts
+const MAX_REPORTED_DUPLICATED_RULES = 5;
 function parseStaticRouting(input) {
 	if (input.length === 0) throw new Error("No `run_worker_first` rules were provided; must provide at least 1 rule.");
-	if (input.length > MAX_ROUTES_RULES) throw new Error(`Too many \`run_worker_first\` rules were provided; ${input.length} rules provided exceeds max of ${MAX_ROUTES_RULES}.`);
+	if (input.length > MAX_ROUTES_RULES) {
+		const seenRules = /* @__PURE__ */ new Set();
+		const duplicatedRules = /* @__PURE__ */ new Set();
+		for (const rule of input) {
+			if (seenRules.has(rule)) duplicatedRules.add(rule);
+			seenRules.add(rule);
+		}
+		if (duplicatedRules.size > 0) {
+			const duplicateEntryCount = input.length - seenRules.size;
+			const reportedDuplicatedRules = [...seenRules].filter((rule) => duplicatedRules.has(rule)).slice(0, MAX_REPORTED_DUPLICATED_RULES);
+			const unreportedDuplicatedRuleCount = duplicatedRules.size - reportedDuplicatedRules.length;
+			const unreportedDuplicatedRulesMessage = unreportedDuplicatedRuleCount > 0 ? `\n...and ${unreportedDuplicatedRuleCount} more duplicated ${unreportedDuplicatedRuleCount === 1 ? "rule" : "rules"}.` : "";
+			throw new Error(`Too many \`run_worker_first\` rules were provided; ${input.length} rules provided (${seenRules.size} distinct, ${duplicateEntryCount} duplicate ${duplicateEntryCount === 1 ? "entry" : "entries"}) exceeds max of ${MAX_ROUTES_RULES}. Note: duplicate entries count towards the route limit. Ensure that no duplicate rules are present in your \`run_worker_first\` configuration.\n\nThe duplicated rules found are:\n${reportedDuplicatedRules.map((rule) => `- ${JSON.stringify(rule)}`).join("\n")}${unreportedDuplicatedRulesMessage}`);
+		}
+		throw new Error(`Too many \`run_worker_first\` rules were provided; ${input.length} rules provided exceeds max of ${MAX_ROUTES_RULES}.`);
+	}
 	const rawAssetWorkerRules = [];
 	const assetWorkerRules = [];
 	const userWorkerRules = [];
@@ -56946,13 +57309,36 @@ function getWorkersDir(root) {
 	return path.join(getBuildOutputDir(root), BUILD_OUTPUT_VERSION, "workers");
 }
 /**
+* Absolute path to the Containers output directory.
+*/
+function getContainersDir(root) {
+	return path.join(getBuildOutputDir(root), BUILD_OUTPUT_VERSION, "containers");
+}
+function validateDirectoryName(name, resourceName) {
+	if (name.length === 0 || name === "." || name === ".." || name.includes("/") || name.includes("\\") || name.includes("\0")) throw new Error(`${resourceName} directory names must be non-empty, single path segments. Received ${JSON.stringify(name)}.`);
+}
+/**
 * Absolute path to a Worker's directory (`workers/<worker-directory-name>`).
 */
 function getWorkerDir(root, workerDirectoryName = DEFAULT_WORKER_DIRECTORY_NAME) {
-	if (workerDirectoryName.length === 0 || workerDirectoryName === "." || workerDirectoryName === ".." || workerDirectoryName.includes("/") || workerDirectoryName.includes("\\") || workerDirectoryName.includes("\0")) throw new Error("Worker directory names must be non-empty, single path segments.");
+	validateDirectoryName(workerDirectoryName, "Worker");
 	return path.join(getWorkersDir(root), workerDirectoryName);
 }
 /**
+* Absolute path to a Container's directory
+* (`containers/<container-directory-name>`).
+*/
+function getContainerDir(root, containerDirectoryName) {
+	validateDirectoryName(containerDirectoryName, "Container");
+	return path.join(getContainersDir(root), containerDirectoryName);
+}
+/**
+* Absolute path to the Container's config file.
+*/
+function getContainerConfigPath(root, containerDirectoryName) {
+	return path.join(getContainerDir(root, containerDirectoryName), CONFIG_FILENAME);
+}
+/**
 * Absolute path to the Worker's config file.
 */
 function getWorkerConfigPath(root, workerDirectoryName = DEFAULT_WORKER_DIRECTORY_NAME) {
@@ -57011,14 +57397,14 @@ async function cleanBuildOutputDir(root) {
 * - Workers mode: `manifest` is provided (bundle/ present on disk).
 * - Assets-only mode: `manifest` is omitted (no bundle/ directory).
 */
-async function writeWorkerConfig({ root, config: config$2, manifest, workerDirectoryName = DEFAULT_WORKER_DIRECTORY_NAME }) {
+async function writeWorkerConfig({ root, config: config$2, manifest, directoryName = DEFAULT_WORKER_DIRECTORY_NAME }) {
 	const { entrypoint: _entrypoint,...rest } = config$2;
 	const outputConfig = {
 		...rest,
 		manifest
 	};
-	await fsp.mkdir(getWorkerDir(root, workerDirectoryName), { recursive: true });
-	await fsp.writeFile(getWorkerConfigPath(root, workerDirectoryName), JSON.stringify(outputConfig));
+	await fsp.mkdir(getWorkerDir(root, directoryName), { recursive: true });
+	await fsp.writeFile(getWorkerConfigPath(root, directoryName), JSON.stringify(outputConfig));
 }
 /**
 * Write the top-level `config.json` to the Build Output Specification tree.
@@ -57057,12 +57443,13 @@ var BuildOutputError = class extends Error {
 * `<root>/.cloudflare/output/v0/`.
 *
 * Reads the optional top-level settings `config.json`, then reads and
-* schema-validates the Worker's `config.json` and resolves its
-* `bundle/` / `assets/` directories. Partial manifests are resolved into
-* complete manifests using the files in `bundle/`.
+* schema-validates each Worker and Container `config.json`, and resolves each
+* Worker's `bundle/` / `assets/` directories. Partial manifests are resolved
+* into complete manifests using the files in `bundle/`.
 *
 * @throws {BuildOutputError} if the top-level `config.json` is invalid, or if
-* the Worker config is missing, is not valid JSON, or fails schema validation.
+* a Worker or Container config is missing, is not valid JSON, or fails schema
+* validation.
 */
 async function readBuildOutput(root) {
 	const settings = await readSettings(root);
@@ -57076,7 +57463,28 @@ async function readBuildOutput(root) {
 		workers: {
 			default: defaultWorker,
 			...Object.fromEntries(additionalWorkers)
-		}
+		},
+		containers: await readContainers(root)
+	};
+}
+/** Read and schema-validate all Container configs, if any. */
+async function readContainers(root) {
+	const containersDir = getContainersDir(root);
+	if (!fs$1.existsSync(containersDir)) return {};
+	const containerDirectoryNames = (await fsp.readdir(containersDir, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
+	const containers = await Promise.all(containerDirectoryNames.map(async (containerDirectoryName) => [containerDirectoryName, await readContainer(root, containerDirectoryName)]));
+	return Object.fromEntries(containers);
+}
+/** Read and schema-validate one Container config. */
+async function readContainer(root, containerDirectoryName) {
+	const configPath = getContainerConfigPath(root, containerDirectoryName);
+	if (!fs$1.existsSync(configPath)) throw new BuildOutputError(`no Container config found at ${configPath}.`);
+	const contents = await fsp.readFile(configPath, "utf-8");
+	const result = OutputContainerSchema.safeParse(parseJson(contents, configPath));
+	if (!result.success) throw new BuildOutputError(`invalid Container config at ${configPath}.\n${result.error.message}`);
+	return {
+		configPath,
+		config: result.data
 	};
 }
 /**
@@ -65975,8 +66383,9 @@ function maybeAddAgentHint(server, mode) {
 * Prints the Local Explorer API URL and useful routes to stdout so that
 * headless AI agents can discover and call them programmatically.
 *
-* Keep the message in sync with the wrangler copy in
-* packages/wrangler/src/dev/start-dev.ts.
+* Keep the message in sync with:
+* - packages/wrangler/src/dev/start-dev.ts (printLocalExplorerAgentHint)
+* - packages/create-cloudflare/src/agents-md.ts (Local Explorer section)
 *
 * @param server - The Vite dev or preview server (must have `resolvedUrls` populated)
 * @param mode - Whether this is a "dev" or "preview" session
@@ -65998,6 +66407,7 @@ function printLocalExplorerAgentHint(server, mode) {
 		`  GET ${explorerApiUrl}/workflows - Workflows`,
 		`  POST ${explorerApiUrl}/local/observability/query - run a read-only SQL query (SELECT/WITH only) over captured request traces and console logs. Tables: spans, logs (read attributes via json(attributes)). Example:`,
 		`    curl -X POST ${explorerApiUrl}/local/observability/query -H 'Content-Type: application/json' -d '{"sql":"SELECT service, name, outcome, duration_ms FROM spans WHERE parent_id IS NULL LIMIT 20"}'`,
+		`  POST ${explorerApiUrl}/local/observability/clear - clear all captured traces and logs`,
 		`If the routes above don't cover what you need, fetch the full OpenAPI schema (large - use only as a last resort):`,
 		`  GET ${explorerApiUrl} - OpenAPI schema`,
 		""
@@ -68562,6 +68972,39 @@ function validateWorkerEnvironmentOptions(resolvedPluginConfig, resolvedViteConf
 	}
 }
 
+//#endregion
+//#region src/plugins/wrangler-watch-ignore.ts
+const WRANGLER_STATE_WATCH_IGNORE = "**/.wrangler/**";
+/**
+* Keep Miniflare persistence writes out of Vite's file watcher without
+* replacing any ignore patterns the user already configured.
+*
+* @param userIgnored - Existing `server.watch.ignored` patterns, if any
+* @returns Ignore patterns that always include `.wrangler` directories
+*/
+function withWranglerStateIgnored(userIgnored) {
+	if (userIgnored == null) return WRANGLER_STATE_WATCH_IGNORE;
+	if (Array.isArray(userIgnored)) return [...userIgnored, WRANGLER_STATE_WATCH_IGNORE];
+	return [userIgnored, WRANGLER_STATE_WATCH_IGNORE];
+}
+/**
+* Merge `.wrangler` into Vite's `server.watch` config.
+*
+* Returns `null` when the user disabled watching with `server.watch: null`,
+* so this plugin does not turn the watcher back on.
+*
+* @param userWatch - The user's `server.watch` value from Vite config
+* @returns `null` when watching is disabled, otherwise a watch object whose
+*   `ignored` list includes `.wrangler` directories
+*/
+function getServerWatchConfig(userWatch) {
+	if (userWatch === null) return null;
+	return {
+		...userWatch,
+		ignored: withWranglerStateIgnored(userWatch?.ignored)
+	};
+}
+
 //#endregion
 //#region src/plugins/config.ts
 /**
@@ -68580,6 +69023,7 @@ const configPlugin = createPlugin("config", (ctx) => {
 				appType: "custom",
 				server: {
 					allowedHosts: getAllowedHosts(ctx.getTunnelHostnames(), userConfig.server?.allowedHosts),
+					watch: getServerWatchConfig(userConfig.server?.watch),
 					fs: { deny: [...[
 						".env",
 						".env.*",
@@ -74143,7 +74587,7 @@ async function buildContainerImage(containerConfig, pathToDocker, verifyDockerIs
 			}
 		})).ready;
 		return {
-			containerConfig,
+			container: containerConfig,
 			localTag
 		};
 	} catch (error$2) {
@@ -74156,12 +74600,14 @@ async function buildContainerImage(containerConfig, pathToDocker, verifyDockerIs
 }
 __name$2(buildContainerImage, "buildContainerImage");
 async function buildContainerImages(containers, pathToDocker, verifyDockerIsRunning) {
-	const builtContainerDeployments = [];
-	for (const container of containers.filter(isDockerfileContainerConfig)) builtContainerDeployments.push({
-		container,
-		builtImage: await buildContainerImage(container, pathToDocker, verifyDockerIsRunning)
-	});
-	return builtContainerDeployments;
+	const builtImages = [];
+	try {
+		for (const container of containers.filter(isDockerfileContainerConfig)) builtImages.push(await buildContainerImage(container, pathToDocker, verifyDockerIsRunning));
+	} catch (error$2) {
+		await cleanupBuiltImages(builtImages, pathToDocker);
+		throw error$2;
+	}
+	return builtImages;
 }
 __name$2(buildContainerImages, "buildContainerImages");
 async function pushBuiltContainerImage(builtImage, versionId, pathToDocker, accountId, complianceConfig) {
@@ -74169,8 +74615,8 @@ async function pushBuiltContainerImage(builtImage, versionId, pathToDocker, acco
 		const imageRef = await pushImageIfChanged({
 			pathToDocker,
 			sourceTag: builtImage.localTag,
-			targetTag: getContainerImageTag(builtImage.containerConfig, versionId),
-			containerConfig: builtImage.containerConfig,
+			targetTag: getContainerImageTag(builtImage.container, versionId),
+			containerConfig: builtImage.container,
 			accountId,
 			complianceConfig,
 			cleanupSourceTag: true
@@ -74186,23 +74632,29 @@ async function pushBuiltContainerImage(builtImage, versionId, pathToDocker, acco
 	}
 }
 __name$2(pushBuiltContainerImage, "pushBuiltContainerImage");
-async function cleanupBuiltContainerImages(builtContainerDeployments, pathToDocker) {
-	for (const { builtImage } of builtContainerDeployments) {
-		if (builtImage.localTagCleaned) continue;
-		try {
-			logger$1.debug(`Untagging built image: ${builtImage.localTag}.`);
+async function cleanupBuiltImages(builtImages, pathToDocker) {
+	const aliasesByTag = /* @__PURE__ */ new Map();
+	for (const builtImage of builtImages) {
+		const aliases = aliasesByTag.get(builtImage.localTag);
+		if (aliases) aliases.push(builtImage);
+		else aliasesByTag.set(builtImage.localTag, [builtImage]);
+	}
+	for (const [localTag, aliases] of aliasesByTag) {
+		if (!aliases.some((alias) => alias.localTagCleaned)) try {
+			logger$1.debug(`Untagging built image: ${localTag}.`);
 			await runDockerCmd(pathToDocker, [
 				"image",
 				"rm",
-				builtImage.localTag
+				localTag
 			]);
-			builtImage.localTagCleaned = true;
 		} catch (error$2) {
-			if (error$2 instanceof Error) logger$1.debug(`Cleaning up built image ${builtImage.localTag} failed with error: ${error$2.message}`);
+			if (error$2 instanceof Error) logger$1.debug(`Cleaning up built image ${localTag} failed with error: ${error$2.message}`);
+			continue;
 		}
+		for (const alias of aliases) alias.localTagCleaned = true;
 	}
 }
-__name$2(cleanupBuiltContainerImages, "cleanupBuiltContainerImages");
+__name$2(cleanupBuiltImages, "cleanupBuiltImages");
 function getContainerImageTag(containerConfig, imageTag) {
 	return `${getContainerImageRepositoryName(containerConfig)}:${imageTag.split("-")[0]}`;
 }
@@ -77992,7 +78444,7 @@ function scrubEncryptedCredentials(options) {
 __name$1(scrubEncryptedCredentials, "scrubEncryptedCredentials");
 
 //#endregion
-//#region ../workers-auth/dist/chunk-YCVYA5LL.mjs
+//#region ../workers-auth/dist/chunk-T63LVVAX.mjs
 function createPreferences(getConfigPath) {
 	function getUserPreferencesPath() {
 		return path__default.resolve(getConfigPath(), "preferences.json");
@@ -78771,7 +79223,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
 		return oauthFlow.requireApiToken();
 	}
 	__name$1(requireApiToken$1, "requireApiToken");
-	function withDefaultScopes(complianceConfig, props) {
+	function withLoginDefaults(complianceConfig, props) {
 		return {
 			complianceConfig,
 			scopes: props?.scopes ?? descriptor.getDefaultScopeKeys(),
@@ -78779,12 +79231,12 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
 			callbackHost: props?.callbackHost,
 			callbackPort: props?.callbackPort,
 			profile: props?.profile,
-			device: props?.device
+			device: props?.device ?? descriptor.useDeviceFlowByDefault ?? false
 		};
 	}
-	__name$1(withDefaultScopes, "withDefaultScopes");
+	__name$1(withLoginDefaults, "withLoginDefaults");
 	async function login(complianceConfig, props) {
-		return oauthFlow.login(withDefaultScopes(complianceConfig, props));
+		return oauthFlow.login(withLoginDefaults(complianceConfig, props));
 	}
 	__name$1(login, "login");
 	async function logout(profile) {
@@ -78793,7 +79245,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
 	__name$1(logout, "logout");
 	async function loginOrRefreshIfRequired(complianceConfig, props) {
 		if (oauthFlow.getActiveTemporaryAccount()) return { loggedIn: true };
-		return oauthFlow.loginOrRefreshIfRequired(withDefaultScopes(complianceConfig, props));
+		return oauthFlow.loginOrRefreshIfRequired(withLoginDefaults(complianceConfig, props));
 	}
 	__name$1(loginOrRefreshIfRequired, "loginOrRefreshIfRequired");
 	async function getOAuthTokenFromLocalState() {
@@ -78826,10 +79278,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
 		return configCache.getConfigCache(getAccountCacheFileName()).account;
 	}
 	__name$1(getAccountFromCache, "getAccountFromCache");
-	async function fetchAccountsPaged(complianceConfig, resource) {
-		const result = await loginOrRefreshIfRequired(complianceConfig);
-		if (!result.loggedIn) throw new UserError(`Not logged in. ${NOT_LOGGED_IN_ERROR_BODIES[result.reason]}${NOT_LOGGED_IN_WHOAMI_TIP}`, { telemetryMessage: "cfetch auth login required" });
-		const credentials = requireApiToken$1();
+	async function fetchAccountsPaged(complianceConfig, resource, credentials) {
 		const results = [];
 		let getMoreResults = true;
 		let page = 1;
@@ -78849,7 +79298,10 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
 	__name$1(fetchAccountsPaged, "fetchAccountsPaged");
 	async function fetchAllAccounts(complianceConfig, options = {}) {
 		const { throwOnEmpty = true } = options;
-		const [accountsRes, membershipsRes] = await Promise.allSettled([fetchAccountsPaged(complianceConfig, `/accounts`), fetchAccountsPaged(complianceConfig, `/memberships`)]);
+		const loginResult = await loginOrRefreshIfRequired(complianceConfig);
+		if (!loginResult.loggedIn) throw new UserError(`Not logged in. ${NOT_LOGGED_IN_ERROR_BODIES[loginResult.reason]}${NOT_LOGGED_IN_WHOAMI_TIP}`, { telemetryMessage: "cfetch auth login required" });
+		const credentials = requireApiToken$1();
+		const [accountsRes, membershipsRes] = await Promise.allSettled([fetchAccountsPaged(complianceConfig, `/accounts`, credentials), fetchAccountsPaged(complianceConfig, `/memberships`, credentials)]);
 		if (accountsRes.status === "rejected") throw accountsRes.reason;
 		if (membershipsRes.status === "rejected") if (isMembershipsInaccessible(membershipsRes.reason)) {
 			if (accountsRes.status === "fulfilled" && accountsRes.value.length > 0) return accountsRes.value;
@@ -79146,7 +79598,483 @@ function getCfConfigPath() {
 	});
 }
 __name$1(getCfConfigPath, "getCfConfigPath");
-var CF_SCOPES = [
+var CF_REGISTERED_SCOPES = [
+	"access:read",
+	"access:write",
+	"account:read",
+	"agw:read",
+	"agw:run",
+	"agw:write",
+	"ai:read",
+	"ai:write",
+	"ai-search:read",
+	"ai-search:run",
+	"ai-search:write",
+	"aiaudit:read",
+	"aiaudit:write",
+	"aig:read",
+	"aig:write",
+	"auditlogs:read",
+	"billing:read",
+	"billing:write",
+	"browser:read",
+	"browser:write",
+	"cfone:read",
+	"cfone:write",
+	"cloudchamber:write",
+	"connectivity:admin",
+	"connectivity:bind",
+	"connectivity:read",
+	"constellation:write",
+	"containers:write",
+	"d1:write",
+	"dex:read",
+	"dex:write",
+	"dns_analytics:read",
+	"dns_records:edit",
+	"dns_records:read",
+	"dns_settings:read",
+	"email_routing:read",
+	"email_routing:write",
+	"email_sending:read",
+	"email_sending:write",
+	"firstpartytags:write",
+	"images:read",
+	"images:write",
+	"lb:edit",
+	"lb:read",
+	"logpush:read",
+	"logpush:write",
+	"mcp_portals:read",
+	"mcp_portals:write",
+	"notebook-examples:read",
+	"notebook-managed:read",
+	"notification:read",
+	"notification:write",
+	"oauth_account_ssl_and_certificates_write",
+	"offline",
+	"openid",
+	"pages:read",
+	"pages:write",
+	"pipelines:read",
+	"pipelines:setup",
+	"pipelines:write",
+	"query_cache:write",
+	"queues:write",
+	"r2_catalog:write",
+	"radar:read",
+	"rag:read",
+	"rag:write",
+	"registrar:read",
+	"registrar:write",
+	"secrets_store:read",
+	"secrets_store:write",
+	"sso-connector:read",
+	"sso-connector:write",
+	"ssl_certs:write",
+	"teams:pii",
+	"teams:read",
+	"teams:secure_location",
+	"teams:write",
+	"url_scanner:read",
+	"url_scanner:write",
+	"user:read",
+	"vectorize:write",
+	"workers:read",
+	"workers:write",
+	"workers_builds:read",
+	"workers_builds:write",
+	"workers_deployments:read",
+	"workers_kv:write",
+	"workers_observability:read",
+	"workers_observability:write",
+	"workers_observability_telemetry:write",
+	"workers_routes:write",
+	"workers_scripts:write",
+	"workers_tail:read",
+	"zone:read",
+	"account-analytics.read",
+	"account-ssl-and-certificates.write",
+	"ssl-and-certificates.read",
+	"ssl-and-certificates.write",
+	"registrar-domains.read",
+	"registrar-domains.admin",
+	"logs.read",
+	"logs.write",
+	"websearch.run",
+	"snippets.read",
+	"snippets.write",
+	"access-acct.read",
+	"access-acct.revoke",
+	"access-acct.write",
+	"access-app.read",
+	"access-app.revoke",
+	"access-app.write",
+	"access-audit-log.read",
+	"access-certificate.read",
+	"access-certificate.write",
+	"access-custom-page.read",
+	"access-custom-page.write",
+	"access-device-posture.read",
+	"access-device-posture.write",
+	"access-group.read",
+	"access-group.write",
+	"access-idp.read",
+	"access-idp.write",
+	"access-key.read",
+	"access-key.write",
+	"access-org.read",
+	"access-org.revoke",
+	"access-org.write",
+	"access-policy-test.read",
+	"access-policy-test.write",
+	"access-policy.read",
+	"access-policy.write",
+	"access-population.read",
+	"access-population.write",
+	"access-saml-certificate.read",
+	"access-saml-certificate.write",
+	"access-scim-log.read",
+	"access-seats.write",
+	"access-service-token.read",
+	"access-service-token.write",
+	"access-ssh-auditing.read",
+	"access-ssh-auditing.write",
+	"access-tag.read",
+	"access-tag.write",
+	"access-users.read",
+	"access-users.write",
+	"access.read",
+	"access.revoke",
+	"access.write",
+	"account-api-gateway.read",
+	"account-api-gateway.write",
+	"account-custom-asset.read",
+	"account-custom-asset.write",
+	"account-custom-error-rules.read",
+	"account-custom-error-rules.write",
+	"account-custom-pages.read",
+	"account-custom-pages.write",
+	"account-disable-esc.read",
+	"account-disable-esc.write",
+	"account-dns-settings.read",
+	"account-dns-settings.write",
+	"account-firewall-access-rules.read",
+	"account-firewall-access-rules.write",
+	"account-logs.read",
+	"account-logs.write",
+	"account-rule-lists.read",
+	"account-rule-lists.write",
+	"account-rulesets.read",
+	"account-rulesets.write",
+	"account-security-center-insights.read",
+	"account-security-center-insights.write",
+	"account-settings.read",
+	"account-settings.write",
+	"account-ssl-and-certificates.read",
+	"account-waf.read",
+	"account-waf.write",
+	"account-waiting-rooms.read",
+	"address-maps.read",
+	"address-maps.write",
+	"agent-memory.write",
+	"agw.read",
+	"agw.run",
+	"agw.write",
+	"ai-search.index",
+	"ai-search.metadata_read",
+	"ai-search.read",
+	"ai-search.run",
+	"ai-search.write",
+	"ai.read",
+	"ai.write",
+	"aiaudit.read",
+	"aiaudit.write",
+	"aig.metadata_read",
+	"aig.read",
+	"aig.run",
+	"aig.write",
+	"analytics.read",
+	"api-gateway.read",
+	"api-gateway.write",
+	"apps.write",
+	"argotunnel.read",
+	"argotunnel.write",
+	"artifacts.read",
+	"artifacts.write",
+	"bot-management-feedback.read",
+	"bot-management-feedback.write",
+	"bot-management.read",
+	"bot-management.write",
+	"browser-rendering.read",
+	"browser-rendering.write",
+	"cache-settings.read",
+	"cache-settings.write",
+	"cache.purge",
+	"calls.read",
+	"calls.write",
+	"casb.read",
+	"casb.write",
+	"cf-agents.read",
+	"cf-agents.write",
+	"challenge-widgets.read",
+	"challenge-widgets.write",
+	"chinanetwork-steering.read",
+	"chinanetwork-steering.write",
+	"cloud-connector.read",
+	"cloud-connector.write",
+	"cloud-email-security.read",
+	"cloud-email-security.write",
+	"cloudchamber.read",
+	"cloudchamber.write",
+	"cloudforce-one.read",
+	"cloudforce-one.write",
+	"config-settings.read",
+	"config-settings.write",
+	"connectivity-directory.admin",
+	"connectivity-directory.bind",
+	"connectivity-directory.read",
+	"constellation.read",
+	"constellation.write",
+	"containers.read",
+	"containers.write",
+	"custom-errors.read",
+	"custom-errors.write",
+	"custom-pages.read",
+	"custom-pages.write",
+	"d1.metadata_read",
+	"d1.read",
+	"d1.write",
+	"ddos-botnet-feed.read",
+	"ddos-botnet-feed.write",
+	"ddos-protection.read",
+	"ddos-protection.write",
+	"dls.read",
+	"dls.write",
+	"dns-firewall.read",
+	"dns-firewall.write",
+	"dns-view.read",
+	"dns-view.write",
+	"dns.read",
+	"dns.write",
+	"domain-page-shield.read",
+	"domain-page.shield",
+	"dynamic-redirect.read",
+	"dynamic-redirect.write",
+	"email-routing-account-rule.read",
+	"email-routing-address.read",
+	"email-routing-address.write",
+	"email-routing-rule.read",
+	"email-routing-rule.write",
+	"email-routing-suppression.read",
+	"email-routing-suppression.write",
+	"email-security-dmarcreports.read",
+	"email-security-dmarcreports.write",
+	"email-sending.read",
+	"email-sending.write",
+	"fbm.admin",
+	"fbm.read",
+	"fbm.write",
+	"field-extractor.read",
+	"field-extractor.write",
+	"firewall-for-ai.read",
+	"firewall-for-ai.write",
+	"firewall-services.read",
+	"firewall-services.write",
+	"flagship.evaluate",
+	"flagship.read",
+	"flagship.write",
+	"fraud-detection-pii.read",
+	"fraud-detection.read",
+	"fraud-detection.write",
+	"fraud-events.write",
+	"fraud-feedback.read",
+	"fraud-feedback.write",
+	"healthcheck.read",
+	"healthcheck.write",
+	"http-applications.read",
+	"http-applications.write",
+	"http-ddos-managed-ruleset.read",
+	"http-ddos-managed-ruleset.write",
+	"images.metadata_read",
+	"images.read",
+	"images.write",
+	"integration.write",
+	"intel.read",
+	"intel.write",
+	"iot.read",
+	"iot.write",
+	"ip-prefix-bgp-on-demand.read",
+	"ip-prefix-bgp-on-demand.write",
+	"ip-prefix.read",
+	"ip-prefix.write",
+	"l4-ddos-managed-ruleset.read",
+	"l4-ddos-managed-ruleset.write",
+	"load-balancers-account.read",
+	"load-balancers-account.write",
+	"load-balancers.read",
+	"load-balancers.write",
+	"load-balancing-monitors-and-pools.read",
+	"load-balancing-monitors-and-pools.write",
+	"magic-firewall.read",
+	"magic-firewall.write",
+	"magic-transit.read",
+	"magic-transit.write",
+	"magic-wan.read",
+	"magic-wan.write",
+	"managed-headers.read",
+	"managed-headers.write",
+	"mass-url-redirects.read",
+	"mass-url-redirects.write",
+	"mcp-portals.read",
+	"mcp-portals.write",
+	"memberships.read",
+	"memberships.write",
+	"messaging.edit",
+	"messaging.metadata_read",
+	"messaging.read",
+	"moq.read",
+	"moq.write",
+	"notifications.read",
+	"notifications.write",
+	"origin.read",
+	"origin.write",
+	"page-rules.read",
+	"page-rules.write",
+	"page-shield.read",
+	"page.read",
+	"page.shield",
+	"page.write",
+	"pages.metadata_read",
+	"payments-gateway.read",
+	"payments-gateway.write",
+	"pcaps-api.read",
+	"pcaps-api.write",
+	"pipelines.read",
+	"pipelines.send",
+	"pipelines.write",
+	"precursor.read",
+	"precursor.write",
+	"pubsub.read",
+	"pubsub.write",
+	"query-cache.read",
+	"query-cache.write",
+	"queues.metadata_read",
+	"queues.read",
+	"queues.write",
+	"r2-catalog-sql.read",
+	"r2-catalog.read",
+	"r2-catalog.write",
+	"radar.read",
+	"rag.read",
+	"rag.run",
+	"rag.write",
+	"realtime.admin",
+	"realtime.read",
+	"realtime.write",
+	"registrar-sandbox-domains.admin",
+	"registrar-sandbox-domains.read",
+	"reports-application-security-report.read",
+	"request-tracer.read",
+	"resource-library.read",
+	"resource-library.write",
+	"resource-sharing.read",
+	"response-compression.read",
+	"response-compression.write",
+	"sanitize.read",
+	"sanitize.write",
+	"secrets-store.read",
+	"secrets-store.write",
+	"select-configuration.read",
+	"select-configuration.write",
+	"stream.metadata_read",
+	"stream.read",
+	"stream.write",
+	"tag.read",
+	"tag.write",
+	"teams-cds-compute-account.read",
+	"teams-cds-compute-account.write",
+	"teams-connector-cloudflared.monitoring",
+	"teams-connector-cloudflared.read",
+	"teams-connector-cloudflared.write",
+	"teams-connector-warp.read",
+	"teams-connector-warp.write",
+	"teams-connectors.read",
+	"teams-connectors.write",
+	"teams-dex.read",
+	"teams-dex.write",
+	"teams-networks.read",
+	"teams-networks.write",
+	"teams-pii.read",
+	"teams-resilience.read",
+	"teams-resilience.write",
+	"teams-secure.location",
+	"teams.read",
+	"teams.report",
+	"teams.write",
+	"transform-rules.read",
+	"transform-rules.write",
+	"trust-and-safety.read",
+	"trust-and-safety.write",
+	"url-scanner.read",
+	"url-scanner.write",
+	"user-details.read",
+	"user-details.write",
+	"vectorize.read",
+	"vectorize.write",
+	"waiting-rooms.read",
+	"waiting-rooms.write",
+	"web3-hostnames.read",
+	"web3-hostnames.write",
+	"websearch.metadata_read",
+	"websearch.read",
+	"websearch.write",
+	"workers-ci.read",
+	"workers-ci.write",
+	"workers-kv-storage.metadata_read",
+	"workers-kv-storage.read",
+	"workers-kv-storage.write",
+	"workers-observability-telemetry.write",
+	"workers-observability.read",
+	"workers-observability.write",
+	"workers-r2-bucket-item.read",
+	"workers-r2-bucket-item.write",
+	"workers-r2.metadata_read",
+	"workers-r2.read",
+	"workers-r2.write",
+	"workers-routes.read",
+	"workers-routes.write",
+	"workers-scripts.bind",
+	"workers-scripts.read",
+	"workers-scripts.write",
+	"workers-tail.read",
+	"workers_ai.metadata_read",
+	"zaraz.edit",
+	"zaraz.read",
+	"zaraz.write",
+	"zone-access.read",
+	"zone-access.revoke",
+	"zone-access.write",
+	"zone-custom-asset.read",
+	"zone-custom-asset.write",
+	"zone-disable-esc.read",
+	"zone-disable-esc.write",
+	"zone-dns-settings.read",
+	"zone-dns-settings.write",
+	"zone-security-center-insights.read",
+	"zone-security-center-insights.write",
+	"zone-settings.read",
+	"zone-settings.write",
+	"zone-transform-rules.read",
+	"zone-transform-rules.write",
+	"zone-versioning.read",
+	"zone-versioning.write",
+	"zone-waf.read",
+	"zone-waf.write",
+	"zone.read",
+	"zone.write"
+];
+var DefaultScopeKeys$1 = [...[
 	"openid",
 	"offline",
 	"user:read",
@@ -79235,13 +80163,12 @@ var CF_SCOPES = [
 	"workers_scripts:write",
 	"workers_tail:read",
 	"zone:read"
-];
-var DefaultScopeKeys$1 = [...CF_SCOPES];
+]];
 function setLoginScopeKeys$1(scopes) {
 	DefaultScopeKeys$1 = scopes;
 }
 __name$1(setLoginScopeKeys$1, "setLoginScopeKeys");
-var CF_SCOPE_SET = new Set(CF_SCOPES);
+var CF_SCOPE_SET = new Set(CF_REGISTERED_SCOPES);
 function validateScopeKeys$1(scopes) {
 	return scopes.every((scope) => CF_SCOPE_SET.has(scope));
 }
@@ -79270,12 +80197,13 @@ var CF_CLI = {
 		login: "cf auth login",
 		whoami: "cf auth whoami",
 		createProfile: "cf auth create",
-		deviceLogin: "cf auth login --device"
+		deviceLogin: "cf auth login"
 	},
 	keyringServiceName: CF_KEYRING_SERVICE_NAME,
 	clientId: getClientIdFromEnv$1,
 	consent: CF_CONSENT_PAGES,
 	redirectUri: CF_OAUTH_CALLBACK_URL,
+	useDeviceFlowByDefault: true,
 	allowGlobalAuthKey: false,
 	getConfigPath: getCfConfigPath,
 	getTemporaryAccountConfigPath: getCfTemporaryAccountConfigPath,
@@ -79330,7 +80258,6 @@ var DefaultScopes = {
 	"ai:write": "See and change Workers AI catalog and assets",
 	"ai-search:write": "See and change AI Search data",
 	"ai-search:run": "Run search queries on your AI Search instances",
-	"websearch.run": "Run search queries against Cloudflare Web Search",
 	"agent-memory:write": "See and change Agent Memory data such as keys and namespaces.",
 	"queues:write": "See and change Cloudflare Queues settings and data",
 	"pipelines:write": "See and change Cloudflare Pipelines configurations and data",
@@ -79557,7 +80484,7 @@ var require_command_exists = /* @__PURE__ */ __commonJS$2({ "../../node_modules/
 }) });
 
 //#endregion
-//#region ../deploy-helpers/dist/chunk-3G6JZQDH.mjs
+//#region ../deploy-helpers/dist/chunk-QBZBEHZB.mjs
 var import_undici$1 = require_undici();
 var import_command_exists = require_command_exists();
 function handleUnsafeCapnp(capnp) {
@@ -79634,7 +80561,6 @@ function createWorkerUploadForm(worker, bindings, options) {
 	const vectorize = extractBindingsOfType("vectorize", bindings);
 	const ai_search_namespaces = extractBindingsOfType("ai_search_namespace", bindings);
 	const ai_search = extractBindingsOfType("ai_search", bindings);
-	const websearch = extractBindingsOfType("websearch", bindings)[0];
 	const agent_memory = extractBindingsOfType("agent_memory", bindings);
 	const hyperdrive = extractBindingsOfType("hyperdrive", bindings);
 	const secrets_store_secrets = extractBindingsOfType("secrets_store_secret", bindings);
@@ -79810,10 +80736,6 @@ function createWorkerUploadForm(worker, bindings, options) {
 			instance_name
 		});
 	});
-	if (websearch !== void 0) metadataBindings.push({
-		name: websearch.binding,
-		type: "websearch"
-	});
 	agent_memory.forEach(({ binding, namespace }) => {
 		if (options?.dryRun) namespace ??= INHERIT_SYMBOL;
 		if (namespace === void 0) throw new UserError(`${binding} bindings must have a "namespace" field. Add a "namespace" field to the binding in your Worker configuration specifying the namespace to bind to.`, { telemetryMessage: false });
@@ -80117,7 +81039,7 @@ __name(createWorkerUploadForm, "createWorkerUploadForm");
 //#endregion
 //#region ../remote-bindings/dist/index.mjs
 var import_undici = require_undici();
-var version$2 = "0.0.23";
+var version$2 = "0.0.25";
 var NoDefaultValueProvided = class extends UserError {
 	constructor() {
 		super("This command cannot be run in a non-interactive context", { telemetryMessage: "remote bindings prompt default missing" });