@cloudflare/vite-plugin 1.54.9 → 1.54.10

package/dist/index.mjs

@@ -137,7 +137,7 @@ function createFatalError$1(message, isJson, options) {
 __name$6(createFatalError$1, "createFatalError");
 
 //#endregion
-//#region ../workers-utils/dist/chunk-T5JQYOMX.mjs
+//#region ../workers-utils/dist/chunk-JGKSDUFK.mjs
 function hasKnownExportType(entry) {
 	const type = entry?.type;
 	return type === "durable-object" || type === "worker";
@@ -173,6 +173,17 @@ function getDurableObjectContainerApps(containers) {
 	return Array.isArray(containers) ? containers.filter(isDurableObjectContainerApp) : [];
 }
 __name$6(getDurableObjectContainerApps, "getDurableObjectContainerApps");
+function getResolvedDurableObjectContainerApps(containers, exports$1) {
+	return getDurableObjectContainerApps(containers).map((container) => {
+		const className = resolveContainerClassName(container, exports$1);
+		if (typeof className !== "string" || className.length === 0) throw new UserError(`The container "${container.name}" is not linked to a Durable Object. Either set "containers.class_name", or reference this container from a Durable Object's \`exports\` entry via its "container" field.`, { telemetryMessage: "durable object container class unresolved" });
+		return {
+			...container,
+			class_name: className
+		};
+	});
+}
+__name$6(getResolvedDurableObjectContainerApps, "getResolvedDurableObjectContainerApps");
 function getContainerNameToClassNameMap(exports$1) {
 	const containerNameToClassName = /* @__PURE__ */ new Map();
 	for (const [className, entry] of Object.entries(getDurableObjectExports(exports$1))) if ("container" in entry && typeof entry.container === "string" && !containerNameToClassName.has(entry.container)) containerNameToClassName.set(entry.container, className);
@@ -227,7 +238,7 @@ function getDurableObjectClassNameToUseSQLiteMap(migrations, exports$1) {
 __name$6(getDurableObjectClassNameToUseSQLiteMap, "getDurableObjectClassNameToUseSQLiteMap");
 function validateDurableObjectContainerApplications(config$2, containers = getDurableObjectContainerApps(config$2.containers)) {
 	const allDOs = getDurableObjectClassNameToUseSQLiteMap(config$2.migrations, config$2.exports);
-	for (const container of containers) {
+	for (const container of getResolvedDurableObjectContainerApps(containers, config$2.exports)) {
 		const maybeBoundDO = config$2.durable_objects.bindings.find((durableObject) => durableObject.class_name === container.class_name);
 		const useSQLite = allDOs.get(container.class_name);
 		if (useSQLite === void 0 && maybeBoundDO === void 0) throw new UserError(`The container class_name ${container.class_name} does not match any durable object class_name defined in your Wrangler config file. Note that the durable object must be defined in the same script as the container.`, { telemetryMessage: "no DO defined that matches container class_name" });
@@ -2195,7 +2206,12 @@ var APIError = class extends ParseError {
 		return this.#status;
 	}
 	isGatewayError() {
-		if (this.#status !== void 0) return [524].includes(this.#status);
+		if (this.#status !== void 0) return [
+			502,
+			503,
+			504,
+			524
+		].includes(this.#status);
 		return false;
 	}
 	isRetryable() {
@@ -2599,8 +2615,8 @@ function formatConfigSnippet(snippet, configPath, formatted = true) {
 __name$6(formatConfigSnippet, "formatConfigSnippet");
 
 //#endregion
-//#region ../workers-utils/dist/chunk-KBTXSRPS.mjs
-var DEFAULT_COMPAT_DATE = "2026-09-11";
+//#region ../workers-utils/dist/chunk-5H6GBNUC.mjs
+var DEFAULT_COMPAT_DATE = "2026-09-15";
 function assertNever(_value) {}
 __name$6(assertNever, "assertNever");
 function mapWorkerMetadataBindings(bindings) {
@@ -2772,9 +2788,6 @@ function mapWorkerMetadataBindings(bindings) {
 					instance_name: binding.instance_name
 				}];
 				break;
-			case "websearch":
-				configObj.websearch = { binding: binding.name };
-				break;
 			case "agent_memory":
 				configObj.agent_memory = [...configObj.agent_memory ?? [], {
 					binding: binding.name,
@@ -27263,7 +27276,6 @@ var defaultWranglerConfig = {
 	vectorize: [],
 	ai_search_namespaces: [],
 	ai_search: [],
-	websearch: void 0,
 	agent_memory: [],
 	hyperdrive: [],
 	workflows: [],
@@ -41341,7 +41353,6 @@ var friendlyBindingNames = {
 	vectorize: "Vectorize Index",
 	ai_search_namespaces: "AI Search Namespace",
 	ai_search: "AI Search Instance",
-	websearch: "Web Search",
 	agent_memory: "Agent Memory",
 	hyperdrive: "Hyperdrive Config",
 	r2_buckets: "R2 Bucket",
@@ -41394,7 +41405,6 @@ var bindingTypeFriendlyNames = {
 	vectorize: "Vectorize Index",
 	ai_search_namespace: "AI Search Namespace",
 	ai_search: "AI Search Instance",
-	websearch: "Web Search",
 	agent_memory: "Agent Memory",
 	hyperdrive: "Hyperdrive Config",
 	service: "Worker",
@@ -41897,7 +41907,6 @@ function normalizeAndValidateEnvironment(diagnostics, configPath, rawEnv, isDisp
 		vectorize: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "vectorize", validateBindingArray(envName, validateVectorizeBinding), []),
 		ai_search_namespaces: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "ai_search_namespaces", validateBindingArray(envName, validateAISearchNamespaceBinding), []),
 		ai_search: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "ai_search", validateBindingArray(envName, validateAISearchBinding), []),
-		websearch: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "websearch", validateNamedSimpleBinding(envName), void 0),
 		agent_memory: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "agent_memory", validateBindingArray(envName, validateAgentMemoryBinding), []),
 		hyperdrive: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "hyperdrive", validateBindingArray(envName, validateHyperdriveBinding), []),
 		services: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "services", validateBindingArray(envName, validateServiceBinding), []),
@@ -42437,7 +42446,6 @@ var validateUnsafeBinding = /* @__PURE__ */ __name$6((diagnostics, field, value)
 			"ai",
 			"ai_search_namespace",
 			"ai_search",
-			"websearch",
 			"agent_memory",
 			"kv_namespace",
 			"durable_object_namespace",
@@ -42583,7 +42591,18 @@ function validateDurableObjectContainerImages(diagnostics, field, images, compli
 				valid$2 = false;
 			}
 		}
-		const unsupportedFields = Object.keys(image).filter((property) => property !== "dockerfile" && property !== "image");
+		const isDockerfileBuild = hasDockerfile && !hasImage;
+		if (isDockerfileBuild) {
+			if (image.build_context !== void 0 && (typeof image.build_context !== "string" || image.build_context.length === 0)) {
+				diagnostics.errors.push(`"${imageField}.build_context" must be a non-empty string.`);
+				valid$2 = false;
+			}
+			if (image.build_vars !== void 0 && (typeof image.build_vars !== "object" || image.build_vars === null || Array.isArray(image.build_vars) || Object.values(image.build_vars).some((value) => typeof value !== "string"))) {
+				diagnostics.errors.push(`"${imageField}.build_vars" must be an object with string values.`);
+				valid$2 = false;
+			}
+		}
+		const unsupportedFields = Object.keys(image).filter((property) => property !== "dockerfile" && property !== "image" && !(isDockerfileBuild && (property === "build_context" || property === "build_vars")));
 		if (unsupportedFields.length > 0) {
 			diagnostics.errors.push(`Unexpected fields found in ${imageField} field: ${unsupportedFields.map((property) => `"${property}"`).join(", ")}`);
 			valid$2 = false;
@@ -42592,6 +42611,24 @@ function validateDurableObjectContainerImages(diagnostics, field, images, compli
 	return valid$2;
 }
 __name$6(validateDurableObjectContainerImages, "validateDurableObjectContainerImages");
+function validateDurableObjectContainerUnsafe(diagnostics, field, value) {
+	if (value === void 0) return;
+	if (typeof value !== "object" || value === null || Array.isArray(value)) {
+		diagnostics.errors.push(`"${field}" should be an object.`);
+		return;
+	}
+	const unsafe = value;
+	const configuration = unsafe.configuration;
+	if (Object.keys(unsafe).some((key) => key !== "configuration") || configuration !== void 0 && (typeof configuration !== "object" || configuration === null || Array.isArray(configuration) || Object.keys(configuration).some((key) => key !== "experimental_flags"))) {
+		diagnostics.errors.push(`Only "${field}.configuration.experimental_flags" is supported for Durable Object-managed Containers.`);
+		return;
+	}
+	if (configuration !== void 0) {
+		const flags = configuration.experimental_flags;
+		if (flags !== void 0 && (!Array.isArray(flags) || flags.some((flag) => typeof flag !== "string"))) diagnostics.errors.push(`"${field}.configuration.experimental_flags" should be an array of strings.`);
+	}
+}
+__name$6(validateDurableObjectContainerUnsafe, "validateDurableObjectContainerUnsafe");
 function validateContainerApp(envName, topLevelName, configPath, options = {}) {
 	const { generateDefaultName = true } = options;
 	return (diagnostics, field, value, config2) => {
@@ -42603,11 +42640,10 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
 		for (const containerAppOptional of value) {
 			const isDurableObjectManaged = containerAppOptional.scheduling_policy === "durable_object";
 			const hasValidDurableObjectClassName = typeof containerAppOptional.class_name === "string" && containerAppOptional.class_name.length > 0;
-			if (isDurableObjectManaged) {
-				if (!hasValidDurableObjectClassName) diagnostics.errors.push(`"containers.class_name" must be a non-empty string when "containers.scheduling_policy" is "durable_object".`);
-			} else validateOptionalProperty(diagnostics, field, "class_name", containerAppOptional.class_name, "string");
+			validateOptionalProperty(diagnostics, field, "class_name", containerAppOptional.class_name, "string");
+			if (isDurableObjectManaged && containerAppOptional.class_name === "") diagnostics.errors.push(`"containers.class_name" must be a non-empty string when specified for a Durable Object-managed Container.`);
 			validateOptionalProperty(diagnostics, field, "name", containerAppOptional.name, "string");
-			if (generateDefaultName && !containerAppOptional.name && (!isDurableObjectManaged || hasValidDurableObjectClassName)) if (containerAppOptional.class_name === void 0) diagnostics.errors.push(`"containers.name" is required when "containers.class_name" is not defined, because there is no class name to derive a default name from. Either name this container and reference it from a Durable Object's \`exports\` entry, or set "containers.class_name".`);
+			if (generateDefaultName && !containerAppOptional.name && (!isDurableObjectManaged || containerAppOptional.class_name === void 0 || hasValidDurableObjectClassName)) if (containerAppOptional.class_name === void 0) diagnostics.errors.push(`"containers.name" is required when "containers.class_name" is not defined, because there is no class name to derive a default name from. Either name this container and reference it from a Durable Object's \`exports\` entry, or set "containers.class_name".`);
 			else if (!topLevelName) diagnostics.errors.push(`Must have either a top level "name" and "containers.class_name" field defined, or have field "containers.name" defined.`);
 			else {
 				let name = `${topLevelName}-${containerAppOptional.class_name}`;
@@ -42616,13 +42652,18 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
 			}
 			if (isDurableObjectManaged) {
 				validateDurableObjectContainerImages(diagnostics, `${field}.images`, containerAppOptional.images, options.complianceConfig);
+				validateContainerObservability(diagnostics, `${field}.observability`, containerAppOptional.observability, config2);
+				if (containerAppOptional.observability?.target_instance_count !== void 0 || containerAppOptional.observability?.target_instance_percentage !== void 0) diagnostics.errors.push(`"${field}.observability" only supports enabling or disabling logs for Durable Object-managed Containers; instance targeting is not supported.`);
+				validateDurableObjectContainerUnsafe(diagnostics, `${field}.unsafe`, containerAppOptional.unsafe);
 				const unsupportedFields = Object.keys(containerAppOptional).filter((key) => ![
 					"name",
 					"class_name",
 					"scheduling_policy",
-					"images"
+					"images",
+					"observability",
+					"unsafe"
 				].includes(key));
-				if (unsupportedFields.length > 0) diagnostics.errors.push(`Unsupported fields for Durable Object-managed Containers in ${field}: ${unsupportedFields.map((key) => `"${key}"`).join(",")}. Only "name", "class_name", "scheduling_policy", and "images" are supported.`);
+				if (unsupportedFields.length > 0) diagnostics.errors.push(`Unsupported fields for Durable Object-managed Containers in ${field}: ${unsupportedFields.map((key) => `"${key}"`).join(",")}. Only "name", "class_name", "scheduling_policy", "images", "observability", and restricted "unsafe" settings are supported.`);
 				continue;
 			}
 			if (!containerAppOptional.configuration?.image && !containerAppOptional.image) diagnostics.errors.push(`"containers.image" field must be defined for each container app. This should be the path to your Dockerfile or an image URI pointing to the Cloudflare registry.`);
@@ -43693,6 +43734,8 @@ var validatePreviewsConfig = /* @__PURE__ */ __name$6((envName, configPath) => (
 		"d1_databases",
 		"r2_buckets",
 		"vectorize",
+		"ai_search_namespaces",
+		"ai_search",
 		"hyperdrive",
 		"services",
 		"analytics_engine_datasets",
@@ -43731,6 +43774,8 @@ var validatePreviewsConfig = /* @__PURE__ */ __name$6((envName, configPath) => (
 	isValid = validateBindingArray(envName, validateD1Binding)(diagnostics, `${field}.d1_databases`, previews.d1_databases, void 0) && isValid;
 	isValid = validateBindingArray(envName, validateR2Binding)(diagnostics, `${field}.r2_buckets`, previews.r2_buckets, void 0) && isValid;
 	isValid = validateBindingArray(envName, validateVectorizeBinding)(diagnostics, `${field}.vectorize`, previews.vectorize, void 0) && isValid;
+	isValid = validateBindingArray(envName, validateAISearchNamespaceBinding)(diagnostics, `${field}.ai_search_namespaces`, previews.ai_search_namespaces, void 0) && isValid;
+	isValid = validateBindingArray(envName, validateAISearchBinding)(diagnostics, `${field}.ai_search`, previews.ai_search, void 0) && isValid;
 	isValid = validateBindingArray(envName, validateHyperdriveBinding)(diagnostics, `${field}.hyperdrive`, previews.hyperdrive, void 0) && isValid;
 	isValid = validateBindingArray(envName, validateServiceBinding)(diagnostics, `${field}.services`, previews.services, void 0) && isValid;
 	isValid = validateBindingArray(envName, validateAnalyticsEngineBinding)(diagnostics, `${field}.analytics_engine_datasets`, previews.analytics_engine_datasets, void 0) && isValid;
@@ -44291,7 +44336,6 @@ var BINDING_LOCAL_SUPPORT = {
 	flagship: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
 	vpc_service: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
 	vpc_network: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
-	websearch: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
 	agent_memory: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator"
 };
 function getBindingLocalSupport(type) {
@@ -44649,14 +44693,6 @@ function convertConfigToBindings(config2, options) {
 					...x
 				};
 				break;
-			case "websearch": {
-				const { binding,...x } = info$1;
-				output[binding] = {
-					type: "websearch",
-					...x
-				};
-				break;
-			}
 			case "agent_memory":
 				for (const { binding,...x } of info$1) output[binding] = {
 					type: "agent_memory",
@@ -44802,7 +44838,6 @@ function printBindings(bindings, options) {
 	const vectorize = extractBindingsOfType("vectorize", bindings);
 	const ai_search_namespaces = extractBindingsOfType("ai_search_namespace", bindings);
 	const ai_search = extractBindingsOfType("ai_search", bindings);
-	const websearch = extractBindingsOfType("websearch", bindings);
 	const agent_memory = extractBindingsOfType("agent_memory", bindings);
 	const hyperdrive = extractBindingsOfType("hyperdrive", bindings);
 	const r2_buckets = extractBindingsOfType("r2_bucket", bindings);
@@ -44942,12 +44977,6 @@ function printBindings(bindings, options) {
 		value: instance_name ? String(instance_name) : void 0,
 		mode: getMode({ isSimulatedLocally: false })
 	})));
-	if (websearch.length > 0) output.push(...websearch.map(({ binding }) => ({
-		name: binding,
-		type: getBindingTypeFriendlyName("websearch"),
-		value: void 0,
-		mode: getMode({ isSimulatedLocally: false })
-	})));
 	if (agent_memory.length > 0) output.push(...agent_memory.map(({ binding, namespace }) => ({
 		name: binding,
 		type: getBindingTypeFriendlyName("agent_memory"),
@@ -45236,7 +45265,7 @@ ${allTailConsumers.map(({ service, streaming }) => {
 		let containersTitle = "The following containers are available:";
 		if (context.name && isMultiWorker) containersTitle = `The following containers are available from ${source_default.blue(context.name)}:`;
 		log$2(`${containersTitle}
-${containers.map((container) => container.scheduling_policy === "durable_object" ? `- ${container.class_name} (durable_object)` : `- ${container.name} (${container.image})`).join("\n")}`);
+${containers.map((container) => container.scheduling_policy === "durable_object" ? `- ${container.class_name ?? container.name} (durable_object)` : `- ${container.name} (${container.image})`).join("\n")}`);
 		log$2("");
 	}
 	if (context.unsafeMetadata) {
@@ -55442,10 +55471,6 @@ const KnownBindingSchema = discriminatedUnion("type", [
 		const value = input;
 		return value.tunnelId !== void 0 && value.networkId !== void 0 ? `"vpc-network" bindings must specify exactly one of "tunnelId" or "networkId", not both` : `"vpc-network" bindings must specify either "tunnelId" or "networkId"`;
 	} }),
-	strictObject({
-		type: literal$1("web-search"),
-		dev: RemoteBindingDevSchema.optional()
-	}),
 	WorkerBindingSchema,
 	strictObject({ type: literal$1("worker-loader") })
 ]);
@@ -55484,8 +55509,7 @@ const SINGLETON_BINDING_TYPES = new Set([
 	"images",
 	"media",
 	"stream",
-	"version-metadata",
-	"web-search"
+	"version-metadata"
 ]);
 const listFormatter = new Intl.ListFormat("en-US");
 function validateSingletonBindings(env$3, ctx) {
@@ -56424,12 +56448,6 @@ function convertBindingsAndAssets(config$2, result) {
 					remote: binding.dev?.remote
 				}));
 				break;
-			case "web-search":
-				result.websearch = omitUndefined({
-					binding: name,
-					remote: binding.dev?.remote
-				});
-				break;
 			case "worker":
 				services.push(omitUndefined({
 					binding: name,
@@ -57144,9 +57162,25 @@ const MAX_ROUTES_RULE_LENGTH = 100;
 
 //#endregion
 //#region ../workers-shared/utils/configuration/parseStaticRouting.ts
+const MAX_REPORTED_DUPLICATED_RULES = 5;
 function parseStaticRouting(input) {
 	if (input.length === 0) throw new Error("No `run_worker_first` rules were provided; must provide at least 1 rule.");
-	if (input.length > MAX_ROUTES_RULES) throw new Error(`Too many \`run_worker_first\` rules were provided; ${input.length} rules provided exceeds max of ${MAX_ROUTES_RULES}.`);
+	if (input.length > MAX_ROUTES_RULES) {
+		const seenRules = /* @__PURE__ */ new Set();
+		const duplicatedRules = /* @__PURE__ */ new Set();
+		for (const rule of input) {
+			if (seenRules.has(rule)) duplicatedRules.add(rule);
+			seenRules.add(rule);
+		}
+		if (duplicatedRules.size > 0) {
+			const duplicateEntryCount = input.length - seenRules.size;
+			const reportedDuplicatedRules = [...seenRules].filter((rule) => duplicatedRules.has(rule)).slice(0, MAX_REPORTED_DUPLICATED_RULES);
+			const unreportedDuplicatedRuleCount = duplicatedRules.size - reportedDuplicatedRules.length;
+			const unreportedDuplicatedRulesMessage = unreportedDuplicatedRuleCount > 0 ? `\n...and ${unreportedDuplicatedRuleCount} more duplicated ${unreportedDuplicatedRuleCount === 1 ? "rule" : "rules"}.` : "";
+			throw new Error(`Too many \`run_worker_first\` rules were provided; ${input.length} rules provided (${seenRules.size} distinct, ${duplicateEntryCount} duplicate ${duplicateEntryCount === 1 ? "entry" : "entries"}) exceeds max of ${MAX_ROUTES_RULES}. Note: duplicate entries count towards the route limit. Ensure that no duplicate rules are present in your \`run_worker_first\` configuration.\n\nThe duplicated rules found are:\n${reportedDuplicatedRules.map((rule) => `- ${JSON.stringify(rule)}`).join("\n")}${unreportedDuplicatedRulesMessage}`);
+		}
+		throw new Error(`Too many \`run_worker_first\` rules were provided; ${input.length} rules provided exceeds max of ${MAX_ROUTES_RULES}.`);
+	}
 	const rawAssetWorkerRules = [];
 	const assetWorkerRules = [];
 	const userWorkerRules = [];
@@ -66349,8 +66383,9 @@ function maybeAddAgentHint(server, mode) {
 * Prints the Local Explorer API URL and useful routes to stdout so that
 * headless AI agents can discover and call them programmatically.
 *
-* Keep the message in sync with the wrangler copy in
-* packages/wrangler/src/dev/start-dev.ts.
+* Keep the message in sync with:
+* - packages/wrangler/src/dev/start-dev.ts (printLocalExplorerAgentHint)
+* - packages/create-cloudflare/src/agents-md.ts (Local Explorer section)
 *
 * @param server - The Vite dev or preview server (must have `resolvedUrls` populated)
 * @param mode - Whether this is a "dev" or "preview" session
@@ -66372,6 +66407,7 @@ function printLocalExplorerAgentHint(server, mode) {
 		`  GET ${explorerApiUrl}/workflows - Workflows`,
 		`  POST ${explorerApiUrl}/local/observability/query - run a read-only SQL query (SELECT/WITH only) over captured request traces and console logs. Tables: spans, logs (read attributes via json(attributes)). Example:`,
 		`    curl -X POST ${explorerApiUrl}/local/observability/query -H 'Content-Type: application/json' -d '{"sql":"SELECT service, name, outcome, duration_ms FROM spans WHERE parent_id IS NULL LIMIT 20"}'`,
+		`  POST ${explorerApiUrl}/local/observability/clear - clear all captured traces and logs`,
 		`If the routes above don't cover what you need, fetch the full OpenAPI schema (large - use only as a last resort):`,
 		`  GET ${explorerApiUrl} - OpenAPI schema`,
 		""
@@ -74597,19 +74633,25 @@ async function pushBuiltContainerImage(builtImage, versionId, pathToDocker, acco
 }
 __name$2(pushBuiltContainerImage, "pushBuiltContainerImage");
 async function cleanupBuiltImages(builtImages, pathToDocker) {
+	const aliasesByTag = /* @__PURE__ */ new Map();
 	for (const builtImage of builtImages) {
-		if (builtImage.localTagCleaned) continue;
-		try {
-			logger$1.debug(`Untagging built image: ${builtImage.localTag}.`);
+		const aliases = aliasesByTag.get(builtImage.localTag);
+		if (aliases) aliases.push(builtImage);
+		else aliasesByTag.set(builtImage.localTag, [builtImage]);
+	}
+	for (const [localTag, aliases] of aliasesByTag) {
+		if (!aliases.some((alias) => alias.localTagCleaned)) try {
+			logger$1.debug(`Untagging built image: ${localTag}.`);
 			await runDockerCmd(pathToDocker, [
 				"image",
 				"rm",
-				builtImage.localTag
+				localTag
 			]);
-			builtImage.localTagCleaned = true;
 		} catch (error$2) {
-			if (error$2 instanceof Error) logger$1.debug(`Cleaning up built image ${builtImage.localTag} failed with error: ${error$2.message}`);
+			if (error$2 instanceof Error) logger$1.debug(`Cleaning up built image ${localTag} failed with error: ${error$2.message}`);
+			continue;
 		}
+		for (const alias of aliases) alias.localTagCleaned = true;
 	}
 }
 __name$2(cleanupBuiltImages, "cleanupBuiltImages");
@@ -78402,7 +78444,7 @@ function scrubEncryptedCredentials(options) {
 __name$1(scrubEncryptedCredentials, "scrubEncryptedCredentials");
 
 //#endregion
-//#region ../workers-auth/dist/chunk-YCVYA5LL.mjs
+//#region ../workers-auth/dist/chunk-T63LVVAX.mjs
 function createPreferences(getConfigPath) {
 	function getUserPreferencesPath() {
 		return path__default.resolve(getConfigPath(), "preferences.json");
@@ -79181,7 +79223,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
 		return oauthFlow.requireApiToken();
 	}
 	__name$1(requireApiToken$1, "requireApiToken");
-	function withDefaultScopes(complianceConfig, props) {
+	function withLoginDefaults(complianceConfig, props) {
 		return {
 			complianceConfig,
 			scopes: props?.scopes ?? descriptor.getDefaultScopeKeys(),
@@ -79189,12 +79231,12 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
 			callbackHost: props?.callbackHost,
 			callbackPort: props?.callbackPort,
 			profile: props?.profile,
-			device: props?.device
+			device: props?.device ?? descriptor.useDeviceFlowByDefault ?? false
 		};
 	}
-	__name$1(withDefaultScopes, "withDefaultScopes");
+	__name$1(withLoginDefaults, "withLoginDefaults");
 	async function login(complianceConfig, props) {
-		return oauthFlow.login(withDefaultScopes(complianceConfig, props));
+		return oauthFlow.login(withLoginDefaults(complianceConfig, props));
 	}
 	__name$1(login, "login");
 	async function logout(profile) {
@@ -79203,7 +79245,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
 	__name$1(logout, "logout");
 	async function loginOrRefreshIfRequired(complianceConfig, props) {
 		if (oauthFlow.getActiveTemporaryAccount()) return { loggedIn: true };
-		return oauthFlow.loginOrRefreshIfRequired(withDefaultScopes(complianceConfig, props));
+		return oauthFlow.loginOrRefreshIfRequired(withLoginDefaults(complianceConfig, props));
 	}
 	__name$1(loginOrRefreshIfRequired, "loginOrRefreshIfRequired");
 	async function getOAuthTokenFromLocalState() {
@@ -79236,10 +79278,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
 		return configCache.getConfigCache(getAccountCacheFileName()).account;
 	}
 	__name$1(getAccountFromCache, "getAccountFromCache");
-	async function fetchAccountsPaged(complianceConfig, resource) {
-		const result = await loginOrRefreshIfRequired(complianceConfig);
-		if (!result.loggedIn) throw new UserError(`Not logged in. ${NOT_LOGGED_IN_ERROR_BODIES[result.reason]}${NOT_LOGGED_IN_WHOAMI_TIP}`, { telemetryMessage: "cfetch auth login required" });
-		const credentials = requireApiToken$1();
+	async function fetchAccountsPaged(complianceConfig, resource, credentials) {
 		const results = [];
 		let getMoreResults = true;
 		let page = 1;
@@ -79259,7 +79298,10 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
 	__name$1(fetchAccountsPaged, "fetchAccountsPaged");
 	async function fetchAllAccounts(complianceConfig, options = {}) {
 		const { throwOnEmpty = true } = options;
-		const [accountsRes, membershipsRes] = await Promise.allSettled([fetchAccountsPaged(complianceConfig, `/accounts`), fetchAccountsPaged(complianceConfig, `/memberships`)]);
+		const loginResult = await loginOrRefreshIfRequired(complianceConfig);
+		if (!loginResult.loggedIn) throw new UserError(`Not logged in. ${NOT_LOGGED_IN_ERROR_BODIES[loginResult.reason]}${NOT_LOGGED_IN_WHOAMI_TIP}`, { telemetryMessage: "cfetch auth login required" });
+		const credentials = requireApiToken$1();
+		const [accountsRes, membershipsRes] = await Promise.allSettled([fetchAccountsPaged(complianceConfig, `/accounts`, credentials), fetchAccountsPaged(complianceConfig, `/memberships`, credentials)]);
 		if (accountsRes.status === "rejected") throw accountsRes.reason;
 		if (membershipsRes.status === "rejected") if (isMembershipsInaccessible(membershipsRes.reason)) {
 			if (accountsRes.status === "fulfilled" && accountsRes.value.length > 0) return accountsRes.value;
@@ -79556,7 +79598,483 @@ function getCfConfigPath() {
 	});
 }
 __name$1(getCfConfigPath, "getCfConfigPath");
-var CF_SCOPES = [
+var CF_REGISTERED_SCOPES = [
+	"access:read",
+	"access:write",
+	"account:read",
+	"agw:read",
+	"agw:run",
+	"agw:write",
+	"ai:read",
+	"ai:write",
+	"ai-search:read",
+	"ai-search:run",
+	"ai-search:write",
+	"aiaudit:read",
+	"aiaudit:write",
+	"aig:read",
+	"aig:write",
+	"auditlogs:read",
+	"billing:read",
+	"billing:write",
+	"browser:read",
+	"browser:write",
+	"cfone:read",
+	"cfone:write",
+	"cloudchamber:write",
+	"connectivity:admin",
+	"connectivity:bind",
+	"connectivity:read",
+	"constellation:write",
+	"containers:write",
+	"d1:write",
+	"dex:read",
+	"dex:write",
+	"dns_analytics:read",
+	"dns_records:edit",
+	"dns_records:read",
+	"dns_settings:read",
+	"email_routing:read",
+	"email_routing:write",
+	"email_sending:read",
+	"email_sending:write",
+	"firstpartytags:write",
+	"images:read",
+	"images:write",
+	"lb:edit",
+	"lb:read",
+	"logpush:read",
+	"logpush:write",
+	"mcp_portals:read",
+	"mcp_portals:write",
+	"notebook-examples:read",
+	"notebook-managed:read",
+	"notification:read",
+	"notification:write",
+	"oauth_account_ssl_and_certificates_write",
+	"offline",
+	"openid",
+	"pages:read",
+	"pages:write",
+	"pipelines:read",
+	"pipelines:setup",
+	"pipelines:write",
+	"query_cache:write",
+	"queues:write",
+	"r2_catalog:write",
+	"radar:read",
+	"rag:read",
+	"rag:write",
+	"registrar:read",
+	"registrar:write",
+	"secrets_store:read",
+	"secrets_store:write",
+	"sso-connector:read",
+	"sso-connector:write",
+	"ssl_certs:write",
+	"teams:pii",
+	"teams:read",
+	"teams:secure_location",
+	"teams:write",
+	"url_scanner:read",
+	"url_scanner:write",
+	"user:read",
+	"vectorize:write",
+	"workers:read",
+	"workers:write",
+	"workers_builds:read",
+	"workers_builds:write",
+	"workers_deployments:read",
+	"workers_kv:write",
+	"workers_observability:read",
+	"workers_observability:write",
+	"workers_observability_telemetry:write",
+	"workers_routes:write",
+	"workers_scripts:write",
+	"workers_tail:read",
+	"zone:read",
+	"account-analytics.read",
+	"account-ssl-and-certificates.write",
+	"ssl-and-certificates.read",
+	"ssl-and-certificates.write",
+	"registrar-domains.read",
+	"registrar-domains.admin",
+	"logs.read",
+	"logs.write",
+	"websearch.run",
+	"snippets.read",
+	"snippets.write",
+	"access-acct.read",
+	"access-acct.revoke",
+	"access-acct.write",
+	"access-app.read",
+	"access-app.revoke",
+	"access-app.write",
+	"access-audit-log.read",
+	"access-certificate.read",
+	"access-certificate.write",
+	"access-custom-page.read",
+	"access-custom-page.write",
+	"access-device-posture.read",
+	"access-device-posture.write",
+	"access-group.read",
+	"access-group.write",
+	"access-idp.read",
+	"access-idp.write",
+	"access-key.read",
+	"access-key.write",
+	"access-org.read",
+	"access-org.revoke",
+	"access-org.write",
+	"access-policy-test.read",
+	"access-policy-test.write",
+	"access-policy.read",
+	"access-policy.write",
+	"access-population.read",
+	"access-population.write",
+	"access-saml-certificate.read",
+	"access-saml-certificate.write",
+	"access-scim-log.read",
+	"access-seats.write",
+	"access-service-token.read",
+	"access-service-token.write",
+	"access-ssh-auditing.read",
+	"access-ssh-auditing.write",
+	"access-tag.read",
+	"access-tag.write",
+	"access-users.read",
+	"access-users.write",
+	"access.read",
+	"access.revoke",
+	"access.write",
+	"account-api-gateway.read",
+	"account-api-gateway.write",
+	"account-custom-asset.read",
+	"account-custom-asset.write",
+	"account-custom-error-rules.read",
+	"account-custom-error-rules.write",
+	"account-custom-pages.read",
+	"account-custom-pages.write",
+	"account-disable-esc.read",
+	"account-disable-esc.write",
+	"account-dns-settings.read",
+	"account-dns-settings.write",
+	"account-firewall-access-rules.read",
+	"account-firewall-access-rules.write",
+	"account-logs.read",
+	"account-logs.write",
+	"account-rule-lists.read",
+	"account-rule-lists.write",
+	"account-rulesets.read",
+	"account-rulesets.write",
+	"account-security-center-insights.read",
+	"account-security-center-insights.write",
+	"account-settings.read",
+	"account-settings.write",
+	"account-ssl-and-certificates.read",
+	"account-waf.read",
+	"account-waf.write",
+	"account-waiting-rooms.read",
+	"address-maps.read",
+	"address-maps.write",
+	"agent-memory.write",
+	"agw.read",
+	"agw.run",
+	"agw.write",
+	"ai-search.index",
+	"ai-search.metadata_read",
+	"ai-search.read",
+	"ai-search.run",
+	"ai-search.write",
+	"ai.read",
+	"ai.write",
+	"aiaudit.read",
+	"aiaudit.write",
+	"aig.metadata_read",
+	"aig.read",
+	"aig.run",
+	"aig.write",
+	"analytics.read",
+	"api-gateway.read",
+	"api-gateway.write",
+	"apps.write",
+	"argotunnel.read",
+	"argotunnel.write",
+	"artifacts.read",
+	"artifacts.write",
+	"bot-management-feedback.read",
+	"bot-management-feedback.write",
+	"bot-management.read",
+	"bot-management.write",
+	"browser-rendering.read",
+	"browser-rendering.write",
+	"cache-settings.read",
+	"cache-settings.write",
+	"cache.purge",
+	"calls.read",
+	"calls.write",
+	"casb.read",
+	"casb.write",
+	"cf-agents.read",
+	"cf-agents.write",
+	"challenge-widgets.read",
+	"challenge-widgets.write",
+	"chinanetwork-steering.read",
+	"chinanetwork-steering.write",
+	"cloud-connector.read",
+	"cloud-connector.write",
+	"cloud-email-security.read",
+	"cloud-email-security.write",
+	"cloudchamber.read",
+	"cloudchamber.write",
+	"cloudforce-one.read",
+	"cloudforce-one.write",
+	"config-settings.read",
+	"config-settings.write",
+	"connectivity-directory.admin",
+	"connectivity-directory.bind",
+	"connectivity-directory.read",
+	"constellation.read",
+	"constellation.write",
+	"containers.read",
+	"containers.write",
+	"custom-errors.read",
+	"custom-errors.write",
+	"custom-pages.read",
+	"custom-pages.write",
+	"d1.metadata_read",
+	"d1.read",
+	"d1.write",
+	"ddos-botnet-feed.read",
+	"ddos-botnet-feed.write",
+	"ddos-protection.read",
+	"ddos-protection.write",
+	"dls.read",
+	"dls.write",
+	"dns-firewall.read",
+	"dns-firewall.write",
+	"dns-view.read",
+	"dns-view.write",
+	"dns.read",
+	"dns.write",
+	"domain-page-shield.read",
+	"domain-page.shield",
+	"dynamic-redirect.read",
+	"dynamic-redirect.write",
+	"email-routing-account-rule.read",
+	"email-routing-address.read",
+	"email-routing-address.write",
+	"email-routing-rule.read",
+	"email-routing-rule.write",
+	"email-routing-suppression.read",
+	"email-routing-suppression.write",
+	"email-security-dmarcreports.read",
+	"email-security-dmarcreports.write",
+	"email-sending.read",
+	"email-sending.write",
+	"fbm.admin",
+	"fbm.read",
+	"fbm.write",
+	"field-extractor.read",
+	"field-extractor.write",
+	"firewall-for-ai.read",
+	"firewall-for-ai.write",
+	"firewall-services.read",
+	"firewall-services.write",
+	"flagship.evaluate",
+	"flagship.read",
+	"flagship.write",
+	"fraud-detection-pii.read",
+	"fraud-detection.read",
+	"fraud-detection.write",
+	"fraud-events.write",
+	"fraud-feedback.read",
+	"fraud-feedback.write",
+	"healthcheck.read",
+	"healthcheck.write",
+	"http-applications.read",
+	"http-applications.write",
+	"http-ddos-managed-ruleset.read",
+	"http-ddos-managed-ruleset.write",
+	"images.metadata_read",
+	"images.read",
+	"images.write",
+	"integration.write",
+	"intel.read",
+	"intel.write",
+	"iot.read",
+	"iot.write",
+	"ip-prefix-bgp-on-demand.read",
+	"ip-prefix-bgp-on-demand.write",
+	"ip-prefix.read",
+	"ip-prefix.write",
+	"l4-ddos-managed-ruleset.read",
+	"l4-ddos-managed-ruleset.write",
+	"load-balancers-account.read",
+	"load-balancers-account.write",
+	"load-balancers.read",
+	"load-balancers.write",
+	"load-balancing-monitors-and-pools.read",
+	"load-balancing-monitors-and-pools.write",
+	"magic-firewall.read",
+	"magic-firewall.write",
+	"magic-transit.read",
+	"magic-transit.write",
+	"magic-wan.read",
+	"magic-wan.write",
+	"managed-headers.read",
+	"managed-headers.write",
+	"mass-url-redirects.read",
+	"mass-url-redirects.write",
+	"mcp-portals.read",
+	"mcp-portals.write",
+	"memberships.read",
+	"memberships.write",
+	"messaging.edit",
+	"messaging.metadata_read",
+	"messaging.read",
+	"moq.read",
+	"moq.write",
+	"notifications.read",
+	"notifications.write",
+	"origin.read",
+	"origin.write",
+	"page-rules.read",
+	"page-rules.write",
+	"page-shield.read",
+	"page.read",
+	"page.shield",
+	"page.write",
+	"pages.metadata_read",
+	"payments-gateway.read",
+	"payments-gateway.write",
+	"pcaps-api.read",
+	"pcaps-api.write",
+	"pipelines.read",
+	"pipelines.send",
+	"pipelines.write",
+	"precursor.read",
+	"precursor.write",
+	"pubsub.read",
+	"pubsub.write",
+	"query-cache.read",
+	"query-cache.write",
+	"queues.metadata_read",
+	"queues.read",
+	"queues.write",
+	"r2-catalog-sql.read",
+	"r2-catalog.read",
+	"r2-catalog.write",
+	"radar.read",
+	"rag.read",
+	"rag.run",
+	"rag.write",
+	"realtime.admin",
+	"realtime.read",
+	"realtime.write",
+	"registrar-sandbox-domains.admin",
+	"registrar-sandbox-domains.read",
+	"reports-application-security-report.read",
+	"request-tracer.read",
+	"resource-library.read",
+	"resource-library.write",
+	"resource-sharing.read",
+	"response-compression.read",
+	"response-compression.write",
+	"sanitize.read",
+	"sanitize.write",
+	"secrets-store.read",
+	"secrets-store.write",
+	"select-configuration.read",
+	"select-configuration.write",
+	"stream.metadata_read",
+	"stream.read",
+	"stream.write",
+	"tag.read",
+	"tag.write",
+	"teams-cds-compute-account.read",
+	"teams-cds-compute-account.write",
+	"teams-connector-cloudflared.monitoring",
+	"teams-connector-cloudflared.read",
+	"teams-connector-cloudflared.write",
+	"teams-connector-warp.read",
+	"teams-connector-warp.write",
+	"teams-connectors.read",
+	"teams-connectors.write",
+	"teams-dex.read",
+	"teams-dex.write",
+	"teams-networks.read",
+	"teams-networks.write",
+	"teams-pii.read",
+	"teams-resilience.read",
+	"teams-resilience.write",
+	"teams-secure.location",
+	"teams.read",
+	"teams.report",
+	"teams.write",
+	"transform-rules.read",
+	"transform-rules.write",
+	"trust-and-safety.read",
+	"trust-and-safety.write",
+	"url-scanner.read",
+	"url-scanner.write",
+	"user-details.read",
+	"user-details.write",
+	"vectorize.read",
+	"vectorize.write",
+	"waiting-rooms.read",
+	"waiting-rooms.write",
+	"web3-hostnames.read",
+	"web3-hostnames.write",
+	"websearch.metadata_read",
+	"websearch.read",
+	"websearch.write",
+	"workers-ci.read",
+	"workers-ci.write",
+	"workers-kv-storage.metadata_read",
+	"workers-kv-storage.read",
+	"workers-kv-storage.write",
+	"workers-observability-telemetry.write",
+	"workers-observability.read",
+	"workers-observability.write",
+	"workers-r2-bucket-item.read",
+	"workers-r2-bucket-item.write",
+	"workers-r2.metadata_read",
+	"workers-r2.read",
+	"workers-r2.write",
+	"workers-routes.read",
+	"workers-routes.write",
+	"workers-scripts.bind",
+	"workers-scripts.read",
+	"workers-scripts.write",
+	"workers-tail.read",
+	"workers_ai.metadata_read",
+	"zaraz.edit",
+	"zaraz.read",
+	"zaraz.write",
+	"zone-access.read",
+	"zone-access.revoke",
+	"zone-access.write",
+	"zone-custom-asset.read",
+	"zone-custom-asset.write",
+	"zone-disable-esc.read",
+	"zone-disable-esc.write",
+	"zone-dns-settings.read",
+	"zone-dns-settings.write",
+	"zone-security-center-insights.read",
+	"zone-security-center-insights.write",
+	"zone-settings.read",
+	"zone-settings.write",
+	"zone-transform-rules.read",
+	"zone-transform-rules.write",
+	"zone-versioning.read",
+	"zone-versioning.write",
+	"zone-waf.read",
+	"zone-waf.write",
+	"zone.read",
+	"zone.write"
+];
+var DefaultScopeKeys$1 = [...[
 	"openid",
 	"offline",
 	"user:read",
@@ -79645,13 +80163,12 @@ var CF_SCOPES = [
 	"workers_scripts:write",
 	"workers_tail:read",
 	"zone:read"
-];
-var DefaultScopeKeys$1 = [...CF_SCOPES];
+]];
 function setLoginScopeKeys$1(scopes) {
 	DefaultScopeKeys$1 = scopes;
 }
 __name$1(setLoginScopeKeys$1, "setLoginScopeKeys");
-var CF_SCOPE_SET = new Set(CF_SCOPES);
+var CF_SCOPE_SET = new Set(CF_REGISTERED_SCOPES);
 function validateScopeKeys$1(scopes) {
 	return scopes.every((scope) => CF_SCOPE_SET.has(scope));
 }
@@ -79680,12 +80197,13 @@ var CF_CLI = {
 		login: "cf auth login",
 		whoami: "cf auth whoami",
 		createProfile: "cf auth create",
-		deviceLogin: "cf auth login --device"
+		deviceLogin: "cf auth login"
 	},
 	keyringServiceName: CF_KEYRING_SERVICE_NAME,
 	clientId: getClientIdFromEnv$1,
 	consent: CF_CONSENT_PAGES,
 	redirectUri: CF_OAUTH_CALLBACK_URL,
+	useDeviceFlowByDefault: true,
 	allowGlobalAuthKey: false,
 	getConfigPath: getCfConfigPath,
 	getTemporaryAccountConfigPath: getCfTemporaryAccountConfigPath,
@@ -79740,7 +80258,6 @@ var DefaultScopes = {
 	"ai:write": "See and change Workers AI catalog and assets",
 	"ai-search:write": "See and change AI Search data",
 	"ai-search:run": "Run search queries on your AI Search instances",
-	"websearch.run": "Run search queries against Cloudflare Web Search",
 	"agent-memory:write": "See and change Agent Memory data such as keys and namespaces.",
 	"queues:write": "See and change Cloudflare Queues settings and data",
 	"pipelines:write": "See and change Cloudflare Pipelines configurations and data",
@@ -79967,7 +80484,7 @@ var require_command_exists = /* @__PURE__ */ __commonJS$2({ "../../node_modules/
 }) });
 
 //#endregion
-//#region ../deploy-helpers/dist/chunk-3G6JZQDH.mjs
+//#region ../deploy-helpers/dist/chunk-QBZBEHZB.mjs
 var import_undici$1 = require_undici();
 var import_command_exists = require_command_exists();
 function handleUnsafeCapnp(capnp) {
@@ -80044,7 +80561,6 @@ function createWorkerUploadForm(worker, bindings, options) {
 	const vectorize = extractBindingsOfType("vectorize", bindings);
 	const ai_search_namespaces = extractBindingsOfType("ai_search_namespace", bindings);
 	const ai_search = extractBindingsOfType("ai_search", bindings);
-	const websearch = extractBindingsOfType("websearch", bindings)[0];
 	const agent_memory = extractBindingsOfType("agent_memory", bindings);
 	const hyperdrive = extractBindingsOfType("hyperdrive", bindings);
 	const secrets_store_secrets = extractBindingsOfType("secrets_store_secret", bindings);
@@ -80220,10 +80736,6 @@ function createWorkerUploadForm(worker, bindings, options) {
 			instance_name
 		});
 	});
-	if (websearch !== void 0) metadataBindings.push({
-		name: websearch.binding,
-		type: "websearch"
-	});
 	agent_memory.forEach(({ binding, namespace }) => {
 		if (options?.dryRun) namespace ??= INHERIT_SYMBOL;
 		if (namespace === void 0) throw new UserError(`${binding} bindings must have a "namespace" field. Add a "namespace" field to the binding in your Worker configuration specifying the namespace to bind to.`, { telemetryMessage: false });
@@ -80527,7 +81039,7 @@ __name(createWorkerUploadForm, "createWorkerUploadForm");
 //#endregion
 //#region ../remote-bindings/dist/index.mjs
 var import_undici = require_undici();
-var version$2 = "0.0.24";
+var version$2 = "0.0.25";
 var NoDefaultValueProvided = class extends UserError {
 	constructor() {
 		super("This command cannot be run in a non-interactive context", { telemetryMessage: "remote bindings prompt default missing" });