@cloudflare/vite-plugin 1.62.4 → 1.63.0

package/dist/index.d.mts

@@ -53,6 +53,8 @@ type PersistState = boolean | {
 type TunnelConfig = {
   autoStart?: boolean;
   name?: string;
+  /** Email addresses or domain patterns allowed to authenticate to a Quick Tunnel. */
+  allowedMail?: string[];
 };
 interface BaseWorkerConfig {
   viteEnvironment?: {

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/utils.ts","../src/workers-configs.ts","../src/plugin-config.ts","../src/index.ts"],"sourcesContent":[],"mappings":";;;;;;;ACsDK,KDEO,OCFP,CAAA,CAAA,CAAA,GDEoB,OCFpB,CDE4B,CCF5B,EAAA,SAA8B,CAAA;;;;AAE9B,KAzBO,YAAA,GAAe,IAyBH,CAzBQ,eA0B7B,EAAA,MA1BoD,mBA2BpD,CAAA;KAJE,8BAAA,UAAwC;ACN7C,KDQK,mBAAA,GACF,iCCTqB,GDUrB,8BCVqB;AACxB,KDWK,iCAAA,GCXmB,MDYjB,8BCZiB,CAAA,gBAAA,CAAA;AAGtB,KDWG,8BAAA,GACJ,8BCVyB,CAAA,aAAA,CAAA,CAAA,MAAA,CAAA;AAAA;AASd;;AAeE,cDTD,0BCSC,EAAA;EAbsB;;AAAgB;EAqB1C,SAAA,cAAA,EAAA;IAED,SAAA,KAAA,EAAA;MACE,SAAA,eAAA,EAAA,eAAA;MAHmC,SAAA,QAAA,EAAA,2DAAA;IAAgB,CAAA;IAMzD,SAAA,MAAA,EAAA;MAIK,SAAA,eAA0B,EAAA,QAAQ;MAIlC,SAAA,QAAA,EAAA,oDAAoC;IAKzC,CAAA;IAIK,SAAA,MAAA,EAAA;MA2BA,SAAY,eAIH,EAAA,cAAA;MAkDd,SAAA,QAAA,EAAA,yDAAgC;IAKhC,CAAA;EACM,CAAA;EAAR;;;;EAMwB,SAAA,WAAA,EAAA,SAAA,CAAA,UAAA,EAAA,OAAA,EAAA,yBAAA,EAAA,WAAA,EAAA,qBAAA,EAAA,OAAA,EAAA,MAAA,EAAA,UAAA,CAAA;EAEX;;;EAEC,SAAA,uBAAa,EAAA,SAAA,CAAA,QAAA,CAAA;CACV;;;KA/JR,YAAA;;ADjBZ,CAAA;AAAgC,KCkBpB,YAAA,GDlBoB;EAAuB,SAAA,CAAA,EAAA,OAAA;EAA5B,IAAA,CAAA,EAAA,MAAA;CAAI;AAqB7B,UCEQ,gBAAA,CDAL;EAEA,eAAA,CAAA,EAAA;IAIA,IAAA,CAAA,EAAA,MAAA;IAGA,iBAAA,CAAA,EAAA,MAAA,EAAA;EAMQ,CAAA;;;;ACrBb;AACA;AAGE;AAEwB,KASrB,OAAA,GAAO,OAAA,GAAA,CAAA,GAAA,GAAA,OAAA,CAAA;AAAA,UAEF,iBAAA,SAA0B,gBAAR,CAAA;EAElB,UAAA,CAAA,EAAA,MAAA;EAWI,MAAA,CAAA,EAXJ,sBAWI,CAAA,IAAA,CAAA;EAbsB;;AAAgB;AAgBQ;;;;;AAKE;AAQhC;EAMpB,UAAA,CAAA,EAtBI,OAsBJ;AAAoD;AAOhC,UA1BpB,yBAAA,SAAkC,gBA4Bb,CAAA;EA2BrB,UAAA,EAAA,MAAY;EAsDjB,OAAA,CAAA,EA3GM,OA2GN;AAAgC;UAxG3B,2BAAA,SAAoC,gBA8GnC,CAAA;EAAR,UAAA,CAAA,EAAA,MAAA;EAES,MAAA,EA9GH,sBA8GG,CAAA,KAAA,CAAA;EACG,OAAA,CAAA,EA9GJ,OA8GI;;KA3GV,qBAAA,GACF,yBA6GwB,GA5GxB,2BA4GwB;UA1GjB,yBAAA,SAAkC,gBA4G5B,CAAA;EAAR,UAAA,EAAA,MAAA;;AAER,UA1GU,2BAAA,SAAoC,gBA0GhB,CAAA;EACV,UAAA,CAAA,EAAA,MAAA;EACJ,MAAA,EA1GP,sBA0GO,CAAA,KAAA,CAAA;;KAvGX,qBAAA,GACF,yBA0Ga,GAzGb,2BAyGa;UAvGN,qBAAA,CAiG4B;EAAiB;EAStC,KAAA,CAAA,EAAA;IACM;;;;IAEM,QAAA,CAAA,EAAA,OAAA;IAAR;;;;;;EC7KL,CAAA;EAwBA;;;;;;UDmEN,YAAA;;;;oBAIS;;;;;;;;wBAQI;;KA0ClB,yBAAA,GAA4B,KAChC;KAII,yDACF,QAAQ,2BAEC,uCACG,yBAED;qBACa;OAEnB,QAAQ;UAEC,YAAA,SAAqB;qBAClB;iBACJ;;;qBAGI;iBACJ;;UAGC,wBAAA,SAAiC;gBACnC,QAAQ;QAChB,QAAQ;sBACM,QAAQ;;;;;;;AFlK7B;;;;ACzBA;;;;AAA+B,iBEcf,gCAAA,CFde,QAuBwC,CAvBxC,EAAA;EAuB1B,WAAA,CAAA,EAAA,MAAA;AAAkE,CAAA,CAAA,EAElE;EAIA,IAAA,EEbO,UFaP;EAGA,MAAA,EAAA,SAAA,GAAA,UAAA;AAML,CAAA;;ACrBA;AACA;AAGE;AAEwB;AASd;;AAeE,iBCTE,UAAA,CDSF,YAAA,CAAA,ECT2B,YDS3B,CAAA,ECT+C,IAAA,CAAK,MDSpD,EAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/utils.ts","../src/workers-configs.ts","../src/plugin-config.ts","../src/index.ts"],"sourcesContent":[],"mappings":";;;;;;;ACsDK,KDEO,OCFP,CAAA,CAAA,CAAA,GDEoB,OCFpB,CDE4B,CCF5B,EAAA,SAA8B,CAAA;;;;AAE9B,KAzBO,YAAA,GAAe,IAyBH,CAzBQ,eA0B7B,EAAA,MA1BoD,mBA2BpD,CAAA;KAJE,8BAAA,UAAwC;ACN7C,KDQK,mBAAA,GACF,iCCTqB,GDUrB,8BCVqB;AACxB,KDWK,iCAAA,GCXmB,MDYjB,8BCZiB,CAAA,gBAAA,CAAA;AAKtB,KDSG,8BAAA,GACJ,8BCRyB,CAAA,aAAA,CAAA,CAAA,MAAA,CAAA;AAAA;AASd;;AAeE,cDXD,0BCWC,EAAA;EAbsB;;AAAgB;EAqB1C,SAAA,cAAA,EAAA;IAED,SAAA,KAAA,EAAA;MACE,SAAA,eAAA,EAAA,eAAA;MAHmC,SAAA,QAAA,EAAA,2DAAA;IAAgB,CAAA;IAMzD,SAAA,MAAA,EAAA;MAIK,SAAA,eAA0B,EAAA,QAAQ;MAIlC,SAAA,QAAA,EAAA,oDAAoC;IAKzC,CAAA;IAIK,SAAA,MAAA,EAAA;MA2BA,SAAY,eAIH,EAAA,cAAA;MAkDd,SAAA,QAAA,EAAA,yDAAgC;IAKhC,CAAA;EACM,CAAA;EAAR;;;;EAMwB,SAAA,WAAA,EAAA,SAAA,CAAA,UAAA,EAAA,OAAA,EAAA,yBAAA,EAAA,WAAA,EAAA,qBAAA,EAAA,OAAA,EAAA,MAAA,EAAA,UAAA,CAAA;EAEX;;;EAEC,SAAA,uBAAa,EAAA,SAAA,CAAA,QAAA,CAAA;CACV;;;KAjKR,YAAA;;ADjBZ,CAAA;AAAgC,KCkBpB,YAAA,GDlBoB;EAAuB,SAAA,CAAA,EAAA,OAAA;EAA5B,IAAA,CAAA,EAAA,MAAA;EAAI;EAuB1B,WAAA,CAAA,EAAA,MAAA,EAAA;AAAkE,CAAA;AAItC,UCFvB,gBAAA,CDIL;EAGA,eAAA,CAAA,EAAA;IAMQ,IAAA,CAAA,EAAA,MAAA;;;;ACrBb;AACA;AAKE;AAEwB;AASd;KAAP,OAAA,GAIK,OAAA,GAAA,CAAA,GAAA,GAAA,OAAA,CAAA;UAFA,iBAAA,SAA0B,gBAatB,CAAA;EAbsB,UAAA,CAAA,EAAA,MAAA;EAAgB,MAAA,CAAA,EAE1C,sBAF0C,CAAA,IAAA,CAAA;EAgB1C;AAAkD;;;;;AAKE;AAQhC;AAE8B;AAIE;EASpD,UAAA,CAAA,EA/BI,OA+BJ;AAsB6B;AAiBK,UAnElC,yBAAA,SAAkC,gBA8G3C,CAAA;EAII,UAAA,EAAA,MAAA;EACM,OAAA,CAAA,EAjHA,OAiHA;;UA9GD,2BAAA,SAAoC,gBAgHlC,CAAA;EACG,UAAA,CAAA,EAAA,MAAA;EAED,MAAA,EAjHL,sBAiHK,CAAA,KAAA,CAAA;EACa,OAAA,CAAA,EAjHhB,OAiHgB;;KA9GtB,qBAAA,GACF,yBA+GK,GA9GL,2BA8GK;UA5GE,yBAAA,SAAkC,gBA4G7B,CAAA;EAEE,UAAA,EAAA,MAAa;;UA1GpB,2BAAA,SAAoC,gBA4G9B,CAAA;EAGI,UAAA,CAAA,EAAA,MAAA;EACJ,MAAA,EA9GP,sBA8GO,CAAA,KAAA,CAAA;;KA3GX,qBAAA,GACF,yBAoGoD,GAnGpD,2BAmGoD;AASvD,UA1GU,qBAAA,CA0GgC;EACnB;EAAR,KAAA,CAAA,EAAA;IACA;;;;IAFmC,QAAA,CAAA,EAAA,OAAA;IAAY;;;;AC5K9D;IAwBgB,cAAU,CAAA,EAAA,OAAe;;;;;;;;UDqE/B,YAAA;;;;oBAIS;;;;;;;;wBAQI;;KA0ClB,yBAAA,GAA4B,KAChC;KAII,yDACF,QAAQ,2BAEC,uCACG,yBAED;qBACa;OAEnB,QAAQ;UAEC,YAAA,SAAqB;qBAClB;iBACJ;;;qBAGI;iBACJ;;UAGC,wBAAA,SAAiC;gBACnC,QAAQ;QAChB,QAAQ;sBACM,QAAQ;;;;;;;AFpK7B;;;;ACzBA;;;;AAA+B,iBEcf,gCAAA,CFde,QAuBwC,CAvBxC,EAAA;EAuB1B,WAAA,CAAA,EAAA,MAAA;AAAkE,CAAA,CAAA,EAElE;EAIA,IAAA,EEbO,UFaP;EAGA,MAAA,EAAA,SAAA,GAAA,UAAA;AAML,CAAA;;ACrBA;AACA;AAKE;AAEwB;AASd;;AAeE,iBCXE,UAAA,CDWF,YAAA,CAAA,ECX2B,YDW3B,CAAA,ECX+C,IAAA,CAAK,MDWpD,EAAA"}

package/dist/index.mjs

@@ -8,7 +8,7 @@ import path__default, { basename, dirname, isAbsolute, join, relative, resolve }
 import assert from "node:assert";
 import os, { arch, release } from "node:os";
 import * as util from "node:util";
-import { TextEncoder as TextEncoder$1, format, inspect, promisify, stripVTControlCharacters, styleText } from "node:util";
+import { TextEncoder as TextEncoder$1, format, inspect, isDeepStrictEqual, promisify, stripVTControlCharacters, styleText } from "node:util";
 import process$1, { exit, stdin, stdout } from "node:process";
 import tty from "node:tty";
 import url, { URL as URL$1, URLSearchParams as URLSearchParams$1, fileURLToPath, pathToFileURL } from "node:url";
@@ -13890,7 +13890,7 @@ function createFatalError$1(message, isJson, options) {
 __name$6(createFatalError$1, "createFatalError");
 
 //#endregion
-//#region ../workers-utils/dist/chunk-AUSY7DKT.mjs
+//#region ../workers-utils/dist/chunk-TAK63GWY.mjs
 createRequire(import.meta.url || (typeof __filename === "string" ? __filename : "/"));
 function hasKnownExportType(entry) {
 	const type = entry?.type;
@@ -16349,10 +16349,18 @@ function findRedirectedWranglerConfig(cwd, userConfigPath) {
 				But the redirected configuration path it points to, "${path__default.relative(".", redirectedConfigPath)}", does not exist.
 			`, { telemetryMessage: false });
 	if (userConfigPath) {
-		if (path__default.join(path__default.dirname(userConfigPath), PATH_TO_DEPLOY_CONFIG) !== deployConfigPath) throw new UserError(esm_default$1`
+		const expectedDeployConfigPath = path__default.join(path__default.dirname(userConfigPath), PATH_TO_DEPLOY_CONFIG);
+		if (expectedDeployConfigPath !== deployConfigPath) throw new UserError(esm_default$1`
 					Found both a user configuration file at "${path__default.relative(".", userConfigPath)}"
 					and a deploy configuration file at "${path__default.relative(".", deployConfigPath)}".
 					But these do not share the same base path so it is not clear which should be used.
+
+					A deploy configuration file is generated by a build tool to redirect Wrangler to the configuration it generated.
+					It is only applied when it sits alongside the user configuration file, which here would be "${path__default.relative(".", expectedDeployConfigPath)}".
+
+					Please either delete "${path__default.relative(".", deployConfigPath)}" if it is left over from a previous build,
+					or try running this command from the directory containing the configuration you want to use.
+					See https://developers.cloudflare.com/workers/wrangler/configuration/#generated-wrangler-configuration
 				`, { telemetryMessage: false });
 	}
 	return {
@@ -43167,6 +43175,7 @@ var validateAssetsConfig = /* @__PURE__ */ __name$6((diagnostics, field, value)
 		"404-page",
 		"none"
 	]) && isValid;
+	isValid = validateOptionalProperty(diagnostics, field, "base_path", value.base_path, "string") && isValid;
 	if (value.run_worker_first !== void 0) if (typeof value.run_worker_first === "boolean") isValid = validateOptionalProperty(diagnostics, field, "run_worker_first", value.run_worker_first, "boolean") && isValid;
 	else if (Array.isArray(value.run_worker_first)) isValid = validateOptionalTypedArray(diagnostics, "assets.run_worker_first", value.run_worker_first, "string") && isValid;
 	else {
@@ -43178,6 +43187,7 @@ var validateAssetsConfig = /* @__PURE__ */ __name$6((diagnostics, field, value)
 		"binding",
 		"html_handling",
 		"not_found_handling",
+		"base_path",
 		"run_worker_first"
 	]) && isValid;
 	return isValid;
@@ -43602,7 +43612,11 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
 				}
 				validateOptionalTypedArray(diagnostics, `${field}.constraints.tiers`, constraints.tiers, "number");
 				validateOptionalProperty(diagnostics, `${field}.constraints`, "jurisdiction", constraints.jurisdiction, "string");
-				if (constraints.jurisdiction && !["eu", "fedramp"].includes(constraints.jurisdiction)) diagnostics.errors.push(`${field}.constraints.jurisdiction must be one of: "eu", "fedramp"`);
+				if (constraints.jurisdiction && ![
+					"eu",
+					"fedramp",
+					"us"
+				].includes(constraints.jurisdiction)) diagnostics.errors.push(`${field}.constraints.jurisdiction must be one of: "eu", "fedramp", "us"`);
 				if (validateOptionalTypedArray(diagnostics, `${field}.constraints.regions`, constraints.regions, "string") && constraints.regions && Array.isArray(constraints.regions)) {
 					const validRegions = [
 						"ENAM",
@@ -45648,7 +45662,7 @@ function mapWorkerMetadataBindings(bindings) {
 	}, {});
 }
 __name$6(mapWorkerMetadataBindings, "mapWorkerMetadataBindings");
-var DEFAULT_COMPAT_DATE = "2026-10-01";
+var DEFAULT_COMPAT_DATE = "2026-10-06";
 function constructWranglerConfig(config$2) {
 	const mappedBindings = mapWorkerMetadataBindings(config$2.bindings);
 	const durableObjectClassNames = config$2.bindings.filter((binding) => binding.type === "durable_object_namespace" && binding.script_name === config$2.name).map((durableObject) => durableObject.class_name);
@@ -47582,6 +47596,7 @@ function startTunnel(options) {
 	const reminderIntervalMs = options.reminderIntervalMs ?? DEFAULT_TUNNEL_REMINDER_INTERVAL_MS;
 	const defaultExpiryMs = options.expiryMs ?? DEFAULT_TUNNEL_EXPIRY_MS;
 	const isNamedTunnel = options.token !== void 0;
+	if (isNamedTunnel && (options.allowedMail?.length ?? 0) > 0) throw new UserError("The `allowedMail` option is only supported for Quick Tunnels.", { telemetryMessage: "tunnel allowed mail named tunnel conflict" });
 	const timeFormatter = new Intl.DateTimeFormat(void 0, { timeStyle: "short" });
 	const readyPromise = spawnCloudflared(isNamedTunnel ? [
 		"tunnel",
@@ -47591,7 +47606,8 @@ function startTunnel(options) {
 		"tunnel",
 		"--no-autoupdate",
 		"--url",
-		options.origin.href
+		options.origin.href,
+		...(options.allowedMail ?? []).flatMap((allowedMail) => ["--allowed-mail", allowedMail])
 	], {
 		stdio: "pipe",
 		env: options.token ? { TUNNEL_TOKEN: options.token } : void 0,
@@ -51357,7 +51373,7 @@ var qr_default = encodeQR;
 //#endregion
 //#region src/plugins/tunnel.ts
 function createPublicExposureWarning(mode, name, shortcutPressed) {
-	const intro = name === void 0 ? import_picocolors$5.default.dim("Once connected, this tunnel will be ") + "publicly accessible" + import_picocolors$5.default.dim(". Anyone who can reach it can:") : import_picocolors$5.default.dim("Once connected, this tunnel may be reachable from the Internet. Anyone who can reach it can:");
+	const intro = name === void 0 ? import_picocolors$5.default.dim("Once connected, this tunnel may be ") + "publicly accessible" + import_picocolors$5.default.dim(". Anyone who can reach it can:") : import_picocolors$5.default.dim("Once connected, this tunnel may be reachable from the Internet. Anyone who can reach it can:");
 	const concerns = [
 		"Call ungated endpoints",
 		"Trigger logic that uses remote bindings",
@@ -51381,19 +51397,23 @@ function createPublicExposureWarning(mode, name, shortcutPressed) {
 }
 const QUICK_TUNNEL_SSE_WARNING = "Quick tunnels do not support Server-Sent Events (SSE). Use a named Cloudflare Tunnel if you need SSE over a public URL.";
 const QUICK_TUNNEL_ALLOWED_HOST = ".trycloudflare.com";
+function normalizeAllowedMail(allowedMail) {
+	return allowedMail?.length ? allowedMail : void 0;
+}
 var TunnelManager = class {
 	#logger;
 	#origin;
 	#publicUrls;
 	#requestedTunnel;
+	#requestedAllowedMail;
 	#tunnel;
 	#abortController;
 	#hasWarnedAboutSse = false;
 	constructor(logger$2) {
 		this.#logger = logger$2;
 	}
-	isStarted(origin, name) {
-		return this.#origin === origin && this.#requestedTunnel === name;
+	isStarted(origin, name, allowedMail) {
+		return this.#origin === origin && this.#requestedTunnel === name && isDeepStrictEqual(this.#requestedAllowedMail, normalizeAllowedMail(allowedMail));
 	}
 	isOpen() {
 		if (!this.#tunnel) return this.#origin !== void 0;
@@ -51405,12 +51425,14 @@ var TunnelManager = class {
 		return isOpen;
 	}
 	async startTunnel(options) {
+		const allowedMail = normalizeAllowedMail(options.allowedMail);
 		try {
 			if (this.#tunnel) this.dispose();
 			const abortController = new AbortController();
 			this.#abortController = abortController;
 			this.#origin = options.origin;
 			this.#requestedTunnel = options.name;
+			this.#requestedAllowedMail = allowedMail ? [...allowedMail] : void 0;
 			this.#logger.info(import_picocolors$5.default.dim("\n  ➜  Starting tunnel (usually takes a few seconds)...\n"));
 			this.#logger.warn(createPublicExposureWarning(options.mode, options.name, options.shortcutPressed ?? false));
 			const namedTunnel = options.name !== void 0 ? await wrangler.unstable_resolveNamedTunnel(options.name, new URL(options.origin), {
@@ -51433,6 +51455,7 @@ Add \`${QUICK_TUNNEL_ALLOWED_HOST}\` to \`preview.allowedHosts\` in your Vite co
 			const tunnel = startTunnel({
 				origin: new URL(options.origin),
 				token: namedTunnel?.token,
+				allowedMail,
 				extendHint: "Press a + enter to extend by 1 hour.",
 				logger: {
 					log: (message) => this.#logger.info(message),
@@ -51485,6 +51508,7 @@ Add \`${QUICK_TUNNEL_ALLOWED_HOST}\` to \`preview.allowedHosts\` in your Vite co
 		this.#origin = void 0;
 		this.#publicUrls = void 0;
 		this.#requestedTunnel = void 0;
+		this.#requestedAllowedMail = void 0;
 		this.#tunnel = void 0;
 		this.#hasWarnedAboutSse = false;
 		debuglog("Disposing tunnel...");
@@ -51581,7 +51605,7 @@ async function resolvePreviewTunnelOrigin(server) {
 async function setupDevTunnel(server, ctx, manager, shortcutPressed) {
 	const origin = await resolveDevTunnelOrigin(server);
 	const tunnel = ctx.resolvedPluginConfig.tunnel;
-	if (manager.isStarted(origin, tunnel.name)) {
+	if (manager.isStarted(origin, tunnel.name, tunnel.allowedMail)) {
 		debuglog("Tunnel is already started on", origin);
 		return;
 	}
@@ -51590,6 +51614,7 @@ async function setupDevTunnel(server, ctx, manager, shortcutPressed) {
 		origin,
 		shortcutPressed,
 		name: tunnel.name,
+		allowedMail: tunnel.allowedMail,
 		accountId: ctx.entryWorkerConfig?.account_id,
 		complianceRegion: ctx.entryWorkerConfig?.compliance_region,
 		allowedHosts: true
@@ -51617,7 +51642,7 @@ async function setupPreviewTunnel(server, ctx, manager, shortcutPressed) {
 	if (originalPort !== 0 && resolvedPort !== originalPort) server.config.logger.info(import_picocolors$5.default.dim(`Port ${originalPort} is in use, using ${resolvedPort} instead for preview tunnel sharing.\n`));
 	const tunnel = ctx.resolvedPluginConfig.tunnel;
 	const origin = resolvedOrigin.toString();
-	if (manager.isStarted(origin, tunnel.name)) {
+	if (manager.isStarted(origin, tunnel.name, tunnel.allowedMail)) {
 		debuglog("Tunnel is already started on", origin);
 		return;
 	}
@@ -51626,6 +51651,7 @@ async function setupPreviewTunnel(server, ctx, manager, shortcutPressed) {
 		origin,
 		shortcutPressed,
 		name: tunnel.name,
+		allowedMail: tunnel.allowedMail,
 		allowedHosts: preview?.allowedHosts,
 		accountId: ctx.allWorkerConfigs[0]?.account_id,
 		complianceRegion: ctx.allWorkerConfigs[0]?.compliance_region
@@ -56623,6 +56649,7 @@ const AssetsSchema = strictObject({
 		"404-page",
 		"none"
 	]).optional(),
+	basePath: string().optional(),
 	runWorkerFirst: union([array(string()), boolean()]).optional()
 });
 const BrowserBindingSchema = strictObject({
@@ -56979,7 +57006,11 @@ const StandardContainerBaseSchema = BaseContainerSchema.extend({
 			"OC",
 			"AFR"
 		])).optional(),
-		jurisdiction: _enum(["eu", "fedramp"]).optional()
+		jurisdiction: _enum([
+			"eu",
+			"fedramp",
+			"us"
+		]).optional()
 	}).optional(),
 	rollout: strictObject({
 		kind: _enum([
@@ -57869,6 +57900,7 @@ function convertBindingsAndAssets(config$2, result) {
 		if (assetsBindingName !== void 0) assets.binding = assetsBindingName;
 		if (config$2.assets?.htmlHandling !== void 0) assets.html_handling = config$2.assets.htmlHandling;
 		if (config$2.assets?.notFoundHandling !== void 0) assets.not_found_handling = config$2.assets.notFoundHandling;
+		if (config$2.assets?.basePath !== void 0) assets.base_path = config$2.assets.basePath;
 		if (config$2.assets?.runWorkerFirst !== void 0) assets.run_worker_first = config$2.assets.runWorkerFirst;
 		result.assets = assets;
 	}
@@ -65978,13 +66010,17 @@ function resolveWorkerConfig(options) {
 	});
 }
 async function resolvePluginConfig(pluginConfig, userConfig, viteEnv) {
+	if (typeof pluginConfig.tunnel === "object") {
+		if (pluginConfig.tunnel.name !== void 0 && (pluginConfig.tunnel.allowedMail?.length ?? 0) > 0) throw new Error("`tunnel.allowedMail` is only supported for Quick Tunnels and cannot be used together with `tunnel.name`.");
+	}
 	const resolvedNewConfig = normalizeNewConfig(pluginConfig.experimental?.newConfig);
 	const shared = {
 		persistState: pluginConfig.persistState ?? true,
 		inspectorPort: pluginConfig.inspectorPort,
 		tunnel: typeof pluginConfig.tunnel === "boolean" ? { autoStart: pluginConfig.tunnel } : {
 			autoStart: pluginConfig.tunnel?.autoStart ?? false,
-			name: pluginConfig.tunnel?.name
+			name: pluginConfig.tunnel?.name,
+			allowedMail: pluginConfig.tunnel?.allowedMail?.length ? pluginConfig.tunnel.allowedMail : void 0
 		},
 		experimental: {
 			headersAndRedirectsDevModeSupport: pluginConfig.experimental?.headersAndRedirectsDevModeSupport,
@@ -80757,7 +80793,7 @@ var __name$1 = (target$1, value) => __defProp$1(target$1, "name", {
 });
 
 //#endregion
-//#region ../workers-auth/dist/chunk-FT2NMTJB.mjs
+//#region ../workers-auth/dist/chunk-NDZDTP46.mjs
 var import_undici$2 = require_undici();
 createRequire(import.meta.url || (typeof __filename === "string" ? __filename : "/"));
 var hasWarnedAboutDeprecatedV1ApiToken = false;
@@ -81152,7 +81188,7 @@ function getCachedTemporaryPreviewAccount(storage) {
 	return temporaryPreviewAccount;
 }
 __name$1(getCachedTemporaryPreviewAccount, "getCachedTemporaryPreviewAccount");
-async function requestPowSolution(logger$2) {
+async function requestPowSolution(temporaryAccountLogger) {
 	const response = await (0, import_undici$2.fetch)(getTemporaryPreviewChallengeUrl(), {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
@@ -81168,7 +81204,7 @@ async function requestPowSolution(logger$2) {
 	const { challengeToken, seed, k, g } = body.result ?? {};
 	if (challengeToken === void 0 || seed === void 0 || k === void 0 || g === void 0) throw new FatalError("Failed to request a proof-of-work challenge because the response was missing required fields.", { telemetryMessage: "deploy temporary account challenge incomplete" });
 	if (!Number.isInteger(k) || !Number.isInteger(g) || k <= 0 || g <= 0 || k * g > POW_MAX_ITERATIONS || Buffer.from(seed, "base64url").length !== 32) throw new FatalError("The proof-of-work challenge is not supported by this version of Wrangler.", { telemetryMessage: "deploy temporary account challenge difficulty unsupported" });
-	logger$2.log("Solving proof-of-work challenge…");
+	temporaryAccountLogger.log("Solving proof-of-work challenge…");
 	return solveChallenge({
 		challengeToken,
 		seed,
@@ -81177,8 +81213,8 @@ async function requestPowSolution(logger$2) {
 	});
 }
 __name$1(requestPowSolution, "requestPowSolution");
-async function createTemporaryPreviewAccount(logger$2, request$2) {
-	const pow = await requestPowSolution(logger$2);
+async function createTemporaryPreviewAccount(temporaryAccountLogger, request$2) {
+	const pow = await requestPowSolution(temporaryAccountLogger);
 	const response = await (0, import_undici$2.fetch)(getTemporaryPreviewUrl(), {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
@@ -81238,7 +81274,7 @@ async function getOrCreateTemporaryPreviewAccount(options) {
 		};
 	}
 	if (!await options.prompt(TEMPORARY_TERMS_PROMPT, TEMPORARY_TERMS_NOTICE)) throw new UserError(TEMPORARY_TERMS_ERROR, { telemetryMessage: "user temporary terms not accepted" });
-	const temporaryPreviewAccount = await createTemporaryPreviewAccount(options.logger, options.request);
+	const temporaryPreviewAccount = await createTemporaryPreviewAccount(options.temporaryAccountLogger, options.request);
 	options.storage.write(temporaryPreviewAccount);
 	return {
 		account: temporaryPreviewAccount,
@@ -82193,7 +82229,6 @@ function createOAuthFlow(ctx) {
 		if (!ctx.temporary) throw new UserError("Temporary preview accounts are not supported by this CLI.", { telemetryMessage: "user temporary account unsupported" });
 		const result = await getOrCreateTemporaryPreviewAccount({
 			...ctx.temporary,
-			logger: ctx.logger,
 			...temporaryRequest ? { request: temporaryRequest } : {}
 		});
 		activeTemporaryAccount = result.account;
@@ -83231,7 +83266,7 @@ function scrubEncryptedCredentials(options) {
 __name$1(scrubEncryptedCredentials, "scrubEncryptedCredentials");
 
 //#endregion
-//#region ../workers-auth/dist/chunk-VVLCNASF.mjs
+//#region ../workers-auth/dist/chunk-PGZZHNWG.mjs
 createRequire(import.meta.url || (typeof __filename === "string" ? __filename : "/"));
 function createPreferences(getConfigPath) {
 	function getUserPreferencesPath() {
@@ -83908,10 +83943,10 @@ function createFileStorage(format$3, getPath) {
 }
 __name$1(createFileStorage, "createFileStorage");
 function createTemporaryTermsPrompt(deps) {
-	const { logger: logger$2, prompt } = deps;
+	const { temporaryAccountLogger, prompt } = deps;
 	return /* @__PURE__ */ __name$1(async function ensureTemporaryTermsAccepted(question, notice) {
 		if (isNonInteractiveOrCI()) {
-			logger$2.log(notice);
+			temporaryAccountLogger.log(notice);
 			return true;
 		}
 		const answer = await prompt(question);
@@ -83939,9 +83974,9 @@ function notLoggedInErrorBodies(loginCommand) {
 	};
 }
 __name$1(notLoggedInErrorBodies, "notLoggedInErrorBodies");
-function logTemporaryPreviewAccount(logger$2, temporaryPreviewAccount, cached$2) {
+function logTemporaryPreviewAccount(temporaryAccountLogger, temporaryPreviewAccount, cached$2) {
 	const claimExpiresAt = new Date(temporaryPreviewAccount.claim.expiresAt);
-	logger$2.log(dedent`
+	temporaryAccountLogger.log(dedent`
 			Temporary account ready:
 				Account: ${temporaryPreviewAccount.account.name} (${cached$2 ? "reused" : "created"})
 				Claim within: ${formatDistanceToNowStrict(claimExpiresAt)}
@@ -83951,6 +83986,7 @@ function logTemporaryPreviewAccount(logger$2, temporaryPreviewAccount, cached$2)
 __name$1(logTemporaryPreviewAccount, "logTemporaryPreviewAccount");
 function createCloudflareAuth(descriptor, ctx) {
 	const { logger: logger$2 } = ctx;
+	const temporaryAccountLogger = ctx.temporaryAccountLogger ?? logger$2;
 	const cliName = descriptor.cliName;
 	const NOT_LOGGED_IN_ERROR_BODIES = notLoggedInErrorBodies(descriptor.commands.login);
 	const NOT_LOGGED_IN_WHOAMI_TIP = `
@@ -83983,9 +84019,10 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
 		temporary: {
 			storage: createFileStorage(descriptor.fileFormat, descriptor.getTemporaryAccountConfigPath),
 			prompt: createTemporaryTermsPrompt({
-				logger: logger$2,
+				temporaryAccountLogger,
 				prompt: ctx.prompt
-			})
+			}),
+			temporaryAccountLogger
 		}
 	});
 	function setProfile(profile) {
@@ -84160,7 +84197,7 @@ ${accounts.map((account) => `  \`${redactAccountName ? "(redacted)" : account.na
 			if (latchedTemporaryAccount) return latchedTemporaryAccount.account.id;
 			if (getAPIToken$1()) throw new UserError("You're already authenticated with Cloudflare, so `--temporary` can't be used. Temporary preview accounts are only for unauthenticated use. Either remove `--temporary` to use your existing account, or log out (and unset CLOUDFLARE_API_TOKEN) first.", { telemetryMessage: "user temporary account already authenticated" });
 			const { account: temporaryPreviewAccount, cached: cached$2 } = await oauthFlow.activateTemporaryAccount();
-			logTemporaryPreviewAccount(logger$2, temporaryPreviewAccount, cached$2);
+			logTemporaryPreviewAccount(temporaryAccountLogger, temporaryPreviewAccount, cached$2);
 			return temporaryPreviewAccount.account.id;
 		}
 		const result = await loginOrRefreshIfRequired(config$2);
@@ -84857,6 +84894,8 @@ var CF_CLIENT_REGISTERED_SCOPES = [
 	"zone-disable-esc.write",
 	"zone-dns-settings.read",
 	"zone-dns-settings.write",
+	"zone-observability.read",
+	"zone-observability.write",
 	"zone-security-center-insights.read",
 	"zone-security-center-insights.write",
 	"zone-settings.read",
@@ -85204,7 +85243,7 @@ var require_command_exists = /* @__PURE__ */ __commonJS$3({ "../../node_modules/
 }) });
 
 //#endregion
-//#region ../deploy-helpers/dist/chunk-KKDV4JPS.mjs
+//#region ../deploy-helpers/dist/chunk-DSGVRFIS.mjs
 var import_undici$1 = require_undici();
 var import_command_exists = require_command_exists();
 createRequire(import.meta.url || (typeof __filename === "string" ? __filename : "/"));
@@ -85251,6 +85290,7 @@ function createWorkerUploadForm(worker, bindings, options) {
 	const assetConfig = {
 		html_handling: assets?.assetConfig?.html_handling,
 		not_found_handling: assets?.assetConfig?.not_found_handling,
+		base_path: assets?.assetConfig?.base_path,
 		run_worker_first: assets?.run_worker_first,
 		_redirects: assets?._redirects,
 		_headers: assets?._headers
@@ -85774,7 +85814,7 @@ __name(createWorkerUploadForm, "createWorkerUploadForm");
 //#endregion
 //#region ../remote-bindings/dist/index.mjs
 var import_undici = require_undici();
-var version$2 = "0.0.42";
+var version$2 = "0.0.44";
 var NoDefaultValueProvided = class extends UserError {
 	constructor() {
 		super("This command cannot be run in a non-interactive context", { telemetryMessage: "remote bindings prompt default missing" });