@cloudflare/vitest-plugin 1.1.8 → 1.1.10

package/dist/pool/index.mjs

@@ -325,7 +325,7 @@ function createFatalError$1(message, isJson, options) {
 __name$3(createFatalError$1, "createFatalError");
 
 //#endregion
-//#region ../workers-utils/dist/chunk-R5MIV2EH.mjs
+//#region ../workers-utils/dist/chunk-JGKSDUFK.mjs
 function hasKnownExportType(entry) {
 	const type = entry?.type;
 	return type === "durable-object" || type === "worker";
@@ -361,6 +361,17 @@ function getDurableObjectContainerApps(containers) {
 	return Array.isArray(containers) ? containers.filter(isDurableObjectContainerApp) : [];
 }
 __name$3(getDurableObjectContainerApps, "getDurableObjectContainerApps");
+function getResolvedDurableObjectContainerApps(containers, exports$1) {
+	return getDurableObjectContainerApps(containers).map((container) => {
+		const className = resolveContainerClassName(container, exports$1);
+		if (typeof className !== "string" || className.length === 0) throw new UserError$1(`The container "${container.name}" is not linked to a Durable Object. Either set "containers.class_name", or reference this container from a Durable Object's \`exports\` entry via its "container" field.`, { telemetryMessage: "durable object container class unresolved" });
+		return {
+			...container,
+			class_name: className
+		};
+	});
+}
+__name$3(getResolvedDurableObjectContainerApps, "getResolvedDurableObjectContainerApps");
 function getContainerNameToClassNameMap(exports$1) {
 	const containerNameToClassName = /* @__PURE__ */ new Map();
 	for (const [className, entry] of Object.entries(getDurableObjectExports(exports$1))) if ("container" in entry && typeof entry.container === "string" && !containerNameToClassName.has(entry.container)) containerNameToClassName.set(entry.container, className);
@@ -413,9 +424,9 @@ function getDurableObjectClassNameToUseSQLiteMap(migrations, exports$1) {
 	return durableObjectClassNameToUseSQLiteMap;
 }
 __name$3(getDurableObjectClassNameToUseSQLiteMap, "getDurableObjectClassNameToUseSQLiteMap");
-function validateDurableObjectContainerApplications(config$1) {
+function validateDurableObjectContainerApplications(config$1, containers = getDurableObjectContainerApps(config$1.containers)) {
 	const allDOs = getDurableObjectClassNameToUseSQLiteMap(config$1.migrations, config$1.exports);
-	for (const container of getDurableObjectContainerApps(config$1.containers)) {
+	for (const container of getResolvedDurableObjectContainerApps(containers, config$1.exports)) {
 		const maybeBoundDO = config$1.durable_objects.bindings.find((durableObject) => durableObject.class_name === container.class_name);
 		const useSQLite = allDOs.get(container.class_name);
 		if (useSQLite === void 0 && maybeBoundDO === void 0) throw new UserError$1(`The container class_name ${container.class_name} does not match any durable object class_name defined in your Wrangler config file. Note that the durable object must be defined in the same script as the container.`, { telemetryMessage: "no DO defined that matches container class_name" });
@@ -2383,7 +2394,12 @@ var APIError = class extends ParseError {
 		return this.#status;
 	}
 	isGatewayError() {
-		if (this.#status !== void 0) return [524].includes(this.#status);
+		if (this.#status !== void 0) return [
+			502,
+			503,
+			504,
+			524
+		].includes(this.#status);
 		return false;
 	}
 	isRetryable() {
@@ -2787,8 +2803,8 @@ function formatConfigSnippet(snippet, configPath, formatted = true) {
 __name$3(formatConfigSnippet, "formatConfigSnippet");
 
 //#endregion
-//#region ../workers-utils/dist/chunk-KBTXSRPS.mjs
-var DEFAULT_COMPAT_DATE = "2026-09-11";
+//#region ../workers-utils/dist/chunk-5H6GBNUC.mjs
+var DEFAULT_COMPAT_DATE = "2026-09-15";
 function assertNever(_value) {}
 __name$3(assertNever, "assertNever");
 function mapWorkerMetadataBindings(bindings) {
@@ -2960,9 +2976,6 @@ function mapWorkerMetadataBindings(bindings) {
 					instance_name: binding.instance_name
 				}];
 				break;
-			case "websearch":
-				configObj.websearch = { binding: binding.name };
-				break;
 			case "agent_memory":
 				configObj.agent_memory = [...configObj.agent_memory ?? [], {
 					binding: binding.name,
@@ -27489,7 +27502,6 @@ var defaultWranglerConfig = {
 	vectorize: [],
 	ai_search_namespaces: [],
 	ai_search: [],
-	websearch: void 0,
 	agent_memory: [],
 	hyperdrive: [],
 	workflows: [],
@@ -41567,7 +41579,6 @@ var friendlyBindingNames = {
 	vectorize: "Vectorize Index",
 	ai_search_namespaces: "AI Search Namespace",
 	ai_search: "AI Search Instance",
-	websearch: "Web Search",
 	agent_memory: "Agent Memory",
 	hyperdrive: "Hyperdrive Config",
 	r2_buckets: "R2 Bucket",
@@ -41620,7 +41631,6 @@ var bindingTypeFriendlyNames = {
 	vectorize: "Vectorize Index",
 	ai_search_namespace: "AI Search Namespace",
 	ai_search: "AI Search Instance",
-	websearch: "Web Search",
 	agent_memory: "Agent Memory",
 	hyperdrive: "Hyperdrive Config",
 	service: "Worker",
@@ -42123,7 +42133,6 @@ function normalizeAndValidateEnvironment(diagnostics, configPath, rawEnv, isDisp
 		vectorize: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "vectorize", validateBindingArray(envName, validateVectorizeBinding), []),
 		ai_search_namespaces: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "ai_search_namespaces", validateBindingArray(envName, validateAISearchNamespaceBinding), []),
 		ai_search: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "ai_search", validateBindingArray(envName, validateAISearchBinding), []),
-		websearch: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "websearch", validateNamedSimpleBinding(envName), void 0),
 		agent_memory: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "agent_memory", validateBindingArray(envName, validateAgentMemoryBinding), []),
 		hyperdrive: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "hyperdrive", validateBindingArray(envName, validateHyperdriveBinding), []),
 		services: notInheritable(diagnostics, topLevelEnv, rawConfig, rawEnv, envName, "services", validateBindingArray(envName, validateServiceBinding), []),
@@ -42165,7 +42174,7 @@ function normalizeAndValidateEnvironment(diagnostics, configPath, rawEnv, isDisp
 	warnIfDurableObjectsHaveNoLifecycleConfig(diagnostics, environment.durable_objects, environment.migrations, environment.exports, configPath);
 	errorIfMigrationsAndExportsBothSet(diagnostics, environment.migrations, environment.exports);
 	const containersDeclaredElsewhere = rawConfig !== void 0 ? rawConfig.containers !== void 0 : Object.values("env" in rawEnv ? rawEnv.env ?? {} : {}).some((rawNamedEnv) => rawNamedEnv?.containers !== void 0);
-	validateContainerExportLinks(diagnostics, environment.containers, environment.exports, containersDeclaredElsewhere);
+	validateContainerExportLinks$1(diagnostics, environment.containers, environment.exports, containersDeclaredElsewhere);
 	if (envName !== "top level") validateAdditionalProperties(diagnostics, "env." + envName, Object.keys(rawEnv), Object.keys(environment));
 	return environment;
 }
@@ -42663,7 +42672,6 @@ var validateUnsafeBinding = /* @__PURE__ */ __name$3((diagnostics, field, value)
 			"ai",
 			"ai_search_namespace",
 			"ai_search",
-			"websearch",
 			"agent_memory",
 			"kv_namespace",
 			"durable_object_namespace",
@@ -42809,7 +42817,18 @@ function validateDurableObjectContainerImages(diagnostics, field, images, compli
 				valid = false;
 			}
 		}
-		const unsupportedFields = Object.keys(image).filter((property) => property !== "dockerfile" && property !== "image");
+		const isDockerfileBuild = hasDockerfile && !hasImage;
+		if (isDockerfileBuild) {
+			if (image.build_context !== void 0 && (typeof image.build_context !== "string" || image.build_context.length === 0)) {
+				diagnostics.errors.push(`"${imageField}.build_context" must be a non-empty string.`);
+				valid = false;
+			}
+			if (image.build_vars !== void 0 && (typeof image.build_vars !== "object" || image.build_vars === null || Array.isArray(image.build_vars) || Object.values(image.build_vars).some((value) => typeof value !== "string"))) {
+				diagnostics.errors.push(`"${imageField}.build_vars" must be an object with string values.`);
+				valid = false;
+			}
+		}
+		const unsupportedFields = Object.keys(image).filter((property) => property !== "dockerfile" && property !== "image" && !(isDockerfileBuild && (property === "build_context" || property === "build_vars")));
 		if (unsupportedFields.length > 0) {
 			diagnostics.errors.push(`Unexpected fields found in ${imageField} field: ${unsupportedFields.map((property) => `"${property}"`).join(", ")}`);
 			valid = false;
@@ -42818,6 +42837,24 @@ function validateDurableObjectContainerImages(diagnostics, field, images, compli
 	return valid;
 }
 __name$3(validateDurableObjectContainerImages, "validateDurableObjectContainerImages");
+function validateDurableObjectContainerUnsafe(diagnostics, field, value) {
+	if (value === void 0) return;
+	if (typeof value !== "object" || value === null || Array.isArray(value)) {
+		diagnostics.errors.push(`"${field}" should be an object.`);
+		return;
+	}
+	const unsafe = value;
+	const configuration = unsafe.configuration;
+	if (Object.keys(unsafe).some((key) => key !== "configuration") || configuration !== void 0 && (typeof configuration !== "object" || configuration === null || Array.isArray(configuration) || Object.keys(configuration).some((key) => key !== "experimental_flags"))) {
+		diagnostics.errors.push(`Only "${field}.configuration.experimental_flags" is supported for Durable Object-managed Containers.`);
+		return;
+	}
+	if (configuration !== void 0) {
+		const flags = configuration.experimental_flags;
+		if (flags !== void 0 && (!Array.isArray(flags) || flags.some((flag) => typeof flag !== "string"))) diagnostics.errors.push(`"${field}.configuration.experimental_flags" should be an array of strings.`);
+	}
+}
+__name$3(validateDurableObjectContainerUnsafe, "validateDurableObjectContainerUnsafe");
 function validateContainerApp(envName, topLevelName, configPath, options = {}) {
 	const { generateDefaultName = true } = options;
 	return (diagnostics, field, value, config2) => {
@@ -42829,11 +42866,10 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
 		for (const containerAppOptional of value) {
 			const isDurableObjectManaged = containerAppOptional.scheduling_policy === "durable_object";
 			const hasValidDurableObjectClassName = typeof containerAppOptional.class_name === "string" && containerAppOptional.class_name.length > 0;
-			if (isDurableObjectManaged) {
-				if (!hasValidDurableObjectClassName) diagnostics.errors.push(`"containers.class_name" must be a non-empty string when "containers.scheduling_policy" is "durable_object".`);
-			} else validateOptionalProperty(diagnostics, field, "class_name", containerAppOptional.class_name, "string");
+			validateOptionalProperty(diagnostics, field, "class_name", containerAppOptional.class_name, "string");
+			if (isDurableObjectManaged && containerAppOptional.class_name === "") diagnostics.errors.push(`"containers.class_name" must be a non-empty string when specified for a Durable Object-managed Container.`);
 			validateOptionalProperty(diagnostics, field, "name", containerAppOptional.name, "string");
-			if (generateDefaultName && !containerAppOptional.name && (!isDurableObjectManaged || hasValidDurableObjectClassName)) if (containerAppOptional.class_name === void 0) diagnostics.errors.push(`"containers.name" is required when "containers.class_name" is not defined, because there is no class name to derive a default name from. Either name this container and reference it from a Durable Object's \`exports\` entry, or set "containers.class_name".`);
+			if (generateDefaultName && !containerAppOptional.name && (!isDurableObjectManaged || containerAppOptional.class_name === void 0 || hasValidDurableObjectClassName)) if (containerAppOptional.class_name === void 0) diagnostics.errors.push(`"containers.name" is required when "containers.class_name" is not defined, because there is no class name to derive a default name from. Either name this container and reference it from a Durable Object's \`exports\` entry, or set "containers.class_name".`);
 			else if (!topLevelName) diagnostics.errors.push(`Must have either a top level "name" and "containers.class_name" field defined, or have field "containers.name" defined.`);
 			else {
 				let name = `${topLevelName}-${containerAppOptional.class_name}`;
@@ -42842,13 +42878,18 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
 			}
 			if (isDurableObjectManaged) {
 				validateDurableObjectContainerImages(diagnostics, `${field}.images`, containerAppOptional.images, options.complianceConfig);
+				validateContainerObservability(diagnostics, `${field}.observability`, containerAppOptional.observability, config2);
+				if (containerAppOptional.observability?.target_instance_count !== void 0 || containerAppOptional.observability?.target_instance_percentage !== void 0) diagnostics.errors.push(`"${field}.observability" only supports enabling or disabling logs for Durable Object-managed Containers; instance targeting is not supported.`);
+				validateDurableObjectContainerUnsafe(diagnostics, `${field}.unsafe`, containerAppOptional.unsafe);
 				const unsupportedFields = Object.keys(containerAppOptional).filter((key) => ![
 					"name",
 					"class_name",
 					"scheduling_policy",
-					"images"
+					"images",
+					"observability",
+					"unsafe"
 				].includes(key));
-				if (unsupportedFields.length > 0) diagnostics.errors.push(`Unsupported fields for Durable Object-managed Containers in ${field}: ${unsupportedFields.map((key) => `"${key}"`).join(",")}. Only "name", "class_name", "scheduling_policy", and "images" are supported.`);
+				if (unsupportedFields.length > 0) diagnostics.errors.push(`Unsupported fields for Durable Object-managed Containers in ${field}: ${unsupportedFields.map((key) => `"${key}"`).join(",")}. Only "name", "class_name", "scheduling_policy", "images", "observability", and restricted "unsafe" settings are supported.`);
 				continue;
 			}
 			if (!containerAppOptional.configuration?.image && !containerAppOptional.image) diagnostics.errors.push(`"containers.image" field must be defined for each container app. This should be the path to your Dockerfile or an image URI pointing to the Cloudflare registry.`);
@@ -43919,6 +43960,8 @@ var validatePreviewsConfig = /* @__PURE__ */ __name$3((envName, configPath) => (
 		"d1_databases",
 		"r2_buckets",
 		"vectorize",
+		"ai_search_namespaces",
+		"ai_search",
 		"hyperdrive",
 		"services",
 		"analytics_engine_datasets",
@@ -43957,6 +44000,8 @@ var validatePreviewsConfig = /* @__PURE__ */ __name$3((envName, configPath) => (
 	isValid = validateBindingArray(envName, validateD1Binding)(diagnostics, `${field}.d1_databases`, previews.d1_databases, void 0) && isValid;
 	isValid = validateBindingArray(envName, validateR2Binding)(diagnostics, `${field}.r2_buckets`, previews.r2_buckets, void 0) && isValid;
 	isValid = validateBindingArray(envName, validateVectorizeBinding)(diagnostics, `${field}.vectorize`, previews.vectorize, void 0) && isValid;
+	isValid = validateBindingArray(envName, validateAISearchNamespaceBinding)(diagnostics, `${field}.ai_search_namespaces`, previews.ai_search_namespaces, void 0) && isValid;
+	isValid = validateBindingArray(envName, validateAISearchBinding)(diagnostics, `${field}.ai_search`, previews.ai_search, void 0) && isValid;
 	isValid = validateBindingArray(envName, validateHyperdriveBinding)(diagnostics, `${field}.hyperdrive`, previews.hyperdrive, void 0) && isValid;
 	isValid = validateBindingArray(envName, validateServiceBinding)(diagnostics, `${field}.services`, previews.services, void 0) && isValid;
 	isValid = validateBindingArray(envName, validateAnalyticsEngineBinding)(diagnostics, `${field}.analytics_engine_datasets`, previews.analytics_engine_datasets, void 0) && isValid;
@@ -44375,7 +44420,7 @@ function errorIfMigrationsAndExportsBothSet(diagnostics, migrations, exports$1)
 	if (migrations.length > 0 && exports$1 !== void 0 && Object.values(exports$1).some((entry) => entry.type === "durable-object")) diagnostics.errors.push(`\`migrations\` and \`exports\` are mutually exclusive. Choose one or the other to declare your Durable Object lifecycle, but not both.`);
 }
 __name$3(errorIfMigrationsAndExportsBothSet, "errorIfMigrationsAndExportsBothSet");
-function validateContainerExportLinks(diagnostics, containers, exports$1, containersDeclaredElsewhere) {
+function validateContainerExportLinks$1(diagnostics, containers, exports$1, containersDeclaredElsewhere) {
 	if (containers !== void 0 && !Array.isArray(containers)) return;
 	if (containers === void 0 && containersDeclaredElsewhere) return;
 	const containersByName = /* @__PURE__ */ new Map();
@@ -44435,7 +44480,7 @@ function validateContainerExportLinks(diagnostics, containers, exports$1, contai
 		if (referencedContainerName === void 0 && exportEntry !== void 0 && "storage" in exportEntry && exportEntry.storage === "legacy-kv") diagnostics.errors.push(`The container "${container.name}" sets "class_name" to "${container.class_name}", but "exports.${container.class_name}.storage" is "legacy-kv". Containers are not supported on Durable Objects using the "legacy-kv" storage backend.`);
 	}
 }
-__name$3(validateContainerExportLinks, "validateContainerExportLinks");
+__name$3(validateContainerExportLinks$1, "validateContainerExportLinks");
 var validatePythonModules = /* @__PURE__ */ __name$3((diagnostics, field, value, topLevelEnv) => {
 	if (value === void 0) return true;
 	if (typeof value !== "object" || value === null || Array.isArray(value)) {
@@ -44517,7 +44562,6 @@ var BINDING_LOCAL_SUPPORT = {
 	flagship: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
 	vpc_service: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
 	vpc_network: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
-	websearch: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
 	agent_memory: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator"
 };
 function getBindingLocalSupport(type) {
@@ -44875,14 +44919,6 @@ function convertConfigToBindings(config2, options) {
 					...x
 				};
 				break;
-			case "websearch": {
-				const { binding,...x } = info;
-				output[binding] = {
-					type: "websearch",
-					...x
-				};
-				break;
-			}
 			case "agent_memory":
 				for (const { binding,...x } of info) output[binding] = {
 					type: "agent_memory",
@@ -45028,7 +45064,6 @@ function printBindings(bindings, options) {
 	const vectorize = extractBindingsOfType("vectorize", bindings);
 	const ai_search_namespaces = extractBindingsOfType("ai_search_namespace", bindings);
 	const ai_search = extractBindingsOfType("ai_search", bindings);
-	const websearch = extractBindingsOfType("websearch", bindings);
 	const agent_memory = extractBindingsOfType("agent_memory", bindings);
 	const hyperdrive = extractBindingsOfType("hyperdrive", bindings);
 	const r2_buckets = extractBindingsOfType("r2_bucket", bindings);
@@ -45168,12 +45203,6 @@ function printBindings(bindings, options) {
 		value: instance_name ? String(instance_name) : void 0,
 		mode: getMode({ isSimulatedLocally: false })
 	})));
-	if (websearch.length > 0) output.push(...websearch.map(({ binding }) => ({
-		name: binding,
-		type: getBindingTypeFriendlyName("websearch"),
-		value: void 0,
-		mode: getMode({ isSimulatedLocally: false })
-	})));
 	if (agent_memory.length > 0) output.push(...agent_memory.map(({ binding, namespace }) => ({
 		name: binding,
 		type: getBindingTypeFriendlyName("agent_memory"),
@@ -45462,7 +45491,7 @@ ${allTailConsumers.map(({ service, streaming }) => {
 		let containersTitle = "The following containers are available:";
 		if (context.name && isMultiWorker) containersTitle = `The following containers are available from ${source_default.blue(context.name)}:`;
 		log$2(`${containersTitle}
-${containers.map((container) => container.scheduling_policy === "durable_object" ? `- ${container.class_name} (durable_object)` : `- ${container.name} (${container.image})`).join("\n")}`);
+${containers.map((container) => container.scheduling_policy === "durable_object" ? `- ${container.class_name ?? container.name} (durable_object)` : `- ${container.name} (${container.image})`).join("\n")}`);
 		log$2("");
 	}
 	if (context.unsafeMetadata) {
@@ -54836,7 +54865,7 @@ function scrubEncryptedCredentials(options) {
 __name$2(scrubEncryptedCredentials, "scrubEncryptedCredentials");
 
 //#endregion
-//#region ../workers-auth/dist/chunk-YCVYA5LL.mjs
+//#region ../workers-auth/dist/chunk-T63LVVAX.mjs
 function createPreferences(getConfigPath) {
 	function getUserPreferencesPath() {
 		return path.resolve(getConfigPath(), "preferences.json");
@@ -55615,7 +55644,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
 		return oauthFlow.requireApiToken();
 	}
 	__name$2(requireApiToken$1, "requireApiToken");
-	function withDefaultScopes(complianceConfig, props) {
+	function withLoginDefaults(complianceConfig, props) {
 		return {
 			complianceConfig,
 			scopes: props?.scopes ?? descriptor.getDefaultScopeKeys(),
@@ -55623,12 +55652,12 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
 			callbackHost: props?.callbackHost,
 			callbackPort: props?.callbackPort,
 			profile: props?.profile,
-			device: props?.device
+			device: props?.device ?? descriptor.useDeviceFlowByDefault ?? false
 		};
 	}
-	__name$2(withDefaultScopes, "withDefaultScopes");
+	__name$2(withLoginDefaults, "withLoginDefaults");
 	async function login(complianceConfig, props) {
-		return oauthFlow.login(withDefaultScopes(complianceConfig, props));
+		return oauthFlow.login(withLoginDefaults(complianceConfig, props));
 	}
 	__name$2(login, "login");
 	async function logout(profile) {
@@ -55637,7 +55666,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
 	__name$2(logout, "logout");
 	async function loginOrRefreshIfRequired(complianceConfig, props) {
 		if (oauthFlow.getActiveTemporaryAccount()) return { loggedIn: true };
-		return oauthFlow.loginOrRefreshIfRequired(withDefaultScopes(complianceConfig, props));
+		return oauthFlow.loginOrRefreshIfRequired(withLoginDefaults(complianceConfig, props));
 	}
 	__name$2(loginOrRefreshIfRequired, "loginOrRefreshIfRequired");
 	async function getOAuthTokenFromLocalState() {
@@ -55670,10 +55699,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
 		return configCache.getConfigCache(getAccountCacheFileName()).account;
 	}
 	__name$2(getAccountFromCache, "getAccountFromCache");
-	async function fetchAccountsPaged(complianceConfig, resource) {
-		const result = await loginOrRefreshIfRequired(complianceConfig);
-		if (!result.loggedIn) throw new UserError$1(`Not logged in. ${NOT_LOGGED_IN_ERROR_BODIES[result.reason]}${NOT_LOGGED_IN_WHOAMI_TIP}`, { telemetryMessage: "cfetch auth login required" });
-		const credentials = requireApiToken$1();
+	async function fetchAccountsPaged(complianceConfig, resource, credentials) {
 		const results = [];
 		let getMoreResults = true;
 		let page = 1;
@@ -55693,7 +55719,10 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
 	__name$2(fetchAccountsPaged, "fetchAccountsPaged");
 	async function fetchAllAccounts(complianceConfig, options = {}) {
 		const { throwOnEmpty = true } = options;
-		const [accountsRes, membershipsRes] = await Promise.allSettled([fetchAccountsPaged(complianceConfig, `/accounts`), fetchAccountsPaged(complianceConfig, `/memberships`)]);
+		const loginResult = await loginOrRefreshIfRequired(complianceConfig);
+		if (!loginResult.loggedIn) throw new UserError$1(`Not logged in. ${NOT_LOGGED_IN_ERROR_BODIES[loginResult.reason]}${NOT_LOGGED_IN_WHOAMI_TIP}`, { telemetryMessage: "cfetch auth login required" });
+		const credentials = requireApiToken$1();
+		const [accountsRes, membershipsRes] = await Promise.allSettled([fetchAccountsPaged(complianceConfig, `/accounts`, credentials), fetchAccountsPaged(complianceConfig, `/memberships`, credentials)]);
 		if (accountsRes.status === "rejected") throw accountsRes.reason;
 		if (membershipsRes.status === "rejected") if (isMembershipsInaccessible(membershipsRes.reason)) {
 			if (accountsRes.status === "fulfilled" && accountsRes.value.length > 0) return accountsRes.value;
@@ -55990,7 +56019,483 @@ function getCfConfigPath() {
 	});
 }
 __name$2(getCfConfigPath, "getCfConfigPath");
-var CF_SCOPES = [
+var CF_REGISTERED_SCOPES = [
+	"access:read",
+	"access:write",
+	"account:read",
+	"agw:read",
+	"agw:run",
+	"agw:write",
+	"ai:read",
+	"ai:write",
+	"ai-search:read",
+	"ai-search:run",
+	"ai-search:write",
+	"aiaudit:read",
+	"aiaudit:write",
+	"aig:read",
+	"aig:write",
+	"auditlogs:read",
+	"billing:read",
+	"billing:write",
+	"browser:read",
+	"browser:write",
+	"cfone:read",
+	"cfone:write",
+	"cloudchamber:write",
+	"connectivity:admin",
+	"connectivity:bind",
+	"connectivity:read",
+	"constellation:write",
+	"containers:write",
+	"d1:write",
+	"dex:read",
+	"dex:write",
+	"dns_analytics:read",
+	"dns_records:edit",
+	"dns_records:read",
+	"dns_settings:read",
+	"email_routing:read",
+	"email_routing:write",
+	"email_sending:read",
+	"email_sending:write",
+	"firstpartytags:write",
+	"images:read",
+	"images:write",
+	"lb:edit",
+	"lb:read",
+	"logpush:read",
+	"logpush:write",
+	"mcp_portals:read",
+	"mcp_portals:write",
+	"notebook-examples:read",
+	"notebook-managed:read",
+	"notification:read",
+	"notification:write",
+	"oauth_account_ssl_and_certificates_write",
+	"offline",
+	"openid",
+	"pages:read",
+	"pages:write",
+	"pipelines:read",
+	"pipelines:setup",
+	"pipelines:write",
+	"query_cache:write",
+	"queues:write",
+	"r2_catalog:write",
+	"radar:read",
+	"rag:read",
+	"rag:write",
+	"registrar:read",
+	"registrar:write",
+	"secrets_store:read",
+	"secrets_store:write",
+	"sso-connector:read",
+	"sso-connector:write",
+	"ssl_certs:write",
+	"teams:pii",
+	"teams:read",
+	"teams:secure_location",
+	"teams:write",
+	"url_scanner:read",
+	"url_scanner:write",
+	"user:read",
+	"vectorize:write",
+	"workers:read",
+	"workers:write",
+	"workers_builds:read",
+	"workers_builds:write",
+	"workers_deployments:read",
+	"workers_kv:write",
+	"workers_observability:read",
+	"workers_observability:write",
+	"workers_observability_telemetry:write",
+	"workers_routes:write",
+	"workers_scripts:write",
+	"workers_tail:read",
+	"zone:read",
+	"account-analytics.read",
+	"account-ssl-and-certificates.write",
+	"ssl-and-certificates.read",
+	"ssl-and-certificates.write",
+	"registrar-domains.read",
+	"registrar-domains.admin",
+	"logs.read",
+	"logs.write",
+	"websearch.run",
+	"snippets.read",
+	"snippets.write",
+	"access-acct.read",
+	"access-acct.revoke",
+	"access-acct.write",
+	"access-app.read",
+	"access-app.revoke",
+	"access-app.write",
+	"access-audit-log.read",
+	"access-certificate.read",
+	"access-certificate.write",
+	"access-custom-page.read",
+	"access-custom-page.write",
+	"access-device-posture.read",
+	"access-device-posture.write",
+	"access-group.read",
+	"access-group.write",
+	"access-idp.read",
+	"access-idp.write",
+	"access-key.read",
+	"access-key.write",
+	"access-org.read",
+	"access-org.revoke",
+	"access-org.write",
+	"access-policy-test.read",
+	"access-policy-test.write",
+	"access-policy.read",
+	"access-policy.write",
+	"access-population.read",
+	"access-population.write",
+	"access-saml-certificate.read",
+	"access-saml-certificate.write",
+	"access-scim-log.read",
+	"access-seats.write",
+	"access-service-token.read",
+	"access-service-token.write",
+	"access-ssh-auditing.read",
+	"access-ssh-auditing.write",
+	"access-tag.read",
+	"access-tag.write",
+	"access-users.read",
+	"access-users.write",
+	"access.read",
+	"access.revoke",
+	"access.write",
+	"account-api-gateway.read",
+	"account-api-gateway.write",
+	"account-custom-asset.read",
+	"account-custom-asset.write",
+	"account-custom-error-rules.read",
+	"account-custom-error-rules.write",
+	"account-custom-pages.read",
+	"account-custom-pages.write",
+	"account-disable-esc.read",
+	"account-disable-esc.write",
+	"account-dns-settings.read",
+	"account-dns-settings.write",
+	"account-firewall-access-rules.read",
+	"account-firewall-access-rules.write",
+	"account-logs.read",
+	"account-logs.write",
+	"account-rule-lists.read",
+	"account-rule-lists.write",
+	"account-rulesets.read",
+	"account-rulesets.write",
+	"account-security-center-insights.read",
+	"account-security-center-insights.write",
+	"account-settings.read",
+	"account-settings.write",
+	"account-ssl-and-certificates.read",
+	"account-waf.read",
+	"account-waf.write",
+	"account-waiting-rooms.read",
+	"address-maps.read",
+	"address-maps.write",
+	"agent-memory.write",
+	"agw.read",
+	"agw.run",
+	"agw.write",
+	"ai-search.index",
+	"ai-search.metadata_read",
+	"ai-search.read",
+	"ai-search.run",
+	"ai-search.write",
+	"ai.read",
+	"ai.write",
+	"aiaudit.read",
+	"aiaudit.write",
+	"aig.metadata_read",
+	"aig.read",
+	"aig.run",
+	"aig.write",
+	"analytics.read",
+	"api-gateway.read",
+	"api-gateway.write",
+	"apps.write",
+	"argotunnel.read",
+	"argotunnel.write",
+	"artifacts.read",
+	"artifacts.write",
+	"bot-management-feedback.read",
+	"bot-management-feedback.write",
+	"bot-management.read",
+	"bot-management.write",
+	"browser-rendering.read",
+	"browser-rendering.write",
+	"cache-settings.read",
+	"cache-settings.write",
+	"cache.purge",
+	"calls.read",
+	"calls.write",
+	"casb.read",
+	"casb.write",
+	"cf-agents.read",
+	"cf-agents.write",
+	"challenge-widgets.read",
+	"challenge-widgets.write",
+	"chinanetwork-steering.read",
+	"chinanetwork-steering.write",
+	"cloud-connector.read",
+	"cloud-connector.write",
+	"cloud-email-security.read",
+	"cloud-email-security.write",
+	"cloudchamber.read",
+	"cloudchamber.write",
+	"cloudforce-one.read",
+	"cloudforce-one.write",
+	"config-settings.read",
+	"config-settings.write",
+	"connectivity-directory.admin",
+	"connectivity-directory.bind",
+	"connectivity-directory.read",
+	"constellation.read",
+	"constellation.write",
+	"containers.read",
+	"containers.write",
+	"custom-errors.read",
+	"custom-errors.write",
+	"custom-pages.read",
+	"custom-pages.write",
+	"d1.metadata_read",
+	"d1.read",
+	"d1.write",
+	"ddos-botnet-feed.read",
+	"ddos-botnet-feed.write",
+	"ddos-protection.read",
+	"ddos-protection.write",
+	"dls.read",
+	"dls.write",
+	"dns-firewall.read",
+	"dns-firewall.write",
+	"dns-view.read",
+	"dns-view.write",
+	"dns.read",
+	"dns.write",
+	"domain-page-shield.read",
+	"domain-page.shield",
+	"dynamic-redirect.read",
+	"dynamic-redirect.write",
+	"email-routing-account-rule.read",
+	"email-routing-address.read",
+	"email-routing-address.write",
+	"email-routing-rule.read",
+	"email-routing-rule.write",
+	"email-routing-suppression.read",
+	"email-routing-suppression.write",
+	"email-security-dmarcreports.read",
+	"email-security-dmarcreports.write",
+	"email-sending.read",
+	"email-sending.write",
+	"fbm.admin",
+	"fbm.read",
+	"fbm.write",
+	"field-extractor.read",
+	"field-extractor.write",
+	"firewall-for-ai.read",
+	"firewall-for-ai.write",
+	"firewall-services.read",
+	"firewall-services.write",
+	"flagship.evaluate",
+	"flagship.read",
+	"flagship.write",
+	"fraud-detection-pii.read",
+	"fraud-detection.read",
+	"fraud-detection.write",
+	"fraud-events.write",
+	"fraud-feedback.read",
+	"fraud-feedback.write",
+	"healthcheck.read",
+	"healthcheck.write",
+	"http-applications.read",
+	"http-applications.write",
+	"http-ddos-managed-ruleset.read",
+	"http-ddos-managed-ruleset.write",
+	"images.metadata_read",
+	"images.read",
+	"images.write",
+	"integration.write",
+	"intel.read",
+	"intel.write",
+	"iot.read",
+	"iot.write",
+	"ip-prefix-bgp-on-demand.read",
+	"ip-prefix-bgp-on-demand.write",
+	"ip-prefix.read",
+	"ip-prefix.write",
+	"l4-ddos-managed-ruleset.read",
+	"l4-ddos-managed-ruleset.write",
+	"load-balancers-account.read",
+	"load-balancers-account.write",
+	"load-balancers.read",
+	"load-balancers.write",
+	"load-balancing-monitors-and-pools.read",
+	"load-balancing-monitors-and-pools.write",
+	"magic-firewall.read",
+	"magic-firewall.write",
+	"magic-transit.read",
+	"magic-transit.write",
+	"magic-wan.read",
+	"magic-wan.write",
+	"managed-headers.read",
+	"managed-headers.write",
+	"mass-url-redirects.read",
+	"mass-url-redirects.write",
+	"mcp-portals.read",
+	"mcp-portals.write",
+	"memberships.read",
+	"memberships.write",
+	"messaging.edit",
+	"messaging.metadata_read",
+	"messaging.read",
+	"moq.read",
+	"moq.write",
+	"notifications.read",
+	"notifications.write",
+	"origin.read",
+	"origin.write",
+	"page-rules.read",
+	"page-rules.write",
+	"page-shield.read",
+	"page.read",
+	"page.shield",
+	"page.write",
+	"pages.metadata_read",
+	"payments-gateway.read",
+	"payments-gateway.write",
+	"pcaps-api.read",
+	"pcaps-api.write",
+	"pipelines.read",
+	"pipelines.send",
+	"pipelines.write",
+	"precursor.read",
+	"precursor.write",
+	"pubsub.read",
+	"pubsub.write",
+	"query-cache.read",
+	"query-cache.write",
+	"queues.metadata_read",
+	"queues.read",
+	"queues.write",
+	"r2-catalog-sql.read",
+	"r2-catalog.read",
+	"r2-catalog.write",
+	"radar.read",
+	"rag.read",
+	"rag.run",
+	"rag.write",
+	"realtime.admin",
+	"realtime.read",
+	"realtime.write",
+	"registrar-sandbox-domains.admin",
+	"registrar-sandbox-domains.read",
+	"reports-application-security-report.read",
+	"request-tracer.read",
+	"resource-library.read",
+	"resource-library.write",
+	"resource-sharing.read",
+	"response-compression.read",
+	"response-compression.write",
+	"sanitize.read",
+	"sanitize.write",
+	"secrets-store.read",
+	"secrets-store.write",
+	"select-configuration.read",
+	"select-configuration.write",
+	"stream.metadata_read",
+	"stream.read",
+	"stream.write",
+	"tag.read",
+	"tag.write",
+	"teams-cds-compute-account.read",
+	"teams-cds-compute-account.write",
+	"teams-connector-cloudflared.monitoring",
+	"teams-connector-cloudflared.read",
+	"teams-connector-cloudflared.write",
+	"teams-connector-warp.read",
+	"teams-connector-warp.write",
+	"teams-connectors.read",
+	"teams-connectors.write",
+	"teams-dex.read",
+	"teams-dex.write",
+	"teams-networks.read",
+	"teams-networks.write",
+	"teams-pii.read",
+	"teams-resilience.read",
+	"teams-resilience.write",
+	"teams-secure.location",
+	"teams.read",
+	"teams.report",
+	"teams.write",
+	"transform-rules.read",
+	"transform-rules.write",
+	"trust-and-safety.read",
+	"trust-and-safety.write",
+	"url-scanner.read",
+	"url-scanner.write",
+	"user-details.read",
+	"user-details.write",
+	"vectorize.read",
+	"vectorize.write",
+	"waiting-rooms.read",
+	"waiting-rooms.write",
+	"web3-hostnames.read",
+	"web3-hostnames.write",
+	"websearch.metadata_read",
+	"websearch.read",
+	"websearch.write",
+	"workers-ci.read",
+	"workers-ci.write",
+	"workers-kv-storage.metadata_read",
+	"workers-kv-storage.read",
+	"workers-kv-storage.write",
+	"workers-observability-telemetry.write",
+	"workers-observability.read",
+	"workers-observability.write",
+	"workers-r2-bucket-item.read",
+	"workers-r2-bucket-item.write",
+	"workers-r2.metadata_read",
+	"workers-r2.read",
+	"workers-r2.write",
+	"workers-routes.read",
+	"workers-routes.write",
+	"workers-scripts.bind",
+	"workers-scripts.read",
+	"workers-scripts.write",
+	"workers-tail.read",
+	"workers_ai.metadata_read",
+	"zaraz.edit",
+	"zaraz.read",
+	"zaraz.write",
+	"zone-access.read",
+	"zone-access.revoke",
+	"zone-access.write",
+	"zone-custom-asset.read",
+	"zone-custom-asset.write",
+	"zone-disable-esc.read",
+	"zone-disable-esc.write",
+	"zone-dns-settings.read",
+	"zone-dns-settings.write",
+	"zone-security-center-insights.read",
+	"zone-security-center-insights.write",
+	"zone-settings.read",
+	"zone-settings.write",
+	"zone-transform-rules.read",
+	"zone-transform-rules.write",
+	"zone-versioning.read",
+	"zone-versioning.write",
+	"zone-waf.read",
+	"zone-waf.write",
+	"zone.read",
+	"zone.write"
+];
+var DefaultScopeKeys$1 = [...[
 	"openid",
 	"offline",
 	"user:read",
@@ -56079,13 +56584,12 @@ var CF_SCOPES = [
 	"workers_scripts:write",
 	"workers_tail:read",
 	"zone:read"
-];
-var DefaultScopeKeys$1 = [...CF_SCOPES];
+]];
 function setLoginScopeKeys$1(scopes) {
 	DefaultScopeKeys$1 = scopes;
 }
 __name$2(setLoginScopeKeys$1, "setLoginScopeKeys");
-var CF_SCOPE_SET = new Set(CF_SCOPES);
+var CF_SCOPE_SET = new Set(CF_REGISTERED_SCOPES);
 function validateScopeKeys$1(scopes) {
 	return scopes.every((scope) => CF_SCOPE_SET.has(scope));
 }
@@ -56114,12 +56618,13 @@ var CF_CLI = {
 		login: "cf auth login",
 		whoami: "cf auth whoami",
 		createProfile: "cf auth create",
-		deviceLogin: "cf auth login --device"
+		deviceLogin: "cf auth login"
 	},
 	keyringServiceName: CF_KEYRING_SERVICE_NAME,
 	clientId: getClientIdFromEnv$1,
 	consent: CF_CONSENT_PAGES,
 	redirectUri: CF_OAUTH_CALLBACK_URL,
+	useDeviceFlowByDefault: true,
 	allowGlobalAuthKey: false,
 	getConfigPath: getCfConfigPath,
 	getTemporaryAccountConfigPath: getCfTemporaryAccountConfigPath,
@@ -56174,7 +56679,6 @@ var DefaultScopes = {
 	"ai:write": "See and change Workers AI catalog and assets",
 	"ai-search:write": "See and change AI Search data",
 	"ai-search:run": "Run search queries on your AI Search instances",
-	"websearch.run": "Run search queries against Cloudflare Web Search",
 	"agent-memory:write": "See and change Agent Memory data such as keys and namespaces.",
 	"queues:write": "See and change Cloudflare Queues settings and data",
 	"pipelines:write": "See and change Cloudflare Pipelines configurations and data",
@@ -59982,7 +60486,7 @@ var require_command_exists = /* @__PURE__ */ __commonJS$2({ "../../node_modules/
 }) });
 
 //#endregion
-//#region ../deploy-helpers/dist/chunk-3G6JZQDH.mjs
+//#region ../deploy-helpers/dist/chunk-QBZBEHZB.mjs
 var import_undici$1 = require_undici();
 var import_command_exists = require_command_exists();
 function handleUnsafeCapnp(capnp) {
@@ -60059,7 +60563,6 @@ function createWorkerUploadForm(worker, bindings, options) {
 	const vectorize = extractBindingsOfType("vectorize", bindings);
 	const ai_search_namespaces = extractBindingsOfType("ai_search_namespace", bindings);
 	const ai_search = extractBindingsOfType("ai_search", bindings);
-	const websearch = extractBindingsOfType("websearch", bindings)[0];
 	const agent_memory = extractBindingsOfType("agent_memory", bindings);
 	const hyperdrive = extractBindingsOfType("hyperdrive", bindings);
 	const secrets_store_secrets = extractBindingsOfType("secrets_store_secret", bindings);
@@ -60235,10 +60738,6 @@ function createWorkerUploadForm(worker, bindings, options) {
 			instance_name
 		});
 	});
-	if (websearch !== void 0) metadataBindings.push({
-		name: websearch.binding,
-		type: "websearch"
-	});
 	agent_memory.forEach(({ binding, namespace }) => {
 		if (options?.dryRun) namespace ??= INHERIT_SYMBOL;
 		if (namespace === void 0) throw new UserError$1(`${binding} bindings must have a "namespace" field. Add a "namespace" field to the binding in your Worker configuration specifying the namespace to bind to.`, { telemetryMessage: false });
@@ -60542,7 +61041,7 @@ __name$1(createWorkerUploadForm, "createWorkerUploadForm");
 //#endregion
 //#region ../remote-bindings/dist/index.mjs
 var import_undici = require_undici();
-var version = "0.0.23";
+var version = "0.0.25";
 var NoDefaultValueProvided = class extends UserError$1 {
 	constructor() {
 		super("This command cannot be run in a non-interactive context", { telemetryMessage: "remote bindings prompt default missing" });
@@ -61647,10 +62146,6 @@ const KnownBindingSchema = z$1.discriminatedUnion("type", [
 		const value = input;
 		return value.tunnelId !== void 0 && value.networkId !== void 0 ? `"vpc-network" bindings must specify exactly one of "tunnelId" or "networkId", not both` : `"vpc-network" bindings must specify either "tunnelId" or "networkId"`;
 	} }),
-	z$1.strictObject({
-		type: z$1.literal("web-search"),
-		dev: RemoteBindingDevSchema.optional()
-	}),
 	WorkerBindingSchema,
 	z$1.strictObject({ type: z$1.literal("worker-loader") })
 ]);
@@ -61689,8 +62184,7 @@ const SINGLETON_BINDING_TYPES = new Set([
 	"images",
 	"media",
 	"stream",
-	"version-metadata",
-	"web-search"
+	"version-metadata"
 ]);
 const listFormatter = new Intl.ListFormat("en-US");
 function validateSingletonBindings(env$2, ctx) {
@@ -61709,6 +62203,136 @@ function validateSingletonBindings(env$2, ctx) {
 	});
 }
 const EnvSchema = z$1.record(z$1.string(), BindingSchema).superRefine(validateSingletonBindings).optional();
+const ContainerImageDockerfileSchema = z$1.strictObject({
+	dockerfile: z$1.string().min(1),
+	buildContext: z$1.string().optional(),
+	buildVars: z$1.record(z$1.string(), z$1.string()).optional()
+});
+const ContainerImageReferenceSchema = z$1.strictObject({ reference: z$1.string().min(1) });
+const ContainerImageLocalReferenceSchema = z$1.strictObject({ localReference: z$1.string().min(1) });
+const InputContainerImageSchema = z$1.union([ContainerImageDockerfileSchema, ContainerImageReferenceSchema]);
+const OutputContainerImageSchema = z$1.union([ContainerImageReferenceSchema, ContainerImageLocalReferenceSchema]);
+const VALID_ROLLOUT_STEP_PERCENTAGES = new Set([
+	5,
+	10,
+	20,
+	25,
+	50,
+	100
+]);
+const ContainerRolloutStepPercentageSchema = z$1.union([z$1.number(), z$1.array(z$1.number())]).superRefine((stepPercentage, ctx) => {
+	if (typeof stepPercentage === "number") {
+		if (!VALID_ROLLOUT_STEP_PERCENTAGES.has(stepPercentage)) ctx.addIssue({
+			code: "custom",
+			message: "A rollout step percentage must be one of 5, 10, 20, 25, 50, or 100"
+		});
+		return;
+	}
+	if (stepPercentage.length === 0) {
+		ctx.addIssue({
+			code: "custom",
+			message: "A rollout must contain at least one step percentage"
+		});
+		return;
+	}
+	for (const [index, step] of stepPercentage.entries()) {
+		if (step < 10 || step > 100) ctx.addIssue({
+			code: "custom",
+			path: [index],
+			message: "Rollout step percentages must be between 10 and 100"
+		});
+		const previousStep = stepPercentage[index - 1];
+		if (previousStep !== void 0 && step < previousStep) ctx.addIssue({
+			code: "custom",
+			path: [index],
+			message: "Rollout step percentages must be in ascending order"
+		});
+	}
+	const lastIndex = stepPercentage.length - 1;
+	if (stepPercentage[lastIndex] !== 100) ctx.addIssue({
+		code: "custom",
+		path: [lastIndex],
+		message: "The final rollout step percentage must be 100"
+	});
+});
+function validateContainerRelationships(container, ctx) {
+	const stepPercentage = container.rollout?.stepPercentage;
+	if (Array.isArray(stepPercentage) && container.maxInstances !== void 0 && stepPercentage.length > container.maxInstances) ctx.addIssue({
+		code: "custom",
+		path: ["rollout", "stepPercentage"],
+		message: "A rollout cannot contain more steps than the maximum number of instances"
+	});
+}
+const ContainerObservabilityBaseSchema = z$1.strictObject({
+	enabled: z$1.boolean().optional(),
+	logs: z$1.strictObject({ enabled: z$1.boolean().optional() }).optional()
+});
+const ContainerObservabilitySchema = z$1.union([ContainerObservabilityBaseSchema.extend({ targetInstancePercentage: z$1.number().min(0).max(100).optional() }), ContainerObservabilityBaseSchema.extend({ targetInstanceCount: z$1.number().int().nonnegative().optional() })]);
+const BaseContainerSchema = z$1.strictObject({
+	type: z$1.literal("container"),
+	name: z$1.string().min(1),
+	observability: ContainerObservabilitySchema.optional(),
+	unsafe: z$1.record(z$1.string(), z$1.unknown()).optional()
+});
+const StandardContainerBaseSchema = BaseContainerSchema.extend({
+	maxInstances: z$1.number().int().nonnegative().default(20),
+	instanceType: z$1.union([z$1.enum([
+		"basic",
+		"lite",
+		"standard-1",
+		"standard-2",
+		"standard-3",
+		"standard-4"
+	]), z$1.strictObject({
+		vcpu: z$1.number().min(.0625).optional(),
+		memoryMib: z$1.number().nonnegative().optional(),
+		diskMb: z$1.number().nonnegative().optional()
+	})]).optional(),
+	schedulingPolicy: z$1.enum(["default", "regional"]).optional(),
+	ssh: z$1.strictObject({
+		enabled: z$1.boolean(),
+		port: z$1.number().int().min(1).max(65535).optional()
+	}).optional(),
+	authorizedKeys: z$1.array(z$1.strictObject({
+		name: z$1.string(),
+		publicKey: z$1.string()
+	})).optional(),
+	constraints: z$1.strictObject({
+		regions: z$1.array(z$1.enum([
+			"ENAM",
+			"WNAM",
+			"EEUR",
+			"WEUR",
+			"APAC",
+			"SAM",
+			"ME",
+			"OC",
+			"AFR"
+		])).optional(),
+		jurisdiction: z$1.enum(["eu", "fedramp"]).optional()
+	}).optional(),
+	rollout: z$1.strictObject({
+		kind: z$1.enum([
+			"full-auto",
+			"none",
+			"full-manual"
+		]).optional(),
+		stepPercentage: ContainerRolloutStepPercentageSchema.optional(),
+		activeGracePeriod: z$1.number().nonnegative().optional()
+	}).optional()
+});
+const DurableObjectContainerBaseSchema = BaseContainerSchema.extend({ schedulingPolicy: z$1.literal("durable-object") });
+/**
+* Input Container schema — validates user-authored `cloudflare.config.ts`
+* Container exports. Dockerfiles are built by the consuming build tool.
+*/
+const InputContainerSchema = z$1.union([StandardContainerBaseSchema.extend({ image: InputContainerImageSchema }).superRefine(validateContainerRelationships), DurableObjectContainerBaseSchema.extend({ images: z$1.record(z$1.string(), InputContainerImageSchema).optional() })]);
+/**
+* Output Container schema — validates Container configs in the Build Output
+* Specification, after any Dockerfile has been built into a local or remote
+* image reference.
+*/
+const OutputContainerSchema = z$1.union([StandardContainerBaseSchema.extend({ image: OutputContainerImageSchema }).superRefine(validateContainerRelationships), DurableObjectContainerBaseSchema.extend({ images: z$1.record(z$1.string(), OutputContainerImageSchema).optional() })]);
 const DurableObjectCreatedExportSchema = z$1.strictObject({
 	type: z$1.literal("durable-object"),
 	state: z$1.literal("created").optional(),
@@ -61887,8 +62511,13 @@ const InputSettingsSchema = z$1.strictObject({
 * Build Output Specification. Adds the `mode` the build was produced in.
 */
 const OutputSettingsSchema = InputSettingsSchema.extend({ mode: z$1.string().optional() });
+const DEFAULT_EXPORT_NAME = "default";
 const SETTINGS_EXPORT_NAME = "settings";
-const SUPPORTED_EXPORT_TYPES = new Set(["worker", "settings"]);
+const SUPPORTED_EXPORT_TYPES = new Set([
+	"container",
+	"worker",
+	"settings"
+]);
 function invalidConfigExportMessage(exportName) {
 	return `The \`${exportName}\` export is not a supported export type. Move constants, helper functions, and other unsupported exports to a separate module.`;
 }
@@ -61905,6 +62534,15 @@ const ConfigExportsTypeSchema = z$1.record(z$1.string(), z$1.unknown()).check((c
 			});
 			continue;
 		}
+		if (key === DEFAULT_EXPORT_NAME && type !== "worker") {
+			ctx.issues.push({
+				code: "custom",
+				input: value,
+				path: [key],
+				message: `The \`${DEFAULT_EXPORT_NAME}\` export is reserved for a \`worker\` config; found a \`${type}\` config.`
+			});
+			continue;
+		}
 		const isSettingsName = key === SETTINGS_EXPORT_NAME;
 		const isSettingsType = type === "settings";
 		if (isSettingsType && !isSettingsName) ctx.issues.push({
@@ -62053,18 +62691,26 @@ function createFatalError(message, isJson, options) {
 	return new FatalError(`${message}`, options);
 }
 __name(createFatalError, "createFatalError");
+const ROLLOUT_KIND_MAP = {
+	"full-auto": "full_auto",
+	"full-manual": "full_manual",
+	none: "none"
+};
 /**
 * Convert a parsed `@cloudflare/config` config into a Wrangler `RawConfig`.
 *
-* The caller is responsible for unwrapping any function/promise wrapper around
-* the config and validating it against `InputWorkerSchema` before passing it in.
+* The caller is responsible for unwrapping any function/promise wrappers and
+* validating the configs against their corresponding input schemas before
+* passing them in.
 *
 * @param workerConfig The parsed (post-validation) Worker config.
 * @param settingsConfig The optional parsed settings config, whose fields
 * are merged onto the result.
+* @param containerExports The parsed Container exports to include in the
+* result.
 * @returns The corresponding Wrangler `RawConfig`.
 */
-function convertToWranglerConfig(workerConfig, settingsConfig) {
+function convertToWranglerConfig(workerConfig, settingsConfig, containerExports = []) {
 	const result = {};
 	convertTopLevel(workerConfig, result);
 	convertBindingsAndAssets(workerConfig, result);
@@ -62073,8 +62719,50 @@ function convertToWranglerConfig(workerConfig, settingsConfig) {
 	convertTriggers(workerConfig, result);
 	convertTailConsumers(workerConfig, result);
 	if (settingsConfig !== void 0) convertSettings(settingsConfig, result);
+	if (containerExports.length > 0) result.containers = containerExports.map((container) => convertContainer(container));
 	return result;
 }
+function convertContainer(container) {
+	if (container.schedulingPolicy === "durable-object") throw new UserError("Durable Object-managed Containers are not currently supported by `convertToWranglerConfig()`.", { telemetryMessage: false });
+	const converted = { name: container.name };
+	if (container.observability !== void 0) converted.observability = convertContainerObservability(container.observability);
+	if (container.unsafe !== void 0) converted.unsafe = container.unsafe;
+	converted.image = "dockerfile" in container.image ? container.image.dockerfile : container.image.reference;
+	converted.max_instances = container.maxInstances;
+	if ("dockerfile" in container.image) {
+		if (container.image.buildContext !== void 0) converted.image_build_context = container.image.buildContext;
+		if (container.image.buildVars !== void 0) converted.image_vars = container.image.buildVars;
+	}
+	if (container.instanceType !== void 0) if (typeof container.instanceType === "string") converted.instance_type = container.instanceType;
+	else {
+		const instanceType = {};
+		if (container.instanceType.vcpu !== void 0) instanceType.vcpu = container.instanceType.vcpu;
+		if (container.instanceType.memoryMib !== void 0) instanceType.memory_mib = container.instanceType.memoryMib;
+		if (container.instanceType.diskMb !== void 0) instanceType.disk_mb = container.instanceType.diskMb;
+		converted.instance_type = instanceType;
+	}
+	if (container.schedulingPolicy !== void 0) converted.scheduling_policy = container.schedulingPolicy;
+	if (container.ssh !== void 0) converted.ssh = container.ssh;
+	if (container.authorizedKeys !== void 0) converted.authorized_keys = container.authorizedKeys.map(({ name, publicKey }) => ({
+		name,
+		public_key: publicKey
+	}));
+	if (container.constraints !== void 0) converted.constraints = container.constraints;
+	if (container.rollout !== void 0) {
+		if (container.rollout.kind !== void 0) converted.rollout_kind = ROLLOUT_KIND_MAP[container.rollout.kind];
+		if (container.rollout.stepPercentage !== void 0) converted.rollout_step_percentage = container.rollout.stepPercentage;
+		if (container.rollout.activeGracePeriod !== void 0) converted.rollout_active_grace_period = container.rollout.activeGracePeriod;
+	}
+	return converted;
+}
+function convertContainerObservability(observability) {
+	const converted = {};
+	if (observability.enabled !== void 0) converted.enabled = observability.enabled;
+	if (observability.logs !== void 0) converted.logs = observability.logs;
+	if ("targetInstancePercentage" in observability && observability.targetInstancePercentage !== void 0) converted.target_instance_percentage = observability.targetInstancePercentage;
+	if ("targetInstanceCount" in observability && observability.targetInstanceCount !== void 0) converted.target_instance_count = observability.targetInstanceCount;
+	return converted;
+}
 /**
 * Merge a parsed settings config's fields (`account_id`, `compliance_region`)
 * onto an existing Wrangler `RawConfig`.
@@ -62402,12 +63090,6 @@ function convertBindingsAndAssets(config$1, result) {
 					remote: binding.dev?.remote
 				}));
 				break;
-			case "web-search":
-				result.websearch = omitUndefined({
-					binding: name,
-					remote: binding.dev?.remote
-				});
-				break;
 			case "worker":
 				services.push(omitUndefined({
 					binding: name,
@@ -62742,6 +63424,9 @@ function isRecord(value) {
 function isConfigReference(value) {
 	return typeof value === "function" || isRecord(value);
 }
+function normalizeConfigReference(reference, resolved, expectedType) {
+	return isRecord(resolved) && resolved.type === expectedType && typeof resolved.name === "string" ? resolved.name : reference;
+}
 function createDefinitionResolver(ctx) {
 	const resolvedDefinitions = /* @__PURE__ */ new Map();
 	return (input) => {
@@ -62762,7 +63447,7 @@ async function normalizeWorkerReferences(resolved, resolveDefinition) {
 		const target = await resolveDefinition(binding.worker);
 		env$2[bindingName] = {
 			...binding,
-			worker: isRecord(target) ? target.name : void 0
+			worker: normalizeConfigReference(binding.worker, target, "worker")
 		};
 	}
 	return {
@@ -62770,22 +63455,151 @@ async function normalizeWorkerReferences(resolved, resolveDefinition) {
 		env: env$2
 	};
 }
+async function normalizeContainerReferences(resolved, resolveDefinition, resolvedExports) {
+	const issues = [];
+	if (!isRecord(resolved) || !isRecord(resolved.exports)) return {
+		value: resolved,
+		issues
+	};
+	const workerExports = { ...resolved.exports };
+	for (const [exportName, workerExport] of Object.entries(workerExports)) {
+		if (!isRecord(workerExport) || workerExport.type !== "durable-object" || workerExport.container === void 0) continue;
+		const reference = workerExport.container;
+		if (typeof reference === "string") {
+			issues.push({
+				code: "custom",
+				input: reference,
+				path: [
+					"exports",
+					exportName,
+					"container"
+				],
+				message: "Container provided as a string. Reference an exported Container definition instead."
+			});
+			workerExports[exportName] = {
+				...workerExport,
+				container: void 0
+			};
+			continue;
+		}
+		const target = await resolveDefinition(reference);
+		if (isRecord(target) && target.type === "container" && typeof target.name === "string" && !Object.values(resolvedExports).includes(target)) {
+			issues.push({
+				code: "custom",
+				input: reference,
+				path: [
+					"exports",
+					exportName,
+					"container"
+				],
+				message: `The referenced Container "${target.name}" is not exported.`
+			});
+			workerExports[exportName] = {
+				...workerExport,
+				container: void 0
+			};
+			continue;
+		}
+		workerExports[exportName] = {
+			...workerExport,
+			container: normalizeConfigReference(reference, target, "container")
+		};
+	}
+	return {
+		value: {
+			...resolved,
+			exports: workerExports
+		},
+		issues
+	};
+}
+async function normalizeConfigReferences(resolved, resolveDefinition, resolvedExports) {
+	return normalizeContainerReferences(await normalizeWorkerReferences(resolved, resolveDefinition), resolveDefinition, resolvedExports);
+}
 function prefixIssues(issues, prefix) {
 	return issues.map((issue$1) => ({
 		...issue$1,
 		path: [prefix, ...issue$1.path]
 	}));
 }
+function validateUniqueResourceNames(configExports) {
+	const issues = [];
+	const exportNameByResourceName = {
+		container: /* @__PURE__ */ new Map(),
+		worker: /* @__PURE__ */ new Map()
+	};
+	for (const [exportName, config$1] of Object.entries(configExports)) {
+		if (config$1.type !== "container" && config$1.type !== "worker") continue;
+		const resourceType = config$1.type === "container" ? "Container" : "Worker";
+		const exportNames = exportNameByResourceName[config$1.type];
+		const previousExportName = exportNames.get(config$1.name);
+		if (previousExportName !== void 0) {
+			issues.push({
+				code: "custom",
+				input: config$1.name,
+				path: [exportName, "name"],
+				message: `The ${resourceType} name "${config$1.name}" is also used by the "${previousExportName}" export. ${resourceType} names must be unique.`
+			});
+			continue;
+		}
+		exportNames.set(config$1.name, exportName);
+	}
+	return issues;
+}
+function validateContainerExportLinks(configExports) {
+	const issues = [];
+	const containerNames = /* @__PURE__ */ new Set();
+	for (const config$1 of Object.values(configExports)) if (config$1.type === "container") containerNames.add(config$1.name);
+	const firstReferenceByContainerName = /* @__PURE__ */ new Map();
+	for (const [workerExportName, config$1] of Object.entries(configExports)) {
+		if (config$1.type !== "worker") continue;
+		for (const [durableObjectExportName, workerExport] of Object.entries(config$1.exports ?? {})) {
+			if (workerExport.type !== "durable-object" || !("container" in workerExport) || workerExport.container === void 0) continue;
+			const containerName = workerExport.container;
+			const path$3 = [
+				workerExportName,
+				"exports",
+				durableObjectExportName,
+				"container"
+			];
+			if (!containerNames.has(containerName)) {
+				issues.push({
+					code: "custom",
+					input: containerName,
+					path: path$3,
+					message: `The Container "${containerName}" is not exported from this configuration.`
+				});
+				continue;
+			}
+			const firstReference = firstReferenceByContainerName.get(containerName);
+			if (firstReference !== void 0) {
+				issues.push({
+					code: "custom",
+					input: containerName,
+					path: path$3,
+					message: `The Container "${containerName}" is already referenced by "${firstReference.workerExportName}.exports.${firstReference.durableObjectExportName}". A Container can only be linked to one Durable Object.`
+				});
+				continue;
+			}
+			firstReferenceByContainerName.set(containerName, {
+				workerExportName,
+				durableObjectExportName
+			});
+		}
+	}
+	return issues;
+}
 /**
 * Resolve and validate loaded `cloudflare.config.ts` exports.
 *
-* Config inputs are resolved once by identity. Top-level Worker exports are
-* also parsed once by identity; unexported references are resolved only far
-* enough to replace the reference with the Worker's name.
+* Config inputs are resolved once by identity. Top-level Worker and Container
+* exports are also parsed once by identity. References are resolved only far
+* enough to replace them with resource names, then Container links are
+* validated across the exported resources.
 */
 async function resolveAndValidateConfigExports(exports$2, ctx) {
 	const resolveDefinition = createDefinitionResolver(ctx);
-	const parsedWorkers = /* @__PURE__ */ new Map();
+	const parsedResources = /* @__PURE__ */ new Map();
 	const resolvedExports = {};
 	for (const [name, input] of Object.entries(exports$2)) resolvedExports[name] = await resolveDefinition(input);
 	const typeResult = ConfigExportsTypeSchema.safeParse(resolvedExports);
@@ -62799,17 +63613,20 @@ async function resolveAndValidateConfigExports(exports$2, ctx) {
 	for (const [name, input] of Object.entries(exports$2)) {
 		const resolved = resolvedExports[name];
 		if (!isRecord(resolved)) continue;
-		if (resolved.type === "worker") {
-			let result = parsedWorkers.get(input);
-			if (!result) {
-				result = InputWorkerSchema.safeParse(await normalizeWorkerReferences(resolved, resolveDefinition));
-				parsedWorkers.set(input, result);
-				if (!result.success) issues.push(...prefixIssues(result.error.issues, name));
-			}
-			if (result.success) data[name] = result.data;
-			continue;
-		}
-	}
+		if (resolved.type !== "worker" && resolved.type !== "container") continue;
+		let result = parsedResources.get(input);
+		if (!result) {
+			if (resolved.type === "worker") {
+				const normalized = await normalizeConfigReferences(resolved, resolveDefinition, resolvedExports);
+				issues.push(...prefixIssues(normalized.issues, name));
+				result = InputWorkerSchema.safeParse(normalized.value);
+			} else result = InputContainerSchema.safeParse(resolved);
+			parsedResources.set(input, result);
+			if (!result.success) issues.push(...prefixIssues(result.error.issues, name));
+		}
+		if (result.success) data[name] = result.data;
+	}
+	issues.push(...validateUniqueResourceNames(data), ...validateContainerExportLinks(data));
 	return issues.length > 0 ? {
 		success: false,
 		error: new z$1.ZodError(issues)