@cloudflare/workers-utils 0.44.0 → 0.45.1

package/dist/browser.d.mts

@@ -77,6 +77,9 @@ type WorkerMetadataBinding = {
     type: "browser";
     name: string;
     raw?: boolean;
+} | {
+    type: "analytics";
+    name: string;
 } | {
     type: "ai";
     name: string;
@@ -197,6 +200,10 @@ type WorkerMetadataBinding = {
     name: string;
     stream?: string;
     pipeline?: string;
+} | {
+    type: "k2";
+    name: string;
+    stream: string;
 } | {
     type: "secrets_store_secret";
     name: string;
@@ -1640,6 +1647,20 @@ interface EnvironmentNonInheritable {
         /** Whether the Browser binding should be remote or not in local development */
         remote?: boolean;
     } | undefined;
+    /**
+     * An Analytics SQL binding.
+     *
+     * NOTE: This field is not automatically inherited from the top level environment,
+     * and so must be specified in every named environment.
+     *
+     * @default {}
+     * @nonInheritable
+     */
+    analytics: {
+        binding: string;
+        /** Whether the binding should connect to the remote service during local development. */
+        remote?: boolean;
+    } | undefined;
     /**
      * Binding to the AI project.
      *
@@ -1825,6 +1846,21 @@ interface EnvironmentNonInheritable {
         /** Whether the pipeline should be remote or not in local development */
         remote?: boolean;
     }[];
+    /**
+     * K2 producer bindings. Create streams using the Dashboard or API.
+     *
+     * This field must be specified separately in each named environment.
+     * @default []
+     * @nonInheritable
+     */
+    k2: {
+        /** The binding name exposed on the Worker's env object. */
+        binding: string;
+        /** The ID of the K2 stream. */
+        stream: string;
+        /** Always uses the real stream in development. Set true to suppress the usage warning; false is unsupported. */
+        remote?: boolean;
+    }[];
     /**
      * Specifies Secret Store bindings that are bound to this Worker environment.
      *

package/dist/browser.mjs

@@ -2,7 +2,7 @@ var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
 // src/default-compat-date.ts
-var DEFAULT_COMPAT_DATE = "2026-09-25";
+var DEFAULT_COMPAT_DATE = "2026-10-01";
 
 // src/assert-never.ts
 function assertNever(_value) {
@@ -70,6 +70,13 @@ function mapWorkerMetadataBindings(bindings) {
           };
         }
         break;
+      case "analytics":
+        {
+          configObj.analytics = {
+            binding: binding.name
+          };
+        }
+        break;
       case "ai":
         {
           configObj.ai = {
@@ -325,6 +332,12 @@ function mapWorkerMetadataBindings(bindings) {
           }
         ];
         break;
+      case "k2":
+        configObj.k2 = [
+          ...configObj.k2 ?? [],
+          { binding: binding.name, stream: binding.stream }
+        ];
+        break;
       case "assets":
         configObj.assets = {
           binding: binding.name

package/dist/{compliance-CZ8Ownqu.d.mts → compliance-CADarBwY.d.mts}

@@ -238,6 +238,11 @@ interface CfBrowserBinding {
     raw?: boolean;
     remote?: boolean;
 }
+/** A binding to Analytics SQL. */
+interface CfAnalyticsSQLBinding {
+    binding: string;
+    remote?: boolean;
+}
 /**
  * A binding to the AI project
  */
@@ -465,6 +470,11 @@ interface CfPipeline {
     pipeline?: string;
     remote?: boolean;
 }
+interface CfK2Binding {
+    binding: string;
+    stream: string;
+    remote?: boolean;
+}
 interface CfUnsafeBinding {
     name: string;
     type: string;
@@ -661,6 +671,9 @@ type WorkerMetadataBinding = {
     type: "browser";
     name: string;
     raw?: boolean;
+} | {
+    type: "analytics";
+    name: string;
 } | {
     type: "ai";
     name: string;
@@ -781,6 +794,10 @@ type WorkerMetadataBinding = {
     name: string;
     stream?: string;
     pipeline?: string;
+} | {
+    type: "k2";
+    name: string;
+    stream: string;
 } | {
     type: "secrets_store_secret";
     name: string;
@@ -1082,6 +1099,8 @@ type Binding = {
 } | ({
     type: "browser";
 } & BindingOmit<CfBrowserBinding>) | ({
+    type: "analytics";
+} & BindingOmit<CfAnalyticsSQLBinding>) | ({
     type: "ai";
 } & BindingOmit<CfAIBinding>) | ({
     type: "images";
@@ -1126,6 +1145,8 @@ type Binding = {
 } & BindingOmit<CfMTlsCertificate>) | ({
     type: "pipeline";
 } & BindingOmit<CfPipeline>) | ({
+    type: "k2";
+} & BindingOmit<CfK2Binding>) | ({
     type: "secrets_store_secret";
 } & BindingOmit<CfSecretsStoreSecrets>) | ({
     type: "artifacts";
@@ -2702,6 +2723,20 @@ interface EnvironmentNonInheritable {
         /** Whether the Browser binding should be remote or not in local development */
         remote?: boolean;
     } | undefined;
+    /**
+     * An Analytics SQL binding.
+     *
+     * NOTE: This field is not automatically inherited from the top level environment,
+     * and so must be specified in every named environment.
+     *
+     * @default {}
+     * @nonInheritable
+     */
+    analytics: {
+        binding: string;
+        /** Whether the binding should connect to the remote service during local development. */
+        remote?: boolean;
+    } | undefined;
     /**
      * Binding to the AI project.
      *
@@ -2887,6 +2922,21 @@ interface EnvironmentNonInheritable {
         /** Whether the pipeline should be remote or not in local development */
         remote?: boolean;
     }[];
+    /**
+     * K2 producer bindings. Create streams using the Dashboard or API.
+     *
+     * This field must be specified separately in each named environment.
+     * @default []
+     * @nonInheritable
+     */
+    k2: {
+        /** The binding name exposed on the Worker's env object. */
+        binding: string;
+        /** The ID of the K2 stream. */
+        stream: string;
+        /** Always uses the real stream in development. Set true to suppress the usage warning; false is unsupported. */
+        remote?: boolean;
+    }[];
     /**
      * Specifies Secret Store bindings that are bound to this Worker environment.
      *
@@ -3733,4 +3783,4 @@ declare const getWranglerCacheDirFromEnv: () => string | undefined;
  */
 declare const getCloudflaredPathFromEnv: () => string | undefined;
 
-export { type CfLogfwdrBinding as $, type ApiCredentials as A, type Binding as B, type ComputedFields as C, type DurableObjectExport as D, type Exports as E, type CfAnalyticsEngineDataset as F, type CfArtifacts as G, type CfAssetsBinding as H, type CfBrowserBinding as I, type CfCapnp as J, type CfD1Database as K, type Logger as L, type CfDataBlobBindings as M, type CfDevPluginCfg as N, type CfDispatchNamespace as O, type CfDurableObject as P, type CfDurableObjectMigrations as Q, type RawConfig as R, type CfExports as S, type TailConsumer as T, type CfFlagship as U, type CfHelloWorld as V, type WorkerEntrypointExport as W, type CfHyperdrive as X, type CfImagesBinding as Y, type CfKvNamespace as Z, type CfLogfwdr as _, type RedirectedRawConfig as a, type Hook as a$, type CfMTlsCertificate as a0, type CfMediaBinding as a1, type CfModule as a2, type CfModuleType as a3, type CfPipeline as a4, type CfPlacement as a5, type CfQueue as a6, type CfR2Bucket as a7, type CfRateLimit as a8, type CfScriptFormat as a9, type CustomDomainRoute as aA, type DispatchNamespaceOutbound as aB, type DockerConfiguration as aC, type DurableObjectBindings as aD, type DurableObjectCodeUpdateStrategy as aE, type DurableObjectContainerImage as aF, type DurableObjectExportStorage as aG, type DurableObjectMigration as aH, type DurableObjectsConfig as aI, ENVIRONMENT_TAG_PREFIX as aJ, type Entry as aK, type Environment as aL, type EnvironmentNonInheritable as aM, type ExportsReconciliationEntryBase as aN, type ExportsReconciliationErrorDetail as aO, type ExportsReconciliationInfo as aP, type ExportsReconciliationRename as aQ, type ExportsReconciliationResult as aR, type ExportsReconciliationTransfer as aS, type ExportsReconciliationTransferPending as aT, type ExportsReconciliationWarning as aU, type FetchKVGetValueFetcher as aV, type FetchListResultFetcher as aW, type FetchPagedListResultFetcher as aX, type FetchResult as aY, type FetchResultFetcher as aZ, type File as a_, type CfSecretsStoreSecrets as aa, type CfSendEmailBindings as ab, type CfService as ac, type CfStreamBinding as ad, type CfTextBlobBindings as ae, type CfUnsafe as af, type CfUnsafeBinding as ag, type CfUserLimits as ah, type CfVars as ai, type CfVectorize as aj, type CfVersionMetadataBinding as ak, type CfVpcNetwork as al, type CfVpcService as am, type CfWasmModuleBindings as an, type CfWorkerContext as ao, type CfWorkerInit as ap, type CfWorkerLoader as aq, type CfWorkerSourceMap as ar, type CfWorkflow as as, type CloudchamberConfig as at, type ConfigFields as au, type ConfigModuleRuleType as av, type ConfiguredExport as aw, type ConnectHandler as ax, type ContainerEngine as ay, type ContainerObservability as az, type Config as b, getOutputFileDirectoryFromEnv as b$, type HookValues as b0, INHERIT_SYMBOL as b1, JSON_CONFIG_FORMATS as b2, type Json as b3, LOGGER_LEVELS as b4, type LegacyAssetPaths as b5, type LocalS3Credentials as b6, type LogLevel as b7, type LoggerLevel as b8, type NodeJSCompatMode as b9, fetchListResultBase as bA, fetchResultBase as bB, getBrowserRenderingHeadfulFromEnv as bC, getBuildConditionsFromEnv as bD, getBuildPlatformFromEnv as bE, getC3CommandFromEnv as bF, getCIGeneratePreviewAlias as bG, getCIMatchTag as bH, getCIOverrideName as bI, getCIOverrideNetworkModeHost as bJ, getCfFetchEnabledFromEnv as bK, getCfFetchPathFromEnv as bL, getCloudflareApiBaseUrl as bM, getCloudflareApiEnvironmentFromEnv as bN, getCloudflareComplianceRegion as bO, getCloudflareContainerRegistry as bP, getCloudflareEnv as bQ, getCloudflareIncludeProcessEnvFromEnv as bR, getCloudflareLoadDevVarsFromDotEnv as bS, getCloudflaredPathFromEnv as bT, getComplianceRegionSubdomain as bU, getD1ExtraLocationChoices as bV, getDisableConfigWatching as bW, getLocalExplorerEnabledFromEnv as bX, getLocalObservabilityEnabledFromEnv as bY, getNoSkillsUpdatePromptsFromEnv as bZ, getOpenNextDeployFromEnv as b_, type Observability as ba, PATH_TO_DEPLOY_CONFIG as bb, type PreviewsConfig as bc, type RawDevConfig as bd, type RawDurableObjectsConfig as be, type RawEnvironment as bf, type Rule as bg, SERVICE_TAG_PREFIX as bh, type ServiceFetch as bi, type ServiceMetadataRes as bj, type StartDevWorkerInput as bk, type StreamingTailConsumer as bl, type TcpConnectHandler as bm, type Trigger as bn, type UdpConnectHandler as bo, type UserLimits as bp, type ValidatedAssetsOptions as bq, type WorkflowBinding as br, type ZoneIdRoute as bs, type ZoneNameRoute as bt, addAuthorizationHeader as bu, defaultWranglerConfig as bv, extractAccountTag as bw, extractWAFBlockRayId as bx, fetchInternalBase as by, fetchKVGetValueBase as bz, type WorkflowExport as c, getOutputFilePathFromEnv as c0, getRegistryPath as c1, getSanitizeLogs as c2, getSubdomainMixedStateCheckDisabled as c3, getTraceHeader as c4, getWorkersCIBranchName as c5, getWranglerCacheDirFromEnv as c6, getWranglerHideBanner as c7, getWranglerSendErrorReportsFromEnv as c8, getWranglerSendMetricsFromEnv as c9, hasCursor as ca, hasMorePages as cb, isDoNotTrackEnabled as cc, isWAFBlockResponse as cd, maybeAddTraceHeader as ce, parseRetryAfterMs as cf, parseRetryAfterValue as cg, performApiFetchBase as ch, renderError as ci, throwFetchError as cj, truncate as ck, type ContainerApp as d, type WorkerMetadataBinding as e, type WorkerMetadata as f, type CfTailConsumer as g, type ComplianceConfig as h, type Route as i, ARTIFACTS_EVENT_TYPES as j, type Access as k, type ArtifactsEventTrigger as l, type ArtifactsEventType as m, type AssetConfigMetadata as n, type Assets as o, type AssetsOptions as p, type AsyncHook as q, type BinaryFile as r, COMPLIANCE_REGION_CONFIG_PUBLIC as s, COMPLIANCE_REGION_CONFIG_UNKNOWN as t, type CacheOptions as u, type CfAIBinding as v, type CfAISearch as w, type CfAISearchNamespace as x, type CfAccount as y, type CfAgentMemory as z };
+export { type CfKvNamespace as $, type ApiCredentials as A, type Binding as B, type ComputedFields as C, type DurableObjectExport as D, type Exports as E, type CfAnalyticsEngineDataset as F, type CfAnalyticsSQLBinding as G, type CfArtifacts as H, type CfAssetsBinding as I, type CfBrowserBinding as J, type CfCapnp as K, type Logger as L, type CfD1Database as M, type CfDataBlobBindings as N, type CfDevPluginCfg as O, type CfDispatchNamespace as P, type CfDurableObject as Q, type RawConfig as R, type CfDurableObjectMigrations as S, type TailConsumer as T, type CfExports as U, type CfFlagship as V, type WorkerEntrypointExport as W, type CfHelloWorld as X, type CfHyperdrive as Y, type CfImagesBinding as Z, type CfK2Binding as _, type RedirectedRawConfig as a, type FetchResultFetcher as a$, type CfLogfwdr as a0, type CfLogfwdrBinding as a1, type CfMTlsCertificate as a2, type CfMediaBinding as a3, type CfModule as a4, type CfModuleType as a5, type CfPipeline as a6, type CfPlacement as a7, type CfQueue as a8, type CfR2Bucket as a9, type ContainerEngine as aA, type ContainerObservability as aB, type CustomDomainRoute as aC, type DispatchNamespaceOutbound as aD, type DockerConfiguration as aE, type DurableObjectBindings as aF, type DurableObjectCodeUpdateStrategy as aG, type DurableObjectContainerImage as aH, type DurableObjectExportStorage as aI, type DurableObjectMigration as aJ, type DurableObjectsConfig as aK, ENVIRONMENT_TAG_PREFIX as aL, type Entry as aM, type Environment as aN, type EnvironmentNonInheritable as aO, type ExportsReconciliationEntryBase as aP, type ExportsReconciliationErrorDetail as aQ, type ExportsReconciliationInfo as aR, type ExportsReconciliationRename as aS, type ExportsReconciliationResult as aT, type ExportsReconciliationTransfer as aU, type ExportsReconciliationTransferPending as aV, type ExportsReconciliationWarning as aW, type FetchKVGetValueFetcher as aX, type FetchListResultFetcher as aY, type FetchPagedListResultFetcher as aZ, type FetchResult as a_, type CfRateLimit as aa, type CfScriptFormat as ab, type CfSecretsStoreSecrets as ac, type CfSendEmailBindings as ad, type CfService as ae, type CfStreamBinding as af, type CfTextBlobBindings as ag, type CfUnsafe as ah, type CfUnsafeBinding as ai, type CfUserLimits as aj, type CfVars as ak, type CfVectorize as al, type CfVersionMetadataBinding as am, type CfVpcNetwork as an, type CfVpcService as ao, type CfWasmModuleBindings as ap, type CfWorkerContext as aq, type CfWorkerInit as ar, type CfWorkerLoader as as, type CfWorkerSourceMap as at, type CfWorkflow as au, type CloudchamberConfig as av, type ConfigFields as aw, type ConfigModuleRuleType as ax, type ConfiguredExport as ay, type ConnectHandler as az, type Config as b, getNoSkillsUpdatePromptsFromEnv as b$, type File as b0, type Hook as b1, type HookValues as b2, INHERIT_SYMBOL as b3, JSON_CONFIG_FORMATS as b4, type Json as b5, LOGGER_LEVELS as b6, type LegacyAssetPaths as b7, type LocalS3Credentials as b8, type LogLevel as b9, fetchInternalBase as bA, fetchKVGetValueBase as bB, fetchListResultBase as bC, fetchResultBase as bD, getBrowserRenderingHeadfulFromEnv as bE, getBuildConditionsFromEnv as bF, getBuildPlatformFromEnv as bG, getC3CommandFromEnv as bH, getCIGeneratePreviewAlias as bI, getCIMatchTag as bJ, getCIOverrideName as bK, getCIOverrideNetworkModeHost as bL, getCfFetchEnabledFromEnv as bM, getCfFetchPathFromEnv as bN, getCloudflareApiBaseUrl as bO, getCloudflareApiEnvironmentFromEnv as bP, getCloudflareComplianceRegion as bQ, getCloudflareContainerRegistry as bR, getCloudflareEnv as bS, getCloudflareIncludeProcessEnvFromEnv as bT, getCloudflareLoadDevVarsFromDotEnv as bU, getCloudflaredPathFromEnv as bV, getComplianceRegionSubdomain as bW, getD1ExtraLocationChoices as bX, getDisableConfigWatching as bY, getLocalExplorerEnabledFromEnv as bZ, getLocalObservabilityEnabledFromEnv as b_, type LoggerLevel as ba, type NodeJSCompatMode as bb, type Observability as bc, PATH_TO_DEPLOY_CONFIG as bd, type PreviewsConfig as be, type RawDevConfig as bf, type RawDurableObjectsConfig as bg, type RawEnvironment as bh, type Rule as bi, SERVICE_TAG_PREFIX as bj, type ServiceFetch as bk, type ServiceMetadataRes as bl, type StartDevWorkerInput as bm, type StreamingTailConsumer as bn, type TcpConnectHandler as bo, type Trigger as bp, type UdpConnectHandler as bq, type UserLimits as br, type ValidatedAssetsOptions as bs, type WorkflowBinding as bt, type ZoneIdRoute as bu, type ZoneNameRoute as bv, addAuthorizationHeader as bw, defaultWranglerConfig as bx, extractAccountTag as by, extractWAFBlockRayId as bz, type WorkflowExport as c, getOpenNextDeployFromEnv as c0, getOutputFileDirectoryFromEnv as c1, getOutputFilePathFromEnv as c2, getRegistryPath as c3, getSanitizeLogs as c4, getSubdomainMixedStateCheckDisabled as c5, getTraceHeader as c6, getWorkersCIBranchName as c7, getWranglerCacheDirFromEnv as c8, getWranglerHideBanner as c9, getWranglerSendErrorReportsFromEnv as ca, getWranglerSendMetricsFromEnv as cb, hasCursor as cc, hasMorePages as cd, isDoNotTrackEnabled as ce, isWAFBlockResponse as cf, maybeAddTraceHeader as cg, parseRetryAfterMs as ch, parseRetryAfterValue as ci, performApiFetchBase as cj, renderError as ck, throwFetchError as cl, truncate as cm, type ContainerApp as d, type WorkerMetadataBinding as e, type WorkerMetadata as f, type CfTailConsumer as g, type ComplianceConfig as h, type Route as i, ARTIFACTS_EVENT_TYPES as j, type Access as k, type ArtifactsEventTrigger as l, type ArtifactsEventType as m, type AssetConfigMetadata as n, type Assets as o, type AssetsOptions as p, type AsyncHook as q, type BinaryFile as r, COMPLIANCE_REGION_CONFIG_PUBLIC as s, COMPLIANCE_REGION_CONFIG_UNKNOWN as t, type CacheOptions as u, type CfAIBinding as v, type CfAISearch as w, type CfAISearchNamespace as x, type CfAccount as y, type CfAgentMemory as z };

package/dist/compliance.d.mts

@@ -1,4 +1,4 @@
-export { s as COMPLIANCE_REGION_CONFIG_PUBLIC, t as COMPLIANCE_REGION_CONFIG_UNKNOWN, h as ComplianceConfig, bM as getCloudflareApiBaseUrl, bO as getCloudflareComplianceRegion, bP as getCloudflareContainerRegistry, bU as getComplianceRegionSubdomain } from './compliance-CZ8Ownqu.mjs';
+export { s as COMPLIANCE_REGION_CONFIG_PUBLIC, t as COMPLIANCE_REGION_CONFIG_UNKNOWN, h as ComplianceConfig, bO as getCloudflareApiBaseUrl, bQ as getCloudflareComplianceRegion, bR as getCloudflareContainerRegistry, bW as getComplianceRegionSubdomain } from './compliance-CADarBwY.mjs';
 import 'node:url';
 import 'undici';
 import '@cloudflare/workers-shared';

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { C as ComputedFields, B as Binding, R as RawConfig, b as Config, E as Exports, D as DurableObjectExport, W as WorkerEntrypointExport, c as WorkflowExport, d as ContainerApp, e as WorkerMetadataBinding, T as TailConsumer, f as WorkerMetadata, g as CfTailConsumer, L as Logger, A as ApiCredentials, h as ComplianceConfig, i as Route } from './compliance-CZ8Ownqu.mjs';
-export { j as ARTIFACTS_EVENT_TYPES, k as Access, l as ArtifactsEventTrigger, m as ArtifactsEventType, n as AssetConfigMetadata, o as Assets, p as AssetsOptions, q as AsyncHook, r as BinaryFile, s as COMPLIANCE_REGION_CONFIG_PUBLIC, t as COMPLIANCE_REGION_CONFIG_UNKNOWN, u as CacheOptions, v as CfAIBinding, w as CfAISearch, x as CfAISearchNamespace, y as CfAccount, z as CfAgentMemory, F as CfAnalyticsEngineDataset, G as CfArtifacts, H as CfAssetsBinding, I as CfBrowserBinding, J as CfCapnp, K as CfD1Database, M as CfDataBlobBindings, N as CfDevPluginCfg, O as CfDispatchNamespace, P as CfDurableObject, Q as CfDurableObjectMigrations, S as CfExports, U as CfFlagship, V as CfHelloWorld, X as CfHyperdrive, Y as CfImagesBinding, Z as CfKvNamespace, _ as CfLogfwdr, $ as CfLogfwdrBinding, a0 as CfMTlsCertificate, a1 as CfMediaBinding, a2 as CfModule, a3 as CfModuleType, a4 as CfPipeline, a5 as CfPlacement, a6 as CfQueue, a7 as CfR2Bucket, a8 as CfRateLimit, a9 as CfScriptFormat, aa as CfSecretsStoreSecrets, ab as CfSendEmailBindings, ac as CfService, ad as CfStreamBinding, ae as CfTextBlobBindings, af as CfUnsafe, ag as CfUnsafeBinding, ah as CfUserLimits, ai as CfVars, aj as CfVectorize, ak as CfVersionMetadataBinding, al as CfVpcNetwork, am as CfVpcService, an as CfWasmModuleBindings, ao as CfWorkerContext, ap as CfWorkerInit, aq as CfWorkerLoader, ar as CfWorkerSourceMap, as as CfWorkflow, at as CloudchamberConfig, au as ConfigFields, av as ConfigModuleRuleType, aw as ConfiguredExport, ax as ConnectHandler, ay as ContainerEngine, az as ContainerObservability, aA as CustomDomainRoute, aB as DispatchNamespaceOutbound, aC as DockerConfiguration, aD as DurableObjectBindings, aE as DurableObjectCodeUpdateStrategy, aF as DurableObjectContainerImage, aG as DurableObjectExportStorage, aH as DurableObjectMigration, aI as DurableObjectsConfig, aJ as ENVIRONMENT_TAG_PREFIX, aK as Entry, aL as Environment, aM as EnvironmentNonInheritable, aN as ExportsReconciliationEntryBase, aO as ExportsReconciliationErrorDetail, aP as ExportsReconciliationInfo, aQ as ExportsReconciliationRename, aR as ExportsReconciliationResult, aS as ExportsReconciliationTransfer, aT as ExportsReconciliationTransferPending, aU as ExportsReconciliationWarning, aV as FetchKVGetValueFetcher, aW as FetchListResultFetcher, aX as FetchPagedListResultFetcher, aY as FetchResult, aZ as FetchResultFetcher, a_ as File, a$ as Hook, b0 as HookValues, b1 as INHERIT_SYMBOL, b2 as JSON_CONFIG_FORMATS, b3 as Json, b4 as LOGGER_LEVELS, b5 as LegacyAssetPaths, b6 as LocalS3Credentials, b7 as LogLevel, b8 as LoggerLevel, b9 as NodeJSCompatMode, ba as Observability, bb as PATH_TO_DEPLOY_CONFIG, bc as PreviewsConfig, bd as RawDevConfig, be as RawDurableObjectsConfig, bf as RawEnvironment, a as RedirectedRawConfig, bg as Rule, bh as SERVICE_TAG_PREFIX, bi as ServiceFetch, bj as ServiceMetadataRes, bk as StartDevWorkerInput, bl as StreamingTailConsumer, bm as TcpConnectHandler, bn as Trigger, bo as UdpConnectHandler, bp as UserLimits, bq as ValidatedAssetsOptions, br as WorkflowBinding, bs as ZoneIdRoute, bt as ZoneNameRoute, bu as addAuthorizationHeader, bv as defaultWranglerConfig, bw as extractAccountTag, bx as extractWAFBlockRayId, by as fetchInternalBase, bz as fetchKVGetValueBase, bA as fetchListResultBase, bB as fetchResultBase, bC as getBrowserRenderingHeadfulFromEnv, bD as getBuildConditionsFromEnv, bE as getBuildPlatformFromEnv, bF as getC3CommandFromEnv, bG as getCIGeneratePreviewAlias, bH as getCIMatchTag, bI as getCIOverrideName, bJ as getCIOverrideNetworkModeHost, bK as getCfFetchEnabledFromEnv, bL as getCfFetchPathFromEnv, bM as getCloudflareApiBaseUrl, bN as getCloudflareApiEnvironmentFromEnv, bO as getCloudflareComplianceRegion, bP as getCloudflareContainerRegistry, bQ as getCloudflareEnv, bR as getCloudflareIncludeProcessEnvFromEnv, bS as getCloudflareLoadDevVarsFromDotEnv, bT as getCloudflaredPathFromEnv, bU as getComplianceRegionSubdomain, bV as getD1ExtraLocationChoices, bW as getDisableConfigWatching, bX as getLocalExplorerEnabledFromEnv, bY as getLocalObservabilityEnabledFromEnv, bZ as getNoSkillsUpdatePromptsFromEnv, b_ as getOpenNextDeployFromEnv, b$ as getOutputFileDirectoryFromEnv, c0 as getOutputFilePathFromEnv, c1 as getRegistryPath, c2 as getSanitizeLogs, c3 as getSubdomainMixedStateCheckDisabled, c4 as getTraceHeader, c5 as getWorkersCIBranchName, c6 as getWranglerCacheDirFromEnv, c7 as getWranglerHideBanner, c8 as getWranglerSendErrorReportsFromEnv, c9 as getWranglerSendMetricsFromEnv, ca as hasCursor, cb as hasMorePages, cc as isDoNotTrackEnabled, cd as isWAFBlockResponse, ce as maybeAddTraceHeader, cf as parseRetryAfterMs, cg as parseRetryAfterValue, ch as performApiFetchBase, ci as renderError, cj as throwFetchError, ck as truncate } from './compliance-CZ8Ownqu.mjs';
+import { C as ComputedFields, B as Binding, R as RawConfig, b as Config, E as Exports, D as DurableObjectExport, W as WorkerEntrypointExport, c as WorkflowExport, d as ContainerApp, e as WorkerMetadataBinding, T as TailConsumer, f as WorkerMetadata, g as CfTailConsumer, L as Logger, A as ApiCredentials, h as ComplianceConfig, i as Route } from './compliance-CADarBwY.mjs';
+export { j as ARTIFACTS_EVENT_TYPES, k as Access, l as ArtifactsEventTrigger, m as ArtifactsEventType, n as AssetConfigMetadata, o as Assets, p as AssetsOptions, q as AsyncHook, r as BinaryFile, s as COMPLIANCE_REGION_CONFIG_PUBLIC, t as COMPLIANCE_REGION_CONFIG_UNKNOWN, u as CacheOptions, v as CfAIBinding, w as CfAISearch, x as CfAISearchNamespace, y as CfAccount, z as CfAgentMemory, F as CfAnalyticsEngineDataset, G as CfAnalyticsSQLBinding, H as CfArtifacts, I as CfAssetsBinding, J as CfBrowserBinding, K as CfCapnp, M as CfD1Database, N as CfDataBlobBindings, O as CfDevPluginCfg, P as CfDispatchNamespace, Q as CfDurableObject, S as CfDurableObjectMigrations, U as CfExports, V as CfFlagship, X as CfHelloWorld, Y as CfHyperdrive, Z as CfImagesBinding, _ as CfK2Binding, $ as CfKvNamespace, a0 as CfLogfwdr, a1 as CfLogfwdrBinding, a2 as CfMTlsCertificate, a3 as CfMediaBinding, a4 as CfModule, a5 as CfModuleType, a6 as CfPipeline, a7 as CfPlacement, a8 as CfQueue, a9 as CfR2Bucket, aa as CfRateLimit, ab as CfScriptFormat, ac as CfSecretsStoreSecrets, ad as CfSendEmailBindings, ae as CfService, af as CfStreamBinding, ag as CfTextBlobBindings, ah as CfUnsafe, ai as CfUnsafeBinding, aj as CfUserLimits, ak as CfVars, al as CfVectorize, am as CfVersionMetadataBinding, an as CfVpcNetwork, ao as CfVpcService, ap as CfWasmModuleBindings, aq as CfWorkerContext, ar as CfWorkerInit, as as CfWorkerLoader, at as CfWorkerSourceMap, au as CfWorkflow, av as CloudchamberConfig, aw as ConfigFields, ax as ConfigModuleRuleType, ay as ConfiguredExport, az as ConnectHandler, aA as ContainerEngine, aB as ContainerObservability, aC as CustomDomainRoute, aD as DispatchNamespaceOutbound, aE as DockerConfiguration, aF as DurableObjectBindings, aG as DurableObjectCodeUpdateStrategy, aH as DurableObjectContainerImage, aI as DurableObjectExportStorage, aJ as DurableObjectMigration, aK as DurableObjectsConfig, aL as ENVIRONMENT_TAG_PREFIX, aM as Entry, aN as Environment, aO as EnvironmentNonInheritable, aP as ExportsReconciliationEntryBase, aQ as ExportsReconciliationErrorDetail, aR as ExportsReconciliationInfo, aS as ExportsReconciliationRename, aT as ExportsReconciliationResult, aU as ExportsReconciliationTransfer, aV as ExportsReconciliationTransferPending, aW as ExportsReconciliationWarning, aX as FetchKVGetValueFetcher, aY as FetchListResultFetcher, aZ as FetchPagedListResultFetcher, a_ as FetchResult, a$ as FetchResultFetcher, b0 as File, b1 as Hook, b2 as HookValues, b3 as INHERIT_SYMBOL, b4 as JSON_CONFIG_FORMATS, b5 as Json, b6 as LOGGER_LEVELS, b7 as LegacyAssetPaths, b8 as LocalS3Credentials, b9 as LogLevel, ba as LoggerLevel, bb as NodeJSCompatMode, bc as Observability, bd as PATH_TO_DEPLOY_CONFIG, be as PreviewsConfig, bf as RawDevConfig, bg as RawDurableObjectsConfig, bh as RawEnvironment, a as RedirectedRawConfig, bi as Rule, bj as SERVICE_TAG_PREFIX, bk as ServiceFetch, bl as ServiceMetadataRes, bm as StartDevWorkerInput, bn as StreamingTailConsumer, bo as TcpConnectHandler, bp as Trigger, bq as UdpConnectHandler, br as UserLimits, bs as ValidatedAssetsOptions, bt as WorkflowBinding, bu as ZoneIdRoute, bv as ZoneNameRoute, bw as addAuthorizationHeader, bx as defaultWranglerConfig, by as extractAccountTag, bz as extractWAFBlockRayId, bA as fetchInternalBase, bB as fetchKVGetValueBase, bC as fetchListResultBase, bD as fetchResultBase, bE as getBrowserRenderingHeadfulFromEnv, bF as getBuildConditionsFromEnv, bG as getBuildPlatformFromEnv, bH as getC3CommandFromEnv, bI as getCIGeneratePreviewAlias, bJ as getCIMatchTag, bK as getCIOverrideName, bL as getCIOverrideNetworkModeHost, bM as getCfFetchEnabledFromEnv, bN as getCfFetchPathFromEnv, bO as getCloudflareApiBaseUrl, bP as getCloudflareApiEnvironmentFromEnv, bQ as getCloudflareComplianceRegion, bR as getCloudflareContainerRegistry, bS as getCloudflareEnv, bT as getCloudflareIncludeProcessEnvFromEnv, bU as getCloudflareLoadDevVarsFromDotEnv, bV as getCloudflaredPathFromEnv, bW as getComplianceRegionSubdomain, bX as getD1ExtraLocationChoices, bY as getDisableConfigWatching, bZ as getLocalExplorerEnabledFromEnv, b_ as getLocalObservabilityEnabledFromEnv, b$ as getNoSkillsUpdatePromptsFromEnv, c0 as getOpenNextDeployFromEnv, c1 as getOutputFileDirectoryFromEnv, c2 as getOutputFilePathFromEnv, c3 as getRegistryPath, c4 as getSanitizeLogs, c5 as getSubdomainMixedStateCheckDisabled, c6 as getTraceHeader, c7 as getWorkersCIBranchName, c8 as getWranglerCacheDirFromEnv, c9 as getWranglerHideBanner, ca as getWranglerSendErrorReportsFromEnv, cb as getWranglerSendMetricsFromEnv, cc as hasCursor, cd as hasMorePages, ce as isDoNotTrackEnabled, cf as isWAFBlockResponse, cg as maybeAddTraceHeader, ch as parseRetryAfterMs, ci as parseRetryAfterValue, cj as performApiFetchBase, ck as renderError, cl as throwFetchError, cm as truncate } from './compliance-CADarBwY.mjs';
 import * as jsoncParser from 'jsonc-parser';
 import { UserError, TelemetryMessage } from './errors.mjs';
 export { CommandLineArgsError, DeprecationError, FatalError, JsonFriendlyFatalError, MissingConfigError, createFatalError } from './errors.mjs';
@@ -100,7 +100,7 @@ declare const bucketFormatMessage = "Bucket names must begin and end with an alp
  * Config field names for bindings (e.g., "kv_namespaces", "d1_databases").
  * These are the keys used in Wrangler's config file
  */
-type ConfigBindingFieldName = "data_blobs" | "durable_objects" | "kv_namespaces" | "send_email" | "queues" | "d1_databases" | "vectorize" | "ai_search_namespaces" | "ai_search" | "agent_memory" | "hyperdrive" | "r2_buckets" | "logfwdr" | "services" | "analytics_engine_datasets" | "text_blobs" | "browser" | "ai" | "images" | "stream" | "media" | "version_metadata" | "unsafe" | "vars" | "wasm_modules" | "dispatch_namespaces" | "mtls_certificates" | "workflows" | "pipelines" | "secrets_store_secrets" | "artifacts" | "ratelimits" | "assets" | "unsafe_hello_world" | "flagship" | "worker_loaders" | "vpc_services" | "vpc_networks";
+type ConfigBindingFieldName = "data_blobs" | "durable_objects" | "kv_namespaces" | "send_email" | "queues" | "d1_databases" | "vectorize" | "ai_search_namespaces" | "ai_search" | "agent_memory" | "hyperdrive" | "r2_buckets" | "logfwdr" | "services" | "analytics_engine_datasets" | "text_blobs" | "browser" | "analytics" | "ai" | "images" | "stream" | "media" | "version_metadata" | "unsafe" | "vars" | "wasm_modules" | "dispatch_namespaces" | "mtls_certificates" | "workflows" | "pipelines" | "k2" | "secrets_store_secrets" | "artifacts" | "ratelimits" | "assets" | "unsafe_hello_world" | "flagship" | "worker_loaders" | "vpc_services" | "vpc_networks";
 /**
  * Get a friendly name for a binding type, handling unsafe bindings
  */
@@ -627,8 +627,8 @@ type VariableNames =
  | "CLOUDFLARE_API_BASE_URL"
 /** Set to "fedramp_high" for FedRAMP High compliance region. This will update the API/AUTH URLs used to make requests to Cloudflare. */
  | "CLOUDFLARE_COMPLIANCE_REGION"
-/** API token for R2 SQL service. */
- | "WRANGLER_R2_SQL_AUTH_TOKEN"
+/** API token for Basin SQL service. */
+ | "WRANGLER_BASIN_SQL_AUTH_TOKEN"
 /** Controls whether to fetch the cf.json file. Set to "false" or "0" to disable fetching and use fallback data. Defaults to "true". */
  | "CLOUDFLARE_CF_FETCH_ENABLED"
 /** Custom path for caching the cf.json file. Overrides the default node_modules/.mf/cf.json location. */

package/dist/index.mjs

@@ -2552,11 +2552,13 @@ var defaultWranglerConfig = {
   containers: void 0,
   send_email: [],
   browser: void 0,
+  analytics: void 0,
   unsafe: {},
   mtls_certificates: [],
   tail_consumers: void 0,
   streaming_tail_consumers: void 0,
   pipelines: [],
+  k2: [],
   vpc_services: [],
   vpc_networks: []
 };
@@ -3062,6 +3064,7 @@ var friendlyBindingNames = {
   analytics_engine_datasets: "Analytics Engine Dataset",
   text_blobs: "Text Blob",
   browser: "Browser Run",
+  analytics: "Analytics SQL",
   ai: "AI",
   images: "Images",
   stream: "Stream",
@@ -3074,6 +3077,7 @@ var friendlyBindingNames = {
   mtls_certificates: "mTLS Certificate",
   workflows: "Workflow",
   pipelines: "Pipeline",
+  k2: "K2 Stream",
   secrets_store_secrets: "Secrets Store Secret",
   artifacts: "Artifacts",
   ratelimits: "Rate Limit",
@@ -3094,6 +3098,7 @@ var bindingTypeFriendlyNames = {
   wasm_module: "Wasm Module",
   text_blob: "Text Blob",
   browser: "Browser Run",
+  analytics: "Analytics SQL",
   ai: "AI",
   images: "Images",
   stream: "Stream",
@@ -3115,6 +3120,7 @@ var bindingTypeFriendlyNames = {
   dispatch_namespace: "Dispatch Namespace",
   mtls_certificate: "mTLS Certificate",
   pipeline: "Pipeline",
+  k2: "K2 Stream",
   secrets_store_secret: "Secrets Store Secret",
   artifacts: "Artifacts",
   logfwdr: "logfwdr",
@@ -4482,6 +4488,16 @@ function normalizeAndValidateEnvironment(diagnostics, configPath, rawEnv, isDisp
       validateNamedSimpleBinding(envName),
       void 0
     ),
+    analytics: notInheritable(
+      diagnostics,
+      topLevelEnv,
+      rawConfig,
+      rawEnv,
+      envName,
+      "analytics",
+      validateNamedSimpleBinding(envName),
+      void 0
+    ),
     ai: notInheritable(
       diagnostics,
       topLevelEnv,
@@ -4532,6 +4548,16 @@ function normalizeAndValidateEnvironment(diagnostics, configPath, rawEnv, isDisp
       validateBindingArray(envName, validatePipelineBinding),
       []
     ),
+    k2: notInheritable(
+      diagnostics,
+      topLevelEnv,
+      rawConfig,
+      rawEnv,
+      envName,
+      "k2",
+      validateBindingArray(envName, validateK2Binding),
+      []
+    ),
     secrets_store_secrets: notInheritable(
       diagnostics,
       topLevelEnv,
@@ -5749,6 +5775,7 @@ var validateUnsafeBinding = /* @__PURE__ */ __name((diagnostics, field, value) =
       "data_blob",
       "text_blob",
       "browser",
+      "analytics",
       "ai",
       "ai_search_namespace",
       "ai_search",
@@ -5761,6 +5788,7 @@ var validateUnsafeBinding = /* @__PURE__ */ __name((diagnostics, field, value) =
       "logfwdr",
       "mtls_certificate",
       "pipeline",
+      "k2",
       "worker_loader",
       "vpc_service",
       "flagship",
@@ -7711,6 +7739,38 @@ var validatePipelineBinding = /* @__PURE__ */ __name((diagnostics, field, value)
   ]);
   return isValid;
 }, "validatePipelineBinding");
+var validateK2Binding = /* @__PURE__ */ __name((diagnostics, field, value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    diagnostics.errors.push(
+      `"${field}" bindings should be objects, but got ${JSON.stringify(value)}`
+    );
+    return false;
+  }
+  let isValid = true;
+  if (!isRequiredProperty(value, "binding", "string")) {
+    diagnostics.errors.push(`"${field}" must have a string "binding" field.`);
+    isValid = false;
+  }
+  if (!isRequiredProperty(value, "stream", "string")) {
+    diagnostics.errors.push(`"${field}" must have a string "stream" field.`);
+    isValid = false;
+  }
+  if (!isRemoteValid(value, field, diagnostics)) {
+    isValid = false;
+  }
+  if ("remote" in value && value.remote === false) {
+    diagnostics.errors.push(
+      `"${field}" does not support \`remote: false\`. K2 bindings always access remote resources; omit "remote" or set \`remote: true\`.`
+    );
+    isValid = false;
+  }
+  validateAdditionalProperties(diagnostics, field, Object.keys(value), [
+    "binding",
+    "stream",
+    "remote"
+  ]);
+  return isValid;
+}, "validateK2Binding");
 var validateSecretsStoreSecretBinding = /* @__PURE__ */ __name((diagnostics, field, value) => {
   if (typeof value !== "object" || value === null) {
     diagnostics.errors.push(
@@ -8001,11 +8061,13 @@ var validatePreviewsConfig = /* @__PURE__ */ __name((envName, configPath) => (di
     "streaming_tail_consumers",
     "unsafe",
     "browser",
+    "analytics",
     "ai",
     "images",
     "stream",
     "media",
     "pipelines",
+    "k2",
     "secrets_store_secrets",
     "artifacts",
     "unsafe_hello_world",
@@ -8155,6 +8217,14 @@ var validatePreviewsConfig = /* @__PURE__ */ __name((envName, configPath) => (di
       void 0
     ) && isValid;
   }
+  if (previews.analytics !== void 0) {
+    isValid = validateNamedSimpleBinding(envName)(
+      diagnostics,
+      `${field}.analytics`,
+      previews.analytics,
+      void 0
+    ) && isValid;
+  }
   if (previews.ai !== void 0) {
     isValid = validateAIBinding(envName)(
       diagnostics,
@@ -8199,6 +8269,12 @@ var validatePreviewsConfig = /* @__PURE__ */ __name((envName, configPath) => (di
     previews.secrets_store_secrets,
     void 0
   ) && isValid;
+  isValid = validateBindingArray(envName, validateK2Binding)(
+    diagnostics,
+    `${field}.k2`,
+    previews.k2,
+    void 0
+  ) && isValid;
   isValid = validateBindingArray(envName, validateArtifactsBinding)(
     diagnostics,
     `${field}.artifacts`,
@@ -9339,6 +9415,7 @@ var BINDING_LOCAL_SUPPORT = {
   mtls_certificate: "remote",
   dispatch_namespace: "remote",
   // Reach out to the @cloudflare/wrangler team before adding anything here
+  k2: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
   ai: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
   ai_search: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
   ai_search_namespace: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
@@ -9346,7 +9423,8 @@ var BINDING_LOCAL_SUPPORT = {
   artifacts: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
   vpc_service: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
   vpc_network: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
-  agent_memory: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator"
+  agent_memory: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator",
+  analytics: "DO-NOT-USE-this-resource-will-never-have-a-local-simulator"
 };
 function getBindingLocalSupport(type) {
   if (type in BINDING_LOCAL_SUPPORT) {
@@ -9681,6 +9759,13 @@ function mapWorkerMetadataBindings(bindings) {
           };
         }
         break;
+      case "analytics":
+        {
+          configObj.analytics = {
+            binding: binding.name
+          };
+        }
+        break;
       case "ai":
         {
           configObj.ai = {
@@ -9936,6 +10021,12 @@ function mapWorkerMetadataBindings(bindings) {
           }
         ];
         break;
+      case "k2":
+        configObj.k2 = [
+          ...configObj.k2 ?? [],
+          { binding: binding.name, stream: binding.stream }
+        ];
+        break;
       case "assets":
         configObj.assets = {
           binding: binding.name
@@ -10027,7 +10118,7 @@ function mapWorkerMetadataBindings(bindings) {
 __name(mapWorkerMetadataBindings, "mapWorkerMetadataBindings");
 
 // src/default-compat-date.ts
-var DEFAULT_COMPAT_DATE = "2026-09-25";
+var DEFAULT_COMPAT_DATE = "2026-10-01";
 
 // src/construct-wrangler-config.ts
 function constructWranglerConfig(config) {
@@ -10179,6 +10270,11 @@ function convertConfigToBindings(config, options) {
         output[binding] = { type: "browser", ...x };
         break;
       }
+      case "analytics": {
+        const { binding, ...x } = info;
+        output[binding] = { type: "analytics", ...x };
+        break;
+      }
       case "durable_objects": {
         for (const { name, ...x } of info.bindings ?? []) {
           output[name] = { type: "durable_object_namespace", ...x };
@@ -10334,6 +10430,15 @@ function convertConfigToBindings(config, options) {
         }
         break;
       }
+      case "k2": {
+        if (pages) {
+          break;
+        }
+        for (const { binding, ...x } of info) {
+          output[binding] = { type: "k2", ...x };
+        }
+        break;
+      }
       case "secrets_store_secrets": {
         for (const { binding, ...x } of info) {
           output[binding] = { type: "secrets_store_secret", ...x };
@@ -10491,6 +10596,7 @@ function printBindings(bindings, options) {
   );
   const text_blobs = extractBindingsOfType("text_blob", bindings);
   const browser = extractBindingsOfType("browser", bindings);
+  const analytics = extractBindingsOfType("analytics", bindings);
   const images = extractBindingsOfType("images", bindings);
   const stream = extractBindingsOfType("stream", bindings);
   const ai = extractBindingsOfType("ai", bindings);
@@ -10508,6 +10614,7 @@ function printBindings(bindings, options) {
   );
   const mtls_certificates = extractBindingsOfType("mtls_certificate", bindings);
   const pipelines = extractBindingsOfType("pipeline", bindings);
+  const k2 = extractBindingsOfType("k2", bindings);
   const ratelimits = extractBindingsOfType("ratelimit", bindings);
   const assets = extractBindingsOfType("assets", bindings);
   const unsafe_hello_world = extractBindingsOfType(
@@ -10887,6 +10994,18 @@ function printBindings(bindings, options) {
       }))
     );
   }
+  if (analytics.length > 0) {
+    output.push(
+      ...analytics.map(({ binding, remote }) => ({
+        name: binding,
+        type: getBindingTypeFriendlyName("analytics"),
+        value: void 0,
+        mode: getMode({
+          isSimulatedLocally: (remote === true || remote === void 0) && !context.remoteBindingsDisabled ? false : void 0
+        })
+      }))
+    );
+  }
   if (images.length > 0) {
     output.push(
       ...images.map(({ binding, remote }) => ({
@@ -10949,6 +11068,19 @@ function printBindings(bindings, options) {
       )
     );
   }
+  if (k2.length > 0) {
+    output.push(
+      ...k2.map(({ binding, stream: k2Stream }) => ({
+        name: binding,
+        type: getBindingTypeFriendlyName("k2"),
+        value: k2Stream,
+        mode: getMode({
+          // K2 always writes to the real stream; `remote: false` is rejected during validation.
+          isSimulatedLocally: context.remoteBindingsDisabled ? void 0 : false
+        })
+      }))
+    );
+  }
   if (ratelimits.length > 0) {
     output.push(
       ...ratelimits.map(({ name, simple }) => ({
@@ -12267,13 +12399,16 @@ You can try:
 __name(validateBinary, "validateBinary");
 function redactCloudflaredArgsForLogging(args) {
   const redacted = [...args];
+  const sensitiveArgs = ["--token", "--allowed-mail"];
   for (let i = 0; i < redacted.length; i++) {
     const arg = redacted[i];
-    if (arg === "--token" && i + 1 < redacted.length) {
-      redacted[i + 1] = "[REDACTED]";
-    }
-    if (arg.startsWith("--token=")) {
-      redacted[i] = "--token=[REDACTED]";
+    for (const sensitiveArg of sensitiveArgs) {
+      if (arg === sensitiveArg && i + 1 < redacted.length) {
+        redacted[i + 1] = "[REDACTED]";
+      }
+      if (arg.startsWith(`${sensitiveArg}=`)) {
+        redacted[i] = `${sensitiveArg}=[REDACTED]`;
+      }
     }
   }
   return redacted;
@@ -12552,6 +12687,27 @@ async function spawnCloudflared(args, options) {
     confirmDownload: options?.confirmDownload,
     logger
   });
+  if (args.some(
+    (arg) => arg === "--allowed-mail" || arg.startsWith("--allowed-mail=")
+  )) {
+    const minimumVersion = "2026.9.2";
+    const installedVersion = getInstalledVersion(binPath);
+    if (!installedVersion || isVersionOutdated(installedVersion, minimumVersion)) {
+      throw new UserError(
+        `[cloudflared] --allowed-mail requires cloudflared ${minimumVersion} or later.
+
+` + (installedVersion ? `The selected binary (${binPath}) is version ${installedVersion}.
+
+` : `Could not determine the version of the selected binary (${binPath}).
+
+`) + `Update cloudflared in your PATH or set CLOUDFLARED_PATH to a compatible binary.
+Download instructions: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
+        {
+          telemetryMessage: "tunnel cloudflared allowed mail unsupported version"
+        }
+      );
+    }
+  }
   logger?.debug(
     `Spawning cloudflared: ${binPath} ${redactCloudflaredArgsForLogging(args).join(" ")}`
   );