create-cloudflare 2.72.6 → 2.72.7

package/dist/cli.js

@@ -77461,7 +77461,7 @@ function dedent(templ) {
 __name(dedent, "dedent");
 var esm_default = dedent;
 
-// ../workers-utils/dist/chunk-V6JSHOVJ.mjs
+// ../workers-utils/dist/chunk-R5MIV2EH.mjs
 init_chunk_Q72B4Q5Z();
 var import_node_fs = require("node:fs");
 var import_node_path = __toESM(require("node:path"), 1);
@@ -77495,6 +77495,15 @@ function hasDurableObjectExports(exports$1) {
   return Object.keys(getDurableObjectExports(exports$1)).length > 0;
 }
 __name(hasDurableObjectExports, "hasDurableObjectExports");
+var CONTAINER_IMAGES_BINDING = "EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES";
+function isDurableObjectContainerApp(container) {
+  return container.scheduling_policy === "durable_object";
+}
+__name(isDurableObjectContainerApp, "isDurableObjectContainerApp");
+function getDurableObjectContainerApps(containers) {
+  return Array.isArray(containers) ? containers.filter(isDurableObjectContainerApp) : [];
+}
+__name(getDurableObjectContainerApps, "getDurableObjectContainerApps");
 function getContainerNameToClassNameMap(exports$1) {
   const containerNameToClassName = /* @__PURE__ */ new Map();
   for (const [className, entry] of Object.entries(
@@ -77528,6 +77537,108 @@ function getContainerDurableObjectClassNames(containers, exports$1) {
   return classNames;
 }
 __name(getContainerDurableObjectClassNames, "getContainerDurableObjectClassNames");
+function getDurableObjectClassNameToUseSQLiteMap(migrations, exports$1) {
+  const durableObjectClassNameToUseSQLiteMap = /* @__PURE__ */ new Map();
+  (migrations ?? []).forEach((migration) => {
+    migration.deleted_classes?.forEach((deleted_class) => {
+      if (!durableObjectClassNameToUseSQLiteMap.delete(deleted_class)) {
+        throw new UserError(
+          `Cannot apply deleted_classes migration to non-existent class ${deleted_class}`,
+          {
+            telemetryMessage: "durable object deleted class migration missing class"
+          }
+        );
+      }
+    });
+    migration.renamed_classes?.forEach(({ from, to }) => {
+      const useSQLite = durableObjectClassNameToUseSQLiteMap.get(from);
+      if (useSQLite === void 0) {
+        throw new UserError(
+          `Cannot apply renamed_classes migration to non-existent class ${from}`,
+          {
+            telemetryMessage: "durable object renamed class migration missing class"
+          }
+        );
+      } else {
+        durableObjectClassNameToUseSQLiteMap.delete(from);
+        durableObjectClassNameToUseSQLiteMap.set(to, useSQLite);
+      }
+    });
+    migration.new_classes?.forEach((new_class) => {
+      if (durableObjectClassNameToUseSQLiteMap.has(new_class)) {
+        throw new UserError(
+          `Cannot apply new_classes migration to existing class ${new_class}`,
+          {
+            telemetryMessage: "durable object new class migration existing class"
+          }
+        );
+      } else {
+        durableObjectClassNameToUseSQLiteMap.set(new_class, false);
+      }
+    });
+    migration.new_sqlite_classes?.forEach((new_class) => {
+      if (durableObjectClassNameToUseSQLiteMap.has(new_class)) {
+        throw new UserError(
+          `Cannot apply new_sqlite_classes migration to existing class ${new_class}`,
+          {
+            telemetryMessage: "durable object new sqlite class migration existing class"
+          }
+        );
+      } else {
+        durableObjectClassNameToUseSQLiteMap.set(new_class, true);
+      }
+    });
+  });
+  const durableObjectExports = getDurableObjectExports(exports$1 ?? {});
+  for (const [className, entry] of Object.entries(durableObjectExports)) {
+    if (entry.type !== "durable-object") {
+      continue;
+    }
+    if (entry.state === void 0 || entry.state === "created" || entry.state === "expecting-transfer") {
+      durableObjectClassNameToUseSQLiteMap.set(
+        className,
+        entry.storage === "sqlite"
+      );
+    }
+  }
+  return durableObjectClassNameToUseSQLiteMap;
+}
+__name(getDurableObjectClassNameToUseSQLiteMap, "getDurableObjectClassNameToUseSQLiteMap");
+function validateDurableObjectContainerApplications(config50) {
+  const allDOs = getDurableObjectClassNameToUseSQLiteMap(
+    config50.migrations,
+    config50.exports
+  );
+  for (const container of getDurableObjectContainerApps(config50.containers)) {
+    const maybeBoundDO = config50.durable_objects.bindings.find(
+      (durableObject) => durableObject.class_name === container.class_name
+    );
+    const useSQLite = allDOs.get(container.class_name);
+    if (useSQLite === void 0 && maybeBoundDO === void 0) {
+      throw new UserError(
+        `The container class_name ${container.class_name} does not match any durable object class_name defined in your Wrangler config file. Note that the durable object must be defined in the same script as the container.`,
+        { telemetryMessage: "no DO defined that matches container class_name" }
+      );
+    }
+    if (maybeBoundDO?.script_name !== void 0) {
+      throw new UserError(
+        `The container ${container.name} is referencing the durable object ${container.class_name}, which appears to be defined on the ${maybeBoundDO.script_name} Worker instead (via the 'script_name' field). You cannot configure a container on a Durable Object that is defined in another Worker.`,
+        {
+          telemetryMessage: "container class_name refers to an external durable object"
+        }
+      );
+    }
+    if (useSQLite === false) {
+      throw new UserError(
+        `The container ${container.name} references Durable Object class ${container.class_name}, which uses the legacy KV storage backend. Durable Object-managed Containers require SQLite-backed Durable Objects.`,
+        {
+          telemetryMessage: "durable object container class uses legacy storage"
+        }
+      );
+    }
+  }
+}
+__name(validateDurableObjectContainerApplications, "validateDurableObjectContainerApplications");
 function createScanner(text, ignoreTrivia = false) {
   const len = text.length;
   let pos = 0, value = "", tokenOffset = 0, token = 16, lineNumber = 0, lineStartOffset = 0, tokenLineStartOffset = 0, prevTokenLineStartOffset = 0, scanError = 0;
@@ -80284,9 +80395,9 @@ function formatConfigSnippet(snippet, configPath, formatted = true) {
 }
 __name(formatConfigSnippet, "formatConfigSnippet");
 
-// ../workers-utils/dist/chunk-XADL62NU.mjs
+// ../workers-utils/dist/chunk-KBTXSRPS.mjs
 init_chunk_Q72B4Q5Z();
-var DEFAULT_COMPAT_DATE = "2026-09-07";
+var DEFAULT_COMPAT_DATE = "2026-09-11";
 function assertNever(_value) {
 }
 __name(assertNever, "assertNever");
@@ -81043,7 +81154,7 @@ function getGlobalWranglerCachePath() {
 }
 __name(getGlobalWranglerCachePath, "getGlobalWranglerCachePath");
 
-// ../workers-utils/dist/chunk-XUGGRRBO.mjs
+// ../workers-utils/dist/chunk-IYSONYTF.mjs
 init_chunk_Q72B4Q5Z();
 var import_node_path3 = __toESM(require("node:path"), 1);
 var getC3CommandFromEnv = getEnvironmentVariableFactory({
@@ -81082,6 +81193,9 @@ var getCloudflareApiEnvironmentFromEnv = getEnvironmentVariableFactory(
     choices: ["production", "staging"]
   }
 );
+var COMPLIANCE_REGION_CONFIG_UNKNOWN = {
+  compliance_region: void 0
+};
 var getCloudflareComplianceRegionFromEnv = getEnvironmentVariableFactory({
   variableName: "CLOUDFLARE_COMPLIANCE_REGION",
   choices: ["public", "fedramp_high"]
@@ -81109,6 +81223,15 @@ function getComplianceRegionSubdomain(complianceConfig) {
   return getCloudflareComplianceRegion(complianceConfig) === "fedramp_high" ? ".fed" : "";
 }
 __name(getComplianceRegionSubdomain, "getComplianceRegionSubdomain");
+function getCloudflareContainerRegistry(complianceConfig = COMPLIANCE_REGION_CONFIG_UNKNOWN) {
+  if (process.env.CLOUDFLARE_CONTAINER_REGISTRY) {
+    return process.env.CLOUDFLARE_CONTAINER_REGISTRY;
+  }
+  const environmentPrefix = process.env.WRANGLER_API_ENVIRONMENT === "staging" ? "staging." : "";
+  const complianceRegionSubdomain = getComplianceRegionSubdomain(complianceConfig);
+  return `${environmentPrefix}registry${complianceRegionSubdomain}.cloudflare.com`;
+}
+__name(getCloudflareContainerRegistry, "getCloudflareContainerRegistry");
 function getStagingSubdomain() {
   return getCloudflareApiEnvironmentFromEnv() === "staging" ? ".staging" : "";
 }
@@ -81217,11 +81340,11 @@ var import_node_assert2 = __toESM(require("node:assert"), 1);
 var path5 = __toESM(require("node:path"), 1);
 var import_node_path5 = __toESM(require("node:path"), 1);
 var import_node_util3 = require("node:util");
+var import_node_url2 = require("node:url");
+var import_undici = __toESM(require_undici(), 1);
 var import_node_child_process2 = require("node:child_process");
 var import_node_crypto = require("node:crypto");
 var import_node_os5 = require("node:os");
-var import_undici = __toESM(require_undici(), 1);
-var import_node_url2 = require("node:url");
 var timersPromises = __toESM(require("node:timers/promises"), 1);
 var import_promises2 = require("node:timers/promises");
 var import_node_console = require("node:console");
@@ -99399,7 +99522,16 @@ function normalizeAndValidateEnvironment(diagnostics, configPath, rawEnv, isDisp
       // `name` is inheritable, so a named environment that doesn't redeclare it
       // still runs under the top level Worker name — fall back to it so the
       // generated container name isn't built from `undefined`.
-      validateContainerApp(envName, rawEnv.name ?? rawConfig?.name, configPath),
+      validateContainerApp(
+        envName,
+        rawEnv.name ?? rawConfig?.name,
+        configPath,
+        {
+          complianceConfig: {
+            compliance_region: rawEnv.compliance_region ?? topLevelEnv?.compliance_region
+          }
+        }
+      ),
       void 0
     ),
     send_email: notInheritable(
@@ -100851,6 +100983,15 @@ function validatePreviewsContainers(envName, configPath) {
   });
   return (diagnostics, field, value, config210) => {
     if (Array.isArray(value)) {
+      const durableObjectPolicyFields = [...value.entries()].filter(
+        ([, entry]) => entry && typeof entry === "object" && entry.scheduling_policy === "durable_object"
+      ).map(([index]) => `"${field}[${index}].scheduling_policy"`);
+      if (durableObjectPolicyFields.length > 0) {
+        diagnostics.errors.push(
+          `${durableObjectPolicyFields.join(", ")} cannot be "durable_object". Durable Object-managed Containers are configured only in the top-level "containers" array.`
+        );
+        return false;
+      }
       const nameFields = [...value.entries()].filter(
         ([, entry]) => entry && typeof entry === "object" && "name" in entry
       ).map(([index]) => `"${field}[${index}].name"`);
@@ -100885,6 +101026,85 @@ function validatePreviewsContainers(envName, configPath) {
   };
 }
 __name(validatePreviewsContainers, "validatePreviewsContainers");
+function validateDurableObjectContainerImages(diagnostics, field, images, complianceConfig) {
+  if (images === void 0) {
+    return true;
+  }
+  if (typeof images !== "object" || images === null || Array.isArray(images) || Object.keys(images).length === 0) {
+    diagnostics.errors.push(
+      `"${field}" must be a non-empty object when present.`
+    );
+    return false;
+  }
+  let valid = true;
+  const entries = Object.entries(images);
+  if (entries.length > 100) {
+    diagnostics.errors.push(`"${field}" must contain at most 100 images.`);
+    valid = false;
+  }
+  for (const [imageName, imageValue] of entries) {
+    const imageField = `${field}.${imageName}`;
+    if (imageName.length === 0 || imageName.length > 128) {
+      diagnostics.errors.push(
+        `"${field}" image names must be between 1 and 128 characters.`
+      );
+      valid = false;
+    }
+    if (typeof imageValue !== "object" || imageValue === null || Array.isArray(imageValue)) {
+      diagnostics.errors.push(
+        `"${imageField}" must be an object with either a "dockerfile" or "image" field.`
+      );
+      valid = false;
+      continue;
+    }
+    const image = imageValue;
+    const hasDockerfile = image.dockerfile !== void 0;
+    const hasImage = image.image !== void 0;
+    if (hasDockerfile === hasImage) {
+      diagnostics.errors.push(
+        `"${imageField}" must specify exactly one of "dockerfile" or "image".`
+      );
+      valid = false;
+    }
+    if (hasDockerfile && (typeof image.dockerfile !== "string" || image.dockerfile.length === 0)) {
+      diagnostics.errors.push(
+        `"${imageField}.dockerfile" must be a non-empty string.`
+      );
+      valid = false;
+    }
+    if (hasImage && (typeof image.image !== "string" || image.image.length === 0)) {
+      diagnostics.errors.push(
+        `"${imageField}.image" must be a non-empty string.`
+      );
+      valid = false;
+    }
+    if (typeof image.image === "string" && image.image.length > 0) {
+      const registry2 = getCloudflareContainerRegistry(complianceConfig);
+      const prefix = `${registry2}/`;
+      const reference = image.image.slice(prefix.length);
+      const digestReference = reference.match(
+        /^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)+@sha256:[a-f0-9]{64}$/
+      );
+      if (!image.image.startsWith(prefix) || digestReference?.[0] !== reference) {
+        diagnostics.errors.push(
+          `"${imageField}.image" must be a digest-pinned image in the managed registry, in the form "${registry2}/<account-id>/<repository>@sha256:<64 lowercase hex characters>".`
+        );
+        valid = false;
+      }
+    }
+    const unsupportedFields = Object.keys(image).filter(
+      (property) => property !== "dockerfile" && property !== "image"
+    );
+    if (unsupportedFields.length > 0) {
+      diagnostics.errors.push(
+        `Unexpected fields found in ${imageField} field: ${unsupportedFields.map((property) => `"${property}"`).join(", ")}`
+      );
+      valid = false;
+    }
+  }
+  return valid;
+}
+__name(validateDurableObjectContainerImages, "validateDurableObjectContainerImages");
 function validateContainerApp(envName, topLevelName, configPath, options = {}) {
   const { generateDefaultName = true } = options;
   return (diagnostics, field, value, config210) => {
@@ -100898,13 +101118,23 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
       return false;
     }
     for (const containerAppOptional of value) {
-      validateOptionalProperty(
-        diagnostics,
-        field,
-        "class_name",
-        containerAppOptional.class_name,
-        "string"
-      );
+      const isDurableObjectManaged = containerAppOptional.scheduling_policy === "durable_object";
+      const hasValidDurableObjectClassName = typeof containerAppOptional.class_name === "string" && containerAppOptional.class_name.length > 0;
+      if (isDurableObjectManaged) {
+        if (!hasValidDurableObjectClassName) {
+          diagnostics.errors.push(
+            `"containers.class_name" must be a non-empty string when "containers.scheduling_policy" is "durable_object".`
+          );
+        }
+      } else {
+        validateOptionalProperty(
+          diagnostics,
+          field,
+          "class_name",
+          containerAppOptional.class_name,
+          "string"
+        );
+      }
       validateOptionalProperty(
         diagnostics,
         field,
@@ -100912,7 +101142,7 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
         containerAppOptional.name,
         "string"
       );
-      if (generateDefaultName && !containerAppOptional.name) {
+      if (generateDefaultName && !containerAppOptional.name && (!isDurableObjectManaged || hasValidDurableObjectClassName)) {
         if (containerAppOptional.class_name === void 0) {
           diagnostics.errors.push(
             `"containers.name" is required when "containers.class_name" is not defined, because there is no class name to derive a default name from. Either name this container and reference it from a Durable Object's \`exports\` entry, or set "containers.class_name".`
@@ -100927,6 +101157,23 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
           containerAppOptional.name = name3.toLowerCase().replace(/ /g, "-");
         }
       }
+      if (isDurableObjectManaged) {
+        validateDurableObjectContainerImages(
+          diagnostics,
+          `${field}.images`,
+          containerAppOptional.images,
+          options.complianceConfig
+        );
+        const unsupportedFields = Object.keys(containerAppOptional).filter(
+          (key) => !["name", "class_name", "scheduling_policy", "images"].includes(key)
+        );
+        if (unsupportedFields.length > 0) {
+          diagnostics.errors.push(
+            `Unsupported fields for Durable Object-managed Containers in ${field}: ${unsupportedFields.map((key) => `"${key}"`).join(",")}. Only "name", "class_name", "scheduling_policy", and "images" are supported.`
+          );
+        }
+        continue;
+      }
       if (!containerAppOptional.configuration?.image && !containerAppOptional.image) {
         diagnostics.errors.push(
           `"containers.image" field must be defined for each container app. This should be the path to your Dockerfile or an image URI pointing to the Cloudflare registry.`
@@ -101065,6 +101312,12 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
         containerAppOptional.image_vars,
         "object"
       );
+      validateContainerObservability(
+        diagnostics,
+        `${field}.observability`,
+        containerAppOptional.observability,
+        config210
+      );
       validateOptionalProperty(
         diagnostics,
         field,
@@ -101108,6 +101361,7 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
           "image",
           "image_build_context",
           "image_vars",
+          "observability",
           "class_name",
           "scheduling_policy",
           "instance_type",
@@ -101933,6 +102187,7 @@ var validateBindingsHaveUniqueNames = /* @__PURE__ */ __name((diagnostics, confi
     ])
   );
   bindingsGroupedByType["Secret"] = config210.secrets?.required ?? [];
+  bindingsGroupedByType["Container images"] = [CONTAINER_IMAGES_BINDING];
   const bindingsGroupedByName = {};
   for (const bindingType in bindingsGroupedByType) {
     const bindingNames = bindingsGroupedByType[bindingType];
@@ -103349,6 +103604,133 @@ var validateExports = /* @__PURE__ */ __name((diagnostics, field, value) => {
   }
   return valid;
 }, "validateExports");
+var CONTAINER_OBSERVABILITY_TARGET_INSTANCE_PERCENTAGE_MIN = 1;
+var CONTAINER_OBSERVABILITY_TARGET_INSTANCE_PERCENTAGE_MAX = 99;
+var CONTAINER_OBSERVABILITY_TARGET_INSTANCE_COUNT_MIN = 1;
+function isContainerObservabilityEnabled(observability) {
+  return observability?.logs?.enabled === true || observability?.enabled === true;
+}
+__name(isContainerObservabilityEnabled, "isContainerObservabilityEnabled");
+function hasConflictingContainerObservabilityEnabledValues(observability) {
+  return typeof observability.enabled === "boolean" && typeof observability.logs?.enabled === "boolean" && observability.enabled !== observability.logs.enabled;
+}
+__name(hasConflictingContainerObservabilityEnabledValues, "hasConflictingContainerObservabilityEnabledValues");
+var validateContainerObservability = /* @__PURE__ */ __name((diagnostics, field, value) => {
+  if (value === void 0) {
+    return true;
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    diagnostics.errors.push(
+      `"${field}" should be an object but got ${JSON.stringify(value)}.`
+    );
+    return false;
+  }
+  const val = value;
+  let isValid = true;
+  isValid = validateOptionalProperty(
+    diagnostics,
+    field,
+    "enabled",
+    val.enabled,
+    "boolean"
+  ) && isValid;
+  if (val.logs !== void 0) {
+    if (typeof val.logs !== "object" || val.logs === null || Array.isArray(val.logs)) {
+      diagnostics.errors.push(
+        `Expected "${field}.logs" to be of type object but got ${JSON.stringify(
+          val.logs
+        )}.`
+      );
+      isValid = false;
+    } else {
+      isValid = validateOptionalProperty(
+        diagnostics,
+        field,
+        "logs.enabled",
+        val.logs.enabled,
+        "boolean"
+      ) && isValid;
+      isValid = validateAdditionalProperties(
+        diagnostics,
+        `${field}.logs`,
+        Object.keys(val.logs),
+        ["enabled"]
+      ) && isValid;
+    }
+  }
+  if (val.enabled === void 0 && val.target_instance_percentage === void 0 && val.target_instance_count === void 0 && (val.logs === void 0 || typeof val.logs === "object" && val.logs !== null && !Array.isArray(val.logs) && val.logs.enabled === void 0)) {
+    isValid = validateAtLeastOnePropertyRequired(diagnostics, field, [
+      {
+        key: "enabled",
+        value: val.enabled,
+        type: "boolean"
+      },
+      {
+        key: "logs.enabled",
+        value: val.logs?.enabled,
+        type: "boolean"
+      }
+    ]) && isValid;
+  }
+  isValid = validateOptionalProperty(
+    diagnostics,
+    field,
+    "target_instance_percentage",
+    val.target_instance_percentage,
+    "number"
+  ) && isValid;
+  isValid = validateOptionalProperty(
+    diagnostics,
+    field,
+    "target_instance_count",
+    val.target_instance_count,
+    "number"
+  ) && isValid;
+  isValid = validateAdditionalProperties(diagnostics, field, Object.keys(val), [
+    "enabled",
+    "logs",
+    "target_instance_percentage",
+    "target_instance_count"
+  ]) && isValid;
+  if (hasConflictingContainerObservabilityEnabledValues(val)) {
+    diagnostics.errors.push(
+      `"${field}.enabled" and "${field}.logs.enabled" cannot be set to different values.`
+    );
+    isValid = false;
+  }
+  if (val.target_instance_percentage !== void 0 && val.target_instance_count !== void 0) {
+    diagnostics.errors.push(
+      `"${field}.target_instance_percentage" and "${field}.target_instance_count" cannot both be set.`
+    );
+    isValid = false;
+  }
+  if (typeof val.target_instance_percentage === "number" && (!Number.isInteger(val.target_instance_percentage) || val.target_instance_percentage < CONTAINER_OBSERVABILITY_TARGET_INSTANCE_PERCENTAGE_MIN || val.target_instance_percentage > CONTAINER_OBSERVABILITY_TARGET_INSTANCE_PERCENTAGE_MAX)) {
+    diagnostics.errors.push(
+      `"${field}.target_instance_percentage" must be an integer between ${CONTAINER_OBSERVABILITY_TARGET_INSTANCE_PERCENTAGE_MIN} and ${CONTAINER_OBSERVABILITY_TARGET_INSTANCE_PERCENTAGE_MAX} inclusive.`
+    );
+    isValid = false;
+  }
+  if (typeof val.target_instance_count === "number" && (!Number.isInteger(val.target_instance_count) || val.target_instance_count < CONTAINER_OBSERVABILITY_TARGET_INSTANCE_COUNT_MIN)) {
+    diagnostics.errors.push(
+      `"${field}.target_instance_count" must be a positive integer.`
+    );
+    isValid = false;
+  }
+  const observabilityEnabled = isContainerObservabilityEnabled(val);
+  if (val.target_instance_percentage !== void 0 && !observabilityEnabled) {
+    diagnostics.errors.push(
+      `"${field}.target_instance_percentage" requires "${field}.enabled" or "${field}.logs.enabled" to be true because container observability overrides root observability.`
+    );
+    isValid = false;
+  }
+  if (val.target_instance_count !== void 0 && !observabilityEnabled) {
+    diagnostics.errors.push(
+      `"${field}.target_instance_count" requires "${field}.enabled" or "${field}.logs.enabled" to be true because container observability overrides root observability.`
+    );
+    isValid = false;
+  }
+  return isValid;
+}, "validateContainerObservability");
 var validateObservability = /* @__PURE__ */ __name((diagnostics, field, value) => {
   if (value === void 0) {
     return true;
@@ -105248,7 +105630,9 @@ ${allTailConsumers.map(({ service, streaming }) => {
     }
     log2(
       `${containersTitle}
-${containers.map((c2) => `- ${c2.name} (${c2.image})`).join("\n")}`
+${containers.map(
+        (container) => container.scheduling_policy === "durable_object" ? `- ${container.class_name} (durable_object)` : `- ${container.name} (${container.image})`
+      ).join("\n")}`
     );
     log2("");
   }
@@ -105715,126 +106099,529 @@ function getWranglerTmpDir(projectRoot, prefix, cleanup = true) {
   };
 }
 __name(getWranglerTmpDir, "getWranglerTmpDir");
-var import_command_exists = __toESM2(require_command_exists2());
-var UPDATE_SERVICE_URL = "https://update.argotunnel.com";
-var CLOUDFLARED_VERSION_PATTERN = /^\d{4}\.\d+\.\d+$/;
-function sha256Hex(buffer) {
-  return (0, import_node_crypto.createHash)("sha256").update(buffer).digest("hex");
+function buildDetailedError(message, ...extra) {
+  return new ParseError({
+    text: message,
+    notes: extra.map((text) => ({ text })),
+    telemetryMessage: false
+  });
 }
-__name(sha256Hex, "sha256Hex");
-function getGoArch() {
-  const nodeArch = (0, import_node_os5.arch)();
-  switch (nodeArch) {
-    case "x64":
-      return "amd64";
-    case "arm64":
-      return "arm64";
-    case "arm":
-      return "arm";
-    default:
-      throw new UserError(
-        `Unsupported architecture for cloudflared: ${nodeArch}
-
-cloudflared supports: x64 (amd64), arm64, arm
-
-You can manually install cloudflared and set the CLOUDFLARED_PATH environment variable.
-Download instructions: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
-        { telemetryMessage: "tunnel cloudflared unsupported architecture" }
-      );
+__name(buildDetailedError, "buildDetailedError");
+function maybeThrowFriendlyError(error51) {
+  if (error51.message === "workers.api.error.email_verification_required") {
+    throw buildDetailedError(
+      "Please verify your account's email address and try again.",
+      "Check your email for a verification link, or login to https://dash.cloudflare.com and request a new one."
+    );
   }
 }
-__name(getGoArch, "getGoArch");
-function getGoOS() {
-  switch (process.platform) {
-    case "darwin":
-      return "darwin";
-    case "linux":
-      return "linux";
-    case "win32":
-      return "windows";
-    default:
-      throw new UserError(
-        `Unsupported platform for cloudflared: ${process.platform}
-
-cloudflared supports: darwin (macOS), linux, win32 (Windows)
-
-You can manually install cloudflared and set the CLOUDFLARED_PATH environment variable.
-Download instructions: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
-        { telemetryMessage: "tunnel cloudflared unsupported platform" }
-      );
-  }
+__name(maybeThrowFriendlyError, "maybeThrowFriendlyError");
+function logHeaders(headers, logger) {
+  const clone2 = cloneHeaders(headers);
+  clone2.delete("Authorization");
+  logger.debugWithSanitization?.(
+    "HEADERS:",
+    JSON.stringify(Object.fromEntries(clone2), null, 2)
+  );
 }
-__name(getGoOS, "getGoOS");
-var GITHUB_RELEASE_BASE = "https://github.com/cloudflare/cloudflared/releases/download";
-function getAssetFilename(goOS, goArch) {
-  if (goOS === "windows") {
-    return `cloudflared-${goOS}-${goArch}.exe`;
-  }
-  if (goOS === "darwin") {
-    return `cloudflared-${goOS}-${goArch}.tgz`;
+__name(logHeaders, "logHeaders");
+async function performApiFetchBase(complianceConfig, resource, init = {}, userAgent, logger, queryParams, abortSignal, credentials) {
+  (0, import_node_assert2.default)(credentials, "credentials are required for performApiFetch");
+  const method = init.method ?? "GET";
+  (0, import_node_assert2.default)(
+    resource.startsWith("/"),
+    `CF API fetch - resource path must start with a "/" but got "${resource}"`
+  );
+  const headers = cloneHeaders(new import_undici.Headers(init.headers));
+  addAuthorizationHeader(headers, credentials);
+  headers.set("User-Agent", userAgent);
+  maybeAddTraceHeader(headers);
+  const queryString = queryParams ? `?${queryParams.toString()}` : "";
+  logger.debug(
+    `-- START CF API REQUEST: ${method} ${getCloudflareApiBaseUrl(complianceConfig)}${resource}`
+  );
+  logger.debugWithSanitization?.("QUERY STRING:", queryString);
+  logHeaders(headers, logger);
+  logger.debugWithSanitization?.("INIT:", JSON.stringify({ ...init }, null, 2));
+  if (init.body instanceof import_undici.FormData) {
+    logger.debugWithSanitization?.(
+      "BODY:",
+      await new import_undici.Response(init.body).text(),
+      null,
+      2
+    );
   }
-  return `cloudflared-${goOS}-${goArch}`;
+  logger.debug("-- END CF API REQUEST");
+  return await (0, import_undici.fetch)(
+    `${getCloudflareApiBaseUrl(complianceConfig)}${resource}${queryString}`,
+    {
+      method,
+      ...init,
+      headers,
+      signal: abortSignal
+    }
+  );
 }
-__name(getAssetFilename, "getAssetFilename");
-async function queryUpdateService(goOS, goArch, options) {
-  const { logger } = options ?? {};
-  const url2 = new URL(UPDATE_SERVICE_URL);
-  url2.searchParams.set("os", goOS);
-  url2.searchParams.set("arch", goArch);
-  logger?.debug(`Checking for latest cloudflared: ${url2.toString()}`);
-  let response;
-  try {
-    response = await (0, import_undici.fetch)(url2.toString(), {
-      headers: { "User-Agent": "wrangler" }
-    });
-  } catch (e2) {
-    logger?.debug(
-      `Failed to reach update service: ${e2 instanceof Error ? e2.message : String(e2)}`
-    );
-    return null;
+__name(performApiFetchBase, "performApiFetchBase");
+async function fetchInternalBase(complianceConfig, resource, init = {}, userAgent, logger, queryParams, abortSignal, credentials) {
+  const method = init.method ?? "GET";
+  const response = await performApiFetchBase(
+    complianceConfig,
+    resource,
+    init,
+    userAgent,
+    logger,
+    queryParams,
+    abortSignal,
+    credentials
+  );
+  const jsonText = await response.text();
+  logger.debug(
+    "-- START CF API RESPONSE:",
+    response.statusText,
+    response.status
+  );
+  logHeaders(response.headers, logger);
+  logger.debugWithSanitization?.("RESPONSE:", jsonText);
+  logger.debug("-- END CF API RESPONSE");
+  const retryAfterMs = parseRetryAfterMs(response.headers);
+  if (!jsonText && (response.status === 204 || response.status === 205)) {
+    return {
+      response: {
+        result: {},
+        success: true,
+        errors: [],
+        messages: []
+      },
+      status: response.status,
+      retryAfterMs
+    };
   }
-  if (!response.ok) {
-    logger?.debug(
-      `Update service returned ${response.status} for ${goOS}/${goArch}`
+  if (isWAFBlockResponse(response.headers)) {
+    throwWAFBlockError(
+      response.headers,
+      method,
+      resource,
+      response.status,
+      response.statusText,
+      retryAfterMs
     );
-    return null;
   }
-  let data;
   try {
-    data = await response.json();
-  } catch (e2) {
-    logger?.debug(
-      `Update service returned non-JSON response: ${e2 instanceof Error ? e2.message : String(e2)}`
-    );
-    return null;
+    const json2 = parseJSON(jsonText);
+    return { response: json2, status: response.status, retryAfterMs };
+  } catch {
+    const rayId = extractWAFBlockRayId(response.headers);
+    throw new APIError({
+      text: "Received a malformed response from the API",
+      notes: [
+        {
+          text: truncate(jsonText, 100)
+        },
+        {
+          text: `${method} ${resource} -> ${response.status} ${response.statusText}`
+        },
+        ...rayId ? [{ text: `Cloudflare Ray ID: ${rayId}` }] : []
+      ],
+      status: response.status,
+      retryAfterMs,
+      telemetryMessage: false
+    });
   }
-  if (typeof data.version === "string" && !CLOUDFLARED_VERSION_PATTERN.test(data.version)) {
-    throw new Error(
-      `[cloudflared] Invalid cloudflared version returned by update service: ${data.version}`
+}
+__name(fetchInternalBase, "fetchInternalBase");
+async function fetchResultBase(complianceConfig, resource, init = {}, userAgent, logger, queryParams, abortSignal, credentials) {
+  const {
+    response: json2,
+    status: status2,
+    retryAfterMs
+  } = await fetchInternalBase(
+    complianceConfig,
+    resource,
+    init,
+    userAgent,
+    logger,
+    queryParams,
+    abortSignal,
+    credentials
+  );
+  if (json2.success) {
+    return json2.result;
+  } else {
+    throwFetchError(resource, json2, status2, retryAfterMs);
+  }
+}
+__name(fetchResultBase, "fetchResultBase");
+async function fetchListResultBase(complianceConfig, resource, init = {}, userAgent, logger, queryParams, credentials) {
+  const results = [];
+  let getMoreResults = true;
+  let cursor;
+  while (getMoreResults) {
+    if (cursor) {
+      queryParams = new import_node_url2.URLSearchParams(queryParams);
+      queryParams.set("cursor", cursor);
+    }
+    const {
+      response: json2,
+      status: status2,
+      retryAfterMs
+    } = await fetchInternalBase(
+      complianceConfig,
+      resource,
+      init,
+      userAgent,
+      logger,
+      queryParams,
+      void 0,
+      credentials
     );
+    if (json2.success) {
+      results.push(...json2.result);
+      if (hasCursor(json2.result_info)) {
+        cursor = json2.result_info?.cursor;
+      } else {
+        getMoreResults = false;
+      }
+    } else {
+      throwFetchError(resource, json2, status2, retryAfterMs);
+    }
   }
-  if (data.error || !data.url || !data.version) {
-    return data.version ? data : null;
+  return results;
+}
+__name(fetchListResultBase, "fetchListResultBase");
+function truncate(text, maxLength) {
+  const { length } = text;
+  if (length <= maxLength) {
+    return text;
   }
-  return data;
+  return `${text.substring(0, maxLength)}... (length = ${length})`;
 }
-__name(queryUpdateService, "queryUpdateService");
-async function getLatestVersionInfo(options) {
-  const { logger } = options ?? {};
-  const goOS = getGoOS();
-  const goArch = getGoArch();
-  const primary = await queryUpdateService(goOS, goArch, { logger });
-  if (primary && primary.url && primary.version) {
-    return primary;
+__name(truncate, "truncate");
+function isWAFBlockResponse(headers) {
+  return headers.get("cf-mitigated") === "challenge";
+}
+__name(isWAFBlockResponse, "isWAFBlockResponse");
+function parseRetryAfterValue(retryAfter) {
+  if (!retryAfter) {
+    return void 0;
   }
-  logger?.debug(
-    `Update worker had no result for ${goOS}/${goArch}, falling back to GitHub release URL`
-  );
-  const fallback = await queryUpdateService("linux", "amd64", { logger });
-  if (!fallback?.version) {
-    throw new UserError(
-      `[cloudflared] Failed to determine the latest cloudflared version.
-
+  if (/^\d+$/.test(retryAfter.trim())) {
+    return Number(retryAfter) * 1e3;
+  }
+  const retryAfterDate = new Date(retryAfter);
+  if (!Number.isNaN(retryAfterDate.getTime())) {
+    return Math.max(0, retryAfterDate.getTime() - Date.now());
+  }
+  return void 0;
+}
+__name(parseRetryAfterValue, "parseRetryAfterValue");
+function parseRetryAfterMs(headers) {
+  return parseRetryAfterValue(headers.get("Retry-After"));
+}
+__name(parseRetryAfterMs, "parseRetryAfterMs");
+function extractWAFBlockRayId(headers) {
+  return headers.get("cf-ray") ?? void 0;
+}
+__name(extractWAFBlockRayId, "extractWAFBlockRayId");
+function extractAccountTag(resource) {
+  const re = new RegExp("/accounts/([a-zA-Z0-9]+)/?");
+  const matches = re.exec(resource);
+  return matches?.[1];
+}
+__name(extractAccountTag, "extractAccountTag");
+function hasMorePages(result_info) {
+  const page = result_info?.page;
+  const per_page = result_info?.per_page;
+  const total = result_info?.total_count;
+  return page !== void 0 && per_page !== void 0 && total !== void 0 && page * per_page < total;
+}
+__name(hasMorePages, "hasMorePages");
+function renderError(err, level = 0) {
+  const indent2 = "  ".repeat(level);
+  const message = err.message ?? "";
+  const chainedMessages = "error_chain" in err ? err.error_chain?.map(
+    (chainedError) => `
+
+${indent2}- ${renderError(chainedError, level + 1)}`
+  ).join("\n") ?? "" : "";
+  return (err.code ? `${message} [code: ${err.code}]` : message) + (err.documentation_url ? `
+${indent2}To learn more about this error, visit: ${err.documentation_url}` : "") + chainedMessages;
+}
+__name(renderError, "renderError");
+function addAuthorizationHeader(headers, auth, overrideExisting = false) {
+  if (!headers.has("Authorization") || overrideExisting) {
+    if ("apiToken" in auth) {
+      const authorizationHeader = `Bearer ${auth.apiToken}`;
+      validateAuthorizationHeaderValue(authorizationHeader);
+      headers.set("Authorization", authorizationHeader);
+    } else {
+      headers.set("X-Auth-Key", auth.authKey);
+      headers.set("X-Auth-Email", auth.authEmail);
+    }
+  }
+}
+__name(addAuthorizationHeader, "addAuthorizationHeader");
+function validateAuthorizationHeaderValue(value) {
+  for (const character of value) {
+    const codePoint = character.codePointAt(0);
+    if (codePoint === void 0 || codePoint > 255) {
+      throw new UserError(
+        `The configured Cloudflare API token contains a character that cannot be used in an HTTP Authorization header: ${formatAuthorizationHeaderCharacter(character, codePoint)}. Recreate or copy the token again, making sure it does not include characters such as ellipses.`,
+        {
+          telemetryMessage: "cfetch auth invalid authorization header"
+        }
+      );
+    }
+  }
+}
+__name(validateAuthorizationHeaderValue, "validateAuthorizationHeaderValue");
+function formatAuthorizationHeaderCharacter(character, codePoint) {
+  if (codePoint === void 0) {
+    return '"\\u{unknown}"';
+  }
+  const codePointLabel = `U+${codePoint.toString(16).toUpperCase().padStart(4, "0")}`;
+  const characterLabel = isPrintableCharacter(character) ? `"${character}"` : `"${escapeCharacter(character)}"`;
+  return `${characterLabel} (${codePointLabel})`;
+}
+__name(formatAuthorizationHeaderCharacter, "formatAuthorizationHeaderCharacter");
+function isPrintableCharacter(character) {
+  return !/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(character);
+}
+__name(isPrintableCharacter, "isPrintableCharacter");
+function escapeCharacter(character) {
+  return Array.from(character).map((c2) => {
+    const codePoint = c2.codePointAt(0);
+    if (codePoint === void 0) {
+      return "";
+    }
+    return codePoint <= 65535 ? `\\u${codePoint.toString(16).toUpperCase().padStart(4, "0")}` : `\\u{${codePoint.toString(16).toUpperCase()}}`;
+  }).join("");
+}
+__name(escapeCharacter, "escapeCharacter");
+function throwFetchError(resource, response, status2, retryAfterMs) {
+  const errors = response.errors ?? [];
+  for (const error52 of errors) {
+    maybeThrowFriendlyError(error52);
+  }
+  const notes = [
+    ...errors.map((err) => ({ text: renderError(err) })),
+    ...response.messages?.map((msg) => ({
+      text: typeof msg === "string" ? msg : msg.message ?? String(msg)
+    })) ?? []
+  ];
+  if (notes.length === 0) {
+    const raw = response;
+    const fallbackMessage = typeof raw.error === "string" ? `${raw.error}${raw.code ? ` [code: ${raw.code}]` : ""}` : void 0;
+    if (fallbackMessage) {
+      notes.push({ text: fallbackMessage });
+    }
+  }
+  if (retryAfterMs !== void 0) {
+    notes.push({
+      text: `The API responded with a "Retry-After" header indicating you should wait ${Math.ceil(retryAfterMs / 1e3)} second(s) before retrying.`
+    });
+  }
+  const error51 = new APIError({
+    text: `A request to the Cloudflare API (${resource}) failed.`,
+    notes,
+    status: status2,
+    // hoist the parsed `Retry-After` header (if any) so consumers such as
+    // `retryOnAPIFailure()` can back off for the amount of time the API
+    // asked us to wait, e.g. when rate limited (HTTP 429).
+    retryAfterMs,
+    telemetryMessage: false
+  });
+  const code = errors[0]?.code;
+  if (code) {
+    error51.code = code;
+  }
+  const meta3 = errors[0]?.meta;
+  if (meta3) {
+    error51.meta = meta3;
+  }
+  error51.accountTag = extractAccountTag(resource);
+  throw error51;
+}
+__name(throwFetchError, "throwFetchError");
+function throwWAFBlockError(headers, method, resource, status2, statusText, retryAfterMs) {
+  const rayId = extractWAFBlockRayId(headers);
+  throw new APIError({
+    text: "The Cloudflare API responded with a WAF block page instead of the expected JSON response",
+    notes: [
+      {
+        text: "Cloudflare's firewall (WAF) blocked this API request. This is usually a false positive."
+      },
+      ...rayId ? [{ text: `Cloudflare Ray ID: ${rayId}` }] : [],
+      {
+        text: rayId ? "If the issue persists, please open a Cloudflare Support ticket and include the Ray ID above." : "If the issue persists, please open a Cloudflare Support ticket. You can find the Cloudflare Ray ID on the block page in your browser."
+      },
+      {
+        text: `${method} ${resource} -> ${status2} ${statusText}`
+      }
+    ],
+    status: status2,
+    retryAfterMs,
+    telemetryMessage: false
+  });
+}
+__name(throwWAFBlockError, "throwWAFBlockError");
+async function fetchKVGetValueBase(complianceConfig, accountId, namespaceId, key, userAgent, logger, credentials) {
+  const headers = new import_undici.Headers();
+  addAuthorizationHeader(headers, credentials);
+  headers.set("User-Agent", userAgent);
+  maybeAddTraceHeader(headers);
+  const resource = `${getCloudflareApiBaseUrl(complianceConfig)}/accounts/${accountId}/storage/kv/namespaces/${namespaceId}/values/${key}`;
+  logger.debug(`-- START CF API REQUEST: GET ${resource}`);
+  logger.debug("-- END CF API REQUEST");
+  const response = await (0, import_undici.fetch)(resource, {
+    method: "GET",
+    headers
+  });
+  if (response.ok) {
+    return await response.arrayBuffer();
+  } else {
+    throw new Error(
+      `Failed to fetch ${resource} - ${response.status}: ${response.statusText}`
+    );
+  }
+}
+__name(fetchKVGetValueBase, "fetchKVGetValueBase");
+function hasCursor(result_info) {
+  const cursor = result_info?.cursor;
+  return cursor !== void 0 && cursor !== null && cursor !== "";
+}
+__name(hasCursor, "hasCursor");
+function maybeAddTraceHeader(headers) {
+  const traceHeader = getTraceHeader();
+  if (traceHeader) {
+    headers.set("Cf-Trace-Id", traceHeader);
+  }
+}
+__name(maybeAddTraceHeader, "maybeAddTraceHeader");
+function cloneHeaders(headers) {
+  return new import_undici.Headers(headers);
+}
+__name(cloneHeaders, "cloneHeaders");
+var import_command_exists = __toESM2(require_command_exists2());
+var UPDATE_SERVICE_URL = "https://update.argotunnel.com";
+var CLOUDFLARED_VERSION_PATTERN = /^\d{4}\.\d+\.\d+$/;
+function sha256Hex(buffer) {
+  return (0, import_node_crypto.createHash)("sha256").update(buffer).digest("hex");
+}
+__name(sha256Hex, "sha256Hex");
+function getGoArch() {
+  const nodeArch = (0, import_node_os5.arch)();
+  switch (nodeArch) {
+    case "x64":
+      return "amd64";
+    case "arm64":
+      return "arm64";
+    case "arm":
+      return "arm";
+    default:
+      throw new UserError(
+        `Unsupported architecture for cloudflared: ${nodeArch}
+
+cloudflared supports: x64 (amd64), arm64, arm
+
+You can manually install cloudflared and set the CLOUDFLARED_PATH environment variable.
+Download instructions: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
+        { telemetryMessage: "tunnel cloudflared unsupported architecture" }
+      );
+  }
+}
+__name(getGoArch, "getGoArch");
+function getGoOS() {
+  switch (process.platform) {
+    case "darwin":
+      return "darwin";
+    case "linux":
+      return "linux";
+    case "win32":
+      return "windows";
+    default:
+      throw new UserError(
+        `Unsupported platform for cloudflared: ${process.platform}
+
+cloudflared supports: darwin (macOS), linux, win32 (Windows)
+
+You can manually install cloudflared and set the CLOUDFLARED_PATH environment variable.
+Download instructions: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
+        { telemetryMessage: "tunnel cloudflared unsupported platform" }
+      );
+  }
+}
+__name(getGoOS, "getGoOS");
+var GITHUB_RELEASE_BASE = "https://github.com/cloudflare/cloudflared/releases/download";
+function getAssetFilename(goOS, goArch) {
+  if (goOS === "windows") {
+    return `cloudflared-${goOS}-${goArch}.exe`;
+  }
+  if (goOS === "darwin") {
+    return `cloudflared-${goOS}-${goArch}.tgz`;
+  }
+  return `cloudflared-${goOS}-${goArch}`;
+}
+__name(getAssetFilename, "getAssetFilename");
+async function queryUpdateService(goOS, goArch, options) {
+  const { logger } = options ?? {};
+  const url2 = new URL(UPDATE_SERVICE_URL);
+  url2.searchParams.set("os", goOS);
+  url2.searchParams.set("arch", goArch);
+  logger?.debug(`Checking for latest cloudflared: ${url2.toString()}`);
+  let response;
+  try {
+    response = await (0, import_undici.fetch)(url2.toString(), {
+      headers: { "User-Agent": "wrangler" }
+    });
+  } catch (e2) {
+    logger?.debug(
+      `Failed to reach update service: ${e2 instanceof Error ? e2.message : String(e2)}`
+    );
+    return null;
+  }
+  if (!response.ok) {
+    logger?.debug(
+      `Update service returned ${response.status} for ${goOS}/${goArch}`
+    );
+    return null;
+  }
+  let data;
+  try {
+    data = await response.json();
+  } catch (e2) {
+    logger?.debug(
+      `Update service returned non-JSON response: ${e2 instanceof Error ? e2.message : String(e2)}`
+    );
+    return null;
+  }
+  if (typeof data.version === "string" && !CLOUDFLARED_VERSION_PATTERN.test(data.version)) {
+    throw new Error(
+      `[cloudflared] Invalid cloudflared version returned by update service: ${data.version}`
+    );
+  }
+  if (data.error || !data.url || !data.version) {
+    return data.version ? data : null;
+  }
+  return data;
+}
+__name(queryUpdateService, "queryUpdateService");
+async function getLatestVersionInfo(options) {
+  const { logger } = options ?? {};
+  const goOS = getGoOS();
+  const goArch = getGoArch();
+  const primary = await queryUpdateService(goOS, goArch, { logger });
+  if (primary && primary.url && primary.version) {
+    return primary;
+  }
+  logger?.debug(
+    `Update worker had no result for ${goOS}/${goArch}, falling back to GitHub release URL`
+  );
+  const fallback = await queryUpdateService("linux", "amd64", { logger });
+  if (!fallback?.version) {
+    throw new UserError(
+      `[cloudflared] Failed to determine the latest cloudflared version.
+
 The update service did not return results for ${goOS}/${goArch},
 and the fallback query also failed.
 
@@ -106229,12 +107016,154 @@ function removeCloudflaredCache(version22) {
 }
 __name(removeCloudflaredCache, "removeCloudflaredCache");
 var TUNNEL_STARTUP_TIMEOUT_MS = 3e4;
+var TUNNEL_API_TIMEOUT_MS = 6e4;
 var TUNNEL_FORCE_KILL_TIMEOUT_MS = 5e3;
 var DEFAULT_TUNNEL_EXPIRY_MS = 60 * 60 * 1e3;
 var DEFAULT_TUNNEL_EXTENSION_MS = 60 * 60 * 1e3;
 var DEFAULT_TUNNEL_MAX_REMAINING_MS = 3 * 60 * 60 * 1e3;
 var DEFAULT_TUNNEL_REMINDER_INTERVAL_MS = 10 * 60 * 1e3;
 var QUICK_TUNNEL_URL_REGEX = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
+var LOCAL_TUNNEL_HOSTNAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "127.0.0.1",
+  "::1",
+  "0.0.0.0",
+  "::"
+]);
+async function resolveNamedTunnel(name3, origin, options) {
+  const {
+    accountId,
+    apiToken,
+    complianceRegion,
+    logger,
+    userAgent,
+    abortSignal
+  } = options;
+  const complianceConfig = { compliance_region: complianceRegion };
+  const resource = `/accounts/${accountId}/cfd_tunnel`;
+  const tunnels = await fetchResultBase(
+    complianceConfig,
+    resource,
+    void 0,
+    userAgent,
+    logger,
+    new URLSearchParams({ name: name3, is_deleted: "false" }),
+    createApiAbortSignal(TUNNEL_API_TIMEOUT_MS, abortSignal),
+    apiToken
+  );
+  const tunnel = tunnels.find((item) => item.name === name3);
+  if (!tunnel) {
+    throw new UserError(
+      `No Cloudflare Tunnel named "${name3}" was found in this account. Use "wrangler tunnel list" to see available tunnels.`,
+      { telemetryMessage: "tunnel resolve named missing tunnel" }
+    );
+  }
+  const tunnelId = tunnel.id;
+  if (!tunnelId) {
+    throw new FatalError(
+      `Tunnel "${name3}" was found but has no ID. This is unexpected.`,
+      { telemetryMessage: "tunnel resolve named missing tunnel id" }
+    );
+  }
+  const configuration = await fetchResultBase(
+    complianceConfig,
+    `${resource}/${tunnelId}/configurations`,
+    void 0,
+    userAgent,
+    logger,
+    void 0,
+    createApiAbortSignal(TUNNEL_API_TIMEOUT_MS, abortSignal),
+    apiToken
+  );
+  const ingress = configuration.config?.ingress ?? [];
+  const hostnames = getMatchingIngressHostnames(origin, ingress);
+  if (hostnames.length === 0) {
+    throw new UserError(
+      createMissingIngressMessage(name3, origin, {
+        dashboardUrl: `https://dash.cloudflare.com/${accountId}/tunnels/${tunnelId}`,
+        ingress
+      }),
+      { telemetryMessage: "tunnel resolve named ingress mismatch" }
+    );
+  }
+  const token = await fetchResultBase(
+    complianceConfig,
+    `${resource}/${tunnelId}/token`,
+    void 0,
+    userAgent,
+    logger,
+    void 0,
+    createApiAbortSignal(TUNNEL_API_TIMEOUT_MS, abortSignal),
+    apiToken
+  );
+  return { hostnames, token: String(token) };
+}
+__name(resolveNamedTunnel, "resolveNamedTunnel");
+function getMatchingIngressHostnames(origin, ingressConfig) {
+  const hostnames = /* @__PURE__ */ new Set();
+  const originUrl = normalizeURL(origin);
+  for (const ingress of ingressConfig) {
+    try {
+      const serviceUrl = normalizeURL(ingress.service);
+      if (ingress.hostname && serviceUrl.toString() === originUrl.toString()) {
+        hostnames.add(ingress.hostname);
+      }
+    } catch {
+    }
+  }
+  return [...hostnames];
+}
+__name(getMatchingIngressHostnames, "getMatchingIngressHostnames");
+function normalizeURL(url2) {
+  const normalizedUrl = new URL(url2);
+  if (LOCAL_TUNNEL_HOSTNAMES.has(normalizedUrl.hostname)) {
+    normalizedUrl.hostname = "localhost";
+  }
+  if (!normalizedUrl.port) {
+    switch (normalizedUrl.protocol) {
+      case "http:":
+        normalizedUrl.port = "80";
+        break;
+      case "https:":
+        normalizedUrl.port = "443";
+        break;
+    }
+  }
+  return normalizedUrl;
+}
+__name(normalizeURL, "normalizeURL");
+function createApiAbortSignal(timeoutMs, abortSignal) {
+  const timeoutSignal = AbortSignal.timeout(timeoutMs);
+  return abortSignal ? AbortSignal.any([abortSignal, timeoutSignal]) : timeoutSignal;
+}
+__name(createApiAbortSignal, "createApiAbortSignal");
+function createMissingIngressMessage(name3, origin, {
+  dashboardUrl,
+  ingress
+}) {
+  if (ingress.length === 0) {
+    return [
+      `Tunnel "${name3}" has no routes configured.`,
+      "",
+      `Add a route for ${origin} in the Cloudflare dashboard:`,
+      dashboardUrl,
+      ""
+    ].join("\n");
+  }
+  return [
+    `Tunnel "${name3}" has no route for ${origin}`,
+    "",
+    "Resolved routes:",
+    ...ingress.map(
+      ({ hostname: hostname3, service }) => `  - ${hostname3 ?? "(no hostname)"} -> ${service}`
+    ),
+    "",
+    "Update your local server settings or the tunnel routes in the Cloudflare dashboard:",
+    dashboardUrl,
+    ""
+  ].join("\n");
+}
+__name(createMissingIngressMessage, "createMissingIngressMessage");
 function startTunnel(options) {
   let disposed = false;
   let reminderInterval;
@@ -106467,409 +107396,6 @@ The local dev server started at ${origin.href}
   return new Error(errorMessage);
 }
 __name(createTunnelStartupError, "createTunnelStartupError");
-function buildDetailedError(message, ...extra) {
-  return new ParseError({
-    text: message,
-    notes: extra.map((text) => ({ text })),
-    telemetryMessage: false
-  });
-}
-__name(buildDetailedError, "buildDetailedError");
-function maybeThrowFriendlyError(error51) {
-  if (error51.message === "workers.api.error.email_verification_required") {
-    throw buildDetailedError(
-      "Please verify your account's email address and try again.",
-      "Check your email for a verification link, or login to https://dash.cloudflare.com and request a new one."
-    );
-  }
-}
-__name(maybeThrowFriendlyError, "maybeThrowFriendlyError");
-function logHeaders(headers, logger) {
-  const clone2 = cloneHeaders(headers);
-  clone2.delete("Authorization");
-  logger.debugWithSanitization?.(
-    "HEADERS:",
-    JSON.stringify(Object.fromEntries(clone2), null, 2)
-  );
-}
-__name(logHeaders, "logHeaders");
-async function performApiFetchBase(complianceConfig, resource, init = {}, userAgent, logger, queryParams, abortSignal, credentials) {
-  (0, import_node_assert2.default)(credentials, "credentials are required for performApiFetch");
-  const method = init.method ?? "GET";
-  (0, import_node_assert2.default)(
-    resource.startsWith("/"),
-    `CF API fetch - resource path must start with a "/" but got "${resource}"`
-  );
-  const headers = cloneHeaders(new import_undici.Headers(init.headers));
-  addAuthorizationHeader(headers, credentials);
-  headers.set("User-Agent", userAgent);
-  maybeAddTraceHeader(headers);
-  const queryString = queryParams ? `?${queryParams.toString()}` : "";
-  logger.debug(
-    `-- START CF API REQUEST: ${method} ${getCloudflareApiBaseUrl(complianceConfig)}${resource}`
-  );
-  logger.debugWithSanitization?.("QUERY STRING:", queryString);
-  logHeaders(headers, logger);
-  logger.debugWithSanitization?.("INIT:", JSON.stringify({ ...init }, null, 2));
-  if (init.body instanceof import_undici.FormData) {
-    logger.debugWithSanitization?.(
-      "BODY:",
-      await new import_undici.Response(init.body).text(),
-      null,
-      2
-    );
-  }
-  logger.debug("-- END CF API REQUEST");
-  return await (0, import_undici.fetch)(
-    `${getCloudflareApiBaseUrl(complianceConfig)}${resource}${queryString}`,
-    {
-      method,
-      ...init,
-      headers,
-      signal: abortSignal
-    }
-  );
-}
-__name(performApiFetchBase, "performApiFetchBase");
-async function fetchInternalBase(complianceConfig, resource, init = {}, userAgent, logger, queryParams, abortSignal, credentials) {
-  const method = init.method ?? "GET";
-  const response = await performApiFetchBase(
-    complianceConfig,
-    resource,
-    init,
-    userAgent,
-    logger,
-    queryParams,
-    abortSignal,
-    credentials
-  );
-  const jsonText = await response.text();
-  logger.debug(
-    "-- START CF API RESPONSE:",
-    response.statusText,
-    response.status
-  );
-  logHeaders(response.headers, logger);
-  logger.debugWithSanitization?.("RESPONSE:", jsonText);
-  logger.debug("-- END CF API RESPONSE");
-  const retryAfterMs = parseRetryAfterMs(response.headers);
-  if (!jsonText && (response.status === 204 || response.status === 205)) {
-    return {
-      response: {
-        result: {},
-        success: true,
-        errors: [],
-        messages: []
-      },
-      status: response.status,
-      retryAfterMs
-    };
-  }
-  if (isWAFBlockResponse(response.headers)) {
-    throwWAFBlockError(
-      response.headers,
-      method,
-      resource,
-      response.status,
-      response.statusText,
-      retryAfterMs
-    );
-  }
-  try {
-    const json2 = parseJSON(jsonText);
-    return { response: json2, status: response.status, retryAfterMs };
-  } catch {
-    const rayId = extractWAFBlockRayId(response.headers);
-    throw new APIError({
-      text: "Received a malformed response from the API",
-      notes: [
-        {
-          text: truncate(jsonText, 100)
-        },
-        {
-          text: `${method} ${resource} -> ${response.status} ${response.statusText}`
-        },
-        ...rayId ? [{ text: `Cloudflare Ray ID: ${rayId}` }] : []
-      ],
-      status: response.status,
-      retryAfterMs,
-      telemetryMessage: false
-    });
-  }
-}
-__name(fetchInternalBase, "fetchInternalBase");
-async function fetchResultBase(complianceConfig, resource, init = {}, userAgent, logger, queryParams, abortSignal, credentials) {
-  const {
-    response: json2,
-    status: status2,
-    retryAfterMs
-  } = await fetchInternalBase(
-    complianceConfig,
-    resource,
-    init,
-    userAgent,
-    logger,
-    queryParams,
-    abortSignal,
-    credentials
-  );
-  if (json2.success) {
-    return json2.result;
-  } else {
-    throwFetchError(resource, json2, status2, retryAfterMs);
-  }
-}
-__name(fetchResultBase, "fetchResultBase");
-async function fetchListResultBase(complianceConfig, resource, init = {}, userAgent, logger, queryParams, credentials) {
-  const results = [];
-  let getMoreResults = true;
-  let cursor;
-  while (getMoreResults) {
-    if (cursor) {
-      queryParams = new import_node_url2.URLSearchParams(queryParams);
-      queryParams.set("cursor", cursor);
-    }
-    const {
-      response: json2,
-      status: status2,
-      retryAfterMs
-    } = await fetchInternalBase(
-      complianceConfig,
-      resource,
-      init,
-      userAgent,
-      logger,
-      queryParams,
-      void 0,
-      credentials
-    );
-    if (json2.success) {
-      results.push(...json2.result);
-      if (hasCursor(json2.result_info)) {
-        cursor = json2.result_info?.cursor;
-      } else {
-        getMoreResults = false;
-      }
-    } else {
-      throwFetchError(resource, json2, status2, retryAfterMs);
-    }
-  }
-  return results;
-}
-__name(fetchListResultBase, "fetchListResultBase");
-function truncate(text, maxLength) {
-  const { length } = text;
-  if (length <= maxLength) {
-    return text;
-  }
-  return `${text.substring(0, maxLength)}... (length = ${length})`;
-}
-__name(truncate, "truncate");
-function isWAFBlockResponse(headers) {
-  return headers.get("cf-mitigated") === "challenge";
-}
-__name(isWAFBlockResponse, "isWAFBlockResponse");
-function parseRetryAfterValue(retryAfter) {
-  if (!retryAfter) {
-    return void 0;
-  }
-  if (/^\d+$/.test(retryAfter.trim())) {
-    return Number(retryAfter) * 1e3;
-  }
-  const retryAfterDate = new Date(retryAfter);
-  if (!Number.isNaN(retryAfterDate.getTime())) {
-    return Math.max(0, retryAfterDate.getTime() - Date.now());
-  }
-  return void 0;
-}
-__name(parseRetryAfterValue, "parseRetryAfterValue");
-function parseRetryAfterMs(headers) {
-  return parseRetryAfterValue(headers.get("Retry-After"));
-}
-__name(parseRetryAfterMs, "parseRetryAfterMs");
-function extractWAFBlockRayId(headers) {
-  return headers.get("cf-ray") ?? void 0;
-}
-__name(extractWAFBlockRayId, "extractWAFBlockRayId");
-function extractAccountTag(resource) {
-  const re = new RegExp("/accounts/([a-zA-Z0-9]+)/?");
-  const matches = re.exec(resource);
-  return matches?.[1];
-}
-__name(extractAccountTag, "extractAccountTag");
-function hasMorePages(result_info) {
-  const page = result_info?.page;
-  const per_page = result_info?.per_page;
-  const total = result_info?.total_count;
-  return page !== void 0 && per_page !== void 0 && total !== void 0 && page * per_page < total;
-}
-__name(hasMorePages, "hasMorePages");
-function renderError(err, level = 0) {
-  const indent2 = "  ".repeat(level);
-  const message = err.message ?? "";
-  const chainedMessages = "error_chain" in err ? err.error_chain?.map(
-    (chainedError) => `
-
-${indent2}- ${renderError(chainedError, level + 1)}`
-  ).join("\n") ?? "" : "";
-  return (err.code ? `${message} [code: ${err.code}]` : message) + (err.documentation_url ? `
-${indent2}To learn more about this error, visit: ${err.documentation_url}` : "") + chainedMessages;
-}
-__name(renderError, "renderError");
-function addAuthorizationHeader(headers, auth, overrideExisting = false) {
-  if (!headers.has("Authorization") || overrideExisting) {
-    if ("apiToken" in auth) {
-      const authorizationHeader = `Bearer ${auth.apiToken}`;
-      validateAuthorizationHeaderValue(authorizationHeader);
-      headers.set("Authorization", authorizationHeader);
-    } else {
-      headers.set("X-Auth-Key", auth.authKey);
-      headers.set("X-Auth-Email", auth.authEmail);
-    }
-  }
-}
-__name(addAuthorizationHeader, "addAuthorizationHeader");
-function validateAuthorizationHeaderValue(value) {
-  for (const character of value) {
-    const codePoint = character.codePointAt(0);
-    if (codePoint === void 0 || codePoint > 255) {
-      throw new UserError(
-        `The configured Cloudflare API token contains a character that cannot be used in an HTTP Authorization header: ${formatAuthorizationHeaderCharacter(character, codePoint)}. Recreate or copy the token again, making sure it does not include characters such as ellipses.`,
-        {
-          telemetryMessage: "cfetch auth invalid authorization header"
-        }
-      );
-    }
-  }
-}
-__name(validateAuthorizationHeaderValue, "validateAuthorizationHeaderValue");
-function formatAuthorizationHeaderCharacter(character, codePoint) {
-  if (codePoint === void 0) {
-    return '"\\u{unknown}"';
-  }
-  const codePointLabel = `U+${codePoint.toString(16).toUpperCase().padStart(4, "0")}`;
-  const characterLabel = isPrintableCharacter(character) ? `"${character}"` : `"${escapeCharacter(character)}"`;
-  return `${characterLabel} (${codePointLabel})`;
-}
-__name(formatAuthorizationHeaderCharacter, "formatAuthorizationHeaderCharacter");
-function isPrintableCharacter(character) {
-  return !/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(character);
-}
-__name(isPrintableCharacter, "isPrintableCharacter");
-function escapeCharacter(character) {
-  return Array.from(character).map((c2) => {
-    const codePoint = c2.codePointAt(0);
-    if (codePoint === void 0) {
-      return "";
-    }
-    return codePoint <= 65535 ? `\\u${codePoint.toString(16).toUpperCase().padStart(4, "0")}` : `\\u{${codePoint.toString(16).toUpperCase()}}`;
-  }).join("");
-}
-__name(escapeCharacter, "escapeCharacter");
-function throwFetchError(resource, response, status2, retryAfterMs) {
-  const errors = response.errors ?? [];
-  for (const error52 of errors) {
-    maybeThrowFriendlyError(error52);
-  }
-  const notes = [
-    ...errors.map((err) => ({ text: renderError(err) })),
-    ...response.messages?.map((msg) => ({
-      text: typeof msg === "string" ? msg : msg.message ?? String(msg)
-    })) ?? []
-  ];
-  if (notes.length === 0) {
-    const raw = response;
-    const fallbackMessage = typeof raw.error === "string" ? `${raw.error}${raw.code ? ` [code: ${raw.code}]` : ""}` : void 0;
-    if (fallbackMessage) {
-      notes.push({ text: fallbackMessage });
-    }
-  }
-  if (retryAfterMs !== void 0) {
-    notes.push({
-      text: `The API responded with a "Retry-After" header indicating you should wait ${Math.ceil(retryAfterMs / 1e3)} second(s) before retrying.`
-    });
-  }
-  const error51 = new APIError({
-    text: `A request to the Cloudflare API (${resource}) failed.`,
-    notes,
-    status: status2,
-    // hoist the parsed `Retry-After` header (if any) so consumers such as
-    // `retryOnAPIFailure()` can back off for the amount of time the API
-    // asked us to wait, e.g. when rate limited (HTTP 429).
-    retryAfterMs,
-    telemetryMessage: false
-  });
-  const code = errors[0]?.code;
-  if (code) {
-    error51.code = code;
-  }
-  const meta3 = errors[0]?.meta;
-  if (meta3) {
-    error51.meta = meta3;
-  }
-  error51.accountTag = extractAccountTag(resource);
-  throw error51;
-}
-__name(throwFetchError, "throwFetchError");
-function throwWAFBlockError(headers, method, resource, status2, statusText, retryAfterMs) {
-  const rayId = extractWAFBlockRayId(headers);
-  throw new APIError({
-    text: "The Cloudflare API responded with a WAF block page instead of the expected JSON response",
-    notes: [
-      {
-        text: "Cloudflare's firewall (WAF) blocked this API request. This is usually a false positive."
-      },
-      ...rayId ? [{ text: `Cloudflare Ray ID: ${rayId}` }] : [],
-      {
-        text: rayId ? "If the issue persists, please open a Cloudflare Support ticket and include the Ray ID above." : "If the issue persists, please open a Cloudflare Support ticket. You can find the Cloudflare Ray ID on the block page in your browser."
-      },
-      {
-        text: `${method} ${resource} -> ${status2} ${statusText}`
-      }
-    ],
-    status: status2,
-    retryAfterMs,
-    telemetryMessage: false
-  });
-}
-__name(throwWAFBlockError, "throwWAFBlockError");
-async function fetchKVGetValueBase(complianceConfig, accountId, namespaceId, key, userAgent, logger, credentials) {
-  const headers = new import_undici.Headers();
-  addAuthorizationHeader(headers, credentials);
-  headers.set("User-Agent", userAgent);
-  maybeAddTraceHeader(headers);
-  const resource = `${getCloudflareApiBaseUrl(complianceConfig)}/accounts/${accountId}/storage/kv/namespaces/${namespaceId}/values/${key}`;
-  logger.debug(`-- START CF API REQUEST: GET ${resource}`);
-  logger.debug("-- END CF API REQUEST");
-  const response = await (0, import_undici.fetch)(resource, {
-    method: "GET",
-    headers
-  });
-  if (response.ok) {
-    return await response.arrayBuffer();
-  } else {
-    throw new Error(
-      `Failed to fetch ${resource} - ${response.status}: ${response.statusText}`
-    );
-  }
-}
-__name(fetchKVGetValueBase, "fetchKVGetValueBase");
-function hasCursor(result_info) {
-  const cursor = result_info?.cursor;
-  return cursor !== void 0 && cursor !== null && cursor !== "";
-}
-__name(hasCursor, "hasCursor");
-function maybeAddTraceHeader(headers) {
-  const traceHeader = getTraceHeader();
-  if (traceHeader) {
-    headers.set("Cf-Trace-Id", traceHeader);
-  }
-}
-__name(maybeAddTraceHeader, "maybeAddTraceHeader");
-function cloneHeaders(headers) {
-  return new import_undici.Headers(headers);
-}
-__name(cloneHeaders, "cloneHeaders");
 var import_update_check = __toESM2(require_update_check());
 var UPDATE_CHECK_TIMEOUT_MS = 3e3;
 var TIMED_OUT = /* @__PURE__ */ Symbol("timed_out");
@@ -112007,7 +112533,7 @@ var Yargs = YargsFactory(esm_default2);
 var yargs_default = Yargs;
 
 // package.json
-var version2 = "2.72.6";
+var version2 = "2.72.7";
 
 // src/metrics.ts
 var import_node_async_hooks = require("node:async_hooks");
@@ -117199,7 +117725,7 @@ If the application uses Durable Objects or Workflows, refer to the relevant best
 var import_node_assert7 = __toESM(require("node:assert"));
 
 // ../wrangler/package.json
-var version3 = "4.129.1";
+var version3 = "4.131.1";
 
 // src/git.ts
 var offerGit = async (ctx) => {