create-cloudflare 2.72.8 → 2.72.9

package/dist/cli.js

@@ -80413,9 +80413,9 @@ function formatConfigSnippet(snippet, configPath, formatted = true) {
 }
 __name(formatConfigSnippet, "formatConfigSnippet");
 
-// ../workers-utils/dist/chunk-5H6GBNUC.mjs
+// ../workers-utils/dist/chunk-YZWVNJ5I.mjs
 init_chunk_Q72B4Q5Z();
-var DEFAULT_COMPAT_DATE = "2026-09-15";
+var DEFAULT_COMPAT_DATE = "2026-09-16";
 function assertNever(_value) {
 }
 __name(assertNever, "assertNever");
@@ -81358,7 +81358,6 @@ var import_node_crypto = require("node:crypto");
 var import_node_os5 = require("node:os");
 var timersPromises = __toESM(require("node:timers/promises"), 1);
 var import_promises2 = require("node:timers/promises");
-var import_node_console = require("node:console");
 var require_vendors2 = __commonJS2({
   "../../node_modules/.pnpm/ci-info@4.4.0/node_modules/ci-info/vendors.json"(exports$1, module2) {
     module2.exports = [
@@ -99077,17 +99076,31 @@ function validateRoutes(diagnostics, topLevelEnv, rawEnv, envName) {
   return result;
 }
 __name(validateRoutes, "validateRoutes");
-function normalizeAndValidatePlacement(diagnostics, topLevelEnv, rawEnv) {
-  if (rawEnv.placement) {
+function normalizeAndValidatePlacement(diagnostics, topLevelEnv, rawEnv, diagnosticField = "placement") {
+  if (rawEnv.placement !== void 0) {
+    if (typeof rawEnv.placement !== "object" || rawEnv.placement === null || Array.isArray(rawEnv.placement)) {
+      diagnostics.errors.push(
+        `The field "${diagnosticField}" should be an object but got ${JSON.stringify(rawEnv.placement)}.`
+      );
+      return inheritable(
+        diagnostics,
+        topLevelEnv,
+        rawEnv,
+        "placement",
+        () => true,
+        void 0
+      );
+    }
     const placement = rawEnv.placement;
     const hasHint = "hint" in placement;
-    const hasRegion = "region" in placement;
-    const hasHost = "host" in placement;
-    const hasHostname = "hostname" in placement;
-    const hasTargetedFields = hasRegion || hasHost || hasHostname;
+    const targetedFields = ["region", "host", "hostname"];
+    const presentTargetedFields = targetedFields.filter(
+      (field) => field in placement
+    );
+    const hasTargetedFields = presentTargetedFields.length > 0;
     if (hasHint && hasTargetedFields) {
       diagnostics.errors.push(
-        `"placement" cannot have both "hint" (smart format) and "region"/"host"/"hostname" (targeted format) fields`
+        `"${diagnosticField}" cannot have both "hint" (smart format) and "region"/"host"/"hostname" (targeted format) fields`
       );
       return inheritable(
         diagnostics,
@@ -99101,7 +99114,7 @@ function normalizeAndValidatePlacement(diagnostics, topLevelEnv, rawEnv) {
     if (hasHint) {
       validateRequiredProperty(
         diagnostics,
-        "placement",
+        diagnosticField,
         "mode",
         placement.mode,
         "string",
@@ -99111,75 +99124,58 @@ function normalizeAndValidatePlacement(diagnostics, topLevelEnv, rawEnv) {
       const hint = placement.hint;
       if (hint !== void 0 && typeof hint !== "string") {
         diagnostics.errors.push(
-          `"placement.hint" must be a string when "placement.mode" is "${mode}"`
+          `"${diagnosticField}.hint" must be a string when "${diagnosticField}.mode" is "${mode}"`
         );
       }
       if (hint && mode !== "smart") {
         diagnostics.errors.push(
-          `"placement.hint" can only be set when "placement.mode" is "smart"`
+          `"${diagnosticField}.hint" can only be set when "${diagnosticField}.mode" is "smart"`
         );
       }
     } else if (hasTargetedFields) {
       validateOptionalProperty(
         diagnostics,
-        "placement",
+        diagnosticField,
         "mode",
         placement.mode,
         "string",
-        ["off", "targeted"]
+        ["targeted"]
       );
-      if (hasRegion) {
-        validateOptionalProperty(
-          diagnostics,
-          "placement",
-          "region",
-          placement.region,
-          "string"
-        );
-      }
-      if (hasHost) {
-        validateOptionalProperty(
+      for (const field of presentTargetedFields) {
+        validateRequiredProperty(
           diagnostics,
-          "placement",
-          "host",
-          placement.host,
-          "string"
-        );
-      }
-      if (hasHostname) {
-        validateOptionalProperty(
-          diagnostics,
-          "placement",
-          "hostname",
-          placement.hostname,
+          diagnosticField,
+          field,
+          placement[field],
           "string"
         );
-      }
-      const fieldsPresent = [hasRegion, hasHost, hasHostname].filter(Boolean);
-      if (fieldsPresent.length > 1) {
-        const presentFields = [];
-        if (hasRegion) {
-          presentFields.push("region");
-        }
-        if (hasHost) {
-          presentFields.push("host");
-        }
-        if (hasHostname) {
-          presentFields.push("hostname");
+        if (placement[field] === "") {
+          diagnostics.errors.push(
+            `"${diagnosticField}.${field}" must be a non-empty string.`
+          );
         }
+      }
+      if (presentTargetedFields.length > 1) {
         diagnostics.errors.push(
-          `"placement" fields ${presentFields.map((f) => `"${f}"`).join(", ")} are mutually exclusive. Only one can be specified.`
+          `"${diagnosticField}" fields ${presentTargetedFields.map((field) => `"${field}"`).join(", ")} are mutually exclusive. Only one can be specified.`
         );
       }
     } else {
       validateRequiredProperty(
         diagnostics,
-        "placement",
+        diagnosticField,
         "mode",
         placement.mode,
         "string",
         ["off", "smart", "targeted"]
       );
+      if (placement.mode === "targeted") {
+        validateAtLeastOnePropertyRequired(diagnostics, diagnosticField, [
+          { key: "region", value: placement.region, type: "string" },
+          { key: "host", value: placement.host, type: "string" },
+          { key: "hostname", value: placement.hostname, type: "string" }
+        ]);
+      }
     }
   }
   return inheritable(
@@ -103100,6 +103096,7 @@ var validatePreviewsConfig = /* @__PURE__ */ __name((envName, configPath) => (di
     "logpush",
     "observability",
     "limits",
+    "placement",
     "cache"
   ]) && isValid;
   isValid = validateVars(envName)(
@@ -103114,6 +103111,12 @@ var validatePreviewsConfig = /* @__PURE__ */ __name((envName, configPath) => (di
     previews.define,
     void 0
   ) && isValid;
+  normalizeAndValidatePlacement(
+    diagnostics,
+    void 0,
+    previews,
+    `${field}.placement`
+  );
   isValid = validateBindingsProperty(envName, validateDurableObjectBinding)(
     diagnostics,
     `${field}.durable_objects`,
@@ -107692,7 +107695,7 @@ function getWorkerNameFromProject(projectPath) {
 }
 __name(getWorkerNameFromProject, "getWorkerNameFromProject");
 function toUrlPath(filePath) {
-  (0, import_node_console.assert)(
+  (0, import_node_assert2.default)(
     !/^[a-z]:/i.test(filePath),
     "Tried to convert a Windows file path with a drive to a URL path."
   );
@@ -112590,7 +112593,7 @@ var Yargs = YargsFactory(esm_default2);
 var yargs_default = Yargs;
 
 // package.json
-var version2 = "2.72.8";
+var version2 = "2.72.9";
 
 // src/metrics.ts
 var import_node_async_hooks = require("node:async_hooks");
@@ -117803,7 +117806,7 @@ If the application uses Durable Objects or Workflows, refer to the relevant best
 var import_node_assert7 = __toESM(require("node:assert"));
 
 // ../wrangler/package.json
-var version3 = "4.132.0";
+var version3 = "4.133.0";
 
 // src/git.ts
 var offerGit = async (ctx) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-cloudflare",
-  "version": "2.72.8",
+  "version": "2.72.9",
   "description": "A CLI for creating and deploying new applications to Cloudflare.",
   "keywords": [
     "cloudflare",
@@ -31,7 +31,7 @@
     "@babel/parser": "^7.21.3",
     "@babel/types": "^7.21.4",
     "@clack/prompts": "^1.2.0",
-    "@cloudflare/workers-types": "^5.20260915.1",
+    "@cloudflare/workers-types": "^5.20260916.1",
     "@types/command-exists": "^1.2.0",
     "@types/cross-spawn": "^6.0.2",
     "@types/deepmerge": "^2.2.0",
@@ -70,13 +70,13 @@
     "which-pm-runs": "^1.1.0",
     "wrap-ansi": "^9.0.0",
     "yargs": "^17.7.2",
-    "@cloudflare/cli-shared-helpers": "0.1.31",
-    "@cloudflare/shared-ast-primitives": "1.1.0",
-    "@cloudflare/vite-plugin": "1.54.10",
+    "@cloudflare/cli-shared-helpers": "0.1.32",
     "@cloudflare/mock-npm-registry": "0.0.0",
+    "@cloudflare/shared-ast-primitives": "1.1.0",
+    "@cloudflare/vite-plugin": "1.54.11",
     "@cloudflare/workers-tsconfig": "0.0.0",
-    "@cloudflare/workers-utils": "0.39.0",
-    "wrangler": "4.132.0"
+    "@cloudflare/workers-utils": "0.39.1",
+    "wrangler": "4.133.0"
   },
   "engines": {
     "node": ">=22.0.0"

package/templates/common/js/src/index.js

@@ -37,8 +37,8 @@ export default {
 		return new Response(
 			`Try making requests to:
       <ul>
-      <li><code><a href="/redirect?redirectUrl=https://example.com/">/redirect?redirectUrl=https://example.com/</a></code>,</li>
-      <li><code><a href="/proxy?modify&proxyUrl=https://example.com/">/proxy?modify&proxyUrl=https://example.com/</a></code>, or</li>
+      <li><code><a href="/redirect">/redirect</a></code>,</li>
+      <li><code><a href="/proxy?modify">/proxy?modify</a></code>, or</li>
       <li><code><a href="/api/todos">/api/todos</a></code></li>`,
 			{ headers: { 'Content-Type': 'text/html' } }
 		);

package/templates/common/js/src/proxy.js

@@ -1,16 +1,14 @@
+// Keep the destination fixed to prevent this Worker from becoming an open proxy.
+const PROXY_URL = 'https://example.com/';
+
 export default {
 	async fetch(request, env, ctx) {
 		const url = new URL(request.url);
 
-		const proxyUrl = url.searchParams.get('proxyUrl'); // get a query param value (?proxyUrl=...)
-		const modify = url.searchParams.has('modify'); // check if a query param is set (?proxyUrl=...&modify)
-
-		if (!proxyUrl) {
-			return new Response('Bad request: Missing `proxyUrl` query param', { status: 400 });
-		}
+		const modify = url.searchParams.has('modify'); // check if a query param is set (?modify)
 
 		// make subrequests with the global `fetch()` function
-		let res = await fetch(proxyUrl, request);
+		let res = await fetch(PROXY_URL, request);
 
 		// optionally, modify the respone
 		if (modify) {

package/templates/common/js/src/redirect.js

@@ -1,13 +1,9 @@
+// Keep the destination fixed to prevent this Worker from becoming an open redirect.
+const REDIRECT_URL = 'https://example.com/';
+
 export default {
 	async fetch(request, env, ctx) {
-		const url = new URL(request.url);
-		const redirectUrl = url.searchParams.get('redirectUrl'); // get a query param value (?redirectUrl=...)
-
-		if (!redirectUrl) {
-			return new Response('Bad request: Missing `redirectUrl` query param', { status: 400 });
-		}
-
 		// The Response class has static methods to create common Response objects as a convenience
-		return Response.redirect(redirectUrl);
+		return Response.redirect(REDIRECT_URL);
 	},
 };

package/templates/common/ts/src/index.ts

@@ -40,8 +40,8 @@ export default {
 		return new Response(
 			`Try making requests to:
       <ul>
-      <li><code><a href="/redirect?redirectUrl=https://example.com/">/redirect?redirectUrl=https://example.com/</a></code>,</li>
-      <li><code><a href="/proxy?modify&proxyUrl=https://example.com/">/proxy?modify&proxyUrl=https://example.com/</a></code>, or</li>
+      <li><code><a href="/redirect">/redirect</a></code>,</li>
+      <li><code><a href="/proxy?modify">/proxy?modify</a></code>, or</li>
       <li><code><a href="/api/todos">/api/todos</a></code></li>`,
 			{ headers: { 'Content-Type': 'text/html' } }
 		);

package/templates/common/ts/src/proxy.ts

@@ -1,16 +1,14 @@
+// Keep the destination fixed to prevent this Worker from becoming an open proxy.
+const PROXY_URL = 'https://example.com/';
+
 export default {
 	async fetch(request, env, ctx): Promise<Response> {
 		const url = new URL(request.url);
 
-		const proxyUrl = url.searchParams.get('proxyUrl'); // get a query param value (?proxyUrl=...)
-		const modify = url.searchParams.has('modify'); // check if a query param is set (?proxyUrl=...&modify)
-
-		if (!proxyUrl) {
-			return new Response('Bad request: Missing `proxyUrl` query param', { status: 400 });
-		}
+		const modify = url.searchParams.has('modify'); // check if a query param is set (?modify)
 
 		// make subrequests with the global `fetch()` function
-		let res = await fetch(proxyUrl, request);
+		let res = await fetch(PROXY_URL, request);
 
 		// optionally, modify the respone
 		if (modify) {

package/templates/common/ts/src/redirect.ts

@@ -1,13 +1,9 @@
+// Keep the destination fixed to prevent this Worker from becoming an open redirect.
+const REDIRECT_URL = 'https://example.com/';
+
 export default {
 	async fetch(request, env, ctx): Promise<Response> {
-		const url = new URL(request.url);
-		const redirectUrl = url.searchParams.get('redirectUrl'); // get a query param value (?redirectUrl=...)
-
-		if (!redirectUrl) {
-			return new Response('Bad request: Missing `redirectUrl` query param', { status: 400 });
-		}
-
 		// The Response class has static methods to create common Response objects as a convenience
-		return Response.redirect(redirectUrl);
+		return Response.redirect(REDIRECT_URL);
 	},
 } satisfies ExportedHandler<Env>;