wrangler 4.104.0 → 4.105.0

package/wrangler-dist/cli.js

@@ -17921,7 +17921,7 @@ var require_snapshot_recorder = __commonJS({
     init_import_meta_url();
     var { writeFile: writeFile14, readFile: readFile19, mkdir: mkdir8 } = __require("fs/promises");
     var { dirname: dirname29, resolve: resolve32 } = __require("path");
-    var { setTimeout: setTimeout9, clearTimeout: clearTimeout2 } = __require("timers");
+    var { setTimeout: setTimeout10, clearTimeout: clearTimeout2 } = __require("timers");
     var { InvalidArgumentError, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
     function formatRequestKey(opts, headerFilters, matchOptions = {}) {
@@ -18262,7 +18262,7 @@ var require_snapshot_recorder = __commonJS({
        * Schedules a flush (debounced to avoid excessive writes)
        */
       #scheduleFlush() {
-        this.#flushTimeout = setTimeout9(() => {
+        this.#flushTimeout = setTimeout10(() => {
           this.saveSnapshots().catch(() => {
           });
           if (this.#autoFlush) {
@@ -44488,7 +44488,7 @@ var name, version;
 var init_package = __esm({
   "package.json"() {
     name = "wrangler";
-    version = "4.104.0";
+    version = "4.105.0";
   }
 });
 
@@ -124876,6 +124876,103 @@ Current account: "${accountId}"`
   }
   return `${url5.hostname}/${accountId}${url5.pathname}`;
 }
+function invalidGarCredentialError() {
+  return new UserError(
+    "The Google service account key must be a JSON key file or its base64-encoded form.",
+    {
+      telemetryMessage: "containers registries configure invalid gar credential"
+    }
+  );
+}
+function tryParseJson(value) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return void 0;
+  }
+}
+function assertJsonObject(parsed) {
+  if (typeof parsed !== "object" || parsed === null) {
+    throw invalidGarCredentialError();
+  }
+  return parsed;
+}
+function validateServiceAccountKey(accountKey) {
+  const privateKey = accountKey.private_key;
+  const clientEmail = accountKey.client_email;
+  const rawPrivateKeyId = accountKey.private_key_id;
+  if (typeof privateKey !== "string" || typeof clientEmail !== "string") {
+    throw new UserError(
+      "The Google service account key is missing required fields (private_key, client_email).",
+      {
+        telemetryMessage: "containers registries configure gar credential missing fields"
+      }
+    );
+  }
+  if (privateKey.length === 0 || clientEmail.length === 0) {
+    throw new UserError(
+      "The Google service account key has an empty private_key or client_email.",
+      {
+        telemetryMessage: "containers registries configure gar credential empty fields"
+      }
+    );
+  }
+  let privateKeyId;
+  if (rawPrivateKeyId === void 0) {
+    privateKeyId = void 0;
+  } else if (typeof rawPrivateKeyId === "string" && rawPrivateKeyId.length > 0) {
+    privateKeyId = rawPrivateKeyId;
+  } else {
+    throw new UserError(
+      "The Google service account key has an empty or invalid private_key_id.",
+      {
+        telemetryMessage: "containers registries configure gar credential invalid private key id"
+      }
+    );
+  }
+  return {
+    private_key: privateKey,
+    client_email: clientEmail,
+    private_key_id: privateKeyId
+  };
+}
+function validateAndEncodeGarKey(rawKey, expectedEmail) {
+  const trimmed = rawKey.trim();
+  let base64Key;
+  let json2;
+  const rawJson = tryParseJson(trimmed);
+  if (rawJson !== void 0) {
+    json2 = assertJsonObject(rawJson);
+    base64Key = Buffer.from(trimmed, "utf8").toString("base64");
+  } else {
+    if (trimmed.startsWith("-----BEGIN")) {
+      throw new UserError(
+        "The provided key appears to be a PEM private key. Provide the full Google service-account JSON key file, not just the private key.",
+        {
+          telemetryMessage: "containers registries configure gar credential pem key"
+        }
+      );
+    }
+    base64Key = trimmed.replace(/\s+/g, "");
+    const decodedJson = tryParseJson(
+      Buffer.from(base64Key, "base64").toString("utf8")
+    );
+    if (decodedJson === void 0) {
+      throw invalidGarCredentialError();
+    }
+    json2 = assertJsonObject(decodedJson);
+  }
+  const key = validateServiceAccountKey(json2);
+  if (key.client_email !== expectedEmail) {
+    throw new UserError(
+      `The provided --gar-email "${expectedEmail}" does not match the service account email "${key.client_email}" in the key.`,
+      {
+        telemetryMessage: "containers registries configure gar email mismatch"
+      }
+    );
+  }
+  return base64Key;
+}
 var DEFAULT_CONTAINER_EGRESS_INTERCEPTOR_IMAGE, getAndValidateRegistryType;
 var init_images2 = __esm({
   "../containers-shared/src/images.ts"() {
@@ -124924,6 +125021,12 @@ ${e9.message}`);
           name: "DockerHub",
           secretType: "DockerHub PAT Token"
         },
+        {
+          type: "GAR" /* GAR */,
+          pattern: /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?-docker\.pkg\.dev$/,
+          name: "Google Artifact Registry",
+          secretType: "Google Service Account JSON Key"
+        },
         {
           type: "cloudflare",
           // Make a regex based on the env var CLOUDFLARE_CONTAINER_REGISTRY
@@ -124947,6 +125050,11 @@ To use an existing image from another repository, see https://developers.cloudfl
       }
       return match3;
     }, "getAndValidateRegistryType");
+    __name(invalidGarCredentialError, "invalidGarCredentialError");
+    __name(tryParseJson, "tryParseJson");
+    __name(assertJsonObject, "assertJsonObject");
+    __name(validateServiceAccountKey, "validateServiceAccountKey");
+    __name(validateAndEncodeGarKey, "validateAndEncodeGarKey");
   }
 });
 
@@ -148013,61 +148121,6 @@ function errIsStartupErr(err) {
   }
   return false;
 }
-async function verifyWorkerMatchesCITag(complianceConfig, accountId, workerName, configPath) {
-  const matchTag = getCIMatchTag();
-  logger.debug(
-    `Starting verifyWorkerMatchesCITag() with tag: ${matchTag}, name: ${workerName}`
-  );
-  if (!matchTag) {
-    logger.debug(
-      "No WRANGLER_CI_MATCH_TAG variable provided, aborting verifyWorkerMatchesCITag()"
-    );
-    return;
-  }
-  const envAccountID = getCloudflareAccountIdFromEnv2();
-  if (accountId !== envAccountID) {
-    throw new FatalError(
-      `The \`account_id\` in your ${configFileName(configPath)} file must match the \`account_id\` for this account. Please update your ${configFileName(configPath)} file with \`${formatConfigSnippet({ account_id: envAccountID }, configPath, false)}\``,
-      { telemetryMessage: "ci match tag account mismatch" }
-    );
-  }
-  let tag;
-  try {
-    const worker = await fetchResult(
-      complianceConfig,
-      `/accounts/${accountId}/workers/services/${workerName}`
-    );
-    tag = worker.default_environment.script.tag;
-    logger.debug(`API returned with tag: ${tag} for worker: ${workerName}`);
-  } catch (e9) {
-    logger.debug(e9);
-    if (isWorkerNotFoundError(e9)) {
-      throw new FatalError(
-        `The name in your ${configFileName(configPath)} file (${workerName}) must match the name of your Worker. Please update the name field in your ${configFileName(configPath)} file.`,
-        { telemetryMessage: "ci match tag worker not found" }
-      );
-    } else if (e9 instanceof APIError) {
-      throw new FatalError(
-        "An error occurred while trying to validate that the Worker name matches what is expected by the build system.\n" + e9.message + "\n" + e9.notes.map((note) => note.text).join("\n"),
-        { telemetryMessage: "ci match tag validation api error" }
-      );
-    } else {
-      throw new FatalError(
-        "Wrangler cannot validate that your Worker name matches what is expected by the build system. Please retry the build. If the problem persists, please contact support.",
-        { telemetryMessage: "ci match tag validation failed" }
-      );
-    }
-  }
-  if (tag !== matchTag) {
-    logger.debug(
-      `Failed to match Worker tag. The API returned "${tag}", but the CI system expected "${matchTag}"`
-    );
-    throw new FatalError(
-      `The name in your ${configFileName(configPath)} file (${workerName}) must match the name of your Worker. Please update the name field in your ${configFileName(configPath)} file.`,
-      { telemetryMessage: "ci match tag tag mismatch" }
-    );
-  }
-}
 function validateFileSecrets(content, jsonFilePath) {
   if (content === null || typeof content !== "object") {
     throw new FatalError(
@@ -149632,6 +149685,128 @@ function lineMatchToCallSite(lineMatch) {
     native: isNative
   });
 }
+async function verifyWorkerMatchesCITag(complianceConfig, accountId, workerName, configPath) {
+  const matchTag = getCIMatchTag();
+  logger.debug(
+    `Starting verifyWorkerMatchesCITag() with tag: ${matchTag}, name: ${workerName}`
+  );
+  if (!matchTag) {
+    logger.debug(
+      "No WRANGLER_CI_MATCH_TAG variable provided, aborting verifyWorkerMatchesCITag()"
+    );
+    return;
+  }
+  const envAccountID = getCloudflareAccountIdFromEnv2();
+  if (accountId !== envAccountID) {
+    throw new FatalError(
+      `The \`account_id\` in your ${configFileName(configPath)} file must match the \`account_id\` for this account. Please update your ${configFileName(configPath)} file with \`${formatConfigSnippet({ account_id: envAccountID }, configPath, false)}\``,
+      { telemetryMessage: "ci match tag account mismatch" }
+    );
+  }
+  let tag;
+  try {
+    const worker = await fetchResult(
+      complianceConfig,
+      `/accounts/${accountId}/workers/services/${workerName}`
+    );
+    tag = worker.default_environment.script.tag;
+    logger.debug(`API returned with tag: ${tag} for worker: ${workerName}`);
+  } catch (e9) {
+    logger.debug(e9);
+    if (isWorkerNotFoundError(e9)) {
+      throw new FatalError(
+        `The name in your ${configFileName(configPath)} file (${workerName}) must match the name of your Worker. Please update the name field in your ${configFileName(configPath)} file.`,
+        { telemetryMessage: "ci match tag worker not found" }
+      );
+    } else if (e9 instanceof APIError) {
+      throw new FatalError(
+        "An error occurred while trying to validate that the Worker name matches what is expected by the build system.\n" + e9.message + "\n" + e9.notes.map((note) => note.text).join("\n"),
+        { telemetryMessage: "ci match tag validation api error" }
+      );
+    } else {
+      throw new FatalError(
+        "Wrangler cannot validate that your Worker name matches what is expected by the build system. Please retry the build. If the problem persists, please contact support.",
+        { telemetryMessage: "ci match tag validation failed" }
+      );
+    }
+  }
+  if (tag !== matchTag) {
+    logger.debug(
+      `Failed to match Worker tag. The API returned "${tag}", but the CI system expected "${matchTag}"`
+    );
+    throw new FatalError(
+      `The name in your ${configFileName(configPath)} file (${workerName}) must match the name of your Worker. Please update the name field in your ${configFileName(configPath)} file.`,
+      { telemetryMessage: "ci match tag tag mismatch" }
+    );
+  }
+}
+async function validateWorkerProps(props, config2) {
+  const { name: name2, dryRun, accountId, compatibilityDate } = props;
+  const { format: format32 } = props.entry;
+  if (!name2) {
+    throw new UserError(
+      `You need to provide the name of your worker. Either pass it as a cli arg with --name <name> or in your config file as ${formatConfigSnippet({ name: "<name>" }, config2.userConfigPath)}`,
+      {
+        telemetryMessage: props.command === "deploy" ? "deploy command missing worker name" : "versions upload missing worker name"
+      }
+    );
+  }
+  if (!compatibilityDate) {
+    const compatibilityDateStr = getTodaysCompatDate();
+    throw new UserError(
+      `A compatibility_date is required when uploading a Worker. Add the following to your ${configFileName(config2.configPath)} file:
+    \`\`\`
+    ${formatConfigSnippet({ compatibility_date: compatibilityDateStr }, config2.configPath, false)}
+    \`\`\`
+    Or you could pass it in your terminal as \`--compatibility-date ${compatibilityDateStr}\`
+See https://developers.cloudflare.com/workers/platform/compatibility-dates for more information.`,
+      {
+        telemetryMessage: props.command === "deploy" ? "missing compatibility date when deploying" : "versions upload missing compatibility date"
+      }
+    );
+  }
+  if (config2.wasm_modules && format32 === "modules") {
+    throw new UserError(
+      "You cannot configure [wasm_modules] with an ES module worker. Instead, import the .wasm module directly in your code",
+      { telemetryMessage: "wasm_modules with es module worker" }
+    );
+  }
+  if (config2.text_blobs && format32 === "modules") {
+    throw new UserError(
+      `You cannot configure [text_blobs] with an ES module worker. Instead, import the file directly in your code, and optionally configure \`[rules]\` in your ${configFileName(config2.configPath)} file`,
+      { telemetryMessage: "text_blobs with es module worker" }
+    );
+  }
+  if (config2.data_blobs && format32 === "modules") {
+    throw new UserError(
+      `You cannot configure [data_blobs] with an ES module worker. Instead, import the file directly in your code, and optionally configure \`[rules]\` in your ${configFileName(config2.configPath)} file`,
+      { telemetryMessage: "data_blobs with es module worker" }
+    );
+  }
+  if (props.command === "deploy") {
+    validateRoutes2(props.routes, props.assetsOptions);
+    assert5__default.default(
+      !config2.site || config2.site.bucket,
+      "A [site] definition requires a `bucket` field with a path to the site's assets directory."
+    );
+    if (!props.isWorkersSite && Boolean(props.legacyAssetPaths) && format32 === "service-worker") {
+      throw new UserError(
+        "You cannot use the service-worker format with an `assets` directory yet. For information on how to migrate to the module-worker format, see: https://developers.cloudflare.com/workers/learning/migrating-to-module-workers/",
+        { telemetryMessage: "deploy service worker assets unsupported" }
+      );
+    }
+  } else {
+    if (config2.containers && config2.containers.length > 0) {
+      logger.warn(
+        `Your Worker has Containers configured. Container configuration changes (such as image, max_instances, etc.) will not be gradually rolled out with versions. These changes will only take effect after running \`wrangler deploy\`.`
+      );
+    }
+  }
+  if (!dryRun) {
+    assert5__default.default(accountId, "Missing account ID");
+    await verifyWorkerMatchesCITag(config2, accountId, name2, config2.configPath);
+  }
+}
 function addWorkersSitesBindings(bindings2, namespace, manifest, format32) {
   const withSites = { ...bindings2 };
   if (namespace) {
@@ -149649,12 +149824,6 @@ function addWorkersSitesBindings(bindings2, namespace, manifest, format32) {
   return withSites;
 }
 async function deploy(props, config2, buildResult, callbacks) {
-  if (!props.name) {
-    throw new UserError(
-      'You need to provide a name when publishing a worker. Either pass it as a cli arg with `--name <name>` or in your config file as `name = "<name>"`',
-      { telemetryMessage: "deploy command missing worker name" }
-    );
-  }
   const {
     entry,
     name: name2,
@@ -149664,10 +149833,8 @@ async function deploy(props, config2, buildResult, callbacks) {
     accountId
   } = props;
   const assetsOptions = resolveAssetOptions(props, config2);
-  if (!props.dryRun) {
-    assert5__default.default(accountId, "Missing account ID");
-    await verifyWorkerMatchesCITag(config2, accountId, name2, config2.configPath);
-  }
+  await validateWorkerProps({ ...props, assetsOptions }, config2);
+  assert5__default.default(name2);
   const deployConfirm = getDeployConfirmFunction({
     strictMode: props.strict
   });
@@ -149675,7 +149842,6 @@ async function deploy(props, config2, buildResult, callbacks) {
   let versionId = null;
   let tags = [];
   let workerExists = true;
-  const allDeploymentRoutes = props.routes;
   if (!props.dispatchNamespace && accountId) {
     try {
       const serviceMetaData = await fetchResult(config2, `/accounts/${accountId}/workers/services/${name2}`);
@@ -149694,7 +149860,7 @@ async function deploy(props, config2, buildResult, callbacks) {
         const configDiff = getRemoteConfigDiff(remoteWorkerConfig, {
           ...config2,
           // We also want to include all the routes used for deployment
-          routes: allDeploymentRoutes
+          routes: props.routes
         });
         if (!configDiff.nonDestructive) {
           logger.warn(
@@ -149765,24 +149931,7 @@ Edits that have been made via the script API will be overridden by your local co
       }
     }
   }
-  if (!compatibilityDate) {
-    const compatibilityDateStr = getTodaysCompatDate();
-    throw new UserError(
-      `A compatibility_date is required when publishing. Add the following to your ${configFileName(config2.configPath)} file:
-    \`\`\`
-    ${formatConfigSnippet({ compatibility_date: compatibilityDateStr }, config2.configPath, false)}
-    \`\`\`
-    Or you could pass it in your terminal as \`--compatibility-date ${compatibilityDateStr}\`
-See https://developers.cloudflare.com/workers/platform/compatibility-dates for more information.`,
-      { telemetryMessage: "missing compatibility date when deploying" }
-    );
-  }
-  validateRoutes2(allDeploymentRoutes, assetsOptions);
   const scriptName = name2;
-  assert5__default.default(
-    !config2.site || config2.site.bucket,
-    "A [site] definition requires a `bucket` field with a path to the site's assets directory."
-  );
   const envName = props.env ?? "production";
   const start = Date.now();
   const useServiceEnvironments2 = props.useServiceEnvApiPath;
@@ -149801,30 +149950,6 @@ See https://developers.cloudflare.com/workers/platform/compatibility-dates for m
       return { versionId, workerTag };
     }
   }
-  if (!props.isWorkersSite && Boolean(props.legacyAssetPaths) && format32 === "service-worker") {
-    throw new UserError(
-      "You cannot use the service-worker format with an `assets` directory yet. For information on how to migrate to the module-worker format, see: https://developers.cloudflare.com/workers/learning/migrating-to-module-workers/",
-      { telemetryMessage: "deploy service worker assets unsupported" }
-    );
-  }
-  if (config2.wasm_modules && format32 === "modules") {
-    throw new UserError(
-      "You cannot configure [wasm_modules] with an ES module worker. Instead, import the .wasm module directly in your code",
-      { telemetryMessage: "deploy wasm modules with es module worker" }
-    );
-  }
-  if (config2.text_blobs && format32 === "modules") {
-    throw new UserError(
-      `You cannot configure [text_blobs] with an ES module worker. Instead, import the file directly in your code, and optionally configure \`[rules]\` in your ${configFileName(config2.configPath)} file`,
-      { telemetryMessage: "[text_blobs] with an ES module worker" }
-    );
-  }
-  if (config2.data_blobs && format32 === "modules") {
-    throw new UserError(
-      `You cannot configure [data_blobs] with an ES module worker. Instead, import the file directly in your code, and optionally configure \`[rules]\` in your ${configFileName(config2.configPath)} file`,
-      { telemetryMessage: "[data_blobs] with an ES module worker" }
-    );
-  }
   const isDryRun = props.dryRun;
   const normalisedContainerConfig = callbacks.getNormalizedContainerOptions ? await callbacks.getNormalizedContainerOptions(config2, props) : [];
   const {
@@ -150225,7 +150350,7 @@ See https://developers.cloudflare.com/workers/platform/compatibility-dates for m
     crons: props.triggers,
     useServiceEnvironments: useServiceEnvironments2,
     firstDeploy: !workerExists,
-    routes: allDeploymentRoutes
+    routes: props.routes
   });
   logger.log("Current Version ID:", versionId);
   return {
@@ -150236,12 +150361,6 @@ See https://developers.cloudflare.com/workers/platform/compatibility-dates for m
   };
 }
 async function versionsUpload(props, config2, buildResult, callbacks) {
-  if (!props.name) {
-    throw new UserError(
-      'You need to provide a name of your worker. Either pass it as a cli arg with `--name <name>` or in your config file as `name = "<name>"`',
-      { telemetryMessage: "versions upload missing worker name" }
-    );
-  }
   const {
     entry,
     name: name2,
@@ -150251,14 +150370,12 @@ async function versionsUpload(props, config2, buildResult, callbacks) {
     accountId
   } = props;
   const assetsOptions = resolveAssetOptions(props, config2);
-  if (!props.dryRun) {
-    assert5__default.default(accountId, "Missing account ID");
-    await verifyWorkerMatchesCITag(config2, accountId, name2, config2.configPath);
-  }
+  await validateWorkerProps(props, config2);
+  assert5__default.default(name2);
   let versionId = null;
   let workerTag = null;
   let tags = [];
-  if (accountId && name2) {
+  if (accountId) {
     try {
       const {
         default_environment: { script }
@@ -150298,56 +150415,11 @@ Edits that have been made via the API will be overridden by your local code and
       }
     }
   }
-  if (!compatibilityDate) {
-    const compatibilityDateStr = getTodaysCompatDate();
-    throw new UserError(
-      `A compatibility_date is required when uploading a Worker Version. Add the following to your ${configFileName(config2.configPath)} file:
-    \`\`\`
-	${formatConfigSnippet({ compatibility_date: compatibilityDateStr }, config2.configPath, false)}
-    \`\`\`
-    Or you could pass it in your terminal as \`--compatibility-date ${compatibilityDateStr}\`
-See https://developers.cloudflare.com/workers/platform/compatibility-dates for more information.`,
-      {
-        telemetryMessage: "versions upload missing compatibility date"
-      }
-    );
-  }
   const scriptName = name2;
-  if (config2.site && !config2.site.bucket) {
-    throw new UserError(
-      "A [site] definition requires a `bucket` field with a path to the site's assets directory.",
-      { telemetryMessage: "versions upload sites missing bucket" }
-    );
-  }
   const start = Date.now();
   const workerName = scriptName;
   const workerUrl = `/accounts/${accountId}/workers/scripts/${scriptName}`;
-  const { format: format32 } = entry;
   const projectRoot = entry.projectRoot;
-  if (config2.wasm_modules && format32 === "modules") {
-    throw new UserError(
-      "You cannot configure [wasm_modules] with an ES module worker. Instead, import the .wasm module directly in your code",
-      {
-        telemetryMessage: "versions upload wasm modules unsupported module worker"
-      }
-    );
-  }
-  if (config2.text_blobs && format32 === "modules") {
-    throw new UserError(
-      `You cannot configure [text_blobs] with an ES module worker. Instead, import the file directly in your code, and optionally configure \`[rules]\` in your ${configFileName(config2.configPath)} file`,
-      {
-        telemetryMessage: "versions upload text blobs unsupported module worker"
-      }
-    );
-  }
-  if (config2.data_blobs && format32 === "modules") {
-    throw new UserError(
-      `You cannot configure [data_blobs] with an ES module worker. Instead, import the file directly in your code, and optionally configure \`[rules]\` in your ${configFileName(config2.configPath)} file`,
-      {
-        telemetryMessage: "versions upload data blobs unsupported module worker"
-      }
-    );
-  }
   let hasPreview = false;
   const {
     modules,
@@ -150429,11 +150501,6 @@ See https://developers.cloudflare.com/workers/platform/compatibility-dates for m
     cache: config2.cache
     // cache is a versioned setting
   };
-  if (config2.containers && config2.containers.length > 0) {
-    logger.warn(
-      `Your Worker has Containers configured. Container configuration changes (such as image, max_instances, etc.) will not be gradually rolled out with versions. These changes will only take effect after running \`wrangler deploy\`.`
-    );
-  }
   await printBundleSize(
     { name: path3__namespace.default.basename(resolvedEntryPointPath), content },
     modules
@@ -150560,11 +150627,7 @@ See https://developers.cloudflare.com/workers/platform/compatibility-dates for m
     logger.log(`--dry-run: exiting now.`);
     return { versionId, workerTag };
   }
-  if (!accountId) {
-    throw new UserError("Missing accountId", {
-      telemetryMessage: "versions upload missing account id"
-    });
-  }
+  assert5__default.default(accountId);
   const uploadMs = Date.now() - start;
   logger.log("Uploaded", workerName, formatTime(uploadMs));
   logger.log("Worker Version ID:", versionId);
@@ -150677,7 +150740,7 @@ function validateNodeCompatMode(compatibilityDateStr = "2000-01-01", compatibili
   }
   return mode;
 }
-var import_undici4, import_command_exists2, import_dotenv, require_ignore, require_heap, require_heap2, require_difflib, require_difflib2, require_util9, require_styles2, require_has_flag2, require_supports_colors2, require_trap2, require_zalgo2, require_america2, require_zebra2, require_rainbow2, require_random2, require_colors2, require_safe2, require_colorize, require_lib4, __getOwnPropNames4, __commonJS22, __defProp5, __name22, UserError2, FatalError2, JsonFriendlyFatalError2, CharacterCodes2, ParseOptions2, ScanError2, SyntaxKind2, parse22, ParseErrorCode2, TomlError3, DATE_TIME_RE3, TomlDate3, INT_REGEX3, FLOAT_REGEX3, LEADING_ZERO3, ESCAPE_REGEX3, ESC_MAP3, KEY_PART_RE3, BARE_KEY3, dist_default5, ParseError2, units2, UNSUPPORTED_BOMS2, PATH_TO_DEPLOY_CONFIG2, esm_default5, AssetsSchema, KnownBindingSchema, UnsafeBindingSchema, BindingSchema, CacheSchema, SINGLETON_BINDING_TYPES, listFormatter, EnvSchema, ExportSchema, LimitsSchema, ObservabilitySchema, PlacementSchema, TailConsumerSchema, TriggerSchema, UnsafeSchema, BaseWorkerSchema, InputWorkerSchema, ModuleTypeSchema, ManifestSchema, require_dist2, ApplicationRollout2, BadRequestWithCodeError2, CreateApplicationRolloutRequest2, DeploymentNotFoundError2, ImageRegistryAlreadyExistsError2, ImageRegistryIsPublic2, ImageRegistryNotAllowedError2, ImageRegistryNotFoundError2, ImageRegistryProtocolAlreadyExists2, ImageRegistryProtocolIsReferencedError2, ImageRegistryProtocolNotFound2, ProvisionerConfiguration2, RolloutStep2, SecretNameAlreadyExists2, SecretNotFound2, SSHPublicKeyNotFoundError2, UpdateApplicationRolloutRequest2, runDockerCmd2, isDockerRunning2, verifyDockerInstalled2, queuesUrl, MAX_ROUTES_RULES, MAX_ROUTES_RULE_LENGTH, formatInvalidRoutes, MAX_ASSET_SIZE, CF_ASSETS_IGNORE_FILENAME, REDIRECTS_FILENAME, HEADERS_FILENAME, import_ignore, types, other_default, types2, standard_default, __classPrivateFieldGet7, _Mime_extensionToType, _Mime_typeToExtension, _Mime_typeToExtensions, Mime, Mime_default, src_default, normalizeFilePath, getContentType, hashFile, isJwtExpired, BULK_UPLOAD_CONCURRENCY, MAX_UPLOAD_ATTEMPTS, MAX_UPLOAD_GATEWAY_ERRORS, MAX_DIFF_LINES, syncAssets, buildAssetManifest, WORKER_JS_FILENAME, nameBindings, ONE_KIB_BYTES, MAX_GZIP_SIZE_BYTES, WORKER_NOT_FOUND_ERR_CODE, WORKER_LEGACY_ENVIRONMENT_NOT_FOUND_ERR_CODE, WORKFLOW_NOT_FOUND_CODE, import_json_diff, reorderableBindings, BLANK_INPUT, moduleTypeMimeType, suppressNotFoundError, esm_default22, getCloudflareAccountIdFromEnv2, isConnectedStatusExplained, ProvisionResourceHandler, R2Handler, AISearchNamespaceHandler, AgentMemoryNamespaceHandler, KVHandler, D1Handler, HANDLERS, INVALID_INHERIT_BINDING_CODE, InternalConfigSchema, StaticRoutingSchema, MetadataStaticRedirectEntry, MetadataRedirectEntry, MetadataStaticRedirects, MetadataRedirects, MetadataHeaderEntry, MetadataHeaders, RedirectsSchema, HeadersSchema, sourceMappingPrepareStackTrace, retrieveSourceMapOverride, placeholderError, CALL_SITE_REGEXP, CallSite, validateRoutes2, MAX_DNS_LABEL_LENGTH, HASH_LENGTH, ALIAS_VALIDATION_REGEX;
+var import_undici4, import_command_exists2, import_dotenv, require_ignore, require_heap, require_heap2, require_difflib, require_difflib2, require_util9, require_styles2, require_has_flag2, require_supports_colors2, require_trap2, require_zalgo2, require_america2, require_zebra2, require_rainbow2, require_random2, require_colors2, require_safe2, require_colorize, require_lib4, __getOwnPropNames4, __commonJS22, __defProp5, __name22, UserError2, FatalError2, JsonFriendlyFatalError2, CharacterCodes2, ParseOptions2, ScanError2, SyntaxKind2, parse22, ParseErrorCode2, TomlError3, DATE_TIME_RE3, TomlDate3, INT_REGEX3, FLOAT_REGEX3, LEADING_ZERO3, ESCAPE_REGEX3, ESC_MAP3, KEY_PART_RE3, BARE_KEY3, dist_default5, ParseError2, units2, UNSUPPORTED_BOMS2, PATH_TO_DEPLOY_CONFIG2, esm_default5, AssetsSchema, KnownBindingSchema, UnsafeBindingSchema, BindingSchema, CacheSchema, SINGLETON_BINDING_TYPES, listFormatter, EnvSchema, ExportSchema, LimitsSchema, ObservabilitySchema, PlacementSchema, TailConsumerSchema, TriggerSchema, UnsafeSchema, BaseWorkerSchema, InputWorkerSchema, ModuleTypeSchema, ManifestSchema, require_dist2, ApplicationRollout2, BadRequestWithCodeError2, CreateApplicationRolloutRequest2, DeploymentNotFoundError2, ImageRegistryAlreadyExistsError2, ImageRegistryIsPublic2, ImageRegistryNotAllowedError2, ImageRegistryNotFoundError2, ImageRegistryProtocolAlreadyExists2, ImageRegistryProtocolIsReferencedError2, ImageRegistryProtocolNotFound2, ProvisionerConfiguration2, RolloutStep2, SecretNameAlreadyExists2, SecretNotFound2, SSHPublicKeyNotFoundError2, UpdateApplicationRolloutRequest2, runDockerCmd2, isDockerRunning2, verifyDockerInstalled2, queuesUrl, MAX_ROUTES_RULES, MAX_ROUTES_RULE_LENGTH, formatInvalidRoutes, MAX_ASSET_SIZE, CF_ASSETS_IGNORE_FILENAME, REDIRECTS_FILENAME, HEADERS_FILENAME, import_ignore, types, other_default, types2, standard_default, __classPrivateFieldGet7, _Mime_extensionToType, _Mime_typeToExtension, _Mime_typeToExtensions, Mime, Mime_default, src_default, normalizeFilePath, getContentType, hashFile, isJwtExpired, BULK_UPLOAD_CONCURRENCY, MAX_UPLOAD_ATTEMPTS, MAX_UPLOAD_GATEWAY_ERRORS, MAX_DIFF_LINES, syncAssets, buildAssetManifest, WORKER_JS_FILENAME, nameBindings, ONE_KIB_BYTES, MAX_GZIP_SIZE_BYTES, WORKER_NOT_FOUND_ERR_CODE, WORKER_LEGACY_ENVIRONMENT_NOT_FOUND_ERR_CODE, WORKFLOW_NOT_FOUND_CODE, import_json_diff, reorderableBindings, BLANK_INPUT, moduleTypeMimeType, suppressNotFoundError, esm_default22, isConnectedStatusExplained, ProvisionResourceHandler, R2Handler, AISearchNamespaceHandler, AgentMemoryNamespaceHandler, KVHandler, D1Handler, HANDLERS, INVALID_INHERIT_BINDING_CODE, InternalConfigSchema, StaticRoutingSchema, MetadataStaticRedirectEntry, MetadataRedirectEntry, MetadataStaticRedirects, MetadataRedirects, MetadataHeaderEntry, MetadataHeaders, RedirectsSchema, HeadersSchema, sourceMappingPrepareStackTrace, retrieveSourceMapOverride, placeholderError, CALL_SITE_REGEXP, CallSite, getCloudflareAccountIdFromEnv2, validateRoutes2, MAX_DNS_LABEL_LENGTH, HASH_LENGTH, ALIAS_VALIDATION_REGEX;
 var init_dist9 = __esm({
   "../deploy-helpers/dist/index.mjs"() {
     init_import_meta_url();
@@ -151371,10 +151434,10 @@ var init_dist9 = __esm({
     require_difflib = __commonJS3({
       "../../node_modules/.pnpm/@ewoudenberg+difflib@0.1.0/node_modules/@ewoudenberg/difflib/lib/difflib.js"(exports2) {
         (function() {
-          var Differ, Heap, IS_CHARACTER_JUNK, IS_LINE_JUNK, SequenceMatcher, _any2, _arrayCmp, _calculateRatio, _countLeading, _formatRangeContext, _formatRangeUnified, _has, assert92, contextDiff, floor, getCloseMatches, max, min, ndiff, restore, unifiedDiff2, indexOf = [].indexOf;
+          var Differ, Heap, IS_CHARACTER_JUNK, IS_LINE_JUNK, SequenceMatcher, _any2, _arrayCmp, _calculateRatio, _countLeading, _formatRangeContext, _formatRangeUnified, _has, assert102, contextDiff, floor, getCloseMatches, max, min, ndiff, restore, unifiedDiff2, indexOf = [].indexOf;
           ({ floor, max, min } = Math);
           Heap = require_heap2();
-          assert92 = __require3("assert");
+          assert102 = __require3("assert");
           _calculateRatio = /* @__PURE__ */ __name3(function(matches, length) {
             if (length) {
               return 2 * matches / length;
@@ -151951,7 +152014,7 @@ var init_dist9 = __esm({
             }
             _plainReplace(a7, alo, ahi, b9, blo, bhi) {
               var first, g6, l7, len, len1, line, lines, m6, ref, second;
-              assert92(alo < ahi && blo < bhi);
+              assert102(alo < ahi && blo < bhi);
               if (bhi - blo < ahi - alo) {
                 first = this._dump("+", b9, blo, bhi);
                 second = this._dump("-", a7, alo, ahi);
@@ -156464,12 +156527,6 @@ Ensure all assets in your assets directory "${dir2}" conform with the Workers ma
     __name3(errIsScriptSize, "errIsScriptSize");
     __name(errIsStartupErr, "errIsStartupErr");
     __name3(errIsStartupErr, "errIsStartupErr");
-    getCloudflareAccountIdFromEnv2 = getEnvironmentVariableFactory({
-      variableName: "CLOUDFLARE_ACCOUNT_ID",
-      deprecatedName: "CF_ACCOUNT_ID"
-    });
-    __name(verifyWorkerMatchesCITag, "verifyWorkerMatchesCITag");
-    __name3(verifyWorkerMatchesCITag, "verifyWorkerMatchesCITag");
     __name(validateFileSecrets, "validateFileSecrets");
     __name3(validateFileSecrets, "validateFileSecrets");
     (class extends Error {
@@ -157118,6 +157175,12 @@ Ensure all assets in your assets directory "${dir2}" conform with the Workers ma
         return null;
       }
     };
+    getCloudflareAccountIdFromEnv2 = getEnvironmentVariableFactory({
+      variableName: "CLOUDFLARE_ACCOUNT_ID",
+      deprecatedName: "CF_ACCOUNT_ID"
+    });
+    __name(verifyWorkerMatchesCITag, "verifyWorkerMatchesCITag");
+    __name3(verifyWorkerMatchesCITag, "verifyWorkerMatchesCITag");
     validateRoutes2 = /* @__PURE__ */ __name3((routes, assets) => {
       const invalidRoutes = {};
       const mountedAssetRoutes = [];
@@ -157172,6 +157235,8 @@ ${mountedAssetRoutes.map((route) => {
         );
       }
     }, "validateRoutes");
+    __name(validateWorkerProps, "validateWorkerProps");
+    __name3(validateWorkerProps, "validateWorkerProps");
     __name(addWorkersSitesBindings, "addWorkersSitesBindings");
     __name3(addWorkersSitesBindings, "addWorkersSitesBindings");
     __name(deploy, "deploy");
@@ -159381,7 +159446,7 @@ var init_dist10 = __esm({
   }
 });
 
-// ../../node_modules/.pnpm/am-i-vibing@0.4.0/node_modules/am-i-vibing/dist/detector-Boc_-HQ9.mjs
+// ../../node_modules/.pnpm/am-i-vibing@0.5.0/node_modules/am-i-vibing/dist/detector-1yx2Hoe0.mjs
 function checkEnvVar(envVarDef, env7 = process.env) {
   const [envVar, expectedValue] = typeof envVarDef === "string" ? [envVarDef, void 0] : envVarDef;
   const actualValue = env7[envVar];
@@ -159455,8 +159520,8 @@ function detectAgenticEnvironment(envOrOptions, legacyAncestry) {
   };
 }
 var providers;
-var init_detector_Boc_HQ9 = __esm({
-  "../../node_modules/.pnpm/am-i-vibing@0.4.0/node_modules/am-i-vibing/dist/detector-Boc_-HQ9.mjs"() {
+var init_detector_1yx2Hoe0 = __esm({
+  "../../node_modules/.pnpm/am-i-vibing@0.5.0/node_modules/am-i-vibing/dist/detector-1yx2Hoe0.mjs"() {
     init_import_meta_url();
     init_dist10();
     providers = [
@@ -159638,6 +159703,12 @@ var init_detector_Boc_HQ9 = __esm({
         name: "Factory Droid",
         type: "agent",
         processChecks: ["droid"]
+      },
+      {
+        id: "pi",
+        name: "Pi",
+        type: "agent",
+        envVars: [["PI_CODING_AGENT", "true"]]
       }
     ];
     __name(checkEnvVar, "checkEnvVar");
@@ -159650,11 +159721,11 @@ var init_detector_Boc_HQ9 = __esm({
   }
 });
 
-// ../../node_modules/.pnpm/am-i-vibing@0.4.0/node_modules/am-i-vibing/dist/index.mjs
+// ../../node_modules/.pnpm/am-i-vibing@0.5.0/node_modules/am-i-vibing/dist/index.mjs
 var init_dist11 = __esm({
-  "../../node_modules/.pnpm/am-i-vibing@0.4.0/node_modules/am-i-vibing/dist/index.mjs"() {
+  "../../node_modules/.pnpm/am-i-vibing@0.5.0/node_modules/am-i-vibing/dist/index.mjs"() {
     init_import_meta_url();
-    init_detector_Boc_HQ9();
+    init_detector_1yx2Hoe0();
   }
 });
 function write(p7, bytes) {
@@ -197161,6 +197232,52 @@ var init_limits2 = __esm({
     __name(ensureImageFitsLimits, "ensureImageFitsLimits");
   }
 });
+function getRepositoryOnly(externalAccountId, imageTag) {
+  return resolveImageName(externalAccountId, imageTag).replace(DIGEST_SUFFIX_REGEXP, "").replace(TAG_SUFFIX_REGEXP, "");
+}
+function imageRefWithDigest(externalAccountId, imageTag, digest) {
+  if (!DIGEST_VALUE_REGEXP.test(digest)) {
+    throw new Error(
+      `Expected image digest to match algorithm:hex format, got ${digest}`
+    );
+  }
+  return `${getRepositoryOnly(externalAccountId, imageTag)}@${digest}`;
+}
+function findManifestDigest(manifestOutput) {
+  const parsedManifest = JSON.parse(manifestOutput);
+  const digest = parsedManifest?.Descriptor?.digest;
+  if (typeof digest !== "string" || digest.length === 0) {
+    throw new Error(
+      `Expected docker manifest inspect output to include Descriptor.digest, got ${manifestOutput}`
+    );
+  }
+  return digest;
+}
+function findRemoteDigest(repoDigestsJson, externalAccountId, imageTag) {
+  const parsedDigests = JSON.parse(repoDigestsJson);
+  if (!Array.isArray(parsedDigests)) {
+    throw new Error(
+      `Expected RepoDigests from docker inspect to be an array but got ${JSON.stringify(parsedDigests)}`
+    );
+  }
+  const repositoryOnly = getRepositoryOnly(externalAccountId, imageTag);
+  logger2.debug("respositoryOnly:", repositoryOnly);
+  const digest = parsedDigests.find((d8) => {
+    if (typeof d8 !== "string" || !d8.includes("@")) {
+      return false;
+    }
+    const resolved = resolveImageName(externalAccountId, d8);
+    logger2.debug(`Comparing ${resolved.split("@")[0]} to ${repositoryOnly}`);
+    return typeof d8 === "string" && resolved.split("@")[0] === repositoryOnly;
+  });
+  if (!digest) {
+    throw new Error(
+      `Could not find a digest for the image ${repositoryOnly}. Found digests: ${parsedDigests.join(", ")}`
+    );
+  }
+  const [, hash3] = digest.split("@");
+  return imageRefWithDigest(externalAccountId, imageTag, hash3);
+}
 async function buildAndMaybePush(args, pathToDocker, push3, containerConfig) {
   try {
     const imageTag = args.tag;
@@ -197199,44 +197316,20 @@ async function buildAndMaybePush(args, pathToDocker, push3, containerConfig) {
         getCloudflareContainerRegistry()
       );
       try {
-        const [digests] = imageInfo.split(" ");
-        const parsedDigests = JSON.parse(digests);
-        if (!Array.isArray(parsedDigests)) {
-          throw new Error(
-            `Expected RepoDigests from docker inspect to be an array but got ${JSON.stringify(parsedDigests)}`
-          );
-        }
-        const imageUrl = new URL(
-          `http://${resolveImageName(account.external_account_id, imageTag)}`
-        );
-        const repositoryOnly = `${imageUrl.host}${imageUrl.pathname.split(":")[0]}`;
-        logger2.debug("respositoryOnly:", repositoryOnly);
-        const digest = parsedDigests.find((d8) => {
-          const resolved = resolveImageName(account.external_account_id, d8);
-          logger2.debug(
-            `Comparing ${resolved.split("@")[0]} to ${repositoryOnly}`
-          );
-          return typeof d8 === "string" && resolved.split("@")[0] === repositoryOnly;
-        });
-        if (!digest) {
-          throw new Error(
-            `Could not find a digest for the image ${repositoryOnly}. Found digests: ${parsedDigests.join(", ")}`
-          );
-        }
-        const [image, hash3] = digest.split("@");
-        const resolvedImage = resolveImageName(
+        const remoteDigest2 = findRemoteDigest(
+          imageInfo,
           account.external_account_id,
-          image
+          imageTag
         );
-        const remoteDigest = `${resolvedImage}@${hash3}`;
+        const [, hash3] = remoteDigest2.split("@");
         logger2.debug(
-          `'docker manifest inspect -v ${resolveImageName(account.external_account_id, remoteDigest)}:`
+          `'docker manifest inspect -v ${resolveImageName(account.external_account_id, remoteDigest2)}:`
         );
         const remoteManifest = runDockerCmdWithOutput(pathToDocker, [
           "manifest",
           "inspect",
           "-v",
-          resolveImageName(account.external_account_id, remoteDigest)
+          resolveImageName(account.external_account_id, remoteDigest2)
         ]);
         const parsedRemoteManifest = JSON.parse(remoteManifest);
         if (parsedRemoteManifest.Descriptor.digest === hash3) {
@@ -197245,7 +197338,7 @@ async function buildAndMaybePush(args, pathToDocker, push3, containerConfig) {
             `Untagging built image: ${args.tag} since there was no change.`
           );
           await runDockerCmd(pathToDocker, ["image", "rm", imageTag]);
-          return { remoteDigest };
+          return { remoteDigest: remoteDigest2 };
         }
       } catch (error53) {
         if (error53 instanceof Error) {
@@ -197263,6 +197356,36 @@ async function buildAndMaybePush(args, pathToDocker, push3, containerConfig) {
       );
       await runDockerCmd(pathToDocker, ["tag", imageTag, namespacedImageTag]);
       await runDockerCmd(pathToDocker, ["push", namespacedImageTag]);
+      let remoteDigest;
+      try {
+        const pushedImageInfo = await dockerImageInspect(pathToDocker, {
+          imageTag: namespacedImageTag,
+          formatString: "{{ json .RepoDigests }}"
+        });
+        remoteDigest = findRemoteDigest(
+          pushedImageInfo,
+          account.external_account_id,
+          namespacedImageTag
+        );
+      } catch (error53) {
+        if (error53 instanceof Error) {
+          logger2.debug(
+            `Inspecting pushed image ${namespacedImageTag} failed with error: ${error53.message}`
+          );
+        }
+        const remoteManifest = runDockerCmdWithOutput(pathToDocker, [
+          "manifest",
+          "inspect",
+          "-v",
+          namespacedImageTag
+        ]);
+        remoteDigest = imageRefWithDigest(
+          account.external_account_id,
+          namespacedImageTag,
+          findManifestDigest(remoteManifest)
+        );
+      }
+      return { remoteDigest };
     }
     return { newTag: imageTag };
   } catch (error53) {
@@ -197341,7 +197464,7 @@ async function checkImagePlatform(pathToDocker, imageTag, expectedPlatform = "li
     );
   }
 }
-var cloudchamberBuildCommand, cloudchamberPushCommand;
+var DIGEST_SUFFIX_REGEXP, DIGEST_VALUE_REGEXP, TAG_SUFFIX_REGEXP, cloudchamberBuildCommand, cloudchamberPushCommand;
 var init_build2 = __esm({
   "src/cloudchamber/build.ts"() {
     init_import_meta_url();
@@ -197353,6 +197476,13 @@ var init_build2 = __esm({
     init_common();
     init_limits2();
     init_locations7();
+    DIGEST_SUFFIX_REGEXP = /@[A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*:[a-fA-F0-9]{32,}$/;
+    DIGEST_VALUE_REGEXP = /^[A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*:[a-fA-F0-9]{32,}$/;
+    TAG_SUFFIX_REGEXP = /:[\w][\w.-]{0,127}$/;
+    __name(getRepositoryOnly, "getRepositoryOnly");
+    __name(imageRefWithDigest, "imageRefWithDigest");
+    __name(findManifestDigest, "findManifestDigest");
+    __name(findRemoteDigest, "findRemoteDigest");
     __name(buildAndMaybePush, "buildAndMaybePush");
     __name(buildCommand, "buildCommand");
     __name(pushCommand, "pushCommand");
@@ -197994,7 +198124,7 @@ async function deployContainers(config2, normalisedContainerConfig, { versionId,
       imageRef = { newTag: container.image_uri };
     }
     if (boundDOs.has(container.class_name)) {
-      maybeVersionInfo ??= await fetchVersion2(
+      maybeVersionInfo ??= await fetchUploadedVersion(
         config2,
         accountId,
         scriptName,
@@ -198040,6 +198170,19 @@ async function deployContainers(config2, normalisedContainerConfig, { versionId,
     }
   }
 }
+async function fetchUploadedVersion(config2, accountId, scriptName, versionId) {
+  for (let attempt = 0; attempt < 5; attempt++) {
+    try {
+      return await fetchVersion2(config2, accountId, scriptName, versionId);
+    } catch (error53) {
+      if (!(error53 instanceof APIError) || error53.code !== 100146 || attempt === 4) {
+        throw error53;
+      }
+      await timersPromises.setTimeout(500);
+    }
+  }
+  throw new Error("Unable to fetch uploaded Worker version");
+}
 async function listDurableObjects(complianceConfig, accountId) {
   return await fetchResult2(
     complianceConfig,
@@ -198156,7 +198299,7 @@ async function apply(args, containerConfig, config2) {
   const prevApp = existingApplications.find(
     (app) => app.name === containerConfig.name
   );
-  const imageRef = "remoteDigest" in args.imageRef ? prevApp?.configuration.image ?? args.imageRef.remoteDigest : args.imageRef.newTag;
+  const imageRef = "remoteDigest" in args.imageRef ? args.imageRef.remoteDigest : args.imageRef.newTag;
   log(dim("Container application changes\n"));
   const accountId = await getOrSelectAccountId(config2);
   const appConfig = mergeIfUnsafe(
@@ -198322,6 +198465,7 @@ var init_deploy = __esm({
     init_api2();
     init_containers2();
     __name(deployContainers, "deployContainers");
+    __name(fetchUploadedVersion, "fetchUploadedVersion");
     __name(listDurableObjects, "listDurableObjects");
     __name(mergeDeep2, "mergeDeep");
     __name(isObject2, "isObject");
@@ -198464,8 +198608,12 @@ ${formatError2(err)}`,
     }, "configRolloutStepsToAPI");
   }
 });
-
-// src/containers/registries.ts
+function providerSpecificCredentialFlagConflicts(flagName) {
+  return [
+    "public-credential",
+    ...providerSpecificCredentialFlagNames.filter((name2) => name2 !== flagName)
+  ];
+}
 async function registryConfigureCommand(configureArgs, config2) {
   startSection("Configure a container registry");
   const registryType = getAndValidateRegistryType(configureArgs.DOMAIN);
@@ -198476,9 +198624,10 @@ async function registryConfigureCommand(configureArgs, config2) {
     endSection("No configuration required");
     return;
   }
-  const publicCredential = configureArgs.awsAccessKeyId ?? configureArgs.dockerhubUsername ?? configureArgs.publicCredential;
+  validateProviderSpecificCredentialFlags(configureArgs, registryType.type);
+  const publicCredential = configureArgs.awsAccessKeyId ?? configureArgs.dockerhubUsername ?? configureArgs.garEmail ?? configureArgs.publicCredential;
   if (!publicCredential) {
-    const arg = registryType.type === "DockerHub" /* DOCKER_HUB */ ? "dockerhub-username" : registryType.type === "ECR" /* ECR */ ? "aws-access-key-id" : "public-credential";
+    const arg = registryType.type === "DockerHub" /* DOCKER_HUB */ ? "dockerhub-username" : registryType.type === "ECR" /* ECR */ ? "aws-access-key-id" : registryType.type === "GAR" /* GAR */ ? "gar-email" : "public-credential";
     throw new UserError(`Missing required argument: ${arg}`, {
       telemetryMessage: "containers registries configure missing public credential"
     });
@@ -198556,8 +198705,10 @@ async function registryConfigureCommand(configureArgs, config2) {
     if (!secretExists) {
       log(`Getting ${registryType.secretType}...
 `);
-      const privateCredential = await promptForRegistryPrivateCredential(
-        registryType.secretType
+      const privateCredential = await resolvePrivateCredential(
+        registryType.type,
+        registryType.secretType,
+        publicCredential
       );
       await promiseSpinner(
         createSecret(config2, accountId, secretStoreId, {
@@ -198569,6 +198720,11 @@ async function registryConfigureCommand(configureArgs, config2) {
       );
       log(
         `Container-scoped secret "${secretName}" created in Secrets Store.
+`
+      );
+    } else if (registryType.type === "GAR" /* GAR */) {
+      log(
+        `Reusing existing secret "${secretName}". Wrangler cannot verify it matches --gar-email "${publicCredential}"; the email is validated against the key when images are pulled.
 `
       );
     }
@@ -198579,8 +198735,10 @@ async function registryConfigureCommand(configureArgs, config2) {
   } else {
     log(`Getting ${registryType.secretType}...
 `);
-    private_credential = await promptForRegistryPrivateCredential(
-      registryType.secretType
+    private_credential = await resolvePrivateCredential(
+      registryType.type,
+      registryType.secretType,
+      publicCredential
     );
   }
   try {
@@ -198688,6 +198846,60 @@ async function promptForRegistryPrivateCredential(secretType) {
   }
   return secret;
 }
+function validateProviderSpecificCredentialFlags(configureArgs, registryType) {
+  for (const flag of providerSpecificCredentialFlags) {
+    if (configureArgs[flag.argName] !== void 0 && registryType !== flag.registryType) {
+      throw new UserError(
+        `--${flag.flagName} can only be used with ${flag.registryName}.`,
+        { telemetryMessage: flag.telemetryMessage }
+      );
+    }
+  }
+}
+async function resolvePrivateCredential(registryType, secretType, publicCredential) {
+  if (registryType === "GAR" /* GAR */) {
+    const rawKey = await getGarServiceAccountKey(secretType);
+    return validateAndEncodeGarKey(rawKey, publicCredential);
+  }
+  return promptForRegistryPrivateCredential(secretType);
+}
+async function getGarServiceAccountKey(secretType) {
+  if (isNonInteractiveOrCI2()) {
+    const stdinInput = trimTrailingWhitespace(await readFromStdin());
+    if (!stdinInput) {
+      throw new UserError(
+        "No input provided. In non-interactive mode, pipe the Google service account key (a file path, raw JSON, or base64) via stdin.",
+        {
+          telemetryMessage: "containers registries configure missing gar key input"
+        }
+      );
+    }
+    return fs11.existsSync(stdinInput) ? readGarServiceAccountKeyFile(stdinInput) : stdinInput;
+  }
+  const input = await prompt2(
+    `Enter ${secretType ?? "secret"} (file path or base64):`,
+    { isSecret: true }
+  );
+  if (!input) {
+    throw new UserError("Secret cannot be empty.", {
+      telemetryMessage: "containers registries configure empty secret"
+    });
+  }
+  const trimmed = input.trim();
+  return fs11.existsSync(trimmed) ? readGarServiceAccountKeyFile(trimmed) : input;
+}
+function readGarServiceAccountKeyFile(path84) {
+  try {
+    return readFileSync(path84);
+  } catch {
+    throw new UserError(
+      `Could not read the Google service account key file at "${path84}".`,
+      {
+        telemetryMessage: "containers registries configure gar key file unreadable"
+      }
+    );
+  }
+}
 async function registryListCommand(listArgs2) {
   if (!listArgs2.json && !isNonInteractiveOrCI2()) {
     startSection("List configured container registries");
@@ -198828,7 +199040,7 @@ async function registryCredentialsCommand(credentialsArgs) {
     logger2.log(credentials.password);
   }
 }
-var registryConfigureArgs, registryListArgs, registryDeleteArgs, containersRegistriesNamespace, containersRegistriesConfigureCommand, containersRegistriesListCommand, containersRegistriesDeleteCommand, containersRegistriesCredentialsCommand;
+var providerSpecificCredentialFlags, providerSpecificCredentialFlagNames, registryConfigureArgs, registryListArgs, registryDeleteArgs, containersRegistriesNamespace, containersRegistriesConfigureCommand, containersRegistriesListCommand, containersRegistriesDeleteCommand, containersRegistriesCredentialsCommand;
 var init_registries2 = __esm({
   "src/containers/registries.ts"() {
     init_import_meta_url();
@@ -198846,6 +199058,33 @@ var init_registries2 = __esm({
     init_std();
     init_deploy();
     init_containers2();
+    providerSpecificCredentialFlags = [
+      {
+        argName: "awsAccessKeyId",
+        flagName: "aws-access-key-id",
+        registryType: "ECR" /* ECR */,
+        registryName: "AWS ECR",
+        telemetryMessage: "containers registries configure aws access key id unsupported registry"
+      },
+      {
+        argName: "dockerhubUsername",
+        flagName: "dockerhub-username",
+        registryType: "DockerHub" /* DOCKER_HUB */,
+        registryName: "DockerHub",
+        telemetryMessage: "containers registries configure dockerhub username unsupported registry"
+      },
+      {
+        argName: "garEmail",
+        flagName: "gar-email",
+        registryType: "GAR" /* GAR */,
+        registryName: "Google Artifact Registry",
+        telemetryMessage: "containers registries configure gar email unsupported registry"
+      }
+    ];
+    providerSpecificCredentialFlagNames = providerSpecificCredentialFlags.map(
+      (flag) => flag.flagName
+    );
+    __name(providerSpecificCredentialFlagConflicts, "providerSpecificCredentialFlagConflicts");
     registryConfigureArgs = {
       DOMAIN: {
         describe: "Domain to configure for the registry",
@@ -198857,19 +199096,26 @@ var init_registries2 = __esm({
         demandOption: false,
         hidden: true,
         deprecated: true,
-        conflicts: ["dockerhub-username", "aws-access-key-id"]
+        conflicts: providerSpecificCredentialFlagNames
       },
       "aws-access-key-id": {
         type: "string",
         description: "When configuring Amazon ECR, `AWS_ACCESS_KEY_ID`",
         demandOption: false,
-        conflicts: ["public-credential", "dockerhub-username"]
+        conflicts: providerSpecificCredentialFlagConflicts("aws-access-key-id")
       },
       "dockerhub-username": {
         type: "string",
         description: "When configuring DockerHub, the DockerHub username",
         demandOption: false,
-        conflicts: ["public-credential", "aws-access-key-id"]
+        conflicts: providerSpecificCredentialFlagConflicts("dockerhub-username")
+      },
+      "gar-email": {
+        type: "string",
+        description: "When configuring Google Artifact Registry, the Google service account email. Must match the `client_email` in the service account key.",
+        demandOption: false,
+        requiresArg: true,
+        conflicts: providerSpecificCredentialFlagConflicts("gar-email")
       },
       "secret-store-id": {
         type: "string",
@@ -198900,6 +199146,10 @@ var init_registries2 = __esm({
     __name(promptForSecretName, "promptForSecretName");
     __name(resolveSecretSelection, "resolveSecretSelection");
     __name(promptForRegistryPrivateCredential, "promptForRegistryPrivateCredential");
+    __name(validateProviderSpecificCredentialFlags, "validateProviderSpecificCredentialFlags");
+    __name(resolvePrivateCredential, "resolvePrivateCredential");
+    __name(getGarServiceAccountKey, "getGarServiceAccountKey");
+    __name(readGarServiceAccountKeyFile, "readGarServiceAccountKeyFile");
     registryListArgs = {
       json: {
         type: "boolean",
@@ -232500,6 +232750,9 @@ function normalizeRelativePath(p7) {
   }
   return normalized;
 }
+function escapeIdentifier(id) {
+  return `"${id.replace(/"/g, '""')}"`;
+}
 async function getMigrationsPath({
   projectPath,
   migrationsDir,
@@ -232675,6 +232928,7 @@ var init_helpers6 = __esm({
     __name(resolveMigrationsConfig, "resolveMigrationsConfig");
     __name(stripDirPrefix, "stripDirPrefix");
     __name(normalizeRelativePath, "normalizeRelativePath");
+    __name(escapeIdentifier, "escapeIdentifier");
     __name(getMigrationsPath, "getMigrationsPath");
     __name(getUnappliedMigrations, "getUnappliedMigrations");
     listAppliedMigrations = /* @__PURE__ */ __name(async ({
@@ -232686,6 +232940,7 @@ var init_helpers6 = __esm({
       persistTo,
       preview
     }) => {
+      const escapedTableName = escapeIdentifier(migrationsTableName);
       const response = await executeSql({
         local,
         remote,
@@ -232694,7 +232949,7 @@ var init_helpers6 = __esm({
         shouldPrompt: !isNonInteractiveOrCI2(),
         persistTo,
         command: `SELECT *
-		FROM ${migrationsTableName}
+		FROM ${escapedTableName}
 		ORDER BY id`,
         file: void 0,
         json: true,
@@ -232721,6 +232976,7 @@ var init_helpers6 = __esm({
       persistTo,
       preview
     }) => {
+      const escapedTableName = escapeIdentifier(migrationsTableName);
       return executeSql({
         local,
         remote,
@@ -232728,7 +232984,7 @@ var init_helpers6 = __esm({
         name: name2,
         shouldPrompt: !isNonInteractiveOrCI2(),
         persistTo,
-        command: `CREATE TABLE IF NOT EXISTS ${migrationsTableName}(
+        command: `CREATE TABLE IF NOT EXISTS ${escapedTableName}(
 		id         INTEGER PRIMARY KEY AUTOINCREMENT,
 		name       TEXT UNIQUE,
 		applied_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP NOT NULL
@@ -232870,9 +233126,12 @@ Your database may not be available to serve requests during the migration, conti
             `${migrationsPath}/${migration.name}`,
             "utf8"
           );
+          const escapedTableName = escapeIdentifier(
+            migrationsConfig.migrationsTableName
+          );
           query += `
-								INSERT INTO ${migrationsConfig.migrationsTableName} (name)
-								values ('${migration.name}');
+								INSERT INTO ${escapedTableName} (name)
+								values ('${migration.name.replace(/'/g, "''")}');
 						`;
           let success3 = true;
           let errorNotes = [];